Series comparison

-[PULL 00/46] tcg patch queue
+[PULL 00/72] tcg patch queue
-The following changes since commit d0dddab40e472ba62b5f43f11cc7dba085dabe71:
+The following changes since commit aa3a285b5bc56a4208b3b57d4a55291e9c260107:
-  Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging (2021-02-05 15:27:02 +0000)
+  Merge tag 'mem-2024-12-21' of https://github.com/davidhildenbrand/qemu into staging (2024-12-22 14:33:27 -0500)
 are available in the Git repository at:
-  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20210205
+  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20241224
-for you to fetch changes up to fb6916dd6ca8bb4b42d44baba9c67ecaf2279577:
+for you to fetch changes up to e4a8e093dc74be049f4829831dce76e5edab0003:
-  accel: introduce AccelCPUClass extending CPUClass (2021-02-05 10:24:15 -1000)
+  accel/tcg: Move gen_intermediate_code to TCGCPUOps.translate_core (2024-12-24 08:32:15 -0800)
 ----------------------------------------------------------------
-TCGCPUOps cleanups (claudio)
+tcg/optimize: Remove in-flight mask data from OptContext
-tcg/s390 compare fix (phil)
+fpu: Add float*_muladd_scalbn
-tcg/aarch64 rotli_vec fix
+fpu: Remove float_muladd_halve_result
-tcg/tci cleanups and fixes
+fpu: Add float_round_nearest_even_max
 fpu: Add float_muladd_suppress_add_product_zero
 target/hexagon: Use float32_muladd
 accel/tcg: Move gen_intermediate_code to TCGCPUOps.translate_core
 ----------------------------------------------------------------
-Claudio Fontana (13):
+Ilya Leoshkevich (1):
-      target/riscv: remove CONFIG_TCG, as it is always TCG
+      tests/tcg: Do not use inttypes.h in multiarch/system/memory.c
       accel/tcg: split TCG-only code from cpu_exec_realizefn
       target/arm: do not use cc->do_interrupt for KVM directly
       cpu: move cc->do_interrupt to tcg_ops
       cpu: move cc->transaction_failed to tcg_ops
       cpu: move do_unaligned_access to tcg_ops
       physmem: make watchpoint checking code TCG-only
       cpu: move adjust_watchpoint_address to tcg_ops
       cpu: move debug_check_watchpoint to tcg_ops
       cpu: tcg_ops: move to tcg-cpu-ops.h, keep a pointer in CPUClass
       accel: extend AccelState and AccelClass to user-mode
       accel: replace struct CpusAccel with AccelOpsClass
       accel: introduce AccelCPUClass extending CPUClass
-Eduardo Habkost (5):
+Pierrick Bouvier (1):
-      cpu: Introduce TCGCpuOperations struct
+      plugins: optimize cpu_index code generation
       cpu: Move synchronize_from_tb() to tcg_ops
       cpu: Move cpu_exec_* to tcg_ops
       cpu: Move tlb_fill to tcg_ops
       cpu: Move debug_excp_handler to tcg_ops
-Philippe Mathieu-Daudé (2):
+Richard Henderson (70):
-      tcg/s390: Fix compare instruction from extended-immediate facility
+      tcg/optimize: Split out finish_bb, finish_ebb
-      exec/cpu-defs: Remove TCG backends dependency
+      tcg/optimize: Split out fold_affected_mask
       tcg/optimize: Copy mask writeback to fold_masks
       tcg/optimize: Split out fold_masks_zs
       tcg/optimize: Augment s_mask from z_mask in fold_masks_zs
       tcg/optimize: Change representation of s_mask
       tcg/optimize: Use finish_folding in fold_add, fold_add_vec, fold_addsub2
       tcg/optimize: Introduce const value accessors for TempOptInfo
       tcg/optimize: Use fold_masks_zs in fold_and
       tcg/optimize: Use fold_masks_zs in fold_andc
       tcg/optimize: Use fold_masks_zs in fold_bswap
       tcg/optimize: Use fold_masks_zs in fold_count_zeros
       tcg/optimize: Use fold_masks_z in fold_ctpop
       tcg/optimize: Use fold_and and fold_masks_z in fold_deposit
       tcg/optimize: Compute sign mask in fold_deposit
       tcg/optimize: Use finish_folding in fold_divide
       tcg/optimize: Use finish_folding in fold_dup, fold_dup2
       tcg/optimize: Use fold_masks_s in fold_eqv
       tcg/optimize: Use fold_masks_z in fold_extract
       tcg/optimize: Use finish_folding in fold_extract2
       tcg/optimize: Use fold_masks_zs in fold_exts
       tcg/optimize: Use fold_masks_z in fold_extu
       tcg/optimize: Use fold_masks_zs in fold_movcond
       tcg/optimize: Use finish_folding in fold_mul*
       tcg/optimize: Use fold_masks_s in fold_nand
       tcg/optimize: Use fold_masks_z in fold_neg_no_const
       tcg/optimize: Use fold_masks_s in fold_nor
       tcg/optimize: Use fold_masks_s in fold_not
       tcg/optimize: Use fold_masks_zs in fold_or
       tcg/optimize: Use fold_masks_zs in fold_orc
       tcg/optimize: Use fold_masks_zs in fold_qemu_ld
       tcg/optimize: Return true from fold_qemu_st, fold_tcg_st
       tcg/optimize: Use finish_folding in fold_remainder
       tcg/optimize: Distinguish simplification in fold_setcond_zmask
       tcg/optimize: Use fold_masks_z in fold_setcond
       tcg/optimize: Use fold_masks_s in fold_negsetcond
       tcg/optimize: Use fold_masks_z in fold_setcond2
       tcg/optimize: Use finish_folding in fold_cmp_vec
       tcg/optimize: Use finish_folding in fold_cmpsel_vec
       tcg/optimize: Use fold_masks_zs in fold_sextract
       tcg/optimize: Use fold_masks_zs, fold_masks_s in fold_shift
       tcg/optimize: Simplify sign bit test in fold_shift
       tcg/optimize: Use finish_folding in fold_sub, fold_sub_vec
       tcg/optimize: Use fold_masks_zs in fold_tcg_ld
       tcg/optimize: Use finish_folding in fold_tcg_ld_memcopy
       tcg/optimize: Use fold_masks_zs in fold_xor
       tcg/optimize: Use finish_folding in fold_bitsel_vec
       tcg/optimize: Use finish_folding as default in tcg_optimize
       tcg/optimize: Remove z_mask, s_mask from OptContext
       tcg/optimize: Re-enable sign-mask optimizations
       tcg/optimize: Move fold_bitsel_vec into alphabetic sort
       tcg/optimize: Move fold_cmp_vec, fold_cmpsel_vec into alphabetic sort
       softfloat: Add float{16,32,64}_muladd_scalbn
       target/arm: Use float*_muladd_scalbn
       target/sparc: Use float*_muladd_scalbn
       softfloat: Remove float_muladd_halve_result
       softfloat: Add float_round_nearest_even_max
       softfloat: Add float_muladd_suppress_add_product_zero
       target/hexagon: Use float32_mul in helper_sfmpy
       target/hexagon: Use float32_muladd for helper_sffma
       target/hexagon: Use float32_muladd for helper_sffms
       target/hexagon: Use float32_muladd_scalbn for helper_sffma_sc
       target/hexagon: Use float32_muladd for helper_sffm[as]_lib
       target/hexagon: Remove internal_fmafx
       target/hexagon: Expand GEN_XF_ROUND
       target/hexagon: Remove Float
       target/hexagon: Remove Double
       target/hexagon: Use mulu64 for int128_mul_6464
       target/hexagon: Simplify internal_mpyhh setup
       accel/tcg: Move gen_intermediate_code to TCGCPUOps.translate_core
-Richard Henderson (24):
+ include/exec/translator.h           |  14 -
-      tcg/aarch64: Do not convert TCGArg to temps that are not temps
+ include/fpu/softfloat-types.h       |   2 +
-      configure: Fix --enable-tcg-interpreter
+ include/fpu/softfloat.h             |  14 +-
-      tcg/tci: Make tci_tb_ptr thread-local
+ include/hw/core/tcg-cpu-ops.h       |  13 +
-      tcg/tci: Inline tci_write_reg32s into the only caller
+ target/alpha/cpu.h                  |   2 +
-      tcg/tci: Inline tci_write_reg8 into its callers
+ target/arm/internals.h              |   2 +
-      tcg/tci: Inline tci_write_reg16 into the only caller
+ target/avr/cpu.h                    |   2 +
-      tcg/tci: Inline tci_write_reg32 into all callers
+ target/hexagon/cpu.h                |   2 +
-      tcg/tci: Inline tci_write_reg64 into 64-bit callers
+ target/hexagon/fma_emu.h            |   3 -
-      tcg/tci: Merge INDEX_op_ld8u_{i32,i64}
+ target/hppa/cpu.h                   |   2 +
-      tcg/tci: Merge INDEX_op_ld8s_{i32,i64}
+ target/i386/tcg/helper-tcg.h        |   2 +
-      tcg/tci: Merge INDEX_op_ld16u_{i32,i64}
+ target/loongarch/internals.h        |   2 +
-      tcg/tci: Merge INDEX_op_ld16s_{i32,i64}
+ target/m68k/cpu.h                   |   2 +
-      tcg/tci: Merge INDEX_op_{ld_i32,ld32u_i64}
+ target/microblaze/cpu.h             |   2 +
-      tcg/tci: Merge INDEX_op_st8_{i32,i64}
+ target/mips/tcg/tcg-internal.h      |   2 +
-      tcg/tci: Merge INDEX_op_st16_{i32,i64}
+ target/openrisc/cpu.h               |   2 +
-      tcg/tci: Move stack bounds check to compile-time
+ target/ppc/cpu.h                    |   2 +
-      tcg/tci: Merge INDEX_op_{st_i32,st32_i64}
+ target/riscv/cpu.h                  |   3 +
-      tcg/tci: Use g_assert_not_reached
+ target/rx/cpu.h                     |   2 +
-      tcg/tci: Remove dead code for TCG_TARGET_HAS_div2_*
+ target/s390x/s390x-internal.h       |   2 +
-      tcg/tci: Implement 64-bit division
+ target/sh4/cpu.h                    |   2 +
-      tcg/tci: Remove TODO as unused
+ target/sparc/cpu.h                  |   2 +
-      tcg/tci: Restrict TCG_TARGET_NB_REGS to 16
+ target/sparc/helper.h               |   4 +-
-      tcg/tci: Fix TCG_REG_R4 misusage
+ target/tricore/cpu.h                |   2 +
-      tcg/tci: Remove TCG_CONST
+ target/xtensa/cpu.h                 |   2 +
+ accel/tcg/cpu-exec.c                |   8 +-
-Stefan Weil (2):
+ accel/tcg/plugin-gen.c              |   9 +
-      tcg/tci: Implement INDEX_op_ld16s_i32
+ accel/tcg/translate-all.c           |   8 +-
-      tcg/tci: Implement INDEX_op_ld8s_i64
+ fpu/softfloat.c                     |  63 +--
+ target/alpha/cpu.c                  |   1 +
- configure                                          |   5 +-
+ target/alpha/translate.c            |   4 +-
- accel/accel-softmmu.h                              |  15 +
+ target/arm/cpu.c                    |   1 +
- accel/kvm/kvm-cpus.h                               |   2 -
+ target/arm/tcg/cpu-v7m.c            |   1 +
- .../{tcg-cpus-icount.h => tcg-accel-ops-icount.h}  |   2 +
+ target/arm/tcg/helper-a64.c         |   6 +-
- accel/tcg/tcg-accel-ops-mttcg.h                    |  19 +
+ target/arm/tcg/translate.c          |   5 +-
- accel/tcg/{tcg-cpus-rr.h => tcg-accel-ops-rr.h}    |   0
+ target/avr/cpu.c                    |   1 +
- accel/tcg/{tcg-cpus.h => tcg-accel-ops.h}          |   6 +-
+ target/avr/translate.c              |   6 +-
- include/exec/cpu-all.h                             |  11 +-
+ target/hexagon/cpu.c                |   1 +
- include/exec/cpu-defs.h                            |   3 -
+ target/hexagon/fma_emu.c            | 496 ++++++---------------
- include/exec/exec-all.h                            |   2 +-
+ target/hexagon/op_helper.c          | 125 ++----
- include/hw/boards.h                                |   2 +-
+ target/hexagon/translate.c          |   4 +-
- include/hw/core/accel-cpu.h                        |  38 ++
+ target/hppa/cpu.c                   |   1 +
- include/hw/core/cpu.h                              |  86 +---
+ target/hppa/translate.c             |   4 +-
- include/hw/core/tcg-cpu-ops.h                      |  97 +++++
+ target/i386/tcg/tcg-cpu.c           |   1 +
- include/{sysemu => qemu}/accel.h                   |  16 +-
+ target/i386/tcg/translate.c         |   5 +-
- include/sysemu/accel-ops.h                         |  45 ++
+ target/loongarch/cpu.c              |   1 +
- include/sysemu/cpus.h                              |  26 +-
+ target/loongarch/tcg/translate.c    |   4 +-
- include/sysemu/hvf.h                               |   2 +-
+ target/m68k/cpu.c                   |   1 +
- include/sysemu/kvm.h                               |   2 +-
+ target/m68k/translate.c             |   4 +-
- include/sysemu/kvm_int.h                           |   2 +-
+ target/microblaze/cpu.c             |   1 +
- target/arm/internals.h                             |   6 +
+ target/microblaze/translate.c       |   4 +-
- target/i386/hax/{hax-cpus.h => hax-accel-ops.h}    |   2 -
+ target/mips/cpu.c                   |   1 +
- target/i386/hax/hax-windows.h                      |   2 +-
+ target/mips/tcg/translate.c         |   4 +-
- target/i386/hvf/{hvf-cpus.h => hvf-accel-ops.h}    |   2 -
+ target/openrisc/cpu.c               |   1 +
- target/i386/hvf/hvf-i386.h                         |   2 +-
+ target/openrisc/translate.c         |   4 +-
- target/i386/whpx/{whpx-cpus.h => whpx-accel-ops.h} |   2 -
+ target/ppc/cpu_init.c               |   1 +
- tcg/tci/tcg-target-con-set.h                       |   6 +-
+ target/ppc/translate.c              |   4 +-
- tcg/tci/tcg-target.h                               |  37 +-
+ target/riscv/tcg/tcg-cpu.c          |   1 +
- accel/accel-common.c                               | 105 +++++
+ target/riscv/translate.c            |   4 +-
- accel/{accel.c => accel-softmmu.c}                 |  61 ++-
+ target/rx/cpu.c                     |   1 +
- accel/accel-user.c                                 |  24 ++
+ target/rx/translate.c               |   4 +-
- accel/kvm/{kvm-cpus.c => kvm-accel-ops.c}          |  28 +-
+ target/s390x/cpu.c                  |   1 +
- accel/kvm/kvm-all.c                                |   2 -
+ target/s390x/tcg/translate.c        |   4 +-
- accel/qtest/qtest.c                                |  25 +-
+ target/sh4/cpu.c                    |   1 +
- accel/tcg/cpu-exec.c                               |  53 ++-
+ target/sh4/translate.c              |   4 +-
- accel/tcg/cputlb.c                                 |  34 +-
+ target/sparc/cpu.c                  |   1 +
- .../{tcg-cpus-icount.c => tcg-accel-ops-icount.c}  |  21 +-
+ target/sparc/fop_helper.c           |   8 +-
- .../{tcg-cpus-mttcg.c => tcg-accel-ops-mttcg.c}    |  14 +-
+ target/sparc/translate.c            |  84 ++--
- accel/tcg/{tcg-cpus-rr.c => tcg-accel-ops-rr.c}    |  13 +-
+ target/tricore/cpu.c                |   1 +
- accel/tcg/{tcg-cpus.c => tcg-accel-ops.c}          |  47 +-
+ target/tricore/translate.c          |   5 +-
- accel/tcg/tcg-all.c                                |  19 +-
+ target/xtensa/cpu.c                 |   1 +
- accel/tcg/user-exec.c                              |   8 +-
+ target/xtensa/translate.c           |   4 +-
- accel/xen/xen-all.c                                |  26 +-
+ tcg/optimize.c                      | 857 +++++++++++++++++++-----------------
- bsd-user/main.c                                    |  11 +-
+ tests/tcg/multiarch/system/memory.c |   9 +-
- cpu.c                                              |  66 +--
+ fpu/softfloat-parts.c.inc           |  16 +-
- hw/core/cpu.c                                      |  21 +-
+files changed, 866 insertions(+), 1009 deletions(-)
  hw/mips/jazz.c                                     |  12 +-
  linux-user/main.c                                  |   7 +-
  softmmu/cpus.c                                     |  12 +-
  softmmu/memory.c                                   |   2 +-
  softmmu/physmem.c                                  | 149 ++++---
  softmmu/qtest.c                                    |   2 +-
  softmmu/vl.c                                       |   9 +-
  target/alpha/cpu.c                                 |  21 +-
  target/arm/cpu.c                                   |  45 +-
  target/arm/cpu64.c                                 |   4 +-
  target/arm/cpu_tcg.c                               |  32 +-
  target/arm/helper.c                                |   4 +
  target/arm/kvm64.c                                 |   6 +-
  target/avr/cpu.c                                   |  19 +-
  target/avr/helper.c                                |   5 +-
  target/cris/cpu.c                                  |  43 +-
  target/cris/helper.c                               |   5 +-
  target/hppa/cpu.c                                  |  24 +-
  target/i386/hax/{hax-cpus.c => hax-accel-ops.c}    |  33 +-
  target/i386/hax/hax-all.c                          |   7 +-
  target/i386/hax/hax-mem.c                          |   2 +-
  target/i386/hax/hax-posix.c                        |   2 +-
  target/i386/hax/hax-windows.c                      |   2 +-
  target/i386/hvf/{hvf-cpus.c => hvf-accel-ops.c}    |  29 +-
  target/i386/hvf/hvf.c                              |   5 +-
  target/i386/hvf/x86_task.c                         |   2 +-
  target/i386/hvf/x86hvf.c                           |   2 +-
  target/i386/tcg/tcg-cpu.c                          |  26 +-
  target/i386/whpx/{whpx-cpus.c => whpx-accel-ops.c} |  33 +-
  target/i386/whpx/whpx-all.c                        |   9 +-
  target/lm32/cpu.c                                  |  19 +-
  target/m68k/cpu.c                                  |  19 +-
  target/microblaze/cpu.c                            |  25 +-
  target/mips/cpu.c                                  |  35 +-
  target/moxie/cpu.c                                 |  15 +-
  target/nios2/cpu.c                                 |  18 +-
  target/openrisc/cpu.c                              |  17 +-
  target/riscv/cpu.c                                 |  26 +-
  target/riscv/cpu_helper.c                          |   2 +-
  target/rx/cpu.c                                    |  20 +-
  target/s390x/cpu.c                                 |  33 +-
  target/s390x/excp_helper.c                         |   2 +-
  target/sh4/cpu.c                                   |  21 +-
  target/sparc/cpu.c                                 |  25 +-
  target/tilegx/cpu.c                                |  17 +-
  target/tricore/cpu.c                               |  12 +-
  target/unicore32/cpu.c                             |  17 +-
  target/xtensa/cpu.c                                |  23 +-
  target/xtensa/helper.c                             |   4 +-
  tcg/tcg-common.c                                   |   4 -
  tcg/tci.c                                          | 479 ++++++++-------------
  target/ppc/translate_init.c.inc                    |  39 +-
  tcg/aarch64/tcg-target.c.inc                       |   7 +-
  tcg/s390/tcg-target.c.inc                          |   2 +-
  tcg/tci/tcg-target.c.inc                           | 149 ++-----
  MAINTAINERS                                        |   7 +-
  accel/kvm/meson.build                              |   2 +-
  accel/meson.build                                  |   4 +-
  accel/tcg/meson.build                              |  10 +-
  target/i386/hax/meson.build                        |   2 +-
  target/i386/hvf/meson.build                        |   2 +-
  target/i386/whpx/meson.build                       |   2 +-
 files changed, 1565 insertions(+), 1065 deletions(-)
  create mode 100644 accel/accel-softmmu.h
  rename accel/tcg/{tcg-cpus-icount.h => tcg-accel-ops-icount.h} (88%)
  create mode 100644 accel/tcg/tcg-accel-ops-mttcg.h
  rename accel/tcg/{tcg-cpus-rr.h => tcg-accel-ops-rr.h} (100%)
  rename accel/tcg/{tcg-cpus.h => tcg-accel-ops.h} (72%)
  create mode 100644 include/hw/core/accel-cpu.h
  create mode 100644 include/hw/core/tcg-cpu-ops.h
  rename include/{sysemu => qemu}/accel.h (94%)
  create mode 100644 include/sysemu/accel-ops.h
  rename target/i386/hax/{hax-cpus.h => hax-accel-ops.h} (95%)
  rename target/i386/hvf/{hvf-cpus.h => hvf-accel-ops.h} (94%)
  rename target/i386/whpx/{whpx-cpus.h => whpx-accel-ops.h} (96%)
  create mode 100644 accel/accel-common.c
  rename accel/{accel.c => accel-softmmu.c} (64%)
  create mode 100644 accel/accel-user.c
  rename accel/kvm/{kvm-cpus.c => kvm-accel-ops.c} (72%)
  rename accel/tcg/{tcg-cpus-icount.c => tcg-accel-ops-icount.c} (89%)
  rename accel/tcg/{tcg-cpus-mttcg.c => tcg-accel-ops-mttcg.c} (92%)
  rename accel/tcg/{tcg-cpus-rr.c => tcg-accel-ops-rr.c} (97%)
  rename accel/tcg/{tcg-cpus.c => tcg-accel-ops.c} (63%)
  rename target/i386/hax/{hax-cpus.c => hax-accel-ops.c} (69%)
  rename target/i386/hvf/{hvf-cpus.c => hvf-accel-ops.c} (84%)
  rename target/i386/whpx/{whpx-cpus.c => whpx-accel-ops.c} (71%)

-New patch
+[PULL 01/72] tests/tcg: Do not use inttypes.h in multiarch/system/memory.c
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+make check-tcg fails on Fedora with the following error message:
+    alpha-linux-gnu-gcc [...] qemu/tests/tcg/multiarch/system/memory.c -o memory [...]
+    qemu/tests/tcg/multiarch/system/memory.c:17:10: fatal error: inttypes.h: No such file or directory
+| #include <inttypes.h>
+          |          ^~~~~~~~~~~~
+    compilation terminated.
+The reason is that Fedora has cross-compilers, but no cross-glibc
+headers. Fix by hardcoding the format specifiers and dropping the
+include.
+An alternative fix would be to introduce a configure check for
+inttypes.h. But this would make it impossible to use Fedora
+cross-compilers for softmmu tests, which used to work so far.
+Fixes: ecbcc9ead2f8 ("tests/tcg: add a system test to check memory instrumentation")
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
+Message-ID: <20241010085906.226249-1-iii@linux.ibm.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tests/tcg/multiarch/system/memory.c | 9 ++++-----
+file changed, 4 insertions(+), 5 deletions(-)
+diff --git a/tests/tcg/multiarch/system/memory.c b/tests/tcg/multiarch/system/memory.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/tcg/multiarch/system/memory.c
++++ b/tests/tcg/multiarch/system/memory.c
+@@ -XXX,XX +XXX,XX @@
+ #include <stdint.h>
+ #include <stdbool.h>
+-#include <inttypes.h>
+ #include <minilib.h>
+ #ifndef CHECK_UNALIGNED
+@@ -XXX,XX +XXX,XX @@ int main(void)
+     int i;
+     bool ok = true;
+-    ml_printf("Test data start: 0x%"PRIxPTR"\n", &test_data[0]);
+-    ml_printf("Test data end: 0x%"PRIxPTR"\n", &test_data[TEST_SIZE]);
++    ml_printf("Test data start: 0x%lx\n", (unsigned long)&test_data[0]);
++    ml_printf("Test data end: 0x%lx\n", (unsigned long)&test_data[TEST_SIZE]);
+     /* Run through the unsigned tests first */
+     for (i = 0; i < ARRAY_SIZE(init_ufns) && ok; i++) {
+@@ -XXX,XX +XXX,XX @@ int main(void)
+         ok = do_signed_reads(true);
+     }
+-    ml_printf("Test data read: %"PRId32"\n", test_read_count);
+-    ml_printf("Test data write: %"PRId32"\n", test_write_count);
++    ml_printf("Test data read: %lu\n", (unsigned long)test_read_count);
++    ml_printf("Test data write: %lu\n", (unsigned long)test_write_count);
+     ml_printf("Test complete: %s\n", ok ? "PASSED" : "FAILED");
+     return ok ? 0 : -1;
+ }
+--
+.43.0

-New patch
+[PULL 02/72] plugins: optimize cpu_index code generation
+From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+When running with a single vcpu, we can return a constant instead of a
+load when accessing cpu_index.
+A side effect is that all tcg operations using it are optimized, most
+notably scoreboard access.
+When running a simple loop in user-mode, the speedup is around 20%.
+Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-ID: <20241128213843.1023080-1-pierrick.bouvier@linaro.org>
+---
+ accel/tcg/plugin-gen.c | 9 +++++++++
+file changed, 9 insertions(+)
+diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/plugin-gen.c
++++ b/accel/tcg/plugin-gen.c
+@@ -XXX,XX +XXX,XX @@ static void gen_disable_mem_helper(void)
+ static TCGv_i32 gen_cpu_index(void)
+ {
++    /*
++     * Optimize when we run with a single vcpu. All values using cpu_index,
++     * including scoreboard index, will be optimized out.
++     * User-mode calls tb_flush when setting this flag. In system-mode, all
++     * vcpus are created before generating code.
++     */
++    if (!tcg_cflags_has(current_cpu, CF_PARALLEL)) {
++        return tcg_constant_i32(current_cpu->cpu_index);
++    }
+     TCGv_i32 cpu_index = tcg_temp_ebb_new_i32();
+     tcg_gen_ld_i32(cpu_index, tcg_env,
+                    -offsetof(ArchCPU, env) + offsetof(CPUState, cpu_index));
+--
+.43.0

-[PULL 31/46] accel/tcg: split TCG-only code from cpu_exec_realizefn
+[PULL 03/72] tcg/optimize: Split out finish_bb, finish_ebb
-From: Claudio Fontana <cfontana@suse.de>
+Call them directly from the opcode switch statement in tcg_optimize,
 rather than in finish_folding based on opcode flags.  Adjust folding
 of conditional branches to match.
-move away TCG-only code, make it compile only on TCG.
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 [claudio: moved the prototypes from hw/core/cpu.h to exec/cpu-all.h]
 Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Message-Id: <20210204163931.7358-4-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/cpu-all.h | 11 +++++--
+ tcg/optimize.c | 47 +++++++++++++++++++++++++++++++----------------
- include/hw/core/cpu.h  |  2 ++
+file changed, 31 insertions(+), 16 deletions(-)
  accel/tcg/cpu-exec.c   | 28 +++++++++++++++++
  cpu.c                  | 70 ++++++++++++++++++++----------------------
  hw/core/cpu.c          |  6 +++-
 files changed, 77 insertions(+), 40 deletions(-)
-diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
+diff --git a/tcg/optimize.c b/tcg/optimize.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/cpu-all.h
+--- a/tcg/optimize.c
-+++ b/include/exec/cpu-all.h
++++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@ static inline bool tlb_hit(target_ulong tlb_addr, target_ulong addr)
+@@ -XXX,XX +XXX,XX @@ static void copy_propagate(OptContext *ctx, TCGOp *op,
      }
  }
- #ifdef CONFIG_TCG
++static void finish_bb(OptContext *ctx)
 +/* accel/tcg/cpu-exec.c */
  void dump_drift_info(void);
 +/* accel/tcg/translate-all.c */
  void dump_exec_info(void);
  void dump_opcount_info(void);
  #endif /* CONFIG_TCG */
  #endif /* !CONFIG_USER_ONLY */
 +#ifdef CONFIG_TCG
 +/* accel/tcg/cpu-exec.c */
 +int cpu_exec(CPUState *cpu);
 +void tcg_exec_realizefn(CPUState *cpu, Error **errp);
 +void tcg_exec_unrealizefn(CPUState *cpu);
 +#endif /* CONFIG_TCG */
 +
  /* Returns: 0 on success, -1 on error */
  int cpu_memory_rw_debug(CPUState *cpu, target_ulong addr,
                          void *ptr, target_ulong len, bool is_write);
 -int cpu_exec(CPUState *cpu);
 -
  /**
   * cpu_set_cpustate_pointers(cpu)
   * @cpu: The cpu object
 diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/core/cpu.h
 +++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ AddressSpace *cpu_get_address_space(CPUState *cpu, int asidx);
  void QEMU_NORETURN cpu_abort(CPUState *cpu, const char *fmt, ...)
      GCC_FMT_ATTR(2, 3);
 +
 +/* $(top_srcdir)/cpu.c */
  void cpu_exec_initfn(CPUState *cpu);
  void cpu_exec_realizefn(CPUState *cpu, Error **errp);
  void cpu_exec_unrealizefn(CPUState *cpu);
 diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cpu-exec.c
 +++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
      return ret;
  }
 +void tcg_exec_realizefn(CPUState *cpu, Error **errp)
 +{
-+    static bool tcg_target_initialized;
++    /* We only optimize memory barriers across basic blocks. */
-+    CPUClass *cc = CPU_GET_CLASS(cpu);
++    ctx->prev_mb = NULL;
 +
 +    if (!tcg_target_initialized) {
 +        cc->tcg_ops.initialize();
 +        tcg_target_initialized = true;
 +    }
 +    tlb_init(cpu);
 +    qemu_plugin_vcpu_init_hook(cpu);
 +
 +#ifndef CONFIG_USER_ONLY
 +    tcg_iommu_init_notifier_list(cpu);
 +#endif /* !CONFIG_USER_ONLY */
 +}
 +
-+/* undo the initializations in reverse order */
++static void finish_ebb(OptContext *ctx)
 +void tcg_exec_unrealizefn(CPUState *cpu)
 +{
-+#ifndef CONFIG_USER_ONLY
++    finish_bb(ctx);
-+    tcg_iommu_free_notifier_list(cpu);
++    /* We only optimize across extended basic blocks. */
-+#endif /* !CONFIG_USER_ONLY */
++    memset(&ctx->temps_used, 0, sizeof(ctx->temps_used));
-+
++    remove_mem_copy_all(ctx);
 +    qemu_plugin_vcpu_exit_hook(cpu);
 +    tlb_destroy(cpu);
 +}
 +
- #ifndef CONFIG_USER_ONLY
+ static void finish_folding(OptContext *ctx, TCGOp *op)
  void dump_drift_info(void)
 diff --git a/cpu.c b/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/cpu.c
 +++ b/cpu.c
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_cpu_common = {
  };
  #endif
 -void cpu_exec_unrealizefn(CPUState *cpu)
 +void cpu_exec_realizefn(CPUState *cpu, Error **errp)
  {
-     CPUClass *cc = CPU_GET_CLASS(cpu);
+     const TCGOpDef *def = &tcg_op_defs[op->opc];
+     int i, nb_oargs;
--    tlb_destroy(cpu);
--    cpu_list_remove(cpu);
+-    /*
-+    cpu_list_add(cpu);
+-     * We only optimize extended basic blocks.  If the opcode ends a BB
-+
+-     * and is not a conditional branch, reset all temp data.
-+#ifdef CONFIG_TCG
+-     */
-+    /* NB: errp parameter is unused currently */
+-    if (def->flags & TCG_OPF_BB_END) {
-+    if (tcg_enabled()) {
+-        ctx->prev_mb = NULL;
-+        tcg_exec_realizefn(cpu, errp);
+-        if (!(def->flags & TCG_OPF_COND_BRANCH)) {
-+    }
+-            memset(&ctx->temps_used, 0, sizeof(ctx->temps_used));
-+#endif /* CONFIG_TCG */
+-            remove_mem_copy_all(ctx);
-+
+-        }
-+#ifdef CONFIG_USER_ONLY
+-        return;
 +    assert(cc->vmsd == NULL);
 +#else
 +    if (qdev_get_vmsd(DEVICE(cpu)) == NULL) {
 +        vmstate_register(NULL, cpu->cpu_index, &vmstate_cpu_common, cpu);
 +    }
 +    if (cc->vmsd != NULL) {
 +        vmstate_register(NULL, cpu->cpu_index, cc->vmsd, cpu);
 +    }
 +#endif /* CONFIG_USER_ONLY */
 +}
 +
 +void cpu_exec_unrealizefn(CPUState *cpu)
 +{
 +    CPUClass *cc = CPU_GET_CLASS(cpu);
  #ifdef CONFIG_USER_ONLY
      assert(cc->vmsd == NULL);
@@ -XXX,XX +XXX,XX @@ void cpu_exec_unrealizefn(CPUState *cpu)
      if (qdev_get_vmsd(DEVICE(cpu)) == NULL) {
          vmstate_unregister(NULL, &vmstate_cpu_common, cpu);
      }
 -    tcg_iommu_free_notifier_list(cpu);
  #endif
 +#ifdef CONFIG_TCG
 +    /* NB: errp parameter is unused currently */
 +    if (tcg_enabled()) {
 +        tcg_exec_unrealizefn(cpu);
 +    }
 +#endif /* CONFIG_TCG */
 +
 +    cpu_list_remove(cpu);
  }
  void cpu_exec_initfn(CPUState *cpu)
@@ -XXX,XX +XXX,XX @@ void cpu_exec_initfn(CPUState *cpu)
  #endif
  }
 -void cpu_exec_realizefn(CPUState *cpu, Error **errp)
 -{
 -    CPUClass *cc = CPU_GET_CLASS(cpu);
 -#ifdef CONFIG_TCG
 -    static bool tcg_target_initialized;
 -#endif /* CONFIG_TCG */
 -
 -    cpu_list_add(cpu);
 -
 -#ifdef CONFIG_TCG
 -    if (tcg_enabled() && !tcg_target_initialized) {
 -        tcg_target_initialized = true;
 -        cc->tcg_ops.initialize();
 -    }
 -#endif /* CONFIG_TCG */
 -    tlb_init(cpu);
 -
 -    qemu_plugin_vcpu_init_hook(cpu);
 -
 -#ifdef CONFIG_USER_ONLY
 -    assert(cc->vmsd == NULL);
 -#else /* !CONFIG_USER_ONLY */
 -    if (qdev_get_vmsd(DEVICE(cpu)) == NULL) {
 -        vmstate_register(NULL, cpu->cpu_index, &vmstate_cpu_common, cpu);
 -    }
 -    if (cc->vmsd != NULL) {
 -        vmstate_register(NULL, cpu->cpu_index, cc->vmsd, cpu);
 -    }
 -
--    tcg_iommu_init_notifier_list(cpu);
+     nb_oargs = def->nb_oargs;
--#endif
+     for (i = 0; i < nb_oargs; i++) {
--}
+         TCGTemp *ts = arg_temp(op->args[i]);
--
+@@ -XXX,XX +XXX,XX @@ static bool fold_brcond(OptContext *ctx, TCGOp *op)
- const char *parse_cpu_option(const char *cpu_option)
+     if (i > 0) {
- {
+         op->opc = INDEX_op_br;
-     ObjectClass *oc;
+         op->args[0] = op->args[3];
-diff --git a/hw/core/cpu.c b/hw/core/cpu.c
++        finish_ebb(ctx);
-index XXXXXXX..XXXXXXX 100644
++    } else {
---- a/hw/core/cpu.c
++        finish_bb(ctx);
-+++ b/hw/core/cpu.c
+     }
-@@ -XXX,XX +XXX,XX @@ static bool cpu_common_virtio_is_big_endian(CPUState *cpu)
+-    return false;
-     return target_words_bigendian();
++    return true;
  }
-+/*
+ static bool fold_brcond2(OptContext *ctx, TCGOp *op)
-+ * XXX the following #if is always true because this is a common_ss
+@@ -XXX,XX +XXX,XX @@ static bool fold_brcond2(OptContext *ctx, TCGOp *op)
-+ * module, so target CONFIG_* is never defined.
+         }
-+ */
+         op->opc = INDEX_op_br;
- #if !defined(CONFIG_USER_ONLY)
+         op->args[0] = label;
- GuestPanicInformation *cpu_get_crash_info(CPUState *cpu)
+-        break;
- {
++        finish_ebb(ctx);
-@@ -XXX,XX +XXX,XX @@ static void cpu_common_realizefn(DeviceState *dev, Error **errp)
++        return true;
- static void cpu_common_unrealizefn(DeviceState *dev)
+     }
- {
+-    return false;
      CPUState *cpu = CPU(dev);
 +
-     /* NOTE: latest generic point before the cpu is fully unrealized */
++    finish_bb(ctx);
-     trace_fini_vcpu(cpu);
++    return true;
 -    qemu_plugin_vcpu_exit_hook(cpu);
      cpu_exec_unrealizefn(cpu);
  }
+ static bool fold_bswap(OptContext *ctx, TCGOp *op)
+@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
+         CASE_OP_32_64_VEC(xor):
+             done = fold_xor(&ctx, op);
+             break;
++        case INDEX_op_set_label:
++        case INDEX_op_br:
++        case INDEX_op_exit_tb:
++        case INDEX_op_goto_tb:
++        case INDEX_op_goto_ptr:
++            finish_ebb(&ctx);
++            done = true;
++            break;
+         default:
+             break;
+         }
 --
-.25.1
+.43.0

-[PULL 27/46] tcg/tci: Fix TCG_REG_R4 misusage
+[PULL 04/72] tcg/optimize: Split out fold_affected_mask
-This was removed from tcg_target_reg_alloc_order and
+There are only a few logical operations which can compute
-tcg_target_call_iarg_regs on the assumption that it
+an "affected" mask.  Split out handling of this optimization
-was the stack.  This was incorrectly copied from i386.
+to a separate function, only to be called when applicable.
 For tci, the stack is R15.
-By adding R4 back to tcg_target_call_iarg_regs, adjust the other
+Remove the a_mask field from OptContext, as the mask is
-entries so that 6 (or 12) entries are still present in the array,
+no longer stored anywhere.
 and adjust the numbers in the interpreter.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c                | 8 ++++----
+ tcg/optimize.c | 42 +++++++++++++++++++++++++++---------------
- tcg/tci/tcg-target.c.inc | 7 +------
+file changed, 27 insertions(+), 15 deletions(-)
 files changed, 5 insertions(+), 10 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
+diff --git a/tcg/optimize.c b/tcg/optimize.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/tcg/optimize.c
-+++ b/tcg/tci.c
++++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+@@ -XXX,XX +XXX,XX @@ typedef struct OptContext {
-                                           tci_read_reg(regs, TCG_REG_R1),
+     QSIMPLEQ_HEAD(, MemCopyInfo) mem_free;
-                                           tci_read_reg(regs, TCG_REG_R2),
-                                           tci_read_reg(regs, TCG_REG_R3),
+     /* In flight values from optimization. */
-+                                          tci_read_reg(regs, TCG_REG_R4),
+-    uint64_t a_mask;  /* mask bit is 0 iff value identical to first input */
-                                           tci_read_reg(regs, TCG_REG_R5),
+     uint64_t z_mask;  /* mask bit is 0 iff value bit is 0 */
-                                           tci_read_reg(regs, TCG_REG_R6),
+     uint64_t s_mask;  /* mask of clrsb(value) bits */
-                                           tci_read_reg(regs, TCG_REG_R7),
+     TCGType type;
-                                           tci_read_reg(regs, TCG_REG_R8),
+@@ -XXX,XX +XXX,XX @@ static bool fold_const2_commutative(OptContext *ctx, TCGOp *op)
-                                           tci_read_reg(regs, TCG_REG_R9),
-                                           tci_read_reg(regs, TCG_REG_R10),
+ static bool fold_masks(OptContext *ctx, TCGOp *op)
--                                          tci_read_reg(regs, TCG_REG_R11),
+ {
--                                          tci_read_reg(regs, TCG_REG_R12));
+-    uint64_t a_mask = ctx->a_mask;
-+                                          tci_read_reg(regs, TCG_REG_R11));
+     uint64_t z_mask = ctx->z_mask;
-             tci_write_reg(regs, TCG_REG_R0, tmp64);
+     uint64_t s_mask = ctx->s_mask;
-             tci_write_reg(regs, TCG_REG_R1, tmp64 >> 32);
- #else
+@@ -XXX,XX +XXX,XX @@ static bool fold_masks(OptContext *ctx, TCGOp *op)
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+      * type changing opcodes.
-                                           tci_read_reg(regs, TCG_REG_R1),
+      */
-                                           tci_read_reg(regs, TCG_REG_R2),
+     if (ctx->type == TCG_TYPE_I32) {
-                                           tci_read_reg(regs, TCG_REG_R3),
+-        a_mask = (int32_t)a_mask;
--                                          tci_read_reg(regs, TCG_REG_R5),
+         z_mask = (int32_t)z_mask;
--                                          tci_read_reg(regs, TCG_REG_R6));
+         s_mask |= MAKE_64BIT_MASK(32, 32);
-+                                          tci_read_reg(regs, TCG_REG_R4),
+         ctx->z_mask = z_mask;
-+                                          tci_read_reg(regs, TCG_REG_R5));
+@@ -XXX,XX +XXX,XX @@ static bool fold_masks(OptContext *ctx, TCGOp *op)
-             tci_write_reg(regs, TCG_REG_R0, tmp64);
+     if (z_mask == 0) {
- #endif
+         return tcg_opt_gen_movi(ctx, op, op->args[0], 0);
-             break;
+     }
-diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
++    return false;
-index XXXXXXX..XXXXXXX 100644
++}
---- a/tcg/tci/tcg-target.c.inc
++
-+++ b/tcg/tci/tcg-target.c.inc
++/*
-@@ -XXX,XX +XXX,XX @@ static const int tcg_target_reg_alloc_order[] = {
++ * An "affected" mask bit is 0 if and only if the result is identical
-     TCG_REG_R1,
++ * to the first input.  Thus if the entire mask is 0, the operation
-     TCG_REG_R2,
++ * is equivalent to a copy.
-     TCG_REG_R3,
++ */
--#if 0 /* used for TCG_REG_CALL_STACK */
++static bool fold_affected_mask(OptContext *ctx, TCGOp *op, uint64_t a_mask)
-     TCG_REG_R4,
++{
--#endif
++    if (ctx->type == TCG_TYPE_I32) {
-     TCG_REG_R5,
++        a_mask = (uint32_t)a_mask;
-     TCG_REG_R6,
++    }
-     TCG_REG_R7,
+     if (a_mask == 0) {
-@@ -XXX,XX +XXX,XX @@ static const int tcg_target_call_iarg_regs[] = {
+         return tcg_opt_gen_mov(ctx, op, op->args[0], op->args[1]);
-     TCG_REG_R1,
+     }
-     TCG_REG_R2,
+@@ -XXX,XX +XXX,XX @@ static bool fold_and(OptContext *ctx, TCGOp *op)
-     TCG_REG_R3,
+      * Known-zeros does not imply known-ones.  Therefore unless
--#if 0 /* used for TCG_REG_CALL_STACK */
+      * arg2 is constant, we can't infer affected bits from it.
-     TCG_REG_R4,
+      */
--#endif
+-    if (arg_is_const(op->args[2])) {
-     TCG_REG_R5,
+-        ctx->a_mask = z1 & ~z2;
--    TCG_REG_R6,
++    if (arg_is_const(op->args[2]) &&
- #if TCG_TARGET_REG_BITS == 32
++        fold_affected_mask(ctx, op, z1 & ~z2)) {
-     /* 32 bit hosts need 2 * MAX_OPC_PARAM_IARGS registers. */
++        return true;
-+    TCG_REG_R6,
+     }
-     TCG_REG_R7,
-     TCG_REG_R8,
+     return fold_masks(ctx, op);
-     TCG_REG_R9,
+@@ -XXX,XX +XXX,XX @@ static bool fold_andc(OptContext *ctx, TCGOp *op)
-     TCG_REG_R10,
+      */
-     TCG_REG_R11,
+     if (arg_is_const(op->args[2])) {
--    TCG_REG_R12,
+         uint64_t z2 = ~arg_info(op->args[2])->z_mask;
- #endif
+-        ctx->a_mask = z1 & ~z2;
- };
++        if (fold_affected_mask(ctx, op, z1 & ~z2)) {
 +            return true;
 +        }
          z1 &= z2;
      }
      ctx->z_mask = z1;
@@ -XXX,XX +XXX,XX @@ static bool fold_extract(OptContext *ctx, TCGOp *op)
      z_mask_old = arg_info(op->args[1])->z_mask;
      z_mask = extract64(z_mask_old, pos, len);
 -    if (pos == 0) {
 -        ctx->a_mask = z_mask_old ^ z_mask;
 +    if (pos == 0 && fold_affected_mask(ctx, op, z_mask_old ^ z_mask)) {
 +        return true;
      }
      ctx->z_mask = z_mask;
      ctx->s_mask = smask_from_zmask(z_mask);
@@ -XXX,XX +XXX,XX @@ static bool fold_exts(OptContext *ctx, TCGOp *op)
      ctx->z_mask = z_mask;
      ctx->s_mask = s_mask;
 -    if (!type_change) {
 -        ctx->a_mask = s_mask & ~s_mask_old;
 +    if (!type_change && fold_affected_mask(ctx, op, s_mask & ~s_mask_old)) {
 +        return true;
      }
      return fold_masks(ctx, op);
@@ -XXX,XX +XXX,XX @@ static bool fold_extu(OptContext *ctx, TCGOp *op)
      ctx->z_mask = z_mask;
      ctx->s_mask = smask_from_zmask(z_mask);
 -    if (!type_change) {
 -        ctx->a_mask = z_mask_old ^ z_mask;
 +    if (!type_change && fold_affected_mask(ctx, op, z_mask_old ^ z_mask)) {
 +        return true;
      }
      return fold_masks(ctx, op);
  }
@@ -XXX,XX +XXX,XX @@ static bool fold_sextract(OptContext *ctx, TCGOp *op)
      s_mask |= MAKE_64BIT_MASK(len, 64 - len);
      ctx->s_mask = s_mask;
 -    if (pos == 0) {
 -        ctx->a_mask = s_mask & ~s_mask_old;
 +    if (pos == 0 && fold_affected_mask(ctx, op, s_mask & ~s_mask_old)) {
 +        return true;
      }
      return fold_masks(ctx, op);
@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
          }
          /* Assume all bits affected, no bits known zero, no sign reps. */
 -        ctx.a_mask = -1;
          ctx.z_mask = -1;
          ctx.s_mask = 0;
 --
-.25.1
+.43.0

-New patch
+[PULL 05/72] tcg/optimize: Copy mask writeback to fold_masks
+Use of fold_masks should be restricted to those opcodes that
+can reliably make use of it -- those with a single output,
+and from higher-level folders that set up the masks.
+Prepare for conversion of each folder in turn.
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/optimize.c | 17 ++++++++++++++---
+file changed, 14 insertions(+), 3 deletions(-)
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -XXX,XX +XXX,XX @@ static bool fold_masks(OptContext *ctx, TCGOp *op)
+ {
+     uint64_t z_mask = ctx->z_mask;
+     uint64_t s_mask = ctx->s_mask;
++    const TCGOpDef *def = &tcg_op_defs[op->opc];
++    TCGTemp *ts;
++    TempOptInfo *ti;
++
++    /* Only single-output opcodes are supported here. */
++    tcg_debug_assert(def->nb_oargs == 1);
+     /*
+      * 32-bit ops generate 32-bit results, which for the purpose of
+@@ -XXX,XX +XXX,XX @@ static bool fold_masks(OptContext *ctx, TCGOp *op)
+     if (ctx->type == TCG_TYPE_I32) {
+         z_mask = (int32_t)z_mask;
+         s_mask |= MAKE_64BIT_MASK(32, 32);
+-        ctx->z_mask = z_mask;
+-        ctx->s_mask = s_mask;
+     }
+     if (z_mask == 0) {
+         return tcg_opt_gen_movi(ctx, op, op->args[0], 0);
+     }
+-    return false;
++
++    ts = arg_temp(op->args[0]);
++    reset_ts(ctx, ts);
++
++    ti = ts_info(ts);
++    ti->z_mask = z_mask;
++    ti->s_mask = s_mask;
++    return true;
+ }
+ /*
+--
+.43.0

-New patch
+[PULL 06/72] tcg/optimize: Split out fold_masks_zs
+Add a routine to which masks can be passed directly, rather than
+storing them into OptContext.  To be used in upcoming patches.
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/optimize.c | 15 ++++++++++++---
+file changed, 12 insertions(+), 3 deletions(-)
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -XXX,XX +XXX,XX @@ static bool fold_const2_commutative(OptContext *ctx, TCGOp *op)
+     return fold_const2(ctx, op);
+ }
+-static bool fold_masks(OptContext *ctx, TCGOp *op)
++/*
++ * Record "zero" and "sign" masks for the single output of @op.
++ * See TempOptInfo definition of z_mask and s_mask.
++ * If z_mask allows, fold the output to constant zero.
++ */
++static bool fold_masks_zs(OptContext *ctx, TCGOp *op,
++                          uint64_t z_mask, uint64_t s_mask)
+ {
+-    uint64_t z_mask = ctx->z_mask;
+-    uint64_t s_mask = ctx->s_mask;
+     const TCGOpDef *def = &tcg_op_defs[op->opc];
+     TCGTemp *ts;
+     TempOptInfo *ti;
+@@ -XXX,XX +XXX,XX @@ static bool fold_masks(OptContext *ctx, TCGOp *op)
+     return true;
+ }
++static bool fold_masks(OptContext *ctx, TCGOp *op)
++{
++    return fold_masks_zs(ctx, op, ctx->z_mask, ctx->s_mask);
++}
++
+ /*
+  * An "affected" mask bit is 0 if and only if the result is identical
+  * to the first input.  Thus if the entire mask is 0, the operation
+--
+.43.0

-[PULL 37/46] cpu: move cc->do_interrupt to tcg_ops
+[PULL 07/72] tcg/optimize: Augment s_mask from z_mask in fold_masks_zs
-From: Claudio Fontana <cfontana@suse.de>
+Consider the passed s_mask to be a minimum deduced from
 either existing s_mask or from a sign-extension operation.
 We may be able to deduce more from the set of known zeros.
 Remove identical logic from several opcode folders.
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210204163931.7358-10-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h           |  4 ++--
+ tcg/optimize.c | 21 ++++++---------------
- accel/tcg/cpu-exec.c            |  4 ++--
+file changed, 6 insertions(+), 15 deletions(-)
  target/alpha/cpu.c              |  2 +-
  target/arm/cpu.c                |  4 ++--
  target/arm/cpu_tcg.c            |  9 ++++-----
  target/avr/cpu.c                |  2 +-
  target/avr/helper.c             |  4 ++--
  target/cris/cpu.c               | 12 ++++++------
  target/cris/helper.c            |  4 ++--
  target/hppa/cpu.c               |  2 +-
  target/i386/tcg/tcg-cpu.c       |  2 +-
  target/lm32/cpu.c               |  2 +-
  target/m68k/cpu.c               |  2 +-
  target/microblaze/cpu.c         |  2 +-
  target/mips/cpu.c               |  4 ++--
  target/moxie/cpu.c              |  2 +-
  target/nios2/cpu.c              |  2 +-
  target/openrisc/cpu.c           |  2 +-
  target/riscv/cpu.c              |  2 +-
  target/rx/cpu.c                 |  2 +-
  target/s390x/cpu.c              |  2 +-
  target/sh4/cpu.c                |  2 +-
  target/sparc/cpu.c              |  2 +-
  target/tilegx/cpu.c             |  2 +-
  target/unicore32/cpu.c          |  2 +-
  target/xtensa/cpu.c             |  2 +-
  target/ppc/translate_init.c.inc |  2 +-
 files changed, 41 insertions(+), 42 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
+diff --git a/tcg/optimize.c b/tcg/optimize.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
+--- a/tcg/optimize.c
-+++ b/include/hw/core/cpu.h
++++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
+@@ -XXX,XX +XXX,XX @@ static bool fold_const2_commutative(OptContext *ctx, TCGOp *op)
-     void (*cpu_exec_exit)(CPUState *cpu);
+  * Record "zero" and "sign" masks for the single output of @op.
-     /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
+  * See TempOptInfo definition of z_mask and s_mask.
-     bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
+  * If z_mask allows, fold the output to constant zero.
-+    /** @do_interrupt: Callback for interrupt handling. */
++ * The passed s_mask may be augmented by z_mask.
-+    void (*do_interrupt)(CPUState *cpu);
+  */
-     /**
+ static bool fold_masks_zs(OptContext *ctx, TCGOp *op,
-      * @tlb_fill: Handle a softmmu tlb miss or user-only address fault
+                           uint64_t z_mask, uint64_t s_mask)
-      *
+@@ -XXX,XX +XXX,XX @@ static bool fold_masks_zs(OptContext *ctx, TCGOp *op,
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
-  * @parse_features: Callback to parse command line arguments.
+     ti = ts_info(ts);
-  * @reset_dump_flags: #CPUDumpFlags to use for reset logging.
+     ti->z_mask = z_mask;
-  * @has_work: Callback for checking if there is work to do.
+-    ti->s_mask = s_mask;
-- * @do_interrupt: Callback for interrupt handling.
++    ti->s_mask = s_mask | smask_from_zmask(z_mask);
   * @do_unaligned_access: Callback for unaligned access handling, if
   * the target defines #TARGET_ALIGNED_ONLY.
   * @do_transaction_failed: Callback for handling failed memory transactions
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
      int reset_dump_flags;
      bool (*has_work)(CPUState *cpu);
 -    void (*do_interrupt)(CPUState *cpu);
      void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
                                  MMUAccessType access_type,
                                  int mmu_idx, uintptr_t retaddr);
 diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cpu-exec.c
 +++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
             loop */
  #if defined(TARGET_I386)
          CPUClass *cc = CPU_GET_CLASS(cpu);
 -        cc->do_interrupt(cpu);
 +        cc->tcg_ops.do_interrupt(cpu);
  #endif
          *ret = cpu->exception_index;
          cpu->exception_index = -1;
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
          if (replay_exception()) {
              CPUClass *cc = CPU_GET_CLASS(cpu);
              qemu_mutex_lock_iothread();
 -            cc->do_interrupt(cpu);
 +            cc->tcg_ops.do_interrupt(cpu);
              qemu_mutex_unlock_iothread();
              cpu->exception_index = -1;
 diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/alpha/cpu.c
 +++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = alpha_cpu_class_by_name;
      cc->has_work = alpha_cpu_has_work;
 -    cc->do_interrupt = alpha_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = alpha_cpu_do_interrupt;
      cc->tcg_ops.cpu_exec_interrupt = alpha_cpu_exec_interrupt;
      cc->dump_state = alpha_cpu_dump_state;
      cc->set_pc = alpha_cpu_set_pc;
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ bool arm_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
   found:
      cs->exception_index = excp_idx;
      env->exception.target_el = target_el;
 -    cc->do_interrupt(cs);
 +    cc->tcg_ops.do_interrupt(cs);
      return true;
  }
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ static bool fold_bswap(OptContext *ctx, TCGOp *op)
-     cc->gdb_read_register = arm_cpu_gdb_read_register;
+     default:
-     cc->gdb_write_register = arm_cpu_gdb_write_register;
+         g_assert_not_reached();
- #ifndef CONFIG_USER_ONLY
+     }
--    cc->do_interrupt = arm_cpu_do_interrupt;
+-    s_mask = smask_from_zmask(z_mask);
-     cc->get_phys_page_attrs_debug = arm_cpu_get_phys_page_attrs_debug;
-     cc->asidx_from_attrs = arm_asidx_from_attrs;
++    s_mask = 0;
-     cc->vmsd = &vmstate_arm_cpu;
+     switch (op->args[2] & (TCG_BSWAP_OZ | TCG_BSWAP_OS)) {
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
+     case TCG_BSWAP_OZ:
- #if !defined(CONFIG_USER_ONLY)
+         break;
-     cc->do_transaction_failed = arm_cpu_do_transaction_failed;
+@@ -XXX,XX +XXX,XX @@ static bool fold_bswap(OptContext *ctx, TCGOp *op)
-     cc->adjust_watchpoint_address = arm_adjust_watchpoint_address;
+     default:
-+    cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
+         /* The high bits are undefined: force all bits above the sign to 1. */
- #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
+         z_mask |= sign << 1;
- #endif
+-        s_mask = 0;
          break;
      }
      ctx->z_mask = z_mask;
@@ -XXX,XX +XXX,XX @@ static bool fold_count_zeros(OptContext *ctx, TCGOp *op)
          g_assert_not_reached();
      }
      ctx->z_mask = arg_info(op->args[2])->z_mask | z_mask;
 -    ctx->s_mask = smask_from_zmask(ctx->z_mask);
      return false;
  }
-diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ static bool fold_ctpop(OptContext *ctx, TCGOp *op)
---- a/target/arm/cpu_tcg.c
+     default:
-+++ b/target/arm/cpu_tcg.c
+         g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
      if (interrupt_request & CPU_INTERRUPT_HARD
          && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
          cs->exception_index = EXCP_IRQ;
 -        cc->do_interrupt(cs);
 +        cc->tcg_ops.do_interrupt(cs);
          ret = true;
      }
-     return ret;
+-    ctx->s_mask = smask_from_zmask(ctx->z_mask);
-@@ -XXX,XX +XXX,XX @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
+     return false;
      CPUClass *cc = CPU_CLASS(oc);
      acc->info = data;
 -#ifndef CONFIG_USER_ONLY
 -    cc->do_interrupt = arm_v7m_cpu_do_interrupt;
 -#endif
 -
  #ifdef CONFIG_TCG
      cc->tcg_ops.cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt;
 +#ifndef CONFIG_USER_ONLY
 +    cc->tcg_ops.do_interrupt = arm_v7m_cpu_do_interrupt;
 +#endif
  #endif /* CONFIG_TCG */
      cc->gdb_core_xml_file = "arm-m-profile.xml";
 diff --git a/target/avr/cpu.c b/target/avr/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/avr/cpu.c
 +++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = avr_cpu_class_by_name;
      cc->has_work = avr_cpu_has_work;
 -    cc->do_interrupt = avr_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = avr_cpu_do_interrupt;
      cc->tcg_ops.cpu_exec_interrupt = avr_cpu_exec_interrupt;
      cc->dump_state = avr_cpu_dump_state;
      cc->set_pc = avr_cpu_set_pc;
 diff --git a/target/avr/helper.c b/target/avr/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/avr/helper.c
 +++ b/target/avr/helper.c
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
      if (interrupt_request & CPU_INTERRUPT_RESET) {
          if (cpu_interrupts_enabled(env)) {
              cs->exception_index = EXCP_RESET;
 -            cc->do_interrupt(cs);
 +            cc->tcg_ops.do_interrupt(cs);
              cs->interrupt_request &= ~CPU_INTERRUPT_RESET;
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
          if (cpu_interrupts_enabled(env) && env->intsrc != 0) {
              int index = ctz32(env->intsrc);
              cs->exception_index = EXCP_INT(index);
 -            cc->do_interrupt(cs);
 +            cc->tcg_ops.do_interrupt(cs);
              env->intsrc &= env->intsrc - 1; /* clear the interrupt */
              cs->interrupt_request &= ~CPU_INTERRUPT_HARD;
 diff --git a/target/cris/cpu.c b/target/cris/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/cris/cpu.c
 +++ b/target/cris/cpu.c
@@ -XXX,XX +XXX,XX @@ static void crisv8_cpu_class_init(ObjectClass *oc, void *data)
      CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
      ccc->vr = 8;
 -    cc->do_interrupt = crisv10_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
      cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
  }
-@@ -XXX,XX +XXX,XX @@ static void crisv9_cpu_class_init(ObjectClass *oc, void *data)
-     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
+@@ -XXX,XX +XXX,XX @@ static bool fold_extract(OptContext *ctx, TCGOp *op)
+         return true;
-     ccc->vr = 9;
+     }
--    cc->do_interrupt = crisv10_cpu_do_interrupt;
+     ctx->z_mask = z_mask;
-+    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
+-    ctx->s_mask = smask_from_zmask(z_mask);
-     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
-     cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
+     return fold_masks(ctx, op);
  }
-@@ -XXX,XX +XXX,XX @@ static void crisv10_cpu_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ static bool fold_extu(OptContext *ctx, TCGOp *op)
      CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
      ccc->vr = 10;
 -    cc->do_interrupt = crisv10_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
      cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
  }
@@ -XXX,XX +XXX,XX @@ static void crisv11_cpu_class_init(ObjectClass *oc, void *data)
      CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
      ccc->vr = 11;
 -    cc->do_interrupt = crisv10_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
      cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
  }
@@ -XXX,XX +XXX,XX @@ static void crisv17_cpu_class_init(ObjectClass *oc, void *data)
      CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
      ccc->vr = 17;
 -    cc->do_interrupt = crisv10_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
      cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
  }
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = cris_cpu_class_by_name;
      cc->has_work = cris_cpu_has_work;
 -    cc->do_interrupt = cris_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = cris_cpu_do_interrupt;
      cc->tcg_ops.cpu_exec_interrupt = cris_cpu_exec_interrupt;
      cc->dump_state = cris_cpu_dump_state;
      cc->set_pc = cris_cpu_set_pc;
 diff --git a/target/cris/helper.c b/target/cris/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/cris/helper.c
 +++ b/target/cris/helper.c
@@ -XXX,XX +XXX,XX @@ bool cris_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
          && (env->pregs[PR_CCS] & I_FLAG)
          && !env->locked_irq) {
          cs->exception_index = EXCP_IRQ;
 -        cc->do_interrupt(cs);
 +        cc->tcg_ops.do_interrupt(cs);
          ret = true;
      }
-     if (interrupt_request & CPU_INTERRUPT_NMI) {
-@@ -XXX,XX +XXX,XX @@ bool cris_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
+     ctx->z_mask = z_mask;
-         }
+-    ctx->s_mask = smask_from_zmask(z_mask);
-         if ((env->pregs[PR_CCS] & m_flag_archval)) {
+     if (!type_change && fold_affected_mask(ctx, op, z_mask_old ^ z_mask)) {
-             cs->exception_index = EXCP_NMI;
+         return true;
--            cc->do_interrupt(cs);
+     }
-+            cc->tcg_ops.do_interrupt(cs);
+@@ -XXX,XX +XXX,XX @@ static bool fold_qemu_ld(OptContext *ctx, TCGOp *op)
-             ret = true;
+     int width = 8 * memop_size(mop);
      if (width < 64) {
 -        ctx->s_mask = MAKE_64BIT_MASK(width, 64 - width);
 -        if (!(mop & MO_SIGN)) {
 +        if (mop & MO_SIGN) {
 +            ctx->s_mask = MAKE_64BIT_MASK(width, 64 - width);
 +        } else {
              ctx->z_mask = MAKE_64BIT_MASK(0, width);
 -            ctx->s_mask <<= 1;
          }
      }
-diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ static bool fold_setcond(OptContext *ctx, TCGOp *op)
---- a/target/hppa/cpu.c
+     fold_setcond_tst_pow2(ctx, op, false);
-+++ b/target/hppa/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
+     ctx->z_mask = 1;
+-    ctx->s_mask = smask_from_zmask(1);
-     cc->class_by_name = hppa_cpu_class_by_name;
+     return false;
-     cc->has_work = hppa_cpu_has_work;
+ }
--    cc->do_interrupt = hppa_cpu_do_interrupt;
-+    cc->tcg_ops.do_interrupt = hppa_cpu_do_interrupt;
+@@ -XXX,XX +XXX,XX @@ static bool fold_setcond2(OptContext *ctx, TCGOp *op)
-     cc->tcg_ops.cpu_exec_interrupt = hppa_cpu_exec_interrupt;
+     }
-     cc->dump_state = hppa_cpu_dump_state;
-     cc->set_pc = hppa_cpu_set_pc;
+     ctx->z_mask = 1;
-diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
+-    ctx->s_mask = smask_from_zmask(1);
-index XXXXXXX..XXXXXXX 100644
+     return false;
---- a/target/i386/tcg/tcg-cpu.c
-+++ b/target/i386/tcg/tcg-cpu.c
+  do_setcond_const:
-@@ -XXX,XX +XXX,XX @@ static void x86_cpu_synchronize_from_tb(CPUState *cs,
+@@ -XXX,XX +XXX,XX @@ static bool fold_tcg_ld(OptContext *ctx, TCGOp *op)
+         break;
- void tcg_cpu_common_class_init(CPUClass *cc)
+     CASE_OP_32_64(ld8u):
- {
+         ctx->z_mask = MAKE_64BIT_MASK(0, 8);
--    cc->do_interrupt = x86_cpu_do_interrupt;
+-        ctx->s_mask = MAKE_64BIT_MASK(9, 55);
-+    cc->tcg_ops.do_interrupt = x86_cpu_do_interrupt;
+         break;
-     cc->tcg_ops.cpu_exec_interrupt = x86_cpu_exec_interrupt;
+     CASE_OP_32_64(ld16s):
-     cc->tcg_ops.synchronize_from_tb = x86_cpu_synchronize_from_tb;
+         ctx->s_mask = MAKE_64BIT_MASK(16, 48);
-     cc->tcg_ops.cpu_exec_enter = x86_cpu_exec_enter;
+         break;
-diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
+     CASE_OP_32_64(ld16u):
-index XXXXXXX..XXXXXXX 100644
+         ctx->z_mask = MAKE_64BIT_MASK(0, 16);
---- a/target/lm32/cpu.c
+-        ctx->s_mask = MAKE_64BIT_MASK(17, 47);
-+++ b/target/lm32/cpu.c
+         break;
-@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
+     case INDEX_op_ld32s_i64:
+         ctx->s_mask = MAKE_64BIT_MASK(32, 32);
-     cc->class_by_name = lm32_cpu_class_by_name;
+         break;
-     cc->has_work = lm32_cpu_has_work;
+     case INDEX_op_ld32u_i64:
--    cc->do_interrupt = lm32_cpu_do_interrupt;
+         ctx->z_mask = MAKE_64BIT_MASK(0, 32);
-+    cc->tcg_ops.do_interrupt = lm32_cpu_do_interrupt;
+-        ctx->s_mask = MAKE_64BIT_MASK(33, 31);
-     cc->tcg_ops.cpu_exec_interrupt = lm32_cpu_exec_interrupt;
+         break;
-     cc->dump_state = lm32_cpu_dump_state;
+     default:
-     cc->set_pc = lm32_cpu_set_pc;
+         g_assert_not_reached();
 diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/m68k/cpu.c
 +++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
      cc->class_by_name = m68k_cpu_class_by_name;
      cc->has_work = m68k_cpu_has_work;
 -    cc->do_interrupt = m68k_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = m68k_cpu_do_interrupt;
      cc->tcg_ops.cpu_exec_interrupt = m68k_cpu_exec_interrupt;
      cc->dump_state = m68k_cpu_dump_state;
      cc->set_pc = m68k_cpu_set_pc;
 diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/microblaze/cpu.c
 +++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = mb_cpu_class_by_name;
      cc->has_work = mb_cpu_has_work;
 -    cc->do_interrupt = mb_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = mb_cpu_do_interrupt;
      cc->do_unaligned_access = mb_cpu_do_unaligned_access;
      cc->tcg_ops.cpu_exec_interrupt = mb_cpu_exec_interrupt;
      cc->dump_state = mb_cpu_dump_state;
 diff --git a/target/mips/cpu.c b/target/mips/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/cpu.c
 +++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
      cc->class_by_name = mips_cpu_class_by_name;
      cc->has_work = mips_cpu_has_work;
 -    cc->do_interrupt = mips_cpu_do_interrupt;
      cc->dump_state = mips_cpu_dump_state;
      cc->set_pc = mips_cpu_set_pc;
      cc->gdb_read_register = mips_cpu_gdb_read_register;
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
      cc->disas_set_info = mips_cpu_disas_set_info;
  #ifdef CONFIG_TCG
      cc->tcg_ops.initialize = mips_tcg_init;
 +    cc->tcg_ops.do_interrupt = mips_cpu_do_interrupt;
      cc->tcg_ops.cpu_exec_interrupt = mips_cpu_exec_interrupt;
      cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
      cc->tcg_ops.tlb_fill = mips_cpu_tlb_fill;
 -#endif
 +#endif /* CONFIG_TCG */
      cc->gdb_num_core_regs = 73;
      cc->gdb_stop_before_watchpoint = true;
 diff --git a/target/moxie/cpu.c b/target/moxie/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/moxie/cpu.c
 +++ b/target/moxie/cpu.c
@@ -XXX,XX +XXX,XX @@ static void moxie_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = moxie_cpu_class_by_name;
      cc->has_work = moxie_cpu_has_work;
 -    cc->do_interrupt = moxie_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = moxie_cpu_do_interrupt;
      cc->dump_state = moxie_cpu_dump_state;
      cc->set_pc = moxie_cpu_set_pc;
      cc->tcg_ops.tlb_fill = moxie_cpu_tlb_fill;
 diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/nios2/cpu.c
 +++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = nios2_cpu_class_by_name;
      cc->has_work = nios2_cpu_has_work;
 -    cc->do_interrupt = nios2_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = nios2_cpu_do_interrupt;
      cc->tcg_ops.cpu_exec_interrupt = nios2_cpu_exec_interrupt;
      cc->dump_state = nios2_cpu_dump_state;
      cc->set_pc = nios2_cpu_set_pc;
 diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/openrisc/cpu.c
 +++ b/target/openrisc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = openrisc_cpu_class_by_name;
      cc->has_work = openrisc_cpu_has_work;
 -    cc->do_interrupt = openrisc_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = openrisc_cpu_do_interrupt;
      cc->tcg_ops.cpu_exec_interrupt = openrisc_cpu_exec_interrupt;
      cc->dump_state = openrisc_cpu_dump_state;
      cc->set_pc = openrisc_cpu_set_pc;
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
      cc->class_by_name = riscv_cpu_class_by_name;
      cc->has_work = riscv_cpu_has_work;
 -    cc->do_interrupt = riscv_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = riscv_cpu_do_interrupt;
      cc->tcg_ops.cpu_exec_interrupt = riscv_cpu_exec_interrupt;
      cc->dump_state = riscv_cpu_dump_state;
      cc->set_pc = riscv_cpu_set_pc;
 diff --git a/target/rx/cpu.c b/target/rx/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/rx/cpu.c
 +++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
      cc->class_by_name = rx_cpu_class_by_name;
      cc->has_work = rx_cpu_has_work;
 -    cc->do_interrupt = rx_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = rx_cpu_do_interrupt;
      cc->tcg_ops.cpu_exec_interrupt = rx_cpu_exec_interrupt;
      cc->dump_state = rx_cpu_dump_state;
      cc->set_pc = rx_cpu_set_pc;
 diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/cpu.c
 +++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = s390_cpu_class_by_name,
      cc->has_work = s390_cpu_has_work;
  #ifdef CONFIG_TCG
 -    cc->do_interrupt = s390_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = s390_cpu_do_interrupt;
  #endif
      cc->dump_state = s390_cpu_dump_state;
      cc->set_pc = s390_cpu_set_pc;
 diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sh4/cpu.c
 +++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = superh_cpu_class_by_name;
      cc->has_work = superh_cpu_has_work;
 -    cc->do_interrupt = superh_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = superh_cpu_do_interrupt;
      cc->tcg_ops.cpu_exec_interrupt = superh_cpu_exec_interrupt;
      cc->dump_state = superh_cpu_dump_state;
      cc->set_pc = superh_cpu_set_pc;
 diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sparc/cpu.c
 +++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = sparc_cpu_class_by_name;
      cc->parse_features = sparc_cpu_parse_features;
      cc->has_work = sparc_cpu_has_work;
 -    cc->do_interrupt = sparc_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = sparc_cpu_do_interrupt;
      cc->tcg_ops.cpu_exec_interrupt = sparc_cpu_exec_interrupt;
      cc->dump_state = sparc_cpu_dump_state;
  #if !defined(TARGET_SPARC64) && !defined(CONFIG_USER_ONLY)
 diff --git a/target/tilegx/cpu.c b/target/tilegx/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tilegx/cpu.c
 +++ b/target/tilegx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = tilegx_cpu_class_by_name;
      cc->has_work = tilegx_cpu_has_work;
 -    cc->do_interrupt = tilegx_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = tilegx_cpu_do_interrupt;
      cc->tcg_ops.cpu_exec_interrupt = tilegx_cpu_exec_interrupt;
      cc->dump_state = tilegx_cpu_dump_state;
      cc->set_pc = tilegx_cpu_set_pc;
 diff --git a/target/unicore32/cpu.c b/target/unicore32/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/unicore32/cpu.c
 +++ b/target/unicore32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = uc32_cpu_class_by_name;
      cc->has_work = uc32_cpu_has_work;
 -    cc->do_interrupt = uc32_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = uc32_cpu_do_interrupt;
      cc->tcg_ops.cpu_exec_interrupt = uc32_cpu_exec_interrupt;
      cc->dump_state = uc32_cpu_dump_state;
      cc->set_pc = uc32_cpu_set_pc;
 diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/xtensa/cpu.c
 +++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = xtensa_cpu_class_by_name;
      cc->has_work = xtensa_cpu_has_work;
 -    cc->do_interrupt = xtensa_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = xtensa_cpu_do_interrupt;
      cc->tcg_ops.cpu_exec_interrupt = xtensa_cpu_exec_interrupt;
      cc->dump_state = xtensa_cpu_dump_state;
      cc->set_pc = xtensa_cpu_set_pc;
 diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/ppc/translate_init.c.inc
 +++ b/target/ppc/translate_init.c.inc
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = ppc_cpu_class_by_name;
      cc->has_work = ppc_cpu_has_work;
 -    cc->do_interrupt = ppc_cpu_do_interrupt;
      cc->dump_state = ppc_cpu_dump_state;
      cc->dump_statistics = ppc_cpu_dump_statistics;
      cc->set_pc = ppc_cpu_set_pc;
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
  #ifdef CONFIG_TCG
      cc->tcg_ops.initialize = ppc_translate_init;
      cc->tcg_ops.cpu_exec_interrupt = ppc_cpu_exec_interrupt;
 +    cc->tcg_ops.do_interrupt = ppc_cpu_do_interrupt;
      cc->tcg_ops.tlb_fill = ppc_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->tcg_ops.cpu_exec_enter = ppc_cpu_exec_enter;
 --
-.25.1
+.43.0

-[PULL 28/46] tcg/tci: Remove TCG_CONST
+[PULL 08/72] tcg/optimize: Change representation of s_mask
-Restrict all operands to registers.  All constants will be forced
+Change the representation from sign bit repetitions to all bits equal
-into registers by the middle-end.  Removing the difference in how
+to the sign bit, including the sign bit itself.
 immediate integers were encoded will allow more code to be shared
 between 32-bit and 64-bit operations.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+The previous format has a problem in that it is difficult to recreate
 a valid sign mask after a shift operation: the "repetitions" part of
 the previous format meant that applying the same shift as for the value
 lead to an off-by-one value.
 The new format, including the sign bit itself, means that the sign mask
 can be manipulated in exactly the same way as the value, canonicalization
 is easier.
 Canonicalize the s_mask in fold_masks_zs, rather than requiring callers
 to do so.  Treat 0 as a non-canonical but typeless input for no sign
 information, which will be reset as appropriate for the data type.
 We can easily fold in the data from z_mask while canonicalizing.
 Temporarily disable optimizations using s_mask while each operation is
 converted to use fold_masks_zs and to the new form.
 Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci/tcg-target-con-set.h |   6 +-
+ tcg/optimize.c | 64 ++++++++++++--------------------------------------
- tcg/tci/tcg-target.h         |   3 -
+file changed, 15 insertions(+), 49 deletions(-)
  tcg/tci.c                    | 189 +++++++++++++----------------------
  tcg/tci/tcg-target.c.inc     |  85 ++++------------
 files changed, 89 insertions(+), 194 deletions(-)
-diff --git a/tcg/tci/tcg-target-con-set.h b/tcg/tci/tcg-target-con-set.h
+diff --git a/tcg/optimize.c b/tcg/optimize.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target-con-set.h
+--- a/tcg/optimize.c
-+++ b/tcg/tci/tcg-target-con-set.h
++++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ typedef struct TempOptInfo {
-  * tcg-target-con-str.h; the constraint combination is inclusive or.
+     QSIMPLEQ_HEAD(, MemCopyInfo) mem_copy;
-  */
+     uint64_t val;
- C_O0_I2(r, r)
+     uint64_t z_mask;  /* mask bit is 0 if and only if value bit is 0 */
--C_O0_I2(r, ri)
+-    uint64_t s_mask;  /* a left-aligned mask of clrsb(value) bits. */
- C_O0_I3(r, r, r)
++    uint64_t s_mask;  /* mask bit is 1 if value bit matches msb */
--C_O0_I4(r, r, ri, ri)
+ } TempOptInfo;
- C_O0_I4(r, r, r, r)
- C_O1_I1(r, r)
+ typedef struct OptContext {
- C_O1_I2(r, 0, r)
+@@ -XXX,XX +XXX,XX @@ typedef struct OptContext {
--C_O1_I2(r, ri, ri)
- C_O1_I2(r, r, r)
+     /* In flight values from optimization. */
--C_O1_I2(r, r, ri)
+     uint64_t z_mask;  /* mask bit is 0 iff value bit is 0 */
--C_O1_I4(r, r, r, ri, ri)
+-    uint64_t s_mask;  /* mask of clrsb(value) bits */
-+C_O1_I4(r, r, r, r, r)
++    uint64_t s_mask;  /* mask bit is 1 if value bit matches msb */
- C_O2_I1(r, r, r)
+     TCGType type;
- C_O2_I2(r, r, r, r)
+ } OptContext;
- C_O2_I4(r, r, r, r, r, r)
-diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
+-/* Calculate the smask for a specific value. */
-index XXXXXXX..XXXXXXX 100644
+-static uint64_t smask_from_value(uint64_t value)
 --- a/tcg/tci/tcg-target.h
 +++ b/tcg/tci/tcg-target.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
      TCG_AREG0 = TCG_REG_R14,
      TCG_REG_CALL_STACK = TCG_REG_R15,
 -
 -    /* Special value UINT8_MAX is used by TCI to encode constant values. */
 -    TCG_CONST = UINT8_MAX
  } TCGReg;
  /* Used for function call generation. */
 diff --git a/tcg/tci.c b/tcg/tci.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci.c
 +++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ tci_read_ulong(const tcg_target_ulong *regs, const uint8_t **tb_ptr)
      return taddr;
  }
 -/* Read indexed register or constant (native size) from bytecode. */
 -static tcg_target_ulong
 -tci_read_ri(const tcg_target_ulong *regs, const uint8_t **tb_ptr)
 -{
--    tcg_target_ulong value;
+-    int rep = clrsb64(value);
--    TCGReg r = **tb_ptr;
+-    return ~(~0ull >> rep);
 -    *tb_ptr += 1;
 -    if (r == TCG_CONST) {
 -        value = tci_read_i(tb_ptr);
 -    } else {
 -        value = tci_read_reg(regs, r);
 -    }
 -    return value;
 -}
 -
--/* Read indexed register or constant (32 bit) from bytecode. */
+-/*
--static uint32_t tci_read_ri32(const tcg_target_ulong *regs,
+- * Calculate the smask for a given set of known-zeros.
--                              const uint8_t **tb_ptr)
+- * If there are lots of zeros on the left, we can consider the remainder
 - * an unsigned field, and thus the corresponding signed field is one bit
 - * larger.
 - */
 -static uint64_t smask_from_zmask(uint64_t zmask)
 -{
--    uint32_t value;
+-    /*
--    TCGReg r = **tb_ptr;
+-     * Only the 0 bits are significant for zmask, thus the msb itself
--    *tb_ptr += 1;
+-     * must be zero, else we have no sign information.
--    if (r == TCG_CONST) {
+-     */
--        value = tci_read_i32(tb_ptr);
+-    int rep = clz64(zmask);
--    } else {
+-    if (rep == 0) {
--        value = tci_read_reg32(regs, r);
+-        return 0;
 -    }
--    return value;
+-    rep -= 1;
 -    return ~(~0ull >> rep);
 -}
 -
--#if TCG_TARGET_REG_BITS == 32
+-/*
--/* Read two indexed registers or constants (2 * 32 bit) from bytecode. */
+- * Recreate a properly left-aligned smask after manipulation.
--static uint64_t tci_read_ri64(const tcg_target_ulong *regs,
+- * Some bit-shuffling, particularly shifts and rotates, may
--                              const uint8_t **tb_ptr)
+- * retain sign bits on the left, but may scatter disconnected
 - * sign bits on the right.  Retain only what remains to the left.
 - */
 -static uint64_t smask_from_smask(int64_t smask)
 -{
--    uint32_t low = tci_read_ri32(regs, tb_ptr);
+-    /* Only the 1 bits are significant for smask */
--    return tci_uint64(tci_read_ri32(regs, tb_ptr), low);
+-    return smask_from_zmask(~smask);
 -}
 -#elif TCG_TARGET_REG_BITS == 64
 -/* Read indexed register or constant (64 bit) from bytecode. */
 -static uint64_t tci_read_ri64(const tcg_target_ulong *regs,
 -                              const uint8_t **tb_ptr)
 -{
 -    uint64_t value;
 -    TCGReg r = **tb_ptr;
 -    *tb_ptr += 1;
 -    if (r == TCG_CONST) {
 -        value = tci_read_i64(tb_ptr);
 -    } else {
 -        value = tci_read_reg64(regs, r);
 -    }
 -    return value;
 -}
 -#endif
 -
  static tcg_target_ulong tci_read_label(const uint8_t **tb_ptr)
  {
      tcg_target_ulong label = tci_read_i(tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
          switch (opc) {
          case INDEX_op_call:
 -            t0 = tci_read_ri(regs, &tb_ptr);
 +            t0 = tci_read_i(&tb_ptr);
              tci_tb_ptr = (uintptr_t)tb_ptr;
  #if TCG_TARGET_REG_BITS == 32
              tmp64 = ((helper_function)t0)(tci_read_reg(regs, TCG_REG_R0),
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
          case INDEX_op_setcond_i32:
              t0 = *tb_ptr++;
              t1 = tci_read_r32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              condition = *tb_ptr++;
              tci_write_reg(regs, t0, tci_compare32(t1, t2, condition));
              break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
          case INDEX_op_setcond2_i32:
              t0 = *tb_ptr++;
              tmp64 = tci_read_r64(regs, &tb_ptr);
 -            v64 = tci_read_ri64(regs, &tb_ptr);
 +            v64 = tci_read_r64(regs, &tb_ptr);
              condition = *tb_ptr++;
              tci_write_reg(regs, t0, tci_compare64(tmp64, v64, condition));
              break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
          case INDEX_op_setcond_i64:
              t0 = *tb_ptr++;
              t1 = tci_read_r64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              condition = *tb_ptr++;
              tci_write_reg(regs, t0, tci_compare64(t1, t2, condition));
              break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
          case INDEX_op_add_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 + t2);
              break;
          case INDEX_op_sub_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 - t2);
              break;
          case INDEX_op_mul_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 * t2);
              break;
          case INDEX_op_div_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, (int32_t)t1 / (int32_t)t2);
              break;
          case INDEX_op_divu_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 / t2);
              break;
          case INDEX_op_rem_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, (int32_t)t1 % (int32_t)t2);
              break;
          case INDEX_op_remu_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 % t2);
              break;
          case INDEX_op_and_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 & t2);
              break;
          case INDEX_op_or_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 | t2);
              break;
          case INDEX_op_xor_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 ^ t2);
              break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
          case INDEX_op_shl_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 << (t2 & 31));
              break;
          case INDEX_op_shr_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 >> (t2 & 31));
              break;
          case INDEX_op_sar_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, ((int32_t)t1 >> (t2 & 31)));
              break;
  #if TCG_TARGET_HAS_rot_i32
          case INDEX_op_rotl_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, rol32(t1, t2 & 31));
              break;
          case INDEX_op_rotr_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, ror32(t1, t2 & 31));
              break;
  #endif
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
  #endif
          case INDEX_op_brcond_i32:
              t0 = tci_read_r32(regs, &tb_ptr);
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
              condition = *tb_ptr++;
              label = tci_read_label(&tb_ptr);
              if (tci_compare32(t0, t1, condition)) {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              break;
          case INDEX_op_brcond2_i32:
              tmp64 = tci_read_r64(regs, &tb_ptr);
 -            v64 = tci_read_ri64(regs, &tb_ptr);
 +            v64 = tci_read_r64(regs, &tb_ptr);
              condition = *tb_ptr++;
              label = tci_read_label(&tb_ptr);
              if (tci_compare64(tmp64, v64, condition)) {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
          case INDEX_op_add_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 + t2);
              break;
          case INDEX_op_sub_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 - t2);
              break;
          case INDEX_op_mul_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 * t2);
              break;
          case INDEX_op_div_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, (int64_t)t1 / (int64_t)t2);
              break;
          case INDEX_op_divu_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, (uint64_t)t1 / (uint64_t)t2);
              break;
          case INDEX_op_rem_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, (int64_t)t1 % (int64_t)t2);
              break;
          case INDEX_op_remu_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, (uint64_t)t1 % (uint64_t)t2);
              break;
          case INDEX_op_and_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 & t2);
              break;
          case INDEX_op_or_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 | t2);
              break;
          case INDEX_op_xor_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 ^ t2);
              break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
          case INDEX_op_shl_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 << (t2 & 63));
              break;
          case INDEX_op_shr_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 >> (t2 & 63));
              break;
          case INDEX_op_sar_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, ((int64_t)t1 >> (t2 & 63)));
              break;
  #if TCG_TARGET_HAS_rot_i64
          case INDEX_op_rotl_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, rol64(t1, t2 & 63));
              break;
          case INDEX_op_rotr_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, ror64(t1, t2 & 63));
              break;
  #endif
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
  #endif
          case INDEX_op_brcond_i64:
              t0 = tci_read_r64(regs, &tb_ptr);
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
              condition = *tb_ptr++;
              label = tci_read_label(&tb_ptr);
              if (tci_compare64(t0, t1, condition)) {
 diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.c.inc
 +++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
      case INDEX_op_rem_i64:
      case INDEX_op_remu_i32:
      case INDEX_op_remu_i64:
 -        return C_O1_I2(r, r, r);
 -
      case INDEX_op_add_i32:
      case INDEX_op_add_i64:
      case INDEX_op_sub_i32:
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
      case INDEX_op_rotl_i64:
      case INDEX_op_rotr_i32:
      case INDEX_op_rotr_i64:
 -        /* TODO: Does R, RI, RI result in faster code than R, R, RI? */
 -        return C_O1_I2(r, ri, ri);
 +    case INDEX_op_setcond_i32:
 +    case INDEX_op_setcond_i64:
 +        return C_O1_I2(r, r, r);
      case INDEX_op_deposit_i32:
      case INDEX_op_deposit_i64:
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
      case INDEX_op_brcond_i32:
      case INDEX_op_brcond_i64:
 -        return C_O0_I2(r, ri);
 -
 -    case INDEX_op_setcond_i32:
 -    case INDEX_op_setcond_i64:
 -        return C_O1_I2(r, r, ri);
 +        return C_O0_I2(r, r);
  #if TCG_TARGET_REG_BITS == 32
      /* TODO: Support R, R, R, R, RI, RI? Will it be faster? */
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
      case INDEX_op_sub2_i32:
          return C_O2_I4(r, r, r, r, r, r);
      case INDEX_op_brcond2_i32:
 -        return C_O0_I4(r, r, ri, ri);
 +        return C_O0_I4(r, r, r, r);
      case INDEX_op_mulu2_i32:
          return C_O2_I2(r, r, r, r);
      case INDEX_op_setcond2_i32:
 -        return C_O1_I4(r, r, r, ri, ri);
 +        return C_O1_I4(r, r, r, r, r);
  #endif
      case INDEX_op_qemu_ld_i32:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_r(TCGContext *s, TCGArg t0)
      tcg_out8(s, t0);
  }
 -/* Write register or constant (native size). */
 -static void tcg_out_ri(TCGContext *s, int const_arg, TCGArg arg)
 -{
 -    if (const_arg) {
 -        tcg_debug_assert(const_arg == 1);
 -        tcg_out8(s, TCG_CONST);
 -        tcg_out_i(s, arg);
 -    } else {
 -        tcg_out_r(s, arg);
 -    }
 -}
 -
--/* Write register or constant (32 bit). */
+ static inline TempOptInfo *ts_info(TCGTemp *ts)
 -static void tcg_out_ri32(TCGContext *s, int const_arg, TCGArg arg)
 -{
 -    if (const_arg) {
 -        tcg_debug_assert(const_arg == 1);
 -        tcg_out8(s, TCG_CONST);
 -        tcg_out32(s, arg);
 -    } else {
 -        tcg_out_r(s, arg);
 -    }
 -}
 -
 -#if TCG_TARGET_REG_BITS == 64
 -/* Write register or constant (64 bit). */
 -static void tcg_out_ri64(TCGContext *s, int const_arg, TCGArg arg)
 -{
 -    if (const_arg) {
 -        tcg_debug_assert(const_arg == 1);
 -        tcg_out8(s, TCG_CONST);
 -        tcg_out64(s, arg);
 -    } else {
 -        tcg_out_r(s, arg);
 -    }
 -}
 -#endif
 -
  /* Write label. */
  static void tci_out_label(TCGContext *s, TCGLabel *label)
  {
-@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_call(TCGContext *s, const tcg_insn_unit *arg)
+     return ts->state_ptr;
@@ -XXX,XX +XXX,XX @@ static void init_ts_info(OptContext *ctx, TCGTemp *ts)
          ti->is_const = true;
          ti->val = ts->val;
          ti->z_mask = ts->val;
 -        ti->s_mask = smask_from_value(ts->val);
 +        ti->s_mask = INT64_MIN >> clrsb64(ts->val);
      } else {
          ti->is_const = false;
          ti->z_mask = -1;
@@ -XXX,XX +XXX,XX @@ static void finish_folding(OptContext *ctx, TCGOp *op)
           */
          if (i == 0) {
              ts_info(ts)->z_mask = ctx->z_mask;
 -            ts_info(ts)->s_mask = ctx->s_mask;
          }
      }
  }
@@ -XXX,XX +XXX,XX @@ static bool fold_const2_commutative(OptContext *ctx, TCGOp *op)
   * The passed s_mask may be augmented by z_mask.
   */
  static bool fold_masks_zs(OptContext *ctx, TCGOp *op,
 -                          uint64_t z_mask, uint64_t s_mask)
 +                          uint64_t z_mask, int64_t s_mask)
  {
-     uint8_t *old_code_ptr = s->code_ptr;
+     const TCGOpDef *def = &tcg_op_defs[op->opc];
-     tcg_out_op_t(s, INDEX_op_call);
+     TCGTemp *ts;
--    tcg_out_ri(s, 1, (uintptr_t)arg);
+     TempOptInfo *ti;
-+    tcg_out_i(s, (uintptr_t)arg);
++    int rep;
-     old_code_ptr[1] = s->code_ptr - old_code_ptr;
      /* Only single-output opcodes are supported here. */
      tcg_debug_assert(def->nb_oargs == 1);
@@ -XXX,XX +XXX,XX @@ static bool fold_masks_zs(OptContext *ctx, TCGOp *op,
       */
      if (ctx->type == TCG_TYPE_I32) {
          z_mask = (int32_t)z_mask;
 -        s_mask |= MAKE_64BIT_MASK(32, 32);
 +        s_mask |= INT32_MIN;
      }
      if (z_mask == 0) {
@@ -XXX,XX +XXX,XX @@ static bool fold_masks_zs(OptContext *ctx, TCGOp *op,
      ti = ts_info(ts);
      ti->z_mask = z_mask;
 -    ti->s_mask = s_mask | smask_from_zmask(z_mask);
 +
 +    /* Canonicalize s_mask and incorporate data from z_mask. */
 +    rep = clz64(~s_mask);
 +    rep = MAX(rep, clz64(z_mask));
 +    rep = MAX(rep - 1, 0);
 +    ti->s_mask = INT64_MIN >> rep;
 +
      return true;
  }
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
+@@ -XXX,XX +XXX,XX @@ static bool fold_exts(OptContext *ctx, TCGOp *op)
-     case INDEX_op_setcond_i32:
-         tcg_out_r(s, args[0]);
+     ctx->z_mask = z_mask;
-         tcg_out_r(s, args[1]);
+     ctx->s_mask = s_mask;
--        tcg_out_ri32(s, const_args[2], args[2]);
+-    if (!type_change && fold_affected_mask(ctx, op, s_mask & ~s_mask_old)) {
-+        tcg_out_r(s, args[2]);
++    if (0 && !type_change && fold_affected_mask(ctx, op, s_mask & ~s_mask_old)) {
-         tcg_out8(s, args[3]);   /* condition */
+         return true;
-         break;
+     }
- #if TCG_TARGET_REG_BITS == 32
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
+@@ -XXX,XX +XXX,XX @@ static bool fold_sextract(OptContext *ctx, TCGOp *op)
-         tcg_out_r(s, args[0]);
+     s_mask |= MAKE_64BIT_MASK(len, 64 - len);
-         tcg_out_r(s, args[1]);
+     ctx->s_mask = s_mask;
-         tcg_out_r(s, args[2]);
--        tcg_out_ri32(s, const_args[3], args[3]);
+-    if (pos == 0 && fold_affected_mask(ctx, op, s_mask & ~s_mask_old)) {
--        tcg_out_ri32(s, const_args[4], args[4]);
++    if (0 && pos == 0 && fold_affected_mask(ctx, op, s_mask & ~s_mask_old)) {
-+        tcg_out_r(s, args[3]);
+         return true;
-+        tcg_out_r(s, args[4]);
+     }
-         tcg_out8(s, args[5]);   /* condition */
-         break;
+@@ -XXX,XX +XXX,XX @@ static bool fold_shift(OptContext *ctx, TCGOp *op)
- #elif TCG_TARGET_REG_BITS == 64
+         ctx->z_mask = do_constant_folding(op->opc, ctx->type, z_mask, sh);
-     case INDEX_op_setcond_i64:
-         tcg_out_r(s, args[0]);
+         s_mask = do_constant_folding(op->opc, ctx->type, s_mask, sh);
-         tcg_out_r(s, args[1]);
+-        ctx->s_mask = smask_from_smask(s_mask);
--        tcg_out_ri64(s, const_args[2], args[2]);
-+        tcg_out_r(s, args[2]);
+         return fold_masks(ctx, op);
-         tcg_out8(s, args[3]);   /* condition */
+     }
          break;
  #endif
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
      case INDEX_op_rotl_i32:     /* Optional (TCG_TARGET_HAS_rot_i32). */
      case INDEX_op_rotr_i32:     /* Optional (TCG_TARGET_HAS_rot_i32). */
          tcg_out_r(s, args[0]);
 -        tcg_out_ri32(s, const_args[1], args[1]);
 -        tcg_out_ri32(s, const_args[2], args[2]);
 +        tcg_out_r(s, args[1]);
 +        tcg_out_r(s, args[2]);
          break;
      case INDEX_op_deposit_i32:  /* Optional (TCG_TARGET_HAS_deposit_i32). */
          tcg_out_r(s, args[0]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
      case INDEX_op_rem_i64:      /* Optional (TCG_TARGET_HAS_div_i64). */
      case INDEX_op_remu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
          tcg_out_r(s, args[0]);
 -        tcg_out_ri64(s, const_args[1], args[1]);
 -        tcg_out_ri64(s, const_args[2], args[2]);
 +        tcg_out_r(s, args[1]);
 +        tcg_out_r(s, args[2]);
          break;
      case INDEX_op_deposit_i64:  /* Optional (TCG_TARGET_HAS_deposit_i64). */
          tcg_out_r(s, args[0]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
          break;
      case INDEX_op_brcond_i64:
          tcg_out_r(s, args[0]);
 -        tcg_out_ri64(s, const_args[1], args[1]);
 +        tcg_out_r(s, args[1]);
          tcg_out8(s, args[2]);           /* condition */
          tci_out_label(s, arg_label(args[3]));
          break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
      case INDEX_op_rem_i32:      /* Optional (TCG_TARGET_HAS_div_i32). */
      case INDEX_op_remu_i32:     /* Optional (TCG_TARGET_HAS_div_i32). */
          tcg_out_r(s, args[0]);
 -        tcg_out_ri32(s, const_args[1], args[1]);
 -        tcg_out_ri32(s, const_args[2], args[2]);
 +        tcg_out_r(s, args[1]);
 +        tcg_out_r(s, args[2]);
          break;
  #if TCG_TARGET_REG_BITS == 32
      case INDEX_op_add2_i32:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
      case INDEX_op_brcond2_i32:
          tcg_out_r(s, args[0]);
          tcg_out_r(s, args[1]);
 -        tcg_out_ri32(s, const_args[2], args[2]);
 -        tcg_out_ri32(s, const_args[3], args[3]);
 +        tcg_out_r(s, args[2]);
 +        tcg_out_r(s, args[3]);
          tcg_out8(s, args[4]);           /* condition */
          tci_out_label(s, arg_label(args[5]));
          break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
  #endif
      case INDEX_op_brcond_i32:
          tcg_out_r(s, args[0]);
 -        tcg_out_ri32(s, const_args[1], args[1]);
 +        tcg_out_r(s, args[1]);
          tcg_out8(s, args[2]);           /* condition */
          tci_out_label(s, arg_label(args[3]));
          break;
 --
-.25.1
+.43.0

-[PULL 29/46] cpu: Introduce TCGCpuOperations struct
+[PULL 09/72] tcg/optimize: Use finish_folding in fold_add, fold_add_vec, fold_addsub2
-From: Eduardo Habkost <ehabkost@redhat.com>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 The TCG-specific CPU methods will be moved to a separate struct,
 to make it easier to move accel-specific code outside generic CPU
 code in the future.  Start by moving tcg_initialize().
 The new CPUClass.tcg_opts field may eventually become a pointer,
 but keep it an embedded struct for now, to make code conversion
 easier.
 Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
 [claudio: move TCGCpuOperations inside include/hw/core/cpu.h]
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-Id: <20210204163931.7358-2-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h           | 16 +++++++++++++++-
+ tcg/optimize.c | 9 +++++----
- cpu.c                           |  6 +++++-
+file changed, 5 insertions(+), 4 deletions(-)
  target/alpha/cpu.c              |  2 +-
  target/arm/cpu.c                |  2 +-
  target/avr/cpu.c                |  2 +-
  target/cris/cpu.c               | 12 ++++++------
  target/hppa/cpu.c               |  2 +-
  target/i386/tcg/tcg-cpu.c       |  2 +-
  target/lm32/cpu.c               |  2 +-
  target/m68k/cpu.c               |  2 +-
  target/microblaze/cpu.c         |  2 +-
  target/mips/cpu.c               |  2 +-
  target/moxie/cpu.c              |  2 +-
  target/nios2/cpu.c              |  2 +-
  target/openrisc/cpu.c           |  2 +-
  target/riscv/cpu.c              |  2 +-
  target/rx/cpu.c                 |  2 +-
  target/s390x/cpu.c              |  2 +-
  target/sh4/cpu.c                |  2 +-
  target/sparc/cpu.c              |  2 +-
  target/tilegx/cpu.c             |  2 +-
  target/tricore/cpu.c            |  2 +-
  target/unicore32/cpu.c          |  2 +-
  target/xtensa/cpu.c             |  2 +-
  target/ppc/translate_init.c.inc |  2 +-
 files changed, 48 insertions(+), 30 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
+diff --git a/tcg/optimize.c b/tcg/optimize.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
+--- a/tcg/optimize.c
-+++ b/include/hw/core/cpu.h
++++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUWatchpoint CPUWatchpoint;
+@@ -XXX,XX +XXX,XX @@ static void finish_ebb(OptContext *ctx)
+     remove_mem_copy_all(ctx);
- struct TranslationBlock;
+ }
-+/**
+-static void finish_folding(OptContext *ctx, TCGOp *op)
-+ * struct TcgCpuOperations: TCG operations specific to a CPU class
++static bool finish_folding(OptContext *ctx, TCGOp *op)
-+ */
+ {
-+typedef struct TcgCpuOperations {
+     const TCGOpDef *def = &tcg_op_defs[op->opc];
-+    /**
+     int i, nb_oargs;
-+     * @initialize: Initalize TCG state
+@@ -XXX,XX +XXX,XX @@ static void finish_folding(OptContext *ctx, TCGOp *op)
-+     *
+             ts_info(ts)->z_mask = ctx->z_mask;
-+     * Called when the first CPU is realized.
+         }
-+     */
+     }
-+    void (*initialize)(void);
++    return true;
-+
+ }
 +} TcgCpuOperations;
 +
  /**
   * CPUClass:
   * @class_by_name: Callback to map -cpu command line model name to an
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
      void (*disas_set_info)(CPUState *cpu, disassemble_info *info);
      vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
 -    void (*tcg_initialize)(void);
      const char *deprecation_note;
      /* Keep non-pointer data at the end to minimize holes.  */
      int gdb_num_core_regs;
      bool gdb_stop_before_watchpoint;
 +
 +    TcgCpuOperations tcg_ops;
  };
  /*
-diff --git a/cpu.c b/cpu.c
+@@ -XXX,XX +XXX,XX @@ static bool fold_add(OptContext *ctx, TCGOp *op)
-index XXXXXXX..XXXXXXX 100644
+         fold_xi_to_x(ctx, op, 0)) {
---- a/cpu.c
+         return true;
 +++ b/cpu.c
@@ -XXX,XX +XXX,XX @@ void cpu_exec_initfn(CPUState *cpu)
  void cpu_exec_realizefn(CPUState *cpu, Error **errp)
  {
      CPUClass *cc = CPU_GET_CLASS(cpu);
 +#ifdef CONFIG_TCG
      static bool tcg_target_initialized;
 +#endif /* CONFIG_TCG */
      cpu_list_add(cpu);
 +#ifdef CONFIG_TCG
      if (tcg_enabled() && !tcg_target_initialized) {
          tcg_target_initialized = true;
 -        cc->tcg_initialize();
 +        cc->tcg_ops.initialize();
      }
-+#endif /* CONFIG_TCG */
+-    return false;
-     tlb_init(cpu);
++    return finish_folding(ctx, op);
      qemu_plugin_vcpu_init_hook(cpu);
 diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/alpha/cpu.c
 +++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
      dc->vmsd = &vmstate_alpha_cpu;
  #endif
      cc->disas_set_info = alpha_cpu_disas_set_info;
 -    cc->tcg_initialize = alpha_translate_init;
 +    cc->tcg_ops.initialize = alpha_translate_init;
      cc->gdb_num_core_regs = 67;
  }
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
+ /* We cannot as yet do_constant_folding with vectors. */
---- a/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ static bool fold_add_vec(OptContext *ctx, TCGOp *op)
-+++ b/target/arm/cpu.c
+         fold_xi_to_x(ctx, op, 0)) {
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
+         return true;
-     cc->gdb_stop_before_watchpoint = true;
+     }
-     cc->disas_set_info = arm_disas_set_info;
+-    return false;
- #ifdef CONFIG_TCG
++    return finish_folding(ctx, op);
 -    cc->tcg_initialize = arm_translate_init;
 +    cc->tcg_ops.initialize = arm_translate_init;
      cc->tlb_fill = arm_cpu_tlb_fill;
      cc->debug_excp_handler = arm_debug_excp_handler;
      cc->debug_check_watchpoint = arm_debug_check_watchpoint;
 diff --git a/target/avr/cpu.c b/target/avr/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/avr/cpu.c
 +++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
      cc->tlb_fill = avr_cpu_tlb_fill;
      cc->vmsd = &vms_avr_cpu;
      cc->disas_set_info = avr_cpu_disas_set_info;
 -    cc->tcg_initialize = avr_cpu_tcg_init;
 +    cc->tcg_ops.initialize = avr_cpu_tcg_init;
      cc->synchronize_from_tb = avr_cpu_synchronize_from_tb;
      cc->gdb_read_register = avr_cpu_gdb_read_register;
      cc->gdb_write_register = avr_cpu_gdb_write_register;
 diff --git a/target/cris/cpu.c b/target/cris/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/cris/cpu.c
 +++ b/target/cris/cpu.c
@@ -XXX,XX +XXX,XX @@ static void crisv8_cpu_class_init(ObjectClass *oc, void *data)
      ccc->vr = 8;
      cc->do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
 -    cc->tcg_initialize = cris_initialize_crisv10_tcg;
 +    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
  }
- static void crisv9_cpu_class_init(ObjectClass *oc, void *data)
+ static bool fold_addsub2(OptContext *ctx, TCGOp *op, bool add)
-@@ -XXX,XX +XXX,XX @@ static void crisv9_cpu_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ static bool fold_addsub2(OptContext *ctx, TCGOp *op, bool add)
-     ccc->vr = 9;
+         op->args[4] = arg_new_constant(ctx, bl);
-     cc->do_interrupt = crisv10_cpu_do_interrupt;
+         op->args[5] = arg_new_constant(ctx, bh);
-     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
+     }
--    cc->tcg_initialize = cris_initialize_crisv10_tcg;
+-    return false;
-+    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
++    return finish_folding(ctx, op);
  }
- static void crisv10_cpu_class_init(ObjectClass *oc, void *data)
+ static bool fold_add2(OptContext *ctx, TCGOp *op)
@@ -XXX,XX +XXX,XX @@ static void crisv10_cpu_class_init(ObjectClass *oc, void *data)
      ccc->vr = 10;
      cc->do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
 -    cc->tcg_initialize = cris_initialize_crisv10_tcg;
 +    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
  }
  static void crisv11_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void crisv11_cpu_class_init(ObjectClass *oc, void *data)
      ccc->vr = 11;
      cc->do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
 -    cc->tcg_initialize = cris_initialize_crisv10_tcg;
 +    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
  }
  static void crisv17_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void crisv17_cpu_class_init(ObjectClass *oc, void *data)
      ccc->vr = 17;
      cc->do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
 -    cc->tcg_initialize = cris_initialize_crisv10_tcg;
 +    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
  }
  static void crisv32_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
      cc->gdb_stop_before_watchpoint = true;
      cc->disas_set_info = cris_disas_set_info;
 -    cc->tcg_initialize = cris_initialize_tcg;
 +    cc->tcg_ops.initialize = cris_initialize_tcg;
  }
  #define DEFINE_CRIS_CPU_TYPE(cpu_model, initfn) \
 diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hppa/cpu.c
 +++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
  #endif
      cc->do_unaligned_access = hppa_cpu_do_unaligned_access;
      cc->disas_set_info = hppa_cpu_disas_set_info;
 -    cc->tcg_initialize = hppa_translate_init;
 +    cc->tcg_ops.initialize = hppa_translate_init;
      cc->gdb_num_core_regs = 128;
  }
 diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/tcg-cpu.c
 +++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void tcg_cpu_common_class_init(CPUClass *cc)
      cc->synchronize_from_tb = x86_cpu_synchronize_from_tb;
      cc->cpu_exec_enter = x86_cpu_exec_enter;
      cc->cpu_exec_exit = x86_cpu_exec_exit;
 -    cc->tcg_initialize = tcg_x86_init;
 +    cc->tcg_ops.initialize = tcg_x86_init;
      cc->tlb_fill = x86_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->debug_excp_handler = breakpoint_handler;
 diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/lm32/cpu.c
 +++ b/target/lm32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
      cc->gdb_stop_before_watchpoint = true;
      cc->debug_excp_handler = lm32_debug_excp_handler;
      cc->disas_set_info = lm32_cpu_disas_set_info;
 -    cc->tcg_initialize = lm32_translate_init;
 +    cc->tcg_ops.initialize = lm32_translate_init;
  }
  #define DEFINE_LM32_CPU_TYPE(cpu_model, initfn) \
 diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/m68k/cpu.c
 +++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
      dc->vmsd = &vmstate_m68k_cpu;
  #endif
      cc->disas_set_info = m68k_cpu_disas_set_info;
 -    cc->tcg_initialize = m68k_tcg_init;
 +    cc->tcg_ops.initialize = m68k_tcg_init;
      cc->gdb_num_core_regs = 18;
  }
 diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/microblaze/cpu.c
 +++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
      cc->gdb_num_core_regs = 32 + 27;
      cc->disas_set_info = mb_disas_set_info;
 -    cc->tcg_initialize = mb_tcg_init;
 +    cc->tcg_ops.initialize = mb_tcg_init;
  }
  static const TypeInfo mb_cpu_type_info = {
 diff --git a/target/mips/cpu.c b/target/mips/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/cpu.c
 +++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
  #endif
      cc->disas_set_info = mips_cpu_disas_set_info;
  #ifdef CONFIG_TCG
 -    cc->tcg_initialize = mips_tcg_init;
 +    cc->tcg_ops.initialize = mips_tcg_init;
      cc->tlb_fill = mips_cpu_tlb_fill;
  #endif
 diff --git a/target/moxie/cpu.c b/target/moxie/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/moxie/cpu.c
 +++ b/target/moxie/cpu.c
@@ -XXX,XX +XXX,XX @@ static void moxie_cpu_class_init(ObjectClass *oc, void *data)
      cc->vmsd = &vmstate_moxie_cpu;
  #endif
      cc->disas_set_info = moxie_cpu_disas_set_info;
 -    cc->tcg_initialize = moxie_translate_init;
 +    cc->tcg_ops.initialize = moxie_translate_init;
  }
  static void moxielite_initfn(Object *obj)
 diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/nios2/cpu.c
 +++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
      cc->gdb_read_register = nios2_cpu_gdb_read_register;
      cc->gdb_write_register = nios2_cpu_gdb_write_register;
      cc->gdb_num_core_regs = 49;
 -    cc->tcg_initialize = nios2_tcg_init;
 +    cc->tcg_ops.initialize = nios2_tcg_init;
  }
  static const TypeInfo nios2_cpu_type_info = {
 diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/openrisc/cpu.c
 +++ b/target/openrisc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
      dc->vmsd = &vmstate_openrisc_cpu;
  #endif
      cc->gdb_num_core_regs = 32 + 3;
 -    cc->tcg_initialize = openrisc_translate_init;
 +    cc->tcg_ops.initialize = openrisc_translate_init;
      cc->disas_set_info = openrisc_disas_set_info;
  }
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
      cc->gdb_arch_name = riscv_gdb_arch_name;
      cc->gdb_get_dynamic_xml = riscv_gdb_get_dynamic_xml;
  #ifdef CONFIG_TCG
 -    cc->tcg_initialize = riscv_translate_init;
 +    cc->tcg_ops.initialize = riscv_translate_init;
      cc->tlb_fill = riscv_cpu_tlb_fill;
  #endif
      device_class_set_props(dc, riscv_cpu_properties);
 diff --git a/target/rx/cpu.c b/target/rx/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/rx/cpu.c
 +++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
      cc->gdb_write_register = rx_cpu_gdb_write_register;
      cc->get_phys_page_debug = rx_cpu_get_phys_page_debug;
      cc->disas_set_info = rx_cpu_disas_set_info;
 -    cc->tcg_initialize = rx_translate_init;
 +    cc->tcg_ops.initialize = rx_translate_init;
      cc->tlb_fill = rx_cpu_tlb_fill;
      cc->gdb_num_core_regs = 26;
 diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/cpu.c
 +++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
  #endif
      cc->disas_set_info = s390_cpu_disas_set_info;
  #ifdef CONFIG_TCG
 -    cc->tcg_initialize = s390x_translate_init;
 +    cc->tcg_ops.initialize = s390x_translate_init;
      cc->tlb_fill = s390_cpu_tlb_fill;
  #endif
 diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sh4/cpu.c
 +++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
      cc->get_phys_page_debug = superh_cpu_get_phys_page_debug;
  #endif
      cc->disas_set_info = superh_cpu_disas_set_info;
 -    cc->tcg_initialize = sh4_translate_init;
 +    cc->tcg_ops.initialize = sh4_translate_init;
      cc->gdb_num_core_regs = 59;
 diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sparc/cpu.c
 +++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
      cc->vmsd = &vmstate_sparc_cpu;
  #endif
      cc->disas_set_info = cpu_sparc_disas_set_info;
 -    cc->tcg_initialize = sparc_tcg_init;
 +    cc->tcg_ops.initialize = sparc_tcg_init;
  #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
      cc->gdb_num_core_regs = 86;
 diff --git a/target/tilegx/cpu.c b/target/tilegx/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tilegx/cpu.c
 +++ b/target/tilegx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
      cc->set_pc = tilegx_cpu_set_pc;
      cc->tlb_fill = tilegx_cpu_tlb_fill;
      cc->gdb_num_core_regs = 0;
 -    cc->tcg_initialize = tilegx_tcg_init;
 +    cc->tcg_ops.initialize = tilegx_tcg_init;
  }
  static const TypeInfo tilegx_cpu_type_info = {
 diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tricore/cpu.c
 +++ b/target/tricore/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_class_init(ObjectClass *c, void *data)
      cc->set_pc = tricore_cpu_set_pc;
      cc->synchronize_from_tb = tricore_cpu_synchronize_from_tb;
      cc->get_phys_page_debug = tricore_cpu_get_phys_page_debug;
 -    cc->tcg_initialize = tricore_tcg_init;
 +    cc->tcg_ops.initialize = tricore_tcg_init;
      cc->tlb_fill = tricore_cpu_tlb_fill;
  }
 diff --git a/target/unicore32/cpu.c b/target/unicore32/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/unicore32/cpu.c
 +++ b/target/unicore32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
      cc->set_pc = uc32_cpu_set_pc;
      cc->tlb_fill = uc32_cpu_tlb_fill;
      cc->get_phys_page_debug = uc32_cpu_get_phys_page_debug;
 -    cc->tcg_initialize = uc32_translate_init;
 +    cc->tcg_ops.initialize = uc32_translate_init;
      dc->vmsd = &vmstate_uc32_cpu;
  }
 diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/xtensa/cpu.c
 +++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
  #endif
      cc->debug_excp_handler = xtensa_breakpoint_handler;
      cc->disas_set_info = xtensa_cpu_disas_set_info;
 -    cc->tcg_initialize = xtensa_translate_init;
 +    cc->tcg_ops.initialize = xtensa_translate_init;
      dc->vmsd = &vmstate_xtensa_cpu;
  }
 diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/ppc/translate_init.c.inc
 +++ b/target/ppc/translate_init.c.inc
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
      cc->virtio_is_big_endian = ppc_cpu_is_big_endian;
  #endif
  #ifdef CONFIG_TCG
 -    cc->tcg_initialize = ppc_translate_init;
 +    cc->tcg_ops.initialize = ppc_translate_init;
      cc->tlb_fill = ppc_cpu_tlb_fill;
  #endif
  #ifndef CONFIG_USER_ONLY
 --
-.25.1
+.43.0

-[PULL 45/46] accel: replace struct CpusAccel with AccelOpsClass
+[PULL 10/72] tcg/optimize: Introduce const value accessors for TempOptInfo
-From: Claudio Fontana <cfontana@suse.de>
+Introduce ti_is_const, ti_const_val, ti_is_const_val.
-This will allow us to centralize the registration of
-the cpus.c module accelerator operations (in accel/accel-softmmu.c),
-and trigger it automatically using object hierarchy lookup from the
-new accel_init_interfaces() initialization step, depending just on
-which accelerators are available in the code.
-Rename all tcg-cpus.c, kvm-cpus.c, etc to tcg-accel-ops.c,
-kvm-accel-ops.c, etc, matching the object type names.
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
-Message-Id: <20210204163931.7358-18-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/accel-softmmu.h                         | 15 ++++++
+ tcg/optimize.c | 20 +++++++++++++++++---
- accel/kvm/kvm-cpus.h                          |  2 -
+file changed, 17 insertions(+), 3 deletions(-)
  ...g-cpus-icount.h => tcg-accel-ops-icount.h} |  2 +
  accel/tcg/tcg-accel-ops-mttcg.h               | 19 ++++++++
  .../tcg/{tcg-cpus-rr.h => tcg-accel-ops-rr.h} |  0
  accel/tcg/{tcg-cpus.h => tcg-accel-ops.h}     |  6 +--
  include/qemu/accel.h                          |  2 +
  include/sysemu/accel-ops.h                    | 45 ++++++++++++++++++
  include/sysemu/cpus.h                         | 26 ++--------
  .../i386/hax/{hax-cpus.h => hax-accel-ops.h}  |  2 -
  target/i386/hax/hax-windows.h                 |  2 +-
  .../i386/hvf/{hvf-cpus.h => hvf-accel-ops.h}  |  2 -
  .../whpx/{whpx-cpus.h => whpx-accel-ops.h}    |  2 -
  accel/accel-common.c                          | 11 +++++
  accel/accel-softmmu.c                         | 44 +++++++++++++++--
  accel/kvm/{kvm-cpus.c => kvm-accel-ops.c}     | 28 ++++++++---
  accel/kvm/kvm-all.c                           |  2 -
  accel/qtest/qtest.c                           | 23 ++++++---
  ...g-cpus-icount.c => tcg-accel-ops-icount.c} | 21 +++------
  ...tcg-cpus-mttcg.c => tcg-accel-ops-mttcg.c} | 14 ++----
  .../tcg/{tcg-cpus-rr.c => tcg-accel-ops-rr.c} | 13 ++---
  accel/tcg/{tcg-cpus.c => tcg-accel-ops.c}     | 47 ++++++++++++++++++-
  accel/tcg/tcg-all.c                           | 12 -----
  accel/xen/xen-all.c                           | 24 ++++++----
  bsd-user/main.c                               |  3 +-
  linux-user/main.c                             |  1 +
  softmmu/cpus.c                                | 12 ++---
  softmmu/vl.c                                  |  7 ++-
  .../i386/hax/{hax-cpus.c => hax-accel-ops.c}  | 33 +++++++++----
  target/i386/hax/hax-all.c                     |  5 +-
  target/i386/hax/hax-mem.c                     |  2 +-
  target/i386/hax/hax-posix.c                   |  2 +-
  target/i386/hax/hax-windows.c                 |  2 +-
  .../i386/hvf/{hvf-cpus.c => hvf-accel-ops.c}  | 29 +++++++++---
  target/i386/hvf/hvf.c                         |  3 +-
  target/i386/hvf/x86hvf.c                      |  2 +-
  .../whpx/{whpx-cpus.c => whpx-accel-ops.c}    | 33 +++++++++----
  target/i386/whpx/whpx-all.c                   |  7 +--
  MAINTAINERS                                   |  3 +-
  accel/kvm/meson.build                         |  2 +-
  accel/tcg/meson.build                         |  8 ++--
  target/i386/hax/meson.build                   |  2 +-
  target/i386/hvf/meson.build                   |  2 +-
  target/i386/whpx/meson.build                  |  2 +-
 files changed, 361 insertions(+), 163 deletions(-)
  create mode 100644 accel/accel-softmmu.h
  rename accel/tcg/{tcg-cpus-icount.h => tcg-accel-ops-icount.h} (88%)
  create mode 100644 accel/tcg/tcg-accel-ops-mttcg.h
  rename accel/tcg/{tcg-cpus-rr.h => tcg-accel-ops-rr.h} (100%)
  rename accel/tcg/{tcg-cpus.h => tcg-accel-ops.h} (72%)
  create mode 100644 include/sysemu/accel-ops.h
  rename target/i386/hax/{hax-cpus.h => hax-accel-ops.h} (95%)
  rename target/i386/hvf/{hvf-cpus.h => hvf-accel-ops.h} (94%)
  rename target/i386/whpx/{whpx-cpus.h => whpx-accel-ops.h} (96%)
  rename accel/kvm/{kvm-cpus.c => kvm-accel-ops.c} (72%)
  rename accel/tcg/{tcg-cpus-icount.c => tcg-accel-ops-icount.c} (89%)
  rename accel/tcg/{tcg-cpus-mttcg.c => tcg-accel-ops-mttcg.c} (92%)
  rename accel/tcg/{tcg-cpus-rr.c => tcg-accel-ops-rr.c} (97%)
  rename accel/tcg/{tcg-cpus.c => tcg-accel-ops.c} (63%)
  rename target/i386/hax/{hax-cpus.c => hax-accel-ops.c} (69%)
  rename target/i386/hvf/{hvf-cpus.c => hvf-accel-ops.c} (84%)
  rename target/i386/whpx/{whpx-cpus.c => whpx-accel-ops.c} (71%)
-diff --git a/accel/accel-softmmu.h b/accel/accel-softmmu.h
+diff --git a/tcg/optimize.c b/tcg/optimize.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/accel/accel-softmmu.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * QEMU System Emulation accel internal functions
 + *
 + * Copyright 2021 SUSE LLC
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
 +#ifndef ACCEL_SOFTMMU_H
 +#define ACCEL_SOFTMMU_H
 +
 +void accel_init_ops_interfaces(AccelClass *ac);
 +
 +#endif /* ACCEL_SOFTMMU_H */
 diff --git a/accel/kvm/kvm-cpus.h b/accel/kvm/kvm-cpus.h
 index XXXXXXX..XXXXXXX 100644
---- a/accel/kvm/kvm-cpus.h
+--- a/tcg/optimize.c
-+++ b/accel/kvm/kvm-cpus.h
++++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static inline TempOptInfo *arg_info(TCGArg arg)
+     return ts_info(arg_temp(arg));
  #include "sysemu/cpus.h"
 -extern const CpusAccel kvm_cpus;
 -
  int kvm_init_vcpu(CPUState *cpu, Error **errp);
  int kvm_cpu_exec(CPUState *cpu);
  void kvm_destroy_vcpu(CPUState *cpu);
 diff --git a/accel/tcg/tcg-cpus-icount.h b/accel/tcg/tcg-accel-ops-icount.h
 similarity index 88%
 rename from accel/tcg/tcg-cpus-icount.h
 rename to accel/tcg/tcg-accel-ops-icount.h
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/tcg-cpus-icount.h
 +++ b/accel/tcg/tcg-accel-ops-icount.h
@@ -XXX,XX +XXX,XX @@ void icount_handle_deadline(void);
  void icount_prepare_for_run(CPUState *cpu);
  void icount_process_data(CPUState *cpu);
 +void icount_handle_interrupt(CPUState *cpu, int mask);
 +
  #endif /* TCG_CPUS_ICOUNT_H */
 diff --git a/accel/tcg/tcg-accel-ops-mttcg.h b/accel/tcg/tcg-accel-ops-mttcg.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/accel/tcg/tcg-accel-ops-mttcg.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * QEMU TCG Multi Threaded vCPUs implementation
 + *
 + * Copyright 2021 SUSE LLC
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
 +#ifndef TCG_CPUS_MTTCG_H
 +#define TCG_CPUS_MTTCG_H
 +
 +/* kick MTTCG vCPU thread */
 +void mttcg_kick_vcpu_thread(CPUState *cpu);
 +
 +/* start an mttcg vCPU thread */
 +void mttcg_start_vcpu_thread(CPUState *cpu);
 +
 +#endif /* TCG_CPUS_MTTCG_H */
 diff --git a/accel/tcg/tcg-cpus-rr.h b/accel/tcg/tcg-accel-ops-rr.h
 similarity index 100%
 rename from accel/tcg/tcg-cpus-rr.h
 rename to accel/tcg/tcg-accel-ops-rr.h
 diff --git a/accel/tcg/tcg-cpus.h b/accel/tcg/tcg-accel-ops.h
 similarity index 72%
 rename from accel/tcg/tcg-cpus.h
 rename to accel/tcg/tcg-accel-ops.h
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/tcg-cpus.h
 +++ b/accel/tcg/tcg-accel-ops.h
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/cpus.h"
 -extern const CpusAccel tcg_cpus_mttcg;
 -extern const CpusAccel tcg_cpus_icount;
 -extern const CpusAccel tcg_cpus_rr;
 -
  void tcg_cpus_destroy(CPUState *cpu);
  int tcg_cpus_exec(CPUState *cpu);
 -void tcg_cpus_handle_interrupt(CPUState *cpu, int mask);
 +void tcg_handle_interrupt(CPUState *cpu, int mask);
  #endif /* TCG_CPUS_H */
 diff --git a/include/qemu/accel.h b/include/qemu/accel.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/qemu/accel.h
 +++ b/include/qemu/accel.h
@@ -XXX,XX +XXX,XX @@ typedef struct AccelClass {
  AccelClass *accel_find(const char *opt_name);
  AccelState *current_accel(void);
 +void accel_init_interfaces(AccelClass *ac);
 +
  #ifndef CONFIG_USER_ONLY
  int accel_init_machine(AccelState *accel, MachineState *ms);
 diff --git a/include/sysemu/accel-ops.h b/include/sysemu/accel-ops.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/sysemu/accel-ops.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Accelerator OPS, used for cpus.c module
 + *
 + * Copyright 2021 SUSE LLC
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
 +#ifndef ACCEL_OPS_H
 +#define ACCEL_OPS_H
 +
 +#include "qom/object.h"
 +
 +#define ACCEL_OPS_SUFFIX "-ops"
 +#define TYPE_ACCEL_OPS "accel" ACCEL_OPS_SUFFIX
 +#define ACCEL_OPS_NAME(name) (name "-" TYPE_ACCEL_OPS)
 +
 +typedef struct AccelOpsClass AccelOpsClass;
 +DECLARE_CLASS_CHECKERS(AccelOpsClass, ACCEL_OPS, TYPE_ACCEL_OPS)
 +
 +/* cpus.c operations interface */
 +struct AccelOpsClass {
 +    /*< private >*/
 +    ObjectClass parent_class;
 +    /*< public >*/
 +
 +    /* initialization function called when accel is chosen */
 +    void (*ops_init)(AccelOpsClass *ops);
 +
 +    void (*create_vcpu_thread)(CPUState *cpu); /* MANDATORY NON-NULL */
 +    void (*kick_vcpu_thread)(CPUState *cpu);
 +
 +    void (*synchronize_post_reset)(CPUState *cpu);
 +    void (*synchronize_post_init)(CPUState *cpu);
 +    void (*synchronize_state)(CPUState *cpu);
 +    void (*synchronize_pre_loadvm)(CPUState *cpu);
 +
 +    void (*handle_interrupt)(CPUState *cpu, int mask);
 +
 +    int64_t (*get_virtual_clock)(void);
 +    int64_t (*get_elapsed_ticks)(void);
 +};
 +
 +#endif /* ACCEL_OPS_H */
 diff --git a/include/sysemu/cpus.h b/include/sysemu/cpus.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/sysemu/cpus.h
 +++ b/include/sysemu/cpus.h
@@ -XXX,XX +XXX,XX @@
  #define QEMU_CPUS_H
  #include "qemu/timer.h"
 +#include "sysemu/accel-ops.h"
 -/* cpus.c */
 +/* register accel-specific operations */
 +void cpus_register_accel(const AccelOpsClass *i);
 -/* CPU execution threads */
 +/* accel/dummy-cpus.c */
 -typedef struct CpusAccel {
 -    void (*create_vcpu_thread)(CPUState *cpu); /* MANDATORY */
 -    void (*kick_vcpu_thread)(CPUState *cpu);
 -
 -    void (*synchronize_post_reset)(CPUState *cpu);
 -    void (*synchronize_post_init)(CPUState *cpu);
 -    void (*synchronize_state)(CPUState *cpu);
 -    void (*synchronize_pre_loadvm)(CPUState *cpu);
 -
 -    void (*handle_interrupt)(CPUState *cpu, int mask);
 -
 -    int64_t (*get_virtual_clock)(void);
 -    int64_t (*get_elapsed_ticks)(void);
 -} CpusAccel;
 -
 -/* register accel-specific cpus interface implementation */
 -void cpus_register_accel(const CpusAccel *i);
 -
 -/* Create a dummy vcpu for CpusAccel->create_vcpu_thread */
 +/* Create a dummy vcpu for AccelOpsClass->create_vcpu_thread */
  void dummy_start_vcpu_thread(CPUState *);
  /* interface available for cpus accelerator threads */
 diff --git a/target/i386/hax/hax-cpus.h b/target/i386/hax/hax-accel-ops.h
 similarity index 95%
 rename from target/i386/hax/hax-cpus.h
 rename to target/i386/hax/hax-accel-ops.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hax/hax-cpus.h
 +++ b/target/i386/hax/hax-accel-ops.h
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/cpus.h"
 -extern const CpusAccel hax_cpus;
 -
  #include "hax-interface.h"
  #include "hax-i386.h"
 diff --git a/target/i386/hax/hax-windows.h b/target/i386/hax/hax-windows.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hax/hax-windows.h
 +++ b/target/i386/hax/hax-windows.h
@@ -XXX,XX +XXX,XX @@
  #include <winioctl.h>
  #include <windef.h>
 -#include "hax-cpus.h"
 +#include "hax-accel-ops.h"
  #define HAX_INVALID_FD INVALID_HANDLE_VALUE
 diff --git a/target/i386/hvf/hvf-cpus.h b/target/i386/hvf/hvf-accel-ops.h
 similarity index 94%
 rename from target/i386/hvf/hvf-cpus.h
 rename to target/i386/hvf/hvf-accel-ops.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hvf/hvf-cpus.h
 +++ b/target/i386/hvf/hvf-accel-ops.h
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/cpus.h"
 -extern const CpusAccel hvf_cpus;
 -
  int hvf_init_vcpu(CPUState *);
  int hvf_vcpu_exec(CPUState *);
  void hvf_cpu_synchronize_state(CPUState *);
 diff --git a/target/i386/whpx/whpx-cpus.h b/target/i386/whpx/whpx-accel-ops.h
 similarity index 96%
 rename from target/i386/whpx/whpx-cpus.h
 rename to target/i386/whpx/whpx-accel-ops.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/whpx/whpx-cpus.h
 +++ b/target/i386/whpx/whpx-accel-ops.h
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/cpus.h"
 -extern const CpusAccel whpx_cpus;
 -
  int whpx_init_vcpu(CPUState *cpu);
  int whpx_vcpu_exec(CPUState *cpu);
  void whpx_destroy_vcpu(CPUState *cpu);
 diff --git a/accel/accel-common.c b/accel/accel-common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/accel-common.c
 +++ b/accel/accel-common.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qemu/accel.h"
 +#ifndef CONFIG_USER_ONLY
 +#include "accel-softmmu.h"
 +#endif /* !CONFIG_USER_ONLY */
 +
  static const TypeInfo accel_type = {
      .name = TYPE_ACCEL,
      .parent = TYPE_OBJECT,
@@ -XXX,XX +XXX,XX @@ AccelClass *accel_find(const char *opt_name)
      return ac;
  }
-+void accel_init_interfaces(AccelClass *ac)
++static inline bool ti_is_const(TempOptInfo *ti)
 +{
-+#ifndef CONFIG_USER_ONLY
++    return ti->is_const;
 +    accel_init_ops_interfaces(ac);
 +#endif /* !CONFIG_USER_ONLY */
 +}
 +
- static void register_accel_types(void)
++static inline uint64_t ti_const_val(TempOptInfo *ti)
  {
      type_register_static(&accel_type);
 diff --git a/accel/accel-softmmu.c b/accel/accel-softmmu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/accel-softmmu.c
 +++ b/accel/accel-softmmu.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qemu/accel.h"
  #include "hw/boards.h"
 -#include "sysemu/arch_init.h"
 -#include "sysemu/sysemu.h"
 -#include "qom/object.h"
 +#include "sysemu/cpus.h"
 +
 +#include "accel-softmmu.h"
  int accel_init_machine(AccelState *accel, MachineState *ms)
  {
@@ -XXX,XX +XXX,XX @@ void accel_setup_post(MachineState *ms)
          acc->setup_post(ms, accel);
      }
  }
 +
 +/* initialize the arch-independent accel operation interfaces */
 +void accel_init_ops_interfaces(AccelClass *ac)
 +{
-+    const char *ac_name;
++    return ti->val;
 +    char *ops_name;
 +    AccelOpsClass *ops;
 +
 +    ac_name = object_class_get_name(OBJECT_CLASS(ac));
 +    g_assert(ac_name != NULL);
 +
 +    ops_name = g_strdup_printf("%s" ACCEL_OPS_SUFFIX, ac_name);
 +    ops = ACCEL_OPS_CLASS(object_class_by_name(ops_name));
 +    g_free(ops_name);
 +
 +    /*
 +     * all accelerators need to define ops, providing at least a mandatory
 +     * non-NULL create_vcpu_thread operation.
 +     */
 +    g_assert(ops != NULL);
 +    if (ops->ops_init) {
 +        ops->ops_init(ops);
 +    }
 +    cpus_register_accel(ops);
 +}
 +
-+static const TypeInfo accel_ops_type_info = {
++static inline bool ti_is_const_val(TempOptInfo *ti, uint64_t val)
 +    .name = TYPE_ACCEL_OPS,
 +    .parent = TYPE_OBJECT,
 +    .abstract = true,
 +    .class_size = sizeof(AccelOpsClass),
 +};
 +
 +static void accel_softmmu_register_types(void)
 +{
-+    type_register_static(&accel_ops_type_info);
++    return ti_is_const(ti) && ti_const_val(ti) == val;
 +}
 +type_init(accel_softmmu_register_types);
 diff --git a/accel/kvm/kvm-cpus.c b/accel/kvm/kvm-accel-ops.c
 similarity index 72%
 rename from accel/kvm/kvm-cpus.c
 rename to accel/kvm/kvm-accel-ops.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/kvm/kvm-cpus.c
 +++ b/accel/kvm/kvm-accel-ops.c
@@ -XXX,XX +XXX,XX @@ static void kvm_start_vcpu_thread(CPUState *cpu)
                         cpu, QEMU_THREAD_JOINABLE);
  }
 -const CpusAccel kvm_cpus = {
 -    .create_vcpu_thread = kvm_start_vcpu_thread,
 +static void kvm_accel_ops_class_init(ObjectClass *oc, void *data)
 +{
 +    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 -    .synchronize_post_reset = kvm_cpu_synchronize_post_reset,
 -    .synchronize_post_init = kvm_cpu_synchronize_post_init,
 -    .synchronize_state = kvm_cpu_synchronize_state,
 -    .synchronize_pre_loadvm = kvm_cpu_synchronize_pre_loadvm,
 +    ops->create_vcpu_thread = kvm_start_vcpu_thread;
 +    ops->synchronize_post_reset = kvm_cpu_synchronize_post_reset;
 +    ops->synchronize_post_init = kvm_cpu_synchronize_post_init;
 +    ops->synchronize_state = kvm_cpu_synchronize_state;
 +    ops->synchronize_pre_loadvm = kvm_cpu_synchronize_pre_loadvm;
 +}
 +
-+static const TypeInfo kvm_accel_ops_type = {
+ static inline bool ts_is_const(TCGTemp *ts)
 +    .name = ACCEL_OPS_NAME("kvm"),
 +
 +    .parent = TYPE_ACCEL_OPS,
 +    .class_init = kvm_accel_ops_class_init,
 +    .abstract = true,
  };
 +
 +static void kvm_accel_ops_register_types(void)
 +{
 +    type_register_static(&kvm_accel_ops_type);
 +}
 +type_init(kvm_accel_ops_register_types);
 diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/kvm/kvm-all.c
 +++ b/accel/kvm/kvm-all.c
@@ -XXX,XX +XXX,XX @@ static int kvm_init(MachineState *ms)
          ret = ram_block_discard_disable(true);
          assert(!ret);
      }
 -
 -    cpus_register_accel(&kvm_cpus);
      return 0;
  err:
 diff --git a/accel/qtest/qtest.c b/accel/qtest/qtest.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/qtest/qtest.c
 +++ b/accel/qtest/qtest.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/main-loop.h"
  #include "hw/core/cpu.h"
 -const CpusAccel qtest_cpus = {
 -    .create_vcpu_thread = dummy_start_vcpu_thread,
 -    .get_virtual_clock = qtest_get_virtual_clock,
 -};
 -
  static int qtest_init_accel(MachineState *ms)
  {
--    cpus_register_accel(&qtest_cpus);
+-    return ts_info(ts)->is_const;
-     return 0;
++    return ti_is_const(ts_info(ts));
  }
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo qtest_accel_type = {
+ static inline bool ts_is_const_val(TCGTemp *ts, uint64_t val)
      .class_init = qtest_accel_class_init,
  };
 +static void qtest_accel_ops_class_init(ObjectClass *oc, void *data)
 +{
 +    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 +
 +    ops->create_vcpu_thread = dummy_start_vcpu_thread;
 +    ops->get_virtual_clock = qtest_get_virtual_clock;
 +};
 +
 +static const TypeInfo qtest_accel_ops_type = {
 +    .name = ACCEL_OPS_NAME("qtest"),
 +
 +    .parent = TYPE_ACCEL_OPS,
 +    .class_init = qtest_accel_ops_class_init,
 +    .abstract = true,
 +};
 +
  static void qtest_type_init(void)
  {
-     type_register_static(&qtest_accel_type);
+-    TempOptInfo *ti = ts_info(ts);
-+    type_register_static(&qtest_accel_ops_type);
+-    return ti->is_const && ti->val == val;
 +    return ti_is_const_val(ts_info(ts), val);
  }
- type_init(qtest_type_init);
+ static inline bool arg_is_const(TCGArg arg)
 diff --git a/accel/tcg/tcg-cpus-icount.c b/accel/tcg/tcg-accel-ops-icount.c
 similarity index 89%
 rename from accel/tcg/tcg-cpus-icount.c
 rename to accel/tcg/tcg-accel-ops-icount.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/tcg-cpus-icount.c
 +++ b/accel/tcg/tcg-accel-ops-icount.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/exec-all.h"
  #include "hw/boards.h"
 -#include "tcg-cpus.h"
 -#include "tcg-cpus-icount.h"
 -#include "tcg-cpus-rr.h"
 +#include "tcg-accel-ops.h"
 +#include "tcg-accel-ops-icount.h"
 +#include "tcg-accel-ops-rr.h"
  static int64_t icount_get_limit(void)
  {
@@ -XXX,XX +XXX,XX @@ void icount_prepare_for_run(CPUState *cpu)
      /*
       * These should always be cleared by icount_process_data after
       * each vCPU execution. However u16.high can be raised
 -     * asynchronously by cpu_exit/cpu_interrupt/tcg_cpus_handle_interrupt
 +     * asynchronously by cpu_exit/cpu_interrupt/tcg_handle_interrupt
       */
      g_assert(cpu_neg(cpu)->icount_decr.u16.low == 0);
      g_assert(cpu->icount_extra == 0);
@@ -XXX,XX +XXX,XX @@ void icount_process_data(CPUState *cpu)
      replay_mutex_unlock();
  }
 -static void icount_handle_interrupt(CPUState *cpu, int mask)
 +void icount_handle_interrupt(CPUState *cpu, int mask)
  {
      int old_mask = cpu->interrupt_request;
 -    tcg_cpus_handle_interrupt(cpu, mask);
 +    tcg_handle_interrupt(cpu, mask);
      if (qemu_cpu_is_self(cpu) &&
          !cpu->can_do_io
          && (mask & ~old_mask) != 0) {
          cpu_abort(cpu, "Raised interrupt while not in I/O function");
      }
  }
 -
 -const CpusAccel tcg_cpus_icount = {
 -    .create_vcpu_thread = rr_start_vcpu_thread,
 -    .kick_vcpu_thread = rr_kick_vcpu_thread,
 -
 -    .handle_interrupt = icount_handle_interrupt,
 -    .get_virtual_clock = icount_get,
 -    .get_elapsed_ticks = icount_get,
 -};
 diff --git a/accel/tcg/tcg-cpus-mttcg.c b/accel/tcg/tcg-accel-ops-mttcg.c
 similarity index 92%
 rename from accel/tcg/tcg-cpus-mttcg.c
 rename to accel/tcg/tcg-accel-ops-mttcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/tcg-cpus-mttcg.c
 +++ b/accel/tcg/tcg-accel-ops-mttcg.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/exec-all.h"
  #include "hw/boards.h"
 -#include "tcg-cpus.h"
 +#include "tcg-accel-ops.h"
 +#include "tcg-accel-ops-mttcg.h"
  /*
   * In the multi-threaded case each vCPU has its own thread. The TLS
@@ -XXX,XX +XXX,XX @@ static void *mttcg_cpu_thread_fn(void *arg)
      return NULL;
  }
 -static void mttcg_kick_vcpu_thread(CPUState *cpu)
 +void mttcg_kick_vcpu_thread(CPUState *cpu)
  {
      cpu_exit(cpu);
  }
 -static void mttcg_start_vcpu_thread(CPUState *cpu)
 +void mttcg_start_vcpu_thread(CPUState *cpu)
  {
      char thread_name[VCPU_THREAD_NAME_SIZE];
@@ -XXX,XX +XXX,XX @@ static void mttcg_start_vcpu_thread(CPUState *cpu)
      cpu->hThread = qemu_thread_get_handle(cpu->thread);
  #endif
  }
 -
 -const CpusAccel tcg_cpus_mttcg = {
 -    .create_vcpu_thread = mttcg_start_vcpu_thread,
 -    .kick_vcpu_thread = mttcg_kick_vcpu_thread,
 -
 -    .handle_interrupt = tcg_cpus_handle_interrupt,
 -};
 diff --git a/accel/tcg/tcg-cpus-rr.c b/accel/tcg/tcg-accel-ops-rr.c
 similarity index 97%
 rename from accel/tcg/tcg-cpus-rr.c
 rename to accel/tcg/tcg-accel-ops-rr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/tcg-cpus-rr.c
 +++ b/accel/tcg/tcg-accel-ops-rr.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/exec-all.h"
  #include "hw/boards.h"
 -#include "tcg-cpus.h"
 -#include "tcg-cpus-rr.h"
 -#include "tcg-cpus-icount.h"
 +#include "tcg-accel-ops.h"
 +#include "tcg-accel-ops-rr.h"
 +#include "tcg-accel-ops-icount.h"
  /* Kick all RR vCPUs */
  void rr_kick_vcpu_thread(CPUState *unused)
@@ -XXX,XX +XXX,XX @@ void rr_start_vcpu_thread(CPUState *cpu)
          cpu->created = true;
      }
  }
 -
 -const CpusAccel tcg_cpus_rr = {
 -    .create_vcpu_thread = rr_start_vcpu_thread,
 -    .kick_vcpu_thread = rr_kick_vcpu_thread,
 -
 -    .handle_interrupt = tcg_cpus_handle_interrupt,
 -};
 diff --git a/accel/tcg/tcg-cpus.c b/accel/tcg/tcg-accel-ops.c
 similarity index 63%
 rename from accel/tcg/tcg-cpus.c
 rename to accel/tcg/tcg-accel-ops.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/tcg-cpus.c
 +++ b/accel/tcg/tcg-accel-ops.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/exec-all.h"
  #include "hw/boards.h"
 -#include "tcg-cpus.h"
 +#include "tcg-accel-ops.h"
 +#include "tcg-accel-ops-mttcg.h"
 +#include "tcg-accel-ops-rr.h"
 +#include "tcg-accel-ops-icount.h"
  /* common functionality among all TCG variants */
@@ -XXX,XX +XXX,XX @@ int tcg_cpus_exec(CPUState *cpu)
  }
  /* mask must never be zero, except for A20 change call */
 -void tcg_cpus_handle_interrupt(CPUState *cpu, int mask)
 +void tcg_handle_interrupt(CPUState *cpu, int mask)
  {
      g_assert(qemu_mutex_iothread_locked());
@@ -XXX,XX +XXX,XX @@ void tcg_cpus_handle_interrupt(CPUState *cpu, int mask)
          qatomic_set(&cpu_neg(cpu)->icount_decr.u16.high, -1);
      }
  }
 +
 +static void tcg_accel_ops_init(AccelOpsClass *ops)
 +{
 +    if (qemu_tcg_mttcg_enabled()) {
 +        ops->create_vcpu_thread = mttcg_start_vcpu_thread;
 +        ops->kick_vcpu_thread = mttcg_kick_vcpu_thread;
 +        ops->handle_interrupt = tcg_handle_interrupt;
 +    } else if (icount_enabled()) {
 +        ops->create_vcpu_thread = rr_start_vcpu_thread;
 +        ops->kick_vcpu_thread = rr_kick_vcpu_thread;
 +        ops->handle_interrupt = icount_handle_interrupt;
 +        ops->get_virtual_clock = icount_get;
 +        ops->get_elapsed_ticks = icount_get;
 +    } else {
 +        ops->create_vcpu_thread = rr_start_vcpu_thread;
 +        ops->kick_vcpu_thread = rr_kick_vcpu_thread;
 +        ops->handle_interrupt = tcg_handle_interrupt;
 +    }
 +}
 +
 +static void tcg_accel_ops_class_init(ObjectClass *oc, void *data)
 +{
 +    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 +
 +    ops->ops_init = tcg_accel_ops_init;
 +}
 +
 +static const TypeInfo tcg_accel_ops_type = {
 +    .name = ACCEL_OPS_NAME("tcg"),
 +
 +    .parent = TYPE_ACCEL_OPS,
 +    .class_init = tcg_accel_ops_class_init,
 +    .abstract = true,
 +};
 +
 +static void tcg_accel_ops_register_types(void)
 +{
 +    type_register_static(&tcg_accel_ops_type);
 +}
 +type_init(tcg_accel_ops_register_types);
 diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/tcg-all.c
 +++ b/accel/tcg/tcg-all.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/accel.h"
  #include "qapi/qapi-builtin-visit.h"
 -#ifndef CONFIG_USER_ONLY
 -#include "tcg-cpus.h"
 -#endif /* CONFIG_USER_ONLY */
 -
  struct TCGState {
      AccelState parent_obj;
@@ -XXX,XX +XXX,XX @@ static int tcg_init(MachineState *ms)
       */
  #ifndef CONFIG_USER_ONLY
      tcg_region_init();
 -
 -    if (mttcg_enabled) {
 -        cpus_register_accel(&tcg_cpus_mttcg);
 -    } else if (icount_enabled()) {
 -        cpus_register_accel(&tcg_cpus_icount);
 -    } else {
 -        cpus_register_accel(&tcg_cpus_rr);
 -    }
  #endif /* !CONFIG_USER_ONLY */
      return 0;
 diff --git a/accel/xen/xen-all.c b/accel/xen/xen-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/xen/xen-all.c
 +++ b/accel/xen/xen-all.c
@@ -XXX,XX +XXX,XX @@ static void xen_setup_post(MachineState *ms, AccelState *accel)
      }
  }
 -const CpusAccel xen_cpus = {
 -    .create_vcpu_thread = dummy_start_vcpu_thread,
 -};
 -
  static int xen_init(MachineState *ms)
  {
      MachineClass *mc = MACHINE_GET_CLASS(ms);
@@ -XXX,XX +XXX,XX @@ static int xen_init(MachineState *ms)
       * opt out of system RAM being allocated by generic code
       */
      mc->default_ram_id = NULL;
 -
 -    cpus_register_accel(&xen_cpus);
 -
      return 0;
  }
@@ -XXX,XX +XXX,XX @@ static const TypeInfo xen_accel_type = {
      .class_init = xen_accel_class_init,
  };
 +static void xen_accel_ops_class_init(ObjectClass *oc, void *data)
 +{
 +    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 +
 +    ops->create_vcpu_thread = dummy_start_vcpu_thread;
 +}
 +
 +static const TypeInfo xen_accel_ops_type = {
 +    .name = ACCEL_OPS_NAME("xen"),
 +
 +    .parent = TYPE_ACCEL_OPS,
 +    .class_init = xen_accel_ops_class_init,
 +    .abstract = true,
 +};
 +
  static void xen_type_init(void)
  {
      type_register_static(&xen_accel_type);
 +    type_register_static(&xen_accel_ops_type);
  }
 -
  type_init(xen_type_init);
 diff --git a/bsd-user/main.c b/bsd-user/main.c
 index XXXXXXX..XXXXXXX 100644
 --- a/bsd-user/main.c
 +++ b/bsd-user/main.c
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
  #endif
      }
 +    cpu_type = parse_cpu_option(cpu_model);
      /* init tcg before creating CPUs and to get qemu_host_page_size */
      {
          AccelClass *ac = ACCEL_GET_CLASS(current_accel());
          ac->init_machine(NULL);
 +        accel_init_interfaces(ac);
      }
 -    cpu_type = parse_cpu_option(cpu_model);
      cpu = cpu_create(cpu_type);
      env = cpu->env_ptr;
  #if defined(TARGET_SPARC) || defined(TARGET_PPC)
 diff --git a/linux-user/main.c b/linux-user/main.c
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/main.c
 +++ b/linux-user/main.c
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp)
          AccelClass *ac = ACCEL_GET_CLASS(current_accel());
          ac->init_machine(NULL);
 +        accel_init_interfaces(ac);
      }
      cpu = cpu_create(cpu_type);
      env = cpu->env_ptr;
 diff --git a/softmmu/cpus.c b/softmmu/cpus.c
 index XXXXXXX..XXXXXXX 100644
 --- a/softmmu/cpus.c
 +++ b/softmmu/cpus.c
@@ -XXX,XX +XXX,XX @@ void hw_error(const char *fmt, ...)
  /*
   * The chosen accelerator is supposed to register this.
   */
 -static const CpusAccel *cpus_accel;
 +static const AccelOpsClass *cpus_accel;
  void cpu_synchronize_all_states(void)
  {
@@ -XXX,XX +XXX,XX @@ void cpu_remove_sync(CPUState *cpu)
      qemu_mutex_lock_iothread();
  }
 -void cpus_register_accel(const CpusAccel *ca)
 +void cpus_register_accel(const AccelOpsClass *ops)
  {
 -    assert(ca != NULL);
 -    assert(ca->create_vcpu_thread != NULL); /* mandatory */
 -    cpus_accel = ca;
 +    assert(ops != NULL);
 +    assert(ops->create_vcpu_thread != NULL); /* mandatory */
 +    cpus_accel = ops;
  }
  void qemu_init_vcpu(CPUState *cpu)
@@ -XXX,XX +XXX,XX @@ void qemu_init_vcpu(CPUState *cpu)
          cpu_address_space_init(cpu, 0, "cpu-memory", cpu->memory);
      }
 -    /* accelerators all implement the CpusAccel interface */
 +    /* accelerators all implement the AccelOpsClass */
      g_assert(cpus_accel != NULL && cpus_accel->create_vcpu_thread != NULL);
      cpus_accel->create_vcpu_thread(cpu);
 diff --git a/softmmu/vl.c b/softmmu/vl.c
 index XXXXXXX..XXXXXXX 100644
 --- a/softmmu/vl.c
 +++ b/softmmu/vl.c
@@ -XXX,XX +XXX,XX @@ static bool object_create_early(const char *type, QemuOpts *opts)
          return false;
      }
 -    /* Allocation of large amounts of memory may delay
 +    /*
 +     * Allocation of large amounts of memory may delay
       * chardev initialization for too long, and trigger timeouts
       * on software that waits for a monitor socket to be created
       * (e.g. libvirt).
@@ -XXX,XX +XXX,XX @@ void qemu_init(int argc, char **argv, char **envp)
       *
       * Machine compat properties: object_set_machine_compat_props().
       * Accelerator compat props: object_set_accelerator_compat_props(),
 -     * called from configure_accelerator().
 +     * called from do_configure_accelerator().
       */
      machine_class = MACHINE_GET_CLASS(current_machine);
@@ -XXX,XX +XXX,XX @@ void qemu_init(int argc, char **argv, char **envp)
      if (cpu_option) {
          current_machine->cpu_type = parse_cpu_option(cpu_option);
      }
 +    /* NB: for machine none cpu_type could STILL be NULL here! */
 +    accel_init_interfaces(ACCEL_GET_CLASS(current_machine->accelerator));
      qemu_resolve_machine_memdev();
      parse_numa_opts(current_machine);
 diff --git a/target/i386/hax/hax-cpus.c b/target/i386/hax/hax-accel-ops.c
 similarity index 69%
 rename from target/i386/hax/hax-cpus.c
 rename to target/i386/hax/hax-accel-ops.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hax/hax-cpus.c
 +++ b/target/i386/hax/hax-accel-ops.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/cpus.h"
  #include "qemu/guest-random.h"
 -#include "hax-cpus.h"
 +#include "hax-accel-ops.h"
  static void *hax_cpu_thread_fn(void *arg)
  {
@@ -XXX,XX +XXX,XX @@ static void hax_start_vcpu_thread(CPUState *cpu)
  #endif
  }
 -const CpusAccel hax_cpus = {
 -    .create_vcpu_thread = hax_start_vcpu_thread,
 -    .kick_vcpu_thread = hax_kick_vcpu_thread,
 +static void hax_accel_ops_class_init(ObjectClass *oc, void *data)
 +{
 +    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 -    .synchronize_post_reset = hax_cpu_synchronize_post_reset,
 -    .synchronize_post_init = hax_cpu_synchronize_post_init,
 -    .synchronize_state = hax_cpu_synchronize_state,
 -    .synchronize_pre_loadvm = hax_cpu_synchronize_pre_loadvm,
 +    ops->create_vcpu_thread = hax_start_vcpu_thread;
 +    ops->kick_vcpu_thread = hax_kick_vcpu_thread;
 +
 +    ops->synchronize_post_reset = hax_cpu_synchronize_post_reset;
 +    ops->synchronize_post_init = hax_cpu_synchronize_post_init;
 +    ops->synchronize_state = hax_cpu_synchronize_state;
 +    ops->synchronize_pre_loadvm = hax_cpu_synchronize_pre_loadvm;
 +}
 +
 +static const TypeInfo hax_accel_ops_type = {
 +    .name = ACCEL_OPS_NAME("hax"),
 +
 +    .parent = TYPE_ACCEL_OPS,
 +    .class_init = hax_accel_ops_class_init,
 +    .abstract = true,
  };
 +
 +static void hax_accel_ops_register_types(void)
 +{
 +    type_register_static(&hax_accel_ops_type);
 +}
 +type_init(hax_accel_ops_register_types);
 diff --git a/target/i386/hax/hax-all.c b/target/i386/hax/hax-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hax/hax-all.c
 +++ b/target/i386/hax/hax-all.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/runstate.h"
  #include "hw/boards.h"
 -#include "hax-cpus.h"
 +#include "hax-accel-ops.h"
  #define DEBUG_HAX 0
@@ -XXX,XX +XXX,XX @@ static int hax_accel_init(MachineState *ms)
                  !ret ? "working" : "not working",
                  !ret ? "fast virt" : "emulation");
      }
 -    if (ret == 0) {
 -        cpus_register_accel(&hax_cpus);
 -    }
      return ret;
  }
 diff --git a/target/i386/hax/hax-mem.c b/target/i386/hax/hax-mem.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hax/hax-mem.c
 +++ b/target/i386/hax/hax-mem.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/address-spaces.h"
  #include "qemu/error-report.h"
 -#include "hax-cpus.h"
 +#include "hax-accel-ops.h"
  #include "qemu/queue.h"
  #define DEBUG_HAX_MEM 0
 diff --git a/target/i386/hax/hax-posix.c b/target/i386/hax/hax-posix.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hax/hax-posix.c
 +++ b/target/i386/hax/hax-posix.c
@@ -XXX,XX +XXX,XX @@
  #include <sys/ioctl.h>
  #include "sysemu/cpus.h"
 -#include "hax-cpus.h"
 +#include "hax-accel-ops.h"
  hax_fd hax_mod_open(void)
  {
 diff --git a/target/i386/hax/hax-windows.c b/target/i386/hax/hax-windows.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hax/hax-windows.c
 +++ b/target/i386/hax/hax-windows.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "cpu.h"
 -#include "hax-cpus.h"
 +#include "hax-accel-ops.h"
  /*
   * return 0 when success, -1 when driver not loaded,
 diff --git a/target/i386/hvf/hvf-cpus.c b/target/i386/hvf/hvf-accel-ops.c
 similarity index 84%
 rename from target/i386/hvf/hvf-cpus.c
 rename to target/i386/hvf/hvf-accel-ops.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hvf/hvf-cpus.c
 +++ b/target/i386/hvf/hvf-accel-ops.c
@@ -XXX,XX +XXX,XX @@
  #include "target/i386/cpu.h"
  #include "qemu/guest-random.h"
 -#include "hvf-cpus.h"
 +#include "hvf-accel-ops.h"
  /*
   * The HVF-specific vCPU thread function. This one should only run when the host
@@ -XXX,XX +XXX,XX @@ static void hvf_start_vcpu_thread(CPUState *cpu)
                         cpu, QEMU_THREAD_JOINABLE);
  }
 -const CpusAccel hvf_cpus = {
 -    .create_vcpu_thread = hvf_start_vcpu_thread,
 +static void hvf_accel_ops_class_init(ObjectClass *oc, void *data)
 +{
 +    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 -    .synchronize_post_reset = hvf_cpu_synchronize_post_reset,
 -    .synchronize_post_init = hvf_cpu_synchronize_post_init,
 -    .synchronize_state = hvf_cpu_synchronize_state,
 -    .synchronize_pre_loadvm = hvf_cpu_synchronize_pre_loadvm,
 +    ops->create_vcpu_thread = hvf_start_vcpu_thread;
 +
 +    ops->synchronize_post_reset = hvf_cpu_synchronize_post_reset;
 +    ops->synchronize_post_init = hvf_cpu_synchronize_post_init;
 +    ops->synchronize_state = hvf_cpu_synchronize_state;
 +    ops->synchronize_pre_loadvm = hvf_cpu_synchronize_pre_loadvm;
  };
 +static const TypeInfo hvf_accel_ops_type = {
 +    .name = ACCEL_OPS_NAME("hvf"),
 +
 +    .parent = TYPE_ACCEL_OPS,
 +    .class_init = hvf_accel_ops_class_init,
 +    .abstract = true,
 +};
 +static void hvf_accel_ops_register_types(void)
 +{
 +    type_register_static(&hvf_accel_ops_type);
 +}
 +type_init(hvf_accel_ops_register_types);
 diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hvf/hvf.c
 +++ b/target/i386/hvf/hvf.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/accel.h"
  #include "target/i386/cpu.h"
 -#include "hvf-cpus.h"
 +#include "hvf-accel-ops.h"
  HVFState *hvf_state;
@@ -XXX,XX +XXX,XX @@ static int hvf_accel_init(MachineState *ms)
      hvf_state = s;
      memory_listener_register(&hvf_memory_listener, &address_space_memory);
 -    cpus_register_accel(&hvf_cpus);
      return 0;
  }
 diff --git a/target/i386/hvf/x86hvf.c b/target/i386/hvf/x86hvf.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hvf/x86hvf.c
 +++ b/target/i386/hvf/x86hvf.c
@@ -XXX,XX +XXX,XX @@
  #include <Hypervisor/hv.h>
  #include <Hypervisor/hv_vmx.h>
 -#include "hvf-cpus.h"
 +#include "hvf-accel-ops.h"
  void hvf_set_segment(struct CPUState *cpu, struct vmx_segment *vmx_seg,
                       SegmentCache *qseg, bool is_tr)
 diff --git a/target/i386/whpx/whpx-cpus.c b/target/i386/whpx/whpx-accel-ops.c
 similarity index 71%
 rename from target/i386/whpx/whpx-cpus.c
 rename to target/i386/whpx/whpx-accel-ops.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/whpx/whpx-cpus.c
 +++ b/target/i386/whpx/whpx-accel-ops.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/whpx.h"
  #include "whpx-internal.h"
 -#include "whpx-cpus.h"
 +#include "whpx-accel-ops.h"
  static void *whpx_cpu_thread_fn(void *arg)
  {
@@ -XXX,XX +XXX,XX @@ static void whpx_kick_vcpu_thread(CPUState *cpu)
      }
  }
 -const CpusAccel whpx_cpus = {
 -    .create_vcpu_thread = whpx_start_vcpu_thread,
 -    .kick_vcpu_thread = whpx_kick_vcpu_thread,
 +static void whpx_accel_ops_class_init(ObjectClass *oc, void *data)
 +{
 +    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 -    .synchronize_post_reset = whpx_cpu_synchronize_post_reset,
 -    .synchronize_post_init = whpx_cpu_synchronize_post_init,
 -    .synchronize_state = whpx_cpu_synchronize_state,
 -    .synchronize_pre_loadvm = whpx_cpu_synchronize_pre_loadvm,
 +    ops->create_vcpu_thread = whpx_start_vcpu_thread;
 +    ops->kick_vcpu_thread = whpx_kick_vcpu_thread;
 +
 +    ops->synchronize_post_reset = whpx_cpu_synchronize_post_reset;
 +    ops->synchronize_post_init = whpx_cpu_synchronize_post_init;
 +    ops->synchronize_state = whpx_cpu_synchronize_state;
 +    ops->synchronize_pre_loadvm = whpx_cpu_synchronize_pre_loadvm;
 +}
 +
 +static const TypeInfo whpx_accel_ops_type = {
 +    .name = ACCEL_OPS_NAME("whpx"),
 +
 +    .parent = TYPE_ACCEL_OPS,
 +    .class_init = whpx_accel_ops_class_init,
 +    .abstract = true,
  };
 +
 +static void whpx_accel_ops_register_types(void)
 +{
 +    type_register_static(&whpx_accel_ops_type);
 +}
 +type_init(whpx_accel_ops_register_types);
 diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/whpx/whpx-all.c
 +++ b/target/i386/whpx/whpx-all.c
@@ -XXX,XX +XXX,XX @@
  #include "migration/blocker.h"
  #include <winerror.h>
 -#include "whpx-cpus.h"
  #include "whpx-internal.h"
 +#include "whpx-accel-ops.h"
 +
 +#include <WinHvPlatform.h>
 +#include <WinHvEmulation.h>
  #define HYPERV_APIC_BUS_FREQUENCY      (200000000ULL)
@@ -XXX,XX +XXX,XX @@ static int whpx_accel_init(MachineState *ms)
      whpx_memory_init();
 -    cpus_register_accel(&whpx_cpus);
 -
      printf("Windows Hypervisor Platform accelerator is operational\n");
      return 0;
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ M: Richard Henderson <richard.henderson@linaro.org>
  R: Paolo Bonzini <pbonzini@redhat.com>
  S: Maintained
  F: include/qemu/accel.h
 -F: accel/accel.c
 +F: include/sysemu/accel-ops.h
 +F: accel/accel-*.c
  F: accel/Makefile.objs
  F: accel/stubs/Makefile.objs
 diff --git a/accel/kvm/meson.build b/accel/kvm/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/kvm/meson.build
 +++ b/accel/kvm/meson.build
@@ -XXX,XX +XXX,XX @@
  kvm_ss = ss.source_set()
  kvm_ss.add(files(
    'kvm-all.c',
 -  'kvm-cpus.c',
 +  'kvm-accel-ops.c',
  ))
  kvm_ss.add(when: 'CONFIG_SEV', if_false: files('sev-stub.c'))
 diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/meson.build
 +++ b/accel/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_ss)
  specific_ss.add(when: ['CONFIG_SOFTMMU', 'CONFIG_TCG'], if_true: files(
    'cputlb.c',
 -  'tcg-cpus.c',
 -  'tcg-cpus-mttcg.c',
 -  'tcg-cpus-icount.c',
 -  'tcg-cpus-rr.c'
 +  'tcg-accel-ops.c',
 +  'tcg-accel-ops-mttcg.c',
 +  'tcg-accel-ops-icount.c',
 +  'tcg-accel-ops-rr.c'
  ))
 diff --git a/target/i386/hax/meson.build b/target/i386/hax/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hax/meson.build
 +++ b/target/i386/hax/meson.build
@@ -XXX,XX +XXX,XX @@
  i386_softmmu_ss.add(when: 'CONFIG_HAX', if_true: files(
    'hax-all.c',
    'hax-mem.c',
 -  'hax-cpus.c',
 +  'hax-accel-ops.c',
  ))
  i386_softmmu_ss.add(when: ['CONFIG_HAX', 'CONFIG_POSIX'], if_true: files('hax-posix.c'))
  i386_softmmu_ss.add(when: ['CONFIG_HAX', 'CONFIG_WIN32'], if_true: files('hax-windows.c'))
 diff --git a/target/i386/hvf/meson.build b/target/i386/hvf/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hvf/meson.build
 +++ b/target/i386/hvf/meson.build
@@ -XXX,XX +XXX,XX @@
  i386_softmmu_ss.add(when: [hvf, 'CONFIG_HVF'], if_true: files(
    'hvf.c',
 -  'hvf-cpus.c',
 +  'hvf-accel-ops.c',
    'x86.c',
    'x86_cpuid.c',
    'x86_decode.c',
 diff --git a/target/i386/whpx/meson.build b/target/i386/whpx/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/whpx/meson.build
 +++ b/target/i386/whpx/meson.build
@@ -XXX,XX +XXX,XX @@
  i386_softmmu_ss.add(when: 'CONFIG_WHPX', if_true: files(
    'whpx-all.c',
    'whpx-apic.c',
 -  'whpx-cpus.c',
 +  'whpx-accel-ops.c',
  ))
 --
-.25.1
+.43.0

-New patch
+[PULL 11/72] tcg/optimize: Use fold_masks_zs in fold_and
+Avoid the use of the OptContext slots.  Find TempOptInfo once.
+Sink mask computation below fold_affected_mask early exit.
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/optimize.c | 30 ++++++++++++++++--------------
+file changed, 16 insertions(+), 14 deletions(-)
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -XXX,XX +XXX,XX @@ static bool fold_add2(OptContext *ctx, TCGOp *op)
+ static bool fold_and(OptContext *ctx, TCGOp *op)
+ {
+-    uint64_t z1, z2;
++    uint64_t z1, z2, z_mask, s_mask;
++    TempOptInfo *t1, *t2;
+     if (fold_const2_commutative(ctx, op) ||
+         fold_xi_to_i(ctx, op, 0) ||
+@@ -XXX,XX +XXX,XX @@ static bool fold_and(OptContext *ctx, TCGOp *op)
+         return true;
+     }
+-    z1 = arg_info(op->args[1])->z_mask;
+-    z2 = arg_info(op->args[2])->z_mask;
+-    ctx->z_mask = z1 & z2;
+-
+-    /*
+-     * Sign repetitions are perforce all identical, whether they are 1 or 0.
+-     * Bitwise operations preserve the relative quantity of the repetitions.
+-     */
+-    ctx->s_mask = arg_info(op->args[1])->s_mask
+-                & arg_info(op->args[2])->s_mask;
++    t1 = arg_info(op->args[1]);
++    t2 = arg_info(op->args[2]);
++    z1 = t1->z_mask;
++    z2 = t2->z_mask;
+     /*
+      * Known-zeros does not imply known-ones.  Therefore unless
+      * arg2 is constant, we can't infer affected bits from it.
+      */
+-    if (arg_is_const(op->args[2]) &&
+-        fold_affected_mask(ctx, op, z1 & ~z2)) {
++    if (ti_is_const(t2) && fold_affected_mask(ctx, op, z1 & ~z2)) {
+         return true;
+     }
+-    return fold_masks(ctx, op);
++    z_mask = z1 & z2;
++
++    /*
++     * Sign repetitions are perforce all identical, whether they are 1 or 0.
++     * Bitwise operations preserve the relative quantity of the repetitions.
++     */
++    s_mask = t1->s_mask & t2->s_mask;
++
++    return fold_masks_zs(ctx, op, z_mask, s_mask);
+ }
+ static bool fold_andc(OptContext *ctx, TCGOp *op)
+--
+.43.0

-New patch
+[PULL 12/72] tcg/optimize: Use fold_masks_zs in fold_andc
+Avoid the use of the OptContext slots.  Find TempOptInfo once.
+Avoid double inversion of the value of second const operand.
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/optimize.c | 21 +++++++++++----------
+file changed, 11 insertions(+), 10 deletions(-)
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -XXX,XX +XXX,XX @@ static bool fold_and(OptContext *ctx, TCGOp *op)
+ static bool fold_andc(OptContext *ctx, TCGOp *op)
+ {
+-    uint64_t z1;
++    uint64_t z_mask, s_mask;
++    TempOptInfo *t1, *t2;
+     if (fold_const2(ctx, op) ||
+         fold_xx_to_i(ctx, op, 0) ||
+@@ -XXX,XX +XXX,XX @@ static bool fold_andc(OptContext *ctx, TCGOp *op)
+         return true;
+     }
+-    z1 = arg_info(op->args[1])->z_mask;
++    t1 = arg_info(op->args[1]);
++    t2 = arg_info(op->args[2]);
++    z_mask = t1->z_mask;
+     /*
+      * Known-zeros does not imply known-ones.  Therefore unless
+      * arg2 is constant, we can't infer anything from it.
+      */
+-    if (arg_is_const(op->args[2])) {
+-        uint64_t z2 = ~arg_info(op->args[2])->z_mask;
+-        if (fold_affected_mask(ctx, op, z1 & ~z2)) {
++    if (ti_is_const(t2)) {
++        uint64_t v2 = ti_const_val(t2);
++        if (fold_affected_mask(ctx, op, z_mask & v2)) {
+             return true;
+         }
+-        z1 &= z2;
++        z_mask &= ~v2;
+     }
+-    ctx->z_mask = z1;
+-    ctx->s_mask = arg_info(op->args[1])->s_mask
+-                & arg_info(op->args[2])->s_mask;
+-    return fold_masks(ctx, op);
++    s_mask = t1->s_mask & t2->s_mask;
++    return fold_masks_zs(ctx, op, z_mask, s_mask);
+ }
+ static bool fold_brcond(OptContext *ctx, TCGOp *op)
+--
+.43.0

-New patch
+[PULL 13/72] tcg/optimize: Use fold_masks_zs in fold_bswap
+Avoid the use of the OptContext slots.  Find TempOptInfo once.
+Always set s_mask along the BSWAP_OS path, since the result is
+being explicitly sign-extended.
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/optimize.c | 21 ++++++++++-----------
+file changed, 10 insertions(+), 11 deletions(-)
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -XXX,XX +XXX,XX @@ static bool fold_brcond2(OptContext *ctx, TCGOp *op)
+ static bool fold_bswap(OptContext *ctx, TCGOp *op)
+ {
+     uint64_t z_mask, s_mask, sign;
++    TempOptInfo *t1 = arg_info(op->args[1]);
+-    if (arg_is_const(op->args[1])) {
+-        uint64_t t = arg_info(op->args[1])->val;
+-
+-        t = do_constant_folding(op->opc, ctx->type, t, op->args[2]);
+-        return tcg_opt_gen_movi(ctx, op, op->args[0], t);
++    if (ti_is_const(t1)) {
++        return tcg_opt_gen_movi(ctx, op, op->args[0],
++                                do_constant_folding(op->opc, ctx->type,
++                                                    ti_const_val(t1),
++                                                    op->args[2]));
+     }
+-    z_mask = arg_info(op->args[1])->z_mask;
+-
++    z_mask = t1->z_mask;
+     switch (op->opc) {
+     case INDEX_op_bswap16_i32:
+     case INDEX_op_bswap16_i64:
+@@ -XXX,XX +XXX,XX @@ static bool fold_bswap(OptContext *ctx, TCGOp *op)
+         /* If the sign bit may be 1, force all the bits above to 1. */
+         if (z_mask & sign) {
+             z_mask |= sign;
+-            s_mask = sign << 1;
+         }
++        /* The value and therefore s_mask is explicitly sign-extended. */
++        s_mask = sign;
+         break;
+     default:
+         /* The high bits are undefined: force all bits above the sign to 1. */
+         z_mask |= sign << 1;
+         break;
+     }
+-    ctx->z_mask = z_mask;
+-    ctx->s_mask = s_mask;
+-    return fold_masks(ctx, op);
++    return fold_masks_zs(ctx, op, z_mask, s_mask);
+ }
+ static bool fold_call(OptContext *ctx, TCGOp *op)
+--
+.43.0

-New patch
+[PULL 14/72] tcg/optimize: Use fold_masks_zs in fold_count_zeros
+Avoid the use of the OptContext slots. Find TempOptInfo once.
+Compute s_mask from the union of the maximum count and the
+op2 fallback for op1 being zero.
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/optimize.c | 15 ++++++++++-----
+file changed, 10 insertions(+), 5 deletions(-)
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -XXX,XX +XXX,XX @@ static bool fold_call(OptContext *ctx, TCGOp *op)
+ static bool fold_count_zeros(OptContext *ctx, TCGOp *op)
+ {
+-    uint64_t z_mask;
++    uint64_t z_mask, s_mask;
++    TempOptInfo *t1 = arg_info(op->args[1]);
++    TempOptInfo *t2 = arg_info(op->args[2]);
+-    if (arg_is_const(op->args[1])) {
+-        uint64_t t = arg_info(op->args[1])->val;
++    if (ti_is_const(t1)) {
++        uint64_t t = ti_const_val(t1);
+         if (t != 0) {
+             t = do_constant_folding(op->opc, ctx->type, t, 0);
+@@ -XXX,XX +XXX,XX @@ static bool fold_count_zeros(OptContext *ctx, TCGOp *op)
+     default:
+         g_assert_not_reached();
+     }
+-    ctx->z_mask = arg_info(op->args[2])->z_mask | z_mask;
+-    return false;
++    s_mask = ~z_mask;
++    z_mask |= t2->z_mask;
++    s_mask &= t2->s_mask;
++
++    return fold_masks_zs(ctx, op, z_mask, s_mask);
+ }
+ static bool fold_ctpop(OptContext *ctx, TCGOp *op)
+--
+.43.0

-New patch
+[PULL 15/72] tcg/optimize: Use fold_masks_z in fold_ctpop
+Add fold_masks_z as a trivial wrapper around fold_masks_zs.
+Avoid the use of the OptContext slots.
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/optimize.c | 13 ++++++++++---
+file changed, 10 insertions(+), 3 deletions(-)
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -XXX,XX +XXX,XX @@ static bool fold_masks_zs(OptContext *ctx, TCGOp *op,
+     return true;
+ }
++static bool fold_masks_z(OptContext *ctx, TCGOp *op, uint64_t z_mask)
++{
++    return fold_masks_zs(ctx, op, z_mask, 0);
++}
++
+ static bool fold_masks(OptContext *ctx, TCGOp *op)
+ {
+     return fold_masks_zs(ctx, op, ctx->z_mask, ctx->s_mask);
+@@ -XXX,XX +XXX,XX @@ static bool fold_count_zeros(OptContext *ctx, TCGOp *op)
+ static bool fold_ctpop(OptContext *ctx, TCGOp *op)
+ {
++    uint64_t z_mask;
++
+     if (fold_const1(ctx, op)) {
+         return true;
+     }
+     switch (ctx->type) {
+     case TCG_TYPE_I32:
+-        ctx->z_mask = 32 | 31;
++        z_mask = 32 | 31;
+         break;
+     case TCG_TYPE_I64:
+-        ctx->z_mask = 64 | 63;
++        z_mask = 64 | 63;
+         break;
+     default:
+         g_assert_not_reached();
+     }
+-    return false;
++    return fold_masks_z(ctx, op, z_mask);
+ }
+ static bool fold_deposit(OptContext *ctx, TCGOp *op)
+--
+.43.0

-New patch
+[PULL 16/72] tcg/optimize: Use fold_and and fold_masks_z in fold_deposit
+Avoid the use of the OptContext slots.  Find TempOptInfo once.
+When we fold to and, use fold_and.
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/optimize.c | 35 +++++++++++++++++------------------
+file changed, 17 insertions(+), 18 deletions(-)
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -XXX,XX +XXX,XX @@ static bool fold_ctpop(OptContext *ctx, TCGOp *op)
+ static bool fold_deposit(OptContext *ctx, TCGOp *op)
+ {
++    TempOptInfo *t1 = arg_info(op->args[1]);
++    TempOptInfo *t2 = arg_info(op->args[2]);
++    int ofs = op->args[3];
++    int len = op->args[4];
+     TCGOpcode and_opc;
++    uint64_t z_mask;
+-    if (arg_is_const(op->args[1]) && arg_is_const(op->args[2])) {
+-        uint64_t t1 = arg_info(op->args[1])->val;
+-        uint64_t t2 = arg_info(op->args[2])->val;
+-
+-        t1 = deposit64(t1, op->args[3], op->args[4], t2);
+-        return tcg_opt_gen_movi(ctx, op, op->args[0], t1);
++    if (ti_is_const(t1) && ti_is_const(t2)) {
++        return tcg_opt_gen_movi(ctx, op, op->args[0],
++                                deposit64(ti_const_val(t1), ofs, len,
++                                          ti_const_val(t2)));
+     }
+     switch (ctx->type) {
+@@ -XXX,XX +XXX,XX @@ static bool fold_deposit(OptContext *ctx, TCGOp *op)
+     }
+     /* Inserting a value into zero at offset 0. */
+-    if (arg_is_const_val(op->args[1], 0) && op->args[3] == 0) {
+-        uint64_t mask = MAKE_64BIT_MASK(0, op->args[4]);
++    if (ti_is_const_val(t1, 0) && ofs == 0) {
++        uint64_t mask = MAKE_64BIT_MASK(0, len);
+         op->opc = and_opc;
+         op->args[1] = op->args[2];
+         op->args[2] = arg_new_constant(ctx, mask);
+-        ctx->z_mask = mask & arg_info(op->args[1])->z_mask;
+-        return false;
++        return fold_and(ctx, op);
+     }
+     /* Inserting zero into a value. */
+-    if (arg_is_const_val(op->args[2], 0)) {
+-        uint64_t mask = deposit64(-1, op->args[3], op->args[4], 0);
++    if (ti_is_const_val(t2, 0)) {
++        uint64_t mask = deposit64(-1, ofs, len, 0);
+         op->opc = and_opc;
+         op->args[2] = arg_new_constant(ctx, mask);
+-        ctx->z_mask = mask & arg_info(op->args[1])->z_mask;
+-        return false;
++        return fold_and(ctx, op);
+     }
+-    ctx->z_mask = deposit64(arg_info(op->args[1])->z_mask,
+-                            op->args[3], op->args[4],
+-                            arg_info(op->args[2])->z_mask);
+-    return false;
++    z_mask = deposit64(t1->z_mask, ofs, len, t2->z_mask);
++    return fold_masks_z(ctx, op, z_mask);
+ }
+ static bool fold_divide(OptContext *ctx, TCGOp *op)
+--
+.43.0

-New patch
+[PULL 17/72] tcg/optimize: Compute sign mask in fold_deposit
+The input which overlaps the sign bit of the output can
+have its input s_mask propagated to the output s_mask.
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/optimize.c | 14 ++++++++++++--
+file changed, 12 insertions(+), 2 deletions(-)
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -XXX,XX +XXX,XX @@ static bool fold_deposit(OptContext *ctx, TCGOp *op)
+     TempOptInfo *t2 = arg_info(op->args[2]);
+     int ofs = op->args[3];
+     int len = op->args[4];
++    int width;
+     TCGOpcode and_opc;
+-    uint64_t z_mask;
++    uint64_t z_mask, s_mask;
+     if (ti_is_const(t1) && ti_is_const(t2)) {
+         return tcg_opt_gen_movi(ctx, op, op->args[0],
+@@ -XXX,XX +XXX,XX @@ static bool fold_deposit(OptContext *ctx, TCGOp *op)
+     switch (ctx->type) {
+     case TCG_TYPE_I32:
+         and_opc = INDEX_op_and_i32;
++        width = 32;
+         break;
+     case TCG_TYPE_I64:
+         and_opc = INDEX_op_and_i64;
++        width = 64;
+         break;
+     default:
+         g_assert_not_reached();
+@@ -XXX,XX +XXX,XX @@ static bool fold_deposit(OptContext *ctx, TCGOp *op)
+         return fold_and(ctx, op);
+     }
++    /* The s_mask from the top portion of the deposit is still valid. */
++    if (ofs + len == width) {
++        s_mask = t2->s_mask << ofs;
++    } else {
++        s_mask = t1->s_mask & ~MAKE_64BIT_MASK(0, ofs + len);
++    }
++
+     z_mask = deposit64(t1->z_mask, ofs, len, t2->z_mask);
+-    return fold_masks_z(ctx, op, z_mask);
++    return fold_masks_zs(ctx, op, z_mask, s_mask);
+ }
+ static bool fold_divide(OptContext *ctx, TCGOp *op)
+--
+.43.0

-New patch
+[PULL 18/72] tcg/optimize: Use finish_folding in fold_divide
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/optimize.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -XXX,XX +XXX,XX @@ static bool fold_divide(OptContext *ctx, TCGOp *op)
+         fold_xi_to_x(ctx, op, 1)) {
+         return true;
+     }
+-    return false;
++    return finish_folding(ctx, op);
+ }
+ static bool fold_dup(OptContext *ctx, TCGOp *op)
+--
+.43.0

-New patch
+[PULL 19/72] tcg/optimize: Use finish_folding in fold_dup, fold_dup2
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/optimize.c | 4 ++--
+file changed, 2 insertions(+), 2 deletions(-)
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -XXX,XX +XXX,XX @@ static bool fold_dup(OptContext *ctx, TCGOp *op)
+         t = dup_const(TCGOP_VECE(op), t);
+         return tcg_opt_gen_movi(ctx, op, op->args[0], t);
+     }
+-    return false;
++    return finish_folding(ctx, op);
+ }
+ static bool fold_dup2(OptContext *ctx, TCGOp *op)
+@@ -XXX,XX +XXX,XX @@ static bool fold_dup2(OptContext *ctx, TCGOp *op)
+         op->opc = INDEX_op_dup_vec;
+         TCGOP_VECE(op) = MO_32;
+     }
+-    return false;
++    return finish_folding(ctx, op);
+ }
+ static bool fold_eqv(OptContext *ctx, TCGOp *op)
+--
+.43.0

-[PULL 20/46] tcg/tci: Move stack bounds check to compile-time
+[PULL 20/72] tcg/optimize: Use fold_masks_s in fold_eqv
-The existing check was incomplete:
+Add fold_masks_s as a trivial wrapper around fold_masks_zs.
-(1) Only applied to two of the 7 stores, and not to the loads at all.
+Avoid the use of the OptContext slots.
 (2) Only checked the upper, but not the lower bound of the stack.
-Doing this at compile time means that we don't need to do it
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 at runtime as well.
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c                |  2 --
+ tcg/optimize.c | 13 ++++++++++---
- tcg/tci/tcg-target.c.inc | 13 +++++++++++++
+file changed, 10 insertions(+), 3 deletions(-)
 files changed, 13 insertions(+), 2 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
+diff --git a/tcg/optimize.c b/tcg/optimize.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/tcg/optimize.c
-+++ b/tcg/tci.c
++++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+@@ -XXX,XX +XXX,XX @@ static bool fold_masks_z(OptContext *ctx, TCGOp *op, uint64_t z_mask)
-             t0 = tci_read_r32(regs, &tb_ptr);
+     return fold_masks_zs(ctx, op, z_mask, 0);
              t1 = tci_read_r(regs, &tb_ptr);
              t2 = tci_read_s32(&tb_ptr);
 -            tci_assert(t1 != sp_value || (int32_t)t2 < 0);
              *(uint32_t *)(t1 + t2) = t0;
              break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              t0 = tci_read_r64(regs, &tb_ptr);
              t1 = tci_read_r(regs, &tb_ptr);
              t2 = tci_read_s32(&tb_ptr);
 -            tci_assert(t1 != sp_value || (int32_t)t2 < 0);
              *(uint64_t *)(t1 + t2) = t0;
              break;
 diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.c.inc
 +++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tci_out_label(TCGContext *s, TCGLabel *label)
      }
  }
-+static void stack_bounds_check(TCGReg base, target_long offset)
++static bool fold_masks_s(OptContext *ctx, TCGOp *op, uint64_t s_mask)
 +{
-+    if (base == TCG_REG_CALL_STACK) {
++    return fold_masks_zs(ctx, op, -1, s_mask);
 +        tcg_debug_assert(offset < 0);
 +        tcg_debug_assert(offset >= -(CPU_TEMP_BUF_NLONGS * sizeof(long)));
 +    }
 +}
 +
- static void tcg_out_ld(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg1,
+ static bool fold_masks(OptContext *ctx, TCGOp *op)
                         intptr_t arg2)
  {
-     uint8_t *old_code_ptr = s->code_ptr;
+     return fold_masks_zs(ctx, op, ctx->z_mask, ctx->s_mask);
@@ -XXX,XX +XXX,XX @@ static bool fold_dup2(OptContext *ctx, TCGOp *op)
  static bool fold_eqv(OptContext *ctx, TCGOp *op)
  {
 +    uint64_t s_mask;
 +
-+    stack_bounds_check(arg1, arg2);
+     if (fold_const2_commutative(ctx, op) ||
-     if (type == TCG_TYPE_I32) {
+         fold_xi_to_x(ctx, op, -1) ||
-         tcg_out_op_t(s, INDEX_op_ld_i32);
+         fold_xi_to_not(ctx, op, 0)) {
-         tcg_out_r(s, ret);
+         return true;
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
+     }
-     case INDEX_op_st16_i64:
-     case INDEX_op_st32_i64:
+-    ctx->s_mask = arg_info(op->args[1])->s_mask
-     case INDEX_op_st_i64:
+-                & arg_info(op->args[2])->s_mask;
-+        stack_bounds_check(args[1], args[2]);
+-    return false;
-         tcg_out_r(s, args[0]);
++    s_mask = arg_info(op->args[1])->s_mask
-         tcg_out_r(s, args[1]);
++           & arg_info(op->args[2])->s_mask;
-         tcg_debug_assert(args[2] == (int32_t)args[2]);
++    return fold_masks_s(ctx, op, s_mask);
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_st(TCGContext *s, TCGType type, TCGReg arg, TCGReg arg1,
+ }
-                        intptr_t arg2)
- {
+ static bool fold_extract(OptContext *ctx, TCGOp *op)
      uint8_t *old_code_ptr = s->code_ptr;
 +
 +    stack_bounds_check(arg1, arg2);
      if (type == TCG_TYPE_I32) {
          tcg_out_op_t(s, INDEX_op_st_i32);
          tcg_out_r(s, arg);
 --
-.25.1
+.43.0

-New patch
+[PULL 21/72] tcg/optimize: Use fold_masks_z in fold_extract
+Avoid the use of the OptContext slots.  Find TempOptInfo once.
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/optimize.c | 15 ++++++---------
+file changed, 6 insertions(+), 9 deletions(-)
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -XXX,XX +XXX,XX @@ static bool fold_eqv(OptContext *ctx, TCGOp *op)
+ static bool fold_extract(OptContext *ctx, TCGOp *op)
+ {
+     uint64_t z_mask_old, z_mask;
++    TempOptInfo *t1 = arg_info(op->args[1]);
+     int pos = op->args[2];
+     int len = op->args[3];
+-    if (arg_is_const(op->args[1])) {
+-        uint64_t t;
+-
+-        t = arg_info(op->args[1])->val;
+-        t = extract64(t, pos, len);
+-        return tcg_opt_gen_movi(ctx, op, op->args[0], t);
++    if (ti_is_const(t1)) {
++        return tcg_opt_gen_movi(ctx, op, op->args[0],
++                                extract64(ti_const_val(t1), pos, len));
+     }
+-    z_mask_old = arg_info(op->args[1])->z_mask;
++    z_mask_old = t1->z_mask;
+     z_mask = extract64(z_mask_old, pos, len);
+     if (pos == 0 && fold_affected_mask(ctx, op, z_mask_old ^ z_mask)) {
+         return true;
+     }
+-    ctx->z_mask = z_mask;
+-    return fold_masks(ctx, op);
++    return fold_masks_z(ctx, op, z_mask);
+ }
+ static bool fold_extract2(OptContext *ctx, TCGOp *op)
+--
+.43.0

-New patch
+[PULL 22/72] tcg/optimize: Use finish_folding in fold_extract2
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/optimize.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -XXX,XX +XXX,XX @@ static bool fold_extract2(OptContext *ctx, TCGOp *op)
+         }
+         return tcg_opt_gen_movi(ctx, op, op->args[0], v1 | v2);
+     }
+-    return false;
++    return finish_folding(ctx, op);
+ }
+ static bool fold_exts(OptContext *ctx, TCGOp *op)
+--
+.43.0

-New patch
+[PULL 23/72] tcg/optimize: Use fold_masks_zs in fold_exts
+Avoid the use of the OptContext slots.  Find TempOptInfo once.
+Explicitly sign-extend z_mask instead of doing that manually.
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/optimize.c | 29 ++++++++++++-----------------
+file changed, 12 insertions(+), 17 deletions(-)
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -XXX,XX +XXX,XX @@ static bool fold_extract2(OptContext *ctx, TCGOp *op)
+ static bool fold_exts(OptContext *ctx, TCGOp *op)
+ {
+-    uint64_t s_mask_old, s_mask, z_mask, sign;
++    uint64_t s_mask_old, s_mask, z_mask;
+     bool type_change = false;
++    TempOptInfo *t1;
+     if (fold_const1(ctx, op)) {
+         return true;
+     }
+-    z_mask = arg_info(op->args[1])->z_mask;
+-    s_mask = arg_info(op->args[1])->s_mask;
++    t1 = arg_info(op->args[1]);
++    z_mask = t1->z_mask;
++    s_mask = t1->s_mask;
+     s_mask_old = s_mask;
+     switch (op->opc) {
+     CASE_OP_32_64(ext8s):
+-        sign = INT8_MIN;
+-        z_mask = (uint8_t)z_mask;
++        s_mask |= INT8_MIN;
++        z_mask = (int8_t)z_mask;
+         break;
+     CASE_OP_32_64(ext16s):
+-        sign = INT16_MIN;
+-        z_mask = (uint16_t)z_mask;
++        s_mask |= INT16_MIN;
++        z_mask = (int16_t)z_mask;
+         break;
+     case INDEX_op_ext_i32_i64:
+         type_change = true;
+         QEMU_FALLTHROUGH;
+     case INDEX_op_ext32s_i64:
+-        sign = INT32_MIN;
+-        z_mask = (uint32_t)z_mask;
++        s_mask |= INT32_MIN;
++        z_mask = (int32_t)z_mask;
+         break;
+     default:
+         g_assert_not_reached();
+     }
+-    if (z_mask & sign) {
+-        z_mask |= sign;
+-    }
+-    s_mask |= sign << 1;
+-
+-    ctx->z_mask = z_mask;
+-    ctx->s_mask = s_mask;
+     if (0 && !type_change && fold_affected_mask(ctx, op, s_mask & ~s_mask_old)) {
+         return true;
+     }
+-    return fold_masks(ctx, op);
++    return fold_masks_zs(ctx, op, z_mask, s_mask);
+ }
+ static bool fold_extu(OptContext *ctx, TCGOp *op)
+--
+.43.0

-New patch
+[PULL 24/72] tcg/optimize: Use fold_masks_z in fold_extu
+Avoid the use of the OptContext slots.
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/optimize.c | 4 ++--
+file changed, 2 insertions(+), 2 deletions(-)
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -XXX,XX +XXX,XX @@ static bool fold_extu(OptContext *ctx, TCGOp *op)
+         g_assert_not_reached();
+     }
+-    ctx->z_mask = z_mask;
+     if (!type_change && fold_affected_mask(ctx, op, z_mask_old ^ z_mask)) {
+         return true;
+     }
+-    return fold_masks(ctx, op);
++
++    return fold_masks_z(ctx, op, z_mask);
+ }
+ static bool fold_mb(OptContext *ctx, TCGOp *op)
+--
+.43.0

-New patch
+[PULL 25/72] tcg/optimize: Use fold_masks_zs in fold_movcond
+Avoid the use of the OptContext slots.  Find TempOptInfo once.
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/optimize.c | 19 +++++++++++--------
+file changed, 11 insertions(+), 8 deletions(-)
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -XXX,XX +XXX,XX @@ static bool fold_mov(OptContext *ctx, TCGOp *op)
+ static bool fold_movcond(OptContext *ctx, TCGOp *op)
+ {
++    uint64_t z_mask, s_mask;
++    TempOptInfo *tt, *ft;
+     int i;
+     /* If true and false values are the same, eliminate the cmp. */
+@@ -XXX,XX +XXX,XX @@ static bool fold_movcond(OptContext *ctx, TCGOp *op)
+         return tcg_opt_gen_mov(ctx, op, op->args[0], op->args[4 - i]);
+     }
+-    ctx->z_mask = arg_info(op->args[3])->z_mask
+-                | arg_info(op->args[4])->z_mask;
+-    ctx->s_mask = arg_info(op->args[3])->s_mask
+-                & arg_info(op->args[4])->s_mask;
++    tt = arg_info(op->args[3]);
++    ft = arg_info(op->args[4]);
++    z_mask = tt->z_mask | ft->z_mask;
++    s_mask = tt->s_mask & ft->s_mask;
+-    if (arg_is_const(op->args[3]) && arg_is_const(op->args[4])) {
+-        uint64_t tv = arg_info(op->args[3])->val;
+-        uint64_t fv = arg_info(op->args[4])->val;
++    if (ti_is_const(tt) && ti_is_const(ft)) {
++        uint64_t tv = ti_const_val(tt);
++        uint64_t fv = ti_const_val(ft);
+         TCGOpcode opc, negopc = 0;
+         TCGCond cond = op->args[5];
+@@ -XXX,XX +XXX,XX @@ static bool fold_movcond(OptContext *ctx, TCGOp *op)
+             }
+         }
+     }
+-    return false;
++
++    return fold_masks_zs(ctx, op, z_mask, s_mask);
+ }
+ static bool fold_mul(OptContext *ctx, TCGOp *op)
+--
+.43.0

-New patch
+[PULL 26/72] tcg/optimize: Use finish_folding in fold_mul*
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/optimize.c | 6 +++---
+file changed, 3 insertions(+), 3 deletions(-)
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -XXX,XX +XXX,XX @@ static bool fold_mul(OptContext *ctx, TCGOp *op)
+         fold_xi_to_x(ctx, op, 1)) {
+         return true;
+     }
+-    return false;
++    return finish_folding(ctx, op);
+ }
+ static bool fold_mul_highpart(OptContext *ctx, TCGOp *op)
+@@ -XXX,XX +XXX,XX @@ static bool fold_mul_highpart(OptContext *ctx, TCGOp *op)
+         fold_xi_to_i(ctx, op, 0)) {
+         return true;
+     }
+-    return false;
++    return finish_folding(ctx, op);
+ }
+ static bool fold_multiply2(OptContext *ctx, TCGOp *op)
+@@ -XXX,XX +XXX,XX @@ static bool fold_multiply2(OptContext *ctx, TCGOp *op)
+         tcg_opt_gen_movi(ctx, op2, rh, h);
+         return true;
+     }
+-    return false;
++    return finish_folding(ctx, op);
+ }
+ static bool fold_nand(OptContext *ctx, TCGOp *op)
+--
+.43.0

-New patch
+[PULL 27/72] tcg/optimize: Use fold_masks_s in fold_nand
+Avoid the use of the OptContext slots.
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/optimize.c | 8 +++++---
+file changed, 5 insertions(+), 3 deletions(-)
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -XXX,XX +XXX,XX @@ static bool fold_multiply2(OptContext *ctx, TCGOp *op)
+ static bool fold_nand(OptContext *ctx, TCGOp *op)
+ {
++    uint64_t s_mask;
++
+     if (fold_const2_commutative(ctx, op) ||
+         fold_xi_to_not(ctx, op, -1)) {
+         return true;
+     }
+-    ctx->s_mask = arg_info(op->args[1])->s_mask
+-                & arg_info(op->args[2])->s_mask;
+-    return false;
++    s_mask = arg_info(op->args[1])->s_mask
++           & arg_info(op->args[2])->s_mask;
++    return fold_masks_s(ctx, op, s_mask);
+ }
+ static bool fold_neg_no_const(OptContext *ctx, TCGOp *op)
+--
+.43.0

-[PULL 09/46] tcg/tci: Inline tci_write_reg8 into its callers
+[PULL 28/72] tcg/optimize: Use fold_masks_z in fold_neg_no_const
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Avoid the use of the OptContext slots.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c | 9 ++-------
+ tcg/optimize.c | 9 ++-------
 file changed, 2 insertions(+), 7 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
+diff --git a/tcg/optimize.c b/tcg/optimize.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/tcg/optimize.c
-+++ b/tcg/tci.c
++++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@ tci_write_reg(tcg_target_ulong *regs, TCGReg index, tcg_target_ulong value)
+@@ -XXX,XX +XXX,XX @@ static bool fold_neg_no_const(OptContext *ctx, TCGOp *op)
-     regs[index] = value;
+ {
      /* Set to 1 all bits to the left of the rightmost.  */
      uint64_t z_mask = arg_info(op->args[1])->z_mask;
 -    ctx->z_mask = -(z_mask & -z_mask);
 +    z_mask = -(z_mask & -z_mask);
 -    /*
 -     * Because of fold_sub_to_neg, we want to always return true,
 -     * via finish_folding.
 -     */
 -    finish_folding(ctx, op);
 -    return true;
 +    return fold_masks_z(ctx, op, z_mask);
  }
--static void tci_write_reg8(tcg_target_ulong *regs, TCGReg index, uint8_t value)
+ static bool fold_neg(OptContext *ctx, TCGOp *op)
 -{
 -    tci_write_reg(regs, index, value);
 -}
 -
  #if TCG_TARGET_REG_BITS == 64
  static void
  tci_write_reg16(tcg_target_ulong *regs, TCGReg index, uint16_t value)
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              t0 = *tb_ptr++;
              t1 = tci_read_r(regs, &tb_ptr);
              t2 = tci_read_s32(&tb_ptr);
 -            tci_write_reg8(regs, t0, *(uint8_t *)(t1 + t2));
 +            tci_write_reg(regs, t0, *(uint8_t *)(t1 + t2));
              break;
          case INDEX_op_ld8s_i32:
              TODO();
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              t0 = *tb_ptr++;
              t1 = tci_read_r(regs, &tb_ptr);
              t2 = tci_read_s32(&tb_ptr);
 -            tci_write_reg8(regs, t0, *(uint8_t *)(t1 + t2));
 +            tci_write_reg(regs, t0, *(uint8_t *)(t1 + t2));
              break;
          case INDEX_op_ld8s_i64:
              t0 = *tb_ptr++;
 --
-.25.1
+.43.0

-New patch
+[PULL 29/72] tcg/optimize: Use fold_masks_s in fold_nor
+Avoid the use of the OptContext slots.
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/optimize.c | 8 +++++---
+file changed, 5 insertions(+), 3 deletions(-)
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -XXX,XX +XXX,XX @@ static bool fold_neg(OptContext *ctx, TCGOp *op)
+ static bool fold_nor(OptContext *ctx, TCGOp *op)
+ {
++    uint64_t s_mask;
++
+     if (fold_const2_commutative(ctx, op) ||
+         fold_xi_to_not(ctx, op, 0)) {
+         return true;
+     }
+-    ctx->s_mask = arg_info(op->args[1])->s_mask
+-                & arg_info(op->args[2])->s_mask;
+-    return false;
++    s_mask = arg_info(op->args[1])->s_mask
++           & arg_info(op->args[2])->s_mask;
++    return fold_masks_s(ctx, op, s_mask);
+ }
+ static bool fold_not(OptContext *ctx, TCGOp *op)
+--
+.43.0

-[PULL 21/46] tcg/tci: Merge INDEX_op_{st_i32,st32_i64}
+[PULL 30/72] tcg/optimize: Use fold_masks_s in fold_not
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Avoid the use of the OptContext slots.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c | 7 +------
+ tcg/optimize.c | 7 +------
 file changed, 1 insertion(+), 6 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
+diff --git a/tcg/optimize.c b/tcg/optimize.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/tcg/optimize.c
-+++ b/tcg/tci.c
++++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+@@ -XXX,XX +XXX,XX @@ static bool fold_not(OptContext *ctx, TCGOp *op)
-             *(uint16_t *)(t1 + t2) = t0;
+     if (fold_const1(ctx, op)) {
-             break;
+         return true;
-         case INDEX_op_st_i32:
+     }
-+        CASE_64(st32)
+-
-             t0 = tci_read_r32(regs, &tb_ptr);
+-    ctx->s_mask = arg_info(op->args[1])->s_mask;
-             t1 = tci_read_r(regs, &tb_ptr);
+-
-             t2 = tci_read_s32(&tb_ptr);
+-    /* Because of fold_to_not, we want to always return true, via finish. */
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+-    finish_folding(ctx, op);
-             t2 = tci_read_s32(&tb_ptr);
+-    return true;
-             tci_write_reg(regs, t0, *(uint64_t *)(t1 + t2));
++    return fold_masks_s(ctx, op, arg_info(op->args[1])->s_mask);
-             break;
+ }
--        case INDEX_op_st32_i64:
--            t0 = tci_read_r32(regs, &tb_ptr);
+ static bool fold_or(OptContext *ctx, TCGOp *op)
 -            t1 = tci_read_r(regs, &tb_ptr);
 -            t2 = tci_read_s32(&tb_ptr);
 -            *(uint32_t *)(t1 + t2) = t0;
 -            break;
          case INDEX_op_st_i64:
              t0 = tci_read_r64(regs, &tb_ptr);
              t1 = tci_read_r(regs, &tb_ptr);
 --
-.25.1
+.43.0

-New patch
+[PULL 31/72] tcg/optimize: Use fold_masks_zs in fold_or
+Avoid the use of the OptContext slots.  Find TempOptInfo once.
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/optimize.c | 13 ++++++++-----
+file changed, 8 insertions(+), 5 deletions(-)
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -XXX,XX +XXX,XX @@ static bool fold_not(OptContext *ctx, TCGOp *op)
+ static bool fold_or(OptContext *ctx, TCGOp *op)
+ {
++    uint64_t z_mask, s_mask;
++    TempOptInfo *t1, *t2;
++
+     if (fold_const2_commutative(ctx, op) ||
+         fold_xi_to_x(ctx, op, 0) ||
+         fold_xx_to_x(ctx, op)) {
+         return true;
+     }
+-    ctx->z_mask = arg_info(op->args[1])->z_mask
+-                | arg_info(op->args[2])->z_mask;
+-    ctx->s_mask = arg_info(op->args[1])->s_mask
+-                & arg_info(op->args[2])->s_mask;
+-    return fold_masks(ctx, op);
++    t1 = arg_info(op->args[1]);
++    t2 = arg_info(op->args[2]);
++    z_mask = t1->z_mask | t2->z_mask;
++    s_mask = t1->s_mask & t2->s_mask;
++    return fold_masks_zs(ctx, op, z_mask, s_mask);
+ }
+ static bool fold_orc(OptContext *ctx, TCGOp *op)
+--
+.43.0

-New patch
+[PULL 32/72] tcg/optimize: Use fold_masks_zs in fold_orc
+Avoid the use of the OptContext slots.
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/optimize.c | 8 +++++---
+file changed, 5 insertions(+), 3 deletions(-)
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -XXX,XX +XXX,XX @@ static bool fold_or(OptContext *ctx, TCGOp *op)
+ static bool fold_orc(OptContext *ctx, TCGOp *op)
+ {
++    uint64_t s_mask;
++
+     if (fold_const2(ctx, op) ||
+         fold_xx_to_i(ctx, op, -1) ||
+         fold_xi_to_x(ctx, op, -1) ||
+@@ -XXX,XX +XXX,XX @@ static bool fold_orc(OptContext *ctx, TCGOp *op)
+         return true;
+     }
+-    ctx->s_mask = arg_info(op->args[1])->s_mask
+-                & arg_info(op->args[2])->s_mask;
+-    return false;
++    s_mask = arg_info(op->args[1])->s_mask
++           & arg_info(op->args[2])->s_mask;
++    return fold_masks_s(ctx, op, s_mask);
+ }
+ static bool fold_qemu_ld(OptContext *ctx, TCGOp *op)
+--
+.43.0

-[PULL 35/46] cpu: Move debug_excp_handler to tcg_ops
+[PULL 33/72] tcg/optimize: Use fold_masks_zs in fold_qemu_ld
-From: Eduardo Habkost <ehabkost@redhat.com>
+Avoid the use of the OptContext slots.
-Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
+Be careful not to call fold_masks_zs when the memory operation
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
+is wide enough to require multiple outputs, so split into two
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+functions: fold_qemu_ld_1reg and fold_qemu_ld_2reg.
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <20210204163931.7358-8-cfontana@suse.de>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h     | 4 ++--
+ tcg/optimize.c | 26 +++++++++++++++++++++-----
- accel/tcg/cpu-exec.c      | 4 ++--
+file changed, 21 insertions(+), 5 deletions(-)
  target/arm/cpu.c          | 2 +-
  target/i386/tcg/tcg-cpu.c | 2 +-
  target/lm32/cpu.c         | 2 +-
  target/s390x/cpu.c        | 2 +-
  target/xtensa/cpu.c       | 2 +-
 files changed, 9 insertions(+), 9 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
+diff --git a/tcg/optimize.c b/tcg/optimize.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
+--- a/tcg/optimize.c
-+++ b/include/hw/core/cpu.h
++++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
+@@ -XXX,XX +XXX,XX @@ static bool fold_orc(OptContext *ctx, TCGOp *op)
-     bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
+     return fold_masks_s(ctx, op, s_mask);
-                      MMUAccessType access_type, int mmu_idx,
+ }
-                      bool probe, uintptr_t retaddr);
-+    /** @debug_excp_handler: Callback for handling debug exceptions */
+-static bool fold_qemu_ld(OptContext *ctx, TCGOp *op)
-+    void (*debug_excp_handler)(CPUState *cpu);
++static bool fold_qemu_ld_1reg(OptContext *ctx, TCGOp *op)
+ {
- } TcgCpuOperations;
+     const TCGOpDef *def = &tcg_op_defs[op->opc];
+     MemOpIdx oi = op->args[def->nb_oargs + def->nb_iargs];
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
+     MemOp mop = get_memop(oi);
-  * @gdb_write_register: Callback for letting GDB write a register.
+     int width = 8 * memop_size(mop);
-  * @debug_check_watchpoint: Callback: return true if the architectural
++    uint64_t z_mask = -1, s_mask = 0;
-  *       watchpoint whose address has matched should really fire.
-- * @debug_excp_handler: Callback for handling debug exceptions.
+     if (width < 64) {
-  * @write_elf64_note: Callback for writing a CPU-specific ELF note to a
+         if (mop & MO_SIGN) {
-  * 64-bit VM coredump.
+-            ctx->s_mask = MAKE_64BIT_MASK(width, 64 - width);
-  * @write_elf32_qemunote: Callback for writing a CPU- and QEMU-specific ELF
++            s_mask = MAKE_64BIT_MASK(width - 1, 64 - (width - 1));
-@@ -XXX,XX +XXX,XX @@ struct CPUClass {
+         } else {
-     int (*gdb_read_register)(CPUState *cpu, GByteArray *buf, int reg);
+-            ctx->z_mask = MAKE_64BIT_MASK(0, width);
-     int (*gdb_write_register)(CPUState *cpu, uint8_t *buf, int reg);
++            z_mask = MAKE_64BIT_MASK(0, width);
      bool (*debug_check_watchpoint)(CPUState *cpu, CPUWatchpoint *wp);
 -    void (*debug_excp_handler)(CPUState *cpu);
      int (*write_elf64_note)(WriteCoreDumpFunction f, CPUState *cpu,
                              int cpuid, void *opaque);
 diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cpu-exec.c
 +++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline void cpu_handle_debug_exception(CPUState *cpu)
          }
      }
--    if (cc->debug_excp_handler) {
+     /* Opcodes that touch guest memory stop the mb optimization.  */
--        cc->debug_excp_handler(cpu);
+     ctx->prev_mb = NULL;
-+    if (cc->tcg_ops.debug_excp_handler) {
+-    return false;
-+        cc->tcg_ops.debug_excp_handler(cpu);
++
-     }
++    return fold_masks_zs(ctx, op, z_mask, s_mask);
 +}
 +
 +static bool fold_qemu_ld_2reg(OptContext *ctx, TCGOp *op)
 +{
 +    /* Opcodes that touch guest memory stop the mb optimization.  */
 +    ctx->prev_mb = NULL;
 +    return finish_folding(ctx, op);
  }
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+ static bool fold_qemu_st(OptContext *ctx, TCGOp *op)
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
---- a/target/arm/cpu.c
+             break;
-+++ b/target/arm/cpu.c
+         case INDEX_op_qemu_ld_a32_i32:
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
+         case INDEX_op_qemu_ld_a64_i32:
-     cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
++            done = fold_qemu_ld_1reg(&ctx, op);
-     cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
++            break;
-     cc->tcg_ops.tlb_fill = arm_cpu_tlb_fill;
+         case INDEX_op_qemu_ld_a32_i64:
--    cc->debug_excp_handler = arm_debug_excp_handler;
+         case INDEX_op_qemu_ld_a64_i64:
-+    cc->tcg_ops.debug_excp_handler = arm_debug_excp_handler;
++            if (TCG_TARGET_REG_BITS == 64) {
-     cc->debug_check_watchpoint = arm_debug_check_watchpoint;
++                done = fold_qemu_ld_1reg(&ctx, op);
-     cc->do_unaligned_access = arm_cpu_do_unaligned_access;
++                break;
- #if !defined(CONFIG_USER_ONLY)
++            }
-diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
++            QEMU_FALLTHROUGH;
-index XXXXXXX..XXXXXXX 100644
+         case INDEX_op_qemu_ld_a32_i128:
---- a/target/i386/tcg/tcg-cpu.c
+         case INDEX_op_qemu_ld_a64_i128:
-+++ b/target/i386/tcg/tcg-cpu.c
+-            done = fold_qemu_ld(&ctx, op);
-@@ -XXX,XX +XXX,XX @@ void tcg_cpu_common_class_init(CPUClass *cc)
++            done = fold_qemu_ld_2reg(&ctx, op);
-     cc->tcg_ops.initialize = tcg_x86_init;
+             break;
-     cc->tcg_ops.tlb_fill = x86_cpu_tlb_fill;
+         case INDEX_op_qemu_st8_a32_i32:
- #ifndef CONFIG_USER_ONLY
+         case INDEX_op_qemu_st8_a64_i32:
 -    cc->debug_excp_handler = breakpoint_handler;
 +    cc->tcg_ops.debug_excp_handler = breakpoint_handler;
  #endif
  }
 diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/lm32/cpu.c
 +++ b/target/lm32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
  #endif
      cc->gdb_num_core_regs = 32 + 7;
      cc->gdb_stop_before_watchpoint = true;
 -    cc->debug_excp_handler = lm32_debug_excp_handler;
 +    cc->tcg_ops.debug_excp_handler = lm32_debug_excp_handler;
      cc->disas_set_info = lm32_cpu_disas_set_info;
      cc->tcg_ops.initialize = lm32_translate_init;
  }
 diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/cpu.c
 +++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
      cc->write_elf64_note = s390_cpu_write_elf64_note;
  #ifdef CONFIG_TCG
      cc->tcg_ops.cpu_exec_interrupt = s390_cpu_exec_interrupt;
 -    cc->debug_excp_handler = s390x_cpu_debug_excp_handler;
 +    cc->tcg_ops.debug_excp_handler = s390x_cpu_debug_excp_handler;
      cc->do_unaligned_access = s390x_cpu_do_unaligned_access;
  #endif
  #endif
 diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/xtensa/cpu.c
 +++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
      cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
      cc->do_transaction_failed = xtensa_cpu_do_transaction_failed;
  #endif
 -    cc->debug_excp_handler = xtensa_breakpoint_handler;
 +    cc->tcg_ops.debug_excp_handler = xtensa_breakpoint_handler;
      cc->disas_set_info = xtensa_cpu_disas_set_info;
      cc->tcg_ops.initialize = xtensa_translate_init;
      dc->vmsd = &vmstate_xtensa_cpu;
 --
-.25.1
+.43.0

-[PULL 46/46] accel: introduce AccelCPUClass extending CPUClass
+[PULL 34/72] tcg/optimize: Return true from fold_qemu_st, fold_tcg_st
-From: Claudio Fontana <cfontana@suse.de>
+Stores have no output operands, and so need no further work.
-add a new optional interface to CPUClass, which allows accelerators
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 to extend the CPUClass with additional accelerator-specific
 initializations.
 This will allow to separate the target cpu code that is specific
 to each accelerator, and register it automatically with object
 hierarchy lookup depending on accelerator code availability,
 as part of the accel_init_interfaces() initialization step.
 Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Message-Id: <20210204163931.7358-19-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/accel-cpu.h | 38 ++++++++++++++++++++++++++++++++
+ tcg/optimize.c | 11 +++++------
- include/hw/core/cpu.h       |  4 ++++
+file changed, 5 insertions(+), 6 deletions(-)
  accel/accel-common.c        | 44 +++++++++++++++++++++++++++++++++++++
  MAINTAINERS                 |  1 +
 files changed, 87 insertions(+)
  create mode 100644 include/hw/core/accel-cpu.h
-diff --git a/include/hw/core/accel-cpu.h b/include/hw/core/accel-cpu.h
+diff --git a/tcg/optimize.c b/tcg/optimize.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/core/accel-cpu.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Accelerator interface, specializes CPUClass
 + * This header is used only by target-specific code.
 + *
 + * Copyright 2021 SUSE LLC
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
 +#ifndef ACCEL_CPU_H
 +#define ACCEL_CPU_H
 +
 +/*
 + * This header is used to define new accelerator-specific target-specific
 + * accelerator cpu subclasses.
 + * It uses CPU_RESOLVING_TYPE, so this is clearly target-specific.
 + *
 + * Do not try to use for any other purpose than the implementation of new
 + * subclasses in target/, or the accel implementation itself in accel/
 + */
 +
 +#define TYPE_ACCEL_CPU "accel-" CPU_RESOLVING_TYPE
 +#define ACCEL_CPU_NAME(name) (name "-" TYPE_ACCEL_CPU)
 +typedef struct AccelCPUClass AccelCPUClass;
 +DECLARE_CLASS_CHECKERS(AccelCPUClass, ACCEL_CPU, TYPE_ACCEL_CPU)
 +
 +typedef struct AccelCPUClass {
 +    /*< private >*/
 +    ObjectClass parent_class;
 +    /*< public >*/
 +
 +    void (*cpu_class_init)(CPUClass *cc);
 +    void (*cpu_instance_init)(CPUState *cpu);
 +    void (*cpu_realizefn)(CPUState *cpu, Error **errp);
 +} AccelCPUClass;
 +
 +#endif /* ACCEL_CPU_H */
 diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
+--- a/tcg/optimize.c
-+++ b/include/hw/core/cpu.h
++++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@ struct TranslationBlock;
+@@ -XXX,XX +XXX,XX @@ static bool fold_qemu_st(OptContext *ctx, TCGOp *op)
- /* see tcg-cpu-ops.h */
+ {
- struct TCGCPUOps;
+     /* Opcodes that touch guest memory stop the mb optimization.  */
+     ctx->prev_mb = NULL;
-+/* see accel-cpu.h */
+-    return false;
-+struct AccelCPUClass;
++    return true;
 +
  /**
   * CPUClass:
   * @class_by_name: Callback to map -cpu command line model name to an
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
      /* Keep non-pointer data at the end to minimize holes.  */
      int gdb_num_core_regs;
      bool gdb_stop_before_watchpoint;
 +    struct AccelCPUClass *accel_cpu;
      /* when TCG is not available, this pointer is NULL */
      struct TCGCPUOps *tcg_ops;
 diff --git a/accel/accel-common.c b/accel/accel-common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/accel-common.c
 +++ b/accel/accel-common.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qemu/accel.h"
 +#include "cpu.h"
 +#include "hw/core/accel-cpu.h"
 +
  #ifndef CONFIG_USER_ONLY
  #include "accel-softmmu.h"
  #endif /* !CONFIG_USER_ONLY */
@@ -XXX,XX +XXX,XX @@ AccelClass *accel_find(const char *opt_name)
      return ac;
  }
-+static void accel_init_cpu_int_aux(ObjectClass *klass, void *opaque)
+ static bool fold_remainder(OptContext *ctx, TCGOp *op)
-+{
+@@ -XXX,XX +XXX,XX @@ static bool fold_tcg_st(OptContext *ctx, TCGOp *op)
-+    CPUClass *cc = CPU_CLASS(klass);
-+    AccelCPUClass *accel_cpu = opaque;
+     if (op->args[1] != tcgv_ptr_arg(tcg_env)) {
-+
+         remove_mem_copy_all(ctx);
-+    cc->accel_cpu = accel_cpu;
+-        return false;
-+    if (accel_cpu->cpu_class_init) {
++        return true;
-+        accel_cpu->cpu_class_init(cc);
+     }
-+    }
-+}
+     switch (op->opc) {
-+
+@@ -XXX,XX +XXX,XX @@ static bool fold_tcg_st(OptContext *ctx, TCGOp *op)
-+/* initialize the arch-specific accel CpuClass interfaces */
+         g_assert_not_reached();
-+static void accel_init_cpu_interfaces(AccelClass *ac)
+     }
-+{
+     remove_mem_copy_in(ctx, ofs, ofs + lm1);
-+    const char *ac_name; /* AccelClass name */
+-    return false;
-+    char *acc_name;      /* AccelCPUClass name */
++    return true;
 +    ObjectClass *acc;    /* AccelCPUClass */
 +
 +    ac_name = object_class_get_name(OBJECT_CLASS(ac));
 +    g_assert(ac_name != NULL);
 +
 +    acc_name = g_strdup_printf("%s-%s", ac_name, CPU_RESOLVING_TYPE);
 +    acc = object_class_by_name(acc_name);
 +    g_free(acc_name);
 +
 +    if (acc) {
 +        object_class_foreach(accel_init_cpu_int_aux,
 +                             CPU_RESOLVING_TYPE, false, acc);
 +    }
 +}
 +
  void accel_init_interfaces(AccelClass *ac)
  {
  #ifndef CONFIG_USER_ONLY
      accel_init_ops_interfaces(ac);
  #endif /* !CONFIG_USER_ONLY */
 +
 +    accel_init_cpu_interfaces(ac);
  }
-+static const TypeInfo accel_cpu_type = {
+ static bool fold_tcg_st_memcopy(OptContext *ctx, TCGOp *op)
-+    .name = TYPE_ACCEL_CPU,
+@@ -XXX,XX +XXX,XX @@ static bool fold_tcg_st_memcopy(OptContext *ctx, TCGOp *op)
-+    .parent = TYPE_OBJECT,
+     TCGType type;
-+    .abstract = true,
-+    .class_size = sizeof(AccelCPUClass),
+     if (op->args[1] != tcgv_ptr_arg(tcg_env)) {
-+};
+-        fold_tcg_st(ctx, op);
-+
+-        return false;
- static void register_accel_types(void)
++        return fold_tcg_st(ctx, op);
- {
+     }
-     type_register_static(&accel_type);
-+    type_register_static(&accel_cpu_type);
+     src = arg_temp(op->args[0]);
@@ -XXX,XX +XXX,XX @@ static bool fold_tcg_st_memcopy(OptContext *ctx, TCGOp *op)
      last = ofs + tcg_type_size(type) - 1;
      remove_mem_copy_in(ctx, ofs, last);
      record_mem_copy(ctx, type, src, ofs, last);
 -    return false;
 +    return true;
  }
- type_init(register_accel_types);
+ static bool fold_xor(OptContext *ctx, TCGOp *op)
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ R: Paolo Bonzini <pbonzini@redhat.com>
  S: Maintained
  F: include/qemu/accel.h
  F: include/sysemu/accel-ops.h
 +F: include/hw/core/accel-cpu.h
  F: accel/accel-*.c
  F: accel/Makefile.objs
  F: accel/stubs/Makefile.objs
 --
-.25.1
+.43.0

-New patch
+[PULL 35/72] tcg/optimize: Use finish_folding in fold_remainder
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/optimize.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -XXX,XX +XXX,XX @@ static bool fold_remainder(OptContext *ctx, TCGOp *op)
+         fold_xx_to_i(ctx, op, 0)) {
+         return true;
+     }
+-    return false;
++    return finish_folding(ctx, op);
+ }
+ static bool fold_setcond_zmask(OptContext *ctx, TCGOp *op, bool neg)
+--
+.43.0

-New patch
+[PULL 36/72] tcg/optimize: Distinguish simplification in fold_setcond_zmask
+Change return from bool to int; distinguish between
+complete folding, simplification, and no change.
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/optimize.c | 22 ++++++++++++++--------
+file changed, 14 insertions(+), 8 deletions(-)
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -XXX,XX +XXX,XX @@ static bool fold_remainder(OptContext *ctx, TCGOp *op)
+     return finish_folding(ctx, op);
+ }
+-static bool fold_setcond_zmask(OptContext *ctx, TCGOp *op, bool neg)
++/* Return 1 if finished, -1 if simplified, 0 if unchanged. */
++static int fold_setcond_zmask(OptContext *ctx, TCGOp *op, bool neg)
+ {
+     uint64_t a_zmask, b_val;
+     TCGCond cond;
+@@ -XXX,XX +XXX,XX @@ static bool fold_setcond_zmask(OptContext *ctx, TCGOp *op, bool neg)
+                 op->opc = xor_opc;
+                 op->args[2] = arg_new_constant(ctx, 1);
+             }
+-            return false;
++            return -1;
+         }
+     }
+-
+-    return false;
++    return 0;
+ }
+ static void fold_setcond_tst_pow2(OptContext *ctx, TCGOp *op, bool neg)
+@@ -XXX,XX +XXX,XX @@ static bool fold_setcond(OptContext *ctx, TCGOp *op)
+         return tcg_opt_gen_movi(ctx, op, op->args[0], i);
+     }
+-    if (fold_setcond_zmask(ctx, op, false)) {
++    i = fold_setcond_zmask(ctx, op, false);
++    if (i > 0) {
+         return true;
+     }
+-    fold_setcond_tst_pow2(ctx, op, false);
++    if (i == 0) {
++        fold_setcond_tst_pow2(ctx, op, false);
++    }
+     ctx->z_mask = 1;
+     return false;
+@@ -XXX,XX +XXX,XX @@ static bool fold_negsetcond(OptContext *ctx, TCGOp *op)
+         return tcg_opt_gen_movi(ctx, op, op->args[0], -i);
+     }
+-    if (fold_setcond_zmask(ctx, op, true)) {
++    i = fold_setcond_zmask(ctx, op, true);
++    if (i > 0) {
+         return true;
+     }
+-    fold_setcond_tst_pow2(ctx, op, true);
++    if (i == 0) {
++        fold_setcond_tst_pow2(ctx, op, true);
++    }
+     /* Value is {0,-1} so all bits are repetitions of the sign. */
+     ctx->s_mask = -1;
+--
+.43.0

-New patch
+[PULL 37/72] tcg/optimize: Use fold_masks_z in fold_setcond
+Avoid the use of the OptContext slots.
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/optimize.c | 3 +--
+file changed, 1 insertion(+), 2 deletions(-)
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -XXX,XX +XXX,XX @@ static bool fold_setcond(OptContext *ctx, TCGOp *op)
+         fold_setcond_tst_pow2(ctx, op, false);
+     }
+-    ctx->z_mask = 1;
+-    return false;
++    return fold_masks_z(ctx, op, 1);
+ }
+ static bool fold_negsetcond(OptContext *ctx, TCGOp *op)
+--
+.43.0

-[PULL 30/46] target/riscv: remove CONFIG_TCG, as it is always TCG
+[PULL 38/72] tcg/optimize: Use fold_masks_s in fold_negsetcond
-From: Claudio Fontana <cfontana@suse.de>
+Avoid the use of the OptContext slots.
-for now only TCG is allowed as an accelerator for riscv,
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 so remove the CONFIG_TCG use.
 Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-Id: <20210204163931.7358-3-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/riscv/cpu.c | 3 +--
+ tcg/optimize.c | 3 +--
 file changed, 1 insertion(+), 2 deletions(-)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+diff --git a/tcg/optimize.c b/tcg/optimize.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
+--- a/tcg/optimize.c
-+++ b/target/riscv/cpu.c
++++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
+@@ -XXX,XX +XXX,XX @@ static bool fold_negsetcond(OptContext *ctx, TCGOp *op)
- #endif
+     }
-     cc->gdb_arch_name = riscv_gdb_arch_name;
-     cc->gdb_get_dynamic_xml = riscv_gdb_get_dynamic_xml;
+     /* Value is {0,-1} so all bits are repetitions of the sign. */
--#ifdef CONFIG_TCG
+-    ctx->s_mask = -1;
-     cc->tcg_ops.initialize = riscv_translate_init;
+-    return false;
-     cc->tlb_fill = riscv_cpu_tlb_fill;
++    return fold_masks_s(ctx, op, -1);
 -#endif
 +
      device_class_set_props(dc, riscv_cpu_properties);
  }
+ static bool fold_setcond2(OptContext *ctx, TCGOp *op)
 --
-.25.1
+.43.0

-[PULL 26/46] tcg/tci: Restrict TCG_TARGET_NB_REGS to 16
+[PULL 39/72] tcg/optimize: Use fold_masks_z in fold_setcond2
-As noted in several comments, 8 regs is not enough for 32-bit
+Avoid the use of the OptContext slots.
 to perform calls, as currently implemented.  Shortly, we will
 rearrange the encoding which will make 32 regs impossible.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci/tcg-target.h     | 32 +++++---------------------------
+ tcg/optimize.c | 3 +--
- tcg/tci/tcg-target.c.inc | 26 --------------------------
+file changed, 1 insertion(+), 2 deletions(-)
 files changed, 5 insertions(+), 53 deletions(-)
-diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
+diff --git a/tcg/optimize.c b/tcg/optimize.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target.h
+--- a/tcg/optimize.c
-+++ b/tcg/tci/tcg-target.h
++++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static bool fold_setcond2(OptContext *ctx, TCGOp *op)
- #define TCG_TARGET_HAS_mulu2_i32        1
+         return fold_setcond(ctx, op);
- #endif /* TCG_TARGET_REG_BITS == 64 */
+     }
--/* Number of registers available.
+-    ctx->z_mask = 1;
--   For 32 bit hosts, we need more than 8 registers (call arguments). */
+-    return false;
--/* #define TCG_TARGET_NB_REGS 8 */
++    return fold_masks_z(ctx, op, 1);
-+/* Number of registers available. */
- #define TCG_TARGET_NB_REGS 16
+  do_setcond_const:
--/* #define TCG_TARGET_NB_REGS 32 */
+     return tcg_opt_gen_movi(ctx, op, op->args[0], i);
  /* List of registers which are used by TCG. */
  typedef enum {
@@ -XXX,XX +XXX,XX @@ typedef enum {
      TCG_REG_R5,
      TCG_REG_R6,
      TCG_REG_R7,
 -#if TCG_TARGET_NB_REGS >= 16
      TCG_REG_R8,
      TCG_REG_R9,
      TCG_REG_R10,
@@ -XXX,XX +XXX,XX @@ typedef enum {
      TCG_REG_R13,
      TCG_REG_R14,
      TCG_REG_R15,
 -#if TCG_TARGET_NB_REGS >= 32
 -    TCG_REG_R16,
 -    TCG_REG_R17,
 -    TCG_REG_R18,
 -    TCG_REG_R19,
 -    TCG_REG_R20,
 -    TCG_REG_R21,
 -    TCG_REG_R22,
 -    TCG_REG_R23,
 -    TCG_REG_R24,
 -    TCG_REG_R25,
 -    TCG_REG_R26,
 -    TCG_REG_R27,
 -    TCG_REG_R28,
 -    TCG_REG_R29,
 -    TCG_REG_R30,
 -    TCG_REG_R31,
 -#endif
 -#endif
 +
 +    TCG_AREG0 = TCG_REG_R14,
 +    TCG_REG_CALL_STACK = TCG_REG_R15,
 +
      /* Special value UINT8_MAX is used by TCI to encode constant values. */
      TCG_CONST = UINT8_MAX
  } TCGReg;
 -#define TCG_AREG0                       (TCG_TARGET_NB_REGS - 2)
 -
  /* Used for function call generation. */
 -#define TCG_REG_CALL_STACK              (TCG_TARGET_NB_REGS - 1)
  #define TCG_TARGET_CALL_STACK_OFFSET    0
  #define TCG_TARGET_STACK_ALIGN          16
 diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.c.inc
 +++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const int tcg_target_reg_alloc_order[] = {
      TCG_REG_R5,
      TCG_REG_R6,
      TCG_REG_R7,
 -#if TCG_TARGET_NB_REGS >= 16
      TCG_REG_R8,
      TCG_REG_R9,
      TCG_REG_R10,
@@ -XXX,XX +XXX,XX @@ static const int tcg_target_reg_alloc_order[] = {
      TCG_REG_R13,
      TCG_REG_R14,
      TCG_REG_R15,
 -#endif
  };
  #if MAX_OPC_PARAM_IARGS != 6
@@ -XXX,XX +XXX,XX @@ static const int tcg_target_call_iarg_regs[] = {
  #if TCG_TARGET_REG_BITS == 32
      /* 32 bit hosts need 2 * MAX_OPC_PARAM_IARGS registers. */
      TCG_REG_R7,
 -#if TCG_TARGET_NB_REGS >= 16
      TCG_REG_R8,
      TCG_REG_R9,
      TCG_REG_R10,
      TCG_REG_R11,
      TCG_REG_R12,
 -#else
 -# error Too few input registers available
 -#endif
  #endif
  };
@@ -XXX,XX +XXX,XX @@ static const char *const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
      "r05",
      "r06",
      "r07",
 -#if TCG_TARGET_NB_REGS >= 16
      "r08",
      "r09",
      "r10",
@@ -XXX,XX +XXX,XX @@ static const char *const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
      "r13",
      "r14",
      "r15",
 -#if TCG_TARGET_NB_REGS >= 32
 -    "r16",
 -    "r17",
 -    "r18",
 -    "r19",
 -    "r20",
 -    "r21",
 -    "r22",
 -    "r23",
 -    "r24",
 -    "r25",
 -    "r26",
 -    "r27",
 -    "r28",
 -    "r29",
 -    "r30",
 -    "r31"
 -#endif
 -#endif
  };
  #endif
 --
-.25.1
+.43.0

-[PULL 36/46] target/arm: do not use cc->do_interrupt for KVM directly
+[PULL 40/72] tcg/optimize: Use finish_folding in fold_cmp_vec
-From: Claudio Fontana <cfontana@suse.de>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 cc->do_interrupt is in theory a TCG callback used in accel/tcg only,
 to prepare the emulated architecture to take an interrupt as defined
 in the hardware specifications,
 but in reality the _do_interrupt style of functions in targets are
 also occasionally reused by KVM to prepare the architecture state in a
 similar way where userspace code has identified that it needs to
 deliver an exception to the guest.
 In the case of ARM, that includes:
 ) the vcpu thread got a SIGBUS indicating a memory error,
    and we need to deliver a Synchronous External Abort to the guest to
    let it know about the error.
 ) the kernel told us about a debug exception (breakpoint, watchpoint)
    but it is not for one of QEMU's own gdbstub breakpoints/watchpoints
    so it must be a breakpoint the guest itself has set up, therefore
    we need to deliver it to the guest.
 So in order to reuse code, the same arm_do_interrupt function is used.
 This is all fine, but we need to avoid calling it using the callback
 registered in CPUClass, since that one is now TCG-only.
 Fortunately this is easily solved by replacing calls to
 CPUClass::do_interrupt() with explicit calls to arm_do_interrupt().
 Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Cc: Peter Maydell <peter.maydell@linaro.org>
 Message-Id: <20210204163931.7358-9-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/arm/helper.c | 4 ++++
+ tcg/optimize.c | 2 +-
- target/arm/kvm64.c  | 6 ++----
+file changed, 1 insertion(+), 1 deletion(-)
 files changed, 6 insertions(+), 4 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/tcg/optimize.c b/tcg/optimize.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/tcg/optimize.c
-+++ b/target/arm/helper.c
++++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@ static void handle_semihosting(CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ static bool fold_cmp_vec(OptContext *ctx, TCGOp *op)
-  * Do any appropriate logging, handle PSCI calls, and then hand off
+     if (swap_commutative(NO_DEST, &op->args[1], &op->args[2])) {
-  * to the AArch64-entry or AArch32-entry function depending on the
+         op->args[3] = tcg_swap_cond(op->args[3]);
-  * target exception level's register width.
+     }
-+ *
+-    return false;
-+ * Note: this is used for both TCG (as the do_interrupt tcg op),
++    return finish_folding(ctx, op);
 + *       and KVM to re-inject guest debug exceptions, and to
 + *       inject a Synchronous-External-Abort.
   */
  void arm_cpu_do_interrupt(CPUState *cs)
  {
 diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm64.c
 +++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ static void kvm_inject_arm_sea(CPUState *c)
  {
      ARMCPU *cpu = ARM_CPU(c);
      CPUARMState *env = &cpu->env;
 -    CPUClass *cc = CPU_GET_CLASS(c);
      uint32_t esr;
      bool same_el;
@@ -XXX,XX +XXX,XX @@ static void kvm_inject_arm_sea(CPUState *c)
      env->exception.syndrome = esr;
 -    cc->do_interrupt(c);
 +    arm_cpu_do_interrupt(c);
  }
- #define AARCH64_CORE_REG(x)   (KVM_REG_ARM64 | KVM_REG_SIZE_U64 | \
+ static bool fold_cmpsel_vec(OptContext *ctx, TCGOp *op)
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_handle_debug(CPUState *cs, struct kvm_debug_exit_arch *debug_exit)
  {
      int hsr_ec = syn_get_ec(debug_exit->hsr);
      ARMCPU *cpu = ARM_CPU(cs);
 -    CPUClass *cc = CPU_GET_CLASS(cs);
      CPUARMState *env = &cpu->env;
      /* Ensure PC is synchronised */
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_handle_debug(CPUState *cs, struct kvm_debug_exit_arch *debug_exit)
      env->exception.vaddress = debug_exit->far;
      env->exception.target_el = 1;
      qemu_mutex_lock_iothread();
 -    cc->do_interrupt(cs);
 +    arm_cpu_do_interrupt(cs);
      qemu_mutex_unlock_iothread();
      return false;
 --
-.25.1
+.43.0

-[PULL 25/46] tcg/tci: Remove TODO as unused
+[PULL 41/72] tcg/optimize: Use finish_folding in fold_cmpsel_vec
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c | 8 --------
+ tcg/optimize.c | 2 +-
-file changed, 8 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
+diff --git a/tcg/optimize.c b/tcg/optimize.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/tcg/optimize.c
-+++ b/tcg/tci.c
++++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static bool fold_cmpsel_vec(OptContext *ctx, TCGOp *op)
- #include "tcg/tcg-op.h"
+     if (swap_commutative(op->args[0], &op->args[4], &op->args[3])) {
- #include "qemu/compiler.h"
+         op->args[5] = tcg_invert_cond(op->args[5]);
+     }
--/* Marker for missing code. */
+-    return false;
--#define TODO() \
++    return finish_folding(ctx, op);
--    do { \
+ }
--        fprintf(stderr, "TODO %s:%u: %s()\n", \
--                __FILE__, __LINE__, __func__); \
+ static bool fold_sextract(OptContext *ctx, TCGOp *op)
 -        tcg_abort(); \
 -    } while (0)
 -
  #if MAX_OPC_PARAM_IARGS != 6
  # error Fix needed, number of supported input arguments changed!
  #endif
 --
-.25.1
+.43.0

-[PULL 10/46] tcg/tci: Inline tci_write_reg16 into the only caller
+[PULL 42/72] tcg/optimize: Use fold_masks_zs in fold_sextract
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Avoid the use of the OptContext slots.  Find TempOptInfo once.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c | 10 +---------
+ tcg/optimize.c | 24 +++++++++---------------
-file changed, 1 insertion(+), 9 deletions(-)
+file changed, 9 insertions(+), 15 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
+diff --git a/tcg/optimize.c b/tcg/optimize.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/tcg/optimize.c
-+++ b/tcg/tci.c
++++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@ tci_write_reg(tcg_target_ulong *regs, TCGReg index, tcg_target_ulong value)
+@@ -XXX,XX +XXX,XX @@ static bool fold_cmpsel_vec(OptContext *ctx, TCGOp *op)
-     regs[index] = value;
+ static bool fold_sextract(OptContext *ctx, TCGOp *op)
  {
      uint64_t z_mask, s_mask, s_mask_old;
 +    TempOptInfo *t1 = arg_info(op->args[1]);
      int pos = op->args[2];
      int len = op->args[3];
 -    if (arg_is_const(op->args[1])) {
 -        uint64_t t;
 -
 -        t = arg_info(op->args[1])->val;
 -        t = sextract64(t, pos, len);
 -        return tcg_opt_gen_movi(ctx, op, op->args[0], t);
 +    if (ti_is_const(t1)) {
 +        return tcg_opt_gen_movi(ctx, op, op->args[0],
 +                                sextract64(ti_const_val(t1), pos, len));
      }
 -    z_mask = arg_info(op->args[1])->z_mask;
 -    z_mask = sextract64(z_mask, pos, len);
 -    ctx->z_mask = z_mask;
 -
 -    s_mask_old = arg_info(op->args[1])->s_mask;
 -    s_mask = sextract64(s_mask_old, pos, len);
 -    s_mask |= MAKE_64BIT_MASK(len, 64 - len);
 -    ctx->s_mask = s_mask;
 +    s_mask_old = t1->s_mask;
 +    s_mask = s_mask_old >> pos;
 +    s_mask |= -1ull << (len - 1);
      if (0 && pos == 0 && fold_affected_mask(ctx, op, s_mask & ~s_mask_old)) {
          return true;
      }
 -    return fold_masks(ctx, op);
 +    z_mask = sextract64(t1->z_mask, pos, len);
 +    return fold_masks_zs(ctx, op, z_mask, s_mask);
  }
--#if TCG_TARGET_REG_BITS == 64
+ static bool fold_shift(OptContext *ctx, TCGOp *op)
 -static void
 -tci_write_reg16(tcg_target_ulong *regs, TCGReg index, uint16_t value)
 -{
 -    tci_write_reg(regs, index, value);
 -}
 -#endif
 -
  static void
  tci_write_reg32(tcg_target_ulong *regs, TCGReg index, uint32_t value)
  {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              t0 = *tb_ptr++;
              t1 = tci_read_r(regs, &tb_ptr);
              t2 = tci_read_s32(&tb_ptr);
 -            tci_write_reg16(regs, t0, *(uint16_t *)(t1 + t2));
 +            tci_write_reg(regs, t0, *(uint16_t *)(t1 + t2));
              break;
          case INDEX_op_ld16s_i64:
              TODO();
 --
-.25.1
+.43.0

-[PULL 22/46] tcg/tci: Use g_assert_not_reached
+[PULL 43/72] tcg/optimize: Use fold_masks_zs, fold_masks_s in fold_shift
-Three TODO instances are never happen cases.
+Avoid the use of the OptContext slots.  Find TempOptInfo once.
 Other uses of tcg_abort are also indicating unreachable cases.
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Reviewed-by: Stefan Weil <sw@weilnetz.de>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c | 15 +++++++--------
+ tcg/optimize.c | 27 ++++++++++++++-------------
-file changed, 7 insertions(+), 8 deletions(-)
+file changed, 14 insertions(+), 13 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
+diff --git a/tcg/optimize.c b/tcg/optimize.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/tcg/optimize.c
-+++ b/tcg/tci.c
++++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@ static bool tci_compare32(uint32_t u0, uint32_t u1, TCGCond condition)
+@@ -XXX,XX +XXX,XX @@ static bool fold_sextract(OptContext *ctx, TCGOp *op)
-         result = (u0 > u1);
+ static bool fold_shift(OptContext *ctx, TCGOp *op)
  {
      uint64_t s_mask, z_mask, sign;
 +    TempOptInfo *t1, *t2;
      if (fold_const2(ctx, op) ||
          fold_ix_to_i(ctx, op, 0) ||
@@ -XXX,XX +XXX,XX @@ static bool fold_shift(OptContext *ctx, TCGOp *op)
          return true;
      }
 -    s_mask = arg_info(op->args[1])->s_mask;
 -    z_mask = arg_info(op->args[1])->z_mask;
 +    t1 = arg_info(op->args[1]);
 +    t2 = arg_info(op->args[2]);
 +    s_mask = t1->s_mask;
 +    z_mask = t1->z_mask;
 -    if (arg_is_const(op->args[2])) {
 -        int sh = arg_info(op->args[2])->val;
 -
 -        ctx->z_mask = do_constant_folding(op->opc, ctx->type, z_mask, sh);
 +    if (ti_is_const(t2)) {
 +        int sh = ti_const_val(t2);
 +        z_mask = do_constant_folding(op->opc, ctx->type, z_mask, sh);
          s_mask = do_constant_folding(op->opc, ctx->type, s_mask, sh);
 -        return fold_masks(ctx, op);
 +        return fold_masks_zs(ctx, op, z_mask, s_mask);
      }
      switch (op->opc) {
@@ -XXX,XX +XXX,XX @@ static bool fold_shift(OptContext *ctx, TCGOp *op)
           * Arithmetic right shift will not reduce the number of
           * input sign repetitions.
           */
 -        ctx->s_mask = s_mask;
 -        break;
 +        return fold_masks_s(ctx, op, s_mask);
      CASE_OP_32_64(shr):
          /*
           * If the sign bit is known zero, then logical right shift
 -         * will not reduced the number of input sign repetitions.
 +         * will not reduce the number of input sign repetitions.
           */
 -        sign = (s_mask & -s_mask) >> 1;
 +        sign = -s_mask;
          if (sign && !(z_mask & sign)) {
 -            ctx->s_mask = s_mask;
 +            return fold_masks_s(ctx, op, s_mask);
          }
          break;
      default:
--        TODO();
+         break;
 +        g_assert_not_reached();
      }
-     return result;
 -    return false;
 +    return finish_folding(ctx, op);
  }
-@@ -XXX,XX +XXX,XX @@ static bool tci_compare64(uint64_t u0, uint64_t u1, TCGCond condition)
-         result = (u0 > u1);
+ static bool fold_sub_to_neg(OptContext *ctx, TCGOp *op)
          break;
      default:
 -        TODO();
 +        g_assert_not_reached();
      }
      return result;
  }
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                  tmp32 = qemu_ld_beul;
                  break;
              default:
 -                tcg_abort();
 +                g_assert_not_reached();
              }
              tci_write_reg(regs, t0, tmp32);
              break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                  tmp64 = qemu_ld_beq;
                  break;
              default:
 -                tcg_abort();
 +                g_assert_not_reached();
              }
              tci_write_reg(regs, t0, tmp64);
              if (TCG_TARGET_REG_BITS == 32) {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                  qemu_st_bel(t0);
                  break;
              default:
 -                tcg_abort();
 +                g_assert_not_reached();
              }
              break;
          case INDEX_op_qemu_st_i64:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                  qemu_st_beq(tmp64);
                  break;
              default:
 -                tcg_abort();
 +                g_assert_not_reached();
              }
              break;
          case INDEX_op_mb:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              smp_mb();
              break;
          default:
 -            TODO();
 -            break;
 +            g_assert_not_reached();
          }
          tci_assert(tb_ptr == old_code_ptr + op_size);
      }
 --
-.25.1
+.43.0

-[PULL 24/46] tcg/tci: Implement 64-bit division
+[PULL 44/72] tcg/optimize: Simplify sign bit test in fold_shift
-Trivially implemented like other arithmetic.
+Merge the two conditions, sign != 0 && !(z_mask & sign),
-Tested via check-tcg and the ppc64 target.
+by testing ~z_mask & sign.   If sign == 0, the logical and
 will produce false.
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci/tcg-target.h     |  4 ++--
+ tcg/optimize.c | 5 ++---
- tcg/tci.c                | 28 ++++++++++++++++++++++------
+file changed, 2 insertions(+), 3 deletions(-)
  tcg/tci/tcg-target.c.inc | 10 ++++------
 files changed, 28 insertions(+), 14 deletions(-)
-diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
+diff --git a/tcg/optimize.c b/tcg/optimize.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target.h
+--- a/tcg/optimize.c
-+++ b/tcg/tci/tcg-target.h
++++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static bool fold_sextract(OptContext *ctx, TCGOp *op)
- #define TCG_TARGET_HAS_extract_i64      0
- #define TCG_TARGET_HAS_sextract_i64     0
+ static bool fold_shift(OptContext *ctx, TCGOp *op)
- #define TCG_TARGET_HAS_extract2_i64     0
+ {
--#define TCG_TARGET_HAS_div_i64          0
+-    uint64_t s_mask, z_mask, sign;
--#define TCG_TARGET_HAS_rem_i64          0
++    uint64_t s_mask, z_mask;
-+#define TCG_TARGET_HAS_div_i64          1
+     TempOptInfo *t1, *t2;
-+#define TCG_TARGET_HAS_rem_i64          1
- #define TCG_TARGET_HAS_ext8s_i64        1
+     if (fold_const2(ctx, op) ||
- #define TCG_TARGET_HAS_ext16s_i64       1
+@@ -XXX,XX +XXX,XX @@ static bool fold_shift(OptContext *ctx, TCGOp *op)
- #define TCG_TARGET_HAS_ext32s_i64       1
+          * If the sign bit is known zero, then logical right shift
-diff --git a/tcg/tci.c b/tcg/tci.c
+          * will not reduce the number of input sign repetitions.
-index XXXXXXX..XXXXXXX 100644
+          */
---- a/tcg/tci.c
+-        sign = -s_mask;
-+++ b/tcg/tci.c
+-        if (sign && !(z_mask & sign)) {
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
++        if (~z_mask & -s_mask) {
-             t2 = tci_read_ri64(regs, &tb_ptr);
+             return fold_masks_s(ctx, op, s_mask);
-             tci_write_reg(regs, t0, t1 * t2);
+         }
              break;
 -#if TCG_TARGET_HAS_div_i64
          case INDEX_op_div_i64:
 -        case INDEX_op_divu_i64:
 -        case INDEX_op_rem_i64:
 -        case INDEX_op_remu_i64:
 -            TODO();
 +            t0 = *tb_ptr++;
 +            t1 = tci_read_ri64(regs, &tb_ptr);
 +            t2 = tci_read_ri64(regs, &tb_ptr);
 +            tci_write_reg(regs, t0, (int64_t)t1 / (int64_t)t2);
 +            break;
 +        case INDEX_op_divu_i64:
 +            t0 = *tb_ptr++;
 +            t1 = tci_read_ri64(regs, &tb_ptr);
 +            t2 = tci_read_ri64(regs, &tb_ptr);
 +            tci_write_reg(regs, t0, (uint64_t)t1 / (uint64_t)t2);
 +            break;
 +        case INDEX_op_rem_i64:
 +            t0 = *tb_ptr++;
 +            t1 = tci_read_ri64(regs, &tb_ptr);
 +            t2 = tci_read_ri64(regs, &tb_ptr);
 +            tci_write_reg(regs, t0, (int64_t)t1 % (int64_t)t2);
 +            break;
 +        case INDEX_op_remu_i64:
 +            t0 = *tb_ptr++;
 +            t1 = tci_read_ri64(regs, &tb_ptr);
 +            t2 = tci_read_ri64(regs, &tb_ptr);
 +            tci_write_reg(regs, t0, (uint64_t)t1 % (uint64_t)t2);
              break;
 -#endif
          case INDEX_op_and_i64:
              t0 = *tb_ptr++;
              t1 = tci_read_ri64(regs, &tb_ptr);
 diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.c.inc
 +++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
      case INDEX_op_sar_i64:
      case INDEX_op_rotl_i64:     /* Optional (TCG_TARGET_HAS_rot_i64). */
      case INDEX_op_rotr_i64:     /* Optional (TCG_TARGET_HAS_rot_i64). */
 +    case INDEX_op_div_i64:      /* Optional (TCG_TARGET_HAS_div_i64). */
 +    case INDEX_op_divu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
 +    case INDEX_op_rem_i64:      /* Optional (TCG_TARGET_HAS_div_i64). */
 +    case INDEX_op_remu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
          tcg_out_r(s, args[0]);
          tcg_out_ri64(s, const_args[1], args[1]);
          tcg_out_ri64(s, const_args[2], args[2]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
          tcg_debug_assert(args[4] <= UINT8_MAX);
          tcg_out8(s, args[4]);
          break;
--    case INDEX_op_div_i64:      /* Optional (TCG_TARGET_HAS_div_i64). */
--    case INDEX_op_divu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
--    case INDEX_op_rem_i64:      /* Optional (TCG_TARGET_HAS_div_i64). */
--    case INDEX_op_remu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
--        TODO();
--        break;
-     case INDEX_op_brcond_i64:
-         tcg_out_r(s, args[0]);
-         tcg_out_ri64(s, const_args[1], args[1]);
 --
-.25.1
+.43.0

-[PULL 34/46] cpu: Move tlb_fill to tcg_ops
+[PULL 45/72] tcg/optimize: Use finish_folding in fold_sub, fold_sub_vec
-From: Eduardo Habkost <ehabkost@redhat.com>
+Duplicate fold_sub_vec into fold_sub instead of calling it,
 now that fold_sub_vec always returns true.
-[claudio: wrapped target code in CONFIG_TCG]
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
 Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210204163931.7358-7-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h           | 21 ++++++++++++---------
+ tcg/optimize.c | 9 ++++++---
- accel/tcg/cputlb.c              |  7 ++++---
+file changed, 6 insertions(+), 3 deletions(-)
  accel/tcg/user-exec.c           |  6 +++---
  target/alpha/cpu.c              |  2 +-
  target/arm/cpu.c                |  2 +-
  target/avr/cpu.c                |  2 +-
  target/cris/cpu.c               |  2 +-
  target/hppa/cpu.c               |  2 +-
  target/i386/tcg/tcg-cpu.c       |  2 +-
  target/lm32/cpu.c               |  2 +-
  target/m68k/cpu.c               |  2 +-
  target/microblaze/cpu.c         |  2 +-
  target/mips/cpu.c               |  2 +-
  target/moxie/cpu.c              |  2 +-
  target/nios2/cpu.c              |  2 +-
  target/openrisc/cpu.c           |  2 +-
  target/riscv/cpu.c              |  2 +-
  target/rx/cpu.c                 |  2 +-
  target/s390x/cpu.c              |  2 +-
  target/sh4/cpu.c                |  2 +-
  target/sparc/cpu.c              |  2 +-
  target/tilegx/cpu.c             |  2 +-
  target/tricore/cpu.c            |  2 +-
  target/unicore32/cpu.c          |  2 +-
  target/xtensa/cpu.c             |  2 +-
  target/ppc/translate_init.c.inc |  2 +-
 files changed, 42 insertions(+), 38 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
+diff --git a/tcg/optimize.c b/tcg/optimize.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
+--- a/tcg/optimize.c
-+++ b/include/hw/core/cpu.h
++++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
+@@ -XXX,XX +XXX,XX @@ static bool fold_sub_vec(OptContext *ctx, TCGOp *op)
-     void (*cpu_exec_exit)(CPUState *cpu);
+         fold_sub_to_neg(ctx, op)) {
-     /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
+         return true;
-     bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
+     }
-+    /**
+-    return false;
-+     * @tlb_fill: Handle a softmmu tlb miss or user-only address fault
++    return finish_folding(ctx, op);
 +     *
 +     * For system mode, if the access is valid, call tlb_set_page
 +     * and return true; if the access is invalid, and probe is
 +     * true, return false; otherwise raise an exception and do
 +     * not return.  For user-only mode, always raise an exception
 +     * and do not return.
 +     */
 +    bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
 +                     MMUAccessType access_type, int mmu_idx,
 +                     bool probe, uintptr_t retaddr);
  } TcgCpuOperations;
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
   *       If the target behaviour here is anything other than "set
   *       the PC register to the value passed in" then the target must
   *       also implement the synchronize_from_tb hook.
 - * @tlb_fill: Callback for handling a softmmu tlb miss or user-only
 - *       address fault.  For system mode, if the access is valid, call
 - *       tlb_set_page and return true; if the access is invalid, and
 - *       probe is true, return false; otherwise raise an exception and
 - *       do not return.  For user-only mode, always raise an exception
 - *       and do not return.
   * @get_phys_page_debug: Callback for obtaining a physical address.
   * @get_phys_page_attrs_debug: Callback for obtaining a physical address and the
   *       associated memory transaction attributes to use for the access.
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
      void (*get_memory_mapping)(CPUState *cpu, MemoryMappingList *list,
                                 Error **errp);
      void (*set_pc)(CPUState *cpu, vaddr value);
 -    bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
 -                     MMUAccessType access_type, int mmu_idx,
 -                     bool probe, uintptr_t retaddr);
      hwaddr (*get_phys_page_debug)(CPUState *cpu, vaddr addr);
      hwaddr (*get_phys_page_attrs_debug)(CPUState *cpu, vaddr addr,
                                          MemTxAttrs *attrs);
 diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cputlb.c
 +++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_fill(CPUState *cpu, target_ulong addr, int size,
       * This is not a probe, so only valid return is success; failure
       * should result in exception + longjmp to the cpu loop.
       */
 -    ok = cc->tlb_fill(cpu, addr, size, access_type, mmu_idx, false, retaddr);
 +    ok = cc->tcg_ops.tlb_fill(cpu, addr, size,
 +                              access_type, mmu_idx, false, retaddr);
      assert(ok);
  }
-@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
+ static bool fold_sub(OptContext *ctx, TCGOp *op)
-             CPUState *cs = env_cpu(env);
+ {
-             CPUClass *cc = CPU_GET_CLASS(cs);
+-    if (fold_const2(ctx, op) || fold_sub_vec(ctx, op)) {
++    if (fold_const2(ctx, op) ||
--            if (!cc->tlb_fill(cs, addr, fault_size, access_type,
++        fold_xx_to_i(ctx, op, 0) ||
--                              mmu_idx, nonfault, retaddr)) {
++        fold_xi_to_x(ctx, op, 0) ||
-+            if (!cc->tcg_ops.tlb_fill(cs, addr, fault_size, access_type,
++        fold_sub_to_neg(ctx, op)) {
-+                                      mmu_idx, nonfault, retaddr)) {
+         return true;
-                 /* Non-faulting page table read failed.  */
+     }
-                 *phost = NULL;
-                 return TLB_INVALID_MASK;
+@@ -XXX,XX +XXX,XX @@ static bool fold_sub(OptContext *ctx, TCGOp *op)
-diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
+                    ? INDEX_op_add_i32 : INDEX_op_add_i64);
-index XXXXXXX..XXXXXXX 100644
+         op->args[2] = arg_new_constant(ctx, -val);
---- a/accel/tcg/user-exec.c
+     }
-+++ b/accel/tcg/user-exec.c
+-    return false;
-@@ -XXX,XX +XXX,XX @@ static inline int handle_cpu_signal(uintptr_t pc, siginfo_t *info,
++    return finish_folding(ctx, op);
      clear_helper_retaddr();
      cc = CPU_GET_CLASS(cpu);
 -    cc->tlb_fill(cpu, address, 0, access_type, MMU_USER_IDX, false, pc);
 +    cc->tcg_ops.tlb_fill(cpu, address, 0, access_type, MMU_USER_IDX, false, pc);
      g_assert_not_reached();
  }
-@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
+ static bool fold_sub2(OptContext *ctx, TCGOp *op)
          } else {
              CPUState *cpu = env_cpu(env);
              CPUClass *cc = CPU_GET_CLASS(cpu);
 -            cc->tlb_fill(cpu, addr, fault_size, access_type,
 -                         MMU_USER_IDX, false, ra);
 +            cc->tcg_ops.tlb_fill(cpu, addr, fault_size, access_type,
 +                                 MMU_USER_IDX, false, ra);
              g_assert_not_reached();
          }
      }
 diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/alpha/cpu.c
 +++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
      cc->set_pc = alpha_cpu_set_pc;
      cc->gdb_read_register = alpha_cpu_gdb_read_register;
      cc->gdb_write_register = alpha_cpu_gdb_write_register;
 -    cc->tlb_fill = alpha_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = alpha_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->do_transaction_failed = alpha_cpu_do_transaction_failed;
      cc->do_unaligned_access = alpha_cpu_do_unaligned_access;
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
      cc->tcg_ops.initialize = arm_translate_init;
      cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
      cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
 -    cc->tlb_fill = arm_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = arm_cpu_tlb_fill;
      cc->debug_excp_handler = arm_debug_excp_handler;
      cc->debug_check_watchpoint = arm_debug_check_watchpoint;
      cc->do_unaligned_access = arm_cpu_do_unaligned_access;
 diff --git a/target/avr/cpu.c b/target/avr/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/avr/cpu.c
 +++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
      cc->set_pc = avr_cpu_set_pc;
      cc->memory_rw_debug = avr_cpu_memory_rw_debug;
      cc->get_phys_page_debug = avr_cpu_get_phys_page_debug;
 -    cc->tlb_fill = avr_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = avr_cpu_tlb_fill;
      cc->vmsd = &vms_avr_cpu;
      cc->disas_set_info = avr_cpu_disas_set_info;
      cc->tcg_ops.initialize = avr_cpu_tcg_init;
 diff --git a/target/cris/cpu.c b/target/cris/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/cris/cpu.c
 +++ b/target/cris/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
      cc->set_pc = cris_cpu_set_pc;
      cc->gdb_read_register = cris_cpu_gdb_read_register;
      cc->gdb_write_register = cris_cpu_gdb_write_register;
 -    cc->tlb_fill = cris_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = cris_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->get_phys_page_debug = cris_cpu_get_phys_page_debug;
      dc->vmsd = &vmstate_cris_cpu;
 diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hppa/cpu.c
 +++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
      cc->tcg_ops.synchronize_from_tb = hppa_cpu_synchronize_from_tb;
      cc->gdb_read_register = hppa_cpu_gdb_read_register;
      cc->gdb_write_register = hppa_cpu_gdb_write_register;
 -    cc->tlb_fill = hppa_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = hppa_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->get_phys_page_debug = hppa_cpu_get_phys_page_debug;
      dc->vmsd = &vmstate_hppa_cpu;
 diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/tcg-cpu.c
 +++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void tcg_cpu_common_class_init(CPUClass *cc)
      cc->tcg_ops.cpu_exec_enter = x86_cpu_exec_enter;
      cc->tcg_ops.cpu_exec_exit = x86_cpu_exec_exit;
      cc->tcg_ops.initialize = tcg_x86_init;
 -    cc->tlb_fill = x86_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = x86_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->debug_excp_handler = breakpoint_handler;
  #endif
 diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/lm32/cpu.c
 +++ b/target/lm32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
      cc->set_pc = lm32_cpu_set_pc;
      cc->gdb_read_register = lm32_cpu_gdb_read_register;
      cc->gdb_write_register = lm32_cpu_gdb_write_register;
 -    cc->tlb_fill = lm32_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = lm32_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->get_phys_page_debug = lm32_cpu_get_phys_page_debug;
      cc->vmsd = &vmstate_lm32_cpu;
 diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/m68k/cpu.c
 +++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
      cc->set_pc = m68k_cpu_set_pc;
      cc->gdb_read_register = m68k_cpu_gdb_read_register;
      cc->gdb_write_register = m68k_cpu_gdb_write_register;
 -    cc->tlb_fill = m68k_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = m68k_cpu_tlb_fill;
  #if defined(CONFIG_SOFTMMU)
      cc->do_transaction_failed = m68k_cpu_transaction_failed;
      cc->get_phys_page_debug = m68k_cpu_get_phys_page_debug;
 diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/microblaze/cpu.c
 +++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
      cc->tcg_ops.synchronize_from_tb = mb_cpu_synchronize_from_tb;
      cc->gdb_read_register = mb_cpu_gdb_read_register;
      cc->gdb_write_register = mb_cpu_gdb_write_register;
 -    cc->tlb_fill = mb_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = mb_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->do_transaction_failed = mb_cpu_transaction_failed;
      cc->get_phys_page_attrs_debug = mb_cpu_get_phys_page_attrs_debug;
 diff --git a/target/mips/cpu.c b/target/mips/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/cpu.c
 +++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
      cc->tcg_ops.initialize = mips_tcg_init;
      cc->tcg_ops.cpu_exec_interrupt = mips_cpu_exec_interrupt;
      cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
 -    cc->tlb_fill = mips_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = mips_cpu_tlb_fill;
  #endif
      cc->gdb_num_core_regs = 73;
 diff --git a/target/moxie/cpu.c b/target/moxie/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/moxie/cpu.c
 +++ b/target/moxie/cpu.c
@@ -XXX,XX +XXX,XX @@ static void moxie_cpu_class_init(ObjectClass *oc, void *data)
      cc->do_interrupt = moxie_cpu_do_interrupt;
      cc->dump_state = moxie_cpu_dump_state;
      cc->set_pc = moxie_cpu_set_pc;
 -    cc->tlb_fill = moxie_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = moxie_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->get_phys_page_debug = moxie_cpu_get_phys_page_debug;
      cc->vmsd = &vmstate_moxie_cpu;
 diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/nios2/cpu.c
 +++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
      cc->dump_state = nios2_cpu_dump_state;
      cc->set_pc = nios2_cpu_set_pc;
      cc->disas_set_info = nios2_cpu_disas_set_info;
 -    cc->tlb_fill = nios2_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = nios2_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->do_unaligned_access = nios2_cpu_do_unaligned_access;
      cc->get_phys_page_debug = nios2_cpu_get_phys_page_debug;
 diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/openrisc/cpu.c
 +++ b/target/openrisc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
      cc->set_pc = openrisc_cpu_set_pc;
      cc->gdb_read_register = openrisc_cpu_gdb_read_register;
      cc->gdb_write_register = openrisc_cpu_gdb_write_register;
 -    cc->tlb_fill = openrisc_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = openrisc_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->get_phys_page_debug = openrisc_cpu_get_phys_page_debug;
      dc->vmsd = &vmstate_openrisc_cpu;
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
      cc->gdb_arch_name = riscv_gdb_arch_name;
      cc->gdb_get_dynamic_xml = riscv_gdb_get_dynamic_xml;
      cc->tcg_ops.initialize = riscv_translate_init;
 -    cc->tlb_fill = riscv_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = riscv_cpu_tlb_fill;
      device_class_set_props(dc, riscv_cpu_properties);
  }
 diff --git a/target/rx/cpu.c b/target/rx/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/rx/cpu.c
 +++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
      cc->get_phys_page_debug = rx_cpu_get_phys_page_debug;
      cc->disas_set_info = rx_cpu_disas_set_info;
      cc->tcg_ops.initialize = rx_translate_init;
 -    cc->tlb_fill = rx_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = rx_cpu_tlb_fill;
      cc->gdb_num_core_regs = 26;
      cc->gdb_core_xml_file = "rx-core.xml";
 diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/cpu.c
 +++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
      cc->disas_set_info = s390_cpu_disas_set_info;
  #ifdef CONFIG_TCG
      cc->tcg_ops.initialize = s390x_translate_init;
 -    cc->tlb_fill = s390_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = s390_cpu_tlb_fill;
  #endif
      cc->gdb_num_core_regs = S390_NUM_CORE_REGS;
 diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sh4/cpu.c
 +++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
      cc->tcg_ops.synchronize_from_tb = superh_cpu_synchronize_from_tb;
      cc->gdb_read_register = superh_cpu_gdb_read_register;
      cc->gdb_write_register = superh_cpu_gdb_write_register;
 -    cc->tlb_fill = superh_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = superh_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->do_unaligned_access = superh_cpu_do_unaligned_access;
      cc->get_phys_page_debug = superh_cpu_get_phys_page_debug;
 diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sparc/cpu.c
 +++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
      cc->tcg_ops.synchronize_from_tb = sparc_cpu_synchronize_from_tb;
      cc->gdb_read_register = sparc_cpu_gdb_read_register;
      cc->gdb_write_register = sparc_cpu_gdb_write_register;
 -    cc->tlb_fill = sparc_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = sparc_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->do_transaction_failed = sparc_cpu_do_transaction_failed;
      cc->do_unaligned_access = sparc_cpu_do_unaligned_access;
 diff --git a/target/tilegx/cpu.c b/target/tilegx/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tilegx/cpu.c
 +++ b/target/tilegx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
      cc->tcg_ops.cpu_exec_interrupt = tilegx_cpu_exec_interrupt;
      cc->dump_state = tilegx_cpu_dump_state;
      cc->set_pc = tilegx_cpu_set_pc;
 -    cc->tlb_fill = tilegx_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = tilegx_cpu_tlb_fill;
      cc->gdb_num_core_regs = 0;
      cc->tcg_ops.initialize = tilegx_tcg_init;
  }
 diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tricore/cpu.c
 +++ b/target/tricore/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_class_init(ObjectClass *c, void *data)
      cc->tcg_ops.synchronize_from_tb = tricore_cpu_synchronize_from_tb;
      cc->get_phys_page_debug = tricore_cpu_get_phys_page_debug;
      cc->tcg_ops.initialize = tricore_tcg_init;
 -    cc->tlb_fill = tricore_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = tricore_cpu_tlb_fill;
  }
  #define DEFINE_TRICORE_CPU_TYPE(cpu_model, initfn) \
 diff --git a/target/unicore32/cpu.c b/target/unicore32/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/unicore32/cpu.c
 +++ b/target/unicore32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
      cc->tcg_ops.cpu_exec_interrupt = uc32_cpu_exec_interrupt;
      cc->dump_state = uc32_cpu_dump_state;
      cc->set_pc = uc32_cpu_set_pc;
 -    cc->tlb_fill = uc32_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = uc32_cpu_tlb_fill;
      cc->get_phys_page_debug = uc32_cpu_get_phys_page_debug;
      cc->tcg_ops.initialize = uc32_translate_init;
      dc->vmsd = &vmstate_uc32_cpu;
 diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/xtensa/cpu.c
 +++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
      cc->gdb_read_register = xtensa_cpu_gdb_read_register;
      cc->gdb_write_register = xtensa_cpu_gdb_write_register;
      cc->gdb_stop_before_watchpoint = true;
 -    cc->tlb_fill = xtensa_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = xtensa_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->do_unaligned_access = xtensa_cpu_do_unaligned_access;
      cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
 diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/ppc/translate_init.c.inc
 +++ b/target/ppc/translate_init.c.inc
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
  #ifdef CONFIG_TCG
      cc->tcg_ops.initialize = ppc_translate_init;
      cc->tcg_ops.cpu_exec_interrupt = ppc_cpu_exec_interrupt;
 -    cc->tlb_fill = ppc_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = ppc_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->tcg_ops.cpu_exec_enter = ppc_cpu_exec_enter;
      cc->tcg_ops.cpu_exec_exit = ppc_cpu_exec_exit;
 --
-.25.1
+.43.0

-[PULL 03/46] tcg/aarch64: Do not convert TCGArg to temps that are not temps
+[PULL 46/72] tcg/optimize: Use fold_masks_zs in fold_tcg_ld
-Fixes INDEX_op_rotli_vec for aarch64 host, where the 3rd
+Avoid the use of the OptContext slots.
 argument is an integer, not a temporary, which now tickles
 an assert added in e89b28a6350.
-Previously, the value computed into v2 would be garbage for
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 rotli_vec, but as the value was unused it caused no harm.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/aarch64/tcg-target.c.inc | 7 ++++---
+ tcg/optimize.c | 16 +++++++++-------
-file changed, 4 insertions(+), 3 deletions(-)
+file changed, 9 insertions(+), 7 deletions(-)
-diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
+diff --git a/tcg/optimize.c b/tcg/optimize.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/aarch64/tcg-target.c.inc
+--- a/tcg/optimize.c
-+++ b/tcg/aarch64/tcg-target.c.inc
++++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@ void tcg_expand_vec_op(TCGOpcode opc, TCGType type, unsigned vece,
+@@ -XXX,XX +XXX,XX @@ static bool fold_sub2(OptContext *ctx, TCGOp *op)
-     v0 = temp_tcgv_vec(arg_temp(a0));
-     v1 = temp_tcgv_vec(arg_temp(va_arg(va, TCGArg)));
+ static bool fold_tcg_ld(OptContext *ctx, TCGOp *op)
-     a2 = va_arg(va, TCGArg);
+ {
--    v2 = temp_tcgv_vec(arg_temp(a2));
++    uint64_t z_mask = -1, s_mask = 0;
-+    va_end(va);
++
+     /* We can't do any folding with a load, but we can record bits. */
-     switch (opc) {
+     switch (op->opc) {
-     case INDEX_op_rotli_vec:
+     CASE_OP_32_64(ld8s):
-@@ -XXX,XX +XXX,XX @@ void tcg_expand_vec_op(TCGOpcode opc, TCGType type, unsigned vece,
+-        ctx->s_mask = MAKE_64BIT_MASK(8, 56);
-     case INDEX_op_shrv_vec:
++        s_mask = INT8_MIN;
      case INDEX_op_sarv_vec:
          /* Right shifts are negative left shifts for AArch64.  */
 +        v2 = temp_tcgv_vec(arg_temp(a2));
          t1 = tcg_temp_new_vec(type);
          tcg_gen_neg_vec(vece, t1, v2);
          opc = (opc == INDEX_op_shrv_vec
@@ -XXX,XX +XXX,XX @@ void tcg_expand_vec_op(TCGOpcode opc, TCGType type, unsigned vece,
          break;
+     CASE_OP_32_64(ld8u):
-     case INDEX_op_rotlv_vec:
+-        ctx->z_mask = MAKE_64BIT_MASK(0, 8);
-+        v2 = temp_tcgv_vec(arg_temp(a2));
++        z_mask = MAKE_64BIT_MASK(0, 8);
          t1 = tcg_temp_new_vec(type);
          c1 = tcg_constant_vec(type, vece, 8 << vece);
          tcg_gen_sub_vec(vece, t1, v2, c1);
@@ -XXX,XX +XXX,XX @@ void tcg_expand_vec_op(TCGOpcode opc, TCGType type, unsigned vece,
          break;
+     CASE_OP_32_64(ld16s):
-     case INDEX_op_rotrv_vec:
+-        ctx->s_mask = MAKE_64BIT_MASK(16, 48);
-+        v2 = temp_tcgv_vec(arg_temp(a2));
++        s_mask = INT16_MIN;
-         t1 = tcg_temp_new_vec(type);
+         break;
-         t2 = tcg_temp_new_vec(type);
+     CASE_OP_32_64(ld16u):
-         c1 = tcg_constant_vec(type, vece, 8 << vece);
+-        ctx->z_mask = MAKE_64BIT_MASK(0, 16);
-@@ -XXX,XX +XXX,XX @@ void tcg_expand_vec_op(TCGOpcode opc, TCGType type, unsigned vece,
++        z_mask = MAKE_64BIT_MASK(0, 16);
          break;
      case INDEX_op_ld32s_i64:
 -        ctx->s_mask = MAKE_64BIT_MASK(32, 32);
 +        s_mask = INT32_MIN;
          break;
      case INDEX_op_ld32u_i64:
 -        ctx->z_mask = MAKE_64BIT_MASK(0, 32);
 +        z_mask = MAKE_64BIT_MASK(0, 32);
          break;
      default:
          g_assert_not_reached();
      }
--
+-    return false;
--    va_end(va);
++    return fold_masks_zs(ctx, op, z_mask, s_mask);
  }
- static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
+ static bool fold_tcg_ld_memcopy(OptContext *ctx, TCGOp *op)
 --
-.25.1
+.43.0

-[PULL 23/46] tcg/tci: Remove dead code for TCG_TARGET_HAS_div2_*
+[PULL 47/72] tcg/optimize: Use finish_folding in fold_tcg_ld_memcopy
-We do not simultaneously support div and div2 -- it's one
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 or the other.  TCI is already using div, so remove div2.
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c                | 12 ------------
+ tcg/optimize.c | 2 +-
- tcg/tci/tcg-target.c.inc |  8 --------
+file changed, 1 insertion(+), 1 deletion(-)
 files changed, 20 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
+diff --git a/tcg/optimize.c b/tcg/optimize.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/tcg/optimize.c
-+++ b/tcg/tci.c
++++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+@@ -XXX,XX +XXX,XX @@ static bool fold_tcg_ld_memcopy(OptContext *ctx, TCGOp *op)
-             t2 = tci_read_ri32(regs, &tb_ptr);
+     TCGType type;
-             tci_write_reg(regs, t0, t1 * t2);
-             break;
+     if (op->args[1] != tcgv_ptr_arg(tcg_env)) {
--#if TCG_TARGET_HAS_div_i32
+-        return false;
-         case INDEX_op_div_i32:
++        return finish_folding(ctx, op);
-             t0 = *tb_ptr++;
+     }
-             t1 = tci_read_ri32(regs, &tb_ptr);
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+     type = ctx->type;
              t2 = tci_read_ri32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 % t2);
              break;
 -#elif TCG_TARGET_HAS_div2_i32
 -        case INDEX_op_div2_i32:
 -        case INDEX_op_divu2_i32:
 -            TODO();
 -            break;
 -#endif
          case INDEX_op_and_i32:
              t0 = *tb_ptr++;
              t1 = tci_read_ri32(regs, &tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
          case INDEX_op_remu_i64:
              TODO();
              break;
 -#elif TCG_TARGET_HAS_div2_i64
 -        case INDEX_op_div2_i64:
 -        case INDEX_op_divu2_i64:
 -            TODO();
 -            break;
  #endif
          case INDEX_op_and_i64:
              t0 = *tb_ptr++;
 diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.c.inc
 +++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
      case INDEX_op_remu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
          TODO();
          break;
 -    case INDEX_op_div2_i64:     /* Optional (TCG_TARGET_HAS_div2_i64). */
 -    case INDEX_op_divu2_i64:    /* Optional (TCG_TARGET_HAS_div2_i64). */
 -        TODO();
 -        break;
      case INDEX_op_brcond_i64:
          tcg_out_r(s, args[0]);
          tcg_out_ri64(s, const_args[1], args[1]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
          tcg_out_ri32(s, const_args[1], args[1]);
          tcg_out_ri32(s, const_args[2], args[2]);
          break;
 -    case INDEX_op_div2_i32:     /* Optional (TCG_TARGET_HAS_div2_i32). */
 -    case INDEX_op_divu2_i32:    /* Optional (TCG_TARGET_HAS_div2_i32). */
 -        TODO();
 -        break;
  #if TCG_TARGET_REG_BITS == 32
      case INDEX_op_add2_i32:
      case INDEX_op_sub2_i32:
 --
-.25.1
+.43.0

-[PULL 41/46] cpu: move adjust_watchpoint_address to tcg_ops
+[PULL 48/72] tcg/optimize: Use fold_masks_zs in fold_xor
-From: Claudio Fontana <cfontana@suse.de>
+Avoid the use of the OptContext slots.  Find TempOptInfo once.
 Remove fold_masks as the function becomes unused.
-commit 40612000599e ("arm: Correctly handle watchpoints for BE32 CPUs")
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 introduced this ARM-specific, TCG-specific hack to adjust the address,
 before checking it with cpu_check_watchpoint.
 Make adjust_watchpoint_address optional and move it to tcg_ops.
 Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-Id: <20210204163931.7358-14-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h | 6 +++++-
+ tcg/optimize.c | 18 ++++++++----------
- hw/core/cpu.c         | 6 ------
+file changed, 8 insertions(+), 10 deletions(-)
  softmmu/physmem.c     | 5 ++++-
  target/arm/cpu.c      | 2 +-
 files changed, 10 insertions(+), 9 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
+diff --git a/tcg/optimize.c b/tcg/optimize.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
+--- a/tcg/optimize.c
-+++ b/include/hw/core/cpu.h
++++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
+@@ -XXX,XX +XXX,XX @@ static bool fold_masks_s(OptContext *ctx, TCGOp *op, uint64_t s_mask)
-     void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
+     return fold_masks_zs(ctx, op, -1, s_mask);
                                  MMUAccessType access_type,
                                  int mmu_idx, uintptr_t retaddr);
 +    /**
 +     * @adjust_watchpoint_address: hack for cpu_check_watchpoint used by ARM
 +     */
 +    vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
 +
  } TcgCpuOperations;
  /**
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
      const char * (*gdb_get_dynamic_xml)(CPUState *cpu, const char *xmlname);
      void (*disas_set_info)(CPUState *cpu, disassemble_info *info);
 -    vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
      const char *deprecation_note;
      /* Keep non-pointer data at the end to minimize holes.  */
 diff --git a/hw/core/cpu.c b/hw/core/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/core/cpu.c
 +++ b/hw/core/cpu.c
@@ -XXX,XX +XXX,XX @@ static int64_t cpu_common_get_arch_id(CPUState *cpu)
      return cpu->cpu_index;
  }
--static vaddr cpu_adjust_watchpoint_address(CPUState *cpu, vaddr addr, int len)
+-static bool fold_masks(OptContext *ctx, TCGOp *op)
 -{
--    return addr;
+-    return fold_masks_zs(ctx, op, ctx->z_mask, ctx->s_mask);
 -}
 -
- static Property cpu_common_props[] = {
+ /*
- #ifndef CONFIG_USER_ONLY
+  * An "affected" mask bit is 0 if and only if the result is identical
-     /* Create a memory property for softmmu CPU object,
+  * to the first input.  Thus if the entire mask is 0, the operation
-@@ -XXX,XX +XXX,XX @@ static void cpu_class_init(ObjectClass *klass, void *data)
+@@ -XXX,XX +XXX,XX @@ static bool fold_tcg_st_memcopy(OptContext *ctx, TCGOp *op)
-     k->gdb_write_register = cpu_common_gdb_write_register;
-     k->virtio_is_big_endian = cpu_common_virtio_is_big_endian;
+ static bool fold_xor(OptContext *ctx, TCGOp *op)
-     k->debug_check_watchpoint = cpu_common_debug_check_watchpoint;
+ {
--    k->adjust_watchpoint_address = cpu_adjust_watchpoint_address;
++    uint64_t z_mask, s_mask;
-     set_bit(DEVICE_CATEGORY_CPU, dc->categories);
++    TempOptInfo *t1, *t2;
-     dc->realize = cpu_common_realizefn;
++
-     dc->unrealize = cpu_common_unrealizefn;
+     if (fold_const2_commutative(ctx, op) ||
-diff --git a/softmmu/physmem.c b/softmmu/physmem.c
+         fold_xx_to_i(ctx, op, 0) ||
-index XXXXXXX..XXXXXXX 100644
+         fold_xi_to_x(ctx, op, 0) ||
---- a/softmmu/physmem.c
+@@ -XXX,XX +XXX,XX @@ static bool fold_xor(OptContext *ctx, TCGOp *op)
-+++ b/softmmu/physmem.c
+         return true;
@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
          return;
      }
--    addr = cc->adjust_watchpoint_address(cpu, addr, len);
+-    ctx->z_mask = arg_info(op->args[1])->z_mask
-+    if (cc->tcg_ops.adjust_watchpoint_address) {
+-                | arg_info(op->args[2])->z_mask;
-+        /* this is currently used only by ARM BE32 */
+-    ctx->s_mask = arg_info(op->args[1])->s_mask
-+        addr = cc->tcg_ops.adjust_watchpoint_address(cpu, addr, len);
+-                & arg_info(op->args[2])->s_mask;
-+    }
+-    return fold_masks(ctx, op);
-     QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
++    t1 = arg_info(op->args[1]);
-         if (watchpoint_address_matches(wp, addr, len)
++    t2 = arg_info(op->args[2]);
-             && (wp->flags & flags)) {
++    z_mask = t1->z_mask | t2->z_mask;
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
++    s_mask = t1->s_mask & t2->s_mask;
-index XXXXXXX..XXXXXXX 100644
++    return fold_masks_zs(ctx, op, z_mask, s_mask);
---- a/target/arm/cpu.c
+ }
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
+ static bool fold_bitsel_vec(OptContext *ctx, TCGOp *op)
  #if !defined(CONFIG_USER_ONLY)
      cc->tcg_ops.do_transaction_failed = arm_cpu_do_transaction_failed;
      cc->tcg_ops.do_unaligned_access = arm_cpu_do_unaligned_access;
 -    cc->adjust_watchpoint_address = arm_adjust_watchpoint_address;
 +    cc->tcg_ops.adjust_watchpoint_address = arm_adjust_watchpoint_address;
      cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
  #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
  #endif /* CONFIG_TCG */
 --
-.25.1
+.43.0

-[PULL 08/46] tcg/tci: Inline tci_write_reg32s into the only caller
+[PULL 49/72] tcg/optimize: Use finish_folding in fold_bitsel_vec
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c | 10 +---------
+ tcg/optimize.c | 2 +-
-file changed, 1 insertion(+), 9 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
+diff --git a/tcg/optimize.c b/tcg/optimize.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/tcg/optimize.c
-+++ b/tcg/tci.c
++++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@ tci_write_reg(tcg_target_ulong *regs, TCGReg index, tcg_target_ulong value)
+@@ -XXX,XX +XXX,XX @@ static bool fold_bitsel_vec(OptContext *ctx, TCGOp *op)
-     regs[index] = value;
+             return fold_orc(ctx, op);
          }
      }
 -    return false;
 +    return finish_folding(ctx, op);
  }
--#if TCG_TARGET_REG_BITS == 64
+ /* Propagate constants and copies, fold constant expressions. */
 -static void
 -tci_write_reg32s(tcg_target_ulong *regs, TCGReg index, int32_t value)
 -{
 -    tci_write_reg(regs, index, value);
 -}
 -#endif
 -
  static void tci_write_reg8(tcg_target_ulong *regs, TCGReg index, uint8_t value)
  {
      tci_write_reg(regs, index, value);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              t0 = *tb_ptr++;
              t1 = tci_read_r(regs, &tb_ptr);
              t2 = tci_read_s32(&tb_ptr);
 -            tci_write_reg32s(regs, t0, *(int32_t *)(t1 + t2));
 +            tci_write_reg(regs, t0, *(int32_t *)(t1 + t2));
              break;
          case INDEX_op_ld_i64:
              t0 = *tb_ptr++;
 --
-.25.1
+.43.0

-[PULL 38/46] cpu: move cc->transaction_failed to tcg_ops
+[PULL 50/72] tcg/optimize: Use finish_folding as default in tcg_optimize
-From: Claudio Fontana <cfontana@suse.de>
+All non-default cases now finish folding within each function.
 Do the same with the default case and assert it is done after.
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 [claudio: wrap target code around CONFIG_TCG and !CONFIG_USER_ONLY]
 avoiding its use in headers used by common_ss code (should be poisoned).
 Note: need to be careful with the use of CONFIG_USER_ONLY,
 Message-Id: <20210204163931.7358-11-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h     | 28 +++++++++++++---------------
+ tcg/optimize.c | 6 ++----
- hw/mips/jazz.c            |  9 +++++++--
+file changed, 2 insertions(+), 4 deletions(-)
  target/alpha/cpu.c        |  2 +-
  target/arm/cpu.c          |  4 ++--
  target/m68k/cpu.c         |  2 +-
  target/microblaze/cpu.c   |  2 +-
  target/mips/cpu.c         |  4 +++-
  target/riscv/cpu.c        |  2 +-
  target/riscv/cpu_helper.c |  2 +-
  target/sparc/cpu.c        |  2 +-
  target/xtensa/cpu.c       |  2 +-
  target/xtensa/helper.c    |  4 ++--
 files changed, 34 insertions(+), 29 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
+diff --git a/tcg/optimize.c b/tcg/optimize.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
+--- a/tcg/optimize.c
-+++ b/include/hw/core/cpu.h
++++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
+@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
-     /** @debug_excp_handler: Callback for handling debug exceptions */
+             done = true;
-     void (*debug_excp_handler)(CPUState *cpu);
+             break;
+         default:
-+    /**
++            done = finish_folding(&ctx, op);
-+     * @do_transaction_failed: Callback for handling failed memory transactions
+             break;
-+     * (ie bus faults or external aborts; not MMU faults)
+         }
 +     */
 +    void (*do_transaction_failed)(CPUState *cpu, hwaddr physaddr, vaddr addr,
 +                                  unsigned size, MMUAccessType access_type,
 +                                  int mmu_idx, MemTxAttrs attrs,
 +                                  MemTxResult response, uintptr_t retaddr);
  } TcgCpuOperations;
  /**
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
   * @has_work: Callback for checking if there is work to do.
   * @do_unaligned_access: Callback for unaligned access handling, if
   * the target defines #TARGET_ALIGNED_ONLY.
 - * @do_transaction_failed: Callback for handling failed memory transactions
 - * (ie bus faults or external aborts; not MMU faults)
   * @virtio_is_big_endian: Callback to return %true if a CPU which supports
   * runtime configurable endianness is currently big-endian. Non-configurable
   * CPUs can use the default implementation of this method. This method should
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
      void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
                                  MMUAccessType access_type,
                                  int mmu_idx, uintptr_t retaddr);
 -    void (*do_transaction_failed)(CPUState *cpu, hwaddr physaddr, vaddr addr,
 -                                  unsigned size, MMUAccessType access_type,
 -                                  int mmu_idx, MemTxAttrs attrs,
 -                                  MemTxResult response, uintptr_t retaddr);
      bool (*virtio_is_big_endian)(CPUState *cpu);
      int (*memory_rw_debug)(CPUState *cpu, vaddr addr,
                             uint8_t *buf, int len, bool is_write);
@@ -XXX,XX +XXX,XX @@ CPUState *cpu_by_arch_id(int64_t id);
  void cpu_interrupt(CPUState *cpu, int mask);
 -#ifdef NEED_CPU_H
 -
--#ifdef CONFIG_SOFTMMU
+-        if (!done) {
- static inline void cpu_unaligned_access(CPUState *cpu, vaddr addr,
+-            finish_folding(&ctx, op);
-                                         MMUAccessType access_type,
+-        }
-                                         int mmu_idx, uintptr_t retaddr)
++        tcg_debug_assert(done);
@@ -XXX,XX +XXX,XX @@ static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
  {
      CPUClass *cc = CPU_GET_CLASS(cpu);
 -    if (!cpu->ignore_memory_transaction_failures && cc->do_transaction_failed) {
 -        cc->do_transaction_failed(cpu, physaddr, addr, size, access_type,
 -                                  mmu_idx, attrs, response, retaddr);
 +    if (!cpu->ignore_memory_transaction_failures &&
 +        cc->tcg_ops.do_transaction_failed) {
 +        cc->tcg_ops.do_transaction_failed(cpu, physaddr, addr, size,
 +                                          access_type, mmu_idx, attrs,
 +                                          response, retaddr);
      }
  }
--#endif
--
--#endif /* NEED_CPU_H */
- /**
-  * cpu_set_pc:
-diff --git a/hw/mips/jazz.c b/hw/mips/jazz.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/mips/jazz.c
-+++ b/hw/mips/jazz.c
-@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps dma_dummy_ops = {
- #define MAGNUM_BIOS_SIZE_MAX 0x7e000
- #define MAGNUM_BIOS_SIZE                                                       \
-         (BIOS_SIZE < MAGNUM_BIOS_SIZE_MAX ? BIOS_SIZE : MAGNUM_BIOS_SIZE_MAX)
-+
-+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
- static void (*real_do_transaction_failed)(CPUState *cpu, hwaddr physaddr,
-                                           vaddr addr, unsigned size,
-                                           MMUAccessType access_type,
-@@ -XXX,XX +XXX,XX @@ static void mips_jazz_do_transaction_failed(CPUState *cs, hwaddr physaddr,
-     (*real_do_transaction_failed)(cs, physaddr, addr, size, access_type,
-                                   mmu_idx, attrs, response, retaddr);
- }
-+#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
- static void mips_jazz_init(MachineState *machine,
-                            enum jazz_model_e jazz_model)
-@@ -XXX,XX +XXX,XX @@ static void mips_jazz_init(MachineState *machine,
-      * memory region that catches all memory accesses, as we do on Malta.
-      */
-     cc = CPU_GET_CLASS(cpu);
--    real_do_transaction_failed = cc->do_transaction_failed;
--    cc->do_transaction_failed = mips_jazz_do_transaction_failed;
-+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
-+    real_do_transaction_failed = cc->tcg_ops.do_transaction_failed;
-+    cc->tcg_ops.do_transaction_failed = mips_jazz_do_transaction_failed;
-+#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
-     /* allocate RAM */
-     memory_region_add_subregion(address_space, 0, machine->ram);
-diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/alpha/cpu.c
-+++ b/target/alpha/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
-     cc->gdb_write_register = alpha_cpu_gdb_write_register;
-     cc->tcg_ops.tlb_fill = alpha_cpu_tlb_fill;
- #ifndef CONFIG_USER_ONLY
--    cc->do_transaction_failed = alpha_cpu_do_transaction_failed;
-+    cc->tcg_ops.do_transaction_failed = alpha_cpu_do_transaction_failed;
-     cc->do_unaligned_access = alpha_cpu_do_unaligned_access;
-     cc->get_phys_page_debug = alpha_cpu_get_phys_page_debug;
-     dc->vmsd = &vmstate_alpha_cpu;
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
-     cc->debug_check_watchpoint = arm_debug_check_watchpoint;
-     cc->do_unaligned_access = arm_cpu_do_unaligned_access;
- #if !defined(CONFIG_USER_ONLY)
--    cc->do_transaction_failed = arm_cpu_do_transaction_failed;
-+    cc->tcg_ops.do_transaction_failed = arm_cpu_do_transaction_failed;
-     cc->adjust_watchpoint_address = arm_adjust_watchpoint_address;
-     cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
- #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
--#endif
-+#endif /* CONFIG_TCG */
- }
- #ifdef CONFIG_KVM
-diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/m68k/cpu.c
-+++ b/target/m68k/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
-     cc->gdb_write_register = m68k_cpu_gdb_write_register;
-     cc->tcg_ops.tlb_fill = m68k_cpu_tlb_fill;
- #if defined(CONFIG_SOFTMMU)
--    cc->do_transaction_failed = m68k_cpu_transaction_failed;
-+    cc->tcg_ops.do_transaction_failed = m68k_cpu_transaction_failed;
-     cc->get_phys_page_debug = m68k_cpu_get_phys_page_debug;
-     dc->vmsd = &vmstate_m68k_cpu;
- #endif
-diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/microblaze/cpu.c
-+++ b/target/microblaze/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
-     cc->gdb_write_register = mb_cpu_gdb_write_register;
-     cc->tcg_ops.tlb_fill = mb_cpu_tlb_fill;
- #ifndef CONFIG_USER_ONLY
--    cc->do_transaction_failed = mb_cpu_transaction_failed;
-+    cc->tcg_ops.do_transaction_failed = mb_cpu_transaction_failed;
-     cc->get_phys_page_attrs_debug = mb_cpu_get_phys_page_attrs_debug;
-     dc->vmsd = &vmstate_mb_cpu;
- #endif
-diff --git a/target/mips/cpu.c b/target/mips/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/mips/cpu.c
-+++ b/target/mips/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
-     cc->gdb_read_register = mips_cpu_gdb_read_register;
-     cc->gdb_write_register = mips_cpu_gdb_write_register;
- #ifndef CONFIG_USER_ONLY
--    cc->do_transaction_failed = mips_cpu_do_transaction_failed;
-     cc->do_unaligned_access = mips_cpu_do_unaligned_access;
-     cc->get_phys_page_debug = mips_cpu_get_phys_page_debug;
-     cc->vmsd = &vmstate_mips_cpu;
-@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
-     cc->tcg_ops.cpu_exec_interrupt = mips_cpu_exec_interrupt;
-     cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
-     cc->tcg_ops.tlb_fill = mips_cpu_tlb_fill;
-+#ifndef CONFIG_USER_ONLY
-+    cc->tcg_ops.do_transaction_failed = mips_cpu_do_transaction_failed;
-+#endif /* CONFIG_USER_ONLY */
- #endif /* CONFIG_TCG */
-     cc->gdb_num_core_regs = 73;
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
-     cc->gdb_stop_before_watchpoint = true;
-     cc->disas_set_info = riscv_cpu_disas_set_info;
- #ifndef CONFIG_USER_ONLY
--    cc->do_transaction_failed = riscv_cpu_do_transaction_failed;
-+    cc->tcg_ops.do_transaction_failed = riscv_cpu_do_transaction_failed;
-     cc->do_unaligned_access = riscv_cpu_do_unaligned_access;
-     cc->get_phys_page_debug = riscv_cpu_get_phys_page_debug;
-     /* For now, mark unmigratable: */
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
-     env->badaddr = addr;
-     riscv_raise_exception(env, cs->exception_index, retaddr);
- }
--#endif
-+#endif /* !CONFIG_USER_ONLY */
- bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
-                         MMUAccessType access_type, int mmu_idx,
-diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/sparc/cpu.c
-+++ b/target/sparc/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
-     cc->gdb_write_register = sparc_cpu_gdb_write_register;
-     cc->tcg_ops.tlb_fill = sparc_cpu_tlb_fill;
- #ifndef CONFIG_USER_ONLY
--    cc->do_transaction_failed = sparc_cpu_do_transaction_failed;
-+    cc->tcg_ops.do_transaction_failed = sparc_cpu_do_transaction_failed;
-     cc->do_unaligned_access = sparc_cpu_do_unaligned_access;
-     cc->get_phys_page_debug = sparc_cpu_get_phys_page_debug;
-     cc->vmsd = &vmstate_sparc_cpu;
-diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/xtensa/cpu.c
-+++ b/target/xtensa/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
- #ifndef CONFIG_USER_ONLY
-     cc->do_unaligned_access = xtensa_cpu_do_unaligned_access;
-     cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
--    cc->do_transaction_failed = xtensa_cpu_do_transaction_failed;
-+    cc->tcg_ops.do_transaction_failed = xtensa_cpu_do_transaction_failed;
- #endif
-     cc->tcg_ops.debug_excp_handler = xtensa_breakpoint_handler;
-     cc->disas_set_info = xtensa_cpu_disas_set_info;
-diff --git a/target/xtensa/helper.c b/target/xtensa/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/xtensa/helper.c
-+++ b/target/xtensa/helper.c
-@@ -XXX,XX +XXX,XX @@ bool xtensa_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
-     cpu_loop_exit_restore(cs, retaddr);
- }
--#else
-+#else /* !CONFIG_USER_ONLY */
- void xtensa_cpu_do_unaligned_access(CPUState *cs,
-                                     vaddr addr, MMUAccessType access_type,
-@@ -XXX,XX +XXX,XX @@ void xtensa_runstall(CPUXtensaState *env, bool runstall)
-         qemu_cpu_kick(cpu);
-     }
- }
--#endif
-+#endif /* !CONFIG_USER_ONLY */
 --
-.25.1
+.43.0

-[PULL 19/46] tcg/tci: Merge INDEX_op_st16_{i32,i64}
+[PULL 51/72] tcg/optimize: Remove z_mask, s_mask from OptContext
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+All mask setting is now done with parameters via fold_masks_*.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c | 8 +-------
+ tcg/optimize.c | 13 -------------
-file changed, 1 insertion(+), 7 deletions(-)
+file changed, 13 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
+diff --git a/tcg/optimize.c b/tcg/optimize.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/tcg/optimize.c
-+++ b/tcg/tci.c
++++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+@@ -XXX,XX +XXX,XX @@ typedef struct OptContext {
-             t2 = tci_read_s32(&tb_ptr);
+     QSIMPLEQ_HEAD(, MemCopyInfo) mem_free;
-             *(uint8_t *)(t1 + t2) = t0;
-             break;
+     /* In flight values from optimization. */
--        case INDEX_op_st16_i32:
+-    uint64_t z_mask;  /* mask bit is 0 iff value bit is 0 */
-+        CASE_32_64(st16)
+-    uint64_t s_mask;  /* mask bit is 1 if value bit matches msb */
-             t0 = tci_read_r16(regs, &tb_ptr);
+     TCGType type;
-             t1 = tci_read_r(regs, &tb_ptr);
+ } OptContext;
-             t2 = tci_read_s32(&tb_ptr);
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+@@ -XXX,XX +XXX,XX @@ static bool finish_folding(OptContext *ctx, TCGOp *op)
-             t2 = tci_read_s32(&tb_ptr);
+     for (i = 0; i < nb_oargs; i++) {
-             tci_write_reg(regs, t0, *(uint64_t *)(t1 + t2));
+         TCGTemp *ts = arg_temp(op->args[i]);
-             break;
+         reset_ts(ctx, ts);
--        case INDEX_op_st16_i64:
+-        /*
--            t0 = tci_read_r16(regs, &tb_ptr);
+-         * Save the corresponding known-zero/sign bits mask for the
--            t1 = tci_read_r(regs, &tb_ptr);
+-         * first output argument (only one supported so far).
--            t2 = tci_read_s32(&tb_ptr);
+-         */
--            *(uint16_t *)(t1 + t2) = t0;
+-        if (i == 0) {
--            break;
+-            ts_info(ts)->z_mask = ctx->z_mask;
-         case INDEX_op_st32_i64:
+-        }
-             t0 = tci_read_r32(regs, &tb_ptr);
+     }
-             t1 = tci_read_r(regs, &tb_ptr);
+     return true;
  }
@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
              ctx.type = TCG_TYPE_I32;
          }
 -        /* Assume all bits affected, no bits known zero, no sign reps. */
 -        ctx.z_mask = -1;
 -        ctx.s_mask = 0;
 -
          /*
           * Process each opcode.
           * Sorted alphabetically by opcode as much as possible.
 --
-.25.1
+.43.0

-[PULL 04/46] configure: Fix --enable-tcg-interpreter
+[PULL 52/72] tcg/optimize: Re-enable sign-mask optimizations
-The configure option was backward, and we failed to
+All instances of s_mask have been converted to the new
-pass the value on to meson.
+representation.  We can now re-enable usage.
-Fixes: 23a77b2d18b ("build-system: clean up TCG/TCI configury")
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Tested-by: Stefan Weil <sw@weilnetz.de>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- configure | 5 +++--
+ tcg/optimize.c | 4 ++--
-file changed, 3 insertions(+), 2 deletions(-)
+file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/configure b/configure
+diff --git a/tcg/optimize.c b/tcg/optimize.c
-index XXXXXXX..XXXXXXX 100755
+index XXXXXXX..XXXXXXX 100644
---- a/configure
+--- a/tcg/optimize.c
-+++ b/configure
++++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@ for opt do
+@@ -XXX,XX +XXX,XX @@ static bool fold_exts(OptContext *ctx, TCGOp *op)
-   ;;
+         g_assert_not_reached();
-   --enable-whpx) whpx="enabled"
+     }
-   ;;
--  --disable-tcg-interpreter) tcg_interpreter="true"
+-    if (0 && !type_change && fold_affected_mask(ctx, op, s_mask & ~s_mask_old)) {
-+  --disable-tcg-interpreter) tcg_interpreter="false"
++    if (!type_change && fold_affected_mask(ctx, op, s_mask & ~s_mask_old)) {
-   ;;
+         return true;
--  --enable-tcg-interpreter) tcg_interpreter="false"
+     }
-+  --enable-tcg-interpreter) tcg_interpreter="true"
-   ;;
+@@ -XXX,XX +XXX,XX @@ static bool fold_sextract(OptContext *ctx, TCGOp *op)
-   --disable-cap-ng)  cap_ng="disabled"
+     s_mask = s_mask_old >> pos;
-   ;;
+     s_mask |= -1ull << (len - 1);
-@@ -XXX,XX +XXX,XX @@ NINJA=$ninja $meson setup \
-         -Dvhost_user_blk_server=$vhost_user_blk_server \
+-    if (0 && pos == 0 && fold_affected_mask(ctx, op, s_mask & ~s_mask_old)) {
-         -Dfuse=$fuse -Dfuse_lseek=$fuse_lseek -Dguest_agent_msi=$guest_agent_msi \
++    if (pos == 0 && fold_affected_mask(ctx, op, s_mask & ~s_mask_old)) {
-         $(if test "$default_features" = no; then echo "-Dauto_features=disabled"; fi) \
+         return true;
-+    -Dtcg_interpreter=$tcg_interpreter \
+     }
          $cross_arg \
          "$PWD" "$source_path"
 --
-.25.1
+.43.0

-[PULL 40/46] physmem: make watchpoint checking code TCG-only
+[PULL 53/72] tcg/optimize: Move fold_bitsel_vec into alphabetic sort
-From: Claudio Fontana <cfontana@suse.de>
+The big comment just above says functions should be sorted.
 Add forward declarations as needed.
-cpu_check_watchpoint, watchpoint_address_matches are TCG-only.
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-Id: <20210204163931.7358-13-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- softmmu/physmem.c | 141 +++++++++++++++++++++++-----------------------
+ tcg/optimize.c | 114 +++++++++++++++++++++++++------------------------
-file changed, 72 insertions(+), 69 deletions(-)
+file changed, 59 insertions(+), 55 deletions(-)
-diff --git a/softmmu/physmem.c b/softmmu/physmem.c
+diff --git a/tcg/optimize.c b/tcg/optimize.c
 index XXXXXXX..XXXXXXX 100644
---- a/softmmu/physmem.c
+--- a/tcg/optimize.c
-+++ b/softmmu/physmem.c
++++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@ void cpu_watchpoint_remove_all(CPUState *cpu, int mask)
+@@ -XXX,XX +XXX,XX @@ static bool fold_xx_to_x(OptContext *ctx, TCGOp *op)
-     }
+  *   3) those that produce information about the result value.
   */
 +static bool fold_or(OptContext *ctx, TCGOp *op);
 +static bool fold_orc(OptContext *ctx, TCGOp *op);
 +static bool fold_xor(OptContext *ctx, TCGOp *op);
 +
  static bool fold_add(OptContext *ctx, TCGOp *op)
  {
      if (fold_const2_commutative(ctx, op) ||
@@ -XXX,XX +XXX,XX @@ static bool fold_andc(OptContext *ctx, TCGOp *op)
      return fold_masks_zs(ctx, op, z_mask, s_mask);
  }
-+#ifdef CONFIG_TCG
++static bool fold_bitsel_vec(OptContext *ctx, TCGOp *op)
  /* Return true if this watchpoint address matches the specified
   * access (ie the address range covered by the watchpoint overlaps
   * partially or completely with the address range covered by the
@@ -XXX,XX +XXX,XX @@ int cpu_watchpoint_address_matches(CPUState *cpu, vaddr addr, vaddr len)
      return ret;
  }
 +/* Generate a debug exception if a watchpoint has been hit.  */
 +void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
 +                          MemTxAttrs attrs, int flags, uintptr_t ra)
 +{
-+    CPUClass *cc = CPU_GET_CLASS(cpu);
++    /* If true and false values are the same, eliminate the cmp. */
-+    CPUWatchpoint *wp;
++    if (args_are_copies(op->args[2], op->args[3])) {
-+
++        return tcg_opt_gen_mov(ctx, op, op->args[0], op->args[2]);
 +    assert(tcg_enabled());
 +    if (cpu->watchpoint_hit) {
 +        /*
 +         * We re-entered the check after replacing the TB.
 +         * Now raise the debug interrupt so that it will
 +         * trigger after the current instruction.
 +         */
 +        qemu_mutex_lock_iothread();
 +        cpu_interrupt(cpu, CPU_INTERRUPT_DEBUG);
 +        qemu_mutex_unlock_iothread();
 +        return;
 +    }
 +
-+    addr = cc->adjust_watchpoint_address(cpu, addr, len);
++    if (arg_is_const(op->args[2]) && arg_is_const(op->args[3])) {
-+    QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
++        uint64_t tv = arg_info(op->args[2])->val;
-+        if (watchpoint_address_matches(wp, addr, len)
++        uint64_t fv = arg_info(op->args[3])->val;
-+            && (wp->flags & flags)) {
++
-+            if (replay_running_debug()) {
++        if (tv == -1 && fv == 0) {
-+                /*
++            return tcg_opt_gen_mov(ctx, op, op->args[0], op->args[1]);
-+                 * Don't process the watchpoints when we are
++        }
-+                 * in a reverse debugging operation.
++        if (tv == 0 && fv == -1) {
-+                 */
++            if (TCG_TARGET_HAS_not_vec) {
-+                replay_breakpoint();
++                op->opc = INDEX_op_not_vec;
-+                return;
++                return fold_not(ctx, op);
 +            } else {
 +                op->opc = INDEX_op_xor_vec;
 +                op->args[2] = arg_new_constant(ctx, -1);
 +                return fold_xor(ctx, op);
 +            }
-+            if (flags == BP_MEM_READ) {
-+                wp->flags |= BP_WATCHPOINT_HIT_READ;
-+            } else {
-+                wp->flags |= BP_WATCHPOINT_HIT_WRITE;
-+            }
-+            wp->hitaddr = MAX(addr, wp->vaddr);
-+            wp->hitattrs = attrs;
-+            if (!cpu->watchpoint_hit) {
-+                if (wp->flags & BP_CPU &&
-+                    !cc->debug_check_watchpoint(cpu, wp)) {
-+                    wp->flags &= ~BP_WATCHPOINT_HIT;
-+                    continue;
-+                }
-+                cpu->watchpoint_hit = wp;
-+
-+                mmap_lock();
-+                tb_check_watchpoint(cpu, ra);
-+                if (wp->flags & BP_STOP_BEFORE_ACCESS) {
-+                    cpu->exception_index = EXCP_DEBUG;
-+                    mmap_unlock();
-+                    cpu_loop_exit_restore(cpu, ra);
-+                } else {
-+                    /* Force execution of one insn next time.  */
-+                    cpu->cflags_next_tb = 1 | curr_cflags();
-+                    mmap_unlock();
-+                    if (ra) {
-+                        cpu_restore_state(cpu, ra, true);
-+                    }
-+                    cpu_loop_exit_noexc(cpu);
-+                }
-+            }
-+        } else {
-+            wp->flags &= ~BP_WATCHPOINT_HIT;
 +        }
 +    }
++    if (arg_is_const(op->args[2])) {
++        uint64_t tv = arg_info(op->args[2])->val;
++        if (tv == -1) {
++            op->opc = INDEX_op_or_vec;
++            op->args[2] = op->args[3];
++            return fold_or(ctx, op);
++        }
++        if (tv == 0 && TCG_TARGET_HAS_andc_vec) {
++            op->opc = INDEX_op_andc_vec;
++            op->args[2] = op->args[1];
++            op->args[1] = op->args[3];
++            return fold_andc(ctx, op);
++        }
++    }
++    if (arg_is_const(op->args[3])) {
++        uint64_t fv = arg_info(op->args[3])->val;
++        if (fv == 0) {
++            op->opc = INDEX_op_and_vec;
++            return fold_and(ctx, op);
++        }
++        if (fv == -1 && TCG_TARGET_HAS_orc_vec) {
++            op->opc = INDEX_op_orc_vec;
++            op->args[2] = op->args[1];
++            op->args[1] = op->args[3];
++            return fold_orc(ctx, op);
++        }
++    }
++    return finish_folding(ctx, op);
 +}
 +
-+#endif /* CONFIG_TCG */
+ static bool fold_brcond(OptContext *ctx, TCGOp *op)
 +
  /* Called from RCU critical section */
  static RAMBlock *qemu_get_ram_block(ram_addr_t addr)
  {
-@@ -XXX,XX +XXX,XX @@ ram_addr_t qemu_ram_addr_from_host(void *ptr)
+     int i = do_constant_folding_cond1(ctx, op, NO_DEST, &op->args[0],
-     return block->offset + offset;
+@@ -XXX,XX +XXX,XX @@ static bool fold_xor(OptContext *ctx, TCGOp *op)
      return fold_masks_zs(ctx, op, z_mask, s_mask);
  }
--/* Generate a debug exception if a watchpoint has been hit.  */
+-static bool fold_bitsel_vec(OptContext *ctx, TCGOp *op)
 -void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
 -                          MemTxAttrs attrs, int flags, uintptr_t ra)
 -{
--    CPUClass *cc = CPU_GET_CLASS(cpu);
+-    /* If true and false values are the same, eliminate the cmp. */
--    CPUWatchpoint *wp;
+-    if (args_are_copies(op->args[2], op->args[3])) {
--
+-        return tcg_opt_gen_mov(ctx, op, op->args[0], op->args[2]);
 -    assert(tcg_enabled());
 -    if (cpu->watchpoint_hit) {
 -        /*
 -         * We re-entered the check after replacing the TB.
 -         * Now raise the debug interrupt so that it will
 -         * trigger after the current instruction.
 -         */
 -        qemu_mutex_lock_iothread();
 -        cpu_interrupt(cpu, CPU_INTERRUPT_DEBUG);
 -        qemu_mutex_unlock_iothread();
 -        return;
 -    }
 -
--    addr = cc->adjust_watchpoint_address(cpu, addr, len);
+-    if (arg_is_const(op->args[2]) && arg_is_const(op->args[3])) {
--    QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
+-        uint64_t tv = arg_info(op->args[2])->val;
--        if (watchpoint_address_matches(wp, addr, len)
+-        uint64_t fv = arg_info(op->args[3])->val;
--            && (wp->flags & flags)) {
+-
--            if (replay_running_debug()) {
+-        if (tv == -1 && fv == 0) {
--                /*
+-            return tcg_opt_gen_mov(ctx, op, op->args[0], op->args[1]);
--                 * Don't process the watchpoints when we are
+-        }
--                 * in a reverse debugging operation.
+-        if (tv == 0 && fv == -1) {
--                 */
+-            if (TCG_TARGET_HAS_not_vec) {
--                replay_breakpoint();
+-                op->opc = INDEX_op_not_vec;
--                return;
+-                return fold_not(ctx, op);
 -            } else {
 -                op->opc = INDEX_op_xor_vec;
 -                op->args[2] = arg_new_constant(ctx, -1);
 -                return fold_xor(ctx, op);
 -            }
--            if (flags == BP_MEM_READ) {
--                wp->flags |= BP_WATCHPOINT_HIT_READ;
--            } else {
--                wp->flags |= BP_WATCHPOINT_HIT_WRITE;
--            }
--            wp->hitaddr = MAX(addr, wp->vaddr);
--            wp->hitattrs = attrs;
--            if (!cpu->watchpoint_hit) {
--                if (wp->flags & BP_CPU &&
--                    !cc->debug_check_watchpoint(cpu, wp)) {
--                    wp->flags &= ~BP_WATCHPOINT_HIT;
--                    continue;
--                }
--                cpu->watchpoint_hit = wp;
--
--                mmap_lock();
--                tb_check_watchpoint(cpu, ra);
--                if (wp->flags & BP_STOP_BEFORE_ACCESS) {
--                    cpu->exception_index = EXCP_DEBUG;
--                    mmap_unlock();
--                    cpu_loop_exit_restore(cpu, ra);
--                } else {
--                    /* Force execution of one insn next time.  */
--                    cpu->cflags_next_tb = 1 | curr_cflags();
--                    mmap_unlock();
--                    if (ra) {
--                        cpu_restore_state(cpu, ra, true);
--                    }
--                    cpu_loop_exit_noexc(cpu);
--                }
--            }
--        } else {
--            wp->flags &= ~BP_WATCHPOINT_HIT;
 -        }
 -    }
+-    if (arg_is_const(op->args[2])) {
+-        uint64_t tv = arg_info(op->args[2])->val;
+-        if (tv == -1) {
+-            op->opc = INDEX_op_or_vec;
+-            op->args[2] = op->args[3];
+-            return fold_or(ctx, op);
+-        }
+-        if (tv == 0 && TCG_TARGET_HAS_andc_vec) {
+-            op->opc = INDEX_op_andc_vec;
+-            op->args[2] = op->args[1];
+-            op->args[1] = op->args[3];
+-            return fold_andc(ctx, op);
+-        }
+-    }
+-    if (arg_is_const(op->args[3])) {
+-        uint64_t fv = arg_info(op->args[3])->val;
+-        if (fv == 0) {
+-            op->opc = INDEX_op_and_vec;
+-            return fold_and(ctx, op);
+-        }
+-        if (fv == -1 && TCG_TARGET_HAS_orc_vec) {
+-            op->opc = INDEX_op_orc_vec;
+-            op->args[2] = op->args[1];
+-            op->args[1] = op->args[3];
+-            return fold_orc(ctx, op);
+-        }
+-    }
+-    return finish_folding(ctx, op);
 -}
 -
- static MemTxResult flatview_read(FlatView *fv, hwaddr addr,
+ /* Propagate constants and copies, fold constant expressions. */
-                                  MemTxAttrs attrs, void *buf, hwaddr len);
+ void tcg_optimize(TCGContext *s)
- static MemTxResult flatview_write(FlatView *fv, hwaddr addr, MemTxAttrs attrs,
+ {
 --
-.25.1
+.43.0

-[PULL 44/46] accel: extend AccelState and AccelClass to user-mode
+[PULL 54/72] tcg/optimize: Move fold_cmp_vec, fold_cmpsel_vec into alphabetic sort
-From: Claudio Fontana <cfontana@suse.de>
+The big comment just above says functions should be sorted.
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 [claudio: rebased on Richard's splitwx work]
 Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Message-Id: <20210204163931.7358-17-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/boards.h                |  2 +-
+ tcg/optimize.c | 60 +++++++++++++++++++++++++-------------------------
- include/{sysemu => qemu}/accel.h   | 14 +++++----
+file changed, 30 insertions(+), 30 deletions(-)
  include/sysemu/hvf.h               |  2 +-
  include/sysemu/kvm.h               |  2 +-
  include/sysemu/kvm_int.h           |  2 +-
  target/i386/hvf/hvf-i386.h         |  2 +-
  accel/accel-common.c               | 50 ++++++++++++++++++++++++++++++
  accel/{accel.c => accel-softmmu.c} | 27 ++--------------
  accel/accel-user.c                 | 24 ++++++++++++++
  accel/qtest/qtest.c                |  2 +-
  accel/tcg/tcg-all.c                | 15 +++++++--
  accel/xen/xen-all.c                |  2 +-
  bsd-user/main.c                    |  6 +++-
  linux-user/main.c                  |  6 +++-
  softmmu/memory.c                   |  2 +-
  softmmu/qtest.c                    |  2 +-
  softmmu/vl.c                       |  2 +-
  target/i386/hax/hax-all.c          |  2 +-
  target/i386/hvf/hvf.c              |  2 +-
  target/i386/hvf/x86_task.c         |  2 +-
  target/i386/whpx/whpx-all.c        |  2 +-
  MAINTAINERS                        |  2 +-
  accel/meson.build                  |  4 ++-
  accel/tcg/meson.build              |  2 +-
 files changed, 125 insertions(+), 53 deletions(-)
  rename include/{sysemu => qemu}/accel.h (95%)
  create mode 100644 accel/accel-common.c
  rename accel/{accel.c => accel-softmmu.c} (75%)
  create mode 100644 accel/accel-user.c
-diff --git a/include/hw/boards.h b/include/hw/boards.h
+diff --git a/tcg/optimize.c b/tcg/optimize.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/boards.h
+--- a/tcg/optimize.c
-+++ b/include/hw/boards.h
++++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static bool fold_call(OptContext *ctx, TCGOp *op)
- #include "exec/memory.h"
+     return true;
- #include "sysemu/hostmem.h"
+ }
- #include "sysemu/blockdev.h"
--#include "sysemu/accel.h"
++static bool fold_cmp_vec(OptContext *ctx, TCGOp *op)
 +#include "qemu/accel.h"
  #include "qapi/qapi-types-machine.h"
  #include "qemu/module.h"
  #include "qom/object.h"
 diff --git a/include/sysemu/accel.h b/include/qemu/accel.h
 similarity index 95%
 rename from include/sysemu/accel.h
 rename to include/qemu/accel.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/sysemu/accel.h
 +++ b/include/qemu/accel.h
@@ -XXX,XX +XXX,XX @@
   * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
   * THE SOFTWARE.
   */
 -#ifndef HW_ACCEL_H
 -#define HW_ACCEL_H
 +#ifndef QEMU_ACCEL_H
 +#define QEMU_ACCEL_H
  #include "qom/object.h"
  #include "exec/hwaddr.h"
@@ -XXX,XX +XXX,XX @@ typedef struct AccelClass {
      /*< public >*/
      const char *name;
 -#ifndef CONFIG_USER_ONLY
      int (*init_machine)(MachineState *ms);
 +#ifndef CONFIG_USER_ONLY
      void (*setup_post)(MachineState *ms, AccelState *accel);
      bool (*has_memory)(MachineState *ms, AddressSpace *as,
                         hwaddr start_addr, hwaddr size);
@@ -XXX,XX +XXX,XX @@ typedef struct AccelClass {
      OBJECT_GET_CLASS(AccelClass, (obj), TYPE_ACCEL)
  AccelClass *accel_find(const char *opt_name);
 +AccelState *current_accel(void);
 +
 +#ifndef CONFIG_USER_ONLY
  int accel_init_machine(AccelState *accel, MachineState *ms);
  /* Called just before os_setup_post (ie just before drop OS privs) */
  void accel_setup_post(MachineState *ms);
 +#endif /* !CONFIG_USER_ONLY */
 -AccelState *current_accel(void);
 -
 -#endif
 +#endif /* QEMU_ACCEL_H */
 diff --git a/include/sysemu/hvf.h b/include/sysemu/hvf.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/sysemu/hvf.h
 +++ b/include/sysemu/hvf.h
@@ -XXX,XX +XXX,XX @@
  #ifndef HVF_H
  #define HVF_H
 -#include "sysemu/accel.h"
 +#include "qemu/accel.h"
  #include "qom/object.h"
  #ifdef CONFIG_HVF
 diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/sysemu/kvm.h
 +++ b/include/sysemu/kvm.h
@@ -XXX,XX +XXX,XX @@
  #include "qemu/queue.h"
  #include "hw/core/cpu.h"
  #include "exec/memattrs.h"
 -#include "sysemu/accel.h"
 +#include "qemu/accel.h"
  #include "qom/object.h"
  #ifdef NEED_CPU_H
 diff --git a/include/sysemu/kvm_int.h b/include/sysemu/kvm_int.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/sysemu/kvm_int.h
 +++ b/include/sysemu/kvm_int.h
@@ -XXX,XX +XXX,XX @@
  #define QEMU_KVM_INT_H
  #include "exec/memory.h"
 -#include "sysemu/accel.h"
 +#include "qemu/accel.h"
  #include "sysemu/kvm.h"
  typedef struct KVMSlot
 diff --git a/target/i386/hvf/hvf-i386.h b/target/i386/hvf/hvf-i386.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hvf/hvf-i386.h
 +++ b/target/i386/hvf/hvf-i386.h
@@ -XXX,XX +XXX,XX @@
  #ifndef HVF_I386_H
  #define HVF_I386_H
 -#include "sysemu/accel.h"
 +#include "qemu/accel.h"
  #include "sysemu/hvf.h"
  #include "cpu.h"
  #include "x86.h"
 diff --git a/accel/accel-common.c b/accel/accel-common.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/accel/accel-common.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * QEMU accel class, components common to system emulation and user mode
 + *
 + * Copyright (c) 2003-2008 Fabrice Bellard
 + * Copyright (c) 2014 Red Hat Inc.
 + *
 + * Permission is hereby granted, free of charge, to any person obtaining a copy
 + * of this software and associated documentation files (the "Software"), to deal
 + * in the Software without restriction, including without limitation the rights
 + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 + * copies of the Software, and to permit persons to whom the Software is
 + * furnished to do so, subject to the following conditions:
 + *
 + * The above copyright notice and this permission notice shall be included in
 + * all copies or substantial portions of the Software.
 + *
 + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 + * THE SOFTWARE.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/accel.h"
 +
 +static const TypeInfo accel_type = {
 +    .name = TYPE_ACCEL,
 +    .parent = TYPE_OBJECT,
 +    .class_size = sizeof(AccelClass),
 +    .instance_size = sizeof(AccelState),
 +};
 +
 +/* Lookup AccelClass from opt_name. Returns NULL if not found */
 +AccelClass *accel_find(const char *opt_name)
 +{
-+    char *class_name = g_strdup_printf(ACCEL_CLASS_NAME("%s"), opt_name);
++    /* Canonicalize the comparison to put immediate second. */
-+    AccelClass *ac = ACCEL_CLASS(object_class_by_name(class_name));
++    if (swap_commutative(NO_DEST, &op->args[1], &op->args[2])) {
-+    g_free(class_name);
++        op->args[3] = tcg_swap_cond(op->args[3]);
-+    return ac;
++    }
 +    return finish_folding(ctx, op);
 +}
 +
-+static void register_accel_types(void)
++static bool fold_cmpsel_vec(OptContext *ctx, TCGOp *op)
 +{
-+    type_register_static(&accel_type);
++    /* If true and false values are the same, eliminate the cmp. */
 +    if (args_are_copies(op->args[3], op->args[4])) {
 +        return tcg_opt_gen_mov(ctx, op, op->args[0], op->args[3]);
 +    }
 +
 +    /* Canonicalize the comparison to put immediate second. */
 +    if (swap_commutative(NO_DEST, &op->args[1], &op->args[2])) {
 +        op->args[5] = tcg_swap_cond(op->args[5]);
 +    }
 +    /*
 +     * Canonicalize the "false" input reg to match the destination,
 +     * so that the tcg backend can implement "move if true".
 +     */
 +    if (swap_commutative(op->args[0], &op->args[4], &op->args[3])) {
 +        op->args[5] = tcg_invert_cond(op->args[5]);
 +    }
 +    return finish_folding(ctx, op);
 +}
 +
-+type_init(register_accel_types);
+ static bool fold_count_zeros(OptContext *ctx, TCGOp *op)
-diff --git a/accel/accel.c b/accel/accel-softmmu.c
+ {
-similarity index 75%
+     uint64_t z_mask, s_mask;
-rename from accel/accel.c
+@@ -XXX,XX +XXX,XX @@ static bool fold_setcond2(OptContext *ctx, TCGOp *op)
-rename to accel/accel-softmmu.c
+     return tcg_opt_gen_movi(ctx, op, op->args[0], i);
-index XXXXXXX..XXXXXXX 100644
+ }
---- a/accel/accel.c
-+++ b/accel/accel-softmmu.c
+-static bool fold_cmp_vec(OptContext *ctx, TCGOp *op)
@@ -XXX,XX +XXX,XX @@
  /*
 - * QEMU System Emulator, accelerator interfaces
 + * QEMU accel class, system emulation components
   *
   * Copyright (c) 2003-2008 Fabrice Bellard
   * Copyright (c) 2014 Red Hat Inc.
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
 -#include "sysemu/accel.h"
 +#include "qemu/accel.h"
  #include "hw/boards.h"
  #include "sysemu/arch_init.h"
  #include "sysemu/sysemu.h"
  #include "qom/object.h"
 -static const TypeInfo accel_type = {
 -    .name = TYPE_ACCEL,
 -    .parent = TYPE_OBJECT,
 -    .class_size = sizeof(AccelClass),
 -    .instance_size = sizeof(AccelState),
 -};
 -
 -/* Lookup AccelClass from opt_name. Returns NULL if not found */
 -AccelClass *accel_find(const char *opt_name)
 -{
--    char *class_name = g_strdup_printf(ACCEL_CLASS_NAME("%s"), opt_name);
+-    /* Canonicalize the comparison to put immediate second. */
--    AccelClass *ac = ACCEL_CLASS(object_class_by_name(class_name));
+-    if (swap_commutative(NO_DEST, &op->args[1], &op->args[2])) {
--    g_free(class_name);
+-        op->args[3] = tcg_swap_cond(op->args[3]);
--    return ac;
+-    }
 -    return finish_folding(ctx, op);
 -}
 -
- int accel_init_machine(AccelState *accel, MachineState *ms)
+-static bool fold_cmpsel_vec(OptContext *ctx, TCGOp *op)
- {
+-{
-     AccelClass *acc = ACCEL_GET_CLASS(accel);
+-    /* If true and false values are the same, eliminate the cmp. */
-@@ -XXX,XX +XXX,XX @@ void accel_setup_post(MachineState *ms)
+-    if (args_are_copies(op->args[3], op->args[4])) {
-         acc->setup_post(ms, accel);
+-        return tcg_opt_gen_mov(ctx, op, op->args[0], op->args[3]);
-     }
+-    }
  }
 -
--static void register_accel_types(void)
+-    /* Canonicalize the comparison to put immediate second. */
--{
+-    if (swap_commutative(NO_DEST, &op->args[1], &op->args[2])) {
--    type_register_static(&accel_type);
+-        op->args[5] = tcg_swap_cond(op->args[5]);
 -    }
 -    /*
 -     * Canonicalize the "false" input reg to match the destination,
 -     * so that the tcg backend can implement "move if true".
 -     */
 -    if (swap_commutative(op->args[0], &op->args[4], &op->args[3])) {
 -        op->args[5] = tcg_invert_cond(op->args[5]);
 -    }
 -    return finish_folding(ctx, op);
 -}
 -
--type_init(register_accel_types);
+ static bool fold_sextract(OptContext *ctx, TCGOp *op)
-diff --git a/accel/accel-user.c b/accel/accel-user.c
+ {
-new file mode 100644
+     uint64_t z_mask, s_mask, s_mask_old;
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/accel/accel-user.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * QEMU accel class, user-mode components
 + *
 + * Copyright 2021 SUSE LLC
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/accel.h"
 +
 +AccelState *current_accel(void)
 +{
 +    static AccelState *accel;
 +
 +    if (!accel) {
 +        AccelClass *ac = accel_find("tcg");
 +
 +        g_assert(ac != NULL);
 +        accel = ACCEL(object_new_with_class(OBJECT_CLASS(ac)));
 +    }
 +    return accel;
 +}
 diff --git a/accel/qtest/qtest.c b/accel/qtest/qtest.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/qtest/qtest.c
 +++ b/accel/qtest/qtest.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/module.h"
  #include "qemu/option.h"
  #include "qemu/config-file.h"
 -#include "sysemu/accel.h"
 +#include "qemu/accel.h"
  #include "sysemu/qtest.h"
  #include "sysemu/cpus.h"
  #include "sysemu/cpu-timers.h"
 diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/tcg-all.c
 +++ b/accel/tcg/tcg-all.c
@@ -XXX,XX +XXX,XX @@
  #include "tcg/tcg.h"
  #include "qapi/error.h"
  #include "qemu/error-report.h"
 -#include "hw/boards.h"
 +#include "qemu/accel.h"
  #include "qapi/qapi-builtin-visit.h"
 +
 +#ifndef CONFIG_USER_ONLY
  #include "tcg-cpus.h"
 +#endif /* CONFIG_USER_ONLY */
  struct TCGState {
      AccelState parent_obj;
@@ -XXX,XX +XXX,XX @@ static void tcg_accel_instance_init(Object *obj)
      s->mttcg_enabled = default_mttcg_enabled();
      /* If debugging enabled, default "auto on", otherwise off. */
 -#ifdef CONFIG_DEBUG_TCG
 +#if defined(CONFIG_DEBUG_TCG) && !defined(CONFIG_USER_ONLY)
      s->splitwx_enabled = -1;
  #else
      s->splitwx_enabled = 0;
@@ -XXX,XX +XXX,XX @@ static int tcg_init(MachineState *ms)
      mttcg_enabled = s->mttcg_enabled;
      /*
 -     * Initialize TCG regions
 +     * Initialize TCG regions only for softmmu.
 +     *
 +     * This needs to be done later for user mode, because the prologue
 +     * generation needs to be delayed so that GUEST_BASE is already set.
       */
 +#ifndef CONFIG_USER_ONLY
      tcg_region_init();
      if (mttcg_enabled) {
@@ -XXX,XX +XXX,XX @@ static int tcg_init(MachineState *ms)
      } else {
          cpus_register_accel(&tcg_cpus_rr);
      }
 +#endif /* !CONFIG_USER_ONLY */
 +
      return 0;
  }
 diff --git a/accel/xen/xen-all.c b/accel/xen/xen-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/xen/xen-all.c
 +++ b/accel/xen/xen-all.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/xen/xen-legacy-backend.h"
  #include "hw/xen/xen_pt.h"
  #include "chardev/char.h"
 -#include "sysemu/accel.h"
 +#include "qemu/accel.h"
  #include "sysemu/cpus.h"
  #include "sysemu/xen.h"
  #include "sysemu/runstate.h"
 diff --git a/bsd-user/main.c b/bsd-user/main.c
 index XXXXXXX..XXXXXXX 100644
 --- a/bsd-user/main.c
 +++ b/bsd-user/main.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qemu-common.h"
  #include "qemu/units.h"
 +#include "qemu/accel.h"
  #include "sysemu/tcg.h"
  #include "qemu-version.h"
  #include <machine/trap.h>
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
      }
      /* init tcg before creating CPUs and to get qemu_host_page_size */
 -    tcg_exec_init(0, false);
 +    {
 +        AccelClass *ac = ACCEL_GET_CLASS(current_accel());
 +        ac->init_machine(NULL);
 +    }
      cpu_type = parse_cpu_option(cpu_model);
      cpu = cpu_create(cpu_type);
      env = cpu->env_ptr;
 diff --git a/linux-user/main.c b/linux-user/main.c
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/main.c
 +++ b/linux-user/main.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qemu-common.h"
  #include "qemu/units.h"
 +#include "qemu/accel.h"
  #include "sysemu/tcg.h"
  #include "qemu-version.h"
  #include <sys/syscall.h>
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp)
      cpu_type = parse_cpu_option(cpu_model);
      /* init tcg before creating CPUs and to get qemu_host_page_size */
 -    tcg_exec_init(0, false);
 +    {
 +        AccelClass *ac = ACCEL_GET_CLASS(current_accel());
 +        ac->init_machine(NULL);
 +    }
      cpu = cpu_create(cpu_type);
      env = cpu->env_ptr;
      cpu_reset(cpu);
 diff --git a/softmmu/memory.c b/softmmu/memory.c
 index XXXXXXX..XXXXXXX 100644
 --- a/softmmu/memory.c
 +++ b/softmmu/memory.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/kvm.h"
  #include "sysemu/runstate.h"
  #include "sysemu/tcg.h"
 -#include "sysemu/accel.h"
 +#include "qemu/accel.h"
  #include "hw/boards.h"
  #include "migration/vmstate.h"
 diff --git a/softmmu/qtest.c b/softmmu/qtest.c
 index XXXXXXX..XXXXXXX 100644
 --- a/softmmu/qtest.c
 +++ b/softmmu/qtest.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/ioport.h"
  #include "exec/memory.h"
  #include "hw/irq.h"
 -#include "sysemu/accel.h"
 +#include "qemu/accel.h"
  #include "sysemu/cpu-timers.h"
  #include "qemu/config-file.h"
  #include "qemu/option.h"
 diff --git a/softmmu/vl.c b/softmmu/vl.c
 index XXXXXXX..XXXXXXX 100644
 --- a/softmmu/vl.c
 +++ b/softmmu/vl.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/error-report.h"
  #include "qemu/sockets.h"
 -#include "sysemu/accel.h"
 +#include "qemu/accel.h"
  #include "hw/usb.h"
  #include "hw/isa/isa.h"
  #include "hw/scsi/scsi.h"
 diff --git a/target/i386/hax/hax-all.c b/target/i386/hax/hax-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hax/hax-all.c
 +++ b/target/i386/hax/hax-all.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/address-spaces.h"
  #include "qemu-common.h"
 -#include "sysemu/accel.h"
 +#include "qemu/accel.h"
  #include "sysemu/reset.h"
  #include "sysemu/runstate.h"
  #include "hw/boards.h"
 diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hvf/hvf.c
 +++ b/target/i386/hvf/hvf.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/address-spaces.h"
  #include "hw/i386/apic_internal.h"
  #include "qemu/main-loop.h"
 -#include "sysemu/accel.h"
 +#include "qemu/accel.h"
  #include "target/i386/cpu.h"
  #include "hvf-cpus.h"
 diff --git a/target/i386/hvf/x86_task.c b/target/i386/hvf/x86_task.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hvf/x86_task.c
 +++ b/target/i386/hvf/x86_task.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/i386/apic_internal.h"
  #include "qemu/main-loop.h"
 -#include "sysemu/accel.h"
 +#include "qemu/accel.h"
  #include "target/i386/cpu.h"
  // TODO: taskswitch handling
 diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/whpx/whpx-all.c
 +++ b/target/i386/whpx/whpx-all.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/address-spaces.h"
  #include "exec/ioport.h"
  #include "qemu-common.h"
 -#include "sysemu/accel.h"
 +#include "qemu/accel.h"
  #include "sysemu/whpx.h"
  #include "sysemu/cpus.h"
  #include "sysemu/runstate.h"
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ Overall
  M: Richard Henderson <richard.henderson@linaro.org>
  R: Paolo Bonzini <pbonzini@redhat.com>
  S: Maintained
 -F: include/sysemu/accel.h
 +F: include/qemu/accel.h
  F: accel/accel.c
  F: accel/Makefile.objs
  F: accel/stubs/Makefile.objs
 diff --git a/accel/meson.build b/accel/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/meson.build
 +++ b/accel/meson.build
@@ -XXX,XX +XXX,XX @@
 -softmmu_ss.add(files('accel.c'))
 +specific_ss.add(files('accel-common.c'))
 +softmmu_ss.add(files('accel-softmmu.c'))
 +user_ss.add(files('accel-user.c'))
  subdir('qtest')
  subdir('kvm')
 diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/meson.build
 +++ b/accel/tcg/meson.build
@@ -XXX,XX +XXX,XX @@
  tcg_ss = ss.source_set()
  tcg_ss.add(files(
 +  'tcg-all.c',
    'cpu-exec-common.c',
    'cpu-exec.c',
    'tcg-runtime-gvec.c',
@@ -XXX,XX +XXX,XX @@ tcg_ss.add(when: 'CONFIG_PLUGIN', if_true: [files('plugin-gen.c'), libdl])
  specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_ss)
  specific_ss.add(when: ['CONFIG_SOFTMMU', 'CONFIG_TCG'], if_true: files(
 -  'tcg-all.c',
    'cputlb.c',
    'tcg-cpus.c',
    'tcg-cpus-mttcg.c',
 --
-.25.1
+.43.0

-[PULL 18/46] tcg/tci: Merge INDEX_op_st8_{i32,i64}
+[PULL 55/72] softfloat: Add float{16,32,64}_muladd_scalbn
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+We currently have a flag, float_muladd_halve_result, to scale
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+the result by 2**-1.  Extend this to handle arbitrary scaling.
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c | 8 +-------
+ include/fpu/softfloat.h   |  6 ++++
-file changed, 1 insertion(+), 7 deletions(-)
+ fpu/softfloat.c           | 58 ++++++++++++++++++++++-----------------
+ fpu/softfloat-parts.c.inc |  7 +++--
-diff --git a/tcg/tci.c b/tcg/tci.c
+files changed, 44 insertions(+), 27 deletions(-)
 diff --git a/include/fpu/softfloat.h b/include/fpu/softfloat.h
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/include/fpu/softfloat.h
-+++ b/tcg/tci.c
++++ b/include/fpu/softfloat.h
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+@@ -XXX,XX +XXX,XX @@ float16 float16_add(float16, float16, float_status *status);
-             t2 = tci_read_s32(&tb_ptr);
+ float16 float16_sub(float16, float16, float_status *status);
-             tci_write_reg(regs, t0, *(uint32_t *)(t1 + t2));
+ float16 float16_mul(float16, float16, float_status *status);
-             break;
+ float16 float16_muladd(float16, float16, float16, int, float_status *status);
--        case INDEX_op_st8_i32:
++float16 float16_muladd_scalbn(float16, float16, float16,
-+        CASE_32_64(st8)
++                              int, int, float_status *status);
-             t0 = tci_read_r8(regs, &tb_ptr);
+ float16 float16_div(float16, float16, float_status *status);
-             t1 = tci_read_r(regs, &tb_ptr);
+ float16 float16_scalbn(float16, int, float_status *status);
-             t2 = tci_read_s32(&tb_ptr);
+ float16 float16_min(float16, float16, float_status *status);
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+@@ -XXX,XX +XXX,XX @@ float32 float32_mul(float32, float32, float_status *status);
-             t2 = tci_read_s32(&tb_ptr);
+ float32 float32_div(float32, float32, float_status *status);
-             tci_write_reg(regs, t0, *(uint64_t *)(t1 + t2));
+ float32 float32_rem(float32, float32, float_status *status);
-             break;
+ float32 float32_muladd(float32, float32, float32, int, float_status *status);
--        case INDEX_op_st8_i64:
++float32 float32_muladd_scalbn(float32, float32, float32,
--            t0 = tci_read_r8(regs, &tb_ptr);
++                              int, int, float_status *status);
--            t1 = tci_read_r(regs, &tb_ptr);
+ float32 float32_sqrt(float32, float_status *status);
--            t2 = tci_read_s32(&tb_ptr);
+ float32 float32_exp2(float32, float_status *status);
--            *(uint8_t *)(t1 + t2) = t0;
+ float32 float32_log2(float32, float_status *status);
--            break;
+@@ -XXX,XX +XXX,XX @@ float64 float64_mul(float64, float64, float_status *status);
-         case INDEX_op_st16_i64:
+ float64 float64_div(float64, float64, float_status *status);
-             t0 = tci_read_r16(regs, &tb_ptr);
+ float64 float64_rem(float64, float64, float_status *status);
-             t1 = tci_read_r(regs, &tb_ptr);
+ float64 float64_muladd(float64, float64, float64, int, float_status *status);
 +float64 float64_muladd_scalbn(float64, float64, float64,
 +                              int, int, float_status *status);
  float64 float64_sqrt(float64, float_status *status);
  float64 float64_log2(float64, float_status *status);
  FloatRelation float64_compare(float64, float64, float_status *status);
 diff --git a/fpu/softfloat.c b/fpu/softfloat.c
 index XXXXXXX..XXXXXXX 100644
 --- a/fpu/softfloat.c
 +++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ static FloatParts128 *parts128_mul(FloatParts128 *a, FloatParts128 *b,
  #define parts_mul(A, B, S) \
      PARTS_GENERIC_64_128(mul, A)(A, B, S)
 -static FloatParts64 *parts64_muladd(FloatParts64 *a, FloatParts64 *b,
 -                                    FloatParts64 *c, int flags,
 -                                    float_status *s);
 -static FloatParts128 *parts128_muladd(FloatParts128 *a, FloatParts128 *b,
 -                                      FloatParts128 *c, int flags,
 -                                      float_status *s);
 +static FloatParts64 *parts64_muladd_scalbn(FloatParts64 *a, FloatParts64 *b,
 +                                           FloatParts64 *c, int scale,
 +                                           int flags, float_status *s);
 +static FloatParts128 *parts128_muladd_scalbn(FloatParts128 *a, FloatParts128 *b,
 +                                             FloatParts128 *c, int scale,
 +                                             int flags, float_status *s);
 -#define parts_muladd(A, B, C, Z, S) \
 -    PARTS_GENERIC_64_128(muladd, A)(A, B, C, Z, S)
 +#define parts_muladd_scalbn(A, B, C, Z, Y, S) \
 +    PARTS_GENERIC_64_128(muladd_scalbn, A)(A, B, C, Z, Y, S)
  static FloatParts64 *parts64_div(FloatParts64 *a, FloatParts64 *b,
                                   float_status *s);
@@ -XXX,XX +XXX,XX @@ floatx80_mul(floatx80 a, floatx80 b, float_status *status)
   * Fused multiply-add
   */
 -float16 QEMU_FLATTEN float16_muladd(float16 a, float16 b, float16 c,
 -                                    int flags, float_status *status)
 +float16 QEMU_FLATTEN
 +float16_muladd_scalbn(float16 a, float16 b, float16 c,
 +                      int scale, int flags, float_status *status)
  {
      FloatParts64 pa, pb, pc, *pr;
      float16_unpack_canonical(&pa, a, status);
      float16_unpack_canonical(&pb, b, status);
      float16_unpack_canonical(&pc, c, status);
 -    pr = parts_muladd(&pa, &pb, &pc, flags, status);
 +    pr = parts_muladd_scalbn(&pa, &pb, &pc, scale, flags, status);
      return float16_round_pack_canonical(pr, status);
  }
 -static float32 QEMU_SOFTFLOAT_ATTR
 -soft_f32_muladd(float32 a, float32 b, float32 c, int flags,
 -                float_status *status)
 +float16 float16_muladd(float16 a, float16 b, float16 c,
 +                       int flags, float_status *status)
 +{
 +    return float16_muladd_scalbn(a, b, c, 0, flags, status);
 +}
 +
 +float32 QEMU_SOFTFLOAT_ATTR
 +float32_muladd_scalbn(float32 a, float32 b, float32 c,
 +                      int scale, int flags, float_status *status)
  {
      FloatParts64 pa, pb, pc, *pr;
      float32_unpack_canonical(&pa, a, status);
      float32_unpack_canonical(&pb, b, status);
      float32_unpack_canonical(&pc, c, status);
 -    pr = parts_muladd(&pa, &pb, &pc, flags, status);
 +    pr = parts_muladd_scalbn(&pa, &pb, &pc, scale, flags, status);
      return float32_round_pack_canonical(pr, status);
  }
 -static float64 QEMU_SOFTFLOAT_ATTR
 -soft_f64_muladd(float64 a, float64 b, float64 c, int flags,
 -                float_status *status)
 +float64 QEMU_SOFTFLOAT_ATTR
 +float64_muladd_scalbn(float64 a, float64 b, float64 c,
 +                      int scale, int flags, float_status *status)
  {
      FloatParts64 pa, pb, pc, *pr;
      float64_unpack_canonical(&pa, a, status);
      float64_unpack_canonical(&pb, b, status);
      float64_unpack_canonical(&pc, c, status);
 -    pr = parts_muladd(&pa, &pb, &pc, flags, status);
 +    pr = parts_muladd_scalbn(&pa, &pb, &pc, scale, flags, status);
      return float64_round_pack_canonical(pr, status);
  }
@@ -XXX,XX +XXX,XX @@ float32_muladd(float32 xa, float32 xb, float32 xc, int flags, float_status *s)
      return ur.s;
   soft:
 -    return soft_f32_muladd(ua.s, ub.s, uc.s, flags, s);
 +    return float32_muladd_scalbn(ua.s, ub.s, uc.s, 0, flags, s);
  }
  float64 QEMU_FLATTEN
@@ -XXX,XX +XXX,XX @@ float64_muladd(float64 xa, float64 xb, float64 xc, int flags, float_status *s)
      return ur.s;
   soft:
 -    return soft_f64_muladd(ua.s, ub.s, uc.s, flags, s);
 +    return float64_muladd_scalbn(ua.s, ub.s, uc.s, 0, flags, s);
  }
  float64 float64r32_muladd(float64 a, float64 b, float64 c,
@@ -XXX,XX +XXX,XX @@ float64 float64r32_muladd(float64 a, float64 b, float64 c,
      float64_unpack_canonical(&pa, a, status);
      float64_unpack_canonical(&pb, b, status);
      float64_unpack_canonical(&pc, c, status);
 -    pr = parts_muladd(&pa, &pb, &pc, flags, status);
 +    pr = parts_muladd_scalbn(&pa, &pb, &pc, 0, flags, status);
      return float64r32_round_pack_canonical(pr, status);
  }
@@ -XXX,XX +XXX,XX @@ bfloat16 QEMU_FLATTEN bfloat16_muladd(bfloat16 a, bfloat16 b, bfloat16 c,
      bfloat16_unpack_canonical(&pa, a, status);
      bfloat16_unpack_canonical(&pb, b, status);
      bfloat16_unpack_canonical(&pc, c, status);
 -    pr = parts_muladd(&pa, &pb, &pc, flags, status);
 +    pr = parts_muladd_scalbn(&pa, &pb, &pc, 0, flags, status);
      return bfloat16_round_pack_canonical(pr, status);
  }
@@ -XXX,XX +XXX,XX @@ float128 QEMU_FLATTEN float128_muladd(float128 a, float128 b, float128 c,
      float128_unpack_canonical(&pa, a, status);
      float128_unpack_canonical(&pb, b, status);
      float128_unpack_canonical(&pc, c, status);
 -    pr = parts_muladd(&pa, &pb, &pc, flags, status);
 +    pr = parts_muladd_scalbn(&pa, &pb, &pc, 0, flags, status);
      return float128_round_pack_canonical(pr, status);
  }
@@ -XXX,XX +XXX,XX @@ float32 float32_exp2(float32 a, float_status *status)
      float64_unpack_canonical(&rp, float64_one, status);
      for (i = 0 ; i < 15 ; i++) {
 +
          float64_unpack_canonical(&tp, float32_exp2_coefficients[i], status);
 -        rp = *parts_muladd(&tp, &xnp, &rp, 0, status);
 +        rp = *parts_muladd_scalbn(&tp, &xnp, &rp, 0, 0, status);
          xnp = *parts_mul(&xnp, &xp, status);
      }
 diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/fpu/softfloat-parts.c.inc
 +++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(mul)(FloatPartsN *a, FloatPartsN *b,
   * Requires A and C extracted into a double-sized structure to provide the
   * extra space for the widening multiply.
   */
 -static FloatPartsN *partsN(muladd)(FloatPartsN *a, FloatPartsN *b,
 -                                   FloatPartsN *c, int flags, float_status *s)
 +static FloatPartsN *partsN(muladd_scalbn)(FloatPartsN *a, FloatPartsN *b,
 +                                          FloatPartsN *c, int scale,
 +                                          int flags, float_status *s)
  {
      int ab_mask, abc_mask;
      FloatPartsW p_widen, c_widen;
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(muladd)(FloatPartsN *a, FloatPartsN *b,
      a->exp = p_widen.exp;
   return_normal:
 +    /* TODO: Replace all use of float_muladd_halve_result with scale. */
      if (flags & float_muladd_halve_result) {
          a->exp -= 1;
      }
 +    a->exp += scale;
   finish_sign:
      if (flags & float_muladd_negate_result) {
          a->sign ^= 1;
 --
-.25.1
+.43.0

-[PULL 32/46] cpu: Move synchronize_from_tb() to tcg_ops
+[PULL 56/72] target/arm: Use float*_muladd_scalbn
-From: Eduardo Habkost <ehabkost@redhat.com>
+Use the scalbn interface instead of float_muladd_halve_result.
-Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 [claudio: wrapped target code in CONFIG_TCG, reworded comments]
 Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-Id: <20210204163931.7358-5-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h     | 22 +++++++++++++---------
+ target/arm/tcg/helper-a64.c | 6 +++---
- accel/tcg/cpu-exec.c      |  4 ++--
+file changed, 3 insertions(+), 3 deletions(-)
  target/arm/cpu.c          |  4 +++-
  target/avr/cpu.c          |  2 +-
  target/hppa/cpu.c         |  2 +-
  target/i386/tcg/tcg-cpu.c |  2 +-
  target/microblaze/cpu.c   |  2 +-
  target/mips/cpu.c         |  4 +++-
  target/riscv/cpu.c        |  2 +-
  target/rx/cpu.c           |  2 +-
  target/sh4/cpu.c          |  2 +-
  target/sparc/cpu.c        |  2 +-
  target/tricore/cpu.c      |  2 +-
 files changed, 30 insertions(+), 22 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
+diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
+--- a/target/arm/tcg/helper-a64.c
-+++ b/include/hw/core/cpu.h
++++ b/target/arm/tcg/helper-a64.c
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
+@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(rsqrtsf_f16)(uint32_t a, uint32_t b, float_status *fpst)
-      * Called when the first CPU is realized.
+         (float16_is_infinity(b) && float16_is_zero(a))) {
-      */
+         return float16_one_point_five;
      void (*initialize)(void);
 +    /**
 +     * @synchronize_from_tb: Synchronize state from a TCG #TranslationBlock
 +     *
 +     * This is called when we abandon execution of a TB before starting it,
 +     * and must set all parts of the CPU state which the previous TB in the
 +     * chain may not have updated.
 +     * By default, when this is NULL, a call is made to @set_pc(tb->pc).
 +     *
 +     * If more state needs to be restored, the target must implement a
 +     * function to restore all the state, and register it here.
 +     */
 +    void (*synchronize_from_tb)(CPUState *cpu,
 +                                const struct TranslationBlock *tb);
  } TcgCpuOperations;
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
   *       If the target behaviour here is anything other than "set
   *       the PC register to the value passed in" then the target must
   *       also implement the synchronize_from_tb hook.
 - * @synchronize_from_tb: Callback for synchronizing state from a TCG
 - *       #TranslationBlock. This is called when we abandon execution
 - *       of a TB before starting it, and must set all parts of the CPU
 - *       state which the previous TB in the chain may not have updated.
 - *       This always includes at least the program counter; some targets
 - *       will need to do more. If this hook is not implemented then the
 - *       default is to call @set_pc(tb->pc).
   * @tlb_fill: Callback for handling a softmmu tlb miss or user-only
   *       address fault.  For system mode, if the access is valid, call
   *       tlb_set_page and return true; if the access is invalid, and
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
      void (*get_memory_mapping)(CPUState *cpu, MemoryMappingList *list,
                                 Error **errp);
      void (*set_pc)(CPUState *cpu, vaddr value);
 -    void (*synchronize_from_tb)(CPUState *cpu,
 -                                const struct TranslationBlock *tb);
      bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
                       MMUAccessType access_type, int mmu_idx,
                       bool probe, uintptr_t retaddr);
 diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cpu-exec.c
 +++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
                                 TARGET_FMT_lx "] %s\n",
                                 last_tb->tc.ptr, last_tb->pc,
                                 lookup_symbol(last_tb->pc));
 -        if (cc->synchronize_from_tb) {
 -            cc->synchronize_from_tb(cpu, last_tb);
 +        if (cc->tcg_ops.synchronize_from_tb) {
 +            cc->tcg_ops.synchronize_from_tb(cpu, last_tb);
          } else {
              assert(cc->set_pc);
              cc->set_pc(cpu, last_tb->pc);
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_set_pc(CPUState *cs, vaddr value)
      }
+-    return float16_muladd(a, b, float16_three, float_muladd_halve_result, fpst);
++    return float16_muladd_scalbn(a, b, float16_three, -1, 0, fpst);
  }
-+#ifdef CONFIG_TCG
+ float32 HELPER(rsqrtsf_f32)(float32 a, float32 b, float_status *fpst)
- static void arm_cpu_synchronize_from_tb(CPUState *cs,
+@@ -XXX,XX +XXX,XX @@ float32 HELPER(rsqrtsf_f32)(float32 a, float32 b, float_status *fpst)
-                                         const TranslationBlock *tb)
+         (float32_is_infinity(b) && float32_is_zero(a))) {
- {
+         return float32_one_point_five;
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_synchronize_from_tb(CPUState *cs,
          env->regs[15] = tb->pc;
      }
+-    return float32_muladd(a, b, float32_three, float_muladd_halve_result, fpst);
++    return float32_muladd_scalbn(a, b, float32_three, -1, 0, fpst);
  }
-+#endif /* CONFIG_TCG */
+ float64 HELPER(rsqrtsf_f64)(float64 a, float64 b, float_status *fpst)
- static bool arm_cpu_has_work(CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ float64 HELPER(rsqrtsf_f64)(float64 a, float64 b, float_status *fpst)
- {
+         (float64_is_infinity(b) && float64_is_zero(a))) {
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
+         return float64_one_point_five;
      cc->cpu_exec_interrupt = arm_cpu_exec_interrupt;
      cc->dump_state = arm_cpu_dump_state;
      cc->set_pc = arm_cpu_set_pc;
 -    cc->synchronize_from_tb = arm_cpu_synchronize_from_tb;
      cc->gdb_read_register = arm_cpu_gdb_read_register;
      cc->gdb_write_register = arm_cpu_gdb_write_register;
  #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
      cc->disas_set_info = arm_disas_set_info;
  #ifdef CONFIG_TCG
      cc->tcg_ops.initialize = arm_translate_init;
 +    cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
      cc->tlb_fill = arm_cpu_tlb_fill;
      cc->debug_excp_handler = arm_debug_excp_handler;
      cc->debug_check_watchpoint = arm_debug_check_watchpoint;
 diff --git a/target/avr/cpu.c b/target/avr/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/avr/cpu.c
 +++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
      cc->vmsd = &vms_avr_cpu;
      cc->disas_set_info = avr_cpu_disas_set_info;
      cc->tcg_ops.initialize = avr_cpu_tcg_init;
 -    cc->synchronize_from_tb = avr_cpu_synchronize_from_tb;
 +    cc->tcg_ops.synchronize_from_tb = avr_cpu_synchronize_from_tb;
      cc->gdb_read_register = avr_cpu_gdb_read_register;
      cc->gdb_write_register = avr_cpu_gdb_write_register;
      cc->gdb_num_core_regs = 35;
 diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hppa/cpu.c
 +++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
      cc->cpu_exec_interrupt = hppa_cpu_exec_interrupt;
      cc->dump_state = hppa_cpu_dump_state;
      cc->set_pc = hppa_cpu_set_pc;
 -    cc->synchronize_from_tb = hppa_cpu_synchronize_from_tb;
 +    cc->tcg_ops.synchronize_from_tb = hppa_cpu_synchronize_from_tb;
      cc->gdb_read_register = hppa_cpu_gdb_read_register;
      cc->gdb_write_register = hppa_cpu_gdb_write_register;
      cc->tlb_fill = hppa_cpu_tlb_fill;
 diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/tcg-cpu.c
 +++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void tcg_cpu_common_class_init(CPUClass *cc)
  {
      cc->do_interrupt = x86_cpu_do_interrupt;
      cc->cpu_exec_interrupt = x86_cpu_exec_interrupt;
 -    cc->synchronize_from_tb = x86_cpu_synchronize_from_tb;
 +    cc->tcg_ops.synchronize_from_tb = x86_cpu_synchronize_from_tb;
      cc->cpu_exec_enter = x86_cpu_exec_enter;
      cc->cpu_exec_exit = x86_cpu_exec_exit;
      cc->tcg_ops.initialize = tcg_x86_init;
 diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/microblaze/cpu.c
 +++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
      cc->cpu_exec_interrupt = mb_cpu_exec_interrupt;
      cc->dump_state = mb_cpu_dump_state;
      cc->set_pc = mb_cpu_set_pc;
 -    cc->synchronize_from_tb = mb_cpu_synchronize_from_tb;
 +    cc->tcg_ops.synchronize_from_tb = mb_cpu_synchronize_from_tb;
      cc->gdb_read_register = mb_cpu_gdb_read_register;
      cc->gdb_write_register = mb_cpu_gdb_write_register;
      cc->tlb_fill = mb_cpu_tlb_fill;
 diff --git a/target/mips/cpu.c b/target/mips/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/cpu.c
 +++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_set_pc(CPUState *cs, vaddr value)
      }
+-    return float64_muladd(a, b, float64_three, float_muladd_halve_result, fpst);
++    return float64_muladd_scalbn(a, b, float64_three, -1, 0, fpst);
  }
-+#ifdef CONFIG_TCG
+ /* Floating-point reciprocal exponent - see FPRecpX in ARM ARM */
  static void mips_cpu_synchronize_from_tb(CPUState *cs,
                                           const TranslationBlock *tb)
  {
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_synchronize_from_tb(CPUState *cs,
      env->hflags &= ~MIPS_HFLAG_BMASK;
      env->hflags |= tb->flags & MIPS_HFLAG_BMASK;
  }
 +#endif /* CONFIG_TCG */
  static bool mips_cpu_has_work(CPUState *cs)
  {
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
      cc->cpu_exec_interrupt = mips_cpu_exec_interrupt;
      cc->dump_state = mips_cpu_dump_state;
      cc->set_pc = mips_cpu_set_pc;
 -    cc->synchronize_from_tb = mips_cpu_synchronize_from_tb;
      cc->gdb_read_register = mips_cpu_gdb_read_register;
      cc->gdb_write_register = mips_cpu_gdb_write_register;
  #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
      cc->disas_set_info = mips_cpu_disas_set_info;
  #ifdef CONFIG_TCG
      cc->tcg_ops.initialize = mips_tcg_init;
 +    cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
      cc->tlb_fill = mips_cpu_tlb_fill;
  #endif
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
      cc->cpu_exec_interrupt = riscv_cpu_exec_interrupt;
      cc->dump_state = riscv_cpu_dump_state;
      cc->set_pc = riscv_cpu_set_pc;
 -    cc->synchronize_from_tb = riscv_cpu_synchronize_from_tb;
 +    cc->tcg_ops.synchronize_from_tb = riscv_cpu_synchronize_from_tb;
      cc->gdb_read_register = riscv_cpu_gdb_read_register;
      cc->gdb_write_register = riscv_cpu_gdb_write_register;
      cc->gdb_num_core_regs = 33;
 diff --git a/target/rx/cpu.c b/target/rx/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/rx/cpu.c
 +++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
      cc->cpu_exec_interrupt = rx_cpu_exec_interrupt;
      cc->dump_state = rx_cpu_dump_state;
      cc->set_pc = rx_cpu_set_pc;
 -    cc->synchronize_from_tb = rx_cpu_synchronize_from_tb;
 +    cc->tcg_ops.synchronize_from_tb = rx_cpu_synchronize_from_tb;
      cc->gdb_read_register = rx_cpu_gdb_read_register;
      cc->gdb_write_register = rx_cpu_gdb_write_register;
      cc->get_phys_page_debug = rx_cpu_get_phys_page_debug;
 diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sh4/cpu.c
 +++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
      cc->cpu_exec_interrupt = superh_cpu_exec_interrupt;
      cc->dump_state = superh_cpu_dump_state;
      cc->set_pc = superh_cpu_set_pc;
 -    cc->synchronize_from_tb = superh_cpu_synchronize_from_tb;
 +    cc->tcg_ops.synchronize_from_tb = superh_cpu_synchronize_from_tb;
      cc->gdb_read_register = superh_cpu_gdb_read_register;
      cc->gdb_write_register = superh_cpu_gdb_write_register;
      cc->tlb_fill = superh_cpu_tlb_fill;
 diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sparc/cpu.c
 +++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
      cc->memory_rw_debug = sparc_cpu_memory_rw_debug;
  #endif
      cc->set_pc = sparc_cpu_set_pc;
 -    cc->synchronize_from_tb = sparc_cpu_synchronize_from_tb;
 +    cc->tcg_ops.synchronize_from_tb = sparc_cpu_synchronize_from_tb;
      cc->gdb_read_register = sparc_cpu_gdb_read_register;
      cc->gdb_write_register = sparc_cpu_gdb_write_register;
      cc->tlb_fill = sparc_cpu_tlb_fill;
 diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tricore/cpu.c
 +++ b/target/tricore/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_class_init(ObjectClass *c, void *data)
      cc->dump_state = tricore_cpu_dump_state;
      cc->set_pc = tricore_cpu_set_pc;
 -    cc->synchronize_from_tb = tricore_cpu_synchronize_from_tb;
 +    cc->tcg_ops.synchronize_from_tb = tricore_cpu_synchronize_from_tb;
      cc->get_phys_page_debug = tricore_cpu_get_phys_page_debug;
      cc->tcg_ops.initialize = tricore_tcg_init;
      cc->tlb_fill = tricore_cpu_tlb_fill;
 --
-.25.1
+.43.0

-[PULL 17/46] tcg/tci: Merge INDEX_op_{ld_i32,ld32u_i64}
+[PULL 57/72] target/sparc: Use float*_muladd_scalbn
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Use the scalbn interface instead of float_muladd_halve_result.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c | 7 +------
+ target/sparc/helper.h     |  4 +-
-file changed, 1 insertion(+), 6 deletions(-)
+ target/sparc/fop_helper.c |  8 ++--
+ target/sparc/translate.c  | 80 +++++++++++++++++++++++----------------
-diff --git a/tcg/tci.c b/tcg/tci.c
+files changed, 54 insertions(+), 38 deletions(-)
 diff --git a/target/sparc/helper.h b/target/sparc/helper.h
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/target/sparc/helper.h
-+++ b/tcg/tci.c
++++ b/target/sparc/helper.h
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(faddd, TCG_CALL_NO_WG, f64, env, f64, f64)
-             tci_write_reg(regs, t0, *(int16_t *)(t1 + t2));
+ DEF_HELPER_FLAGS_3(fsubd, TCG_CALL_NO_WG, f64, env, f64, f64)
-             break;
+ DEF_HELPER_FLAGS_3(fmuld, TCG_CALL_NO_WG, f64, env, f64, f64)
-         case INDEX_op_ld_i32:
+ DEF_HELPER_FLAGS_3(fdivd, TCG_CALL_NO_WG, f64, env, f64, f64)
-+        CASE_64(ld32u)
+-DEF_HELPER_FLAGS_5(fmaddd, TCG_CALL_NO_WG, f64, env, f64, f64, f64, i32)
-             t0 = *tb_ptr++;
++DEF_HELPER_FLAGS_6(fmaddd, TCG_CALL_NO_WG, f64, env, f64, f64, f64, s32, i32)
-             t1 = tci_read_r(regs, &tb_ptr);
+ DEF_HELPER_FLAGS_3(fnaddd, TCG_CALL_NO_WG, f64, env, f64, f64)
-             t2 = tci_read_s32(&tb_ptr);
+ DEF_HELPER_FLAGS_3(fnmuld, TCG_CALL_NO_WG, f64, env, f64, f64)
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(fadds, TCG_CALL_NO_WG, f32, env, f32, f32)
-             /* Load/store operations (64 bit). */
+ DEF_HELPER_FLAGS_3(fsubs, TCG_CALL_NO_WG, f32, env, f32, f32)
+ DEF_HELPER_FLAGS_3(fmuls, TCG_CALL_NO_WG, f32, env, f32, f32)
--        case INDEX_op_ld32u_i64:
+ DEF_HELPER_FLAGS_3(fdivs, TCG_CALL_NO_WG, f32, env, f32, f32)
--            t0 = *tb_ptr++;
+-DEF_HELPER_FLAGS_5(fmadds, TCG_CALL_NO_WG, f32, env, f32, f32, f32, i32)
--            t1 = tci_read_r(regs, &tb_ptr);
++DEF_HELPER_FLAGS_6(fmadds, TCG_CALL_NO_WG, f32, env, f32, f32, f32, s32, i32)
--            t2 = tci_read_s32(&tb_ptr);
+ DEF_HELPER_FLAGS_3(fnadds, TCG_CALL_NO_WG, f32, env, f32, f32)
--            tci_write_reg(regs, t0, *(uint32_t *)(t1 + t2));
+ DEF_HELPER_FLAGS_3(fnmuls, TCG_CALL_NO_WG, f32, env, f32, f32)
--            break;
-         case INDEX_op_ld32s_i64:
+diff --git a/target/sparc/fop_helper.c b/target/sparc/fop_helper.c
-             t0 = *tb_ptr++;
+index XXXXXXX..XXXXXXX 100644
-             t1 = tci_read_r(regs, &tb_ptr);
+--- a/target/sparc/fop_helper.c
 +++ b/target/sparc/fop_helper.c
@@ -XXX,XX +XXX,XX @@ Int128 helper_fsqrtq(CPUSPARCState *env, Int128 src)
  }
  float32 helper_fmadds(CPUSPARCState *env, float32 s1,
 -                      float32 s2, float32 s3, uint32_t op)
 +                      float32 s2, float32 s3, int32_t sc, uint32_t op)
  {
 -    float32 ret = float32_muladd(s1, s2, s3, op, &env->fp_status);
 +    float32 ret = float32_muladd_scalbn(s1, s2, s3, sc, op, &env->fp_status);
      check_ieee_exceptions(env, GETPC());
      return ret;
  }
  float64 helper_fmaddd(CPUSPARCState *env, float64 s1,
 -                      float64 s2, float64 s3, uint32_t op)
 +                      float64 s2, float64 s3, int32_t sc, uint32_t op)
  {
 -    float64 ret = float64_muladd(s1, s2, s3, op, &env->fp_status);
 +    float64 ret = float64_muladd_scalbn(s1, s2, s3, sc, op, &env->fp_status);
      check_ieee_exceptions(env, GETPC());
      return ret;
  }
 diff --git a/target/sparc/translate.c b/target/sparc/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sparc/translate.c
 +++ b/target/sparc/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_op_fabsq(TCGv_i128 dst, TCGv_i128 src)
  static void gen_op_fmadds(TCGv_i32 d, TCGv_i32 s1, TCGv_i32 s2, TCGv_i32 s3)
  {
 -    gen_helper_fmadds(d, tcg_env, s1, s2, s3, tcg_constant_i32(0));
 +    TCGv_i32 z = tcg_constant_i32(0);
 +    gen_helper_fmadds(d, tcg_env, s1, s2, s3, z, z);
  }
  static void gen_op_fmaddd(TCGv_i64 d, TCGv_i64 s1, TCGv_i64 s2, TCGv_i64 s3)
  {
 -    gen_helper_fmaddd(d, tcg_env, s1, s2, s3, tcg_constant_i32(0));
 +    TCGv_i32 z = tcg_constant_i32(0);
 +    gen_helper_fmaddd(d, tcg_env, s1, s2, s3, z, z);
  }
  static void gen_op_fmsubs(TCGv_i32 d, TCGv_i32 s1, TCGv_i32 s2, TCGv_i32 s3)
  {
 -    int op = float_muladd_negate_c;
 -    gen_helper_fmadds(d, tcg_env, s1, s2, s3, tcg_constant_i32(op));
 +    TCGv_i32 z = tcg_constant_i32(0);
 +    TCGv_i32 op = tcg_constant_i32(float_muladd_negate_c);
 +    gen_helper_fmadds(d, tcg_env, s1, s2, s3, z, op);
  }
  static void gen_op_fmsubd(TCGv_i64 d, TCGv_i64 s1, TCGv_i64 s2, TCGv_i64 s3)
  {
 -    int op = float_muladd_negate_c;
 -    gen_helper_fmaddd(d, tcg_env, s1, s2, s3, tcg_constant_i32(op));
 +    TCGv_i32 z = tcg_constant_i32(0);
 +    TCGv_i32 op = tcg_constant_i32(float_muladd_negate_c);
 +    gen_helper_fmaddd(d, tcg_env, s1, s2, s3, z, op);
  }
  static void gen_op_fnmsubs(TCGv_i32 d, TCGv_i32 s1, TCGv_i32 s2, TCGv_i32 s3)
  {
 -    int op = float_muladd_negate_c | float_muladd_negate_result;
 -    gen_helper_fmadds(d, tcg_env, s1, s2, s3, tcg_constant_i32(op));
 +    TCGv_i32 z = tcg_constant_i32(0);
 +    TCGv_i32 op = tcg_constant_i32(float_muladd_negate_c |
 +                                   float_muladd_negate_result);
 +    gen_helper_fmadds(d, tcg_env, s1, s2, s3, z, op);
  }
  static void gen_op_fnmsubd(TCGv_i64 d, TCGv_i64 s1, TCGv_i64 s2, TCGv_i64 s3)
  {
 -    int op = float_muladd_negate_c | float_muladd_negate_result;
 -    gen_helper_fmaddd(d, tcg_env, s1, s2, s3, tcg_constant_i32(op));
 +    TCGv_i32 z = tcg_constant_i32(0);
 +    TCGv_i32 op = tcg_constant_i32(float_muladd_negate_c |
 +                                   float_muladd_negate_result);
 +    gen_helper_fmaddd(d, tcg_env, s1, s2, s3, z, op);
  }
  static void gen_op_fnmadds(TCGv_i32 d, TCGv_i32 s1, TCGv_i32 s2, TCGv_i32 s3)
  {
 -    int op = float_muladd_negate_result;
 -    gen_helper_fmadds(d, tcg_env, s1, s2, s3, tcg_constant_i32(op));
 +    TCGv_i32 z = tcg_constant_i32(0);
 +    TCGv_i32 op = tcg_constant_i32(float_muladd_negate_result);
 +    gen_helper_fmadds(d, tcg_env, s1, s2, s3, z, op);
  }
  static void gen_op_fnmaddd(TCGv_i64 d, TCGv_i64 s1, TCGv_i64 s2, TCGv_i64 s3)
  {
 -    int op = float_muladd_negate_result;
 -    gen_helper_fmaddd(d, tcg_env, s1, s2, s3, tcg_constant_i32(op));
 +    TCGv_i32 z = tcg_constant_i32(0);
 +    TCGv_i32 op = tcg_constant_i32(float_muladd_negate_result);
 +    gen_helper_fmaddd(d, tcg_env, s1, s2, s3, z, op);
  }
  /* Use muladd to compute (1 * src1) + src2 / 2 with one rounding. */
  static void gen_op_fhadds(TCGv_i32 d, TCGv_i32 s1, TCGv_i32 s2)
  {
 -    TCGv_i32 one = tcg_constant_i32(float32_one);
 -    int op = float_muladd_halve_result;
 -    gen_helper_fmadds(d, tcg_env, one, s1, s2, tcg_constant_i32(op));
 +    TCGv_i32 fone = tcg_constant_i32(float32_one);
 +    TCGv_i32 mone = tcg_constant_i32(-1);
 +    TCGv_i32 op = tcg_constant_i32(0);
 +    gen_helper_fmadds(d, tcg_env, fone, s1, s2, mone, op);
  }
  static void gen_op_fhaddd(TCGv_i64 d, TCGv_i64 s1, TCGv_i64 s2)
  {
 -    TCGv_i64 one = tcg_constant_i64(float64_one);
 -    int op = float_muladd_halve_result;
 -    gen_helper_fmaddd(d, tcg_env, one, s1, s2, tcg_constant_i32(op));
 +    TCGv_i64 fone = tcg_constant_i64(float64_one);
 +    TCGv_i32 mone = tcg_constant_i32(-1);
 +    TCGv_i32 op = tcg_constant_i32(0);
 +    gen_helper_fmaddd(d, tcg_env, fone, s1, s2, mone, op);
  }
  /* Use muladd to compute (1 * src1) - src2 / 2 with one rounding. */
  static void gen_op_fhsubs(TCGv_i32 d, TCGv_i32 s1, TCGv_i32 s2)
  {
 -    TCGv_i32 one = tcg_constant_i32(float32_one);
 -    int op = float_muladd_negate_c | float_muladd_halve_result;
 -    gen_helper_fmadds(d, tcg_env, one, s1, s2, tcg_constant_i32(op));
 +    TCGv_i32 fone = tcg_constant_i32(float32_one);
 +    TCGv_i32 mone = tcg_constant_i32(-1);
 +    TCGv_i32 op = tcg_constant_i32(float_muladd_negate_c);
 +    gen_helper_fmadds(d, tcg_env, fone, s1, s2, mone, op);
  }
  static void gen_op_fhsubd(TCGv_i64 d, TCGv_i64 s1, TCGv_i64 s2)
  {
 -    TCGv_i64 one = tcg_constant_i64(float64_one);
 -    int op = float_muladd_negate_c | float_muladd_halve_result;
 -    gen_helper_fmaddd(d, tcg_env, one, s1, s2, tcg_constant_i32(op));
 +    TCGv_i64 fone = tcg_constant_i64(float64_one);
 +    TCGv_i32 mone = tcg_constant_i32(-1);
 +    TCGv_i32 op = tcg_constant_i32(float_muladd_negate_c);
 +    gen_helper_fmaddd(d, tcg_env, fone, s1, s2, mone, op);
  }
  /* Use muladd to compute -((1 * src1) + src2 / 2) with one rounding. */
  static void gen_op_fnhadds(TCGv_i32 d, TCGv_i32 s1, TCGv_i32 s2)
  {
 -    TCGv_i32 one = tcg_constant_i32(float32_one);
 -    int op = float_muladd_negate_result | float_muladd_halve_result;
 -    gen_helper_fmadds(d, tcg_env, one, s1, s2, tcg_constant_i32(op));
 +    TCGv_i32 fone = tcg_constant_i32(float32_one);
 +    TCGv_i32 mone = tcg_constant_i32(-1);
 +    TCGv_i32 op = tcg_constant_i32(float_muladd_negate_result);
 +    gen_helper_fmadds(d, tcg_env, fone, s1, s2, mone, op);
  }
  static void gen_op_fnhaddd(TCGv_i64 d, TCGv_i64 s1, TCGv_i64 s2)
  {
 -    TCGv_i64 one = tcg_constant_i64(float64_one);
 -    int op = float_muladd_negate_result | float_muladd_halve_result;
 -    gen_helper_fmaddd(d, tcg_env, one, s1, s2, tcg_constant_i32(op));
 +    TCGv_i64 fone = tcg_constant_i64(float64_one);
 +    TCGv_i32 mone = tcg_constant_i32(-1);
 +    TCGv_i32 op = tcg_constant_i32(float_muladd_negate_result);
 +    gen_helper_fmaddd(d, tcg_env, fone, s1, s2, mone, op);
  }
  static void gen_op_fpexception_im(DisasContext *dc, int ftt)
 --
-.25.1
+.43.0

-[PULL 16/46] tcg/tci: Merge INDEX_op_ld16s_{i32,i64}
+[PULL 58/72] softfloat: Remove float_muladd_halve_result
-Eliminating a TODO for ld16s_i64.
+All uses have been convered to float*_muladd_scalbn.
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c | 5 +----
+ include/fpu/softfloat.h   | 3 ---
-file changed, 1 insertion(+), 4 deletions(-)
+ fpu/softfloat.c           | 6 ------
  fpu/softfloat-parts.c.inc | 4 ----
 files changed, 13 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
+diff --git a/include/fpu/softfloat.h b/include/fpu/softfloat.h
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/include/fpu/softfloat.h
-+++ b/tcg/tci.c
++++ b/include/fpu/softfloat.h
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+@@ -XXX,XX +XXX,XX @@ bfloat16 bfloat16_squash_input_denormal(bfloat16 a, float_status *status);
-             t2 = tci_read_s32(&tb_ptr);
+ | Using these differs from negating an input or output before calling
-             tci_write_reg(regs, t0, *(uint16_t *)(t1 + t2));
+ | the muladd function in that this means that a NaN doesn't have its
-             break;
+ | sign bit inverted before it is propagated.
--        case INDEX_op_ld16s_i32:
+-| We also support halving the result before rounding, as a special
-+        CASE_32_64(ld16s)
+-| case to support the ARM fused-sqrt-step instruction FRSQRTS.
-             t0 = *tb_ptr++;
+ *----------------------------------------------------------------------------*/
-             t1 = tci_read_r(regs, &tb_ptr);
+ enum {
-             t2 = tci_read_s32(&tb_ptr);
+     float_muladd_negate_c = 1,
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+     float_muladd_negate_product = 2,
+     float_muladd_negate_result = 4,
-             /* Load/store operations (64 bit). */
+-    float_muladd_halve_result = 8,
+ };
--        case INDEX_op_ld16s_i64:
--            TODO();
+ /*----------------------------------------------------------------------------
--            break;
+diff --git a/fpu/softfloat.c b/fpu/softfloat.c
-         case INDEX_op_ld32u_i64:
+index XXXXXXX..XXXXXXX 100644
-             t0 = *tb_ptr++;
+--- a/fpu/softfloat.c
-             t1 = tci_read_r(regs, &tb_ptr);
++++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ float32_muladd(float32 xa, float32 xb, float32 xc, int flags, float_status *s)
      if (unlikely(!can_use_fpu(s))) {
          goto soft;
      }
 -    if (unlikely(flags & float_muladd_halve_result)) {
 -        goto soft;
 -    }
      float32_input_flush3(&ua.s, &ub.s, &uc.s, s);
      if (unlikely(!f32_is_zon3(ua, ub, uc))) {
@@ -XXX,XX +XXX,XX @@ float64_muladd(float64 xa, float64 xb, float64 xc, int flags, float_status *s)
      if (unlikely(!can_use_fpu(s))) {
          goto soft;
      }
 -    if (unlikely(flags & float_muladd_halve_result)) {
 -        goto soft;
 -    }
      float64_input_flush3(&ua.s, &ub.s, &uc.s, s);
      if (unlikely(!f64_is_zon3(ua, ub, uc))) {
 diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/fpu/softfloat-parts.c.inc
 +++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(muladd_scalbn)(FloatPartsN *a, FloatPartsN *b,
      a->exp = p_widen.exp;
   return_normal:
 -    /* TODO: Replace all use of float_muladd_halve_result with scale. */
 -    if (flags & float_muladd_halve_result) {
 -        a->exp -= 1;
 -    }
      a->exp += scale;
   finish_sign:
      if (flags & float_muladd_negate_result) {
 --
-.25.1
+.43.0

-[PULL 15/46] tcg/tci: Merge INDEX_op_ld16u_{i32,i64}
+[PULL 59/72] softfloat: Add float_round_nearest_even_max
-Eliminating a TODO for ld16u_i32.
+This rounding mode is used by Hexagon.
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c | 13 +++++--------
+ include/fpu/softfloat-types.h | 2 ++
-file changed, 5 insertions(+), 8 deletions(-)
+ fpu/softfloat-parts.c.inc     | 3 +++
 files changed, 5 insertions(+)
-diff --git a/tcg/tci.c b/tcg/tci.c
+diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/include/fpu/softfloat-types.h
-+++ b/tcg/tci.c
++++ b/include/fpu/softfloat-types.h
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+@@ -XXX,XX +XXX,XX @@ typedef enum __attribute__((__packed__)) {
-             t2 = tci_read_s32(&tb_ptr);
+     float_round_to_odd       = 5,
-             tci_write_reg(regs, t0, *(int8_t *)(t1 + t2));
+     /* Not an IEEE rounding mode: round to closest odd, overflow to inf */
-             break;
+     float_round_to_odd_inf   = 6,
--        case INDEX_op_ld16u_i32:
++    /* Not an IEEE rounding mode: round to nearest even, overflow to max */
--            TODO();
++    float_round_nearest_even_max = 7,
-+        CASE_32_64(ld16u)
+ } FloatRoundMode;
-+            t0 = *tb_ptr++;
-+            t1 = tci_read_r(regs, &tb_ptr);
+ /*
-+            t2 = tci_read_s32(&tb_ptr);
+diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
-+            tci_write_reg(regs, t0, *(uint16_t *)(t1 + t2));
+index XXXXXXX..XXXXXXX 100644
-             break;
+--- a/fpu/softfloat-parts.c.inc
-         case INDEX_op_ld16s_i32:
++++ b/fpu/softfloat-parts.c.inc
-             t0 = *tb_ptr++;
+@@ -XXX,XX +XXX,XX @@ static void partsN(uncanon_normal)(FloatPartsN *p, float_status *s,
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+     int exp, flags = 0;
-             /* Load/store operations (64 bit). */
+     switch (s->float_rounding_mode) {
++    case float_round_nearest_even_max:
--        case INDEX_op_ld16u_i64:
++        overflow_norm = true;
--            t0 = *tb_ptr++;
++        /* fall through */
--            t1 = tci_read_r(regs, &tb_ptr);
+     case float_round_nearest_even:
--            t2 = tci_read_s32(&tb_ptr);
+         if (N > 64 && frac_lsb == 0) {
--            tci_write_reg(regs, t0, *(uint16_t *)(t1 + t2));
+             inc = ((p->frac_hi & 1) || (p->frac_lo & round_mask) != frac_lsbm1
 -            break;
          case INDEX_op_ld16s_i64:
              TODO();
              break;
 --
-.25.1
+.43.0

-[PULL 14/46] tcg/tci: Merge INDEX_op_ld8s_{i32,i64}
+[PULL 60/72] softfloat: Add float_muladd_suppress_add_product_zero
-Eliminating a TODO for ld8s_i32.
+Certain Hexagon instructions suppress changes to the result
 when the product of fma() is a true zero.
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c | 13 +++++--------
+ include/fpu/softfloat.h   | 5 +++++
-file changed, 5 insertions(+), 8 deletions(-)
+ fpu/softfloat.c           | 3 +++
  fpu/softfloat-parts.c.inc | 4 +++-
 files changed, 11 insertions(+), 1 deletion(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
+diff --git a/include/fpu/softfloat.h b/include/fpu/softfloat.h
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/include/fpu/softfloat.h
-+++ b/tcg/tci.c
++++ b/include/fpu/softfloat.h
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+@@ -XXX,XX +XXX,XX @@ bfloat16 bfloat16_squash_input_denormal(bfloat16 a, float_status *status);
-             t2 = tci_read_s32(&tb_ptr);
+ | Using these differs from negating an input or output before calling
-             tci_write_reg(regs, t0, *(uint8_t *)(t1 + t2));
+ | the muladd function in that this means that a NaN doesn't have its
-             break;
+ | sign bit inverted before it is propagated.
--        case INDEX_op_ld8s_i32:
++|
--            TODO();
++| With float_muladd_suppress_add_product_zero, if A or B is zero
-+        CASE_32_64(ld8s)
++| such that the product is a true zero, then return C without addition.
-+            t0 = *tb_ptr++;
++| This preserves the sign of C when C is +/- 0.  Used for Hexagon.
-+            t1 = tci_read_r(regs, &tb_ptr);
+ *----------------------------------------------------------------------------*/
-+            t2 = tci_read_s32(&tb_ptr);
+ enum {
-+            tci_write_reg(regs, t0, *(int8_t *)(t1 + t2));
+     float_muladd_negate_c = 1,
-             break;
+     float_muladd_negate_product = 2,
-         case INDEX_op_ld16u_i32:
+     float_muladd_negate_result = 4,
-             TODO();
++    float_muladd_suppress_add_product_zero = 8,
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+ };
-             /* Load/store operations (64 bit). */
+ /*----------------------------------------------------------------------------
+diff --git a/fpu/softfloat.c b/fpu/softfloat.c
--        case INDEX_op_ld8s_i64:
+index XXXXXXX..XXXXXXX 100644
--            t0 = *tb_ptr++;
+--- a/fpu/softfloat.c
--            t1 = tci_read_r(regs, &tb_ptr);
++++ b/fpu/softfloat.c
--            t2 = tci_read_s32(&tb_ptr);
+@@ -XXX,XX +XXX,XX @@ float32_muladd(float32 xa, float32 xb, float32 xc, int flags, float_status *s)
--            tci_write_reg(regs, t0, *(int8_t *)(t1 + t2));
+     if (unlikely(!can_use_fpu(s))) {
--            break;
+         goto soft;
-         case INDEX_op_ld16u_i64:
+     }
-             t0 = *tb_ptr++;
++    if (unlikely(flags & float_muladd_suppress_add_product_zero)) {
-             t1 = tci_read_r(regs, &tb_ptr);
++        goto soft;
 +    }
      float32_input_flush3(&ua.s, &ub.s, &uc.s, s);
      if (unlikely(!f32_is_zon3(ua, ub, uc))) {
 diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/fpu/softfloat-parts.c.inc
 +++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(muladd_scalbn)(FloatPartsN *a, FloatPartsN *b,
              goto return_normal;
          }
          if (c->cls == float_class_zero) {
 -            if (a->sign != c->sign) {
 +            if (flags & float_muladd_suppress_add_product_zero) {
 +                a->sign = c->sign;
 +            } else if (a->sign != c->sign) {
                  goto return_sub_zero;
              }
              goto return_zero;
 --
-.25.1
+.43.0

-[PULL 42/46] cpu: move debug_check_watchpoint to tcg_ops
+[PULL 61/72] target/hexagon: Use float32_mul in helper_sfmpy
-From: Claudio Fontana <cfontana@suse.de>
+There are no special cases for this instruction.
 Remove internal_mpyf as unused.
-commit 568496c0c0f1 ("cpu: Add callback to check architectural") and
+Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
 commit 3826121d9298 ("target-arm: Implement checking of fired")
 introduced an ARM-specific hack for cpu_check_watchpoint.
 Make debug_check_watchpoint optional, and move it to tcg_ops.
 Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-Id: <20210204163931.7358-15-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h | 9 ++++++---
+ target/hexagon/fma_emu.h   | 1 -
- accel/tcg/user-exec.c | 3 ++-
+ target/hexagon/fma_emu.c   | 8 --------
- hw/core/cpu.c         | 9 ---------
+ target/hexagon/op_helper.c | 2 +-
- softmmu/physmem.c     | 4 ++--
+files changed, 1 insertion(+), 10 deletions(-)
  target/arm/cpu.c      | 4 ++--
 files changed, 12 insertions(+), 17 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
+diff --git a/target/hexagon/fma_emu.h b/target/hexagon/fma_emu.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
+--- a/target/hexagon/fma_emu.h
-+++ b/include/hw/core/cpu.h
++++ b/target/hexagon/fma_emu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
+@@ -XXX,XX +XXX,XX @@ int32_t float32_getexp(float32 f32);
-      */
+ float32 infinite_float32(uint8_t sign);
-     vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
+ float32 internal_fmafx(float32 a, float32 b, float32 c,
+                        int scale, float_status *fp_status);
-+    /**
+-float32 internal_mpyf(float32 a, float32 b, float_status *fp_status);
-+     * @debug_check_watchpoint: return true if the architectural
+ float64 internal_mpyhh(float64 a, float64 b,
-+     * watchpoint whose address has matched should really fire, used by ARM
+                        unsigned long long int accumulated,
-+     */
+                        float_status *fp_status);
-+    bool (*debug_check_watchpoint)(CPUState *cpu, CPUWatchpoint *wp);
+diff --git a/target/hexagon/fma_emu.c b/target/hexagon/fma_emu.c
 +
  } TcgCpuOperations;
  /**
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
   *       a memory access with the specified memory transaction attributes.
   * @gdb_read_register: Callback for letting GDB read a register.
   * @gdb_write_register: Callback for letting GDB write a register.
 - * @debug_check_watchpoint: Callback: return true if the architectural
 - *       watchpoint whose address has matched should really fire.
   * @write_elf64_note: Callback for writing a CPU-specific ELF note to a
   * 64-bit VM coredump.
   * @write_elf32_qemunote: Callback for writing a CPU- and QEMU-specific ELF
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
      int (*asidx_from_attrs)(CPUState *cpu, MemTxAttrs attrs);
      int (*gdb_read_register)(CPUState *cpu, GByteArray *buf, int reg);
      int (*gdb_write_register)(CPUState *cpu, uint8_t *buf, int reg);
 -    bool (*debug_check_watchpoint)(CPUState *cpu, CPUWatchpoint *wp);
      int (*write_elf64_note)(WriteCoreDumpFunction f, CPUState *cpu,
                              int cpuid, void *opaque);
 diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/user-exec.c
+--- a/target/hexagon/fma_emu.c
-+++ b/accel/tcg/user-exec.c
++++ b/target/hexagon/fma_emu.c
-@@ -XXX,XX +XXX,XX @@ static inline int handle_cpu_signal(uintptr_t pc, siginfo_t *info,
+@@ -XXX,XX +XXX,XX @@ float32 internal_fmafx(float32 a, float32 b, float32 c, int scale,
-     clear_helper_retaddr();
+     return accum_round_float32(result, fp_status);
      cc = CPU_GET_CLASS(cpu);
 -    cc->tcg_ops.tlb_fill(cpu, address, 0, access_type, MMU_USER_IDX, false, pc);
 +    cc->tcg_ops.tlb_fill(cpu, address, 0, access_type,
 +                         MMU_USER_IDX, false, pc);
      g_assert_not_reached();
  }
-diff --git a/hw/core/cpu.c b/hw/core/cpu.c
+-float32 internal_mpyf(float32 a, float32 b, float_status *fp_status)
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/core/cpu.c
 +++ b/hw/core/cpu.c
@@ -XXX,XX +XXX,XX @@ static int cpu_common_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg)
      return 0;
  }
 -static bool cpu_common_debug_check_watchpoint(CPUState *cpu, CPUWatchpoint *wp)
 -{
--    /* If no extra check is required, QEMU watchpoint match can be considered
+-    if (float32_is_zero(a) || float32_is_zero(b)) {
--     * as an architectural match.
+-        return float32_mul(a, b, fp_status);
--     */
+-    }
--    return true;
+-    return internal_fmafx(a, b, float32_zero, 0, fp_status);
 -}
 -
- static bool cpu_common_virtio_is_big_endian(CPUState *cpu)
+ float64 internal_mpyhh(float64 a, float64 b,
                        unsigned long long int accumulated,
                        float_status *fp_status)
 diff --git a/target/hexagon/op_helper.c b/target/hexagon/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hexagon/op_helper.c
 +++ b/target/hexagon/op_helper.c
@@ -XXX,XX +XXX,XX @@ float32 HELPER(sfmpy)(CPUHexagonState *env, float32 RsV, float32 RtV)
  {
-     return target_words_bigendian();
+     float32 RdV;
-@@ -XXX,XX +XXX,XX @@ static void cpu_class_init(ObjectClass *klass, void *data)
+     arch_fpop_start(env);
-     k->gdb_read_register = cpu_common_gdb_read_register;
+-    RdV = internal_mpyf(RsV, RtV, &env->fp_status);
-     k->gdb_write_register = cpu_common_gdb_write_register;
++    RdV = float32_mul(RsV, RtV, &env->fp_status);
-     k->virtio_is_big_endian = cpu_common_virtio_is_big_endian;
+     arch_fpop_end(env);
--    k->debug_check_watchpoint = cpu_common_debug_check_watchpoint;
+     return RdV;
      set_bit(DEVICE_CATEGORY_CPU, dc->categories);
      dc->realize = cpu_common_realizefn;
      dc->unrealize = cpu_common_unrealizefn;
 diff --git a/softmmu/physmem.c b/softmmu/physmem.c
 index XXXXXXX..XXXXXXX 100644
 --- a/softmmu/physmem.c
 +++ b/softmmu/physmem.c
@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
              wp->hitaddr = MAX(addr, wp->vaddr);
              wp->hitattrs = attrs;
              if (!cpu->watchpoint_hit) {
 -                if (wp->flags & BP_CPU &&
 -                    !cc->debug_check_watchpoint(cpu, wp)) {
 +                if (wp->flags & BP_CPU && cc->tcg_ops.debug_check_watchpoint &&
 +                    !cc->tcg_ops.debug_check_watchpoint(cpu, wp)) {
                      wp->flags &= ~BP_WATCHPOINT_HIT;
                      continue;
                  }
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
      cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
      cc->tcg_ops.tlb_fill = arm_cpu_tlb_fill;
      cc->tcg_ops.debug_excp_handler = arm_debug_excp_handler;
 -    cc->debug_check_watchpoint = arm_debug_check_watchpoint;
  #if !defined(CONFIG_USER_ONLY)
 +    cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
      cc->tcg_ops.do_transaction_failed = arm_cpu_do_transaction_failed;
      cc->tcg_ops.do_unaligned_access = arm_cpu_do_unaligned_access;
      cc->tcg_ops.adjust_watchpoint_address = arm_adjust_watchpoint_address;
 -    cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
 +    cc->tcg_ops.debug_check_watchpoint = arm_debug_check_watchpoint;
  #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
  #endif /* CONFIG_TCG */
  }
 --
-.25.1
+.43.0

-[PULL 13/46] tcg/tci: Merge INDEX_op_ld8u_{i32,i64}
+[PULL 62/72] target/hexagon: Use float32_muladd for helper_sffma
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+There are no special cases for this instruction.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c | 20 +++++++++++++-------
+ target/hexagon/op_helper.c | 2 +-
-file changed, 13 insertions(+), 7 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
+diff --git a/target/hexagon/op_helper.c b/target/hexagon/op_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/target/hexagon/op_helper.c
-+++ b/tcg/tci.c
++++ b/target/hexagon/op_helper.c
-@@ -XXX,XX +XXX,XX @@ static bool tci_compare64(uint64_t u0, uint64_t u1, TCGCond condition)
+@@ -XXX,XX +XXX,XX @@ float32 HELPER(sffma)(CPUHexagonState *env, float32 RxV,
- # define qemu_st_beq(X)  stq_be_p(g2h(taddr), X)
+                       float32 RsV, float32 RtV)
- #endif
+ {
+     arch_fpop_start(env);
-+#if TCG_TARGET_REG_BITS == 64
+-    RxV = internal_fmafx(RsV, RtV, RxV, 0, &env->fp_status);
-+# define CASE_32_64(x) \
++    RxV = float32_muladd(RsV, RtV, RxV, 0, &env->fp_status);
-+        case glue(glue(INDEX_op_, x), _i64): \
+     arch_fpop_end(env);
-+        case glue(glue(INDEX_op_, x), _i32):
+     return RxV;
-+# define CASE_64(x) \
+ }
 +        case glue(glue(INDEX_op_, x), _i64):
 +#else
 +# define CASE_32_64(x) \
 +        case glue(glue(INDEX_op_, x), _i32):
 +# define CASE_64(x)
 +#endif
 +
  /* Interpret pseudo code in tb. */
  /*
   * Disable CFI checks.
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              /* Load/store operations (32 bit). */
 -        case INDEX_op_ld8u_i32:
 +        CASE_32_64(ld8u)
              t0 = *tb_ptr++;
              t1 = tci_read_r(regs, &tb_ptr);
              t2 = tci_read_s32(&tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              /* Load/store operations (64 bit). */
 -        case INDEX_op_ld8u_i64:
 -            t0 = *tb_ptr++;
 -            t1 = tci_read_r(regs, &tb_ptr);
 -            t2 = tci_read_s32(&tb_ptr);
 -            tci_write_reg(regs, t0, *(uint8_t *)(t1 + t2));
 -            break;
          case INDEX_op_ld8s_i64:
              t0 = *tb_ptr++;
              t1 = tci_read_r(regs, &tb_ptr);
 --
-.25.1
+.43.0

-[PULL 12/46] tcg/tci: Inline tci_write_reg64 into 64-bit callers
+[PULL 63/72] target/hexagon: Use float32_muladd for helper_sffms
-Note that we had two functions of the same name: a 32-bit version
+There are no special cases for this instruction.  Since hexagon
-which took two register numbers and a 64-bit version which was a
+always uses default-nan mode, explicitly negating the first
-no-op wrapper for tcg_write_reg.  After this, we are left with
+input is unnecessary.  Use float_muladd_negate_product instead.
 only the 32-bit version.
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c | 60 +++++++++++++++++++++++++------------------------------
+ target/hexagon/op_helper.c | 5 ++---
-file changed, 27 insertions(+), 33 deletions(-)
+file changed, 2 insertions(+), 3 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
+diff --git a/target/hexagon/op_helper.c b/target/hexagon/op_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/target/hexagon/op_helper.c
-+++ b/tcg/tci.c
++++ b/target/hexagon/op_helper.c
-@@ -XXX,XX +XXX,XX @@ static void tci_write_reg64(tcg_target_ulong *regs, uint32_t high_index,
+@@ -XXX,XX +XXX,XX @@ float32 HELPER(sffma_sc)(CPUHexagonState *env, float32 RxV,
-     tci_write_reg(regs, low_index, value);
+ float32 HELPER(sffms)(CPUHexagonState *env, float32 RxV,
-     tci_write_reg(regs, high_index, value >> 32);
+                       float32 RsV, float32 RtV)
  {
 -    float32 neg_RsV;
      arch_fpop_start(env);
 -    neg_RsV = float32_set_sign(RsV, float32_is_neg(RsV) ? 0 : 1);
 -    RxV = internal_fmafx(neg_RsV, RtV, RxV, 0, &env->fp_status);
 +    RxV = float32_muladd(RsV, RtV, RxV, float_muladd_negate_product,
 +                         &env->fp_status);
      arch_fpop_end(env);
      return RxV;
  }
--#elif TCG_TARGET_REG_BITS == 64
--static void
--tci_write_reg64(tcg_target_ulong *regs, TCGReg index, uint64_t value)
--{
--    tci_write_reg(regs, index, value);
--}
- #endif
- #if TCG_TARGET_REG_BITS == 32
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t1 = tci_read_r64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
-             condition = *tb_ptr++;
--            tci_write_reg64(regs, t0, tci_compare64(t1, t2, condition));
-+            tci_write_reg(regs, t0, tci_compare64(t1, t2, condition));
-             break;
- #endif
-         case INDEX_op_mov_i32:
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-         case INDEX_op_mov_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
-         case INDEX_op_tci_movi_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_i64(&tb_ptr);
--            tci_write_reg64(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
-             /* Load/store operations (64 bit). */
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t0 = *tb_ptr++;
-             t1 = tci_read_r(regs, &tb_ptr);
-             t2 = tci_read_s32(&tb_ptr);
--            tci_write_reg64(regs, t0, *(uint64_t *)(t1 + t2));
-+            tci_write_reg(regs, t0, *(uint64_t *)(t1 + t2));
-             break;
-         case INDEX_op_st8_i64:
-             t0 = tci_read_r8(regs, &tb_ptr);
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1 + t2);
-+            tci_write_reg(regs, t0, t1 + t2);
-             break;
-         case INDEX_op_sub_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1 - t2);
-+            tci_write_reg(regs, t0, t1 - t2);
-             break;
-         case INDEX_op_mul_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1 * t2);
-+            tci_write_reg(regs, t0, t1 * t2);
-             break;
- #if TCG_TARGET_HAS_div_i64
-         case INDEX_op_div_i64:
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1 & t2);
-+            tci_write_reg(regs, t0, t1 & t2);
-             break;
-         case INDEX_op_or_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1 | t2);
-+            tci_write_reg(regs, t0, t1 | t2);
-             break;
-         case INDEX_op_xor_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1 ^ t2);
-+            tci_write_reg(regs, t0, t1 ^ t2);
-             break;
-             /* Shift/rotate operations (64 bit). */
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1 << (t2 & 63));
-+            tci_write_reg(regs, t0, t1 << (t2 & 63));
-             break;
-         case INDEX_op_shr_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1 >> (t2 & 63));
-+            tci_write_reg(regs, t0, t1 >> (t2 & 63));
-             break;
-         case INDEX_op_sar_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, ((int64_t)t1 >> (t2 & 63)));
-+            tci_write_reg(regs, t0, ((int64_t)t1 >> (t2 & 63)));
-             break;
- #if TCG_TARGET_HAS_rot_i64
-         case INDEX_op_rotl_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, rol64(t1, t2 & 63));
-+            tci_write_reg(regs, t0, rol64(t1, t2 & 63));
-             break;
-         case INDEX_op_rotr_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, ror64(t1, t2 & 63));
-+            tci_write_reg(regs, t0, ror64(t1, t2 & 63));
-             break;
- #endif
- #if TCG_TARGET_HAS_deposit_i64
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             tmp16 = *tb_ptr++;
-             tmp8 = *tb_ptr++;
-             tmp64 = (((1ULL << tmp8) - 1) << tmp16);
--            tci_write_reg64(regs, t0, (t1 & ~tmp64) | ((t2 << tmp16) & tmp64));
-+            tci_write_reg(regs, t0, (t1 & ~tmp64) | ((t2 << tmp16) & tmp64));
-             break;
- #endif
-         case INDEX_op_brcond_i64:
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-         case INDEX_op_ext8u_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r8(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
- #endif
- #if TCG_TARGET_HAS_ext8s_i64
-         case INDEX_op_ext8s_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r8s(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
- #endif
- #if TCG_TARGET_HAS_ext16s_i64
-         case INDEX_op_ext16s_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r16s(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
- #endif
- #if TCG_TARGET_HAS_ext16u_i64
-         case INDEX_op_ext16u_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r16(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
- #endif
- #if TCG_TARGET_HAS_ext32s_i64
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-         case INDEX_op_ext_i32_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r32s(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
- #if TCG_TARGET_HAS_ext32u_i64
-         case INDEX_op_ext32u_i64:
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-         case INDEX_op_extu_i32_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r32(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
- #if TCG_TARGET_HAS_bswap16_i64
-         case INDEX_op_bswap16_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r16(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, bswap16(t1));
-+            tci_write_reg(regs, t0, bswap16(t1));
-             break;
- #endif
- #if TCG_TARGET_HAS_bswap32_i64
-         case INDEX_op_bswap32_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r32(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, bswap32(t1));
-+            tci_write_reg(regs, t0, bswap32(t1));
-             break;
- #endif
- #if TCG_TARGET_HAS_bswap64_i64
-         case INDEX_op_bswap64_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, bswap64(t1));
-+            tci_write_reg(regs, t0, bswap64(t1));
-             break;
- #endif
- #if TCG_TARGET_HAS_not_i64
-         case INDEX_op_not_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, ~t1);
-+            tci_write_reg(regs, t0, ~t1);
-             break;
- #endif
- #if TCG_TARGET_HAS_neg_i64
-         case INDEX_op_neg_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, -t1);
-+            tci_write_reg(regs, t0, -t1);
-             break;
- #endif
- #endif /* TCG_TARGET_REG_BITS == 64 */
 --
-.25.1
+.43.0

-[PULL 07/46] tcg/tci: Implement INDEX_op_ld8s_i64
+[PULL 64/72] target/hexagon: Use float32_muladd_scalbn for helper_sffma_sc
-From: Stefan Weil <sw@weilnetz.de>
+This instruction has a special case that 0 * x + c returns c
 without the normal sign folding that comes with 0 + -0.
 Use the new float_muladd_suppress_add_product_zero to
 describe this.
-That TCG opcode is used by debian-buster (arm64) running ffmpeg:
+Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
     qemu-aarch64 /usr/bin/ffmpeg -i theora.mkv theora.webm
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reported-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Stefan Weil <sw@weilnetz.de>
 Message-Id: <20210128020425.2055454-1-sw@weilnetz.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c | 5 ++++-
+ target/hexagon/op_helper.c | 11 +++--------
-file changed, 4 insertions(+), 1 deletion(-)
+file changed, 3 insertions(+), 8 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
+diff --git a/target/hexagon/op_helper.c b/target/hexagon/op_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/target/hexagon/op_helper.c
-+++ b/tcg/tci.c
++++ b/target/hexagon/op_helper.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+@@ -XXX,XX +XXX,XX @@ static float32 check_nan(float32 dst, float32 x, float_status *fp_status)
-             tci_write_reg8(regs, t0, *(uint8_t *)(t1 + t2));
+ float32 HELPER(sffma_sc)(CPUHexagonState *env, float32 RxV,
-             break;
+                          float32 RsV, float32 RtV, float32 PuV)
-         case INDEX_op_ld8s_i64:
+ {
--            TODO();
+-    size4s_t tmp;
-+            t0 = *tb_ptr++;
+     arch_fpop_start(env);
-+            t1 = tci_read_r(regs, &tb_ptr);
+-    RxV = check_nan(RxV, RxV, &env->fp_status);
-+            t2 = tci_read_s32(&tb_ptr);
+-    RxV = check_nan(RxV, RsV, &env->fp_status);
-+            tci_write_reg(regs, t0, *(int8_t *)(t1 + t2));
+-    RxV = check_nan(RxV, RtV, &env->fp_status);
-             break;
+-    tmp = internal_fmafx(RsV, RtV, RxV, fSXTN(8, 64, PuV), &env->fp_status);
-         case INDEX_op_ld16u_i64:
+-    if (!(float32_is_zero(RxV) && is_zero_prod(RsV, RtV))) {
-             t0 = *tb_ptr++;
+-        RxV = tmp;
 -    }
 +    RxV = float32_muladd_scalbn(RsV, RtV, RxV, fSXTN(8, 64, PuV),
 +                                float_muladd_suppress_add_product_zero,
 +                                &env->fp_status);
      arch_fpop_end(env);
      return RxV;
  }
 --
-.25.1
+.43.0

-[PULL 39/46] cpu: move do_unaligned_access to tcg_ops
+[PULL 65/72] target/hexagon: Use float32_muladd for helper_sffm[as]_lib
-From: Claudio Fontana <cfontana@suse.de>
+There are multiple special cases for this instruction.
 (1) The saturate to normal maximum instead of overflow to infinity is
     handled by the new float_round_nearest_even_max rounding mode.
 (2) The 0 * n + c special case is handled by the new
     float_muladd_suppress_add_product_zero flag.
 (3) The Inf - Inf -> 0 special case can be detected after the fact
     by examining float_flag_invalid_isi.
-make it consistently SOFTMMU-only.
+Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
 Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 [claudio: make the field presence in cpu.h unconditional, removing the ifdefs]
 Message-Id: <20210204163931.7358-12-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h           | 13 +++++++------
+ target/hexagon/op_helper.c | 105 +++++++++----------------------------
- target/alpha/cpu.c              |  2 +-
+file changed, 26 insertions(+), 79 deletions(-)
  target/arm/cpu.c                |  2 +-
  target/hppa/cpu.c               |  4 +++-
  target/microblaze/cpu.c         |  2 +-
  target/mips/cpu.c               |  3 ++-
  target/nios2/cpu.c              |  2 +-
  target/riscv/cpu.c              |  2 +-
  target/s390x/cpu.c              |  2 +-
  target/s390x/excp_helper.c      |  2 +-
  target/sh4/cpu.c                |  2 +-
  target/sparc/cpu.c              |  2 +-
  target/xtensa/cpu.c             |  2 +-
  target/ppc/translate_init.c.inc |  2 +-
 files changed, 23 insertions(+), 19 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
+diff --git a/target/hexagon/op_helper.c b/target/hexagon/op_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
+--- a/target/hexagon/op_helper.c
-+++ b/include/hw/core/cpu.h
++++ b/target/hexagon/op_helper.c
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
+@@ -XXX,XX +XXX,XX @@ float32 HELPER(sffma)(CPUHexagonState *env, float32 RxV,
-                                   unsigned size, MMUAccessType access_type,
+     return RxV;
-                                   int mmu_idx, MemTxAttrs attrs,
+ }
-                                   MemTxResult response, uintptr_t retaddr);
-+    /**
+-static bool is_zero_prod(float32 a, float32 b)
-+     * @do_unaligned_access: Callback for unaligned access handling
+-{
-+     */
+-    return ((float32_is_zero(a) && is_finite(b)) ||
-+    void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
+-            (float32_is_zero(b) && is_finite(a)));
-+                                MMUAccessType access_type,
+-}
-+                                int mmu_idx, uintptr_t retaddr);
+-
- } TcgCpuOperations;
+-static float32 check_nan(float32 dst, float32 x, float_status *fp_status)
+-{
- /**
+-    float32 ret = dst;
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
+-    if (float32_is_any_nan(x)) {
-  * @parse_features: Callback to parse command line arguments.
+-        if (extract32(x, 22, 1) == 0) {
-  * @reset_dump_flags: #CPUDumpFlags to use for reset logging.
+-            float_raise(float_flag_invalid, fp_status);
-  * @has_work: Callback for checking if there is work to do.
+-        }
-- * @do_unaligned_access: Callback for unaligned access handling, if
+-        ret = make_float32(0xffffffff);    /* nan */
-- * the target defines #TARGET_ALIGNED_ONLY.
+-    }
-  * @virtio_is_big_endian: Callback to return %true if a CPU which supports
+-    return ret;
-  * runtime configurable endianness is currently big-endian. Non-configurable
+-}
-  * CPUs can use the default implementation of this method. This method should
+-
-@@ -XXX,XX +XXX,XX @@ struct CPUClass {
+ float32 HELPER(sffma_sc)(CPUHexagonState *env, float32 RxV,
+                          float32 RsV, float32 RtV, float32 PuV)
      int reset_dump_flags;
      bool (*has_work)(CPUState *cpu);
 -    void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
 -                                MMUAccessType access_type,
 -                                int mmu_idx, uintptr_t retaddr);
      bool (*virtio_is_big_endian)(CPUState *cpu);
      int (*memory_rw_debug)(CPUState *cpu, vaddr addr,
                             uint8_t *buf, int len, bool is_write);
@@ -XXX,XX +XXX,XX @@ static inline void cpu_unaligned_access(CPUState *cpu, vaddr addr,
  {
-     CPUClass *cc = CPU_GET_CLASS(cpu);
+@@ -XXX,XX +XXX,XX @@ float32 HELPER(sffms)(CPUHexagonState *env, float32 RxV,
+     return RxV;
 -    cc->do_unaligned_access(cpu, addr, access_type, mmu_idx, retaddr);
 +    cc->tcg_ops.do_unaligned_access(cpu, addr, access_type, mmu_idx, retaddr);
  }
- static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
+-static bool is_inf_prod(int32_t a, int32_t b)
-diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
++static float32 do_sffma_lib(CPUHexagonState *env, float32 RxV,
-index XXXXXXX..XXXXXXX 100644
++                            float32 RsV, float32 RtV, int negate)
---- a/target/alpha/cpu.c
+ {
-+++ b/target/alpha/cpu.c
+-    return (float32_is_infinity(a) && float32_is_infinity(b)) ||
-@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
+-           (float32_is_infinity(a) && is_finite(b) && !float32_is_zero(b)) ||
-     cc->tcg_ops.tlb_fill = alpha_cpu_tlb_fill;
+-           (float32_is_infinity(b) && is_finite(a) && !float32_is_zero(a));
- #ifndef CONFIG_USER_ONLY
++    int flags;
-     cc->tcg_ops.do_transaction_failed = alpha_cpu_do_transaction_failed;
++
--    cc->do_unaligned_access = alpha_cpu_do_unaligned_access;
++    arch_fpop_start(env);
-+    cc->tcg_ops.do_unaligned_access = alpha_cpu_do_unaligned_access;
++
-     cc->get_phys_page_debug = alpha_cpu_get_phys_page_debug;
++    set_float_rounding_mode(float_round_nearest_even_max, &env->fp_status);
-     dc->vmsd = &vmstate_alpha_cpu;
++    RxV = float32_muladd(RsV, RtV, RxV,
- #endif
++                         negate | float_muladd_suppress_add_product_zero,
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
++                         &env->fp_status);
-index XXXXXXX..XXXXXXX 100644
++
---- a/target/arm/cpu.c
++    flags = get_float_exception_flags(&env->fp_status);
-+++ b/target/arm/cpu.c
++    if (flags) {
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
++        /* Flags are suppressed by this instruction. */
-     cc->tcg_ops.tlb_fill = arm_cpu_tlb_fill;
++        set_float_exception_flags(0, &env->fp_status);
-     cc->tcg_ops.debug_excp_handler = arm_debug_excp_handler;
++
-     cc->debug_check_watchpoint = arm_debug_check_watchpoint;
++        /* Return 0 for Inf - Inf. */
--    cc->do_unaligned_access = arm_cpu_do_unaligned_access;
++        if (flags & float_flag_invalid_isi) {
- #if !defined(CONFIG_USER_ONLY)
++            RxV = 0;
-     cc->tcg_ops.do_transaction_failed = arm_cpu_do_transaction_failed;
++        }
-+    cc->tcg_ops.do_unaligned_access = arm_cpu_do_unaligned_access;
++    }
-     cc->adjust_watchpoint_address = arm_adjust_watchpoint_address;
++
-     cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
++    arch_fpop_end(env);
- #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
++    return RxV;
 diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hppa/cpu.c
 +++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_disas_set_info(CPUState *cs, disassemble_info *info)
      info->print_insn = print_insn_hppa;
  }
-+#ifndef CONFIG_USER_ONLY
+ float32 HELPER(sffma_lib)(CPUHexagonState *env, float32 RxV,
- static void hppa_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
+                           float32 RsV, float32 RtV)
-                                          MMUAccessType access_type,
+ {
-                                          int mmu_idx, uintptr_t retaddr)
+-    bool infinp;
-@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
+-    bool infminusinf;
+-    float32 tmp;
-     cpu_loop_exit_restore(cs, retaddr);
+-
 -    arch_fpop_start(env);
 -    set_float_rounding_mode(float_round_nearest_even, &env->fp_status);
 -    infminusinf = float32_is_infinity(RxV) &&
 -                  is_inf_prod(RsV, RtV) &&
 -                  (fGETBIT(31, RsV ^ RxV ^ RtV) != 0);
 -    infinp = float32_is_infinity(RxV) ||
 -             float32_is_infinity(RtV) ||
 -             float32_is_infinity(RsV);
 -    RxV = check_nan(RxV, RxV, &env->fp_status);
 -    RxV = check_nan(RxV, RsV, &env->fp_status);
 -    RxV = check_nan(RxV, RtV, &env->fp_status);
 -    tmp = internal_fmafx(RsV, RtV, RxV, 0, &env->fp_status);
 -    if (!(float32_is_zero(RxV) && is_zero_prod(RsV, RtV))) {
 -        RxV = tmp;
 -    }
 -    set_float_exception_flags(0, &env->fp_status);
 -    if (float32_is_infinity(RxV) && !infinp) {
 -        RxV = RxV - 1;
 -    }
 -    if (infminusinf) {
 -        RxV = 0;
 -    }
 -    arch_fpop_end(env);
 -    return RxV;
 +    return do_sffma_lib(env, RxV, RsV, RtV, 0);
  }
-+#endif /* CONFIG_USER_ONLY */
+ float32 HELPER(sffms_lib)(CPUHexagonState *env, float32 RxV,
- static void hppa_cpu_realizefn(DeviceState *dev, Error **errp)
+                           float32 RsV, float32 RtV)
  {
-@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
+-    bool infinp;
-     cc->tcg_ops.tlb_fill = hppa_cpu_tlb_fill;
+-    bool infminusinf;
- #ifndef CONFIG_USER_ONLY
+-    float32 tmp;
-     cc->get_phys_page_debug = hppa_cpu_get_phys_page_debug;
+-
-+    cc->tcg_ops.do_unaligned_access = hppa_cpu_do_unaligned_access;
+-    arch_fpop_start(env);
-     dc->vmsd = &vmstate_hppa_cpu;
+-    set_float_rounding_mode(float_round_nearest_even, &env->fp_status);
- #endif
+-    infminusinf = float32_is_infinity(RxV) &&
--    cc->do_unaligned_access = hppa_cpu_do_unaligned_access;
+-                  is_inf_prod(RsV, RtV) &&
-     cc->disas_set_info = hppa_cpu_disas_set_info;
+-                  (fGETBIT(31, RsV ^ RxV ^ RtV) == 0);
-     cc->tcg_ops.initialize = hppa_translate_init;
+-    infinp = float32_is_infinity(RxV) ||
+-             float32_is_infinity(RtV) ||
-diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
+-             float32_is_infinity(RsV);
-index XXXXXXX..XXXXXXX 100644
+-    RxV = check_nan(RxV, RxV, &env->fp_status);
---- a/target/microblaze/cpu.c
+-    RxV = check_nan(RxV, RsV, &env->fp_status);
-+++ b/target/microblaze/cpu.c
+-    RxV = check_nan(RxV, RtV, &env->fp_status);
-@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
+-    float32 minus_RsV = float32_sub(float32_zero, RsV, &env->fp_status);
-     cc->class_by_name = mb_cpu_class_by_name;
+-    tmp = internal_fmafx(minus_RsV, RtV, RxV, 0, &env->fp_status);
-     cc->has_work = mb_cpu_has_work;
+-    if (!(float32_is_zero(RxV) && is_zero_prod(RsV, RtV))) {
-     cc->tcg_ops.do_interrupt = mb_cpu_do_interrupt;
+-        RxV = tmp;
--    cc->do_unaligned_access = mb_cpu_do_unaligned_access;
+-    }
-     cc->tcg_ops.cpu_exec_interrupt = mb_cpu_exec_interrupt;
+-    set_float_exception_flags(0, &env->fp_status);
-     cc->dump_state = mb_cpu_dump_state;
+-    if (float32_is_infinity(RxV) && !infinp) {
-     cc->set_pc = mb_cpu_set_pc;
+-        RxV = RxV - 1;
-@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
+-    }
-     cc->tcg_ops.tlb_fill = mb_cpu_tlb_fill;
+-    if (infminusinf) {
- #ifndef CONFIG_USER_ONLY
+-        RxV = 0;
-     cc->tcg_ops.do_transaction_failed = mb_cpu_transaction_failed;
+-    }
-+    cc->tcg_ops.do_unaligned_access = mb_cpu_do_unaligned_access;
+-    arch_fpop_end(env);
-     cc->get_phys_page_attrs_debug = mb_cpu_get_phys_page_attrs_debug;
+-    return RxV;
-     dc->vmsd = &vmstate_mb_cpu;
++    return do_sffma_lib(env, RxV, RsV, RtV, float_muladd_negate_product);
  #endif
 diff --git a/target/mips/cpu.c b/target/mips/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/cpu.c
 +++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
      cc->gdb_read_register = mips_cpu_gdb_read_register;
      cc->gdb_write_register = mips_cpu_gdb_write_register;
  #ifndef CONFIG_USER_ONLY
 -    cc->do_unaligned_access = mips_cpu_do_unaligned_access;
      cc->get_phys_page_debug = mips_cpu_get_phys_page_debug;
      cc->vmsd = &vmstate_mips_cpu;
  #endif
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
      cc->tcg_ops.tlb_fill = mips_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->tcg_ops.do_transaction_failed = mips_cpu_do_transaction_failed;
 +    cc->tcg_ops.do_unaligned_access = mips_cpu_do_unaligned_access;
 +
  #endif /* CONFIG_USER_ONLY */
  #endif /* CONFIG_TCG */
 diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/nios2/cpu.c
 +++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
      cc->disas_set_info = nios2_cpu_disas_set_info;
      cc->tcg_ops.tlb_fill = nios2_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
 -    cc->do_unaligned_access = nios2_cpu_do_unaligned_access;
 +    cc->tcg_ops.do_unaligned_access = nios2_cpu_do_unaligned_access;
      cc->get_phys_page_debug = nios2_cpu_get_phys_page_debug;
  #endif
      cc->gdb_read_register = nios2_cpu_gdb_read_register;
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
      cc->disas_set_info = riscv_cpu_disas_set_info;
  #ifndef CONFIG_USER_ONLY
      cc->tcg_ops.do_transaction_failed = riscv_cpu_do_transaction_failed;
 -    cc->do_unaligned_access = riscv_cpu_do_unaligned_access;
 +    cc->tcg_ops.do_unaligned_access = riscv_cpu_do_unaligned_access;
      cc->get_phys_page_debug = riscv_cpu_get_phys_page_debug;
      /* For now, mark unmigratable: */
      cc->vmsd = &vmstate_riscv_cpu;
 diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/cpu.c
 +++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
  #ifdef CONFIG_TCG
      cc->tcg_ops.cpu_exec_interrupt = s390_cpu_exec_interrupt;
      cc->tcg_ops.debug_excp_handler = s390x_cpu_debug_excp_handler;
 -    cc->do_unaligned_access = s390x_cpu_do_unaligned_access;
 +    cc->tcg_ops.do_unaligned_access = s390x_cpu_do_unaligned_access;
  #endif
  #endif
      cc->disas_set_info = s390_cpu_disas_set_info;
 diff --git a/target/s390x/excp_helper.c b/target/s390x/excp_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/excp_helper.c
 +++ b/target/s390x/excp_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(monitor_call)(CPUS390XState *env, uint64_t monitor_code,
      }
  }
--#endif /* CONFIG_USER_ONLY */
+ float64 HELPER(dfmpyfix)(CPUHexagonState *env, float64 RssV, float64 RttV)
 +#endif /* !CONFIG_USER_ONLY */
 diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sh4/cpu.c
 +++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
      cc->gdb_write_register = superh_cpu_gdb_write_register;
      cc->tcg_ops.tlb_fill = superh_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
 -    cc->do_unaligned_access = superh_cpu_do_unaligned_access;
 +    cc->tcg_ops.do_unaligned_access = superh_cpu_do_unaligned_access;
      cc->get_phys_page_debug = superh_cpu_get_phys_page_debug;
  #endif
      cc->disas_set_info = superh_cpu_disas_set_info;
 diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sparc/cpu.c
 +++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
      cc->tcg_ops.tlb_fill = sparc_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->tcg_ops.do_transaction_failed = sparc_cpu_do_transaction_failed;
 -    cc->do_unaligned_access = sparc_cpu_do_unaligned_access;
 +    cc->tcg_ops.do_unaligned_access = sparc_cpu_do_unaligned_access;
      cc->get_phys_page_debug = sparc_cpu_get_phys_page_debug;
      cc->vmsd = &vmstate_sparc_cpu;
  #endif
 diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/xtensa/cpu.c
 +++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
      cc->gdb_stop_before_watchpoint = true;
      cc->tcg_ops.tlb_fill = xtensa_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
 -    cc->do_unaligned_access = xtensa_cpu_do_unaligned_access;
 +    cc->tcg_ops.do_unaligned_access = xtensa_cpu_do_unaligned_access;
      cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
      cc->tcg_ops.do_transaction_failed = xtensa_cpu_do_transaction_failed;
  #endif
 diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/ppc/translate_init.c.inc
 +++ b/target/ppc/translate_init.c.inc
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
      cc->set_pc = ppc_cpu_set_pc;
      cc->gdb_read_register = ppc_cpu_gdb_read_register;
      cc->gdb_write_register = ppc_cpu_gdb_write_register;
 -    cc->do_unaligned_access = ppc_cpu_do_unaligned_access;
  #ifndef CONFIG_USER_ONLY
      cc->get_phys_page_debug = ppc_cpu_get_phys_page_debug;
      cc->vmsd = &vmstate_ppc_cpu;
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
  #ifndef CONFIG_USER_ONLY
      cc->tcg_ops.cpu_exec_enter = ppc_cpu_exec_enter;
      cc->tcg_ops.cpu_exec_exit = ppc_cpu_exec_exit;
 +    cc->tcg_ops.do_unaligned_access = ppc_cpu_do_unaligned_access;
  #endif /* !CONFIG_USER_ONLY */
  #endif /* CONFIG_TCG */
 --
-.25.1
+.43.0

-[PULL 06/46] tcg/tci: Implement INDEX_op_ld16s_i32
+[PULL 66/72] target/hexagon: Remove internal_fmafx
-From: Stefan Weil <sw@weilnetz.de>
+The function is now unused.
-That TCG opcode is used by debian-buster (arm64) running ffmpeg:
+Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
     qemu-aarch64 /usr/bin/ffmpeg -i theora.mkv theora.webm
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reported-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Stefan Weil <sw@weilnetz.de>
 Message-Id: <20210128024814.2056958-1-sw@weilnetz.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c | 5 ++++-
+ target/hexagon/fma_emu.h |   2 -
-file changed, 4 insertions(+), 1 deletion(-)
+ target/hexagon/fma_emu.c | 171 ---------------------------------------
 files changed, 173 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
+diff --git a/target/hexagon/fma_emu.h b/target/hexagon/fma_emu.h
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/target/hexagon/fma_emu.h
-+++ b/tcg/tci.c
++++ b/target/hexagon/fma_emu.h
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+@@ -XXX,XX +XXX,XX @@ static inline uint32_t float32_getexp_raw(float32 f32)
-             TODO();
+ }
-             break;
+ int32_t float32_getexp(float32 f32);
-         case INDEX_op_ld16s_i32:
+ float32 infinite_float32(uint8_t sign);
--            TODO();
+-float32 internal_fmafx(float32 a, float32 b, float32 c,
-+            t0 = *tb_ptr++;
+-                       int scale, float_status *fp_status);
-+            t1 = tci_read_r(regs, &tb_ptr);
+ float64 internal_mpyhh(float64 a, float64 b,
-+            t2 = tci_read_s32(&tb_ptr);
+                        unsigned long long int accumulated,
-+            tci_write_reg(regs, t0, *(int16_t *)(t1 + t2));
+                        float_status *fp_status);
-             break;
+diff --git a/target/hexagon/fma_emu.c b/target/hexagon/fma_emu.c
-         case INDEX_op_ld_i32:
+index XXXXXXX..XXXXXXX 100644
-             t0 = *tb_ptr++;
+--- a/target/hexagon/fma_emu.c
 +++ b/target/hexagon/fma_emu.c
@@ -XXX,XX +XXX,XX @@ int32_t float64_getexp(float64 f64)
      return -1;
  }
 -static uint64_t float32_getmant(float32 f32)
 -{
 -    Float a = { .i = f32 };
 -    if (float32_is_normal(f32)) {
 -        return a.mant | 1ULL << 23;
 -    }
 -    if (float32_is_zero(f32)) {
 -        return 0;
 -    }
 -    if (float32_is_denormal(f32)) {
 -        return a.mant;
 -    }
 -    return ~0ULL;
 -}
 -
  int32_t float32_getexp(float32 f32)
  {
      Float a = { .i = f32 };
@@ -XXX,XX +XXX,XX @@ float32 infinite_float32(uint8_t sign)
  }
  /* Return a maximum finite value with the requested sign */
 -static float32 maxfinite_float32(uint8_t sign)
 -{
 -    if (sign) {
 -        return make_float32(SF_MINUS_MAXF);
 -    } else {
 -        return make_float32(SF_MAXF);
 -    }
 -}
 -
 -/* Return a zero value with requested sign */
 -static float32 zero_float32(uint8_t sign)
 -{
 -    if (sign) {
 -        return make_float32(0x80000000);
 -    } else {
 -        return float32_zero;
 -    }
 -}
 -
  #define GEN_XF_ROUND(SUFFIX, MANTBITS, INF_EXP, INTERNAL_TYPE) \
  static SUFFIX accum_round_##SUFFIX(Accum a, float_status * fp_status) \
  { \
@@ -XXX,XX +XXX,XX @@ static SUFFIX accum_round_##SUFFIX(Accum a, float_status * fp_status) \
  }
  GEN_XF_ROUND(float64, DF_MANTBITS, DF_INF_EXP, Double)
 -GEN_XF_ROUND(float32, SF_MANTBITS, SF_INF_EXP, Float)
 -
 -static bool is_inf_prod(float64 a, float64 b)
 -{
 -    return ((float64_is_infinity(a) && float64_is_infinity(b)) ||
 -            (float64_is_infinity(a) && is_finite(b) && (!float64_is_zero(b))) ||
 -            (float64_is_infinity(b) && is_finite(a) && (!float64_is_zero(a))));
 -}
 -
 -static float64 special_fma(float64 a, float64 b, float64 c,
 -                           float_status *fp_status)
 -{
 -    float64 ret = make_float64(0);
 -
 -    /*
 -     * If A multiplied by B is an exact infinity and C is also an infinity
 -     * but with the opposite sign, FMA returns NaN and raises invalid.
 -     */
 -    uint8_t a_sign = float64_is_neg(a);
 -    uint8_t b_sign = float64_is_neg(b);
 -    uint8_t c_sign = float64_is_neg(c);
 -    if (is_inf_prod(a, b) && float64_is_infinity(c)) {
 -        if ((a_sign ^ b_sign) != c_sign) {
 -            ret = make_float64(DF_NAN);
 -            float_raise(float_flag_invalid, fp_status);
 -            return ret;
 -        }
 -    }
 -    if ((float64_is_infinity(a) && float64_is_zero(b)) ||
 -        (float64_is_zero(a) && float64_is_infinity(b))) {
 -        ret = make_float64(DF_NAN);
 -        float_raise(float_flag_invalid, fp_status);
 -        return ret;
 -    }
 -    /*
 -     * If none of the above checks are true and C is a NaN,
 -     * a NaN shall be returned
 -     * If A or B are NaN, a NAN shall be returned.
 -     */
 -    if (float64_is_any_nan(a) ||
 -        float64_is_any_nan(b) ||
 -        float64_is_any_nan(c)) {
 -        if (float64_is_any_nan(a) && (fGETBIT(51, a) == 0)) {
 -            float_raise(float_flag_invalid, fp_status);
 -        }
 -        if (float64_is_any_nan(b) && (fGETBIT(51, b) == 0)) {
 -            float_raise(float_flag_invalid, fp_status);
 -        }
 -        if (float64_is_any_nan(c) && (fGETBIT(51, c) == 0)) {
 -            float_raise(float_flag_invalid, fp_status);
 -        }
 -        ret = make_float64(DF_NAN);
 -        return ret;
 -    }
 -    /*
 -     * We have checked for adding opposite-signed infinities.
 -     * Other infinities return infinity with the correct sign
 -     */
 -    if (float64_is_infinity(c)) {
 -        ret = infinite_float64(c_sign);
 -        return ret;
 -    }
 -    if (float64_is_infinity(a) || float64_is_infinity(b)) {
 -        ret = infinite_float64(a_sign ^ b_sign);
 -        return ret;
 -    }
 -    g_assert_not_reached();
 -}
 -
 -static float32 special_fmaf(float32 a, float32 b, float32 c,
 -                            float_status *fp_status)
 -{
 -    float64 aa, bb, cc;
 -    aa = float32_to_float64(a, fp_status);
 -    bb = float32_to_float64(b, fp_status);
 -    cc = float32_to_float64(c, fp_status);
 -    return float64_to_float32(special_fma(aa, bb, cc, fp_status), fp_status);
 -}
 -
 -float32 internal_fmafx(float32 a, float32 b, float32 c, int scale,
 -                       float_status *fp_status)
 -{
 -    Accum prod;
 -    Accum acc;
 -    Accum result;
 -    accum_init(&prod);
 -    accum_init(&acc);
 -    accum_init(&result);
 -
 -    uint8_t a_sign = float32_is_neg(a);
 -    uint8_t b_sign = float32_is_neg(b);
 -    uint8_t c_sign = float32_is_neg(c);
 -    if (float32_is_infinity(a) ||
 -        float32_is_infinity(b) ||
 -        float32_is_infinity(c)) {
 -        return special_fmaf(a, b, c, fp_status);
 -    }
 -    if (float32_is_any_nan(a) ||
 -        float32_is_any_nan(b) ||
 -        float32_is_any_nan(c)) {
 -        return special_fmaf(a, b, c, fp_status);
 -    }
 -    if ((scale == 0) && (float32_is_zero(a) || float32_is_zero(b))) {
 -        float32 tmp = float32_mul(a, b, fp_status);
 -        tmp = float32_add(tmp, c, fp_status);
 -        return tmp;
 -    }
 -
 -    /* (a * 2**b) * (c * 2**d) == a*c * 2**(b+d) */
 -    prod.mant = int128_mul_6464(float32_getmant(a), float32_getmant(b));
 -
 -    /*
 -     * Note: extracting the mantissa into an int is multiplying by
 -     * 2**23, so adjust here
 -     */
 -    prod.exp = float32_getexp(a) + float32_getexp(b) - SF_BIAS - 23;
 -    prod.sign = a_sign ^ b_sign;
 -    if (float32_is_zero(a) || float32_is_zero(b)) {
 -        prod.exp = -2 * WAY_BIG_EXP;
 -    }
 -    if ((scale > 0) && float32_is_denormal(c)) {
 -        acc.mant = int128_mul_6464(0, 0);
 -        acc.exp = -WAY_BIG_EXP;
 -        acc.sign = c_sign;
 -        acc.sticky = 1;
 -        result = accum_add(prod, acc);
 -    } else if (!float32_is_zero(c)) {
 -        acc.mant = int128_mul_6464(float32_getmant(c), 1);
 -        acc.exp = float32_getexp(c);
 -        acc.sign = c_sign;
 -        result = accum_add(prod, acc);
 -    } else {
 -        result = prod;
 -    }
 -    result.exp += scale;
 -    return accum_round_float32(result, fp_status);
 -}
  float64 internal_mpyhh(float64 a, float64 b,
                        unsigned long long int accumulated,
 --
-.25.1
+.43.0

-[PULL 33/46] cpu: Move cpu_exec_* to tcg_ops
+[PULL 67/72] target/hexagon: Expand GEN_XF_ROUND
-From: Eduardo Habkost <ehabkost@redhat.com>
+This massive macro is now only used once.
 Expand it for use only by float64.
-Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
+Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
 [claudio: wrapped target code in CONFIG_TCG]
 Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210204163931.7358-6-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h           | 12 ++++++------
+ target/hexagon/fma_emu.c | 255 +++++++++++++++++++--------------------
- accel/tcg/cpu-exec.c            | 12 ++++++------
+file changed, 127 insertions(+), 128 deletions(-)
  target/alpha/cpu.c              |  2 +-
  target/arm/cpu.c                |  2 +-
  target/arm/cpu64.c              |  5 ++++-
  target/arm/cpu_tcg.c            |  7 ++++++-
  target/avr/cpu.c                |  2 +-
  target/cris/cpu.c               |  2 +-
  target/hppa/cpu.c               |  2 +-
  target/i386/tcg/tcg-cpu.c       |  6 +++---
  target/lm32/cpu.c               |  2 +-
  target/m68k/cpu.c               |  2 +-
  target/microblaze/cpu.c         |  2 +-
  target/mips/cpu.c               |  2 +-
  target/nios2/cpu.c              |  2 +-
  target/openrisc/cpu.c           |  2 +-
  target/riscv/cpu.c              |  2 +-
  target/rx/cpu.c                 |  2 +-
  target/s390x/cpu.c              |  2 +-
  target/sh4/cpu.c                |  2 +-
  target/sparc/cpu.c              |  2 +-
  target/tilegx/cpu.c             |  2 +-
  target/unicore32/cpu.c          |  2 +-
  target/xtensa/cpu.c             |  2 +-
  target/ppc/translate_init.c.inc | 16 ++++++++++------
 files changed, 54 insertions(+), 42 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
+diff --git a/target/hexagon/fma_emu.c b/target/hexagon/fma_emu.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
+--- a/target/hexagon/fma_emu.c
-+++ b/include/hw/core/cpu.h
++++ b/target/hexagon/fma_emu.c
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
+@@ -XXX,XX +XXX,XX @@ float32 infinite_float32(uint8_t sign)
       */
      void (*synchronize_from_tb)(CPUState *cpu,
                                  const struct TranslationBlock *tb);
 +    /** @cpu_exec_enter: Callback for cpu_exec preparation */
 +    void (*cpu_exec_enter)(CPUState *cpu);
 +    /** @cpu_exec_exit: Callback for cpu_exec cleanup */
 +    void (*cpu_exec_exit)(CPUState *cpu);
 +    /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
 +    bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
  } TcgCpuOperations;
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
   * @gdb_get_dynamic_xml: Callback to return dynamically generated XML for the
   *   gdb stub. Returns a pointer to the XML contents for the specified XML file
   *   or NULL if the CPU doesn't have a dynamically generated content for it.
 - * @cpu_exec_enter: Callback for cpu_exec preparation.
 - * @cpu_exec_exit: Callback for cpu_exec cleanup.
 - * @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec.
   * @disas_set_info: Setup architecture specific components of disassembly info
   * @adjust_watchpoint_address: Perform a target-specific adjustment to an
   * address before attempting to match it against watchpoints.
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
      const char *gdb_core_xml_file;
      gchar * (*gdb_arch_name)(CPUState *cpu);
      const char * (*gdb_get_dynamic_xml)(CPUState *cpu, const char *xmlname);
 -    void (*cpu_exec_enter)(CPUState *cpu);
 -    void (*cpu_exec_exit)(CPUState *cpu);
 -    bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
      void (*disas_set_info)(CPUState *cpu, disassemble_info *info);
      vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
 diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cpu-exec.c
 +++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static void cpu_exec_enter(CPUState *cpu)
  {
      CPUClass *cc = CPU_GET_CLASS(cpu);
 -    if (cc->cpu_exec_enter) {
 -        cc->cpu_exec_enter(cpu);
 +    if (cc->tcg_ops.cpu_exec_enter) {
 +        cc->tcg_ops.cpu_exec_enter(cpu);
      }
  }
-@@ -XXX,XX +XXX,XX @@ static void cpu_exec_exit(CPUState *cpu)
+ /* Return a maximum finite value with the requested sign */
- {
+-#define GEN_XF_ROUND(SUFFIX, MANTBITS, INF_EXP, INTERNAL_TYPE) \
-     CPUClass *cc = CPU_GET_CLASS(cpu);
+-static SUFFIX accum_round_##SUFFIX(Accum a, float_status * fp_status) \
+-{ \
--    if (cc->cpu_exec_exit) {
+-    if ((int128_gethi(a.mant) == 0) && (int128_getlo(a.mant) == 0) \
--        cc->cpu_exec_exit(cpu);
+-        && ((a.guard | a.round | a.sticky) == 0)) { \
-+    if (cc->tcg_ops.cpu_exec_exit) {
+-        /* result zero */ \
-+        cc->tcg_ops.cpu_exec_exit(cpu);
+-        switch (fp_status->float_rounding_mode) { \
-     }
+-        case float_round_down: \
 -            return zero_##SUFFIX(1); \
 -        default: \
 -            return zero_##SUFFIX(0); \
 -        } \
 -    } \
 -    /* Normalize right */ \
 -    /* We want MANTBITS bits of mantissa plus the leading one. */ \
 -    /* That means that we want MANTBITS+1 bits, or 0x000000000000FF_FFFF */ \
 -    /* So we need to normalize right while the high word is non-zero and \
 -    * while the low word is nonzero when masked with 0xffe0_0000_0000_0000 */ \
 -    while ((int128_gethi(a.mant) != 0) || \
 -           ((int128_getlo(a.mant) >> (MANTBITS + 1)) != 0)) { \
 -        a = accum_norm_right(a, 1); \
 -    } \
 -    /* \
 -     * OK, now normalize left \
 -     * We want to normalize left until we have a leading one in bit 24 \
 -     * Theoretically, we only need to shift a maximum of one to the left if we \
 -     * shifted out lots of bits from B, or if we had no shift / 1 shift sticky \
 -     * should be 0  \
 -     */ \
 -    while ((int128_getlo(a.mant) & (1ULL << MANTBITS)) == 0) { \
 -        a = accum_norm_left(a); \
 -    } \
 -    /* \
 -     * OK, now we might need to denormalize because of potential underflow. \
 -     * We need to do this before rounding, and rounding might make us normal \
 -     * again \
 -     */ \
 -    while (a.exp <= 0) { \
 -        a = accum_norm_right(a, 1 - a.exp); \
 -        /* \
 -         * Do we have underflow? \
 -         * That's when we get an inexact answer because we ran out of bits \
 -         * in a denormal. \
 -         */ \
 -        if (a.guard || a.round || a.sticky) { \
 -            float_raise(float_flag_underflow, fp_status); \
 -        } \
 -    } \
 -    /* OK, we're relatively canonical... now we need to round */ \
 -    if (a.guard || a.round || a.sticky) { \
 -        float_raise(float_flag_inexact, fp_status); \
 -        switch (fp_status->float_rounding_mode) { \
 -        case float_round_to_zero: \
 -            /* Chop and we're done */ \
 -            break; \
 -        case float_round_up: \
 -            if (a.sign == 0) { \
 -                a.mant = int128_add(a.mant, int128_one()); \
 -            } \
 -            break; \
 -        case float_round_down: \
 -            if (a.sign != 0) { \
 -                a.mant = int128_add(a.mant, int128_one()); \
 -            } \
 -            break; \
 -        default: \
 -            if (a.round || a.sticky) { \
 -                /* round up if guard is 1, down if guard is zero */ \
 -                a.mant = int128_add(a.mant, int128_make64(a.guard)); \
 -            } else if (a.guard) { \
 -                /* exactly .5, round up if odd */ \
 -                a.mant = int128_add(a.mant, int128_and(a.mant, int128_one())); \
 -            } \
 -            break; \
 -        } \
 -    } \
 -    /* \
 -     * OK, now we might have carried all the way up. \
 -     * So we might need to shr once \
 -     * at least we know that the lsb should be zero if we rounded and \
 -     * got a carry out... \
 -     */ \
 -    if ((int128_getlo(a.mant) >> (MANTBITS + 1)) != 0) { \
 -        a = accum_norm_right(a, 1); \
 -    } \
 -    /* Overflow? */ \
 -    if (a.exp >= INF_EXP) { \
 -        /* Yep, inf result */ \
 -        float_raise(float_flag_overflow, fp_status); \
 -        float_raise(float_flag_inexact, fp_status); \
 -        switch (fp_status->float_rounding_mode) { \
 -        case float_round_to_zero: \
 -            return maxfinite_##SUFFIX(a.sign); \
 -        case float_round_up: \
 -            if (a.sign == 0) { \
 -                return infinite_##SUFFIX(a.sign); \
 -            } else { \
 -                return maxfinite_##SUFFIX(a.sign); \
 -            } \
 -        case float_round_down: \
 -            if (a.sign != 0) { \
 -                return infinite_##SUFFIX(a.sign); \
 -            } else { \
 -                return maxfinite_##SUFFIX(a.sign); \
 -            } \
 -        default: \
 -            return infinite_##SUFFIX(a.sign); \
 -        } \
 -    } \
 -    /* Underflow? */ \
 -    if (int128_getlo(a.mant) & (1ULL << MANTBITS)) { \
 -        /* Leading one means: No, we're normal. So, we should be done... */ \
 -        INTERNAL_TYPE ret; \
 -        ret.i = 0; \
 -        ret.sign = a.sign; \
 -        ret.exp = a.exp; \
 -        ret.mant = int128_getlo(a.mant); \
 -        return ret.i; \
 -    } \
 -    assert(a.exp == 1); \
 -    INTERNAL_TYPE ret; \
 -    ret.i = 0; \
 -    ret.sign = a.sign; \
 -    ret.exp = 0; \
 -    ret.mant = int128_getlo(a.mant); \
 -    return ret.i; \
 +static float64 accum_round_float64(Accum a, float_status *fp_status)
 +{
 +    if ((int128_gethi(a.mant) == 0) && (int128_getlo(a.mant) == 0)
 +        && ((a.guard | a.round | a.sticky) == 0)) {
 +        /* result zero */
 +        switch (fp_status->float_rounding_mode) {
 +        case float_round_down:
 +            return zero_float64(1);
 +        default:
 +            return zero_float64(0);
 +        }
 +    }
 +    /*
 +     * Normalize right
 +     * We want DF_MANTBITS bits of mantissa plus the leading one.
 +     * That means that we want DF_MANTBITS+1 bits, or 0x000000000000FF_FFFF
 +     * So we need to normalize right while the high word is non-zero and
 +     * while the low word is nonzero when masked with 0xffe0_0000_0000_0000
 +     */
 +    while ((int128_gethi(a.mant) != 0) ||
 +           ((int128_getlo(a.mant) >> (DF_MANTBITS + 1)) != 0)) {
 +        a = accum_norm_right(a, 1);
 +    }
 +    /*
 +     * OK, now normalize left
 +     * We want to normalize left until we have a leading one in bit 24
 +     * Theoretically, we only need to shift a maximum of one to the left if we
 +     * shifted out lots of bits from B, or if we had no shift / 1 shift sticky
 +     * should be 0
 +     */
 +    while ((int128_getlo(a.mant) & (1ULL << DF_MANTBITS)) == 0) {
 +        a = accum_norm_left(a);
 +    }
 +    /*
 +     * OK, now we might need to denormalize because of potential underflow.
 +     * We need to do this before rounding, and rounding might make us normal
 +     * again
 +     */
 +    while (a.exp <= 0) {
 +        a = accum_norm_right(a, 1 - a.exp);
 +        /*
 +         * Do we have underflow?
 +         * That's when we get an inexact answer because we ran out of bits
 +         * in a denormal.
 +         */
 +        if (a.guard || a.round || a.sticky) {
 +            float_raise(float_flag_underflow, fp_status);
 +        }
 +    }
 +    /* OK, we're relatively canonical... now we need to round */
 +    if (a.guard || a.round || a.sticky) {
 +        float_raise(float_flag_inexact, fp_status);
 +        switch (fp_status->float_rounding_mode) {
 +        case float_round_to_zero:
 +            /* Chop and we're done */
 +            break;
 +        case float_round_up:
 +            if (a.sign == 0) {
 +                a.mant = int128_add(a.mant, int128_one());
 +            }
 +            break;
 +        case float_round_down:
 +            if (a.sign != 0) {
 +                a.mant = int128_add(a.mant, int128_one());
 +            }
 +            break;
 +        default:
 +            if (a.round || a.sticky) {
 +                /* round up if guard is 1, down if guard is zero */
 +                a.mant = int128_add(a.mant, int128_make64(a.guard));
 +            } else if (a.guard) {
 +                /* exactly .5, round up if odd */
 +                a.mant = int128_add(a.mant, int128_and(a.mant, int128_one()));
 +            }
 +            break;
 +        }
 +    }
 +    /*
 +     * OK, now we might have carried all the way up.
 +     * So we might need to shr once
 +     * at least we know that the lsb should be zero if we rounded and
 +     * got a carry out...
 +     */
 +    if ((int128_getlo(a.mant) >> (DF_MANTBITS + 1)) != 0) {
 +        a = accum_norm_right(a, 1);
 +    }
 +    /* Overflow? */
 +    if (a.exp >= DF_INF_EXP) {
 +        /* Yep, inf result */
 +        float_raise(float_flag_overflow, fp_status);
 +        float_raise(float_flag_inexact, fp_status);
 +        switch (fp_status->float_rounding_mode) {
 +        case float_round_to_zero:
 +            return maxfinite_float64(a.sign);
 +        case float_round_up:
 +            if (a.sign == 0) {
 +                return infinite_float64(a.sign);
 +            } else {
 +                return maxfinite_float64(a.sign);
 +            }
 +        case float_round_down:
 +            if (a.sign != 0) {
 +                return infinite_float64(a.sign);
 +            } else {
 +                return maxfinite_float64(a.sign);
 +            }
 +        default:
 +            return infinite_float64(a.sign);
 +        }
 +    }
 +    /* Underflow? */
 +    if (int128_getlo(a.mant) & (1ULL << DF_MANTBITS)) {
 +        /* Leading one means: No, we're normal. So, we should be done... */
 +        Double ret;
 +        ret.i = 0;
 +        ret.sign = a.sign;
 +        ret.exp = a.exp;
 +        ret.mant = int128_getlo(a.mant);
 +        return ret.i;
 +    }
 +    assert(a.exp == 1);
 +    Double ret;
 +    ret.i = 0;
 +    ret.sign = a.sign;
 +    ret.exp = 0;
 +    ret.mant = int128_getlo(a.mant);
 +    return ret.i;
  }
-@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
+-GEN_XF_ROUND(float64, DF_MANTBITS, DF_INF_EXP, Double)
-            True when it is, and we should restart on a new TB,
+-
-            and via longjmp via cpu_loop_exit.  */
+ float64 internal_mpyhh(float64 a, float64 b,
-         else {
+                       unsigned long long int accumulated,
--            if (cc->cpu_exec_interrupt &&
+                       float_status *fp_status)
 -                cc->cpu_exec_interrupt(cpu, interrupt_request)) {
 +            if (cc->tcg_ops.cpu_exec_interrupt &&
 +                cc->tcg_ops.cpu_exec_interrupt(cpu, interrupt_request)) {
                  if (need_replay_interrupt(interrupt_request)) {
                      replay_interrupt();
                  }
 diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/alpha/cpu.c
 +++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = alpha_cpu_class_by_name;
      cc->has_work = alpha_cpu_has_work;
      cc->do_interrupt = alpha_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = alpha_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = alpha_cpu_exec_interrupt;
      cc->dump_state = alpha_cpu_dump_state;
      cc->set_pc = alpha_cpu_set_pc;
      cc->gdb_read_register = alpha_cpu_gdb_read_register;
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = arm_cpu_class_by_name;
      cc->has_work = arm_cpu_has_work;
 -    cc->cpu_exec_interrupt = arm_cpu_exec_interrupt;
      cc->dump_state = arm_cpu_dump_state;
      cc->set_pc = arm_cpu_set_pc;
      cc->gdb_read_register = arm_cpu_gdb_read_register;
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
      cc->disas_set_info = arm_disas_set_info;
  #ifdef CONFIG_TCG
      cc->tcg_ops.initialize = arm_translate_init;
 +    cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
      cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
      cc->tlb_fill = arm_cpu_tlb_fill;
      cc->debug_excp_handler = arm_debug_excp_handler;
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_cpu_class_init(ObjectClass *oc, void *data)
  {
      CPUClass *cc = CPU_CLASS(oc);
 -    cc->cpu_exec_interrupt = arm_cpu_exec_interrupt;
 +#ifdef CONFIG_TCG
 +    cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
 +#endif /* CONFIG_TCG */
 +
      cc->gdb_read_register = aarch64_cpu_gdb_read_register;
      cc->gdb_write_register = aarch64_cpu_gdb_write_register;
      cc->gdb_num_core_regs = 34;
 diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu_tcg.c
 +++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@
  /* CPU models. These are not needed for the AArch64 linux-user build. */
  #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
 +#ifdef CONFIG_TCG
  static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
  {
      CPUClass *cc = CPU_GET_CLASS(cs);
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
      }
      return ret;
  }
 +#endif /* CONFIG_TCG */
  static void arm926_initfn(Object *obj)
  {
@@ -XXX,XX +XXX,XX @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
      cc->do_interrupt = arm_v7m_cpu_do_interrupt;
  #endif
 -    cc->cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt;
 +#ifdef CONFIG_TCG
 +    cc->tcg_ops.cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt;
 +#endif /* CONFIG_TCG */
 +
      cc->gdb_core_xml_file = "arm-m-profile.xml";
  }
 diff --git a/target/avr/cpu.c b/target/avr/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/avr/cpu.c
 +++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
      cc->has_work = avr_cpu_has_work;
      cc->do_interrupt = avr_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = avr_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = avr_cpu_exec_interrupt;
      cc->dump_state = avr_cpu_dump_state;
      cc->set_pc = avr_cpu_set_pc;
      cc->memory_rw_debug = avr_cpu_memory_rw_debug;
 diff --git a/target/cris/cpu.c b/target/cris/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/cris/cpu.c
 +++ b/target/cris/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = cris_cpu_class_by_name;
      cc->has_work = cris_cpu_has_work;
      cc->do_interrupt = cris_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = cris_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = cris_cpu_exec_interrupt;
      cc->dump_state = cris_cpu_dump_state;
      cc->set_pc = cris_cpu_set_pc;
      cc->gdb_read_register = cris_cpu_gdb_read_register;
 diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hppa/cpu.c
 +++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = hppa_cpu_class_by_name;
      cc->has_work = hppa_cpu_has_work;
      cc->do_interrupt = hppa_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = hppa_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = hppa_cpu_exec_interrupt;
      cc->dump_state = hppa_cpu_dump_state;
      cc->set_pc = hppa_cpu_set_pc;
      cc->tcg_ops.synchronize_from_tb = hppa_cpu_synchronize_from_tb;
 diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/tcg-cpu.c
 +++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void x86_cpu_synchronize_from_tb(CPUState *cs,
  void tcg_cpu_common_class_init(CPUClass *cc)
  {
      cc->do_interrupt = x86_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = x86_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = x86_cpu_exec_interrupt;
      cc->tcg_ops.synchronize_from_tb = x86_cpu_synchronize_from_tb;
 -    cc->cpu_exec_enter = x86_cpu_exec_enter;
 -    cc->cpu_exec_exit = x86_cpu_exec_exit;
 +    cc->tcg_ops.cpu_exec_enter = x86_cpu_exec_enter;
 +    cc->tcg_ops.cpu_exec_exit = x86_cpu_exec_exit;
      cc->tcg_ops.initialize = tcg_x86_init;
      cc->tlb_fill = x86_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
 diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/lm32/cpu.c
 +++ b/target/lm32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = lm32_cpu_class_by_name;
      cc->has_work = lm32_cpu_has_work;
      cc->do_interrupt = lm32_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = lm32_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = lm32_cpu_exec_interrupt;
      cc->dump_state = lm32_cpu_dump_state;
      cc->set_pc = lm32_cpu_set_pc;
      cc->gdb_read_register = lm32_cpu_gdb_read_register;
 diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/m68k/cpu.c
 +++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
      cc->class_by_name = m68k_cpu_class_by_name;
      cc->has_work = m68k_cpu_has_work;
      cc->do_interrupt = m68k_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = m68k_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = m68k_cpu_exec_interrupt;
      cc->dump_state = m68k_cpu_dump_state;
      cc->set_pc = m68k_cpu_set_pc;
      cc->gdb_read_register = m68k_cpu_gdb_read_register;
 diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/microblaze/cpu.c
 +++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
      cc->has_work = mb_cpu_has_work;
      cc->do_interrupt = mb_cpu_do_interrupt;
      cc->do_unaligned_access = mb_cpu_do_unaligned_access;
 -    cc->cpu_exec_interrupt = mb_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = mb_cpu_exec_interrupt;
      cc->dump_state = mb_cpu_dump_state;
      cc->set_pc = mb_cpu_set_pc;
      cc->tcg_ops.synchronize_from_tb = mb_cpu_synchronize_from_tb;
 diff --git a/target/mips/cpu.c b/target/mips/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/cpu.c
 +++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
      cc->class_by_name = mips_cpu_class_by_name;
      cc->has_work = mips_cpu_has_work;
      cc->do_interrupt = mips_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = mips_cpu_exec_interrupt;
      cc->dump_state = mips_cpu_dump_state;
      cc->set_pc = mips_cpu_set_pc;
      cc->gdb_read_register = mips_cpu_gdb_read_register;
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
      cc->disas_set_info = mips_cpu_disas_set_info;
  #ifdef CONFIG_TCG
      cc->tcg_ops.initialize = mips_tcg_init;
 +    cc->tcg_ops.cpu_exec_interrupt = mips_cpu_exec_interrupt;
      cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
      cc->tlb_fill = mips_cpu_tlb_fill;
  #endif
 diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/nios2/cpu.c
 +++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = nios2_cpu_class_by_name;
      cc->has_work = nios2_cpu_has_work;
      cc->do_interrupt = nios2_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = nios2_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = nios2_cpu_exec_interrupt;
      cc->dump_state = nios2_cpu_dump_state;
      cc->set_pc = nios2_cpu_set_pc;
      cc->disas_set_info = nios2_cpu_disas_set_info;
 diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/openrisc/cpu.c
 +++ b/target/openrisc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = openrisc_cpu_class_by_name;
      cc->has_work = openrisc_cpu_has_work;
      cc->do_interrupt = openrisc_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = openrisc_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = openrisc_cpu_exec_interrupt;
      cc->dump_state = openrisc_cpu_dump_state;
      cc->set_pc = openrisc_cpu_set_pc;
      cc->gdb_read_register = openrisc_cpu_gdb_read_register;
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
      cc->class_by_name = riscv_cpu_class_by_name;
      cc->has_work = riscv_cpu_has_work;
      cc->do_interrupt = riscv_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = riscv_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = riscv_cpu_exec_interrupt;
      cc->dump_state = riscv_cpu_dump_state;
      cc->set_pc = riscv_cpu_set_pc;
      cc->tcg_ops.synchronize_from_tb = riscv_cpu_synchronize_from_tb;
 diff --git a/target/rx/cpu.c b/target/rx/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/rx/cpu.c
 +++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
      cc->class_by_name = rx_cpu_class_by_name;
      cc->has_work = rx_cpu_has_work;
      cc->do_interrupt = rx_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = rx_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = rx_cpu_exec_interrupt;
      cc->dump_state = rx_cpu_dump_state;
      cc->set_pc = rx_cpu_set_pc;
      cc->tcg_ops.synchronize_from_tb = rx_cpu_synchronize_from_tb;
 diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/cpu.c
 +++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
      cc->get_crash_info = s390_cpu_get_crash_info;
      cc->write_elf64_note = s390_cpu_write_elf64_note;
  #ifdef CONFIG_TCG
 -    cc->cpu_exec_interrupt = s390_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = s390_cpu_exec_interrupt;
      cc->debug_excp_handler = s390x_cpu_debug_excp_handler;
      cc->do_unaligned_access = s390x_cpu_do_unaligned_access;
  #endif
 diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sh4/cpu.c
 +++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = superh_cpu_class_by_name;
      cc->has_work = superh_cpu_has_work;
      cc->do_interrupt = superh_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = superh_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = superh_cpu_exec_interrupt;
      cc->dump_state = superh_cpu_dump_state;
      cc->set_pc = superh_cpu_set_pc;
      cc->tcg_ops.synchronize_from_tb = superh_cpu_synchronize_from_tb;
 diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sparc/cpu.c
 +++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
      cc->parse_features = sparc_cpu_parse_features;
      cc->has_work = sparc_cpu_has_work;
      cc->do_interrupt = sparc_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = sparc_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = sparc_cpu_exec_interrupt;
      cc->dump_state = sparc_cpu_dump_state;
  #if !defined(TARGET_SPARC64) && !defined(CONFIG_USER_ONLY)
      cc->memory_rw_debug = sparc_cpu_memory_rw_debug;
 diff --git a/target/tilegx/cpu.c b/target/tilegx/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tilegx/cpu.c
 +++ b/target/tilegx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = tilegx_cpu_class_by_name;
      cc->has_work = tilegx_cpu_has_work;
      cc->do_interrupt = tilegx_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = tilegx_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = tilegx_cpu_exec_interrupt;
      cc->dump_state = tilegx_cpu_dump_state;
      cc->set_pc = tilegx_cpu_set_pc;
      cc->tlb_fill = tilegx_cpu_tlb_fill;
 diff --git a/target/unicore32/cpu.c b/target/unicore32/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/unicore32/cpu.c
 +++ b/target/unicore32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = uc32_cpu_class_by_name;
      cc->has_work = uc32_cpu_has_work;
      cc->do_interrupt = uc32_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = uc32_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = uc32_cpu_exec_interrupt;
      cc->dump_state = uc32_cpu_dump_state;
      cc->set_pc = uc32_cpu_set_pc;
      cc->tlb_fill = uc32_cpu_tlb_fill;
 diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/xtensa/cpu.c
 +++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = xtensa_cpu_class_by_name;
      cc->has_work = xtensa_cpu_has_work;
      cc->do_interrupt = xtensa_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = xtensa_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = xtensa_cpu_exec_interrupt;
      cc->dump_state = xtensa_cpu_dump_state;
      cc->set_pc = xtensa_cpu_set_pc;
      cc->gdb_read_register = xtensa_cpu_gdb_read_register;
 diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/ppc/translate_init.c.inc
 +++ b/target/ppc/translate_init.c.inc
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_reset(DeviceState *dev)
  }
  #ifndef CONFIG_USER_ONLY
 +
  static bool ppc_cpu_is_big_endian(CPUState *cs)
  {
      PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool ppc_cpu_is_big_endian(CPUState *cs)
      return !msr_le;
  }
 +#ifdef CONFIG_TCG
  static void ppc_cpu_exec_enter(CPUState *cs)
  {
      PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_exec_exit(CPUState *cs)
          vhc->cpu_exec_exit(cpu->vhyp, cpu);
      }
  }
 -#endif
 +#endif /* CONFIG_TCG */
 +
 +#endif /* !CONFIG_USER_ONLY */
  static void ppc_cpu_instance_init(Object *obj)
  {
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = ppc_cpu_class_by_name;
      cc->has_work = ppc_cpu_has_work;
      cc->do_interrupt = ppc_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = ppc_cpu_exec_interrupt;
      cc->dump_state = ppc_cpu_dump_state;
      cc->dump_statistics = ppc_cpu_dump_statistics;
      cc->set_pc = ppc_cpu_set_pc;
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
  #endif
  #ifdef CONFIG_TCG
      cc->tcg_ops.initialize = ppc_translate_init;
 +    cc->tcg_ops.cpu_exec_interrupt = ppc_cpu_exec_interrupt;
      cc->tlb_fill = ppc_cpu_tlb_fill;
 -#endif
  #ifndef CONFIG_USER_ONLY
 -    cc->cpu_exec_enter = ppc_cpu_exec_enter;
 -    cc->cpu_exec_exit = ppc_cpu_exec_exit;
 -#endif
 +    cc->tcg_ops.cpu_exec_enter = ppc_cpu_exec_enter;
 +    cc->tcg_ops.cpu_exec_exit = ppc_cpu_exec_exit;
 +#endif /* !CONFIG_USER_ONLY */
 +#endif /* CONFIG_TCG */
      cc->disas_set_info = ppc_disas_set_info;
 --
-.25.1
+.43.0

-[PULL 05/46] tcg/tci: Make tci_tb_ptr thread-local
+[PULL 68/72] target/hexagon: Remove Float
-Each thread must have its own pc, even under TCI.
+This structure, with bitfields, is incorrect for big-endian.
 Use the existing float32_getexp_raw which uses extract32.
-Remove the GETPC ifdef, because GETPC is always available for
+Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
-helpers, and thus is always required.  Move the assignment
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-under INDEX_op_call, because the value is only visible when
+---
-we make a call to a helper function.
+ target/hexagon/fma_emu.c | 16 +++-------------
 file changed, 3 insertions(+), 13 deletions(-)
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+diff --git a/target/hexagon/fma_emu.c b/target/hexagon/fma_emu.c
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210204014509.882821-6-richard.henderson@linaro.org>
 ---
  include/exec/exec-all.h | 2 +-
  tcg/tcg-common.c        | 4 ----
  tcg/tci.c               | 7 +++----
 files changed, 4 insertions(+), 9 deletions(-)
 diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/exec-all.h
+--- a/target/hexagon/fma_emu.c
-+++ b/include/exec/exec-all.h
++++ b/target/hexagon/fma_emu.c
-@@ -XXX,XX +XXX,XX @@ void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr);
+@@ -XXX,XX +XXX,XX @@ typedef union {
+     };
- /* GETPC is the true target of the return instruction that we'll execute.  */
+ } Double;
- #if defined(CONFIG_TCG_INTERPRETER)
--extern uintptr_t tci_tb_ptr;
+-typedef union {
-+extern __thread uintptr_t tci_tb_ptr;
+-    float f;
- # define GETPC() tci_tb_ptr
+-    uint32_t i;
- #else
+-    struct {
- # define GETPC() \
+-        uint32_t mant:23;
-diff --git a/tcg/tcg-common.c b/tcg/tcg-common.c
+-        uint32_t exp:8;
-index XXXXXXX..XXXXXXX 100644
+-        uint32_t sign:1;
---- a/tcg/tcg-common.c
+-    };
-+++ b/tcg/tcg-common.c
+-} Float;
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "tcg/tcg.h"
 -#if defined(CONFIG_TCG_INTERPRETER)
 -uintptr_t tci_tb_ptr;
 -#endif
 -
- TCGOpDef tcg_op_defs[] = {
+ static uint64_t float64_getmant(float64 f64)
  #define DEF(s, oargs, iargs, cargs, flags) \
           { #s, oargs, iargs, cargs, iargs + oargs + cargs, flags },
 diff --git a/tcg/tci.c b/tcg/tci.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci.c
 +++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ typedef uint64_t (*helper_function)(tcg_target_ulong, tcg_target_ulong,
                                      tcg_target_ulong, tcg_target_ulong);
  #endif
 +__thread uintptr_t tci_tb_ptr;
 +
  static tcg_target_ulong tci_read_reg(const tcg_target_ulong *regs, TCGReg index)
  {
-     tci_assert(index < TCG_TARGET_NB_REGS);
+     Double a = { .i = f64 };
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+@@ -XXX,XX +XXX,XX @@ int32_t float64_getexp(float64 f64)
- #endif
-         TCGMemOpIdx oi;
+ int32_t float32_getexp(float32 f32)
+ {
--#if defined(GETPC)
+-    Float a = { .i = f32 };
--        tci_tb_ptr = (uintptr_t)tb_ptr;
++    int exp = float32_getexp_raw(f32);
--#endif
+     if (float32_is_normal(f32)) {
--
+-        return a.exp;
-         /* Skip opcode and size entry. */
++        return exp;
-         tb_ptr += 2;
+     }
+     if (float32_is_denormal(f32)) {
-         switch (opc) {
+-        return a.exp + 1;
-         case INDEX_op_call:
++        return exp + 1;
-             t0 = tci_read_ri(regs, &tb_ptr);
+     }
-+            tci_tb_ptr = (uintptr_t)tb_ptr;
+     return -1;
- #if TCG_TARGET_REG_BITS == 32
+ }
              tmp64 = ((helper_function)t0)(tci_read_reg(regs, TCG_REG_R0),
                                            tci_read_reg(regs, TCG_REG_R1),
 --
-.25.1
+.43.0

-[PULL 02/46] exec/cpu-defs: Remove TCG backends dependency
+[PULL 69/72] target/hexagon: Remove Double
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+This structure, with bitfields, is incorrect for big-endian.
 Use extract64 and deposit64 instead.
-"exec/cpu-defs.h" contains generic CPU definitions for the
+Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
 TCG frontends (mostly related to TLB). TCG backends definitions
 aren't relevant here.
 See tcg/README description:
 ) Backend
   tcg-target.h contains the target specific definitions. tcg-target.c.inc
   contains the target specific code; it is #included by tcg/tcg.c, rather
   than being a standalone C file.
 So far only "tcg/tcg.h" requires these headers.
 Remove the "target-tcg.h" header dependency on TCG frontends, so we
 don't have to rebuild all frontends when hacking a single backend.
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-Id: <20210204191423.1754158-1-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/cpu-defs.h | 3 ---
+ target/hexagon/fma_emu.c | 46 ++++++++++++++--------------------------
-file changed, 3 deletions(-)
+file changed, 16 insertions(+), 30 deletions(-)
-diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
+diff --git a/target/hexagon/fma_emu.c b/target/hexagon/fma_emu.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/cpu-defs.h
+--- a/target/hexagon/fma_emu.c
-+++ b/include/exec/cpu-defs.h
++++ b/target/hexagon/fma_emu.c
 @@ -XXX,XX +XXX,XX @@
- #include "qemu/host-utils.h"
+ #define WAY_BIG_EXP 4096
- #include "qemu/thread.h"
--#ifdef CONFIG_TCG
+-typedef union {
--#include "tcg-target.h"
+-    double f;
--#endif
+-    uint64_t i;
- #ifndef CONFIG_USER_ONLY
+-    struct {
- #include "exec/hwaddr.h"
+-        uint64_t mant:52;
- #endif
+-        uint64_t exp:11;
 -        uint64_t sign:1;
 -    };
 -} Double;
 -
  static uint64_t float64_getmant(float64 f64)
  {
 -    Double a = { .i = f64 };
 +    uint64_t mant = extract64(f64, 0, 52);
      if (float64_is_normal(f64)) {
 -        return a.mant | 1ULL << 52;
 +        return mant | 1ULL << 52;
      }
      if (float64_is_zero(f64)) {
          return 0;
      }
      if (float64_is_denormal(f64)) {
 -        return a.mant;
 +        return mant;
      }
      return ~0ULL;
  }
  int32_t float64_getexp(float64 f64)
  {
 -    Double a = { .i = f64 };
 +    int exp = extract64(f64, 52, 11);
      if (float64_is_normal(f64)) {
 -        return a.exp;
 +        return exp;
      }
      if (float64_is_denormal(f64)) {
 -        return a.exp + 1;
 +        return exp + 1;
      }
      return -1;
  }
@@ -XXX,XX +XXX,XX @@ float32 infinite_float32(uint8_t sign)
  /* Return a maximum finite value with the requested sign */
  static float64 accum_round_float64(Accum a, float_status *fp_status)
  {
 +    uint64_t ret;
 +
      if ((int128_gethi(a.mant) == 0) && (int128_getlo(a.mant) == 0)
          && ((a.guard | a.round | a.sticky) == 0)) {
          /* result zero */
@@ -XXX,XX +XXX,XX @@ static float64 accum_round_float64(Accum a, float_status *fp_status)
          }
      }
      /* Underflow? */
 -    if (int128_getlo(a.mant) & (1ULL << DF_MANTBITS)) {
 +    ret = int128_getlo(a.mant);
 +    if (ret & (1ULL << DF_MANTBITS)) {
          /* Leading one means: No, we're normal. So, we should be done... */
 -        Double ret;
 -        ret.i = 0;
 -        ret.sign = a.sign;
 -        ret.exp = a.exp;
 -        ret.mant = int128_getlo(a.mant);
 -        return ret.i;
 +        ret = deposit64(ret, 52, 11, a.exp);
 +    } else {
 +        assert(a.exp == 1);
 +        ret = deposit64(ret, 52, 11, 0);
      }
 -    assert(a.exp == 1);
 -    Double ret;
 -    ret.i = 0;
 -    ret.sign = a.sign;
 -    ret.exp = 0;
 -    ret.mant = int128_getlo(a.mant);
 -    return ret.i;
 +    ret = deposit64(ret, 63, 1, a.sign);
 +    return ret;
  }
  float64 internal_mpyhh(float64 a, float64 b,
 --
-.25.1
+.43.0

-[PULL 11/46] tcg/tci: Inline tci_write_reg32 into all callers
+[PULL 70/72] target/hexagon: Use mulu64 for int128_mul_6464
-For a 64-bit TCI, the upper bits of a 32-bit operation are
+No need to open-code 64x64->128-bit multiplication.
 undefined (much like a native ppc64 32-bit operation).  It
 simplifies everything if we don't force-extend the result.
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c | 66 +++++++++++++++++++++++++------------------------------
+ target/hexagon/fma_emu.c | 32 +++-----------------------------
-file changed, 30 insertions(+), 36 deletions(-)
+file changed, 3 insertions(+), 29 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
+diff --git a/target/hexagon/fma_emu.c b/target/hexagon/fma_emu.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/target/hexagon/fma_emu.c
-+++ b/tcg/tci.c
++++ b/target/hexagon/fma_emu.c
-@@ -XXX,XX +XXX,XX @@ tci_write_reg(tcg_target_ulong *regs, TCGReg index, tcg_target_ulong value)
+@@ -XXX,XX +XXX,XX @@ int32_t float32_getexp(float32 f32)
-     regs[index] = value;
+     return -1;
  }
--static void
+-static uint32_t int128_getw0(Int128 x)
 -tci_write_reg32(tcg_target_ulong *regs, TCGReg index, uint32_t value)
 -{
--    tci_write_reg(regs, index, value);
+-    return int128_getlo(x);
 -}
 -
- #if TCG_TARGET_REG_BITS == 32
+-static uint32_t int128_getw1(Int128 x)
- static void tci_write_reg64(tcg_target_ulong *regs, uint32_t high_index,
+-{
-                             uint32_t low_index, uint64_t value)
+-    return int128_getlo(x) >> 32;
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+-}
-             t1 = tci_read_r32(regs, &tb_ptr);
+-
-             t2 = tci_read_ri32(regs, &tb_ptr);
+ static Int128 int128_mul_6464(uint64_t ai, uint64_t bi)
-             condition = *tb_ptr++;
+ {
--            tci_write_reg32(regs, t0, tci_compare32(t1, t2, condition));
+-    Int128 a, b;
-+            tci_write_reg(regs, t0, tci_compare32(t1, t2, condition));
+-    uint64_t pp0, pp1a, pp1b, pp1s, pp2;
-             break;
++    uint64_t l, h;
- #if TCG_TARGET_REG_BITS == 32
-         case INDEX_op_setcond2_i32:
+-    a = int128_make64(ai);
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+-    b = int128_make64(bi);
-             tmp64 = tci_read_r64(regs, &tb_ptr);
+-    pp0 = (uint64_t)int128_getw0(a) * (uint64_t)int128_getw0(b);
-             v64 = tci_read_ri64(regs, &tb_ptr);
+-    pp1a = (uint64_t)int128_getw1(a) * (uint64_t)int128_getw0(b);
-             condition = *tb_ptr++;
+-    pp1b = (uint64_t)int128_getw1(b) * (uint64_t)int128_getw0(a);
--            tci_write_reg32(regs, t0, tci_compare64(tmp64, v64, condition));
+-    pp2 = (uint64_t)int128_getw1(a) * (uint64_t)int128_getw1(b);
-+            tci_write_reg(regs, t0, tci_compare64(tmp64, v64, condition));
+-
-             break;
+-    pp1s = pp1a + pp1b;
- #elif TCG_TARGET_REG_BITS == 64
+-    if ((pp1s < pp1a) || (pp1s < pp1b)) {
-         case INDEX_op_setcond_i64:
+-        pp2 += (1ULL << 32);
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+-    }
-         case INDEX_op_mov_i32:
+-    uint64_t ret_low = pp0 + (pp1s << 32);
-             t0 = *tb_ptr++;
+-    if ((ret_low < pp0) || (ret_low < (pp1s << 32))) {
-             t1 = tci_read_r32(regs, &tb_ptr);
+-        pp2 += 1;
--            tci_write_reg32(regs, t0, t1);
+-    }
-+            tci_write_reg(regs, t0, t1);
+-
-             break;
+-    return int128_make128(ret_low, pp2 + (pp1s >> 32));
-         case INDEX_op_tci_movi_i32:
++    mulu64(&l, &h, ai, bi);
-             t0 = *tb_ptr++;
++    return int128_make128(l, h);
-             t1 = tci_read_i32(&tb_ptr);
+ }
--            tci_write_reg32(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
+ static Int128 int128_sub_borrow(Int128 a, Int128 b, int borrow)
              break;
              /* Load/store operations (32 bit). */
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              t0 = *tb_ptr++;
              t1 = tci_read_r(regs, &tb_ptr);
              t2 = tci_read_s32(&tb_ptr);
 -            tci_write_reg32(regs, t0, *(uint32_t *)(t1 + t2));
 +            tci_write_reg(regs, t0, *(uint32_t *)(t1 + t2));
              break;
          case INDEX_op_st8_i32:
              t0 = tci_read_r8(regs, &tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              t0 = *tb_ptr++;
              t1 = tci_read_ri32(regs, &tb_ptr);
              t2 = tci_read_ri32(regs, &tb_ptr);
 -            tci_write_reg32(regs, t0, t1 + t2);
 +            tci_write_reg(regs, t0, t1 + t2);
              break;
          case INDEX_op_sub_i32:
              t0 = *tb_ptr++;
              t1 = tci_read_ri32(regs, &tb_ptr);
              t2 = tci_read_ri32(regs, &tb_ptr);
 -            tci_write_reg32(regs, t0, t1 - t2);
 +            tci_write_reg(regs, t0, t1 - t2);
              break;
          case INDEX_op_mul_i32:
              t0 = *tb_ptr++;
              t1 = tci_read_ri32(regs, &tb_ptr);
              t2 = tci_read_ri32(regs, &tb_ptr);
 -            tci_write_reg32(regs, t0, t1 * t2);
 +            tci_write_reg(regs, t0, t1 * t2);
              break;
  #if TCG_TARGET_HAS_div_i32
          case INDEX_op_div_i32:
              t0 = *tb_ptr++;
              t1 = tci_read_ri32(regs, &tb_ptr);
              t2 = tci_read_ri32(regs, &tb_ptr);
 -            tci_write_reg32(regs, t0, (int32_t)t1 / (int32_t)t2);
 +            tci_write_reg(regs, t0, (int32_t)t1 / (int32_t)t2);
              break;
          case INDEX_op_divu_i32:
              t0 = *tb_ptr++;
              t1 = tci_read_ri32(regs, &tb_ptr);
              t2 = tci_read_ri32(regs, &tb_ptr);
 -            tci_write_reg32(regs, t0, t1 / t2);
 +            tci_write_reg(regs, t0, t1 / t2);
              break;
          case INDEX_op_rem_i32:
              t0 = *tb_ptr++;
              t1 = tci_read_ri32(regs, &tb_ptr);
              t2 = tci_read_ri32(regs, &tb_ptr);
 -            tci_write_reg32(regs, t0, (int32_t)t1 % (int32_t)t2);
 +            tci_write_reg(regs, t0, (int32_t)t1 % (int32_t)t2);
              break;
          case INDEX_op_remu_i32:
              t0 = *tb_ptr++;
              t1 = tci_read_ri32(regs, &tb_ptr);
              t2 = tci_read_ri32(regs, &tb_ptr);
 -            tci_write_reg32(regs, t0, t1 % t2);
 +            tci_write_reg(regs, t0, t1 % t2);
              break;
  #elif TCG_TARGET_HAS_div2_i32
          case INDEX_op_div2_i32:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              t0 = *tb_ptr++;
              t1 = tci_read_ri32(regs, &tb_ptr);
              t2 = tci_read_ri32(regs, &tb_ptr);
 -            tci_write_reg32(regs, t0, t1 & t2);
 +            tci_write_reg(regs, t0, t1 & t2);
              break;
          case INDEX_op_or_i32:
              t0 = *tb_ptr++;
              t1 = tci_read_ri32(regs, &tb_ptr);
              t2 = tci_read_ri32(regs, &tb_ptr);
 -            tci_write_reg32(regs, t0, t1 | t2);
 +            tci_write_reg(regs, t0, t1 | t2);
              break;
          case INDEX_op_xor_i32:
              t0 = *tb_ptr++;
              t1 = tci_read_ri32(regs, &tb_ptr);
              t2 = tci_read_ri32(regs, &tb_ptr);
 -            tci_write_reg32(regs, t0, t1 ^ t2);
 +            tci_write_reg(regs, t0, t1 ^ t2);
              break;
              /* Shift/rotate operations (32 bit). */
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              t0 = *tb_ptr++;
              t1 = tci_read_ri32(regs, &tb_ptr);
              t2 = tci_read_ri32(regs, &tb_ptr);
 -            tci_write_reg32(regs, t0, t1 << (t2 & 31));
 +            tci_write_reg(regs, t0, t1 << (t2 & 31));
              break;
          case INDEX_op_shr_i32:
              t0 = *tb_ptr++;
              t1 = tci_read_ri32(regs, &tb_ptr);
              t2 = tci_read_ri32(regs, &tb_ptr);
 -            tci_write_reg32(regs, t0, t1 >> (t2 & 31));
 +            tci_write_reg(regs, t0, t1 >> (t2 & 31));
              break;
          case INDEX_op_sar_i32:
              t0 = *tb_ptr++;
              t1 = tci_read_ri32(regs, &tb_ptr);
              t2 = tci_read_ri32(regs, &tb_ptr);
 -            tci_write_reg32(regs, t0, ((int32_t)t1 >> (t2 & 31)));
 +            tci_write_reg(regs, t0, ((int32_t)t1 >> (t2 & 31)));
              break;
  #if TCG_TARGET_HAS_rot_i32
          case INDEX_op_rotl_i32:
              t0 = *tb_ptr++;
              t1 = tci_read_ri32(regs, &tb_ptr);
              t2 = tci_read_ri32(regs, &tb_ptr);
 -            tci_write_reg32(regs, t0, rol32(t1, t2 & 31));
 +            tci_write_reg(regs, t0, rol32(t1, t2 & 31));
              break;
          case INDEX_op_rotr_i32:
              t0 = *tb_ptr++;
              t1 = tci_read_ri32(regs, &tb_ptr);
              t2 = tci_read_ri32(regs, &tb_ptr);
 -            tci_write_reg32(regs, t0, ror32(t1, t2 & 31));
 +            tci_write_reg(regs, t0, ror32(t1, t2 & 31));
              break;
  #endif
  #if TCG_TARGET_HAS_deposit_i32
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              tmp16 = *tb_ptr++;
              tmp8 = *tb_ptr++;
              tmp32 = (((1 << tmp8) - 1) << tmp16);
 -            tci_write_reg32(regs, t0, (t1 & ~tmp32) | ((t2 << tmp16) & tmp32));
 +            tci_write_reg(regs, t0, (t1 & ~tmp32) | ((t2 << tmp16) & tmp32));
              break;
  #endif
          case INDEX_op_brcond_i32:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
          case INDEX_op_ext8s_i32:
              t0 = *tb_ptr++;
              t1 = tci_read_r8s(regs, &tb_ptr);
 -            tci_write_reg32(regs, t0, t1);
 +            tci_write_reg(regs, t0, t1);
              break;
  #endif
  #if TCG_TARGET_HAS_ext16s_i32
          case INDEX_op_ext16s_i32:
              t0 = *tb_ptr++;
              t1 = tci_read_r16s(regs, &tb_ptr);
 -            tci_write_reg32(regs, t0, t1);
 +            tci_write_reg(regs, t0, t1);
              break;
  #endif
  #if TCG_TARGET_HAS_ext8u_i32
          case INDEX_op_ext8u_i32:
              t0 = *tb_ptr++;
              t1 = tci_read_r8(regs, &tb_ptr);
 -            tci_write_reg32(regs, t0, t1);
 +            tci_write_reg(regs, t0, t1);
              break;
  #endif
  #if TCG_TARGET_HAS_ext16u_i32
          case INDEX_op_ext16u_i32:
              t0 = *tb_ptr++;
              t1 = tci_read_r16(regs, &tb_ptr);
 -            tci_write_reg32(regs, t0, t1);
 +            tci_write_reg(regs, t0, t1);
              break;
  #endif
  #if TCG_TARGET_HAS_bswap16_i32
          case INDEX_op_bswap16_i32:
              t0 = *tb_ptr++;
              t1 = tci_read_r16(regs, &tb_ptr);
 -            tci_write_reg32(regs, t0, bswap16(t1));
 +            tci_write_reg(regs, t0, bswap16(t1));
              break;
  #endif
  #if TCG_TARGET_HAS_bswap32_i32
          case INDEX_op_bswap32_i32:
              t0 = *tb_ptr++;
              t1 = tci_read_r32(regs, &tb_ptr);
 -            tci_write_reg32(regs, t0, bswap32(t1));
 +            tci_write_reg(regs, t0, bswap32(t1));
              break;
  #endif
  #if TCG_TARGET_HAS_not_i32
          case INDEX_op_not_i32:
              t0 = *tb_ptr++;
              t1 = tci_read_r32(regs, &tb_ptr);
 -            tci_write_reg32(regs, t0, ~t1);
 +            tci_write_reg(regs, t0, ~t1);
              break;
  #endif
  #if TCG_TARGET_HAS_neg_i32
          case INDEX_op_neg_i32:
              t0 = *tb_ptr++;
              t1 = tci_read_r32(regs, &tb_ptr);
 -            tci_write_reg32(regs, t0, -t1);
 +            tci_write_reg(regs, t0, -t1);
              break;
  #endif
  #if TCG_TARGET_REG_BITS == 64
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              t0 = *tb_ptr++;
              t1 = tci_read_r(regs, &tb_ptr);
              t2 = tci_read_s32(&tb_ptr);
 -            tci_write_reg32(regs, t0, *(uint32_t *)(t1 + t2));
 +            tci_write_reg(regs, t0, *(uint32_t *)(t1 + t2));
              break;
          case INDEX_op_ld32s_i64:
              t0 = *tb_ptr++;
 --
-.25.1
+.43.0

-[PULL 01/46] tcg/s390: Fix compare instruction from extended-immediate facility
+[PULL 71/72] target/hexagon: Simplify internal_mpyhh setup
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Initialize x with accumulated via direct assignment,
 rather than multiplying by 1.
-The code is currently comparing c2 to the type promotion of
+Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
 uint32_t and int32_t. That is, the conversion rules are as:
   (common_type) c2 == (common_type) (uint32_t)
                         (is_unsigned
                         ? (uint32_t)c2
                         : (uint32_t)(int32_t)c2)
 In the signed case we lose the desired sign extensions because
 of the argument promotion rules of the ternary operator.
 Solve the problem by doing the round-trip parsing through the
 intermediate type and back to the desired common type (all at
 one expression).
 Fixes: a534bb15f30 ("tcg/s390: Use constant pool for cmpi")
 Tested-by: Richard W.M. Jones <rjones@redhat.com>
 Reviewed-by: David Hildenbrand <david@redhat.com>
 Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
 Reported-by: Richard W.M. Jones <rjones@redhat.com>
 Suggested-by: David Hildenbrand <david@redhat.com>
 Suggested-by: Eric Blake <eblake@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-Id: <20210204182902.1742826-1-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/s390/tcg-target.c.inc | 2 +-
+ target/hexagon/fma_emu.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/tcg/s390/tcg-target.c.inc b/tcg/s390/tcg-target.c.inc
+diff --git a/target/hexagon/fma_emu.c b/target/hexagon/fma_emu.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/s390/tcg-target.c.inc
+--- a/target/hexagon/fma_emu.c
-+++ b/tcg/s390/tcg-target.c.inc
++++ b/target/hexagon/fma_emu.c
-@@ -XXX,XX +XXX,XX @@ static int tgen_cmp(TCGContext *s, TCGType type, TCGCond c, TCGReg r1,
+@@ -XXX,XX +XXX,XX @@ float64 internal_mpyhh(float64 a, float64 b,
-                 op = (is_unsigned ? RIL_CLFI : RIL_CFI);
+         float64_is_infinity(b)) {
-                 tcg_out_insn_RIL(s, op, r1, c2);
+         return float64_mul(a, b, fp_status);
-                 goto exit;
+     }
--            } else if (c2 == (is_unsigned ? (uint32_t)c2 : (int32_t)c2)) {
+-    x.mant = int128_mul_6464(accumulated, 1);
-+            } else if (c2 == (is_unsigned ? (TCGArg)(uint32_t)c2 : (TCGArg)(int32_t)c2)) {
++    x.mant = int128_make64(accumulated);
-                 op = (is_unsigned ? RIL_CLGFI : RIL_CGFI);
+     x.sticky = sticky;
-                 tcg_out_insn_RIL(s, op, r1, c2);
+     prod = fGETUWORD(1, float64_getmant(a)) * fGETUWORD(1, float64_getmant(b));
-                 goto exit;
+     x.mant = int128_add(x.mant, int128_mul_6464(prod, 0x100000000ULL));
 --
-.25.1
+.43.0

-[PULL 43/46] cpu: tcg_ops: move to tcg-cpu-ops.h, keep a pointer in CPUClass
+[PULL 72/72] accel/tcg: Move gen_intermediate_code to TCGCPUOps.translate_core
-From: Claudio Fontana <cfontana@suse.de>
+Convert all targets simultaneously, as the gen_intermediate_code
 function disappears from the target.  While there are possible
 workarounds, they're larger than simply performing the conversion.
-we cannot in principle make the TCG Operations field definitions
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 conditional on CONFIG_TCG in code that is included by both common_ss
 and specific_ss modules.
 Therefore, what we can do safely to restrict the TCG fields to TCG-only
 builds, is to move all tcg cpu operations into a separate header file,
 which is only included by TCG, target-specific code.
 This leaves just a NULL pointer in the cpu.h for the non-TCG builds.
 This also tidies up the code in all targets a bit, having all TCG cpu
 operations neatly contained by a dedicated data struct.
 Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Message-Id: <20210204163931.7358-16-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h           | 103 ++------------------------------
+ include/exec/translator.h        | 14 --------------
- include/hw/core/tcg-cpu-ops.h   |  97 ++++++++++++++++++++++++++++++
+ include/hw/core/tcg-cpu-ops.h    | 13 +++++++++++++
- target/arm/internals.h          |   6 ++
+ target/alpha/cpu.h               |  2 ++
- accel/tcg/cpu-exec.c            |  27 +++++----
+ target/arm/internals.h           |  2 ++
- accel/tcg/cputlb.c              |  35 +++++++++--
+ target/avr/cpu.h                 |  2 ++
- accel/tcg/user-exec.c           |   9 +--
+ target/hexagon/cpu.h             |  2 ++
- hw/mips/jazz.c                  |   7 ++-
+ target/hppa/cpu.h                |  2 ++
- softmmu/physmem.c               |  13 ++--
+ target/i386/tcg/helper-tcg.h     |  2 ++
- target/alpha/cpu.c              |  21 +++++--
+ target/loongarch/internals.h     |  2 ++
- target/arm/cpu.c                |  41 ++++++++-----
+ target/m68k/cpu.h                |  2 ++
- target/arm/cpu64.c              |   7 +--
+ target/microblaze/cpu.h          |  2 ++
- target/arm/cpu_tcg.c            |  28 +++++++--
+ target/mips/tcg/tcg-internal.h   |  2 ++
- target/avr/cpu.c                |  19 ++++--
+ target/openrisc/cpu.h            |  2 ++
- target/avr/helper.c             |   5 +-
+ target/ppc/cpu.h                 |  2 ++
- target/cris/cpu.c               |  43 ++++++++-----
+ target/riscv/cpu.h               |  3 +++
- target/cris/helper.c            |   5 +-
+ target/rx/cpu.h                  |  2 ++
- target/hppa/cpu.c               |  22 ++++---
+ target/s390x/s390x-internal.h    |  2 ++
- target/i386/tcg/tcg-cpu.c       |  26 ++++----
+ target/sh4/cpu.h                 |  2 ++
- target/lm32/cpu.c               |  19 ++++--
+ target/sparc/cpu.h               |  2 ++
- target/m68k/cpu.c               |  19 ++++--
+ target/tricore/cpu.h             |  2 ++
- target/microblaze/cpu.c         |  25 +++++---
+ target/xtensa/cpu.h              |  2 ++
- target/mips/cpu.c               |  36 +++++++----
+ accel/tcg/cpu-exec.c             |  8 +++++---
- target/moxie/cpu.c              |  15 ++++-
+ accel/tcg/translate-all.c        |  8 +++++---
- target/nios2/cpu.c              |  18 ++++--
+ target/alpha/cpu.c               |  1 +
- target/openrisc/cpu.c           |  17 ++++--
+ target/alpha/translate.c         |  4 ++--
- target/riscv/cpu.c              |  23 ++++---
+ target/arm/cpu.c                 |  1 +
- target/rx/cpu.c                 |  20 +++++--
+ target/arm/tcg/cpu-v7m.c         |  1 +
- target/s390x/cpu.c              |  33 ++++++----
+ target/arm/tcg/translate.c       |  5 ++---
- target/sh4/cpu.c                |  21 +++++--
+ target/avr/cpu.c                 |  1 +
- target/sparc/cpu.c              |  25 +++++---
+ target/avr/translate.c           |  6 +++---
- target/tilegx/cpu.c             |  17 ++++--
+ target/hexagon/cpu.c             |  1 +
- target/tricore/cpu.c            |  12 +++-
+ target/hexagon/translate.c       |  4 ++--
- target/unicore32/cpu.c          |  17 ++++--
+ target/hppa/cpu.c                |  1 +
- target/xtensa/cpu.c             |  23 ++++---
+ target/hppa/translate.c          |  4 ++--
- target/ppc/translate_init.c.inc |  33 ++++++----
+ target/i386/tcg/tcg-cpu.c        |  1 +
- MAINTAINERS                     |   1 +
+ target/i386/tcg/translate.c      |  5 ++---
-files changed, 582 insertions(+), 306 deletions(-)
+ target/loongarch/cpu.c           |  1 +
- create mode 100644 include/hw/core/tcg-cpu-ops.h
+ target/loongarch/tcg/translate.c |  4 ++--
  target/m68k/cpu.c                |  1 +
  target/m68k/translate.c          |  4 ++--
  target/microblaze/cpu.c          |  1 +
  target/microblaze/translate.c    |  4 ++--
  target/mips/cpu.c                |  1 +
  target/mips/tcg/translate.c      |  4 ++--
  target/openrisc/cpu.c            |  1 +
  target/openrisc/translate.c      |  4 ++--
  target/ppc/cpu_init.c            |  1 +
  target/ppc/translate.c           |  4 ++--
  target/riscv/tcg/tcg-cpu.c       |  1 +
  target/riscv/translate.c         |  4 ++--
  target/rx/cpu.c                  |  1 +
  target/rx/translate.c            |  4 ++--
  target/s390x/cpu.c               |  1 +
  target/s390x/tcg/translate.c     |  4 ++--
  target/sh4/cpu.c                 |  1 +
  target/sh4/translate.c           |  4 ++--
  target/sparc/cpu.c               |  1 +
  target/sparc/translate.c         |  4 ++--
  target/tricore/cpu.c             |  1 +
  target/tricore/translate.c       |  5 ++---
  target/xtensa/cpu.c              |  1 +
  target/xtensa/translate.c        |  4 ++--
 files changed, 121 insertions(+), 62 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
+diff --git a/include/exec/translator.h b/include/exec/translator.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
+--- a/include/exec/translator.h
-+++ b/include/hw/core/cpu.h
++++ b/include/exec/translator.h
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUWatchpoint CPUWatchpoint;
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/bswap.h"
- struct TranslationBlock;
+ #include "exec/vaddr.h"
 -/**
-- * struct TcgCpuOperations: TCG operations specific to a CPU class
+- * gen_intermediate_code
 - * @cpu: cpu context
 - * @tb: translation block
 - * @max_insns: max number of instructions to translate
 - * @pc: guest virtual program counter address
 - * @host_pc: host physical program counter address
 - *
 - * This function must be provided by the target, which should create
 - * the target-specific DisasContext, and then invoke translator_loop.
 - */
--typedef struct TcgCpuOperations {
+-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int *max_insns,
--    /**
+-                           vaddr pc, void *host_pc);
 -     * @initialize: Initalize TCG state
 -     *
 -     * Called when the first CPU is realized.
 -     */
 -    void (*initialize)(void);
 -    /**
 -     * @synchronize_from_tb: Synchronize state from a TCG #TranslationBlock
 -     *
 -     * This is called when we abandon execution of a TB before starting it,
 -     * and must set all parts of the CPU state which the previous TB in the
 -     * chain may not have updated.
 -     * By default, when this is NULL, a call is made to @set_pc(tb->pc).
 -     *
 -     * If more state needs to be restored, the target must implement a
 -     * function to restore all the state, and register it here.
 -     */
 -    void (*synchronize_from_tb)(CPUState *cpu,
 -                                const struct TranslationBlock *tb);
 -    /** @cpu_exec_enter: Callback for cpu_exec preparation */
 -    void (*cpu_exec_enter)(CPUState *cpu);
 -    /** @cpu_exec_exit: Callback for cpu_exec cleanup */
 -    void (*cpu_exec_exit)(CPUState *cpu);
 -    /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
 -    bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
 -    /** @do_interrupt: Callback for interrupt handling. */
 -    void (*do_interrupt)(CPUState *cpu);
 -    /**
 -     * @tlb_fill: Handle a softmmu tlb miss or user-only address fault
 -     *
 -     * For system mode, if the access is valid, call tlb_set_page
 -     * and return true; if the access is invalid, and probe is
 -     * true, return false; otherwise raise an exception and do
 -     * not return.  For user-only mode, always raise an exception
 -     * and do not return.
 -     */
 -    bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
 -                     MMUAccessType access_type, int mmu_idx,
 -                     bool probe, uintptr_t retaddr);
 -    /** @debug_excp_handler: Callback for handling debug exceptions */
 -    void (*debug_excp_handler)(CPUState *cpu);
 -
 -    /**
 -     * @do_transaction_failed: Callback for handling failed memory transactions
 -     * (ie bus faults or external aborts; not MMU faults)
 -     */
 -    void (*do_transaction_failed)(CPUState *cpu, hwaddr physaddr, vaddr addr,
 -                                  unsigned size, MMUAccessType access_type,
 -                                  int mmu_idx, MemTxAttrs attrs,
 -                                  MemTxResult response, uintptr_t retaddr);
 -    /**
 -     * @do_unaligned_access: Callback for unaligned access handling
 -     */
 -    void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
 -                                MMUAccessType access_type,
 -                                int mmu_idx, uintptr_t retaddr);
 -    /**
 -     * @adjust_watchpoint_address: hack for cpu_check_watchpoint used by ARM
 -     */
 -    vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
 -
 -    /**
 -     * @debug_check_watchpoint: return true if the architectural
 -     * watchpoint whose address has matched should really fire, used by ARM
 -     */
 -    bool (*debug_check_watchpoint)(CPUState *cpu, CPUWatchpoint *wp);
 -
 -} TcgCpuOperations;
 +/* see tcg-cpu-ops.h */
 +struct TCGCPUOps;
  /**
   * CPUClass:
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
      int gdb_num_core_regs;
      bool gdb_stop_before_watchpoint;
 -    TcgCpuOperations tcg_ops;
 +    /* when TCG is not available, this pointer is NULL */
 +    struct TCGCPUOps *tcg_ops;
  };
  /*
@@ -XXX,XX +XXX,XX @@ CPUState *cpu_by_arch_id(int64_t id);
  void cpu_interrupt(CPUState *cpu, int mask);
 -static inline void cpu_unaligned_access(CPUState *cpu, vaddr addr,
 -                                        MMUAccessType access_type,
 -                                        int mmu_idx, uintptr_t retaddr)
 -{
 -    CPUClass *cc = CPU_GET_CLASS(cpu);
 -
 -    cc->tcg_ops.do_unaligned_access(cpu, addr, access_type, mmu_idx, retaddr);
 -}
 -
 -static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
 -                                          vaddr addr, unsigned size,
 -                                          MMUAccessType access_type,
 -                                          int mmu_idx, MemTxAttrs attrs,
 -                                          MemTxResult response,
 -                                          uintptr_t retaddr)
 -{
 -    CPUClass *cc = CPU_GET_CLASS(cpu);
 -
 -    if (!cpu->ignore_memory_transaction_failures &&
 -        cc->tcg_ops.do_transaction_failed) {
 -        cc->tcg_ops.do_transaction_failed(cpu, physaddr, addr, size,
 -                                          access_type, mmu_idx, attrs,
 -                                          response, retaddr);
 -    }
 -}
 -
  /**
-  * cpu_set_pc:
+  * DisasJumpType:
-  * @cpu: The CPU to set the program counter for.
+  * @DISAS_NEXT: Next instruction in program order.
 diff --git a/include/hw/core/tcg-cpu-ops.h b/include/hw/core/tcg-cpu-ops.h
-new file mode 100644
+index XXXXXXX..XXXXXXX 100644
-index XXXXXXX..XXXXXXX
+--- a/include/hw/core/tcg-cpu-ops.h
 --- /dev/null
 +++ b/include/hw/core/tcg-cpu-ops.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ struct TCGCPUOps {
-+/*
+      * Called when the first CPU is realized.
-+ * TCG CPU-specific operations
+      */
-+ *
+     void (*initialize)(void);
 + * Copyright 2021 SUSE LLC
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
 +#ifndef TCG_CPU_OPS_H
 +#define TCG_CPU_OPS_H
 +
 +#include "hw/core/cpu.h"
 +
 +struct TCGCPUOps {
 +    /**
-+     * @initialize: Initalize TCG state
++     * @translate_code: Translate guest instructions to TCGOps
 +     * @cpu: cpu context
 +     * @tb: translation block
 +     * @max_insns: max number of instructions to translate
 +     * @pc: guest virtual program counter address
 +     * @host_pc: host physical program counter address
 +     *
-+     * Called when the first CPU is realized.
++     * This function must be provided by the target, which should create
 +     * the target-specific DisasContext, and then invoke translator_loop.
 +     */
-+    void (*initialize)(void);
++    void (*translate_code)(CPUState *cpu, TranslationBlock *tb,
-+    /**
++                           int *max_insns, vaddr pc, void *host_pc);
-+     * @synchronize_from_tb: Synchronize state from a TCG #TranslationBlock
+     /**
-+     *
+      * @synchronize_from_tb: Synchronize state from a TCG #TranslationBlock
-+     * This is called when we abandon execution of a TB before starting it,
+      *
-+     * and must set all parts of the CPU state which the previous TB in the
+diff --git a/target/alpha/cpu.h b/target/alpha/cpu.h
-+     * chain may not have updated.
+index XXXXXXX..XXXXXXX 100644
-+     * By default, when this is NULL, a call is made to @set_pc(tb->pc).
+--- a/target/alpha/cpu.h
-+     *
++++ b/target/alpha/cpu.h
-+     * If more state needs to be restored, the target must implement a
+@@ -XXX,XX +XXX,XX @@ enum {
-+     * function to restore all the state, and register it here.
+ };
-+     */
-+    void (*synchronize_from_tb)(CPUState *cpu,
+ void alpha_translate_init(void);
-+                                const struct TranslationBlock *tb);
++void alpha_translate_code(CPUState *cs, TranslationBlock *tb,
-+    /** @cpu_exec_enter: Callback for cpu_exec preparation */
++                          int *max_insns, vaddr pc, void *host_pc);
-+    void (*cpu_exec_enter)(CPUState *cpu);
-+    /** @cpu_exec_exit: Callback for cpu_exec cleanup */
+ #define CPU_RESOLVING_TYPE TYPE_ALPHA_CPU
-+    void (*cpu_exec_exit)(CPUState *cpu);
 +    /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
 +    bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
 +    /**
 +     * @do_interrupt: Callback for interrupt handling.
 +     *
 +     * note that this is in general SOFTMMU only, but it actually isn't
 +     * because of an x86 hack (accel/tcg/cpu-exec.c), so we cannot put it
 +     * in the SOFTMMU section in general.
 +     */
 +    void (*do_interrupt)(CPUState *cpu);
 +    /**
 +     * @tlb_fill: Handle a softmmu tlb miss or user-only address fault
 +     *
 +     * For system mode, if the access is valid, call tlb_set_page
 +     * and return true; if the access is invalid, and probe is
 +     * true, return false; otherwise raise an exception and do
 +     * not return.  For user-only mode, always raise an exception
 +     * and do not return.
 +     */
 +    bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
 +                     MMUAccessType access_type, int mmu_idx,
 +                     bool probe, uintptr_t retaddr);
 +    /** @debug_excp_handler: Callback for handling debug exceptions */
 +    void (*debug_excp_handler)(CPUState *cpu);
 +
 +#ifdef NEED_CPU_H
 +#ifdef CONFIG_SOFTMMU
 +    /**
 +     * @do_transaction_failed: Callback for handling failed memory transactions
 +     * (ie bus faults or external aborts; not MMU faults)
 +     */
 +    void (*do_transaction_failed)(CPUState *cpu, hwaddr physaddr, vaddr addr,
 +                                  unsigned size, MMUAccessType access_type,
 +                                  int mmu_idx, MemTxAttrs attrs,
 +                                  MemTxResult response, uintptr_t retaddr);
 +    /**
 +     * @do_unaligned_access: Callback for unaligned access handling
 +     */
 +    void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
 +                                MMUAccessType access_type,
 +                                int mmu_idx, uintptr_t retaddr);
 +
 +    /**
 +     * @adjust_watchpoint_address: hack for cpu_check_watchpoint used by ARM
 +     */
 +    vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
 +
 +    /**
 +     * @debug_check_watchpoint: return true if the architectural
 +     * watchpoint whose address has matched should really fire, used by ARM
 +     */
 +    bool (*debug_check_watchpoint)(CPUState *cpu, CPUWatchpoint *wp);
 +
 +#endif /* CONFIG_SOFTMMU */
 +#endif /* NEED_CPU_H */
 +
 +};
 +
 +#endif /* TCG_CPU_OPS_H */
 diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/internals.h
 +++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ static inline int r14_bank_number(int mode)
+@@ -XXX,XX +XXX,XX @@ void init_cpreg_list(ARMCPU *cpu);
  void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu);
  void arm_translate_init(void);
++void arm_translate_code(CPUState *cs, TranslationBlock *tb,
-+#ifdef CONFIG_TCG
++                        int *max_insns, vaddr pc, void *host_pc);
-+void arm_cpu_synchronize_from_tb(CPUState *cs,
-+                                 const struct TranslationBlock *tb);
+ void arm_cpu_register_gdb_commands(ARMCPU *cpu);
-+#endif /* CONFIG_TCG */
+ void aarch64_cpu_register_gdb_commands(ARMCPU *cpu, GString *,
 diff --git a/target/avr/cpu.h b/target/avr/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/avr/cpu.h
 +++ b/target/avr/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline void set_avr_feature(CPUAVRState *env, int feature)
  }
  void avr_cpu_tcg_init(void);
 +void avr_cpu_translate_code(CPUState *cs, TranslationBlock *tb,
 +                            int *max_insns, vaddr pc, void *host_pc);
  int cpu_avr_exec(CPUState *cpu);
 diff --git a/target/hexagon/cpu.h b/target/hexagon/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hexagon/cpu.h
 +++ b/target/hexagon/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline void cpu_get_tb_cpu_state(CPUHexagonState *env, vaddr *pc,
  typedef HexagonCPU ArchCPU;
  void hexagon_translate_init(void);
 +void hexagon_translate_code(CPUState *cs, TranslationBlock *tb,
 +                            int *max_insns, vaddr pc, void *host_pc);
  #include "exec/cpu-all.h"
 diff --git a/target/hppa/cpu.h b/target/hppa/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hppa/cpu.h
 +++ b/target/hppa/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline int HPPA_BTLB_ENTRIES(CPUHPPAState *env)
  }
  void hppa_translate_init(void);
 +void hppa_translate_code(CPUState *cs, TranslationBlock *tb,
 +                         int *max_insns, vaddr pc, void *host_pc);
  #define CPU_RESOLVING_TYPE TYPE_HPPA_CPU
 diff --git a/target/i386/tcg/helper-tcg.h b/target/i386/tcg/helper-tcg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/helper-tcg.h
 +++ b/target/i386/tcg/helper-tcg.h
@@ -XXX,XX +XXX,XX @@ static inline target_long lshift(target_long x, int n)
  /* translate.c */
  void tcg_x86_init(void);
 +void x86_translate_code(CPUState *cs, TranslationBlock *tb,
 +                        int *max_insns, vaddr pc, void *host_pc);
  /* excp_helper.c */
  G_NORETURN void raise_exception(CPUX86State *env, int exception_index);
 diff --git a/target/loongarch/internals.h b/target/loongarch/internals.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/loongarch/internals.h
 +++ b/target/loongarch/internals.h
@@ -XXX,XX +XXX,XX @@
  #define TARGET_VIRT_MASK MAKE_64BIT_MASK(0, TARGET_VIRT_ADDR_SPACE_BITS)
  void loongarch_translate_init(void);
 +void loongarch_translate_code(CPUState *cs, TranslationBlock *tb,
 +                              int *max_insns, vaddr pc, void *host_pc);
  void G_NORETURN do_raise_exception(CPULoongArchState *env,
                                     uint32_t exception,
 diff --git a/target/m68k/cpu.h b/target/m68k/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/m68k/cpu.h
 +++ b/target/m68k/cpu.h
@@ -XXX,XX +XXX,XX @@ int m68k_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
  int m68k_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
  void m68k_tcg_init(void);
 +void m68k_translate_code(CPUState *cs, TranslationBlock *tb,
 +                         int *max_insns, vaddr pc, void *host_pc);
  void m68k_cpu_init_gdb(M68kCPU *cpu);
  uint32_t cpu_m68k_get_ccr(CPUM68KState *env);
  void cpu_m68k_set_ccr(CPUM68KState *env, uint32_t);
 diff --git a/target/microblaze/cpu.h b/target/microblaze/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/microblaze/cpu.h
 +++ b/target/microblaze/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline void mb_cpu_write_msr(CPUMBState *env, uint32_t val)
  }
  void mb_tcg_init(void);
 +void mb_translate_code(CPUState *cs, TranslationBlock *tb,
 +                       int *max_insns, vaddr pc, void *host_pc);
  #define CPU_RESOLVING_TYPE TYPE_MICROBLAZE_CPU
 diff --git a/target/mips/tcg/tcg-internal.h b/target/mips/tcg/tcg-internal.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/tcg/tcg-internal.h
 +++ b/target/mips/tcg/tcg-internal.h
@@ -XXX,XX +XXX,XX @@
  #include "cpu.h"
  void mips_tcg_init(void);
 +void mips_translate_code(CPUState *cs, TranslationBlock *tb,
 +                         int *max_insns, vaddr pc, void *host_pc);
  void mips_cpu_synchronize_from_tb(CPUState *cs, const TranslationBlock *tb);
  G_NORETURN void mips_cpu_do_unaligned_access(CPUState *cpu, vaddr addr,
 diff --git a/target/openrisc/cpu.h b/target/openrisc/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/openrisc/cpu.h
 +++ b/target/openrisc/cpu.h
@@ -XXX,XX +XXX,XX @@ void openrisc_cpu_dump_state(CPUState *cpu, FILE *f, int flags);
  int openrisc_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
  int openrisc_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
  void openrisc_translate_init(void);
 +void openrisc_translate_code(CPUState *cs, TranslationBlock *tb,
 +                             int *max_insns, vaddr pc, void *host_pc);
  int print_insn_or1k(bfd_vma addr, disassemble_info *info);
  #ifndef CONFIG_USER_ONLY
 diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/ppc/cpu.h
 +++ b/target/ppc/cpu.h
@@ -XXX,XX +XXX,XX @@ extern const VMStateDescription vmstate_ppc_cpu;
  /*****************************************************************************/
  void ppc_translate_init(void);
 +void ppc_translate_code(CPUState *cs, TranslationBlock *tb,
 +                        int *max_insns, vaddr pc, void *host_pc);
  #if !defined(CONFIG_USER_ONLY)
  void ppc_store_sdr1(CPUPPCState *env, target_ulong value);
 diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.h
 +++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ RISCVException smstateen_acc_ok(CPURISCVState *env, int index, uint64_t bit);
  void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv, bool virt_en);
  void riscv_translate_init(void);
 +void riscv_translate_code(CPUState *cs, TranslationBlock *tb,
 +                          int *max_insns, vaddr pc, void *host_pc);
 +
-+
+ G_NORETURN void riscv_raise_exception(CPURISCVState *env,
- enum arm_fprounding {
+                                       uint32_t exception, uintptr_t pc);
-     FPROUNDING_TIEEVEN,
-     FPROUNDING_POSINF,
+diff --git a/target/rx/cpu.h b/target/rx/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/rx/cpu.h
 +++ b/target/rx/cpu.h
@@ -XXX,XX +XXX,XX @@ int rx_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
  int rx_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
  void rx_translate_init(void);
 +void rx_translate_code(CPUState *cs, TranslationBlock *tb,
 +                       int *max_insns, vaddr pc, void *host_pc);
  void rx_cpu_unpack_psw(CPURXState *env, uint32_t psw, int rte);
  #include "exec/cpu-all.h"
 diff --git a/target/s390x/s390x-internal.h b/target/s390x/s390x-internal.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/s390x-internal.h
 +++ b/target/s390x/s390x-internal.h
@@ -XXX,XX +XXX,XX @@ void handle_diag_308(CPUS390XState *env, uint64_t r1, uint64_t r3,
  /* translate.c */
  void s390x_translate_init(void);
 +void s390x_translate_code(CPUState *cs, TranslationBlock *tb,
 +                          int *max_insns, vaddr pc, void *host_pc);
  void s390x_restore_state_to_opc(CPUState *cs,
                                  const TranslationBlock *tb,
                                  const uint64_t *data);
 diff --git a/target/sh4/cpu.h b/target/sh4/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sh4/cpu.h
 +++ b/target/sh4/cpu.h
@@ -XXX,XX +XXX,XX @@ G_NORETURN void superh_cpu_do_unaligned_access(CPUState *cpu, vaddr addr,
                                                 uintptr_t retaddr);
  void sh4_translate_init(void);
 +void sh4_translate_code(CPUState *cs, TranslationBlock *tb,
 +                        int *max_insns, vaddr pc, void *host_pc);
  #if !defined(CONFIG_USER_ONLY)
  hwaddr superh_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
 diff --git a/target/sparc/cpu.h b/target/sparc/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sparc/cpu.h
 +++ b/target/sparc/cpu.h
@@ -XXX,XX +XXX,XX @@ int sparc_cpu_memory_rw_debug(CPUState *cpu, vaddr addr,
  /* translate.c */
  void sparc_tcg_init(void);
 +void sparc_translate_code(CPUState *cs, TranslationBlock *tb,
 +                          int *max_insns, vaddr pc, void *host_pc);
  /* fop_helper.c */
  target_ulong cpu_get_fsr(CPUSPARCState *);
 diff --git a/target/tricore/cpu.h b/target/tricore/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tricore/cpu.h
 +++ b/target/tricore/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(TB_FLAGS, PRIV, 0, 2)
  void cpu_state_reset(CPUTriCoreState *s);
  void tricore_tcg_init(void);
 +void tricore_translate_code(CPUState *cs, TranslationBlock *tb,
 +                            int *max_insns, vaddr pc, void *host_pc);
  static inline void cpu_get_tb_cpu_state(CPUTriCoreState *env, vaddr *pc,
                                          uint64_t *cs_base, uint32_t *flags)
 diff --git a/target/xtensa/cpu.h b/target/xtensa/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/xtensa/cpu.h
 +++ b/target/xtensa/cpu.h
@@ -XXX,XX +XXX,XX @@ G_NORETURN void xtensa_cpu_do_unaligned_access(CPUState *cpu, vaddr addr,
  void xtensa_collect_sr_names(const XtensaConfig *config);
  void xtensa_translate_init(void);
 +void xtensa_translate_code(CPUState *cs, TranslationBlock *tb,
 +                           int *max_insns, vaddr pc, void *host_pc);
  void **xtensa_get_regfile_by_name(const char *name, int entries, int bits);
  void xtensa_breakpoint_handler(CPUState *cs);
  void xtensa_register_core(XtensaConfigList *node);
 diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cpu-exec.c
 +++ b/accel/tcg/cpu-exec.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ bool tcg_exec_realizefn(CPUState *cpu, Error **errp)
  #include "qemu-common.h"
  #include "qemu/qemu-print.h"
  #include "cpu.h"
 +#include "hw/core/tcg-cpu-ops.h"
  #include "trace.h"
  #include "disas/disas.h"
  #include "exec/exec-all.h"
@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
                                 TARGET_FMT_lx "] %s\n",
                                 last_tb->tc.ptr, last_tb->pc,
                                 lookup_symbol(last_tb->pc));
 -        if (cc->tcg_ops.synchronize_from_tb) {
 -            cc->tcg_ops.synchronize_from_tb(cpu, last_tb);
 +        if (cc->tcg_ops->synchronize_from_tb) {
 +            cc->tcg_ops->synchronize_from_tb(cpu, last_tb);
          } else {
              assert(cc->set_pc);
              cc->set_pc(cpu, last_tb->pc);
@@ -XXX,XX +XXX,XX @@ static void cpu_exec_enter(CPUState *cpu)
  {
      CPUClass *cc = CPU_GET_CLASS(cpu);
 -    if (cc->tcg_ops.cpu_exec_enter) {
 -        cc->tcg_ops.cpu_exec_enter(cpu);
 +    if (cc->tcg_ops->cpu_exec_enter) {
 +        cc->tcg_ops->cpu_exec_enter(cpu);
      }
  }
@@ -XXX,XX +XXX,XX @@ static void cpu_exec_exit(CPUState *cpu)
  {
      CPUClass *cc = CPU_GET_CLASS(cpu);
 -    if (cc->tcg_ops.cpu_exec_exit) {
 -        cc->tcg_ops.cpu_exec_exit(cpu);
 +    if (cc->tcg_ops->cpu_exec_exit) {
 +        cc->tcg_ops->cpu_exec_exit(cpu);
      }
  }
@@ -XXX,XX +XXX,XX @@ static inline void cpu_handle_debug_exception(CPUState *cpu)
          }
      }
 -    if (cc->tcg_ops.debug_excp_handler) {
 -        cc->tcg_ops.debug_excp_handler(cpu);
 +    if (cc->tcg_ops->debug_excp_handler) {
 +        cc->tcg_ops->debug_excp_handler(cpu);
      }
  }
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
             loop */
  #if defined(TARGET_I386)
          CPUClass *cc = CPU_GET_CLASS(cpu);
 -        cc->tcg_ops.do_interrupt(cpu);
 +        cc->tcg_ops->do_interrupt(cpu);
  #endif
          *ret = cpu->exception_index;
          cpu->exception_index = -1;
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
          if (replay_exception()) {
              CPUClass *cc = CPU_GET_CLASS(cpu);
              qemu_mutex_lock_iothread();
 -            cc->tcg_ops.do_interrupt(cpu);
 +            cc->tcg_ops->do_interrupt(cpu);
              qemu_mutex_unlock_iothread();
              cpu->exception_index = -1;
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
             True when it is, and we should restart on a new TB,
             and via longjmp via cpu_loop_exit.  */
          else {
 -            if (cc->tcg_ops.cpu_exec_interrupt &&
 -                cc->tcg_ops.cpu_exec_interrupt(cpu, interrupt_request)) {
 +            if (cc->tcg_ops->cpu_exec_interrupt &&
 +                cc->tcg_ops->cpu_exec_interrupt(cpu, interrupt_request)) {
                  if (need_replay_interrupt(interrupt_request)) {
                      replay_interrupt();
                  }
@@ -XXX,XX +XXX,XX @@ void tcg_exec_realizefn(CPUState *cpu, Error **errp)
      CPUClass *cc = CPU_GET_CLASS(cpu);
      if (!tcg_target_initialized) {
--        cc->tcg_ops.initialize();
+         /* Check mandatory TCGCPUOps handlers */
-+        cc->tcg_ops->initialize();
++        const TCGCPUOps *tcg_ops = cpu->cc->tcg_ops;
  #ifndef CONFIG_USER_ONLY
 -        assert(cpu->cc->tcg_ops->cpu_exec_halt);
 -        assert(cpu->cc->tcg_ops->cpu_exec_interrupt);
 +        assert(tcg_ops->cpu_exec_halt);
 +        assert(tcg_ops->cpu_exec_interrupt);
  #endif /* !CONFIG_USER_ONLY */
 -        cpu->cc->tcg_ops->initialize();
 +        assert(tcg_ops->translate_code);
 +        tcg_ops->initialize();
          tcg_target_initialized = true;
      }
-     tlb_init(cpu);
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/accel/tcg/translate-all.c
-+++ b/accel/tcg/cputlb.c
++++ b/accel/tcg/translate-all.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static int setjmp_gen_code(CPUArchState *env, TranslationBlock *tb,
- #include "qemu/osdep.h"
- #include "qemu/main-loop.h"
+     tcg_func_start(tcg_ctx);
- #include "cpu.h"
-+#include "hw/core/tcg-cpu-ops.h"
+-    tcg_ctx->cpu = env_cpu(env);
- #include "exec/exec-all.h"
+-    gen_intermediate_code(env_cpu(env), tb, max_insns, pc, host_pc);
- #include "exec/memory.h"
++    CPUState *cs = env_cpu(env);
- #include "exec/address-spaces.h"
++    tcg_ctx->cpu = cs;
-@@ -XXX,XX +XXX,XX @@ static void tlb_fill(CPUState *cpu, target_ulong addr, int size,
++    cs->cc->tcg_ops->translate_code(cs, tb, max_insns, pc, host_pc);
       * This is not a probe, so only valid return is success; failure
       * should result in exception + longjmp to the cpu loop.
       */
 -    ok = cc->tcg_ops.tlb_fill(cpu, addr, size,
 -                              access_type, mmu_idx, false, retaddr);
 +    ok = cc->tcg_ops->tlb_fill(cpu, addr, size,
 +                               access_type, mmu_idx, false, retaddr);
      assert(ok);
  }
 +static inline void cpu_unaligned_access(CPUState *cpu, vaddr addr,
 +                                        MMUAccessType access_type,
 +                                        int mmu_idx, uintptr_t retaddr)
 +{
 +    CPUClass *cc = CPU_GET_CLASS(cpu);
 +
-+    cc->tcg_ops->do_unaligned_access(cpu, addr, access_type, mmu_idx, retaddr);
+     assert(tb->size != 0);
-+}
+     tcg_ctx->cpu = NULL;
-+
+     *max_insns = tb->icount;
-+static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
+@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
-+                                          vaddr addr, unsigned size,
+             /*
-+                                          MMUAccessType access_type,
+              * Overflow of code_gen_buffer, or the current slice of it.
-+                                          int mmu_idx, MemTxAttrs attrs,
+              *
-+                                          MemTxResult response,
+-             * TODO: We don't need to re-do gen_intermediate_code, nor
-+                                          uintptr_t retaddr)
++             * TODO: We don't need to re-do tcg_ops->translate_code, nor
-+{
+              * should we re-do the tcg optimization currently hidden
-+    CPUClass *cc = CPU_GET_CLASS(cpu);
+              * inside tcg_gen_code.  All that should be required is to
-+
+              * flush the TBs, allocate a new TB, re-initialize it per
 +    if (!cpu->ignore_memory_transaction_failures &&
 +        cc->tcg_ops->do_transaction_failed) {
 +        cc->tcg_ops->do_transaction_failed(cpu, physaddr, addr, size,
 +                                           access_type, mmu_idx, attrs,
 +                                           response, retaddr);
 +    }
 +}
 +
  static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
                           int mmu_idx, target_ulong addr, uintptr_t retaddr,
                           MMUAccessType access_type, MemOp op)
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
              CPUState *cs = env_cpu(env);
              CPUClass *cc = CPU_GET_CLASS(cs);
 -            if (!cc->tcg_ops.tlb_fill(cs, addr, fault_size, access_type,
 -                                      mmu_idx, nonfault, retaddr)) {
 +            if (!cc->tcg_ops->tlb_fill(cs, addr, fault_size, access_type,
 +                                       mmu_idx, nonfault, retaddr)) {
                  /* Non-faulting page table read failed.  */
                  *phost = NULL;
                  return TLB_INVALID_MASK;
 diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/user-exec.c
 +++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
  #include "cpu.h"
 +#include "hw/core/tcg-cpu-ops.h"
  #include "disas/disas.h"
  #include "exec/exec-all.h"
  #include "tcg/tcg.h"
@@ -XXX,XX +XXX,XX @@ static inline int handle_cpu_signal(uintptr_t pc, siginfo_t *info,
      clear_helper_retaddr();
      cc = CPU_GET_CLASS(cpu);
 -    cc->tcg_ops.tlb_fill(cpu, address, 0, access_type,
 -                         MMU_USER_IDX, false, pc);
 +    cc->tcg_ops->tlb_fill(cpu, address, 0, access_type,
 +                          MMU_USER_IDX, false, pc);
      g_assert_not_reached();
  }
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
          } else {
              CPUState *cpu = env_cpu(env);
              CPUClass *cc = CPU_GET_CLASS(cpu);
 -            cc->tcg_ops.tlb_fill(cpu, addr, fault_size, access_type,
 -                                 MMU_USER_IDX, false, ra);
 +            cc->tcg_ops->tlb_fill(cpu, addr, fault_size, access_type,
 +                                  MMU_USER_IDX, false, ra);
              g_assert_not_reached();
          }
      }
 diff --git a/hw/mips/jazz.c b/hw/mips/jazz.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/mips/jazz.c
 +++ b/hw/mips/jazz.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include "qemu/error-report.h"
  #include "qemu/help_option.h"
 +#ifdef CONFIG_TCG
 +#include "hw/core/tcg-cpu-ops.h"
 +#endif /* CONFIG_TCG */
  enum jazz_model_e {
      JAZZ_MAGNUM,
@@ -XXX,XX +XXX,XX @@ static void mips_jazz_init(MachineState *machine,
       */
      cc = CPU_GET_CLASS(cpu);
  #if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
 -    real_do_transaction_failed = cc->tcg_ops.do_transaction_failed;
 -    cc->tcg_ops.do_transaction_failed = mips_jazz_do_transaction_failed;
 +    real_do_transaction_failed = cc->tcg_ops->do_transaction_failed;
 +    cc->tcg_ops->do_transaction_failed = mips_jazz_do_transaction_failed;
  #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
      /* allocate RAM */
 diff --git a/softmmu/physmem.c b/softmmu/physmem.c
 index XXXXXXX..XXXXXXX 100644
 --- a/softmmu/physmem.c
 +++ b/softmmu/physmem.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/cutils.h"
  #include "qemu/cacheflush.h"
  #include "cpu.h"
 +
 +#ifdef CONFIG_TCG
 +#include "hw/core/tcg-cpu-ops.h"
 +#endif /* CONFIG_TCG */
 +
  #include "exec/exec-all.h"
  #include "exec/target_page.h"
  #include "hw/qdev-core.h"
@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
          return;
      }
 -    if (cc->tcg_ops.adjust_watchpoint_address) {
 +    if (cc->tcg_ops->adjust_watchpoint_address) {
          /* this is currently used only by ARM BE32 */
 -        addr = cc->tcg_ops.adjust_watchpoint_address(cpu, addr, len);
 +        addr = cc->tcg_ops->adjust_watchpoint_address(cpu, addr, len);
      }
      QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
          if (watchpoint_address_matches(wp, addr, len)
@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
              wp->hitaddr = MAX(addr, wp->vaddr);
              wp->hitattrs = attrs;
              if (!cpu->watchpoint_hit) {
 -                if (wp->flags & BP_CPU && cc->tcg_ops.debug_check_watchpoint &&
 -                    !cc->tcg_ops.debug_check_watchpoint(cpu, wp)) {
 +                if (wp->flags & BP_CPU && cc->tcg_ops->debug_check_watchpoint &&
 +                    !cc->tcg_ops->debug_check_watchpoint(cpu, wp)) {
                      wp->flags &= ~BP_WATCHPOINT_HIT;
                      continue;
                  }
 diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/alpha/cpu.c
 +++ b/target/alpha/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_initfn(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps alpha_sysemu_ops = {
- #endif
- }
+ static const TCGCPUOps alpha_tcg_ops = {
+     .initialize = alpha_translate_init,
-+#include "hw/core/tcg-cpu-ops.h"
++    .translate_code = alpha_translate_code,
-+
+     .synchronize_from_tb = alpha_cpu_synchronize_from_tb,
-+static struct TCGCPUOps alpha_tcg_ops = {
+     .restore_state_to_opc = alpha_restore_state_to_opc,
-+    .initialize = alpha_translate_init,
-+    .cpu_exec_interrupt = alpha_cpu_exec_interrupt,
+diff --git a/target/alpha/translate.c b/target/alpha/translate.c
-+    .tlb_fill = alpha_cpu_tlb_fill,
+index XXXXXXX..XXXXXXX 100644
-+
+--- a/target/alpha/translate.c
-+#ifndef CONFIG_USER_ONLY
++++ b/target/alpha/translate.c
-+    .do_interrupt = alpha_cpu_do_interrupt,
+@@ -XXX,XX +XXX,XX @@ static const TranslatorOps alpha_tr_ops = {
-+    .do_transaction_failed = alpha_cpu_do_transaction_failed,
+     .tb_stop            = alpha_tr_tb_stop,
-+    .do_unaligned_access = alpha_cpu_do_unaligned_access,
+ };
-+#endif /* !CONFIG_USER_ONLY */
-+};
+-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int *max_insns,
-+
+-                           vaddr pc, void *host_pc)
- static void alpha_cpu_class_init(ObjectClass *oc, void *data)
++void alpha_translate_code(CPUState *cpu, TranslationBlock *tb,
- {
++                          int *max_insns, vaddr pc, void *host_pc)
-     DeviceClass *dc = DEVICE_CLASS(oc);
+ {
-@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
+     DisasContext dc;
+     translator_loop(cpu, tb, max_insns, pc, host_pc, &alpha_tr_ops, &dc.base);
      cc->class_by_name = alpha_cpu_class_by_name;
      cc->has_work = alpha_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = alpha_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = alpha_cpu_exec_interrupt;
      cc->dump_state = alpha_cpu_dump_state;
      cc->set_pc = alpha_cpu_set_pc;
      cc->gdb_read_register = alpha_cpu_gdb_read_register;
      cc->gdb_write_register = alpha_cpu_gdb_write_register;
 -    cc->tcg_ops.tlb_fill = alpha_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
 -    cc->tcg_ops.do_transaction_failed = alpha_cpu_do_transaction_failed;
 -    cc->tcg_ops.do_unaligned_access = alpha_cpu_do_unaligned_access;
      cc->get_phys_page_debug = alpha_cpu_get_phys_page_debug;
      dc->vmsd = &vmstate_alpha_cpu;
  #endif
      cc->disas_set_info = alpha_cpu_disas_set_info;
 -    cc->tcg_ops.initialize = alpha_translate_init;
 +    cc->tcg_ops = &alpha_tcg_ops;
      cc->gdb_num_core_regs = 67;
  }
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps arm_sysemu_ops = {
  #include "qapi/error.h"
  #include "qapi/visitor.h"
  #include "cpu.h"
 +#ifdef CONFIG_TCG
 +#include "hw/core/tcg-cpu-ops.h"
 +#endif /* CONFIG_TCG */
  #include "internals.h"
  #include "exec/exec-all.h"
  #include "hw/qdev-properties.h"
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_set_pc(CPUState *cs, vaddr value)
  }
  #ifdef CONFIG_TCG
--static void arm_cpu_synchronize_from_tb(CPUState *cs,
+ static const TCGCPUOps arm_tcg_ops = {
--                                        const TranslationBlock *tb)
+     .initialize = arm_translate_init,
-+void arm_cpu_synchronize_from_tb(CPUState *cs,
++    .translate_code = arm_translate_code,
-+                                 const TranslationBlock *tb)
+     .synchronize_from_tb = arm_cpu_synchronize_from_tb,
- {
+     .debug_excp_handler = arm_debug_excp_handler,
-     ARMCPU *cpu = ARM_CPU(cs);
+     .restore_state_to_opc = arm_restore_state_to_opc,
-     CPUARMState *env = &cpu->env;
+diff --git a/target/arm/tcg/cpu-v7m.c b/target/arm/tcg/cpu-v7m.c
-@@ -XXX,XX +XXX,XX @@ bool arm_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
+index XXXXXXX..XXXXXXX 100644
-  found:
+--- a/target/arm/tcg/cpu-v7m.c
-     cs->exception_index = excp_idx;
++++ b/target/arm/tcg/cpu-v7m.c
-     env->exception.target_el = target_el;
+@@ -XXX,XX +XXX,XX @@ static void cortex_m55_initfn(Object *obj)
--    cc->tcg_ops.do_interrupt(cs);
-+    cc->tcg_ops->do_interrupt(cs);
+ static const TCGCPUOps arm_v7m_tcg_ops = {
-     return true;
+     .initialize = arm_translate_init,
- }
++    .translate_code = arm_translate_code,
+     .synchronize_from_tb = arm_cpu_synchronize_from_tb,
-@@ -XXX,XX +XXX,XX @@ static gchar *arm_gdb_arch_name(CPUState *cs)
+     .debug_excp_handler = arm_debug_excp_handler,
-     return g_strdup("arm");
+     .restore_state_to_opc = arm_restore_state_to_opc,
- }
+diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c
+index XXXXXXX..XXXXXXX 100644
-+#ifdef CONFIG_TCG
+--- a/target/arm/tcg/translate.c
-+static struct TCGCPUOps arm_tcg_ops = {
++++ b/target/arm/tcg/translate.c
-+    .initialize = arm_translate_init,
+@@ -XXX,XX +XXX,XX @@ static const TranslatorOps thumb_translator_ops = {
-+    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
+     .tb_stop            = arm_tr_tb_stop,
-+    .cpu_exec_interrupt = arm_cpu_exec_interrupt,
+ };
-+    .tlb_fill = arm_cpu_tlb_fill,
-+    .debug_excp_handler = arm_debug_excp_handler,
+-/* generate intermediate code for basic block 'tb'.  */
-+
+-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int *max_insns,
-+#if !defined(CONFIG_USER_ONLY)
+-                           vaddr pc, void *host_pc)
-+    .do_interrupt = arm_cpu_do_interrupt,
++void arm_translate_code(CPUState *cpu, TranslationBlock *tb,
-+    .do_transaction_failed = arm_cpu_do_transaction_failed,
++                        int *max_insns, vaddr pc, void *host_pc)
-+    .do_unaligned_access = arm_cpu_do_unaligned_access,
+ {
-+    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
+     DisasContext dc = { };
-+    .debug_check_watchpoint = arm_debug_check_watchpoint,
+     const TranslatorOps *ops = &arm_translator_ops;
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +#endif /* CONFIG_TCG */
 +
  static void arm_cpu_class_init(ObjectClass *oc, void *data)
  {
      ARMCPUClass *acc = ARM_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
      cc->gdb_get_dynamic_xml = arm_gdb_get_dynamic_xml;
      cc->gdb_stop_before_watchpoint = true;
      cc->disas_set_info = arm_disas_set_info;
 +
  #ifdef CONFIG_TCG
 -    cc->tcg_ops.initialize = arm_translate_init;
 -    cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
 -    cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
 -    cc->tcg_ops.tlb_fill = arm_cpu_tlb_fill;
 -    cc->tcg_ops.debug_excp_handler = arm_debug_excp_handler;
 -#if !defined(CONFIG_USER_ONLY)
 -    cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
 -    cc->tcg_ops.do_transaction_failed = arm_cpu_do_transaction_failed;
 -    cc->tcg_ops.do_unaligned_access = arm_cpu_do_unaligned_access;
 -    cc->tcg_ops.adjust_watchpoint_address = arm_adjust_watchpoint_address;
 -    cc->tcg_ops.debug_check_watchpoint = arm_debug_check_watchpoint;
 -#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 +    cc->tcg_ops = &arm_tcg_ops;
  #endif /* CONFIG_TCG */
  }
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qapi/error.h"
  #include "cpu.h"
 +#ifdef CONFIG_TCG
 +#include "hw/core/tcg-cpu-ops.h"
 +#endif /* CONFIG_TCG */
  #include "qemu/module.h"
  #if !defined(CONFIG_USER_ONLY)
  #include "hw/loader.h"
@@ -XXX,XX +XXX,XX @@ static void aarch64_cpu_class_init(ObjectClass *oc, void *data)
  {
      CPUClass *cc = CPU_CLASS(oc);
 -#ifdef CONFIG_TCG
 -    cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
 -#endif /* CONFIG_TCG */
 -
      cc->gdb_read_register = aarch64_cpu_gdb_read_register;
      cc->gdb_write_register = aarch64_cpu_gdb_write_register;
      cc->gdb_num_core_regs = 34;
 diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu_tcg.c
 +++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "cpu.h"
 +#ifdef CONFIG_TCG
 +#include "hw/core/tcg-cpu-ops.h"
 +#endif /* CONFIG_TCG */
  #include "internals.h"
  /* CPU models. These are not needed for the AArch64 linux-user build. */
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
      if (interrupt_request & CPU_INTERRUPT_HARD
          && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
          cs->exception_index = EXCP_IRQ;
 -        cc->tcg_ops.do_interrupt(cs);
 +        cc->tcg_ops->do_interrupt(cs);
          ret = true;
      }
      return ret;
@@ -XXX,XX +XXX,XX @@ static void pxa270c5_initfn(Object *obj)
      cpu->reset_sctlr = 0x00000078;
  }
 +#ifdef CONFIG_TCG
 +static struct TCGCPUOps arm_v7m_tcg_ops = {
 +    .initialize = arm_translate_init,
 +    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
 +    .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
 +    .tlb_fill = arm_cpu_tlb_fill,
 +    .debug_excp_handler = arm_debug_excp_handler,
 +
 +#if !defined(CONFIG_USER_ONLY)
 +    .do_interrupt = arm_v7m_cpu_do_interrupt,
 +    .do_transaction_failed = arm_cpu_do_transaction_failed,
 +    .do_unaligned_access = arm_cpu_do_unaligned_access,
 +    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
 +    .debug_check_watchpoint = arm_debug_check_watchpoint,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +#endif /* CONFIG_TCG */
 +
  static void arm_v7m_class_init(ObjectClass *oc, void *data)
  {
      ARMCPUClass *acc = ARM_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
      acc->info = data;
  #ifdef CONFIG_TCG
 -    cc->tcg_ops.cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt;
 -#ifndef CONFIG_USER_ONLY
 -    cc->tcg_ops.do_interrupt = arm_v7m_cpu_do_interrupt;
 -#endif
 +    cc->tcg_ops = &arm_v7m_tcg_ops;
  #endif /* CONFIG_TCG */
      cc->gdb_core_xml_file = "arm-m-profile.xml";
 diff --git a/target/avr/cpu.c b/target/avr/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/avr/cpu.c
 +++ b/target/avr/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void avr_cpu_dump_state(CPUState *cs, FILE *f, int flags)
+@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps avr_sysemu_ops = {
-     qemu_fprintf(f, "\n");
- }
+ static const TCGCPUOps avr_tcg_ops = {
+     .initialize = avr_cpu_tcg_init,
-+#include "hw/core/tcg-cpu-ops.h"
++    .translate_code = avr_cpu_translate_code,
-+
+     .synchronize_from_tb = avr_cpu_synchronize_from_tb,
-+static struct TCGCPUOps avr_tcg_ops = {
+     .restore_state_to_opc = avr_restore_state_to_opc,
-+    .initialize = avr_cpu_tcg_init,
+     .cpu_exec_interrupt = avr_cpu_exec_interrupt,
-+    .synchronize_from_tb = avr_cpu_synchronize_from_tb,
+diff --git a/target/avr/translate.c b/target/avr/translate.c
-+    .cpu_exec_interrupt = avr_cpu_exec_interrupt,
+index XXXXXXX..XXXXXXX 100644
-+    .tlb_fill = avr_cpu_tlb_fill,
+--- a/target/avr/translate.c
-+
++++ b/target/avr/translate.c
-+#ifndef CONFIG_USER_ONLY
+@@ -XXX,XX +XXX,XX @@ static bool trans_WDR(DisasContext *ctx, arg_WDR *a)
-+    .do_interrupt = avr_cpu_do_interrupt,
+  *
-+#endif /* !CONFIG_USER_ONLY */
+  *    - translate()
-+};
+  *    - canonicalize_skip()
-+
+- *    - gen_intermediate_code()
- static void avr_cpu_class_init(ObjectClass *oc, void *data)
++ *    - translate_code()
- {
+  *    - restore_state_to_opc()
-     DeviceClass *dc = DEVICE_CLASS(oc);
+  *
-@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
+  */
-     cc->class_by_name = avr_cpu_class_by_name;
+@@ -XXX,XX +XXX,XX @@ static const TranslatorOps avr_tr_ops = {
+     .tb_stop            = avr_tr_tb_stop,
-     cc->has_work = avr_cpu_has_work;
+ };
--    cc->tcg_ops.do_interrupt = avr_cpu_do_interrupt;
--    cc->tcg_ops.cpu_exec_interrupt = avr_cpu_exec_interrupt;
+-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int *max_insns,
-     cc->dump_state = avr_cpu_dump_state;
+-                           vaddr pc, void *host_pc)
-     cc->set_pc = avr_cpu_set_pc;
++void avr_cpu_translate_code(CPUState *cs, TranslationBlock *tb,
-     cc->memory_rw_debug = avr_cpu_memory_rw_debug;
++                            int *max_insns, vaddr pc, void *host_pc)
-     cc->get_phys_page_debug = avr_cpu_get_phys_page_debug;
+ {
--    cc->tcg_ops.tlb_fill = avr_cpu_tlb_fill;
+     DisasContext dc = { };
-     cc->vmsd = &vms_avr_cpu;
+     translator_loop(cs, tb, max_insns, pc, host_pc, &avr_tr_ops, &dc.base);
-     cc->disas_set_info = avr_cpu_disas_set_info;
+diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
--    cc->tcg_ops.initialize = avr_cpu_tcg_init;
+index XXXXXXX..XXXXXXX 100644
--    cc->tcg_ops.synchronize_from_tb = avr_cpu_synchronize_from_tb;
+--- a/target/hexagon/cpu.c
-     cc->gdb_read_register = avr_cpu_gdb_read_register;
++++ b/target/hexagon/cpu.c
-     cc->gdb_write_register = avr_cpu_gdb_write_register;
+@@ -XXX,XX +XXX,XX @@ static void hexagon_cpu_init(Object *obj)
-     cc->gdb_num_core_regs = 35;
-     cc->gdb_core_xml_file = "avr-cpu.xml";
+ static const TCGCPUOps hexagon_tcg_ops = {
-+    cc->tcg_ops = &avr_tcg_ops;
+     .initialize = hexagon_translate_init,
- }
++    .translate_code = hexagon_translate_code,
+     .synchronize_from_tb = hexagon_cpu_synchronize_from_tb,
- /*
+     .restore_state_to_opc = hexagon_restore_state_to_opc,
-diff --git a/target/avr/helper.c b/target/avr/helper.c
+ };
-index XXXXXXX..XXXXXXX 100644
+diff --git a/target/hexagon/translate.c b/target/hexagon/translate.c
---- a/target/avr/helper.c
+index XXXXXXX..XXXXXXX 100644
-+++ b/target/avr/helper.c
+--- a/target/hexagon/translate.c
-@@ -XXX,XX +XXX,XX @@
++++ b/target/hexagon/translate.c
+@@ -XXX,XX +XXX,XX @@ static const TranslatorOps hexagon_tr_ops = {
- #include "qemu/osdep.h"
+     .tb_stop            = hexagon_tr_tb_stop,
- #include "cpu.h"
+ };
-+#include "hw/core/tcg-cpu-ops.h"
- #include "exec/exec-all.h"
+-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int *max_insns,
- #include "exec/address-spaces.h"
+-                           vaddr pc, void *host_pc)
- #include "exec/helper-proto.h"
++void hexagon_translate_code(CPUState *cs, TranslationBlock *tb,
-@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
++                            int *max_insns, vaddr pc, void *host_pc)
-     if (interrupt_request & CPU_INTERRUPT_RESET) {
+ {
-         if (cpu_interrupts_enabled(env)) {
+     DisasContext ctx;
-             cs->exception_index = EXCP_RESET;
 -            cc->tcg_ops.do_interrupt(cs);
 +            cc->tcg_ops->do_interrupt(cs);
              cs->interrupt_request &= ~CPU_INTERRUPT_RESET;
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
          if (cpu_interrupts_enabled(env) && env->intsrc != 0) {
              int index = ctz32(env->intsrc);
              cs->exception_index = EXCP_INT(index);
 -            cc->tcg_ops.do_interrupt(cs);
 +            cc->tcg_ops->do_interrupt(cs);
              env->intsrc &= env->intsrc - 1; /* clear the interrupt */
              cs->interrupt_request &= ~CPU_INTERRUPT_HARD;
 diff --git a/target/cris/cpu.c b/target/cris/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/cris/cpu.c
 +++ b/target/cris/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_initfn(Object *obj)
  #endif
  }
 +#include "hw/core/tcg-cpu-ops.h"
 +
 +static struct TCGCPUOps crisv10_tcg_ops = {
 +    .initialize = cris_initialize_crisv10_tcg,
 +    .cpu_exec_interrupt = cris_cpu_exec_interrupt,
 +    .tlb_fill = cris_cpu_tlb_fill,
 +
 +#ifndef CONFIG_USER_ONLY
 +    .do_interrupt = crisv10_cpu_do_interrupt,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
 +static struct TCGCPUOps crisv32_tcg_ops = {
 +    .initialize = cris_initialize_tcg,
 +    .cpu_exec_interrupt = cris_cpu_exec_interrupt,
 +    .tlb_fill = cris_cpu_tlb_fill,
 +
 +#ifndef CONFIG_USER_ONLY
 +    .do_interrupt = cris_cpu_do_interrupt,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void crisv8_cpu_class_init(ObjectClass *oc, void *data)
  {
      CPUClass *cc = CPU_CLASS(oc);
      CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
      ccc->vr = 8;
 -    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
 -    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
 +    cc->tcg_ops = &crisv10_tcg_ops;
  }
  static void crisv9_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void crisv9_cpu_class_init(ObjectClass *oc, void *data)
      CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
      ccc->vr = 9;
 -    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
 -    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
 +    cc->tcg_ops = &crisv10_tcg_ops;
  }
  static void crisv10_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void crisv10_cpu_class_init(ObjectClass *oc, void *data)
      CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
      ccc->vr = 10;
 -    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
 -    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
 +    cc->tcg_ops = &crisv10_tcg_ops;
  }
  static void crisv11_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void crisv11_cpu_class_init(ObjectClass *oc, void *data)
      CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
      ccc->vr = 11;
 -    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
 -    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
 +    cc->tcg_ops = &crisv10_tcg_ops;
  }
  static void crisv17_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void crisv17_cpu_class_init(ObjectClass *oc, void *data)
      CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
      ccc->vr = 17;
 -    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
 -    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
 +    cc->tcg_ops = &crisv10_tcg_ops;
  }
  static void crisv32_cpu_class_init(ObjectClass *oc, void *data)
  {
 +    CPUClass *cc = CPU_CLASS(oc);
      CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
      ccc->vr = 32;
 +    cc->tcg_ops = &crisv32_tcg_ops;
  }
  static void cris_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = cris_cpu_class_by_name;
      cc->has_work = cris_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = cris_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = cris_cpu_exec_interrupt;
      cc->dump_state = cris_cpu_dump_state;
      cc->set_pc = cris_cpu_set_pc;
      cc->gdb_read_register = cris_cpu_gdb_read_register;
      cc->gdb_write_register = cris_cpu_gdb_write_register;
 -    cc->tcg_ops.tlb_fill = cris_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->get_phys_page_debug = cris_cpu_get_phys_page_debug;
      dc->vmsd = &vmstate_cris_cpu;
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
      cc->gdb_stop_before_watchpoint = true;
      cc->disas_set_info = cris_disas_set_info;
 -    cc->tcg_ops.initialize = cris_initialize_tcg;
  }
  #define DEFINE_CRIS_CPU_TYPE(cpu_model, initfn) \
 diff --git a/target/cris/helper.c b/target/cris/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/cris/helper.c
 +++ b/target/cris/helper.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "cpu.h"
 +#include "hw/core/tcg-cpu-ops.h"
  #include "mmu.h"
  #include "qemu/host-utils.h"
  #include "exec/exec-all.h"
@@ -XXX,XX +XXX,XX @@ bool cris_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
          && (env->pregs[PR_CCS] & I_FLAG)
          && !env->locked_irq) {
          cs->exception_index = EXCP_IRQ;
 -        cc->tcg_ops.do_interrupt(cs);
 +        cc->tcg_ops->do_interrupt(cs);
          ret = true;
      }
      if (interrupt_request & CPU_INTERRUPT_NMI) {
@@ -XXX,XX +XXX,XX @@ bool cris_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
          }
          if ((env->pregs[PR_CCS] & m_flag_archval)) {
              cs->exception_index = EXCP_NMI;
 -            cc->tcg_ops.do_interrupt(cs);
 +            cc->tcg_ops->do_interrupt(cs);
              ret = true;
          }
      }
 diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hppa/cpu.c
 +++ b/target/hppa/cpu.c
-@@ -XXX,XX +XXX,XX @@ static ObjectClass *hppa_cpu_class_by_name(const char *cpu_model)
+@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps hppa_sysemu_ops = {
-     return object_class_by_name(TYPE_HPPA_CPU);
- }
+ static const TCGCPUOps hppa_tcg_ops = {
+     .initialize = hppa_translate_init,
-+#include "hw/core/tcg-cpu-ops.h"
++    .translate_code = hppa_translate_code,
-+
+     .synchronize_from_tb = hppa_cpu_synchronize_from_tb,
-+static struct TCGCPUOps hppa_tcg_ops = {
+     .restore_state_to_opc = hppa_restore_state_to_opc,
-+    .initialize = hppa_translate_init,
-+    .synchronize_from_tb = hppa_cpu_synchronize_from_tb,
+diff --git a/target/hppa/translate.c b/target/hppa/translate.c
-+    .cpu_exec_interrupt = hppa_cpu_exec_interrupt,
+index XXXXXXX..XXXXXXX 100644
-+    .tlb_fill = hppa_cpu_tlb_fill,
+--- a/target/hppa/translate.c
-+
++++ b/target/hppa/translate.c
-+#ifndef CONFIG_USER_ONLY
+@@ -XXX,XX +XXX,XX @@ static const TranslatorOps hppa_tr_ops = {
 +    .do_interrupt = hppa_cpu_do_interrupt,
 +    .do_unaligned_access = hppa_cpu_do_unaligned_access,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void hppa_cpu_class_init(ObjectClass *oc, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = hppa_cpu_class_by_name;
      cc->has_work = hppa_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = hppa_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = hppa_cpu_exec_interrupt;
      cc->dump_state = hppa_cpu_dump_state;
      cc->set_pc = hppa_cpu_set_pc;
 -    cc->tcg_ops.synchronize_from_tb = hppa_cpu_synchronize_from_tb;
      cc->gdb_read_register = hppa_cpu_gdb_read_register;
      cc->gdb_write_register = hppa_cpu_gdb_write_register;
 -    cc->tcg_ops.tlb_fill = hppa_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->get_phys_page_debug = hppa_cpu_get_phys_page_debug;
 -    cc->tcg_ops.do_unaligned_access = hppa_cpu_do_unaligned_access;
      dc->vmsd = &vmstate_hppa_cpu;
  #endif
-     cc->disas_set_info = hppa_cpu_disas_set_info;
+ };
--    cc->tcg_ops.initialize = hppa_translate_init;
--
+-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int *max_insns,
-     cc->gdb_num_core_regs = 128;
+-                           vaddr pc, void *host_pc)
-+    cc->tcg_ops = &hppa_tcg_ops;
++void hppa_translate_code(CPUState *cs, TranslationBlock *tb,
- }
++                         int *max_insns, vaddr pc, void *host_pc)
+ {
- static const TypeInfo hppa_cpu_type_info = {
+     DisasContext ctx = { };
      translator_loop(cs, tb, max_insns, pc, host_pc, &hppa_tr_ops, &ctx.base);
 diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/tcg-cpu.c
 +++ b/target/i386/tcg/tcg-cpu.c
-@@ -XXX,XX +XXX,XX @@ static void x86_cpu_synchronize_from_tb(CPUState *cs,
+@@ -XXX,XX +XXX,XX @@ static bool x86_debug_check_breakpoint(CPUState *cs)
-     cpu->env.eip = tb->pc - tb->cs_base;
- }
+ static const TCGCPUOps x86_tcg_ops = {
+     .initialize = tcg_x86_init,
-+#include "hw/core/tcg-cpu-ops.h"
++    .translate_code = x86_translate_code,
-+
+     .synchronize_from_tb = x86_cpu_synchronize_from_tb,
-+static struct TCGCPUOps x86_tcg_ops = {
+     .restore_state_to_opc = x86_restore_state_to_opc,
-+    .initialize = tcg_x86_init,
+     .cpu_exec_enter = x86_cpu_exec_enter,
-+    .synchronize_from_tb = x86_cpu_synchronize_from_tb,
+diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
-+    .cpu_exec_enter = x86_cpu_exec_enter,
+index XXXXXXX..XXXXXXX 100644
-+    .cpu_exec_exit = x86_cpu_exec_exit,
+--- a/target/i386/tcg/translate.c
-+    .cpu_exec_interrupt = x86_cpu_exec_interrupt,
++++ b/target/i386/tcg/translate.c
-+    .do_interrupt = x86_cpu_do_interrupt,
+@@ -XXX,XX +XXX,XX @@ static const TranslatorOps i386_tr_ops = {
-+    .tlb_fill = x86_cpu_tlb_fill,
+     .tb_stop            = i386_tr_tb_stop,
-+#ifndef CONFIG_USER_ONLY
+ };
-+    .debug_excp_handler = breakpoint_handler,
-+#endif /* !CONFIG_USER_ONLY */
+-/* generate intermediate code for basic block 'tb'.  */
-+};
+-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int *max_insns,
-+
+-                           vaddr pc, void *host_pc)
- void tcg_cpu_common_class_init(CPUClass *cc)
++void x86_translate_code(CPUState *cpu, TranslationBlock *tb,
- {
++                        int *max_insns, vaddr pc, void *host_pc)
--    cc->tcg_ops.do_interrupt = x86_cpu_do_interrupt;
+ {
--    cc->tcg_ops.cpu_exec_interrupt = x86_cpu_exec_interrupt;
+     DisasContext dc;
--    cc->tcg_ops.synchronize_from_tb = x86_cpu_synchronize_from_tb;
--    cc->tcg_ops.cpu_exec_enter = x86_cpu_exec_enter;
+diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
--    cc->tcg_ops.cpu_exec_exit = x86_cpu_exec_exit;
+index XXXXXXX..XXXXXXX 100644
--    cc->tcg_ops.initialize = tcg_x86_init;
+--- a/target/loongarch/cpu.c
--    cc->tcg_ops.tlb_fill = x86_cpu_tlb_fill;
++++ b/target/loongarch/cpu.c
--#ifndef CONFIG_USER_ONLY
+@@ -XXX,XX +XXX,XX @@ static void loongarch_cpu_dump_state(CPUState *cs, FILE *f, int flags)
--    cc->tcg_ops.debug_excp_handler = breakpoint_handler;
--#endif
+ static const TCGCPUOps loongarch_tcg_ops = {
-+    cc->tcg_ops = &x86_tcg_ops;
+     .initialize = loongarch_translate_init,
- }
++    .translate_code = loongarch_translate_code,
-diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
+     .synchronize_from_tb = loongarch_cpu_synchronize_from_tb,
-index XXXXXXX..XXXXXXX 100644
+     .restore_state_to_opc = loongarch_restore_state_to_opc,
---- a/target/lm32/cpu.c
-+++ b/target/lm32/cpu.c
+diff --git a/target/loongarch/tcg/translate.c b/target/loongarch/tcg/translate.c
-@@ -XXX,XX +XXX,XX @@ static ObjectClass *lm32_cpu_class_by_name(const char *cpu_model)
+index XXXXXXX..XXXXXXX 100644
-     return oc;
+--- a/target/loongarch/tcg/translate.c
- }
++++ b/target/loongarch/tcg/translate.c
+@@ -XXX,XX +XXX,XX @@ static const TranslatorOps loongarch_tr_ops = {
-+#include "hw/core/tcg-cpu-ops.h"
+     .tb_stop            = loongarch_tr_tb_stop,
-+
+ };
-+static struct TCGCPUOps lm32_tcg_ops = {
-+    .initialize = lm32_translate_init,
+-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int *max_insns,
-+    .cpu_exec_interrupt = lm32_cpu_exec_interrupt,
+-                           vaddr pc, void *host_pc)
-+    .tlb_fill = lm32_cpu_tlb_fill,
++void loongarch_translate_code(CPUState *cs, TranslationBlock *tb,
-+    .debug_excp_handler = lm32_debug_excp_handler,
++                              int *max_insns, vaddr pc, void *host_pc)
-+
+ {
-+#ifndef CONFIG_USER_ONLY
+     DisasContext ctx;
-+    .do_interrupt = lm32_cpu_do_interrupt,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void lm32_cpu_class_init(ObjectClass *oc, void *data)
  {
      LM32CPUClass *lcc = LM32_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = lm32_cpu_class_by_name;
      cc->has_work = lm32_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = lm32_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = lm32_cpu_exec_interrupt;
      cc->dump_state = lm32_cpu_dump_state;
      cc->set_pc = lm32_cpu_set_pc;
      cc->gdb_read_register = lm32_cpu_gdb_read_register;
      cc->gdb_write_register = lm32_cpu_gdb_write_register;
 -    cc->tcg_ops.tlb_fill = lm32_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->get_phys_page_debug = lm32_cpu_get_phys_page_debug;
      cc->vmsd = &vmstate_lm32_cpu;
  #endif
      cc->gdb_num_core_regs = 32 + 7;
      cc->gdb_stop_before_watchpoint = true;
 -    cc->tcg_ops.debug_excp_handler = lm32_debug_excp_handler;
      cc->disas_set_info = lm32_cpu_disas_set_info;
 -    cc->tcg_ops.initialize = lm32_translate_init;
 +    cc->tcg_ops = &lm32_tcg_ops;
  }
  #define DEFINE_LM32_CPU_TYPE(cpu_model, initfn) \
 diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/m68k/cpu.c
 +++ b/target/m68k/cpu.c
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m68k_cpu = {
+@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps m68k_sysemu_ops = {
- };
- #endif
+ static const TCGCPUOps m68k_tcg_ops = {
+     .initialize = m68k_tcg_init,
-+#include "hw/core/tcg-cpu-ops.h"
++    .translate_code = m68k_translate_code,
-+
+     .restore_state_to_opc = m68k_restore_state_to_opc,
-+static struct TCGCPUOps m68k_tcg_ops = {
-+    .initialize = m68k_tcg_init,
+ #ifndef CONFIG_USER_ONLY
-+    .cpu_exec_interrupt = m68k_cpu_exec_interrupt,
+diff --git a/target/m68k/translate.c b/target/m68k/translate.c
-+    .tlb_fill = m68k_cpu_tlb_fill,
+index XXXXXXX..XXXXXXX 100644
-+
+--- a/target/m68k/translate.c
-+#ifndef CONFIG_USER_ONLY
++++ b/target/m68k/translate.c
-+    .do_interrupt = m68k_cpu_do_interrupt,
+@@ -XXX,XX +XXX,XX @@ static const TranslatorOps m68k_tr_ops = {
-+    .do_transaction_failed = m68k_cpu_transaction_failed,
+     .tb_stop            = m68k_tr_tb_stop,
-+#endif /* !CONFIG_USER_ONLY */
+ };
-+};
-+
+-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int *max_insns,
- static void m68k_cpu_class_init(ObjectClass *c, void *data)
+-                           vaddr pc, void *host_pc)
- {
++void m68k_translate_code(CPUState *cpu, TranslationBlock *tb,
-     M68kCPUClass *mcc = M68K_CPU_CLASS(c);
++                         int *max_insns, vaddr pc, void *host_pc)
-@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
+ {
+     DisasContext dc;
-     cc->class_by_name = m68k_cpu_class_by_name;
+     translator_loop(cpu, tb, max_insns, pc, host_pc, &m68k_tr_ops, &dc.base);
      cc->has_work = m68k_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = m68k_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = m68k_cpu_exec_interrupt;
      cc->dump_state = m68k_cpu_dump_state;
      cc->set_pc = m68k_cpu_set_pc;
      cc->gdb_read_register = m68k_cpu_gdb_read_register;
      cc->gdb_write_register = m68k_cpu_gdb_write_register;
 -    cc->tcg_ops.tlb_fill = m68k_cpu_tlb_fill;
  #if defined(CONFIG_SOFTMMU)
 -    cc->tcg_ops.do_transaction_failed = m68k_cpu_transaction_failed;
      cc->get_phys_page_debug = m68k_cpu_get_phys_page_debug;
      dc->vmsd = &vmstate_m68k_cpu;
  #endif
      cc->disas_set_info = m68k_cpu_disas_set_info;
 -    cc->tcg_ops.initialize = m68k_tcg_init;
      cc->gdb_num_core_regs = 18;
 +    cc->tcg_ops = &m68k_tcg_ops;
  }
  static void m68k_cpu_class_init_cf_core(ObjectClass *c, void *data)
 diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/microblaze/cpu.c
 +++ b/target/microblaze/cpu.c
-@@ -XXX,XX +XXX,XX @@ static ObjectClass *mb_cpu_class_by_name(const char *cpu_model)
+@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps mb_sysemu_ops = {
-     return object_class_by_name(TYPE_MICROBLAZE_CPU);
- }
+ static const TCGCPUOps mb_tcg_ops = {
+     .initialize = mb_tcg_init,
-+#include "hw/core/tcg-cpu-ops.h"
++    .translate_code = mb_translate_code,
-+
+     .synchronize_from_tb = mb_cpu_synchronize_from_tb,
-+static struct TCGCPUOps mb_tcg_ops = {
+     .restore_state_to_opc = mb_restore_state_to_opc,
-+    .initialize = mb_tcg_init,
-+    .synchronize_from_tb = mb_cpu_synchronize_from_tb,
+diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
-+    .cpu_exec_interrupt = mb_cpu_exec_interrupt,
+index XXXXXXX..XXXXXXX 100644
-+    .tlb_fill = mb_cpu_tlb_fill,
+--- a/target/microblaze/translate.c
-+
++++ b/target/microblaze/translate.c
-+#ifndef CONFIG_USER_ONLY
+@@ -XXX,XX +XXX,XX @@ static const TranslatorOps mb_tr_ops = {
-+    .do_interrupt = mb_cpu_do_interrupt,
+     .tb_stop            = mb_tr_tb_stop,
-+    .do_transaction_failed = mb_cpu_transaction_failed,
+ };
-+    .do_unaligned_access = mb_cpu_do_unaligned_access,
-+#endif /* !CONFIG_USER_ONLY */
+-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int *max_insns,
-+};
+-                           vaddr pc, void *host_pc)
-+
++void mb_translate_code(CPUState *cpu, TranslationBlock *tb,
- static void mb_cpu_class_init(ObjectClass *oc, void *data)
++                       int *max_insns, vaddr pc, void *host_pc)
  {
-     DeviceClass *dc = DEVICE_CLASS(oc);
+     DisasContext dc;
-@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
+     translator_loop(cpu, tb, max_insns, pc, host_pc, &mb_tr_ops, &dc.base);
      cc->class_by_name = mb_cpu_class_by_name;
      cc->has_work = mb_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = mb_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = mb_cpu_exec_interrupt;
 +
      cc->dump_state = mb_cpu_dump_state;
      cc->set_pc = mb_cpu_set_pc;
 -    cc->tcg_ops.synchronize_from_tb = mb_cpu_synchronize_from_tb;
      cc->gdb_read_register = mb_cpu_gdb_read_register;
      cc->gdb_write_register = mb_cpu_gdb_write_register;
 -    cc->tcg_ops.tlb_fill = mb_cpu_tlb_fill;
 +
  #ifndef CONFIG_USER_ONLY
 -    cc->tcg_ops.do_transaction_failed = mb_cpu_transaction_failed;
 -    cc->tcg_ops.do_unaligned_access = mb_cpu_do_unaligned_access;
      cc->get_phys_page_attrs_debug = mb_cpu_get_phys_page_attrs_debug;
      dc->vmsd = &vmstate_mb_cpu;
  #endif
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
      cc->gdb_num_core_regs = 32 + 27;
      cc->disas_set_info = mb_disas_set_info;
 -    cc->tcg_ops.initialize = mb_tcg_init;
 +    cc->tcg_ops = &mb_tcg_ops;
  }
  static const TypeInfo mb_cpu_type_info = {
 diff --git a/target/mips/cpu.c b/target/mips/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/cpu.c
 +++ b/target/mips/cpu.c
-@@ -XXX,XX +XXX,XX @@ static Property mips_cpu_properties[] = {
+@@ -XXX,XX +XXX,XX @@ static const Property mips_cpu_properties[] = {
-     DEFINE_PROP_END_OF_LIST()
+ #include "hw/core/tcg-cpu-ops.h"
- };
+ static const TCGCPUOps mips_tcg_ops = {
+     .initialize = mips_tcg_init,
-+#ifdef CONFIG_TCG
++    .translate_code = mips_translate_code,
-+#include "hw/core/tcg-cpu-ops.h"
+     .synchronize_from_tb = mips_cpu_synchronize_from_tb,
-+/*
+     .restore_state_to_opc = mips_restore_state_to_opc,
-+ * NB: cannot be const, as some elements are changed for specific
-+ * mips hardware (see hw/mips/jazz.c).
+diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
-+ */
+index XXXXXXX..XXXXXXX 100644
-+static struct TCGCPUOps mips_tcg_ops = {
+--- a/target/mips/tcg/translate.c
-+    .initialize = mips_tcg_init,
++++ b/target/mips/tcg/translate.c
-+    .synchronize_from_tb = mips_cpu_synchronize_from_tb,
+@@ -XXX,XX +XXX,XX @@ static const TranslatorOps mips_tr_ops = {
-+    .cpu_exec_interrupt = mips_cpu_exec_interrupt,
+     .tb_stop            = mips_tr_tb_stop,
-+    .tlb_fill = mips_cpu_tlb_fill,
+ };
-+
-+#if !defined(CONFIG_USER_ONLY)
+-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int *max_insns,
-+    .do_interrupt = mips_cpu_do_interrupt,
+-                           vaddr pc, void *host_pc)
-+    .do_transaction_failed = mips_cpu_do_transaction_failed,
++void mips_translate_code(CPUState *cs, TranslationBlock *tb,
-+    .do_unaligned_access = mips_cpu_do_unaligned_access,
++                         int *max_insns, vaddr pc, void *host_pc)
-+#endif /* !CONFIG_USER_ONLY */
+ {
-+};
+     DisasContext ctx;
-+#endif /* CONFIG_TCG */
 +
  static void mips_cpu_class_init(ObjectClass *c, void *data)
  {
      MIPSCPUClass *mcc = MIPS_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
      cc->vmsd = &vmstate_mips_cpu;
  #endif
      cc->disas_set_info = mips_cpu_disas_set_info;
 -#ifdef CONFIG_TCG
 -    cc->tcg_ops.initialize = mips_tcg_init;
 -    cc->tcg_ops.do_interrupt = mips_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = mips_cpu_exec_interrupt;
 -    cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
 -    cc->tcg_ops.tlb_fill = mips_cpu_tlb_fill;
 -#ifndef CONFIG_USER_ONLY
 -    cc->tcg_ops.do_transaction_failed = mips_cpu_do_transaction_failed;
 -    cc->tcg_ops.do_unaligned_access = mips_cpu_do_unaligned_access;
 -
 -#endif /* CONFIG_USER_ONLY */
 -#endif /* CONFIG_TCG */
 -
      cc->gdb_num_core_regs = 73;
      cc->gdb_stop_before_watchpoint = true;
 +#ifdef CONFIG_TCG
 +    cc->tcg_ops = &mips_tcg_ops;
 +#endif /* CONFIG_TCG */
  }
  static const TypeInfo mips_cpu_type_info = {
 diff --git a/target/moxie/cpu.c b/target/moxie/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/moxie/cpu.c
 +++ b/target/moxie/cpu.c
@@ -XXX,XX +XXX,XX @@ static ObjectClass *moxie_cpu_class_by_name(const char *cpu_model)
      return oc;
  }
 +#include "hw/core/tcg-cpu-ops.h"
 +
 +static struct TCGCPUOps moxie_tcg_ops = {
 +    .initialize = moxie_translate_init,
 +    .tlb_fill = moxie_cpu_tlb_fill,
 +
 +#ifndef CONFIG_USER_ONLY
 +    .do_interrupt = moxie_cpu_do_interrupt,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void moxie_cpu_class_init(ObjectClass *oc, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void moxie_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = moxie_cpu_class_by_name;
      cc->has_work = moxie_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = moxie_cpu_do_interrupt;
      cc->dump_state = moxie_cpu_dump_state;
      cc->set_pc = moxie_cpu_set_pc;
 -    cc->tcg_ops.tlb_fill = moxie_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->get_phys_page_debug = moxie_cpu_get_phys_page_debug;
      cc->vmsd = &vmstate_moxie_cpu;
  #endif
      cc->disas_set_info = moxie_cpu_disas_set_info;
 -    cc->tcg_ops.initialize = moxie_translate_init;
 +    cc->tcg_ops = &moxie_tcg_ops;
  }
  static void moxielite_initfn(Object *obj)
 diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/nios2/cpu.c
 +++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property nios2_properties[] = {
      DEFINE_PROP_END_OF_LIST(),
  };
 +#include "hw/core/tcg-cpu-ops.h"
 +
 +static struct TCGCPUOps nios2_tcg_ops = {
 +    .initialize = nios2_tcg_init,
 +    .cpu_exec_interrupt = nios2_cpu_exec_interrupt,
 +    .tlb_fill = nios2_cpu_tlb_fill,
 +
 +#ifndef CONFIG_USER_ONLY
 +    .do_interrupt = nios2_cpu_do_interrupt,
 +    .do_unaligned_access = nios2_cpu_do_unaligned_access,
 +#endif /* !CONFIG_USER_ONLY */
 +};
  static void nios2_cpu_class_init(ObjectClass *oc, void *data)
  {
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = nios2_cpu_class_by_name;
      cc->has_work = nios2_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = nios2_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = nios2_cpu_exec_interrupt;
      cc->dump_state = nios2_cpu_dump_state;
      cc->set_pc = nios2_cpu_set_pc;
      cc->disas_set_info = nios2_cpu_disas_set_info;
 -    cc->tcg_ops.tlb_fill = nios2_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
 -    cc->tcg_ops.do_unaligned_access = nios2_cpu_do_unaligned_access;
      cc->get_phys_page_debug = nios2_cpu_get_phys_page_debug;
  #endif
      cc->gdb_read_register = nios2_cpu_gdb_read_register;
      cc->gdb_write_register = nios2_cpu_gdb_write_register;
      cc->gdb_num_core_regs = 49;
 -    cc->tcg_ops.initialize = nios2_tcg_init;
 +    cc->tcg_ops = &nios2_tcg_ops;
  }
  static const TypeInfo nios2_cpu_type_info = {
 diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/openrisc/cpu.c
 +++ b/target/openrisc/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void openrisc_any_initfn(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps openrisc_sysemu_ops = {
-                       | (IMMUCFGR_NTS & (ctz32(TLB_SIZE) << 2));
- }
+ static const TCGCPUOps openrisc_tcg_ops = {
+     .initialize = openrisc_translate_init,
-+#include "hw/core/tcg-cpu-ops.h"
++    .translate_code = openrisc_translate_code,
-+
+     .synchronize_from_tb = openrisc_cpu_synchronize_from_tb,
-+static struct TCGCPUOps openrisc_tcg_ops = {
+     .restore_state_to_opc = openrisc_restore_state_to_opc,
-+    .initialize = openrisc_translate_init,
-+    .cpu_exec_interrupt = openrisc_cpu_exec_interrupt,
+diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
-+    .tlb_fill = openrisc_cpu_tlb_fill,
+index XXXXXXX..XXXXXXX 100644
-+
+--- a/target/openrisc/translate.c
-+#ifndef CONFIG_USER_ONLY
++++ b/target/openrisc/translate.c
-+    .do_interrupt = openrisc_cpu_do_interrupt,
+@@ -XXX,XX +XXX,XX @@ static const TranslatorOps openrisc_tr_ops = {
-+#endif /* !CONFIG_USER_ONLY */
+     .tb_stop            = openrisc_tr_tb_stop,
-+};
+ };
-+
- static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
+-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int *max_insns,
- {
+-                           vaddr pc, void *host_pc)
-     OpenRISCCPUClass *occ = OPENRISC_CPU_CLASS(oc);
++void openrisc_translate_code(CPUState *cs, TranslationBlock *tb,
-@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
++                             int *max_insns, vaddr pc, void *host_pc)
+ {
-     cc->class_by_name = openrisc_cpu_class_by_name;
+     DisasContext ctx;
-     cc->has_work = openrisc_cpu_has_work;
--    cc->tcg_ops.do_interrupt = openrisc_cpu_do_interrupt;
+diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
--    cc->tcg_ops.cpu_exec_interrupt = openrisc_cpu_exec_interrupt;
+index XXXXXXX..XXXXXXX 100644
-     cc->dump_state = openrisc_cpu_dump_state;
+--- a/target/ppc/cpu_init.c
-     cc->set_pc = openrisc_cpu_set_pc;
++++ b/target/ppc/cpu_init.c
-     cc->gdb_read_register = openrisc_cpu_gdb_read_register;
+@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps ppc_sysemu_ops = {
-     cc->gdb_write_register = openrisc_cpu_gdb_write_register;
--    cc->tcg_ops.tlb_fill = openrisc_cpu_tlb_fill;
+ static const TCGCPUOps ppc_tcg_ops = {
- #ifndef CONFIG_USER_ONLY
+   .initialize = ppc_translate_init,
-     cc->get_phys_page_debug = openrisc_cpu_get_phys_page_debug;
++  .translate_code = ppc_translate_code,
-     dc->vmsd = &vmstate_openrisc_cpu;
+   .restore_state_to_opc = ppc_restore_state_to_opc,
- #endif
-     cc->gdb_num_core_regs = 32 + 3;
+ #ifdef CONFIG_USER_ONLY
--    cc->tcg_ops.initialize = openrisc_translate_init;
+diff --git a/target/ppc/translate.c b/target/ppc/translate.c
-     cc->disas_set_info = openrisc_disas_set_info;
+index XXXXXXX..XXXXXXX 100644
-+    cc->tcg_ops = &openrisc_tcg_ops;
+--- a/target/ppc/translate.c
- }
++++ b/target/ppc/translate.c
+@@ -XXX,XX +XXX,XX @@ static const TranslatorOps ppc_tr_ops = {
- /* Sort alphabetically by type name, except for "any". */
+     .tb_stop            = ppc_tr_tb_stop,
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+ };
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
+-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int *max_insns,
-+++ b/target/riscv/cpu.c
+-                           vaddr pc, void *host_pc)
-@@ -XXX,XX +XXX,XX @@ static const char *riscv_gdb_get_dynamic_xml(CPUState *cs, const char *xmlname)
++void ppc_translate_code(CPUState *cs, TranslationBlock *tb,
-     return NULL;
++                        int *max_insns, vaddr pc, void *host_pc)
- }
+ {
+     DisasContext ctx;
-+#include "hw/core/tcg-cpu-ops.h"
-+
+diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
-+static struct TCGCPUOps riscv_tcg_ops = {
+index XXXXXXX..XXXXXXX 100644
-+    .initialize = riscv_translate_init,
+--- a/target/riscv/tcg/tcg-cpu.c
-+    .synchronize_from_tb = riscv_cpu_synchronize_from_tb,
++++ b/target/riscv/tcg/tcg-cpu.c
-+    .cpu_exec_interrupt = riscv_cpu_exec_interrupt,
+@@ -XXX,XX +XXX,XX @@ static void riscv_restore_state_to_opc(CPUState *cs,
-+    .tlb_fill = riscv_cpu_tlb_fill,
-+
+ static const TCGCPUOps riscv_tcg_ops = {
-+#ifndef CONFIG_USER_ONLY
+     .initialize = riscv_translate_init,
-+    .do_interrupt = riscv_cpu_do_interrupt,
++    .translate_code = riscv_translate_code,
-+    .do_transaction_failed = riscv_cpu_do_transaction_failed,
+     .synchronize_from_tb = riscv_cpu_synchronize_from_tb,
-+    .do_unaligned_access = riscv_cpu_do_unaligned_access,
+     .restore_state_to_opc = riscv_restore_state_to_opc,
-+#endif /* !CONFIG_USER_ONLY */
-+};
+diff --git a/target/riscv/translate.c b/target/riscv/translate.c
-+
+index XXXXXXX..XXXXXXX 100644
- static void riscv_cpu_class_init(ObjectClass *c, void *data)
+--- a/target/riscv/translate.c
- {
++++ b/target/riscv/translate.c
-     RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
+@@ -XXX,XX +XXX,XX @@ static const TranslatorOps riscv_tr_ops = {
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
+     .tb_stop            = riscv_tr_tb_stop,
+ };
-     cc->class_by_name = riscv_cpu_class_by_name;
-     cc->has_work = riscv_cpu_has_work;
+-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int *max_insns,
--    cc->tcg_ops.do_interrupt = riscv_cpu_do_interrupt;
+-                           vaddr pc, void *host_pc)
--    cc->tcg_ops.cpu_exec_interrupt = riscv_cpu_exec_interrupt;
++void riscv_translate_code(CPUState *cs, TranslationBlock *tb,
-     cc->dump_state = riscv_cpu_dump_state;
++                          int *max_insns, vaddr pc, void *host_pc)
-     cc->set_pc = riscv_cpu_set_pc;
+ {
--    cc->tcg_ops.synchronize_from_tb = riscv_cpu_synchronize_from_tb;
+     DisasContext ctx;
-     cc->gdb_read_register = riscv_cpu_gdb_read_register;
      cc->gdb_write_register = riscv_cpu_gdb_write_register;
      cc->gdb_num_core_regs = 33;
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
      cc->gdb_stop_before_watchpoint = true;
      cc->disas_set_info = riscv_cpu_disas_set_info;
  #ifndef CONFIG_USER_ONLY
 -    cc->tcg_ops.do_transaction_failed = riscv_cpu_do_transaction_failed;
 -    cc->tcg_ops.do_unaligned_access = riscv_cpu_do_unaligned_access;
      cc->get_phys_page_debug = riscv_cpu_get_phys_page_debug;
      /* For now, mark unmigratable: */
      cc->vmsd = &vmstate_riscv_cpu;
  #endif
      cc->gdb_arch_name = riscv_gdb_arch_name;
      cc->gdb_get_dynamic_xml = riscv_gdb_get_dynamic_xml;
 -    cc->tcg_ops.initialize = riscv_translate_init;
 -    cc->tcg_ops.tlb_fill = riscv_cpu_tlb_fill;
 +    cc->tcg_ops = &riscv_tcg_ops;
      device_class_set_props(dc, riscv_cpu_properties);
  }
 diff --git a/target/rx/cpu.c b/target/rx/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/rx/cpu.c
 +++ b/target/rx/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void rx_cpu_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps rx_sysemu_ops = {
-     qdev_init_gpio_in(DEVICE(cpu), rx_cpu_set_irq, 2);
- }
+ static const TCGCPUOps rx_tcg_ops = {
+     .initialize = rx_translate_init,
-+#include "hw/core/tcg-cpu-ops.h"
++    .translate_code = rx_translate_code,
-+
+     .synchronize_from_tb = rx_cpu_synchronize_from_tb,
-+static struct TCGCPUOps rx_tcg_ops = {
+     .restore_state_to_opc = rx_restore_state_to_opc,
-+    .initialize = rx_translate_init,
+     .tlb_fill = rx_cpu_tlb_fill,
-+    .synchronize_from_tb = rx_cpu_synchronize_from_tb,
+diff --git a/target/rx/translate.c b/target/rx/translate.c
-+    .cpu_exec_interrupt = rx_cpu_exec_interrupt,
+index XXXXXXX..XXXXXXX 100644
-+    .tlb_fill = rx_cpu_tlb_fill,
+--- a/target/rx/translate.c
-+
++++ b/target/rx/translate.c
-+#ifndef CONFIG_USER_ONLY
+@@ -XXX,XX +XXX,XX @@ static const TranslatorOps rx_tr_ops = {
-+    .do_interrupt = rx_cpu_do_interrupt,
+     .tb_stop            = rx_tr_tb_stop,
-+#endif /* !CONFIG_USER_ONLY */
+ };
-+};
-+
+-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int *max_insns,
- static void rx_cpu_class_init(ObjectClass *klass, void *data)
+-                           vaddr pc, void *host_pc)
- {
++void rx_translate_code(CPUState *cs, TranslationBlock *tb,
-     DeviceClass *dc = DEVICE_CLASS(klass);
++                       int *max_insns, vaddr pc, void *host_pc)
-@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
+ {
+     DisasContext dc;
-     cc->class_by_name = rx_cpu_class_by_name;
      cc->has_work = rx_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = rx_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = rx_cpu_exec_interrupt;
      cc->dump_state = rx_cpu_dump_state;
      cc->set_pc = rx_cpu_set_pc;
 -    cc->tcg_ops.synchronize_from_tb = rx_cpu_synchronize_from_tb;
 +
      cc->gdb_read_register = rx_cpu_gdb_read_register;
      cc->gdb_write_register = rx_cpu_gdb_write_register;
      cc->get_phys_page_debug = rx_cpu_get_phys_page_debug;
      cc->disas_set_info = rx_cpu_disas_set_info;
 -    cc->tcg_ops.initialize = rx_translate_init;
 -    cc->tcg_ops.tlb_fill = rx_cpu_tlb_fill;
      cc->gdb_num_core_regs = 26;
      cc->gdb_core_xml_file = "rx-core.xml";
 +    cc->tcg_ops = &rx_tcg_ops;
  }
  static const TypeInfo rx_cpu_info = {
 diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/cpu.c
 +++ b/target/s390x/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void s390_cpu_reset_full(DeviceState *dev)
+@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPUS390XState *env, vaddr *pc,
-     return s390_cpu_reset(s, S390_CPU_RESET_CLEAR);
- }
+ static const TCGCPUOps s390_tcg_ops = {
+     .initialize = s390x_translate_init,
-+#ifdef CONFIG_TCG
++    .translate_code = s390x_translate_code,
-+#include "hw/core/tcg-cpu-ops.h"
+     .restore_state_to_opc = s390x_restore_state_to_opc,
-+
-+static struct TCGCPUOps s390_tcg_ops = {
+ #ifdef CONFIG_USER_ONLY
-+    .initialize = s390x_translate_init,
+diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
-+    .tlb_fill = s390_cpu_tlb_fill,
+index XXXXXXX..XXXXXXX 100644
-+
+--- a/target/s390x/tcg/translate.c
-+#if !defined(CONFIG_USER_ONLY)
++++ b/target/s390x/tcg/translate.c
-+    .cpu_exec_interrupt = s390_cpu_exec_interrupt,
+@@ -XXX,XX +XXX,XX @@ static const TranslatorOps s390x_tr_ops = {
-+    .do_interrupt = s390_cpu_do_interrupt,
+     .disas_log          = s390x_tr_disas_log,
-+    .debug_excp_handler = s390x_cpu_debug_excp_handler,
+ };
-+    .do_unaligned_access = s390x_cpu_do_unaligned_access,
-+#endif /* !CONFIG_USER_ONLY */
+-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int *max_insns,
-+};
+-                           vaddr pc, void *host_pc)
-+#endif /* CONFIG_TCG */
++void s390x_translate_code(CPUState *cs, TranslationBlock *tb,
-+
++                          int *max_insns, vaddr pc, void *host_pc)
- static void s390_cpu_class_init(ObjectClass *oc, void *data)
+ {
- {
+     DisasContext dc;
-     S390CPUClass *scc = S390_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
      scc->reset = s390_cpu_reset;
      cc->class_by_name = s390_cpu_class_by_name,
      cc->has_work = s390_cpu_has_work;
 -#ifdef CONFIG_TCG
 -    cc->tcg_ops.do_interrupt = s390_cpu_do_interrupt;
 -#endif
      cc->dump_state = s390_cpu_dump_state;
      cc->set_pc = s390_cpu_set_pc;
      cc->gdb_read_register = s390_cpu_gdb_read_register;
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
      cc->vmsd = &vmstate_s390_cpu;
      cc->get_crash_info = s390_cpu_get_crash_info;
      cc->write_elf64_note = s390_cpu_write_elf64_note;
 -#ifdef CONFIG_TCG
 -    cc->tcg_ops.cpu_exec_interrupt = s390_cpu_exec_interrupt;
 -    cc->tcg_ops.debug_excp_handler = s390x_cpu_debug_excp_handler;
 -    cc->tcg_ops.do_unaligned_access = s390x_cpu_do_unaligned_access;
 -#endif
  #endif
      cc->disas_set_info = s390_cpu_disas_set_info;
 -#ifdef CONFIG_TCG
 -    cc->tcg_ops.initialize = s390x_translate_init;
 -    cc->tcg_ops.tlb_fill = s390_cpu_tlb_fill;
 -#endif
 -
      cc->gdb_num_core_regs = S390_NUM_CORE_REGS;
      cc->gdb_core_xml_file = "s390x-core64.xml";
      cc->gdb_arch_name = s390_gdb_arch_name;
      s390_cpu_model_class_register_props(oc);
 +
 +#ifdef CONFIG_TCG
 +    cc->tcg_ops = &s390_tcg_ops;
 +#endif /* CONFIG_TCG */
  }
  static const TypeInfo s390_cpu_type_info = {
 diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sh4/cpu.c
 +++ b/target/sh4/cpu.c
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_sh_cpu = {
+@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps sh4_sysemu_ops = {
-     .unmigratable = 1,
- };
+ static const TCGCPUOps superh_tcg_ops = {
+     .initialize = sh4_translate_init,
-+#include "hw/core/tcg-cpu-ops.h"
++    .translate_code = sh4_translate_code,
-+
+     .synchronize_from_tb = superh_cpu_synchronize_from_tb,
-+static struct TCGCPUOps superh_tcg_ops = {
+     .restore_state_to_opc = superh_restore_state_to_opc,
-+    .initialize = sh4_translate_init,
-+    .synchronize_from_tb = superh_cpu_synchronize_from_tb,
+diff --git a/target/sh4/translate.c b/target/sh4/translate.c
-+    .cpu_exec_interrupt = superh_cpu_exec_interrupt,
+index XXXXXXX..XXXXXXX 100644
-+    .tlb_fill = superh_cpu_tlb_fill,
+--- a/target/sh4/translate.c
-+
++++ b/target/sh4/translate.c
-+#ifndef CONFIG_USER_ONLY
+@@ -XXX,XX +XXX,XX @@ static const TranslatorOps sh4_tr_ops = {
-+    .do_interrupt = superh_cpu_do_interrupt,
+     .tb_stop            = sh4_tr_tb_stop,
-+    .do_unaligned_access = superh_cpu_do_unaligned_access,
+ };
-+#endif /* !CONFIG_USER_ONLY */
-+};
+-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int *max_insns,
-+
+-                           vaddr pc, void *host_pc)
- static void superh_cpu_class_init(ObjectClass *oc, void *data)
++void sh4_translate_code(CPUState *cs, TranslationBlock *tb,
- {
++                        int *max_insns, vaddr pc, void *host_pc)
-     DeviceClass *dc = DEVICE_CLASS(oc);
+ {
-@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
+     DisasContext ctx;
      cc->class_by_name = superh_cpu_class_by_name;
      cc->has_work = superh_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = superh_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = superh_cpu_exec_interrupt;
      cc->dump_state = superh_cpu_dump_state;
      cc->set_pc = superh_cpu_set_pc;
 -    cc->tcg_ops.synchronize_from_tb = superh_cpu_synchronize_from_tb;
      cc->gdb_read_register = superh_cpu_gdb_read_register;
      cc->gdb_write_register = superh_cpu_gdb_write_register;
 -    cc->tcg_ops.tlb_fill = superh_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
 -    cc->tcg_ops.do_unaligned_access = superh_cpu_do_unaligned_access;
      cc->get_phys_page_debug = superh_cpu_get_phys_page_debug;
  #endif
      cc->disas_set_info = superh_cpu_disas_set_info;
 -    cc->tcg_ops.initialize = sh4_translate_init;
      cc->gdb_num_core_regs = 59;
      dc->vmsd = &vmstate_sh_cpu;
 +    cc->tcg_ops = &superh_tcg_ops;
  }
  #define DEFINE_SUPERH_CPU_TYPE(type_name, cinit, initfn) \
 diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sparc/cpu.c
 +++ b/target/sparc/cpu.c
-@@ -XXX,XX +XXX,XX @@ static Property sparc_cpu_properties[] = {
+@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps sparc_sysemu_ops = {
-     DEFINE_PROP_END_OF_LIST()
- };
+ static const TCGCPUOps sparc_tcg_ops = {
+     .initialize = sparc_tcg_init,
-+#ifdef CONFIG_TCG
++    .translate_code = sparc_translate_code,
-+#include "hw/core/tcg-cpu-ops.h"
+     .synchronize_from_tb = sparc_cpu_synchronize_from_tb,
-+
+     .restore_state_to_opc = sparc_restore_state_to_opc,
-+static struct TCGCPUOps sparc_tcg_ops = {
-+    .initialize = sparc_tcg_init,
+diff --git a/target/sparc/translate.c b/target/sparc/translate.c
-+    .synchronize_from_tb = sparc_cpu_synchronize_from_tb,
+index XXXXXXX..XXXXXXX 100644
-+    .cpu_exec_interrupt = sparc_cpu_exec_interrupt,
+--- a/target/sparc/translate.c
-+    .tlb_fill = sparc_cpu_tlb_fill,
++++ b/target/sparc/translate.c
-+
+@@ -XXX,XX +XXX,XX @@ static const TranslatorOps sparc_tr_ops = {
-+#ifndef CONFIG_USER_ONLY
+     .tb_stop            = sparc_tr_tb_stop,
-+    .do_interrupt = sparc_cpu_do_interrupt,
+ };
-+    .do_transaction_failed = sparc_cpu_do_transaction_failed,
-+    .do_unaligned_access = sparc_cpu_do_unaligned_access,
+-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int *max_insns,
-+#endif /* !CONFIG_USER_ONLY */
+-                           vaddr pc, void *host_pc)
-+};
++void sparc_translate_code(CPUState *cs, TranslationBlock *tb,
-+#endif /* CONFIG_TCG */
++                          int *max_insns, vaddr pc, void *host_pc)
-+
+ {
- static void sparc_cpu_class_init(ObjectClass *oc, void *data)
+     DisasContext dc = {};
- {
      SPARCCPUClass *scc = SPARC_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = sparc_cpu_class_by_name;
      cc->parse_features = sparc_cpu_parse_features;
      cc->has_work = sparc_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = sparc_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = sparc_cpu_exec_interrupt;
      cc->dump_state = sparc_cpu_dump_state;
  #if !defined(TARGET_SPARC64) && !defined(CONFIG_USER_ONLY)
      cc->memory_rw_debug = sparc_cpu_memory_rw_debug;
  #endif
      cc->set_pc = sparc_cpu_set_pc;
 -    cc->tcg_ops.synchronize_from_tb = sparc_cpu_synchronize_from_tb;
      cc->gdb_read_register = sparc_cpu_gdb_read_register;
      cc->gdb_write_register = sparc_cpu_gdb_write_register;
 -    cc->tcg_ops.tlb_fill = sparc_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
 -    cc->tcg_ops.do_transaction_failed = sparc_cpu_do_transaction_failed;
 -    cc->tcg_ops.do_unaligned_access = sparc_cpu_do_unaligned_access;
      cc->get_phys_page_debug = sparc_cpu_get_phys_page_debug;
      cc->vmsd = &vmstate_sparc_cpu;
  #endif
      cc->disas_set_info = cpu_sparc_disas_set_info;
 -    cc->tcg_ops.initialize = sparc_tcg_init;
  #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
      cc->gdb_num_core_regs = 86;
  #else
      cc->gdb_num_core_regs = 72;
  #endif
 +    cc->tcg_ops = &sparc_tcg_ops;
  }
  static const TypeInfo sparc_cpu_type_info = {
 diff --git a/target/tilegx/cpu.c b/target/tilegx/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tilegx/cpu.c
 +++ b/target/tilegx/cpu.c
@@ -XXX,XX +XXX,XX @@ static bool tilegx_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
      return false;
  }
 +#include "hw/core/tcg-cpu-ops.h"
 +
 +static struct TCGCPUOps tilegx_tcg_ops = {
 +    .initialize = tilegx_tcg_init,
 +    .cpu_exec_interrupt = tilegx_cpu_exec_interrupt,
 +    .tlb_fill = tilegx_cpu_tlb_fill,
 +
 +#ifndef CONFIG_USER_ONLY
 +    .do_interrupt = tilegx_cpu_do_interrupt,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = tilegx_cpu_class_by_name;
      cc->has_work = tilegx_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = tilegx_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = tilegx_cpu_exec_interrupt;
      cc->dump_state = tilegx_cpu_dump_state;
      cc->set_pc = tilegx_cpu_set_pc;
 -    cc->tcg_ops.tlb_fill = tilegx_cpu_tlb_fill;
      cc->gdb_num_core_regs = 0;
 -    cc->tcg_ops.initialize = tilegx_tcg_init;
 +    cc->tcg_ops = &tilegx_tcg_ops;
  }
  static const TypeInfo tilegx_cpu_type_info = {
 diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tricore/cpu.c
 +++ b/target/tricore/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void tc27x_initfn(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps tricore_sysemu_ops = {
-     set_feature(&cpu->env, TRICORE_FEATURE_161);
- }
+ static const TCGCPUOps tricore_tcg_ops = {
+     .initialize = tricore_tcg_init,
-+#include "hw/core/tcg-cpu-ops.h"
++    .translate_code = tricore_translate_code,
-+
+     .synchronize_from_tb = tricore_cpu_synchronize_from_tb,
-+static struct TCGCPUOps tricore_tcg_ops = {
+     .restore_state_to_opc = tricore_restore_state_to_opc,
-+    .initialize = tricore_tcg_init,
+     .tlb_fill = tricore_cpu_tlb_fill,
-+    .synchronize_from_tb = tricore_cpu_synchronize_from_tb,
+diff --git a/target/tricore/translate.c b/target/tricore/translate.c
-+    .tlb_fill = tricore_cpu_tlb_fill,
+index XXXXXXX..XXXXXXX 100644
-+};
+--- a/target/tricore/translate.c
-+
++++ b/target/tricore/translate.c
- static void tricore_cpu_class_init(ObjectClass *c, void *data)
+@@ -XXX,XX +XXX,XX @@ static const TranslatorOps tricore_tr_ops = {
- {
+     .tb_stop            = tricore_tr_tb_stop,
-     TriCoreCPUClass *mcc = TRICORE_CPU_CLASS(c);
+ };
-@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_class_init(ObjectClass *c, void *data)
+-
-     cc->dump_state = tricore_cpu_dump_state;
+-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int *max_insns,
-     cc->set_pc = tricore_cpu_set_pc;
+-                           vaddr pc, void *host_pc)
--    cc->tcg_ops.synchronize_from_tb = tricore_cpu_synchronize_from_tb;
++void tricore_translate_code(CPUState *cs, TranslationBlock *tb,
-     cc->get_phys_page_debug = tricore_cpu_get_phys_page_debug;
++                            int *max_insns, vaddr pc, void *host_pc)
--    cc->tcg_ops.initialize = tricore_tcg_init;
+ {
--    cc->tcg_ops.tlb_fill = tricore_cpu_tlb_fill;
+     DisasContext ctx;
-+    cc->tcg_ops = &tricore_tcg_ops;
+     translator_loop(cs, tb, max_insns, pc, host_pc,
  }
  #define DEFINE_TRICORE_CPU_TYPE(cpu_model, initfn) \
 diff --git a/target/unicore32/cpu.c b/target/unicore32/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/unicore32/cpu.c
 +++ b/target/unicore32/cpu.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_uc32_cpu = {
      .unmigratable = 1,
  };
 +#include "hw/core/tcg-cpu-ops.h"
 +
 +static struct TCGCPUOps uc32_tcg_ops = {
 +    .initialize = uc32_translate_init,
 +    .cpu_exec_interrupt = uc32_cpu_exec_interrupt,
 +    .tlb_fill = uc32_cpu_tlb_fill,
 +
 +#ifndef CONFIG_USER_ONLY
 +    .do_interrupt = uc32_cpu_do_interrupt,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void uc32_cpu_class_init(ObjectClass *oc, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = uc32_cpu_class_by_name;
      cc->has_work = uc32_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = uc32_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = uc32_cpu_exec_interrupt;
      cc->dump_state = uc32_cpu_dump_state;
      cc->set_pc = uc32_cpu_set_pc;
 -    cc->tcg_ops.tlb_fill = uc32_cpu_tlb_fill;
      cc->get_phys_page_debug = uc32_cpu_get_phys_page_debug;
 -    cc->tcg_ops.initialize = uc32_translate_init;
      dc->vmsd = &vmstate_uc32_cpu;
 +    cc->tcg_ops = &uc32_tcg_ops;
  }
  #define DEFINE_UNICORE32_CPU_TYPE(cpu_model, initfn) \
 diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/xtensa/cpu.c
 +++ b/target/xtensa/cpu.c
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_xtensa_cpu = {
+@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps xtensa_sysemu_ops = {
-     .unmigratable = 1,
- };
+ static const TCGCPUOps xtensa_tcg_ops = {
+     .initialize = xtensa_translate_init,
-+#include "hw/core/tcg-cpu-ops.h"
++    .translate_code = xtensa_translate_code,
-+
+     .debug_excp_handler = xtensa_breakpoint_handler,
-+static struct TCGCPUOps xtensa_tcg_ops = {
+     .restore_state_to_opc = xtensa_restore_state_to_opc,
-+    .initialize = xtensa_translate_init,
-+    .cpu_exec_interrupt = xtensa_cpu_exec_interrupt,
+diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
-+    .tlb_fill = xtensa_cpu_tlb_fill,
+index XXXXXXX..XXXXXXX 100644
-+    .debug_excp_handler = xtensa_breakpoint_handler,
+--- a/target/xtensa/translate.c
-+
++++ b/target/xtensa/translate.c
-+#ifndef CONFIG_USER_ONLY
+@@ -XXX,XX +XXX,XX @@ static const TranslatorOps xtensa_translator_ops = {
-+    .do_interrupt = xtensa_cpu_do_interrupt,
+     .tb_stop            = xtensa_tr_tb_stop,
-+    .do_transaction_failed = xtensa_cpu_do_transaction_failed,
+ };
-+    .do_unaligned_access = xtensa_cpu_do_unaligned_access,
-+#endif /* !CONFIG_USER_ONLY */
+-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int *max_insns,
-+};
+-                           vaddr pc, void *host_pc)
-+
++void xtensa_translate_code(CPUState *cpu, TranslationBlock *tb,
- static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
++                           int *max_insns, vaddr pc, void *host_pc)
  {
-     DeviceClass *dc = DEVICE_CLASS(oc);
+     DisasContext dc = {};
-@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
+     translator_loop(cpu, tb, max_insns, pc, host_pc,
      cc->class_by_name = xtensa_cpu_class_by_name;
      cc->has_work = xtensa_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = xtensa_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = xtensa_cpu_exec_interrupt;
      cc->dump_state = xtensa_cpu_dump_state;
      cc->set_pc = xtensa_cpu_set_pc;
      cc->gdb_read_register = xtensa_cpu_gdb_read_register;
      cc->gdb_write_register = xtensa_cpu_gdb_write_register;
      cc->gdb_stop_before_watchpoint = true;
 -    cc->tcg_ops.tlb_fill = xtensa_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
 -    cc->tcg_ops.do_unaligned_access = xtensa_cpu_do_unaligned_access;
      cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
 -    cc->tcg_ops.do_transaction_failed = xtensa_cpu_do_transaction_failed;
  #endif
 -    cc->tcg_ops.debug_excp_handler = xtensa_breakpoint_handler;
      cc->disas_set_info = xtensa_cpu_disas_set_info;
 -    cc->tcg_ops.initialize = xtensa_translate_init;
      dc->vmsd = &vmstate_xtensa_cpu;
 +    cc->tcg_ops = &xtensa_tcg_ops;
  }
  static const TypeInfo xtensa_cpu_type_info = {
 diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/ppc/translate_init.c.inc
 +++ b/target/ppc/translate_init.c.inc
@@ -XXX,XX +XXX,XX @@ static Property ppc_cpu_properties[] = {
      DEFINE_PROP_END_OF_LIST(),
  };
 +#ifdef CONFIG_TCG
 +#include "hw/core/tcg-cpu-ops.h"
 +
 +static struct TCGCPUOps ppc_tcg_ops = {
 +  .initialize = ppc_translate_init,
 +  .cpu_exec_interrupt = ppc_cpu_exec_interrupt,
 +  .tlb_fill = ppc_cpu_tlb_fill,
 +
 +#ifndef CONFIG_USER_ONLY
 +  .do_interrupt = ppc_cpu_do_interrupt,
 +  .cpu_exec_enter = ppc_cpu_exec_enter,
 +  .cpu_exec_exit = ppc_cpu_exec_exit,
 +  .do_unaligned_access = ppc_cpu_do_unaligned_access,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +#endif /* CONFIG_TCG */
 +
  static void ppc_cpu_class_init(ObjectClass *oc, void *data)
  {
      PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
  #ifndef CONFIG_USER_ONLY
      cc->virtio_is_big_endian = ppc_cpu_is_big_endian;
  #endif
 -#ifdef CONFIG_TCG
 -    cc->tcg_ops.initialize = ppc_translate_init;
 -    cc->tcg_ops.cpu_exec_interrupt = ppc_cpu_exec_interrupt;
 -    cc->tcg_ops.do_interrupt = ppc_cpu_do_interrupt;
 -    cc->tcg_ops.tlb_fill = ppc_cpu_tlb_fill;
 -#ifndef CONFIG_USER_ONLY
 -    cc->tcg_ops.cpu_exec_enter = ppc_cpu_exec_enter;
 -    cc->tcg_ops.cpu_exec_exit = ppc_cpu_exec_exit;
 -    cc->tcg_ops.do_unaligned_access = ppc_cpu_do_unaligned_access;
 -#endif /* !CONFIG_USER_ONLY */
 -#endif /* CONFIG_TCG */
 -
      cc->disas_set_info = ppc_disas_set_info;
      dc->fw_name = "PowerPC,UNKNOWN";
 +
 +#ifdef CONFIG_TCG
 +    cc->tcg_ops = &ppc_tcg_ops;
 +#endif /* CONFIG_TCG */
  }
  static const TypeInfo ppc_cpu_type_info = {
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: include/exec/helper*.h
  F: include/exec/tb-hash.h
  F: include/sysemu/cpus.h
  F: include/sysemu/tcg.h
 +F: include/hw/core/tcg-cpu-ops.h
  FPU emulation
  M: Aurelien Jarno <aurelien@aurel32.net>
 --
-.25.1
+.43.0

The following changes since commit d0dddab40e472ba62b5f43f11cc7dba085dabe71:

Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging (2021-02-05 15:27:02 +0000)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20210205

for you to fetch changes up to fb6916dd6ca8bb4b42d44baba9c67ecaf2279577:

accel: introduce AccelCPUClass extending CPUClass (2021-02-05 10:24:15 -1000)

----------------------------------------------------------------
TCGCPUOps cleanups (claudio)
tcg/s390 compare fix (phil)
tcg/aarch64 rotli_vec fix
tcg/tci cleanups and fixes

----------------------------------------------------------------
Claudio Fontana (13):
      target/riscv: remove CONFIG_TCG, as it is always TCG
      accel/tcg: split TCG-only code from cpu_exec_realizefn
      target/arm: do not use cc->do_interrupt for KVM directly
      cpu: move cc->do_interrupt to tcg_ops
      cpu: move cc->transaction_failed to tcg_ops
      cpu: move do_unaligned_access to tcg_ops
      physmem: make watchpoint checking code TCG-only
      cpu: move adjust_watchpoint_address to tcg_ops
      cpu: move debug_check_watchpoint to tcg_ops
      cpu: tcg_ops: move to tcg-cpu-ops.h, keep a pointer in CPUClass
      accel: extend AccelState and AccelClass to user-mode
      accel: replace struct CpusAccel with AccelOpsClass
      accel: introduce AccelCPUClass extending CPUClass

Eduardo Habkost (5):
      cpu: Introduce TCGCpuOperations struct
      cpu: Move synchronize_from_tb() to tcg_ops
      cpu: Move cpu_exec_* to tcg_ops
      cpu: Move tlb_fill to tcg_ops
      cpu: Move debug_excp_handler to tcg_ops

Philippe Mathieu-Daudé (2):
      tcg/s390: Fix compare instruction from extended-immediate facility
      exec/cpu-defs: Remove TCG backends dependency

Richard Henderson (24):
      tcg/aarch64: Do not convert TCGArg to temps that are not temps
      configure: Fix --enable-tcg-interpreter
      tcg/tci: Make tci_tb_ptr thread-local
      tcg/tci: Inline tci_write_reg32s into the only caller
      tcg/tci: Inline tci_write_reg8 into its callers
      tcg/tci: Inline tci_write_reg16 into the only caller
      tcg/tci: Inline tci_write_reg32 into all callers
      tcg/tci: Inline tci_write_reg64 into 64-bit callers
      tcg/tci: Merge INDEX_op_ld8u_{i32,i64}
      tcg/tci: Merge INDEX_op_ld8s_{i32,i64}
      tcg/tci: Merge INDEX_op_ld16u_{i32,i64}
      tcg/tci: Merge INDEX_op_ld16s_{i32,i64}
      tcg/tci: Merge INDEX_op_{ld_i32,ld32u_i64}
      tcg/tci: Merge INDEX_op_st8_{i32,i64}
      tcg/tci: Merge INDEX_op_st16_{i32,i64}
      tcg/tci: Move stack bounds check to compile-time
      tcg/tci: Merge INDEX_op_{st_i32,st32_i64}
      tcg/tci: Use g_assert_not_reached
      tcg/tci: Remove dead code for TCG_TARGET_HAS_div2_*
      tcg/tci: Implement 64-bit division
      tcg/tci: Remove TODO as unused
      tcg/tci: Restrict TCG_TARGET_NB_REGS to 16
      tcg/tci: Fix TCG_REG_R4 misusage
      tcg/tci: Remove TCG_CONST

Stefan Weil (2):
      tcg/tci: Implement INDEX_op_ld16s_i32
      tcg/tci: Implement INDEX_op_ld8s_i64

configure                                          |   5 +-
 accel/accel-softmmu.h                              |  15 +
 accel/kvm/kvm-cpus.h                               |   2 -
 .../{tcg-cpus-icount.h => tcg-accel-ops-icount.h}  |   2 +
 accel/tcg/tcg-accel-ops-mttcg.h                    |  19 +
 accel/tcg/{tcg-cpus-rr.h => tcg-accel-ops-rr.h}    |   0
 accel/tcg/{tcg-cpus.h => tcg-accel-ops.h}          |   6 +-
 include/exec/cpu-all.h                             |  11 +-
 include/exec/cpu-defs.h                            |   3 -
 include/exec/exec-all.h                            |   2 +-
 include/hw/boards.h                                |   2 +-
 include/hw/core/accel-cpu.h                        |  38 ++
 include/hw/core/cpu.h                              |  86 +---
 include/hw/core/tcg-cpu-ops.h                      |  97 +++++
 include/{sysemu => qemu}/accel.h                   |  16 +-
 include/sysemu/accel-ops.h                         |  45 ++
 include/sysemu/cpus.h                              |  26 +-
 include/sysemu/hvf.h                               |   2 +-
 include/sysemu/kvm.h                               |   2 +-
 include/sysemu/kvm_int.h                           |   2 +-
 target/arm/internals.h                             |   6 +
 target/i386/hax/{hax-cpus.h => hax-accel-ops.h}    |   2 -
 target/i386/hax/hax-windows.h                      |   2 +-
 target/i386/hvf/{hvf-cpus.h => hvf-accel-ops.h}    |   2 -
 target/i386/hvf/hvf-i386.h                         |   2 +-
 target/i386/whpx/{whpx-cpus.h => whpx-accel-ops.h} |   2 -
 tcg/tci/tcg-target-con-set.h                       |   6 +-
 tcg/tci/tcg-target.h                               |  37 +-
 accel/accel-common.c                               | 105 +++++
 accel/{accel.c => accel-softmmu.c}                 |  61 ++-
 accel/accel-user.c                                 |  24 ++
 accel/kvm/{kvm-cpus.c => kvm-accel-ops.c}          |  28 +-
 accel/kvm/kvm-all.c                                |   2 -
 accel/qtest/qtest.c                                |  25 +-
 accel/tcg/cpu-exec.c                               |  53 ++-
 accel/tcg/cputlb.c                                 |  34 +-
 .../{tcg-cpus-icount.c => tcg-accel-ops-icount.c}  |  21 +-
 .../{tcg-cpus-mttcg.c => tcg-accel-ops-mttcg.c}    |  14 +-
 accel/tcg/{tcg-cpus-rr.c => tcg-accel-ops-rr.c}    |  13 +-
 accel/tcg/{tcg-cpus.c => tcg-accel-ops.c}          |  47 +-
 accel/tcg/tcg-all.c                                |  19 +-
 accel/tcg/user-exec.c                              |   8 +-
 accel/xen/xen-all.c                                |  26 +-
 bsd-user/main.c                                    |  11 +-
 cpu.c                                              |  66 +--
 hw/core/cpu.c                                      |  21 +-
 hw/mips/jazz.c                                     |  12 +-
 linux-user/main.c                                  |   7 +-
 softmmu/cpus.c                                     |  12 +-
 softmmu/memory.c                                   |   2 +-
 softmmu/physmem.c                                  | 149 ++++---
 softmmu/qtest.c                                    |   2 +-
 softmmu/vl.c                                       |   9 +-
 target/alpha/cpu.c                                 |  21 +-
 target/arm/cpu.c                                   |  45 +-
 target/arm/cpu64.c                                 |   4 +-
 target/arm/cpu_tcg.c                               |  32 +-
 target/arm/helper.c                                |   4 +
 target/arm/kvm64.c                                 |   6 +-
 target/avr/cpu.c                                   |  19 +-
 target/avr/helper.c                                |   5 +-
 target/cris/cpu.c                                  |  43 +-
 target/cris/helper.c                               |   5 +-
 target/hppa/cpu.c                                  |  24 +-
 target/i386/hax/{hax-cpus.c => hax-accel-ops.c}    |  33 +-
 target/i386/hax/hax-all.c                          |   7 +-
 target/i386/hax/hax-mem.c                          |   2 +-
 target/i386/hax/hax-posix.c                        |   2 +-
 target/i386/hax/hax-windows.c                      |   2 +-
 target/i386/hvf/{hvf-cpus.c => hvf-accel-ops.c}    |  29 +-
 target/i386/hvf/hvf.c                              |   5 +-
 target/i386/hvf/x86_task.c                         |   2 +-
 target/i386/hvf/x86hvf.c                           |   2 +-
 target/i386/tcg/tcg-cpu.c                          |  26 +-
 target/i386/whpx/{whpx-cpus.c => whpx-accel-ops.c} |  33 +-
 target/i386/whpx/whpx-all.c                        |   9 +-
 target/lm32/cpu.c                                  |  19 +-
 target/m68k/cpu.c                                  |  19 +-
 target/microblaze/cpu.c                            |  25 +-
 target/mips/cpu.c                                  |  35 +-
 target/moxie/cpu.c                                 |  15 +-
 target/nios2/cpu.c                                 |  18 +-
 target/openrisc/cpu.c                              |  17 +-
 target/riscv/cpu.c                                 |  26 +-
 target/riscv/cpu_helper.c                          |   2 +-
 target/rx/cpu.c                                    |  20 +-
 target/s390x/cpu.c                                 |  33 +-
 target/s390x/excp_helper.c                         |   2 +-
 target/sh4/cpu.c                                   |  21 +-
 target/sparc/cpu.c                                 |  25 +-
 target/tilegx/cpu.c                                |  17 +-
 target/tricore/cpu.c                               |  12 +-
 target/unicore32/cpu.c                             |  17 +-
 target/xtensa/cpu.c                                |  23 +-
 target/xtensa/helper.c                             |   4 +-
 tcg/tcg-common.c                                   |   4 -
 tcg/tci.c                                          | 479 ++++++++-------------
 target/ppc/translate_init.c.inc                    |  39 +-
 tcg/aarch64/tcg-target.c.inc                       |   7 +-
 tcg/s390/tcg-target.c.inc                          |   2 +-
 tcg/tci/tcg-target.c.inc                           | 149 ++-----
 MAINTAINERS                                        |   7 +-
 accel/kvm/meson.build                              |   2 +-
 accel/meson.build                                  |   4 +-
 accel/tcg/meson.build                              |  10 +-
 target/i386/hax/meson.build                        |   2 +-
 target/i386/hvf/meson.build                        |   2 +-
 target/i386/whpx/meson.build                       |   2 +-
 108 files changed, 1565 insertions(+), 1065 deletions(-)
 create mode 100644 accel/accel-softmmu.h
 rename accel/tcg/{tcg-cpus-icount.h => tcg-accel-ops-icount.h} (88%)
 create mode 100644 accel/tcg/tcg-accel-ops-mttcg.h
 rename accel/tcg/{tcg-cpus-rr.h => tcg-accel-ops-rr.h} (100%)
 rename accel/tcg/{tcg-cpus.h => tcg-accel-ops.h} (72%)
 create mode 100644 include/hw/core/accel-cpu.h
 create mode 100644 include/hw/core/tcg-cpu-ops.h
 rename include/{sysemu => qemu}/accel.h (94%)
 create mode 100644 include/sysemu/accel-ops.h
 rename target/i386/hax/{hax-cpus.h => hax-accel-ops.h} (95%)
 rename target/i386/hvf/{hvf-cpus.h => hvf-accel-ops.h} (94%)
 rename target/i386/whpx/{whpx-cpus.h => whpx-accel-ops.h} (96%)
 create mode 100644 accel/accel-common.c
 rename accel/{accel.c => accel-softmmu.c} (64%)
 create mode 100644 accel/accel-user.c
 rename accel/kvm/{kvm-cpus.c => kvm-accel-ops.c} (72%)
 rename accel/tcg/{tcg-cpus-icount.c => tcg-accel-ops-icount.c} (89%)
 rename accel/tcg/{tcg-cpus-mttcg.c => tcg-accel-ops-mttcg.c} (92%)
 rename accel/tcg/{tcg-cpus-rr.c => tcg-accel-ops-rr.c} (97%)
 rename accel/tcg/{tcg-cpus.c => tcg-accel-ops.c} (63%)
 rename target/i386/hax/{hax-cpus.c => hax-accel-ops.c} (69%)
 rename target/i386/hvf/{hvf-cpus.c => hvf-accel-ops.c} (84%)
 rename target/i386/whpx/{whpx-cpus.c => whpx-accel-ops.c} (71%)

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The code is currently comparing c2 to the type promotion of
uint32_t and int32_t. That is, the conversion rules are as:

(common_type) c2 == (common_type) (uint32_t)
                        (is_unsigned
                        ? (uint32_t)c2
                        : (uint32_t)(int32_t)c2)

In the signed case we lose the desired sign extensions because
of the argument promotion rules of the ternary operator.

Solve the problem by doing the round-trip parsing through the
intermediate type and back to the desired common type (all at
one expression).

Fixes: a534bb15f30 ("tcg/s390: Use constant pool for cmpi")
Tested-by: Richard W.M. Jones <rjones@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
Reported-by: Richard W.M. Jones <rjones@redhat.com>
Suggested-by: David Hildenbrand <david@redhat.com>
Suggested-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210204182902.1742826-1-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/s390/tcg-target.c.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tcg/s390/tcg-target.c.inc b/tcg/s390/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390/tcg-target.c.inc
+++ b/tcg/s390/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static int tgen_cmp(TCGContext *s, TCGType type, TCGCond c, TCGReg r1,
                 op = (is_unsigned ? RIL_CLFI : RIL_CFI);
                 tcg_out_insn_RIL(s, op, r1, c2);
                 goto exit;
-            } else if (c2 == (is_unsigned ? (uint32_t)c2 : (int32_t)c2)) {
+            } else if (c2 == (is_unsigned ? (TCGArg)(uint32_t)c2 : (TCGArg)(int32_t)c2)) {
                 op = (is_unsigned ? RIL_CLGFI : RIL_CGFI);
                 tcg_out_insn_RIL(s, op, r1, c2);
                 goto exit;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

"exec/cpu-defs.h" contains generic CPU definitions for the
TCG frontends (mostly related to TLB). TCG backends definitions
aren't relevant here.

See tcg/README description:

4) Backend

tcg-target.h contains the target specific definitions. tcg-target.c.inc
  contains the target specific code; it is #included by tcg/tcg.c, rather
  than being a standalone C file.

So far only "tcg/tcg.h" requires these headers.

Remove the "target-tcg.h" header dependency on TCG frontends, so we
don't have to rebuild all frontends when hacking a single backend.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210204191423.1754158-1-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-defs.h | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/host-utils.h"
 #include "qemu/thread.h"
-#ifdef CONFIG_TCG
-#include "tcg-target.h"
-#endif
 #ifndef CONFIG_USER_ONLY
 #include "exec/hwaddr.h"
 #endif
-- 
2.25.1

Fixes INDEX_op_rotli_vec for aarch64 host, where the 3rd
argument is an integer, not a temporary, which now tickles
an assert added in e89b28a6350.

Previously, the value computed into v2 would be garbage for
rotli_vec, but as the value was unused it caused no harm.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ void tcg_expand_vec_op(TCGOpcode opc, TCGType type, unsigned vece,
     v0 = temp_tcgv_vec(arg_temp(a0));
     v1 = temp_tcgv_vec(arg_temp(va_arg(va, TCGArg)));
     a2 = va_arg(va, TCGArg);
-    v2 = temp_tcgv_vec(arg_temp(a2));
+    va_end(va);
 
     switch (opc) {
     case INDEX_op_rotli_vec:
@@ -XXX,XX +XXX,XX @@ void tcg_expand_vec_op(TCGOpcode opc, TCGType type, unsigned vece,
     case INDEX_op_shrv_vec:
     case INDEX_op_sarv_vec:
         /* Right shifts are negative left shifts for AArch64.  */
+        v2 = temp_tcgv_vec(arg_temp(a2));
         t1 = tcg_temp_new_vec(type);
         tcg_gen_neg_vec(vece, t1, v2);
         opc = (opc == INDEX_op_shrv_vec
@@ -XXX,XX +XXX,XX @@ void tcg_expand_vec_op(TCGOpcode opc, TCGType type, unsigned vece,
         break;
 
     case INDEX_op_rotlv_vec:
+        v2 = temp_tcgv_vec(arg_temp(a2));
         t1 = tcg_temp_new_vec(type);
         c1 = tcg_constant_vec(type, vece, 8 << vece);
         tcg_gen_sub_vec(vece, t1, v2, c1);
@@ -XXX,XX +XXX,XX @@ void tcg_expand_vec_op(TCGOpcode opc, TCGType type, unsigned vece,
         break;
 
     case INDEX_op_rotrv_vec:
+        v2 = temp_tcgv_vec(arg_temp(a2));
         t1 = tcg_temp_new_vec(type);
         t2 = tcg_temp_new_vec(type);
         c1 = tcg_constant_vec(type, vece, 8 << vece);
@@ -XXX,XX +XXX,XX @@ void tcg_expand_vec_op(TCGOpcode opc, TCGType type, unsigned vece,
     default:
         g_assert_not_reached();
     }
-
-    va_end(va);
 }
 
 static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
-- 
2.25.1

The configure option was backward, and we failed to
pass the value on to meson.

Fixes: 23a77b2d18b ("build-system: clean up TCG/TCI configury")
Tested-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 configure | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ for opt do
   ;;
   --enable-whpx) whpx="enabled"
   ;;
-  --disable-tcg-interpreter) tcg_interpreter="true"
+  --disable-tcg-interpreter) tcg_interpreter="false"
   ;;
-  --enable-tcg-interpreter) tcg_interpreter="false"
+  --enable-tcg-interpreter) tcg_interpreter="true"
   ;;
   --disable-cap-ng)  cap_ng="disabled"
   ;;
@@ -XXX,XX +XXX,XX @@ NINJA=$ninja $meson setup \
         -Dvhost_user_blk_server=$vhost_user_blk_server \
         -Dfuse=$fuse -Dfuse_lseek=$fuse_lseek -Dguest_agent_msi=$guest_agent_msi \
         $(if test "$default_features" = no; then echo "-Dauto_features=disabled"; fi) \
+	-Dtcg_interpreter=$tcg_interpreter \
         $cross_arg \
         "$PWD" "$source_path"
 
-- 
2.25.1

Each thread must have its own pc, even under TCI.

Remove the GETPC ifdef, because GETPC is always available for
helpers, and thus is always required.  Move the assignment
under INDEX_op_call, because the value is only visible when
we make a call to a helper function.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210204014509.882821-6-richard.henderson@linaro.org>
---
 include/exec/exec-all.h | 2 +-
 tcg/tcg-common.c        | 4 ----
 tcg/tci.c               | 7 +++----
 3 files changed, 4 insertions(+), 9 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr);
 
 /* GETPC is the true target of the return instruction that we'll execute.  */
 #if defined(CONFIG_TCG_INTERPRETER)
-extern uintptr_t tci_tb_ptr;
+extern __thread uintptr_t tci_tb_ptr;
 # define GETPC() tci_tb_ptr
 #else
 # define GETPC() \
diff --git a/tcg/tcg-common.c b/tcg/tcg-common.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-common.c
+++ b/tcg/tcg-common.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "tcg/tcg.h"
 
-#if defined(CONFIG_TCG_INTERPRETER)
-uintptr_t tci_tb_ptr;
-#endif
-
 TCGOpDef tcg_op_defs[] = {
 #define DEF(s, oargs, iargs, cargs, flags) \
          { #s, oargs, iargs, cargs, iargs + oargs + cargs, flags },
diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ typedef uint64_t (*helper_function)(tcg_target_ulong, tcg_target_ulong,
                                     tcg_target_ulong, tcg_target_ulong);
 #endif
 
+__thread uintptr_t tci_tb_ptr;
+
 static tcg_target_ulong tci_read_reg(const tcg_target_ulong *regs, TCGReg index)
 {
     tci_assert(index < TCG_TARGET_NB_REGS);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 #endif
         TCGMemOpIdx oi;
 
-#if defined(GETPC)
-        tci_tb_ptr = (uintptr_t)tb_ptr;
-#endif
-
         /* Skip opcode and size entry. */
         tb_ptr += 2;
 
         switch (opc) {
         case INDEX_op_call:
             t0 = tci_read_ri(regs, &tb_ptr);
+            tci_tb_ptr = (uintptr_t)tb_ptr;
 #if TCG_TARGET_REG_BITS == 32
             tmp64 = ((helper_function)t0)(tci_read_reg(regs, TCG_REG_R0),
                                           tci_read_reg(regs, TCG_REG_R1),
-- 
2.25.1

From: Stefan Weil <sw@weilnetz.de>

That TCG opcode is used by debian-buster (arm64) running ffmpeg:

qemu-aarch64 /usr/bin/ffmpeg -i theora.mkv theora.webm

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reported-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Message-Id: <20210128024814.2056958-1-sw@weilnetz.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             TODO();
             break;
         case INDEX_op_ld16s_i32:
-            TODO();
+            t0 = *tb_ptr++;
+            t1 = tci_read_r(regs, &tb_ptr);
+            t2 = tci_read_s32(&tb_ptr);
+            tci_write_reg(regs, t0, *(int16_t *)(t1 + t2));
             break;
         case INDEX_op_ld_i32:
             t0 = *tb_ptr++;
-- 
2.25.1

From: Stefan Weil <sw@weilnetz.de>

That TCG opcode is used by debian-buster (arm64) running ffmpeg:

qemu-aarch64 /usr/bin/ffmpeg -i theora.mkv theora.webm

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reported-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Message-Id: <20210128020425.2055454-1-sw@weilnetz.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_write_reg8(regs, t0, *(uint8_t *)(t1 + t2));
             break;
         case INDEX_op_ld8s_i64:
-            TODO();
+            t0 = *tb_ptr++;
+            t1 = tci_read_r(regs, &tb_ptr);
+            t2 = tci_read_s32(&tb_ptr);
+            tci_write_reg(regs, t0, *(int8_t *)(t1 + t2));
             break;
         case INDEX_op_ld16u_i64:
             t0 = *tb_ptr++;
-- 
2.25.1

For a 64-bit TCI, the upper bits of a 32-bit operation are
undefined (much like a native ppc64 32-bit operation).  It
simplifies everything if we don't force-extend the result.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c | 66 +++++++++++++++++++++++++------------------------------
 1 file changed, 30 insertions(+), 36 deletions(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ tci_write_reg(tcg_target_ulong *regs, TCGReg index, tcg_target_ulong value)
     regs[index] = value;
 }
 
-static void
-tci_write_reg32(tcg_target_ulong *regs, TCGReg index, uint32_t value)
-{
-    tci_write_reg(regs, index, value);
-}
-
 #if TCG_TARGET_REG_BITS == 32
 static void tci_write_reg64(tcg_target_ulong *regs, uint32_t high_index,
                             uint32_t low_index, uint64_t value)
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t1 = tci_read_r32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
             condition = *tb_ptr++;
-            tci_write_reg32(regs, t0, tci_compare32(t1, t2, condition));
+            tci_write_reg(regs, t0, tci_compare32(t1, t2, condition));
             break;
 #if TCG_TARGET_REG_BITS == 32
         case INDEX_op_setcond2_i32:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tmp64 = tci_read_r64(regs, &tb_ptr);
             v64 = tci_read_ri64(regs, &tb_ptr);
             condition = *tb_ptr++;
-            tci_write_reg32(regs, t0, tci_compare64(tmp64, v64, condition));
+            tci_write_reg(regs, t0, tci_compare64(tmp64, v64, condition));
             break;
 #elif TCG_TARGET_REG_BITS == 64
         case INDEX_op_setcond_i64:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         case INDEX_op_mov_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_r32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
         case INDEX_op_tci_movi_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_i32(&tb_ptr);
-            tci_write_reg32(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 
             /* Load/store operations (32 bit). */
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = *tb_ptr++;
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
-            tci_write_reg32(regs, t0, *(uint32_t *)(t1 + t2));
+            tci_write_reg(regs, t0, *(uint32_t *)(t1 + t2));
             break;
         case INDEX_op_st8_i32:
             t0 = tci_read_r8(regs, &tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1 + t2);
+            tci_write_reg(regs, t0, t1 + t2);
             break;
         case INDEX_op_sub_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1 - t2);
+            tci_write_reg(regs, t0, t1 - t2);
             break;
         case INDEX_op_mul_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1 * t2);
+            tci_write_reg(regs, t0, t1 * t2);
             break;
 #if TCG_TARGET_HAS_div_i32
         case INDEX_op_div_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, (int32_t)t1 / (int32_t)t2);
+            tci_write_reg(regs, t0, (int32_t)t1 / (int32_t)t2);
             break;
         case INDEX_op_divu_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1 / t2);
+            tci_write_reg(regs, t0, t1 / t2);
             break;
         case INDEX_op_rem_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, (int32_t)t1 % (int32_t)t2);
+            tci_write_reg(regs, t0, (int32_t)t1 % (int32_t)t2);
             break;
         case INDEX_op_remu_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1 % t2);
+            tci_write_reg(regs, t0, t1 % t2);
             break;
 #elif TCG_TARGET_HAS_div2_i32
         case INDEX_op_div2_i32:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1 & t2);
+            tci_write_reg(regs, t0, t1 & t2);
             break;
         case INDEX_op_or_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1 | t2);
+            tci_write_reg(regs, t0, t1 | t2);
             break;
         case INDEX_op_xor_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1 ^ t2);
+            tci_write_reg(regs, t0, t1 ^ t2);
             break;
 
             /* Shift/rotate operations (32 bit). */
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1 << (t2 & 31));
+            tci_write_reg(regs, t0, t1 << (t2 & 31));
             break;
         case INDEX_op_shr_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1 >> (t2 & 31));
+            tci_write_reg(regs, t0, t1 >> (t2 & 31));
             break;
         case INDEX_op_sar_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, ((int32_t)t1 >> (t2 & 31)));
+            tci_write_reg(regs, t0, ((int32_t)t1 >> (t2 & 31)));
             break;
 #if TCG_TARGET_HAS_rot_i32
         case INDEX_op_rotl_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, rol32(t1, t2 & 31));
+            tci_write_reg(regs, t0, rol32(t1, t2 & 31));
             break;
         case INDEX_op_rotr_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, ror32(t1, t2 & 31));
+            tci_write_reg(regs, t0, ror32(t1, t2 & 31));
             break;
 #endif
 #if TCG_TARGET_HAS_deposit_i32
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tmp16 = *tb_ptr++;
             tmp8 = *tb_ptr++;
             tmp32 = (((1 << tmp8) - 1) << tmp16);
-            tci_write_reg32(regs, t0, (t1 & ~tmp32) | ((t2 << tmp16) & tmp32));
+            tci_write_reg(regs, t0, (t1 & ~tmp32) | ((t2 << tmp16) & tmp32));
             break;
 #endif
         case INDEX_op_brcond_i32:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         case INDEX_op_ext8s_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_r8s(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 #endif
 #if TCG_TARGET_HAS_ext16s_i32
         case INDEX_op_ext16s_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_r16s(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 #endif
 #if TCG_TARGET_HAS_ext8u_i32
         case INDEX_op_ext8u_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_r8(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 #endif
 #if TCG_TARGET_HAS_ext16u_i32
         case INDEX_op_ext16u_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_r16(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 #endif
 #if TCG_TARGET_HAS_bswap16_i32
         case INDEX_op_bswap16_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_r16(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, bswap16(t1));
+            tci_write_reg(regs, t0, bswap16(t1));
             break;
 #endif
 #if TCG_TARGET_HAS_bswap32_i32
         case INDEX_op_bswap32_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_r32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, bswap32(t1));
+            tci_write_reg(regs, t0, bswap32(t1));
             break;
 #endif
 #if TCG_TARGET_HAS_not_i32
         case INDEX_op_not_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_r32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, ~t1);
+            tci_write_reg(regs, t0, ~t1);
             break;
 #endif
 #if TCG_TARGET_HAS_neg_i32
         case INDEX_op_neg_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_r32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, -t1);
+            tci_write_reg(regs, t0, -t1);
             break;
 #endif
 #if TCG_TARGET_REG_BITS == 64
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = *tb_ptr++;
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
-            tci_write_reg32(regs, t0, *(uint32_t *)(t1 + t2));
+            tci_write_reg(regs, t0, *(uint32_t *)(t1 + t2));
             break;
         case INDEX_op_ld32s_i64:
             t0 = *tb_ptr++;
-- 
2.25.1

Note that we had two functions of the same name: a 32-bit version
which took two register numbers and a 64-bit version which was a
no-op wrapper for tcg_write_reg.  After this, we are left with
only the 32-bit version.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c | 60 +++++++++++++++++++++++++------------------------------
 1 file changed, 27 insertions(+), 33 deletions(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ static void tci_write_reg64(tcg_target_ulong *regs, uint32_t high_index,
     tci_write_reg(regs, low_index, value);
     tci_write_reg(regs, high_index, value >> 32);
 }
-#elif TCG_TARGET_REG_BITS == 64
-static void
-tci_write_reg64(tcg_target_ulong *regs, TCGReg index, uint64_t value)
-{
-    tci_write_reg(regs, index, value);
-}
 #endif
 
 #if TCG_TARGET_REG_BITS == 32
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t1 = tci_read_r64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
             condition = *tb_ptr++;
-            tci_write_reg64(regs, t0, tci_compare64(t1, t2, condition));
+            tci_write_reg(regs, t0, tci_compare64(t1, t2, condition));
             break;
 #endif
         case INDEX_op_mov_i32:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         case INDEX_op_mov_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
         case INDEX_op_tci_movi_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_i64(&tb_ptr);
-            tci_write_reg64(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 
             /* Load/store operations (64 bit). */
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = *tb_ptr++;
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
-            tci_write_reg64(regs, t0, *(uint64_t *)(t1 + t2));
+            tci_write_reg(regs, t0, *(uint64_t *)(t1 + t2));
             break;
         case INDEX_op_st8_i64:
             t0 = tci_read_r8(regs, &tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1 + t2);
+            tci_write_reg(regs, t0, t1 + t2);
             break;
         case INDEX_op_sub_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1 - t2);
+            tci_write_reg(regs, t0, t1 - t2);
             break;
         case INDEX_op_mul_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1 * t2);
+            tci_write_reg(regs, t0, t1 * t2);
             break;
 #if TCG_TARGET_HAS_div_i64
         case INDEX_op_div_i64:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1 & t2);
+            tci_write_reg(regs, t0, t1 & t2);
             break;
         case INDEX_op_or_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1 | t2);
+            tci_write_reg(regs, t0, t1 | t2);
             break;
         case INDEX_op_xor_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1 ^ t2);
+            tci_write_reg(regs, t0, t1 ^ t2);
             break;
 
             /* Shift/rotate operations (64 bit). */
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1 << (t2 & 63));
+            tci_write_reg(regs, t0, t1 << (t2 & 63));
             break;
         case INDEX_op_shr_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1 >> (t2 & 63));
+            tci_write_reg(regs, t0, t1 >> (t2 & 63));
             break;
         case INDEX_op_sar_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, ((int64_t)t1 >> (t2 & 63)));
+            tci_write_reg(regs, t0, ((int64_t)t1 >> (t2 & 63)));
             break;
 #if TCG_TARGET_HAS_rot_i64
         case INDEX_op_rotl_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, rol64(t1, t2 & 63));
+            tci_write_reg(regs, t0, rol64(t1, t2 & 63));
             break;
         case INDEX_op_rotr_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, ror64(t1, t2 & 63));
+            tci_write_reg(regs, t0, ror64(t1, t2 & 63));
             break;
 #endif
 #if TCG_TARGET_HAS_deposit_i64
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tmp16 = *tb_ptr++;
             tmp8 = *tb_ptr++;
             tmp64 = (((1ULL << tmp8) - 1) << tmp16);
-            tci_write_reg64(regs, t0, (t1 & ~tmp64) | ((t2 << tmp16) & tmp64));
+            tci_write_reg(regs, t0, (t1 & ~tmp64) | ((t2 << tmp16) & tmp64));
             break;
 #endif
         case INDEX_op_brcond_i64:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         case INDEX_op_ext8u_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r8(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 #endif
 #if TCG_TARGET_HAS_ext8s_i64
         case INDEX_op_ext8s_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r8s(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 #endif
 #if TCG_TARGET_HAS_ext16s_i64
         case INDEX_op_ext16s_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r16s(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 #endif
 #if TCG_TARGET_HAS_ext16u_i64
         case INDEX_op_ext16u_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r16(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 #endif
 #if TCG_TARGET_HAS_ext32s_i64
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         case INDEX_op_ext_i32_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r32s(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 #if TCG_TARGET_HAS_ext32u_i64
         case INDEX_op_ext32u_i64:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         case INDEX_op_extu_i32_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r32(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 #if TCG_TARGET_HAS_bswap16_i64
         case INDEX_op_bswap16_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r16(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, bswap16(t1));
+            tci_write_reg(regs, t0, bswap16(t1));
             break;
 #endif
 #if TCG_TARGET_HAS_bswap32_i64
         case INDEX_op_bswap32_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r32(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, bswap32(t1));
+            tci_write_reg(regs, t0, bswap32(t1));
             break;
 #endif
 #if TCG_TARGET_HAS_bswap64_i64
         case INDEX_op_bswap64_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, bswap64(t1));
+            tci_write_reg(regs, t0, bswap64(t1));
             break;
 #endif
 #if TCG_TARGET_HAS_not_i64
         case INDEX_op_not_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, ~t1);
+            tci_write_reg(regs, t0, ~t1);
             break;
 #endif
 #if TCG_TARGET_HAS_neg_i64
         case INDEX_op_neg_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, -t1);
+            tci_write_reg(regs, t0, -t1);
             break;
 #endif
 #endif /* TCG_TARGET_REG_BITS == 64 */
-- 
2.25.1

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ static bool tci_compare64(uint64_t u0, uint64_t u1, TCGCond condition)
 # define qemu_st_beq(X)  stq_be_p(g2h(taddr), X)
 #endif
 
+#if TCG_TARGET_REG_BITS == 64
+# define CASE_32_64(x) \
+        case glue(glue(INDEX_op_, x), _i64): \
+        case glue(glue(INDEX_op_, x), _i32):
+# define CASE_64(x) \
+        case glue(glue(INDEX_op_, x), _i64):
+#else
+# define CASE_32_64(x) \
+        case glue(glue(INDEX_op_, x), _i32):
+# define CASE_64(x)
+#endif
+
 /* Interpret pseudo code in tb. */
 /*
  * Disable CFI checks.
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
             /* Load/store operations (32 bit). */
 
-        case INDEX_op_ld8u_i32:
+        CASE_32_64(ld8u)
             t0 = *tb_ptr++;
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
             /* Load/store operations (64 bit). */
 
-        case INDEX_op_ld8u_i64:
-            t0 = *tb_ptr++;
-            t1 = tci_read_r(regs, &tb_ptr);
-            t2 = tci_read_s32(&tb_ptr);
-            tci_write_reg(regs, t0, *(uint8_t *)(t1 + t2));
-            break;
         case INDEX_op_ld8s_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r(regs, &tb_ptr);
-- 
2.25.1

Eliminating a TODO for ld8s_i32.

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_s32(&tb_ptr);
             tci_write_reg(regs, t0, *(uint8_t *)(t1 + t2));
             break;
-        case INDEX_op_ld8s_i32:
-            TODO();
+        CASE_32_64(ld8s)
+            t0 = *tb_ptr++;
+            t1 = tci_read_r(regs, &tb_ptr);
+            t2 = tci_read_s32(&tb_ptr);
+            tci_write_reg(regs, t0, *(int8_t *)(t1 + t2));
             break;
         case INDEX_op_ld16u_i32:
             TODO();
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
             /* Load/store operations (64 bit). */
 
-        case INDEX_op_ld8s_i64:
-            t0 = *tb_ptr++;
-            t1 = tci_read_r(regs, &tb_ptr);
-            t2 = tci_read_s32(&tb_ptr);
-            tci_write_reg(regs, t0, *(int8_t *)(t1 + t2));
-            break;
         case INDEX_op_ld16u_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r(regs, &tb_ptr);
-- 
2.25.1

Eliminating a TODO for ld16u_i32.

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_s32(&tb_ptr);
             tci_write_reg(regs, t0, *(int8_t *)(t1 + t2));
             break;
-        case INDEX_op_ld16u_i32:
-            TODO();
+        CASE_32_64(ld16u)
+            t0 = *tb_ptr++;
+            t1 = tci_read_r(regs, &tb_ptr);
+            t2 = tci_read_s32(&tb_ptr);
+            tci_write_reg(regs, t0, *(uint16_t *)(t1 + t2));
             break;
         case INDEX_op_ld16s_i32:
             t0 = *tb_ptr++;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
             /* Load/store operations (64 bit). */
 
-        case INDEX_op_ld16u_i64:
-            t0 = *tb_ptr++;
-            t1 = tci_read_r(regs, &tb_ptr);
-            t2 = tci_read_s32(&tb_ptr);
-            tci_write_reg(regs, t0, *(uint16_t *)(t1 + t2));
-            break;
         case INDEX_op_ld16s_i64:
             TODO();
             break;
-- 
2.25.1

Eliminating a TODO for ld16s_i64.

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_s32(&tb_ptr);
             tci_write_reg(regs, t0, *(uint16_t *)(t1 + t2));
             break;
-        case INDEX_op_ld16s_i32:
+        CASE_32_64(ld16s)
             t0 = *tb_ptr++;
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
             /* Load/store operations (64 bit). */
 
-        case INDEX_op_ld16s_i64:
-            TODO();
-            break;
         case INDEX_op_ld32u_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r(regs, &tb_ptr);
-- 
2.25.1

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_write_reg(regs, t0, *(int16_t *)(t1 + t2));
             break;
         case INDEX_op_ld_i32:
+        CASE_64(ld32u)
             t0 = *tb_ptr++;
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
             /* Load/store operations (64 bit). */
 
-        case INDEX_op_ld32u_i64:
-            t0 = *tb_ptr++;
-            t1 = tci_read_r(regs, &tb_ptr);
-            t2 = tci_read_s32(&tb_ptr);
-            tci_write_reg(regs, t0, *(uint32_t *)(t1 + t2));
-            break;
         case INDEX_op_ld32s_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r(regs, &tb_ptr);
-- 
2.25.1

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_s32(&tb_ptr);
             tci_write_reg(regs, t0, *(uint32_t *)(t1 + t2));
             break;
-        case INDEX_op_st8_i32:
+        CASE_32_64(st8)
             t0 = tci_read_r8(regs, &tb_ptr);
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_s32(&tb_ptr);
             tci_write_reg(regs, t0, *(uint64_t *)(t1 + t2));
             break;
-        case INDEX_op_st8_i64:
-            t0 = tci_read_r8(regs, &tb_ptr);
-            t1 = tci_read_r(regs, &tb_ptr);
-            t2 = tci_read_s32(&tb_ptr);
-            *(uint8_t *)(t1 + t2) = t0;
-            break;
         case INDEX_op_st16_i64:
             t0 = tci_read_r16(regs, &tb_ptr);
             t1 = tci_read_r(regs, &tb_ptr);
-- 
2.25.1

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_s32(&tb_ptr);
             *(uint8_t *)(t1 + t2) = t0;
             break;
-        case INDEX_op_st16_i32:
+        CASE_32_64(st16)
             t0 = tci_read_r16(regs, &tb_ptr);
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_s32(&tb_ptr);
             tci_write_reg(regs, t0, *(uint64_t *)(t1 + t2));
             break;
-        case INDEX_op_st16_i64:
-            t0 = tci_read_r16(regs, &tb_ptr);
-            t1 = tci_read_r(regs, &tb_ptr);
-            t2 = tci_read_s32(&tb_ptr);
-            *(uint16_t *)(t1 + t2) = t0;
-            break;
         case INDEX_op_st32_i64:
             t0 = tci_read_r32(regs, &tb_ptr);
             t1 = tci_read_r(regs, &tb_ptr);
-- 
2.25.1

The existing check was incomplete:
(1) Only applied to two of the 7 stores, and not to the loads at all.
(2) Only checked the upper, but not the lower bound of the stack.

Doing this at compile time means that we don't need to do it
at runtime as well.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c                |  2 --
 tcg/tci/tcg-target.c.inc | 13 +++++++++++++
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = tci_read_r32(regs, &tb_ptr);
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
-            tci_assert(t1 != sp_value || (int32_t)t2 < 0);
             *(uint32_t *)(t1 + t2) = t0;
             break;
 
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = tci_read_r64(regs, &tb_ptr);
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
-            tci_assert(t1 != sp_value || (int32_t)t2 < 0);
             *(uint64_t *)(t1 + t2) = t0;
             break;
 
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tci_out_label(TCGContext *s, TCGLabel *label)
     }
 }
 
+static void stack_bounds_check(TCGReg base, target_long offset)
+{
+    if (base == TCG_REG_CALL_STACK) {
+        tcg_debug_assert(offset < 0);
+        tcg_debug_assert(offset >= -(CPU_TEMP_BUF_NLONGS * sizeof(long)));
+    }
+}
+
 static void tcg_out_ld(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg1,
                        intptr_t arg2)
 {
     uint8_t *old_code_ptr = s->code_ptr;
+
+    stack_bounds_check(arg1, arg2);
     if (type == TCG_TYPE_I32) {
         tcg_out_op_t(s, INDEX_op_ld_i32);
         tcg_out_r(s, ret);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
     case INDEX_op_st16_i64:
     case INDEX_op_st32_i64:
     case INDEX_op_st_i64:
+        stack_bounds_check(args[1], args[2]);
         tcg_out_r(s, args[0]);
         tcg_out_r(s, args[1]);
         tcg_debug_assert(args[2] == (int32_t)args[2]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_st(TCGContext *s, TCGType type, TCGReg arg, TCGReg arg1,
                        intptr_t arg2)
 {
     uint8_t *old_code_ptr = s->code_ptr;
+
+    stack_bounds_check(arg1, arg2);
     if (type == TCG_TYPE_I32) {
         tcg_out_op_t(s, INDEX_op_st_i32);
         tcg_out_r(s, arg);
-- 
2.25.1

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             *(uint16_t *)(t1 + t2) = t0;
             break;
         case INDEX_op_st_i32:
+        CASE_64(st32)
             t0 = tci_read_r32(regs, &tb_ptr);
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_s32(&tb_ptr);
             tci_write_reg(regs, t0, *(uint64_t *)(t1 + t2));
             break;
-        case INDEX_op_st32_i64:
-            t0 = tci_read_r32(regs, &tb_ptr);
-            t1 = tci_read_r(regs, &tb_ptr);
-            t2 = tci_read_s32(&tb_ptr);
-            *(uint32_t *)(t1 + t2) = t0;
-            break;
         case INDEX_op_st_i64:
             t0 = tci_read_r64(regs, &tb_ptr);
             t1 = tci_read_r(regs, &tb_ptr);
-- 
2.25.1

Three TODO instances are never happen cases.
Other uses of tcg_abort are also indicating unreachable cases.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ static bool tci_compare32(uint32_t u0, uint32_t u1, TCGCond condition)
         result = (u0 > u1);
         break;
     default:
-        TODO();
+        g_assert_not_reached();
     }
     return result;
 }
@@ -XXX,XX +XXX,XX @@ static bool tci_compare64(uint64_t u0, uint64_t u1, TCGCond condition)
         result = (u0 > u1);
         break;
     default:
-        TODO();
+        g_assert_not_reached();
     }
     return result;
 }
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                 tmp32 = qemu_ld_beul;
                 break;
             default:
-                tcg_abort();
+                g_assert_not_reached();
             }
             tci_write_reg(regs, t0, tmp32);
             break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                 tmp64 = qemu_ld_beq;
                 break;
             default:
-                tcg_abort();
+                g_assert_not_reached();
             }
             tci_write_reg(regs, t0, tmp64);
             if (TCG_TARGET_REG_BITS == 32) {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                 qemu_st_bel(t0);
                 break;
             default:
-                tcg_abort();
+                g_assert_not_reached();
             }
             break;
         case INDEX_op_qemu_st_i64:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                 qemu_st_beq(tmp64);
                 break;
             default:
-                tcg_abort();
+                g_assert_not_reached();
             }
             break;
         case INDEX_op_mb:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             smp_mb();
             break;
         default:
-            TODO();
-            break;
+            g_assert_not_reached();
         }
         tci_assert(tb_ptr == old_code_ptr + op_size);
     }
-- 
2.25.1

We do not simultaneously support div and div2 -- it's one
or the other.  TCI is already using div, so remove div2.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c                | 12 ------------
 tcg/tci/tcg-target.c.inc |  8 --------
 2 files changed, 20 deletions(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_ri32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 * t2);
             break;
-#if TCG_TARGET_HAS_div_i32
         case INDEX_op_div_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_ri32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 % t2);
             break;
-#elif TCG_TARGET_HAS_div2_i32
-        case INDEX_op_div2_i32:
-        case INDEX_op_divu2_i32:
-            TODO();
-            break;
-#endif
         case INDEX_op_and_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         case INDEX_op_remu_i64:
             TODO();
             break;
-#elif TCG_TARGET_HAS_div2_i64
-        case INDEX_op_div2_i64:
-        case INDEX_op_divu2_i64:
-            TODO();
-            break;
 #endif
         case INDEX_op_and_i64:
             t0 = *tb_ptr++;
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
     case INDEX_op_remu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
         TODO();
         break;
-    case INDEX_op_div2_i64:     /* Optional (TCG_TARGET_HAS_div2_i64). */
-    case INDEX_op_divu2_i64:    /* Optional (TCG_TARGET_HAS_div2_i64). */
-        TODO();
-        break;
     case INDEX_op_brcond_i64:
         tcg_out_r(s, args[0]);
         tcg_out_ri64(s, const_args[1], args[1]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
         tcg_out_ri32(s, const_args[1], args[1]);
         tcg_out_ri32(s, const_args[2], args[2]);
         break;
-    case INDEX_op_div2_i32:     /* Optional (TCG_TARGET_HAS_div2_i32). */
-    case INDEX_op_divu2_i32:    /* Optional (TCG_TARGET_HAS_div2_i32). */
-        TODO();
-        break;
 #if TCG_TARGET_REG_BITS == 32
     case INDEX_op_add2_i32:
     case INDEX_op_sub2_i32:
-- 
2.25.1

Trivially implemented like other arithmetic.
Tested via check-tcg and the ppc64 target.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci/tcg-target.h     |  4 ++--
 tcg/tci.c                | 28 ++++++++++++++++++++++------
 tcg/tci/tcg-target.c.inc | 10 ++++------
 3 files changed, 28 insertions(+), 14 deletions(-)

diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.h
+++ b/tcg/tci/tcg-target.h
@@ -XXX,XX +XXX,XX @@
 #define TCG_TARGET_HAS_extract_i64      0
 #define TCG_TARGET_HAS_sextract_i64     0
 #define TCG_TARGET_HAS_extract2_i64     0
-#define TCG_TARGET_HAS_div_i64          0
-#define TCG_TARGET_HAS_rem_i64          0
+#define TCG_TARGET_HAS_div_i64          1
+#define TCG_TARGET_HAS_rem_i64          1
 #define TCG_TARGET_HAS_ext8s_i64        1
 #define TCG_TARGET_HAS_ext16s_i64       1
 #define TCG_TARGET_HAS_ext32s_i64       1
diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_ri64(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 * t2);
             break;
-#if TCG_TARGET_HAS_div_i64
         case INDEX_op_div_i64:
-        case INDEX_op_divu_i64:
-        case INDEX_op_rem_i64:
-        case INDEX_op_remu_i64:
-            TODO();
+            t0 = *tb_ptr++;
+            t1 = tci_read_ri64(regs, &tb_ptr);
+            t2 = tci_read_ri64(regs, &tb_ptr);
+            tci_write_reg(regs, t0, (int64_t)t1 / (int64_t)t2);
+            break;
+        case INDEX_op_divu_i64:
+            t0 = *tb_ptr++;
+            t1 = tci_read_ri64(regs, &tb_ptr);
+            t2 = tci_read_ri64(regs, &tb_ptr);
+            tci_write_reg(regs, t0, (uint64_t)t1 / (uint64_t)t2);
+            break;
+        case INDEX_op_rem_i64:
+            t0 = *tb_ptr++;
+            t1 = tci_read_ri64(regs, &tb_ptr);
+            t2 = tci_read_ri64(regs, &tb_ptr);
+            tci_write_reg(regs, t0, (int64_t)t1 % (int64_t)t2);
+            break;
+        case INDEX_op_remu_i64:
+            t0 = *tb_ptr++;
+            t1 = tci_read_ri64(regs, &tb_ptr);
+            t2 = tci_read_ri64(regs, &tb_ptr);
+            tci_write_reg(regs, t0, (uint64_t)t1 % (uint64_t)t2);
             break;
-#endif
         case INDEX_op_and_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
     case INDEX_op_sar_i64:
     case INDEX_op_rotl_i64:     /* Optional (TCG_TARGET_HAS_rot_i64). */
     case INDEX_op_rotr_i64:     /* Optional (TCG_TARGET_HAS_rot_i64). */
+    case INDEX_op_div_i64:      /* Optional (TCG_TARGET_HAS_div_i64). */
+    case INDEX_op_divu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
+    case INDEX_op_rem_i64:      /* Optional (TCG_TARGET_HAS_div_i64). */
+    case INDEX_op_remu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
         tcg_out_r(s, args[0]);
         tcg_out_ri64(s, const_args[1], args[1]);
         tcg_out_ri64(s, const_args[2], args[2]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
         tcg_debug_assert(args[4] <= UINT8_MAX);
         tcg_out8(s, args[4]);
         break;
-    case INDEX_op_div_i64:      /* Optional (TCG_TARGET_HAS_div_i64). */
-    case INDEX_op_divu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
-    case INDEX_op_rem_i64:      /* Optional (TCG_TARGET_HAS_div_i64). */
-    case INDEX_op_remu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
-        TODO();
-        break;
     case INDEX_op_brcond_i64:
         tcg_out_r(s, args[0]);
         tcg_out_ri64(s, const_args[1], args[1]);
-- 
2.25.1

As noted in several comments, 8 regs is not enough for 32-bit
to perform calls, as currently implemented.  Shortly, we will
rearrange the encoding which will make 32 regs impossible.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci/tcg-target.h     | 32 +++++---------------------------
 tcg/tci/tcg-target.c.inc | 26 --------------------------
 2 files changed, 5 insertions(+), 53 deletions(-)

diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.h
+++ b/tcg/tci/tcg-target.h
@@ -XXX,XX +XXX,XX @@
 #define TCG_TARGET_HAS_mulu2_i32        1
 #endif /* TCG_TARGET_REG_BITS == 64 */
 
-/* Number of registers available.
-   For 32 bit hosts, we need more than 8 registers (call arguments). */
-/* #define TCG_TARGET_NB_REGS 8 */
+/* Number of registers available. */
 #define TCG_TARGET_NB_REGS 16
-/* #define TCG_TARGET_NB_REGS 32 */
 
 /* List of registers which are used by TCG. */
 typedef enum {
@@ -XXX,XX +XXX,XX @@ typedef enum {
     TCG_REG_R5,
     TCG_REG_R6,
     TCG_REG_R7,
-#if TCG_TARGET_NB_REGS >= 16
     TCG_REG_R8,
     TCG_REG_R9,
     TCG_REG_R10,
@@ -XXX,XX +XXX,XX @@ typedef enum {
     TCG_REG_R13,
     TCG_REG_R14,
     TCG_REG_R15,
-#if TCG_TARGET_NB_REGS >= 32
-    TCG_REG_R16,
-    TCG_REG_R17,
-    TCG_REG_R18,
-    TCG_REG_R19,
-    TCG_REG_R20,
-    TCG_REG_R21,
-    TCG_REG_R22,
-    TCG_REG_R23,
-    TCG_REG_R24,
-    TCG_REG_R25,
-    TCG_REG_R26,
-    TCG_REG_R27,
-    TCG_REG_R28,
-    TCG_REG_R29,
-    TCG_REG_R30,
-    TCG_REG_R31,
-#endif
-#endif
+
+    TCG_AREG0 = TCG_REG_R14,
+    TCG_REG_CALL_STACK = TCG_REG_R15,
+
     /* Special value UINT8_MAX is used by TCI to encode constant values. */
     TCG_CONST = UINT8_MAX
 } TCGReg;
 
-#define TCG_AREG0                       (TCG_TARGET_NB_REGS - 2)
-
 /* Used for function call generation. */
-#define TCG_REG_CALL_STACK              (TCG_TARGET_NB_REGS - 1)
 #define TCG_TARGET_CALL_STACK_OFFSET    0
 #define TCG_TARGET_STACK_ALIGN          16
 
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const int tcg_target_reg_alloc_order[] = {
     TCG_REG_R5,
     TCG_REG_R6,
     TCG_REG_R7,
-#if TCG_TARGET_NB_REGS >= 16
     TCG_REG_R8,
     TCG_REG_R9,
     TCG_REG_R10,
@@ -XXX,XX +XXX,XX @@ static const int tcg_target_reg_alloc_order[] = {
     TCG_REG_R13,
     TCG_REG_R14,
     TCG_REG_R15,
-#endif
 };
 
 #if MAX_OPC_PARAM_IARGS != 6
@@ -XXX,XX +XXX,XX @@ static const int tcg_target_call_iarg_regs[] = {
 #if TCG_TARGET_REG_BITS == 32
     /* 32 bit hosts need 2 * MAX_OPC_PARAM_IARGS registers. */
     TCG_REG_R7,
-#if TCG_TARGET_NB_REGS >= 16
     TCG_REG_R8,
     TCG_REG_R9,
     TCG_REG_R10,
     TCG_REG_R11,
     TCG_REG_R12,
-#else
-# error Too few input registers available
-#endif
 #endif
 };
 
@@ -XXX,XX +XXX,XX @@ static const char *const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
     "r05",
     "r06",
     "r07",
-#if TCG_TARGET_NB_REGS >= 16
     "r08",
     "r09",
     "r10",
@@ -XXX,XX +XXX,XX @@ static const char *const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
     "r13",
     "r14",
     "r15",
-#if TCG_TARGET_NB_REGS >= 32
-    "r16",
-    "r17",
-    "r18",
-    "r19",
-    "r20",
-    "r21",
-    "r22",
-    "r23",
-    "r24",
-    "r25",
-    "r26",
-    "r27",
-    "r28",
-    "r29",
-    "r30",
-    "r31"
-#endif
-#endif
 };
 #endif
 
-- 
2.25.1

This was removed from tcg_target_reg_alloc_order and
tcg_target_call_iarg_regs on the assumption that it
was the stack.  This was incorrectly copied from i386.
For tci, the stack is R15.

By adding R4 back to tcg_target_call_iarg_regs, adjust the other
entries so that 6 (or 12) entries are still present in the array,
and adjust the numbers in the interpreter.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c                | 8 ++++----
 tcg/tci/tcg-target.c.inc | 7 +------
 2 files changed, 5 insertions(+), 10 deletions(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                                           tci_read_reg(regs, TCG_REG_R1),
                                           tci_read_reg(regs, TCG_REG_R2),
                                           tci_read_reg(regs, TCG_REG_R3),
+                                          tci_read_reg(regs, TCG_REG_R4),
                                           tci_read_reg(regs, TCG_REG_R5),
                                           tci_read_reg(regs, TCG_REG_R6),
                                           tci_read_reg(regs, TCG_REG_R7),
                                           tci_read_reg(regs, TCG_REG_R8),
                                           tci_read_reg(regs, TCG_REG_R9),
                                           tci_read_reg(regs, TCG_REG_R10),
-                                          tci_read_reg(regs, TCG_REG_R11),
-                                          tci_read_reg(regs, TCG_REG_R12));
+                                          tci_read_reg(regs, TCG_REG_R11));
             tci_write_reg(regs, TCG_REG_R0, tmp64);
             tci_write_reg(regs, TCG_REG_R1, tmp64 >> 32);
 #else
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                                           tci_read_reg(regs, TCG_REG_R1),
                                           tci_read_reg(regs, TCG_REG_R2),
                                           tci_read_reg(regs, TCG_REG_R3),
-                                          tci_read_reg(regs, TCG_REG_R5),
-                                          tci_read_reg(regs, TCG_REG_R6));
+                                          tci_read_reg(regs, TCG_REG_R4),
+                                          tci_read_reg(regs, TCG_REG_R5));
             tci_write_reg(regs, TCG_REG_R0, tmp64);
 #endif
             break;
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const int tcg_target_reg_alloc_order[] = {
     TCG_REG_R1,
     TCG_REG_R2,
     TCG_REG_R3,
-#if 0 /* used for TCG_REG_CALL_STACK */
     TCG_REG_R4,
-#endif
     TCG_REG_R5,
     TCG_REG_R6,
     TCG_REG_R7,
@@ -XXX,XX +XXX,XX @@ static const int tcg_target_call_iarg_regs[] = {
     TCG_REG_R1,
     TCG_REG_R2,
     TCG_REG_R3,
-#if 0 /* used for TCG_REG_CALL_STACK */
     TCG_REG_R4,
-#endif
     TCG_REG_R5,
-    TCG_REG_R6,
 #if TCG_TARGET_REG_BITS == 32
     /* 32 bit hosts need 2 * MAX_OPC_PARAM_IARGS registers. */
+    TCG_REG_R6,
     TCG_REG_R7,
     TCG_REG_R8,
     TCG_REG_R9,
     TCG_REG_R10,
     TCG_REG_R11,
-    TCG_REG_R12,
 #endif
 };
 
-- 
2.25.1

Restrict all operands to registers.  All constants will be forced
into registers by the middle-end.  Removing the difference in how
immediate integers were encoded will allow more code to be shared
between 32-bit and 64-bit operations.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci/tcg-target-con-set.h |   6 +-
 tcg/tci/tcg-target.h         |   3 -
 tcg/tci.c                    | 189 +++++++++++++----------------------
 tcg/tci/tcg-target.c.inc     |  85 ++++------------
 4 files changed, 89 insertions(+), 194 deletions(-)

diff --git a/tcg/tci/tcg-target-con-set.h b/tcg/tci/tcg-target-con-set.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target-con-set.h
+++ b/tcg/tci/tcg-target-con-set.h
@@ -XXX,XX +XXX,XX @@
  * tcg-target-con-str.h; the constraint combination is inclusive or.
  */
 C_O0_I2(r, r)
-C_O0_I2(r, ri)
 C_O0_I3(r, r, r)
-C_O0_I4(r, r, ri, ri)
 C_O0_I4(r, r, r, r)
 C_O1_I1(r, r)
 C_O1_I2(r, 0, r)
-C_O1_I2(r, ri, ri)
 C_O1_I2(r, r, r)
-C_O1_I2(r, r, ri)
-C_O1_I4(r, r, r, ri, ri)
+C_O1_I4(r, r, r, r, r)
 C_O2_I1(r, r, r)
 C_O2_I2(r, r, r, r)
 C_O2_I4(r, r, r, r, r, r)
diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.h
+++ b/tcg/tci/tcg-target.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
 
     TCG_AREG0 = TCG_REG_R14,
     TCG_REG_CALL_STACK = TCG_REG_R15,
-
-    /* Special value UINT8_MAX is used by TCI to encode constant values. */
-    TCG_CONST = UINT8_MAX
 } TCGReg;
 
 /* Used for function call generation. */
diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ tci_read_ulong(const tcg_target_ulong *regs, const uint8_t **tb_ptr)
     return taddr;
 }
 
-/* Read indexed register or constant (native size) from bytecode. */
-static tcg_target_ulong
-tci_read_ri(const tcg_target_ulong *regs, const uint8_t **tb_ptr)
-{
-    tcg_target_ulong value;
-    TCGReg r = **tb_ptr;
-    *tb_ptr += 1;
-    if (r == TCG_CONST) {
-        value = tci_read_i(tb_ptr);
-    } else {
-        value = tci_read_reg(regs, r);
-    }
-    return value;
-}
-
-/* Read indexed register or constant (32 bit) from bytecode. */
-static uint32_t tci_read_ri32(const tcg_target_ulong *regs,
-                              const uint8_t **tb_ptr)
-{
-    uint32_t value;
-    TCGReg r = **tb_ptr;
-    *tb_ptr += 1;
-    if (r == TCG_CONST) {
-        value = tci_read_i32(tb_ptr);
-    } else {
-        value = tci_read_reg32(regs, r);
-    }
-    return value;
-}
-
-#if TCG_TARGET_REG_BITS == 32
-/* Read two indexed registers or constants (2 * 32 bit) from bytecode. */
-static uint64_t tci_read_ri64(const tcg_target_ulong *regs,
-                              const uint8_t **tb_ptr)
-{
-    uint32_t low = tci_read_ri32(regs, tb_ptr);
-    return tci_uint64(tci_read_ri32(regs, tb_ptr), low);
-}
-#elif TCG_TARGET_REG_BITS == 64
-/* Read indexed register or constant (64 bit) from bytecode. */
-static uint64_t tci_read_ri64(const tcg_target_ulong *regs,
-                              const uint8_t **tb_ptr)
-{
-    uint64_t value;
-    TCGReg r = **tb_ptr;
-    *tb_ptr += 1;
-    if (r == TCG_CONST) {
-        value = tci_read_i64(tb_ptr);
-    } else {
-        value = tci_read_reg64(regs, r);
-    }
-    return value;
-}
-#endif
-
 static tcg_target_ulong tci_read_label(const uint8_t **tb_ptr)
 {
     tcg_target_ulong label = tci_read_i(tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
         switch (opc) {
         case INDEX_op_call:
-            t0 = tci_read_ri(regs, &tb_ptr);
+            t0 = tci_read_i(&tb_ptr);
             tci_tb_ptr = (uintptr_t)tb_ptr;
 #if TCG_TARGET_REG_BITS == 32
             tmp64 = ((helper_function)t0)(tci_read_reg(regs, TCG_REG_R0),
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         case INDEX_op_setcond_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_r32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             condition = *tb_ptr++;
             tci_write_reg(regs, t0, tci_compare32(t1, t2, condition));
             break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         case INDEX_op_setcond2_i32:
             t0 = *tb_ptr++;
             tmp64 = tci_read_r64(regs, &tb_ptr);
-            v64 = tci_read_ri64(regs, &tb_ptr);
+            v64 = tci_read_r64(regs, &tb_ptr);
             condition = *tb_ptr++;
             tci_write_reg(regs, t0, tci_compare64(tmp64, v64, condition));
             break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         case INDEX_op_setcond_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             condition = *tb_ptr++;
             tci_write_reg(regs, t0, tci_compare64(t1, t2, condition));
             break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
         case INDEX_op_add_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 + t2);
             break;
         case INDEX_op_sub_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 - t2);
             break;
         case INDEX_op_mul_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 * t2);
             break;
         case INDEX_op_div_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, (int32_t)t1 / (int32_t)t2);
             break;
         case INDEX_op_divu_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 / t2);
             break;
         case INDEX_op_rem_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, (int32_t)t1 % (int32_t)t2);
             break;
         case INDEX_op_remu_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 % t2);
             break;
         case INDEX_op_and_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 & t2);
             break;
         case INDEX_op_or_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 | t2);
             break;
         case INDEX_op_xor_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 ^ t2);
             break;
 
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
         case INDEX_op_shl_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 << (t2 & 31));
             break;
         case INDEX_op_shr_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 >> (t2 & 31));
             break;
         case INDEX_op_sar_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, ((int32_t)t1 >> (t2 & 31)));
             break;
 #if TCG_TARGET_HAS_rot_i32
         case INDEX_op_rotl_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, rol32(t1, t2 & 31));
             break;
         case INDEX_op_rotr_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, ror32(t1, t2 & 31));
             break;
 #endif
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 #endif
         case INDEX_op_brcond_i32:
             t0 = tci_read_r32(regs, &tb_ptr);
-            t1 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
             condition = *tb_ptr++;
             label = tci_read_label(&tb_ptr);
             if (tci_compare32(t0, t1, condition)) {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             break;
         case INDEX_op_brcond2_i32:
             tmp64 = tci_read_r64(regs, &tb_ptr);
-            v64 = tci_read_ri64(regs, &tb_ptr);
+            v64 = tci_read_r64(regs, &tb_ptr);
             condition = *tb_ptr++;
             label = tci_read_label(&tb_ptr);
             if (tci_compare64(tmp64, v64, condition)) {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
         case INDEX_op_add_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 + t2);
             break;
         case INDEX_op_sub_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 - t2);
             break;
         case INDEX_op_mul_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 * t2);
             break;
         case INDEX_op_div_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, (int64_t)t1 / (int64_t)t2);
             break;
         case INDEX_op_divu_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, (uint64_t)t1 / (uint64_t)t2);
             break;
         case INDEX_op_rem_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, (int64_t)t1 % (int64_t)t2);
             break;
         case INDEX_op_remu_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, (uint64_t)t1 % (uint64_t)t2);
             break;
         case INDEX_op_and_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 & t2);
             break;
         case INDEX_op_or_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 | t2);
             break;
         case INDEX_op_xor_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 ^ t2);
             break;
 
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
         case INDEX_op_shl_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 << (t2 & 63));
             break;
         case INDEX_op_shr_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 >> (t2 & 63));
             break;
         case INDEX_op_sar_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, ((int64_t)t1 >> (t2 & 63)));
             break;
 #if TCG_TARGET_HAS_rot_i64
         case INDEX_op_rotl_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, rol64(t1, t2 & 63));
             break;
         case INDEX_op_rotr_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, ror64(t1, t2 & 63));
             break;
 #endif
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 #endif
         case INDEX_op_brcond_i64:
             t0 = tci_read_r64(regs, &tb_ptr);
-            t1 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
             condition = *tb_ptr++;
             label = tci_read_label(&tb_ptr);
             if (tci_compare64(t0, t1, condition)) {
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_rem_i64:
     case INDEX_op_remu_i32:
     case INDEX_op_remu_i64:
-        return C_O1_I2(r, r, r);
-
     case INDEX_op_add_i32:
     case INDEX_op_add_i64:
     case INDEX_op_sub_i32:
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_rotl_i64:
     case INDEX_op_rotr_i32:
     case INDEX_op_rotr_i64:
-        /* TODO: Does R, RI, RI result in faster code than R, R, RI? */
-        return C_O1_I2(r, ri, ri);
+    case INDEX_op_setcond_i32:
+    case INDEX_op_setcond_i64:
+        return C_O1_I2(r, r, r);
 
     case INDEX_op_deposit_i32:
     case INDEX_op_deposit_i64:
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
 
     case INDEX_op_brcond_i32:
     case INDEX_op_brcond_i64:
-        return C_O0_I2(r, ri);
-
-    case INDEX_op_setcond_i32:
-    case INDEX_op_setcond_i64:
-        return C_O1_I2(r, r, ri);
+        return C_O0_I2(r, r);
 
 #if TCG_TARGET_REG_BITS == 32
     /* TODO: Support R, R, R, R, RI, RI? Will it be faster? */
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_sub2_i32:
         return C_O2_I4(r, r, r, r, r, r);
     case INDEX_op_brcond2_i32:
-        return C_O0_I4(r, r, ri, ri);
+        return C_O0_I4(r, r, r, r);
     case INDEX_op_mulu2_i32:
         return C_O2_I2(r, r, r, r);
     case INDEX_op_setcond2_i32:
-        return C_O1_I4(r, r, r, ri, ri);
+        return C_O1_I4(r, r, r, r, r);
 #endif
 
     case INDEX_op_qemu_ld_i32:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_r(TCGContext *s, TCGArg t0)
     tcg_out8(s, t0);
 }
 
-/* Write register or constant (native size). */
-static void tcg_out_ri(TCGContext *s, int const_arg, TCGArg arg)
-{
-    if (const_arg) {
-        tcg_debug_assert(const_arg == 1);
-        tcg_out8(s, TCG_CONST);
-        tcg_out_i(s, arg);
-    } else {
-        tcg_out_r(s, arg);
-    }
-}
-
-/* Write register or constant (32 bit). */
-static void tcg_out_ri32(TCGContext *s, int const_arg, TCGArg arg)
-{
-    if (const_arg) {
-        tcg_debug_assert(const_arg == 1);
-        tcg_out8(s, TCG_CONST);
-        tcg_out32(s, arg);
-    } else {
-        tcg_out_r(s, arg);
-    }
-}
-
-#if TCG_TARGET_REG_BITS == 64
-/* Write register or constant (64 bit). */
-static void tcg_out_ri64(TCGContext *s, int const_arg, TCGArg arg)
-{
-    if (const_arg) {
-        tcg_debug_assert(const_arg == 1);
-        tcg_out8(s, TCG_CONST);
-        tcg_out64(s, arg);
-    } else {
-        tcg_out_r(s, arg);
-    }
-}
-#endif
-
 /* Write label. */
 static void tci_out_label(TCGContext *s, TCGLabel *label)
 {
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_call(TCGContext *s, const tcg_insn_unit *arg)
 {
     uint8_t *old_code_ptr = s->code_ptr;
     tcg_out_op_t(s, INDEX_op_call);
-    tcg_out_ri(s, 1, (uintptr_t)arg);
+    tcg_out_i(s, (uintptr_t)arg);
     old_code_ptr[1] = s->code_ptr - old_code_ptr;
 }
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
     case INDEX_op_setcond_i32:
         tcg_out_r(s, args[0]);
         tcg_out_r(s, args[1]);
-        tcg_out_ri32(s, const_args[2], args[2]);
+        tcg_out_r(s, args[2]);
         tcg_out8(s, args[3]);   /* condition */
         break;
 #if TCG_TARGET_REG_BITS == 32
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
         tcg_out_r(s, args[0]);
         tcg_out_r(s, args[1]);
         tcg_out_r(s, args[2]);
-        tcg_out_ri32(s, const_args[3], args[3]);
-        tcg_out_ri32(s, const_args[4], args[4]);
+        tcg_out_r(s, args[3]);
+        tcg_out_r(s, args[4]);
         tcg_out8(s, args[5]);   /* condition */
         break;
 #elif TCG_TARGET_REG_BITS == 64
     case INDEX_op_setcond_i64:
         tcg_out_r(s, args[0]);
         tcg_out_r(s, args[1]);
-        tcg_out_ri64(s, const_args[2], args[2]);
+        tcg_out_r(s, args[2]);
         tcg_out8(s, args[3]);   /* condition */
         break;
 #endif
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
     case INDEX_op_rotl_i32:     /* Optional (TCG_TARGET_HAS_rot_i32). */
     case INDEX_op_rotr_i32:     /* Optional (TCG_TARGET_HAS_rot_i32). */
         tcg_out_r(s, args[0]);
-        tcg_out_ri32(s, const_args[1], args[1]);
-        tcg_out_ri32(s, const_args[2], args[2]);
+        tcg_out_r(s, args[1]);
+        tcg_out_r(s, args[2]);
         break;
     case INDEX_op_deposit_i32:  /* Optional (TCG_TARGET_HAS_deposit_i32). */
         tcg_out_r(s, args[0]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
     case INDEX_op_rem_i64:      /* Optional (TCG_TARGET_HAS_div_i64). */
     case INDEX_op_remu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
         tcg_out_r(s, args[0]);
-        tcg_out_ri64(s, const_args[1], args[1]);
-        tcg_out_ri64(s, const_args[2], args[2]);
+        tcg_out_r(s, args[1]);
+        tcg_out_r(s, args[2]);
         break;
     case INDEX_op_deposit_i64:  /* Optional (TCG_TARGET_HAS_deposit_i64). */
         tcg_out_r(s, args[0]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
         break;
     case INDEX_op_brcond_i64:
         tcg_out_r(s, args[0]);
-        tcg_out_ri64(s, const_args[1], args[1]);
+        tcg_out_r(s, args[1]);
         tcg_out8(s, args[2]);           /* condition */
         tci_out_label(s, arg_label(args[3]));
         break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
     case INDEX_op_rem_i32:      /* Optional (TCG_TARGET_HAS_div_i32). */
     case INDEX_op_remu_i32:     /* Optional (TCG_TARGET_HAS_div_i32). */
         tcg_out_r(s, args[0]);
-        tcg_out_ri32(s, const_args[1], args[1]);
-        tcg_out_ri32(s, const_args[2], args[2]);
+        tcg_out_r(s, args[1]);
+        tcg_out_r(s, args[2]);
         break;
 #if TCG_TARGET_REG_BITS == 32
     case INDEX_op_add2_i32:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
     case INDEX_op_brcond2_i32:
         tcg_out_r(s, args[0]);
         tcg_out_r(s, args[1]);
-        tcg_out_ri32(s, const_args[2], args[2]);
-        tcg_out_ri32(s, const_args[3], args[3]);
+        tcg_out_r(s, args[2]);
+        tcg_out_r(s, args[3]);
         tcg_out8(s, args[4]);           /* condition */
         tci_out_label(s, arg_label(args[5]));
         break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
 #endif
     case INDEX_op_brcond_i32:
         tcg_out_r(s, args[0]);
-        tcg_out_ri32(s, const_args[1], args[1]);
+        tcg_out_r(s, args[1]);
         tcg_out8(s, args[2]);           /* condition */
         tci_out_label(s, arg_label(args[3]));
         break;
-- 
2.25.1

From: Eduardo Habkost <ehabkost@redhat.com>

The TCG-specific CPU methods will be moved to a separate struct,
to make it easier to move accel-specific code outside generic CPU
code in the future.  Start by moving tcg_initialize().

The new CPUClass.tcg_opts field may eventually become a pointer,
but keep it an embedded struct for now, to make code conversion
easier.

From: Claudio Fontana <cfontana@suse.de>

for now only TCG is allowed as an accelerator for riscv,
so remove the CONFIG_TCG use.

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20210204163931.7358-3-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/riscv/cpu.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
 #endif
     cc->gdb_arch_name = riscv_gdb_arch_name;
     cc->gdb_get_dynamic_xml = riscv_gdb_get_dynamic_xml;
-#ifdef CONFIG_TCG
     cc->tcg_ops.initialize = riscv_translate_init;
     cc->tlb_fill = riscv_cpu_tlb_fill;
-#endif
+
     device_class_set_props(dc, riscv_cpu_properties);
 }
 
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

move away TCG-only code, make it compile only on TCG.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
[claudio: moved the prototypes from hw/core/cpu.h to exec/cpu-all.h]
Signed-off-by: Claudio Fontana <cfontana@suse.de>
Message-Id: <20210204163931.7358-4-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-all.h | 11 +++++--
 include/hw/core/cpu.h  |  2 ++
 accel/tcg/cpu-exec.c   | 28 +++++++++++++++++
 cpu.c                  | 70 ++++++++++++++++++++----------------------
 hw/core/cpu.c          |  6 +++-
 5 files changed, 77 insertions(+), 40 deletions(-)

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -XXX,XX +XXX,XX @@ static inline bool tlb_hit(target_ulong tlb_addr, target_ulong addr)
 }
 
 #ifdef CONFIG_TCG
+/* accel/tcg/cpu-exec.c */
 void dump_drift_info(void);
+/* accel/tcg/translate-all.c */
 void dump_exec_info(void);
 void dump_opcount_info(void);
 #endif /* CONFIG_TCG */
 
 #endif /* !CONFIG_USER_ONLY */
 
+#ifdef CONFIG_TCG
+/* accel/tcg/cpu-exec.c */
+int cpu_exec(CPUState *cpu);
+void tcg_exec_realizefn(CPUState *cpu, Error **errp);
+void tcg_exec_unrealizefn(CPUState *cpu);
+#endif /* CONFIG_TCG */
+
 /* Returns: 0 on success, -1 on error */
 int cpu_memory_rw_debug(CPUState *cpu, target_ulong addr,
                         void *ptr, target_ulong len, bool is_write);
 
-int cpu_exec(CPUState *cpu);
-
 /**
  * cpu_set_cpustate_pointers(cpu)
  * @cpu: The cpu object
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ AddressSpace *cpu_get_address_space(CPUState *cpu, int asidx);
 
 void QEMU_NORETURN cpu_abort(CPUState *cpu, const char *fmt, ...)
     GCC_FMT_ATTR(2, 3);
+
+/* $(top_srcdir)/cpu.c */
 void cpu_exec_initfn(CPUState *cpu);
 void cpu_exec_realizefn(CPUState *cpu, Error **errp);
 void cpu_exec_unrealizefn(CPUState *cpu);
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
     return ret;
 }
 
+void tcg_exec_realizefn(CPUState *cpu, Error **errp)
+{
+    static bool tcg_target_initialized;
+    CPUClass *cc = CPU_GET_CLASS(cpu);
+
+    if (!tcg_target_initialized) {
+        cc->tcg_ops.initialize();
+        tcg_target_initialized = true;
+    }
+    tlb_init(cpu);
+    qemu_plugin_vcpu_init_hook(cpu);
+
+#ifndef CONFIG_USER_ONLY
+    tcg_iommu_init_notifier_list(cpu);
+#endif /* !CONFIG_USER_ONLY */
+}
+
+/* undo the initializations in reverse order */
+void tcg_exec_unrealizefn(CPUState *cpu)
+{
+#ifndef CONFIG_USER_ONLY
+    tcg_iommu_free_notifier_list(cpu);
+#endif /* !CONFIG_USER_ONLY */
+
+    qemu_plugin_vcpu_exit_hook(cpu);
+    tlb_destroy(cpu);
+}
+
 #ifndef CONFIG_USER_ONLY
 
 void dump_drift_info(void)
diff --git a/cpu.c b/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/cpu.c
+++ b/cpu.c
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_cpu_common = {
 };
 #endif
 
-void cpu_exec_unrealizefn(CPUState *cpu)
+void cpu_exec_realizefn(CPUState *cpu, Error **errp)
 {
     CPUClass *cc = CPU_GET_CLASS(cpu);
 
-    tlb_destroy(cpu);
-    cpu_list_remove(cpu);
+    cpu_list_add(cpu);
+
+#ifdef CONFIG_TCG
+    /* NB: errp parameter is unused currently */
+    if (tcg_enabled()) {
+        tcg_exec_realizefn(cpu, errp);
+    }
+#endif /* CONFIG_TCG */
+
+#ifdef CONFIG_USER_ONLY
+    assert(cc->vmsd == NULL);
+#else
+    if (qdev_get_vmsd(DEVICE(cpu)) == NULL) {
+        vmstate_register(NULL, cpu->cpu_index, &vmstate_cpu_common, cpu);
+    }
+    if (cc->vmsd != NULL) {
+        vmstate_register(NULL, cpu->cpu_index, cc->vmsd, cpu);
+    }
+#endif /* CONFIG_USER_ONLY */
+}
+
+void cpu_exec_unrealizefn(CPUState *cpu)
+{
+    CPUClass *cc = CPU_GET_CLASS(cpu);
 
 #ifdef CONFIG_USER_ONLY
     assert(cc->vmsd == NULL);
@@ -XXX,XX +XXX,XX @@ void cpu_exec_unrealizefn(CPUState *cpu)
     if (qdev_get_vmsd(DEVICE(cpu)) == NULL) {
         vmstate_unregister(NULL, &vmstate_cpu_common, cpu);
     }
-    tcg_iommu_free_notifier_list(cpu);
 #endif
+#ifdef CONFIG_TCG
+    /* NB: errp parameter is unused currently */
+    if (tcg_enabled()) {
+        tcg_exec_unrealizefn(cpu);
+    }
+#endif /* CONFIG_TCG */
+
+    cpu_list_remove(cpu);
 }
 
 void cpu_exec_initfn(CPUState *cpu)
@@ -XXX,XX +XXX,XX @@ void cpu_exec_initfn(CPUState *cpu)
 #endif
 }
 
-void cpu_exec_realizefn(CPUState *cpu, Error **errp)
-{
-    CPUClass *cc = CPU_GET_CLASS(cpu);
-#ifdef CONFIG_TCG
-    static bool tcg_target_initialized;
-#endif /* CONFIG_TCG */
-
-    cpu_list_add(cpu);
-
-#ifdef CONFIG_TCG
-    if (tcg_enabled() && !tcg_target_initialized) {
-        tcg_target_initialized = true;
-        cc->tcg_ops.initialize();
-    }
-#endif /* CONFIG_TCG */
-    tlb_init(cpu);
-
-    qemu_plugin_vcpu_init_hook(cpu);
-
-#ifdef CONFIG_USER_ONLY
-    assert(cc->vmsd == NULL);
-#else /* !CONFIG_USER_ONLY */
-    if (qdev_get_vmsd(DEVICE(cpu)) == NULL) {
-        vmstate_register(NULL, cpu->cpu_index, &vmstate_cpu_common, cpu);
-    }
-    if (cc->vmsd != NULL) {
-        vmstate_register(NULL, cpu->cpu_index, cc->vmsd, cpu);
-    }
-
-    tcg_iommu_init_notifier_list(cpu);
-#endif
-}
-
 const char *parse_cpu_option(const char *cpu_option)
 {
     ObjectClass *oc;
diff --git a/hw/core/cpu.c b/hw/core/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/cpu.c
+++ b/hw/core/cpu.c
@@ -XXX,XX +XXX,XX @@ static bool cpu_common_virtio_is_big_endian(CPUState *cpu)
     return target_words_bigendian();
 }
 
+/*
+ * XXX the following #if is always true because this is a common_ss
+ * module, so target CONFIG_* is never defined.
+ */
 #if !defined(CONFIG_USER_ONLY)
 GuestPanicInformation *cpu_get_crash_info(CPUState *cpu)
 {
@@ -XXX,XX +XXX,XX @@ static void cpu_common_realizefn(DeviceState *dev, Error **errp)
 static void cpu_common_unrealizefn(DeviceState *dev)
 {
     CPUState *cpu = CPU(dev);
+
     /* NOTE: latest generic point before the cpu is fully unrealized */
     trace_fini_vcpu(cpu);
-    qemu_plugin_vcpu_exit_hook(cpu);
     cpu_exec_unrealizefn(cpu);
 }
 
-- 
2.25.1

From: Eduardo Habkost <ehabkost@redhat.com>

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
[claudio: wrapped target code in CONFIG_TCG, reworded comments]
Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20210204163931.7358-5-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h     | 22 +++++++++++++---------
 accel/tcg/cpu-exec.c      |  4 ++--
 target/arm/cpu.c          |  4 +++-
 target/avr/cpu.c          |  2 +-
 target/hppa/cpu.c         |  2 +-
 target/i386/tcg/tcg-cpu.c |  2 +-
 target/microblaze/cpu.c   |  2 +-
 target/mips/cpu.c         |  4 +++-
 target/riscv/cpu.c        |  2 +-
 target/rx/cpu.c           |  2 +-
 target/sh4/cpu.c          |  2 +-
 target/sparc/cpu.c        |  2 +-
 target/tricore/cpu.c      |  2 +-
 13 files changed, 30 insertions(+), 22 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
      * Called when the first CPU is realized.
      */
     void (*initialize)(void);
+    /**
+     * @synchronize_from_tb: Synchronize state from a TCG #TranslationBlock
+     *
+     * This is called when we abandon execution of a TB before starting it,
+     * and must set all parts of the CPU state which the previous TB in the
+     * chain may not have updated.
+     * By default, when this is NULL, a call is made to @set_pc(tb->pc).
+     *
+     * If more state needs to be restored, the target must implement a
+     * function to restore all the state, and register it here.
+     */
+    void (*synchronize_from_tb)(CPUState *cpu,
+                                const struct TranslationBlock *tb);
 
 } TcgCpuOperations;
 
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
  *       If the target behaviour here is anything other than "set
  *       the PC register to the value passed in" then the target must
  *       also implement the synchronize_from_tb hook.
- * @synchronize_from_tb: Callback for synchronizing state from a TCG
- *       #TranslationBlock. This is called when we abandon execution
- *       of a TB before starting it, and must set all parts of the CPU
- *       state which the previous TB in the chain may not have updated.
- *       This always includes at least the program counter; some targets
- *       will need to do more. If this hook is not implemented then the
- *       default is to call @set_pc(tb->pc).
  * @tlb_fill: Callback for handling a softmmu tlb miss or user-only
  *       address fault.  For system mode, if the access is valid, call
  *       tlb_set_page and return true; if the access is invalid, and
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     void (*get_memory_mapping)(CPUState *cpu, MemoryMappingList *list,
                                Error **errp);
     void (*set_pc)(CPUState *cpu, vaddr value);
-    void (*synchronize_from_tb)(CPUState *cpu,
-                                const struct TranslationBlock *tb);
     bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
                      MMUAccessType access_type, int mmu_idx,
                      bool probe, uintptr_t retaddr);
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
                                TARGET_FMT_lx "] %s\n",
                                last_tb->tc.ptr, last_tb->pc,
                                lookup_symbol(last_tb->pc));
-        if (cc->synchronize_from_tb) {
-            cc->synchronize_from_tb(cpu, last_tb);
+        if (cc->tcg_ops.synchronize_from_tb) {
+            cc->tcg_ops.synchronize_from_tb(cpu, last_tb);
         } else {
             assert(cc->set_pc);
             cc->set_pc(cpu, last_tb->pc);
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_set_pc(CPUState *cs, vaddr value)
     }
 }
 
+#ifdef CONFIG_TCG
 static void arm_cpu_synchronize_from_tb(CPUState *cs,
                                         const TranslationBlock *tb)
 {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_synchronize_from_tb(CPUState *cs,
         env->regs[15] = tb->pc;
     }
 }
+#endif /* CONFIG_TCG */
 
 static bool arm_cpu_has_work(CPUState *cs)
 {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->cpu_exec_interrupt = arm_cpu_exec_interrupt;
     cc->dump_state = arm_cpu_dump_state;
     cc->set_pc = arm_cpu_set_pc;
-    cc->synchronize_from_tb = arm_cpu_synchronize_from_tb;
     cc->gdb_read_register = arm_cpu_gdb_read_register;
     cc->gdb_write_register = arm_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->disas_set_info = arm_disas_set_info;
 #ifdef CONFIG_TCG
     cc->tcg_ops.initialize = arm_translate_init;
+    cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
     cc->tlb_fill = arm_cpu_tlb_fill;
     cc->debug_excp_handler = arm_debug_excp_handler;
     cc->debug_check_watchpoint = arm_debug_check_watchpoint;
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
     cc->vmsd = &vms_avr_cpu;
     cc->disas_set_info = avr_cpu_disas_set_info;
     cc->tcg_ops.initialize = avr_cpu_tcg_init;
-    cc->synchronize_from_tb = avr_cpu_synchronize_from_tb;
+    cc->tcg_ops.synchronize_from_tb = avr_cpu_synchronize_from_tb;
     cc->gdb_read_register = avr_cpu_gdb_read_register;
     cc->gdb_write_register = avr_cpu_gdb_write_register;
     cc->gdb_num_core_regs = 35;
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
     cc->cpu_exec_interrupt = hppa_cpu_exec_interrupt;
     cc->dump_state = hppa_cpu_dump_state;
     cc->set_pc = hppa_cpu_set_pc;
-    cc->synchronize_from_tb = hppa_cpu_synchronize_from_tb;
+    cc->tcg_ops.synchronize_from_tb = hppa_cpu_synchronize_from_tb;
     cc->gdb_read_register = hppa_cpu_gdb_read_register;
     cc->gdb_write_register = hppa_cpu_gdb_write_register;
     cc->tlb_fill = hppa_cpu_tlb_fill;
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void tcg_cpu_common_class_init(CPUClass *cc)
 {
     cc->do_interrupt = x86_cpu_do_interrupt;
     cc->cpu_exec_interrupt = x86_cpu_exec_interrupt;
-    cc->synchronize_from_tb = x86_cpu_synchronize_from_tb;
+    cc->tcg_ops.synchronize_from_tb = x86_cpu_synchronize_from_tb;
     cc->cpu_exec_enter = x86_cpu_exec_enter;
     cc->cpu_exec_exit = x86_cpu_exec_exit;
     cc->tcg_ops.initialize = tcg_x86_init;
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     cc->cpu_exec_interrupt = mb_cpu_exec_interrupt;
     cc->dump_state = mb_cpu_dump_state;
     cc->set_pc = mb_cpu_set_pc;
-    cc->synchronize_from_tb = mb_cpu_synchronize_from_tb;
+    cc->tcg_ops.synchronize_from_tb = mb_cpu_synchronize_from_tb;
     cc->gdb_read_register = mb_cpu_gdb_read_register;
     cc->gdb_write_register = mb_cpu_gdb_write_register;
     cc->tlb_fill = mb_cpu_tlb_fill;
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_set_pc(CPUState *cs, vaddr value)
     }
 }
 
+#ifdef CONFIG_TCG
 static void mips_cpu_synchronize_from_tb(CPUState *cs,
                                          const TranslationBlock *tb)
 {
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_synchronize_from_tb(CPUState *cs,
     env->hflags &= ~MIPS_HFLAG_BMASK;
     env->hflags |= tb->flags & MIPS_HFLAG_BMASK;
 }
+#endif /* CONFIG_TCG */
 
 static bool mips_cpu_has_work(CPUState *cs)
 {
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->cpu_exec_interrupt = mips_cpu_exec_interrupt;
     cc->dump_state = mips_cpu_dump_state;
     cc->set_pc = mips_cpu_set_pc;
-    cc->synchronize_from_tb = mips_cpu_synchronize_from_tb;
     cc->gdb_read_register = mips_cpu_gdb_read_register;
     cc->gdb_write_register = mips_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->disas_set_info = mips_cpu_disas_set_info;
 #ifdef CONFIG_TCG
     cc->tcg_ops.initialize = mips_tcg_init;
+    cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
     cc->tlb_fill = mips_cpu_tlb_fill;
 #endif
 
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     cc->cpu_exec_interrupt = riscv_cpu_exec_interrupt;
     cc->dump_state = riscv_cpu_dump_state;
     cc->set_pc = riscv_cpu_set_pc;
-    cc->synchronize_from_tb = riscv_cpu_synchronize_from_tb;
+    cc->tcg_ops.synchronize_from_tb = riscv_cpu_synchronize_from_tb;
     cc->gdb_read_register = riscv_cpu_gdb_read_register;
     cc->gdb_write_register = riscv_cpu_gdb_write_register;
     cc->gdb_num_core_regs = 33;
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
     cc->cpu_exec_interrupt = rx_cpu_exec_interrupt;
     cc->dump_state = rx_cpu_dump_state;
     cc->set_pc = rx_cpu_set_pc;
-    cc->synchronize_from_tb = rx_cpu_synchronize_from_tb;
+    cc->tcg_ops.synchronize_from_tb = rx_cpu_synchronize_from_tb;
     cc->gdb_read_register = rx_cpu_gdb_read_register;
     cc->gdb_write_register = rx_cpu_gdb_write_register;
     cc->get_phys_page_debug = rx_cpu_get_phys_page_debug;
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
     cc->cpu_exec_interrupt = superh_cpu_exec_interrupt;
     cc->dump_state = superh_cpu_dump_state;
     cc->set_pc = superh_cpu_set_pc;
-    cc->synchronize_from_tb = superh_cpu_synchronize_from_tb;
+    cc->tcg_ops.synchronize_from_tb = superh_cpu_synchronize_from_tb;
     cc->gdb_read_register = superh_cpu_gdb_read_register;
     cc->gdb_write_register = superh_cpu_gdb_write_register;
     cc->tlb_fill = superh_cpu_tlb_fill;
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
     cc->memory_rw_debug = sparc_cpu_memory_rw_debug;
 #endif
     cc->set_pc = sparc_cpu_set_pc;
-    cc->synchronize_from_tb = sparc_cpu_synchronize_from_tb;
+    cc->tcg_ops.synchronize_from_tb = sparc_cpu_synchronize_from_tb;
     cc->gdb_read_register = sparc_cpu_gdb_read_register;
     cc->gdb_write_register = sparc_cpu_gdb_write_register;
     cc->tlb_fill = sparc_cpu_tlb_fill;
diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_class_init(ObjectClass *c, void *data)
 
     cc->dump_state = tricore_cpu_dump_state;
     cc->set_pc = tricore_cpu_set_pc;
-    cc->synchronize_from_tb = tricore_cpu_synchronize_from_tb;
+    cc->tcg_ops.synchronize_from_tb = tricore_cpu_synchronize_from_tb;
     cc->get_phys_page_debug = tricore_cpu_get_phys_page_debug;
     cc->tcg_ops.initialize = tricore_tcg_init;
     cc->tlb_fill = tricore_cpu_tlb_fill;
-- 
2.25.1

From: Eduardo Habkost <ehabkost@redhat.com>

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
[claudio: wrapped target code in CONFIG_TCG]
Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210204163931.7358-6-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h           | 12 ++++++------
 accel/tcg/cpu-exec.c            | 12 ++++++------
 target/alpha/cpu.c              |  2 +-
 target/arm/cpu.c                |  2 +-
 target/arm/cpu64.c              |  5 ++++-
 target/arm/cpu_tcg.c            |  7 ++++++-
 target/avr/cpu.c                |  2 +-
 target/cris/cpu.c               |  2 +-
 target/hppa/cpu.c               |  2 +-
 target/i386/tcg/tcg-cpu.c       |  6 +++---
 target/lm32/cpu.c               |  2 +-
 target/m68k/cpu.c               |  2 +-
 target/microblaze/cpu.c         |  2 +-
 target/mips/cpu.c               |  2 +-
 target/nios2/cpu.c              |  2 +-
 target/openrisc/cpu.c           |  2 +-
 target/riscv/cpu.c              |  2 +-
 target/rx/cpu.c                 |  2 +-
 target/s390x/cpu.c              |  2 +-
 target/sh4/cpu.c                |  2 +-
 target/sparc/cpu.c              |  2 +-
 target/tilegx/cpu.c             |  2 +-
 target/unicore32/cpu.c          |  2 +-
 target/xtensa/cpu.c             |  2 +-
 target/ppc/translate_init.c.inc | 16 ++++++++++------
 25 files changed, 54 insertions(+), 42 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
      */
     void (*synchronize_from_tb)(CPUState *cpu,
                                 const struct TranslationBlock *tb);
+    /** @cpu_exec_enter: Callback for cpu_exec preparation */
+    void (*cpu_exec_enter)(CPUState *cpu);
+    /** @cpu_exec_exit: Callback for cpu_exec cleanup */
+    void (*cpu_exec_exit)(CPUState *cpu);
+    /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
+    bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
 
 } TcgCpuOperations;
 
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
  * @gdb_get_dynamic_xml: Callback to return dynamically generated XML for the
  *   gdb stub. Returns a pointer to the XML contents for the specified XML file
  *   or NULL if the CPU doesn't have a dynamically generated content for it.
- * @cpu_exec_enter: Callback for cpu_exec preparation.
- * @cpu_exec_exit: Callback for cpu_exec cleanup.
- * @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec.
  * @disas_set_info: Setup architecture specific components of disassembly info
  * @adjust_watchpoint_address: Perform a target-specific adjustment to an
  * address before attempting to match it against watchpoints.
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     const char *gdb_core_xml_file;
     gchar * (*gdb_arch_name)(CPUState *cpu);
     const char * (*gdb_get_dynamic_xml)(CPUState *cpu, const char *xmlname);
-    void (*cpu_exec_enter)(CPUState *cpu);
-    void (*cpu_exec_exit)(CPUState *cpu);
-    bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
 
     void (*disas_set_info)(CPUState *cpu, disassemble_info *info);
     vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static void cpu_exec_enter(CPUState *cpu)
 {
     CPUClass *cc = CPU_GET_CLASS(cpu);
 
-    if (cc->cpu_exec_enter) {
-        cc->cpu_exec_enter(cpu);
+    if (cc->tcg_ops.cpu_exec_enter) {
+        cc->tcg_ops.cpu_exec_enter(cpu);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void cpu_exec_exit(CPUState *cpu)
 {
     CPUClass *cc = CPU_GET_CLASS(cpu);
 
-    if (cc->cpu_exec_exit) {
-        cc->cpu_exec_exit(cpu);
+    if (cc->tcg_ops.cpu_exec_exit) {
+        cc->tcg_ops.cpu_exec_exit(cpu);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
            True when it is, and we should restart on a new TB,
            and via longjmp via cpu_loop_exit.  */
         else {
-            if (cc->cpu_exec_interrupt &&
-                cc->cpu_exec_interrupt(cpu, interrupt_request)) {
+            if (cc->tcg_ops.cpu_exec_interrupt &&
+                cc->tcg_ops.cpu_exec_interrupt(cpu, interrupt_request)) {
                 if (need_replay_interrupt(interrupt_request)) {
                     replay_interrupt();
                 }
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = alpha_cpu_class_by_name;
     cc->has_work = alpha_cpu_has_work;
     cc->do_interrupt = alpha_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = alpha_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = alpha_cpu_exec_interrupt;
     cc->dump_state = alpha_cpu_dump_state;
     cc->set_pc = alpha_cpu_set_pc;
     cc->gdb_read_register = alpha_cpu_gdb_read_register;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = arm_cpu_class_by_name;
     cc->has_work = arm_cpu_has_work;
-    cc->cpu_exec_interrupt = arm_cpu_exec_interrupt;
     cc->dump_state = arm_cpu_dump_state;
     cc->set_pc = arm_cpu_set_pc;
     cc->gdb_read_register = arm_cpu_gdb_read_register;
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->disas_set_info = arm_disas_set_info;
 #ifdef CONFIG_TCG
     cc->tcg_ops.initialize = arm_translate_init;
+    cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
     cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
     cc->tlb_fill = arm_cpu_tlb_fill;
     cc->debug_excp_handler = arm_debug_excp_handler;
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_cpu_class_init(ObjectClass *oc, void *data)
 {
     CPUClass *cc = CPU_CLASS(oc);
 
-    cc->cpu_exec_interrupt = arm_cpu_exec_interrupt;
+#ifdef CONFIG_TCG
+    cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
+#endif /* CONFIG_TCG */
+
     cc->gdb_read_register = aarch64_cpu_gdb_read_register;
     cc->gdb_write_register = aarch64_cpu_gdb_write_register;
     cc->gdb_num_core_regs = 34;
diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu_tcg.c
+++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@
 /* CPU models. These are not needed for the AArch64 linux-user build. */
 #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
 
+#ifdef CONFIG_TCG
 static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 {
     CPUClass *cc = CPU_GET_CLASS(cs);
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
     }
     return ret;
 }
+#endif /* CONFIG_TCG */
 
 static void arm926_initfn(Object *obj)
 {
@@ -XXX,XX +XXX,XX @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
     cc->do_interrupt = arm_v7m_cpu_do_interrupt;
 #endif
 
-    cc->cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt;
+#ifdef CONFIG_TCG
+    cc->tcg_ops.cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt;
+#endif /* CONFIG_TCG */
+
     cc->gdb_core_xml_file = "arm-m-profile.xml";
 }
 
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->has_work = avr_cpu_has_work;
     cc->do_interrupt = avr_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = avr_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = avr_cpu_exec_interrupt;
     cc->dump_state = avr_cpu_dump_state;
     cc->set_pc = avr_cpu_set_pc;
     cc->memory_rw_debug = avr_cpu_memory_rw_debug;
diff --git a/target/cris/cpu.c b/target/cris/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/cpu.c
+++ b/target/cris/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = cris_cpu_class_by_name;
     cc->has_work = cris_cpu_has_work;
     cc->do_interrupt = cris_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = cris_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = cris_cpu_exec_interrupt;
     cc->dump_state = cris_cpu_dump_state;
     cc->set_pc = cris_cpu_set_pc;
     cc->gdb_read_register = cris_cpu_gdb_read_register;
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = hppa_cpu_class_by_name;
     cc->has_work = hppa_cpu_has_work;
     cc->do_interrupt = hppa_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = hppa_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = hppa_cpu_exec_interrupt;
     cc->dump_state = hppa_cpu_dump_state;
     cc->set_pc = hppa_cpu_set_pc;
     cc->tcg_ops.synchronize_from_tb = hppa_cpu_synchronize_from_tb;
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void x86_cpu_synchronize_from_tb(CPUState *cs,
 void tcg_cpu_common_class_init(CPUClass *cc)
 {
     cc->do_interrupt = x86_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = x86_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = x86_cpu_exec_interrupt;
     cc->tcg_ops.synchronize_from_tb = x86_cpu_synchronize_from_tb;
-    cc->cpu_exec_enter = x86_cpu_exec_enter;
-    cc->cpu_exec_exit = x86_cpu_exec_exit;
+    cc->tcg_ops.cpu_exec_enter = x86_cpu_exec_enter;
+    cc->tcg_ops.cpu_exec_exit = x86_cpu_exec_exit;
     cc->tcg_ops.initialize = tcg_x86_init;
     cc->tlb_fill = x86_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/lm32/cpu.c
+++ b/target/lm32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = lm32_cpu_class_by_name;
     cc->has_work = lm32_cpu_has_work;
     cc->do_interrupt = lm32_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = lm32_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = lm32_cpu_exec_interrupt;
     cc->dump_state = lm32_cpu_dump_state;
     cc->set_pc = lm32_cpu_set_pc;
     cc->gdb_read_register = lm32_cpu_gdb_read_register;
diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
     cc->class_by_name = m68k_cpu_class_by_name;
     cc->has_work = m68k_cpu_has_work;
     cc->do_interrupt = m68k_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = m68k_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = m68k_cpu_exec_interrupt;
     cc->dump_state = m68k_cpu_dump_state;
     cc->set_pc = m68k_cpu_set_pc;
     cc->gdb_read_register = m68k_cpu_gdb_read_register;
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     cc->has_work = mb_cpu_has_work;
     cc->do_interrupt = mb_cpu_do_interrupt;
     cc->do_unaligned_access = mb_cpu_do_unaligned_access;
-    cc->cpu_exec_interrupt = mb_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = mb_cpu_exec_interrupt;
     cc->dump_state = mb_cpu_dump_state;
     cc->set_pc = mb_cpu_set_pc;
     cc->tcg_ops.synchronize_from_tb = mb_cpu_synchronize_from_tb;
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->class_by_name = mips_cpu_class_by_name;
     cc->has_work = mips_cpu_has_work;
     cc->do_interrupt = mips_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = mips_cpu_exec_interrupt;
     cc->dump_state = mips_cpu_dump_state;
     cc->set_pc = mips_cpu_set_pc;
     cc->gdb_read_register = mips_cpu_gdb_read_register;
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->disas_set_info = mips_cpu_disas_set_info;
 #ifdef CONFIG_TCG
     cc->tcg_ops.initialize = mips_tcg_init;
+    cc->tcg_ops.cpu_exec_interrupt = mips_cpu_exec_interrupt;
     cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
     cc->tlb_fill = mips_cpu_tlb_fill;
 #endif
diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/cpu.c
+++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = nios2_cpu_class_by_name;
     cc->has_work = nios2_cpu_has_work;
     cc->do_interrupt = nios2_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = nios2_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = nios2_cpu_exec_interrupt;
     cc->dump_state = nios2_cpu_dump_state;
     cc->set_pc = nios2_cpu_set_pc;
     cc->disas_set_info = nios2_cpu_disas_set_info;
diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = openrisc_cpu_class_by_name;
     cc->has_work = openrisc_cpu_has_work;
     cc->do_interrupt = openrisc_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = openrisc_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = openrisc_cpu_exec_interrupt;
     cc->dump_state = openrisc_cpu_dump_state;
     cc->set_pc = openrisc_cpu_set_pc;
     cc->gdb_read_register = openrisc_cpu_gdb_read_register;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     cc->class_by_name = riscv_cpu_class_by_name;
     cc->has_work = riscv_cpu_has_work;
     cc->do_interrupt = riscv_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = riscv_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = riscv_cpu_exec_interrupt;
     cc->dump_state = riscv_cpu_dump_state;
     cc->set_pc = riscv_cpu_set_pc;
     cc->tcg_ops.synchronize_from_tb = riscv_cpu_synchronize_from_tb;
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
     cc->class_by_name = rx_cpu_class_by_name;
     cc->has_work = rx_cpu_has_work;
     cc->do_interrupt = rx_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = rx_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = rx_cpu_exec_interrupt;
     cc->dump_state = rx_cpu_dump_state;
     cc->set_pc = rx_cpu_set_pc;
     cc->tcg_ops.synchronize_from_tb = rx_cpu_synchronize_from_tb;
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
     cc->get_crash_info = s390_cpu_get_crash_info;
     cc->write_elf64_note = s390_cpu_write_elf64_note;
 #ifdef CONFIG_TCG
-    cc->cpu_exec_interrupt = s390_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = s390_cpu_exec_interrupt;
     cc->debug_excp_handler = s390x_cpu_debug_excp_handler;
     cc->do_unaligned_access = s390x_cpu_do_unaligned_access;
 #endif
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = superh_cpu_class_by_name;
     cc->has_work = superh_cpu_has_work;
     cc->do_interrupt = superh_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = superh_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = superh_cpu_exec_interrupt;
     cc->dump_state = superh_cpu_dump_state;
     cc->set_pc = superh_cpu_set_pc;
     cc->tcg_ops.synchronize_from_tb = superh_cpu_synchronize_from_tb;
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
     cc->parse_features = sparc_cpu_parse_features;
     cc->has_work = sparc_cpu_has_work;
     cc->do_interrupt = sparc_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = sparc_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = sparc_cpu_exec_interrupt;
     cc->dump_state = sparc_cpu_dump_state;
 #if !defined(TARGET_SPARC64) && !defined(CONFIG_USER_ONLY)
     cc->memory_rw_debug = sparc_cpu_memory_rw_debug;
diff --git a/target/tilegx/cpu.c b/target/tilegx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tilegx/cpu.c
+++ b/target/tilegx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = tilegx_cpu_class_by_name;
     cc->has_work = tilegx_cpu_has_work;
     cc->do_interrupt = tilegx_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = tilegx_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = tilegx_cpu_exec_interrupt;
     cc->dump_state = tilegx_cpu_dump_state;
     cc->set_pc = tilegx_cpu_set_pc;
     cc->tlb_fill = tilegx_cpu_tlb_fill;
diff --git a/target/unicore32/cpu.c b/target/unicore32/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/unicore32/cpu.c
+++ b/target/unicore32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = uc32_cpu_class_by_name;
     cc->has_work = uc32_cpu_has_work;
     cc->do_interrupt = uc32_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = uc32_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = uc32_cpu_exec_interrupt;
     cc->dump_state = uc32_cpu_dump_state;
     cc->set_pc = uc32_cpu_set_pc;
     cc->tlb_fill = uc32_cpu_tlb_fill;
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = xtensa_cpu_class_by_name;
     cc->has_work = xtensa_cpu_has_work;
     cc->do_interrupt = xtensa_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = xtensa_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = xtensa_cpu_exec_interrupt;
     cc->dump_state = xtensa_cpu_dump_state;
     cc->set_pc = xtensa_cpu_set_pc;
     cc->gdb_read_register = xtensa_cpu_gdb_read_register;
diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/translate_init.c.inc
+++ b/target/ppc/translate_init.c.inc
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_reset(DeviceState *dev)
 }
 
 #ifndef CONFIG_USER_ONLY
+
 static bool ppc_cpu_is_big_endian(CPUState *cs)
 {
     PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool ppc_cpu_is_big_endian(CPUState *cs)
     return !msr_le;
 }
 
+#ifdef CONFIG_TCG
 static void ppc_cpu_exec_enter(CPUState *cs)
 {
     PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_exec_exit(CPUState *cs)
         vhc->cpu_exec_exit(cpu->vhyp, cpu);
     }
 }
-#endif
+#endif /* CONFIG_TCG */
+
+#endif /* !CONFIG_USER_ONLY */
 
 static void ppc_cpu_instance_init(Object *obj)
 {
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = ppc_cpu_class_by_name;
     cc->has_work = ppc_cpu_has_work;
     cc->do_interrupt = ppc_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = ppc_cpu_exec_interrupt;
     cc->dump_state = ppc_cpu_dump_state;
     cc->dump_statistics = ppc_cpu_dump_statistics;
     cc->set_pc = ppc_cpu_set_pc;
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
 #endif
 #ifdef CONFIG_TCG
     cc->tcg_ops.initialize = ppc_translate_init;
+    cc->tcg_ops.cpu_exec_interrupt = ppc_cpu_exec_interrupt;
     cc->tlb_fill = ppc_cpu_tlb_fill;
-#endif
 #ifndef CONFIG_USER_ONLY
-    cc->cpu_exec_enter = ppc_cpu_exec_enter;
-    cc->cpu_exec_exit = ppc_cpu_exec_exit;
-#endif
+    cc->tcg_ops.cpu_exec_enter = ppc_cpu_exec_enter;
+    cc->tcg_ops.cpu_exec_exit = ppc_cpu_exec_exit;
+#endif /* !CONFIG_USER_ONLY */
+#endif /* CONFIG_TCG */
 
     cc->disas_set_info = ppc_disas_set_info;
 
-- 
2.25.1

From: Eduardo Habkost <ehabkost@redhat.com>

[claudio: wrapped target code in CONFIG_TCG]

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210204163931.7358-7-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h           | 21 ++++++++++++---------
 accel/tcg/cputlb.c              |  7 ++++---
 accel/tcg/user-exec.c           |  6 +++---
 target/alpha/cpu.c              |  2 +-
 target/arm/cpu.c                |  2 +-
 target/avr/cpu.c                |  2 +-
 target/cris/cpu.c               |  2 +-
 target/hppa/cpu.c               |  2 +-
 target/i386/tcg/tcg-cpu.c       |  2 +-
 target/lm32/cpu.c               |  2 +-
 target/m68k/cpu.c               |  2 +-
 target/microblaze/cpu.c         |  2 +-
 target/mips/cpu.c               |  2 +-
 target/moxie/cpu.c              |  2 +-
 target/nios2/cpu.c              |  2 +-
 target/openrisc/cpu.c           |  2 +-
 target/riscv/cpu.c              |  2 +-
 target/rx/cpu.c                 |  2 +-
 target/s390x/cpu.c              |  2 +-
 target/sh4/cpu.c                |  2 +-
 target/sparc/cpu.c              |  2 +-
 target/tilegx/cpu.c             |  2 +-
 target/tricore/cpu.c            |  2 +-
 target/unicore32/cpu.c          |  2 +-
 target/xtensa/cpu.c             |  2 +-
 target/ppc/translate_init.c.inc |  2 +-
 26 files changed, 42 insertions(+), 38 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
     void (*cpu_exec_exit)(CPUState *cpu);
     /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
     bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
+    /**
+     * @tlb_fill: Handle a softmmu tlb miss or user-only address fault
+     *
+     * For system mode, if the access is valid, call tlb_set_page
+     * and return true; if the access is invalid, and probe is
+     * true, return false; otherwise raise an exception and do
+     * not return.  For user-only mode, always raise an exception
+     * and do not return.
+     */
+    bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
+                     MMUAccessType access_type, int mmu_idx,
+                     bool probe, uintptr_t retaddr);
 
 } TcgCpuOperations;
 
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
  *       If the target behaviour here is anything other than "set
  *       the PC register to the value passed in" then the target must
  *       also implement the synchronize_from_tb hook.
- * @tlb_fill: Callback for handling a softmmu tlb miss or user-only
- *       address fault.  For system mode, if the access is valid, call
- *       tlb_set_page and return true; if the access is invalid, and
- *       probe is true, return false; otherwise raise an exception and
- *       do not return.  For user-only mode, always raise an exception
- *       and do not return.
  * @get_phys_page_debug: Callback for obtaining a physical address.
  * @get_phys_page_attrs_debug: Callback for obtaining a physical address and the
  *       associated memory transaction attributes to use for the access.
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     void (*get_memory_mapping)(CPUState *cpu, MemoryMappingList *list,
                                Error **errp);
     void (*set_pc)(CPUState *cpu, vaddr value);
-    bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
-                     MMUAccessType access_type, int mmu_idx,
-                     bool probe, uintptr_t retaddr);
     hwaddr (*get_phys_page_debug)(CPUState *cpu, vaddr addr);
     hwaddr (*get_phys_page_attrs_debug)(CPUState *cpu, vaddr addr,
                                         MemTxAttrs *attrs);
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_fill(CPUState *cpu, target_ulong addr, int size,
      * This is not a probe, so only valid return is success; failure
      * should result in exception + longjmp to the cpu loop.
      */
-    ok = cc->tlb_fill(cpu, addr, size, access_type, mmu_idx, false, retaddr);
+    ok = cc->tcg_ops.tlb_fill(cpu, addr, size,
+                              access_type, mmu_idx, false, retaddr);
     assert(ok);
 }
 
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
             CPUState *cs = env_cpu(env);
             CPUClass *cc = CPU_GET_CLASS(cs);
 
-            if (!cc->tlb_fill(cs, addr, fault_size, access_type,
-                              mmu_idx, nonfault, retaddr)) {
+            if (!cc->tcg_ops.tlb_fill(cs, addr, fault_size, access_type,
+                                      mmu_idx, nonfault, retaddr)) {
                 /* Non-faulting page table read failed.  */
                 *phost = NULL;
                 return TLB_INVALID_MASK;
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ static inline int handle_cpu_signal(uintptr_t pc, siginfo_t *info,
     clear_helper_retaddr();
 
     cc = CPU_GET_CLASS(cpu);
-    cc->tlb_fill(cpu, address, 0, access_type, MMU_USER_IDX, false, pc);
+    cc->tcg_ops.tlb_fill(cpu, address, 0, access_type, MMU_USER_IDX, false, pc);
     g_assert_not_reached();
 }
 
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
         } else {
             CPUState *cpu = env_cpu(env);
             CPUClass *cc = CPU_GET_CLASS(cpu);
-            cc->tlb_fill(cpu, addr, fault_size, access_type,
-                         MMU_USER_IDX, false, ra);
+            cc->tcg_ops.tlb_fill(cpu, addr, fault_size, access_type,
+                                 MMU_USER_IDX, false, ra);
             g_assert_not_reached();
         }
     }
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
     cc->set_pc = alpha_cpu_set_pc;
     cc->gdb_read_register = alpha_cpu_gdb_read_register;
     cc->gdb_write_register = alpha_cpu_gdb_write_register;
-    cc->tlb_fill = alpha_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = alpha_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->do_transaction_failed = alpha_cpu_do_transaction_failed;
     cc->do_unaligned_access = alpha_cpu_do_unaligned_access;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.initialize = arm_translate_init;
     cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
     cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
-    cc->tlb_fill = arm_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = arm_cpu_tlb_fill;
     cc->debug_excp_handler = arm_debug_excp_handler;
     cc->debug_check_watchpoint = arm_debug_check_watchpoint;
     cc->do_unaligned_access = arm_cpu_do_unaligned_access;
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
     cc->set_pc = avr_cpu_set_pc;
     cc->memory_rw_debug = avr_cpu_memory_rw_debug;
     cc->get_phys_page_debug = avr_cpu_get_phys_page_debug;
-    cc->tlb_fill = avr_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = avr_cpu_tlb_fill;
     cc->vmsd = &vms_avr_cpu;
     cc->disas_set_info = avr_cpu_disas_set_info;
     cc->tcg_ops.initialize = avr_cpu_tcg_init;
diff --git a/target/cris/cpu.c b/target/cris/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/cpu.c
+++ b/target/cris/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
     cc->set_pc = cris_cpu_set_pc;
     cc->gdb_read_register = cris_cpu_gdb_read_register;
     cc->gdb_write_register = cris_cpu_gdb_write_register;
-    cc->tlb_fill = cris_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = cris_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = cris_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_cris_cpu;
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.synchronize_from_tb = hppa_cpu_synchronize_from_tb;
     cc->gdb_read_register = hppa_cpu_gdb_read_register;
     cc->gdb_write_register = hppa_cpu_gdb_write_register;
-    cc->tlb_fill = hppa_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = hppa_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = hppa_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_hppa_cpu;
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void tcg_cpu_common_class_init(CPUClass *cc)
     cc->tcg_ops.cpu_exec_enter = x86_cpu_exec_enter;
     cc->tcg_ops.cpu_exec_exit = x86_cpu_exec_exit;
     cc->tcg_ops.initialize = tcg_x86_init;
-    cc->tlb_fill = x86_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = x86_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->debug_excp_handler = breakpoint_handler;
 #endif
diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/lm32/cpu.c
+++ b/target/lm32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
     cc->set_pc = lm32_cpu_set_pc;
     cc->gdb_read_register = lm32_cpu_gdb_read_register;
     cc->gdb_write_register = lm32_cpu_gdb_write_register;
-    cc->tlb_fill = lm32_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = lm32_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = lm32_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_lm32_cpu;
diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
     cc->set_pc = m68k_cpu_set_pc;
     cc->gdb_read_register = m68k_cpu_gdb_read_register;
     cc->gdb_write_register = m68k_cpu_gdb_write_register;
-    cc->tlb_fill = m68k_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = m68k_cpu_tlb_fill;
 #if defined(CONFIG_SOFTMMU)
     cc->do_transaction_failed = m68k_cpu_transaction_failed;
     cc->get_phys_page_debug = m68k_cpu_get_phys_page_debug;
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.synchronize_from_tb = mb_cpu_synchronize_from_tb;
     cc->gdb_read_register = mb_cpu_gdb_read_register;
     cc->gdb_write_register = mb_cpu_gdb_write_register;
-    cc->tlb_fill = mb_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = mb_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->do_transaction_failed = mb_cpu_transaction_failed;
     cc->get_phys_page_attrs_debug = mb_cpu_get_phys_page_attrs_debug;
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->tcg_ops.initialize = mips_tcg_init;
     cc->tcg_ops.cpu_exec_interrupt = mips_cpu_exec_interrupt;
     cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
-    cc->tlb_fill = mips_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = mips_cpu_tlb_fill;
 #endif
 
     cc->gdb_num_core_regs = 73;
diff --git a/target/moxie/cpu.c b/target/moxie/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/moxie/cpu.c
+++ b/target/moxie/cpu.c
@@ -XXX,XX +XXX,XX @@ static void moxie_cpu_class_init(ObjectClass *oc, void *data)
     cc->do_interrupt = moxie_cpu_do_interrupt;
     cc->dump_state = moxie_cpu_dump_state;
     cc->set_pc = moxie_cpu_set_pc;
-    cc->tlb_fill = moxie_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = moxie_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = moxie_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_moxie_cpu;
diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/cpu.c
+++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
     cc->dump_state = nios2_cpu_dump_state;
     cc->set_pc = nios2_cpu_set_pc;
     cc->disas_set_info = nios2_cpu_disas_set_info;
-    cc->tlb_fill = nios2_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = nios2_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->do_unaligned_access = nios2_cpu_do_unaligned_access;
     cc->get_phys_page_debug = nios2_cpu_get_phys_page_debug;
diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
     cc->set_pc = openrisc_cpu_set_pc;
     cc->gdb_read_register = openrisc_cpu_gdb_read_register;
     cc->gdb_write_register = openrisc_cpu_gdb_write_register;
-    cc->tlb_fill = openrisc_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = openrisc_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = openrisc_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_openrisc_cpu;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     cc->gdb_arch_name = riscv_gdb_arch_name;
     cc->gdb_get_dynamic_xml = riscv_gdb_get_dynamic_xml;
     cc->tcg_ops.initialize = riscv_translate_init;
-    cc->tlb_fill = riscv_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = riscv_cpu_tlb_fill;
 
     device_class_set_props(dc, riscv_cpu_properties);
 }
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
     cc->get_phys_page_debug = rx_cpu_get_phys_page_debug;
     cc->disas_set_info = rx_cpu_disas_set_info;
     cc->tcg_ops.initialize = rx_translate_init;
-    cc->tlb_fill = rx_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = rx_cpu_tlb_fill;
 
     cc->gdb_num_core_regs = 26;
     cc->gdb_core_xml_file = "rx-core.xml";
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
     cc->disas_set_info = s390_cpu_disas_set_info;
 #ifdef CONFIG_TCG
     cc->tcg_ops.initialize = s390x_translate_init;
-    cc->tlb_fill = s390_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = s390_cpu_tlb_fill;
 #endif
 
     cc->gdb_num_core_regs = S390_NUM_CORE_REGS;
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.synchronize_from_tb = superh_cpu_synchronize_from_tb;
     cc->gdb_read_register = superh_cpu_gdb_read_register;
     cc->gdb_write_register = superh_cpu_gdb_write_register;
-    cc->tlb_fill = superh_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = superh_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->do_unaligned_access = superh_cpu_do_unaligned_access;
     cc->get_phys_page_debug = superh_cpu_get_phys_page_debug;
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.synchronize_from_tb = sparc_cpu_synchronize_from_tb;
     cc->gdb_read_register = sparc_cpu_gdb_read_register;
     cc->gdb_write_register = sparc_cpu_gdb_write_register;
-    cc->tlb_fill = sparc_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = sparc_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->do_transaction_failed = sparc_cpu_do_transaction_failed;
     cc->do_unaligned_access = sparc_cpu_do_unaligned_access;
diff --git a/target/tilegx/cpu.c b/target/tilegx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tilegx/cpu.c
+++ b/target/tilegx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.cpu_exec_interrupt = tilegx_cpu_exec_interrupt;
     cc->dump_state = tilegx_cpu_dump_state;
     cc->set_pc = tilegx_cpu_set_pc;
-    cc->tlb_fill = tilegx_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = tilegx_cpu_tlb_fill;
     cc->gdb_num_core_regs = 0;
     cc->tcg_ops.initialize = tilegx_tcg_init;
 }
diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_class_init(ObjectClass *c, void *data)
     cc->tcg_ops.synchronize_from_tb = tricore_cpu_synchronize_from_tb;
     cc->get_phys_page_debug = tricore_cpu_get_phys_page_debug;
     cc->tcg_ops.initialize = tricore_tcg_init;
-    cc->tlb_fill = tricore_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = tricore_cpu_tlb_fill;
 }
 
 #define DEFINE_TRICORE_CPU_TYPE(cpu_model, initfn) \
diff --git a/target/unicore32/cpu.c b/target/unicore32/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/unicore32/cpu.c
+++ b/target/unicore32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.cpu_exec_interrupt = uc32_cpu_exec_interrupt;
     cc->dump_state = uc32_cpu_dump_state;
     cc->set_pc = uc32_cpu_set_pc;
-    cc->tlb_fill = uc32_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = uc32_cpu_tlb_fill;
     cc->get_phys_page_debug = uc32_cpu_get_phys_page_debug;
     cc->tcg_ops.initialize = uc32_translate_init;
     dc->vmsd = &vmstate_uc32_cpu;
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_read_register = xtensa_cpu_gdb_read_register;
     cc->gdb_write_register = xtensa_cpu_gdb_write_register;
     cc->gdb_stop_before_watchpoint = true;
-    cc->tlb_fill = xtensa_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = xtensa_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->do_unaligned_access = xtensa_cpu_do_unaligned_access;
     cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/translate_init.c.inc
+++ b/target/ppc/translate_init.c.inc
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
 #ifdef CONFIG_TCG
     cc->tcg_ops.initialize = ppc_translate_init;
     cc->tcg_ops.cpu_exec_interrupt = ppc_cpu_exec_interrupt;
-    cc->tlb_fill = ppc_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = ppc_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->tcg_ops.cpu_exec_enter = ppc_cpu_exec_enter;
     cc->tcg_ops.cpu_exec_exit = ppc_cpu_exec_exit;
-- 
2.25.1

From: Eduardo Habkost <ehabkost@redhat.com>

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210204163931.7358-8-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h     | 4 ++--
 accel/tcg/cpu-exec.c      | 4 ++--
 target/arm/cpu.c          | 2 +-
 target/i386/tcg/tcg-cpu.c | 2 +-
 target/lm32/cpu.c         | 2 +-
 target/s390x/cpu.c        | 2 +-
 target/xtensa/cpu.c       | 2 +-
 7 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
     bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
                      MMUAccessType access_type, int mmu_idx,
                      bool probe, uintptr_t retaddr);
+    /** @debug_excp_handler: Callback for handling debug exceptions */
+    void (*debug_excp_handler)(CPUState *cpu);
 
 } TcgCpuOperations;
 
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
  * @gdb_write_register: Callback for letting GDB write a register.
  * @debug_check_watchpoint: Callback: return true if the architectural
  *       watchpoint whose address has matched should really fire.
- * @debug_excp_handler: Callback for handling debug exceptions.
  * @write_elf64_note: Callback for writing a CPU-specific ELF note to a
  * 64-bit VM coredump.
  * @write_elf32_qemunote: Callback for writing a CPU- and QEMU-specific ELF
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     int (*gdb_read_register)(CPUState *cpu, GByteArray *buf, int reg);
     int (*gdb_write_register)(CPUState *cpu, uint8_t *buf, int reg);
     bool (*debug_check_watchpoint)(CPUState *cpu, CPUWatchpoint *wp);
-    void (*debug_excp_handler)(CPUState *cpu);
 
     int (*write_elf64_note)(WriteCoreDumpFunction f, CPUState *cpu,
                             int cpuid, void *opaque);
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline void cpu_handle_debug_exception(CPUState *cpu)
         }
     }
 
-    if (cc->debug_excp_handler) {
-        cc->debug_excp_handler(cpu);
+    if (cc->tcg_ops.debug_excp_handler) {
+        cc->tcg_ops.debug_excp_handler(cpu);
     }
 }
 
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
     cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
     cc->tcg_ops.tlb_fill = arm_cpu_tlb_fill;
-    cc->debug_excp_handler = arm_debug_excp_handler;
+    cc->tcg_ops.debug_excp_handler = arm_debug_excp_handler;
     cc->debug_check_watchpoint = arm_debug_check_watchpoint;
     cc->do_unaligned_access = arm_cpu_do_unaligned_access;
 #if !defined(CONFIG_USER_ONLY)
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void tcg_cpu_common_class_init(CPUClass *cc)
     cc->tcg_ops.initialize = tcg_x86_init;
     cc->tcg_ops.tlb_fill = x86_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->debug_excp_handler = breakpoint_handler;
+    cc->tcg_ops.debug_excp_handler = breakpoint_handler;
 #endif
 }
diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/lm32/cpu.c
+++ b/target/lm32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
 #endif
     cc->gdb_num_core_regs = 32 + 7;
     cc->gdb_stop_before_watchpoint = true;
-    cc->debug_excp_handler = lm32_debug_excp_handler;
+    cc->tcg_ops.debug_excp_handler = lm32_debug_excp_handler;
     cc->disas_set_info = lm32_cpu_disas_set_info;
     cc->tcg_ops.initialize = lm32_translate_init;
 }
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
     cc->write_elf64_note = s390_cpu_write_elf64_note;
 #ifdef CONFIG_TCG
     cc->tcg_ops.cpu_exec_interrupt = s390_cpu_exec_interrupt;
-    cc->debug_excp_handler = s390x_cpu_debug_excp_handler;
+    cc->tcg_ops.debug_excp_handler = s390x_cpu_debug_excp_handler;
     cc->do_unaligned_access = s390x_cpu_do_unaligned_access;
 #endif
 #endif
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
     cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
     cc->do_transaction_failed = xtensa_cpu_do_transaction_failed;
 #endif
-    cc->debug_excp_handler = xtensa_breakpoint_handler;
+    cc->tcg_ops.debug_excp_handler = xtensa_breakpoint_handler;
     cc->disas_set_info = xtensa_cpu_disas_set_info;
     cc->tcg_ops.initialize = xtensa_translate_init;
     dc->vmsd = &vmstate_xtensa_cpu;
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

cc->do_interrupt is in theory a TCG callback used in accel/tcg only,
to prepare the emulated architecture to take an interrupt as defined
in the hardware specifications,

but in reality the _do_interrupt style of functions in targets are
also occasionally reused by KVM to prepare the architecture state in a
similar way where userspace code has identified that it needs to
deliver an exception to the guest.

In the case of ARM, that includes:

1) the vcpu thread got a SIGBUS indicating a memory error,
   and we need to deliver a Synchronous External Abort to the guest to
   let it know about the error.
2) the kernel told us about a debug exception (breakpoint, watchpoint)
   but it is not for one of QEMU's own gdbstub breakpoints/watchpoints
   so it must be a breakpoint the guest itself has set up, therefore
   we need to deliver it to the guest.

So in order to reuse code, the same arm_do_interrupt function is used.
This is all fine, but we need to avoid calling it using the callback
registered in CPUClass, since that one is now TCG-only.

Fortunately this is easily solved by replacing calls to
CPUClass::do_interrupt() with explicit calls to arm_do_interrupt().

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Cc: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20210204163931.7358-9-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/helper.c | 4 ++++
 target/arm/kvm64.c  | 6 ++----
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void handle_semihosting(CPUState *cs)
  * Do any appropriate logging, handle PSCI calls, and then hand off
  * to the AArch64-entry or AArch32-entry function depending on the
  * target exception level's register width.
+ *
+ * Note: this is used for both TCG (as the do_interrupt tcg op),
+ *       and KVM to re-inject guest debug exceptions, and to
+ *       inject a Synchronous-External-Abort.
  */
 void arm_cpu_do_interrupt(CPUState *cs)
 {
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ static void kvm_inject_arm_sea(CPUState *c)
 {
     ARMCPU *cpu = ARM_CPU(c);
     CPUARMState *env = &cpu->env;
-    CPUClass *cc = CPU_GET_CLASS(c);
     uint32_t esr;
     bool same_el;
 
@@ -XXX,XX +XXX,XX @@ static void kvm_inject_arm_sea(CPUState *c)
 
     env->exception.syndrome = esr;
 
-    cc->do_interrupt(c);
+    arm_cpu_do_interrupt(c);
 }
 
 #define AARCH64_CORE_REG(x)   (KVM_REG_ARM64 | KVM_REG_SIZE_U64 | \
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_handle_debug(CPUState *cs, struct kvm_debug_exit_arch *debug_exit)
 {
     int hsr_ec = syn_get_ec(debug_exit->hsr);
     ARMCPU *cpu = ARM_CPU(cs);
-    CPUClass *cc = CPU_GET_CLASS(cs);
     CPUARMState *env = &cpu->env;
 
     /* Ensure PC is synchronised */
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_handle_debug(CPUState *cs, struct kvm_debug_exit_arch *debug_exit)
     env->exception.vaddress = debug_exit->far;
     env->exception.target_el = 1;
     qemu_mutex_lock_iothread();
-    cc->do_interrupt(cs);
+    arm_cpu_do_interrupt(cs);
     qemu_mutex_unlock_iothread();
 
     return false;
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
     void (*cpu_exec_exit)(CPUState *cpu);
     /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
     bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
+    /** @do_interrupt: Callback for interrupt handling. */
+    void (*do_interrupt)(CPUState *cpu);
     /**
      * @tlb_fill: Handle a softmmu tlb miss or user-only address fault
      *
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
  * @parse_features: Callback to parse command line arguments.
  * @reset_dump_flags: #CPUDumpFlags to use for reset logging.
  * @has_work: Callback for checking if there is work to do.
- * @do_interrupt: Callback for interrupt handling.
  * @do_unaligned_access: Callback for unaligned access handling, if
  * the target defines #TARGET_ALIGNED_ONLY.
  * @do_transaction_failed: Callback for handling failed memory transactions
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
 
     int reset_dump_flags;
     bool (*has_work)(CPUState *cpu);
-    void (*do_interrupt)(CPUState *cpu);
     void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
                                 MMUAccessType access_type,
                                 int mmu_idx, uintptr_t retaddr);
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
            loop */
 #if defined(TARGET_I386)
         CPUClass *cc = CPU_GET_CLASS(cpu);
-        cc->do_interrupt(cpu);
+        cc->tcg_ops.do_interrupt(cpu);
 #endif
         *ret = cpu->exception_index;
         cpu->exception_index = -1;
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
         if (replay_exception()) {
             CPUClass *cc = CPU_GET_CLASS(cpu);
             qemu_mutex_lock_iothread();
-            cc->do_interrupt(cpu);
+            cc->tcg_ops.do_interrupt(cpu);
             qemu_mutex_unlock_iothread();
             cpu->exception_index = -1;
 
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = alpha_cpu_class_by_name;
     cc->has_work = alpha_cpu_has_work;
-    cc->do_interrupt = alpha_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = alpha_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = alpha_cpu_exec_interrupt;
     cc->dump_state = alpha_cpu_dump_state;
     cc->set_pc = alpha_cpu_set_pc;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ bool arm_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
  found:
     cs->exception_index = excp_idx;
     env->exception.target_el = target_el;
-    cc->do_interrupt(cs);
+    cc->tcg_ops.do_interrupt(cs);
     return true;
 }
 
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_read_register = arm_cpu_gdb_read_register;
     cc->gdb_write_register = arm_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
-    cc->do_interrupt = arm_cpu_do_interrupt;
     cc->get_phys_page_attrs_debug = arm_cpu_get_phys_page_attrs_debug;
     cc->asidx_from_attrs = arm_asidx_from_attrs;
     cc->vmsd = &vmstate_arm_cpu;
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
 #if !defined(CONFIG_USER_ONLY)
     cc->do_transaction_failed = arm_cpu_do_transaction_failed;
     cc->adjust_watchpoint_address = arm_adjust_watchpoint_address;
+    cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
 #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 #endif
 }
diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu_tcg.c
+++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
     if (interrupt_request & CPU_INTERRUPT_HARD
         && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
         cs->exception_index = EXCP_IRQ;
-        cc->do_interrupt(cs);
+        cc->tcg_ops.do_interrupt(cs);
         ret = true;
     }
     return ret;
@@ -XXX,XX +XXX,XX @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
     CPUClass *cc = CPU_CLASS(oc);
 
     acc->info = data;
-#ifndef CONFIG_USER_ONLY
-    cc->do_interrupt = arm_v7m_cpu_do_interrupt;
-#endif
-
 #ifdef CONFIG_TCG
     cc->tcg_ops.cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt;
+#ifndef CONFIG_USER_ONLY
+    cc->tcg_ops.do_interrupt = arm_v7m_cpu_do_interrupt;
+#endif
 #endif /* CONFIG_TCG */
 
     cc->gdb_core_xml_file = "arm-m-profile.xml";
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = avr_cpu_class_by_name;
 
     cc->has_work = avr_cpu_has_work;
-    cc->do_interrupt = avr_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = avr_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = avr_cpu_exec_interrupt;
     cc->dump_state = avr_cpu_dump_state;
     cc->set_pc = avr_cpu_set_pc;
diff --git a/target/avr/helper.c b/target/avr/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/helper.c
+++ b/target/avr/helper.c
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
     if (interrupt_request & CPU_INTERRUPT_RESET) {
         if (cpu_interrupts_enabled(env)) {
             cs->exception_index = EXCP_RESET;
-            cc->do_interrupt(cs);
+            cc->tcg_ops.do_interrupt(cs);
 
             cs->interrupt_request &= ~CPU_INTERRUPT_RESET;
 
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
         if (cpu_interrupts_enabled(env) && env->intsrc != 0) {
             int index = ctz32(env->intsrc);
             cs->exception_index = EXCP_INT(index);
-            cc->do_interrupt(cs);
+            cc->tcg_ops.do_interrupt(cs);
 
             env->intsrc &= env->intsrc - 1; /* clear the interrupt */
             cs->interrupt_request &= ~CPU_INTERRUPT_HARD;
diff --git a/target/cris/cpu.c b/target/cris/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/cpu.c
+++ b/target/cris/cpu.c
@@ -XXX,XX +XXX,XX @@ static void crisv8_cpu_class_init(ObjectClass *oc, void *data)
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 8;
-    cc->do_interrupt = crisv10_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
     cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
 }
@@ -XXX,XX +XXX,XX @@ static void crisv9_cpu_class_init(ObjectClass *oc, void *data)
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 9;
-    cc->do_interrupt = crisv10_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
     cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
 }
@@ -XXX,XX +XXX,XX @@ static void crisv10_cpu_class_init(ObjectClass *oc, void *data)
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 10;
-    cc->do_interrupt = crisv10_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
     cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
 }
@@ -XXX,XX +XXX,XX @@ static void crisv11_cpu_class_init(ObjectClass *oc, void *data)
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 11;
-    cc->do_interrupt = crisv10_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
     cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
 }
@@ -XXX,XX +XXX,XX @@ static void crisv17_cpu_class_init(ObjectClass *oc, void *data)
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 17;
-    cc->do_interrupt = crisv10_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
     cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
 }
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = cris_cpu_class_by_name;
     cc->has_work = cris_cpu_has_work;
-    cc->do_interrupt = cris_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = cris_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = cris_cpu_exec_interrupt;
     cc->dump_state = cris_cpu_dump_state;
     cc->set_pc = cris_cpu_set_pc;
diff --git a/target/cris/helper.c b/target/cris/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/helper.c
+++ b/target/cris/helper.c
@@ -XXX,XX +XXX,XX @@ bool cris_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
         && (env->pregs[PR_CCS] & I_FLAG)
         && !env->locked_irq) {
         cs->exception_index = EXCP_IRQ;
-        cc->do_interrupt(cs);
+        cc->tcg_ops.do_interrupt(cs);
         ret = true;
     }
     if (interrupt_request & CPU_INTERRUPT_NMI) {
@@ -XXX,XX +XXX,XX @@ bool cris_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
         }
         if ((env->pregs[PR_CCS] & m_flag_archval)) {
             cs->exception_index = EXCP_NMI;
-            cc->do_interrupt(cs);
+            cc->tcg_ops.do_interrupt(cs);
             ret = true;
         }
     }
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = hppa_cpu_class_by_name;
     cc->has_work = hppa_cpu_has_work;
-    cc->do_interrupt = hppa_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = hppa_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = hppa_cpu_exec_interrupt;
     cc->dump_state = hppa_cpu_dump_state;
     cc->set_pc = hppa_cpu_set_pc;
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void x86_cpu_synchronize_from_tb(CPUState *cs,
 
 void tcg_cpu_common_class_init(CPUClass *cc)
 {
-    cc->do_interrupt = x86_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = x86_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = x86_cpu_exec_interrupt;
     cc->tcg_ops.synchronize_from_tb = x86_cpu_synchronize_from_tb;
     cc->tcg_ops.cpu_exec_enter = x86_cpu_exec_enter;
diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/lm32/cpu.c
+++ b/target/lm32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = lm32_cpu_class_by_name;
     cc->has_work = lm32_cpu_has_work;
-    cc->do_interrupt = lm32_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = lm32_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = lm32_cpu_exec_interrupt;
     cc->dump_state = lm32_cpu_dump_state;
     cc->set_pc = lm32_cpu_set_pc;
diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
 
     cc->class_by_name = m68k_cpu_class_by_name;
     cc->has_work = m68k_cpu_has_work;
-    cc->do_interrupt = m68k_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = m68k_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = m68k_cpu_exec_interrupt;
     cc->dump_state = m68k_cpu_dump_state;
     cc->set_pc = m68k_cpu_set_pc;
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = mb_cpu_class_by_name;
     cc->has_work = mb_cpu_has_work;
-    cc->do_interrupt = mb_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = mb_cpu_do_interrupt;
     cc->do_unaligned_access = mb_cpu_do_unaligned_access;
     cc->tcg_ops.cpu_exec_interrupt = mb_cpu_exec_interrupt;
     cc->dump_state = mb_cpu_dump_state;
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
 
     cc->class_by_name = mips_cpu_class_by_name;
     cc->has_work = mips_cpu_has_work;
-    cc->do_interrupt = mips_cpu_do_interrupt;
     cc->dump_state = mips_cpu_dump_state;
     cc->set_pc = mips_cpu_set_pc;
     cc->gdb_read_register = mips_cpu_gdb_read_register;
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->disas_set_info = mips_cpu_disas_set_info;
 #ifdef CONFIG_TCG
     cc->tcg_ops.initialize = mips_tcg_init;
+    cc->tcg_ops.do_interrupt = mips_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = mips_cpu_exec_interrupt;
     cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
     cc->tcg_ops.tlb_fill = mips_cpu_tlb_fill;
-#endif
+#endif /* CONFIG_TCG */
 
     cc->gdb_num_core_regs = 73;
     cc->gdb_stop_before_watchpoint = true;
diff --git a/target/moxie/cpu.c b/target/moxie/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/moxie/cpu.c
+++ b/target/moxie/cpu.c
@@ -XXX,XX +XXX,XX @@ static void moxie_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = moxie_cpu_class_by_name;
 
     cc->has_work = moxie_cpu_has_work;
-    cc->do_interrupt = moxie_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = moxie_cpu_do_interrupt;
     cc->dump_state = moxie_cpu_dump_state;
     cc->set_pc = moxie_cpu_set_pc;
     cc->tcg_ops.tlb_fill = moxie_cpu_tlb_fill;
diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/cpu.c
+++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = nios2_cpu_class_by_name;
     cc->has_work = nios2_cpu_has_work;
-    cc->do_interrupt = nios2_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = nios2_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = nios2_cpu_exec_interrupt;
     cc->dump_state = nios2_cpu_dump_state;
     cc->set_pc = nios2_cpu_set_pc;
diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = openrisc_cpu_class_by_name;
     cc->has_work = openrisc_cpu_has_work;
-    cc->do_interrupt = openrisc_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = openrisc_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = openrisc_cpu_exec_interrupt;
     cc->dump_state = openrisc_cpu_dump_state;
     cc->set_pc = openrisc_cpu_set_pc;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
 
     cc->class_by_name = riscv_cpu_class_by_name;
     cc->has_work = riscv_cpu_has_work;
-    cc->do_interrupt = riscv_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = riscv_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = riscv_cpu_exec_interrupt;
     cc->dump_state = riscv_cpu_dump_state;
     cc->set_pc = riscv_cpu_set_pc;
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
 
     cc->class_by_name = rx_cpu_class_by_name;
     cc->has_work = rx_cpu_has_work;
-    cc->do_interrupt = rx_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = rx_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = rx_cpu_exec_interrupt;
     cc->dump_state = rx_cpu_dump_state;
     cc->set_pc = rx_cpu_set_pc;
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = s390_cpu_class_by_name,
     cc->has_work = s390_cpu_has_work;
 #ifdef CONFIG_TCG
-    cc->do_interrupt = s390_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = s390_cpu_do_interrupt;
 #endif
     cc->dump_state = s390_cpu_dump_state;
     cc->set_pc = s390_cpu_set_pc;
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = superh_cpu_class_by_name;
     cc->has_work = superh_cpu_has_work;
-    cc->do_interrupt = superh_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = superh_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = superh_cpu_exec_interrupt;
     cc->dump_state = superh_cpu_dump_state;
     cc->set_pc = superh_cpu_set_pc;
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = sparc_cpu_class_by_name;
     cc->parse_features = sparc_cpu_parse_features;
     cc->has_work = sparc_cpu_has_work;
-    cc->do_interrupt = sparc_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = sparc_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = sparc_cpu_exec_interrupt;
     cc->dump_state = sparc_cpu_dump_state;
 #if !defined(TARGET_SPARC64) && !defined(CONFIG_USER_ONLY)
diff --git a/target/tilegx/cpu.c b/target/tilegx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tilegx/cpu.c
+++ b/target/tilegx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = tilegx_cpu_class_by_name;
     cc->has_work = tilegx_cpu_has_work;
-    cc->do_interrupt = tilegx_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = tilegx_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = tilegx_cpu_exec_interrupt;
     cc->dump_state = tilegx_cpu_dump_state;
     cc->set_pc = tilegx_cpu_set_pc;
diff --git a/target/unicore32/cpu.c b/target/unicore32/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/unicore32/cpu.c
+++ b/target/unicore32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = uc32_cpu_class_by_name;
     cc->has_work = uc32_cpu_has_work;
-    cc->do_interrupt = uc32_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = uc32_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = uc32_cpu_exec_interrupt;
     cc->dump_state = uc32_cpu_dump_state;
     cc->set_pc = uc32_cpu_set_pc;
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = xtensa_cpu_class_by_name;
     cc->has_work = xtensa_cpu_has_work;
-    cc->do_interrupt = xtensa_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = xtensa_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = xtensa_cpu_exec_interrupt;
     cc->dump_state = xtensa_cpu_dump_state;
     cc->set_pc = xtensa_cpu_set_pc;
diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/translate_init.c.inc
+++ b/target/ppc/translate_init.c.inc
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = ppc_cpu_class_by_name;
     cc->has_work = ppc_cpu_has_work;
-    cc->do_interrupt = ppc_cpu_do_interrupt;
     cc->dump_state = ppc_cpu_dump_state;
     cc->dump_statistics = ppc_cpu_dump_statistics;
     cc->set_pc = ppc_cpu_set_pc;
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
 #ifdef CONFIG_TCG
     cc->tcg_ops.initialize = ppc_translate_init;
     cc->tcg_ops.cpu_exec_interrupt = ppc_cpu_exec_interrupt;
+    cc->tcg_ops.do_interrupt = ppc_cpu_do_interrupt;
     cc->tcg_ops.tlb_fill = ppc_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->tcg_ops.cpu_exec_enter = ppc_cpu_exec_enter;
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

[claudio: wrap target code around CONFIG_TCG and !CONFIG_USER_ONLY]

avoiding its use in headers used by common_ss code (should be poisoned).

Note: need to be careful with the use of CONFIG_USER_ONLY,
Message-Id: <20210204163931.7358-11-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h     | 28 +++++++++++++---------------
 hw/mips/jazz.c            |  9 +++++++--
 target/alpha/cpu.c        |  2 +-
 target/arm/cpu.c          |  4 ++--
 target/m68k/cpu.c         |  2 +-
 target/microblaze/cpu.c   |  2 +-
 target/mips/cpu.c         |  4 +++-
 target/riscv/cpu.c        |  2 +-
 target/riscv/cpu_helper.c |  2 +-
 target/sparc/cpu.c        |  2 +-
 target/xtensa/cpu.c       |  2 +-
 target/xtensa/helper.c    |  4 ++--
 12 files changed, 34 insertions(+), 29 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
     /** @debug_excp_handler: Callback for handling debug exceptions */
     void (*debug_excp_handler)(CPUState *cpu);
 
+    /**
+     * @do_transaction_failed: Callback for handling failed memory transactions
+     * (ie bus faults or external aborts; not MMU faults)
+     */
+    void (*do_transaction_failed)(CPUState *cpu, hwaddr physaddr, vaddr addr,
+                                  unsigned size, MMUAccessType access_type,
+                                  int mmu_idx, MemTxAttrs attrs,
+                                  MemTxResult response, uintptr_t retaddr);
 } TcgCpuOperations;
 
 /**
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
  * @has_work: Callback for checking if there is work to do.
  * @do_unaligned_access: Callback for unaligned access handling, if
  * the target defines #TARGET_ALIGNED_ONLY.
- * @do_transaction_failed: Callback for handling failed memory transactions
- * (ie bus faults or external aborts; not MMU faults)
  * @virtio_is_big_endian: Callback to return %true if a CPU which supports
  * runtime configurable endianness is currently big-endian. Non-configurable
  * CPUs can use the default implementation of this method. This method should
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
                                 MMUAccessType access_type,
                                 int mmu_idx, uintptr_t retaddr);
-    void (*do_transaction_failed)(CPUState *cpu, hwaddr physaddr, vaddr addr,
-                                  unsigned size, MMUAccessType access_type,
-                                  int mmu_idx, MemTxAttrs attrs,
-                                  MemTxResult response, uintptr_t retaddr);
     bool (*virtio_is_big_endian)(CPUState *cpu);
     int (*memory_rw_debug)(CPUState *cpu, vaddr addr,
                            uint8_t *buf, int len, bool is_write);
@@ -XXX,XX +XXX,XX @@ CPUState *cpu_by_arch_id(int64_t id);
 
 void cpu_interrupt(CPUState *cpu, int mask);
 
-#ifdef NEED_CPU_H
-
-#ifdef CONFIG_SOFTMMU
 static inline void cpu_unaligned_access(CPUState *cpu, vaddr addr,
                                         MMUAccessType access_type,
                                         int mmu_idx, uintptr_t retaddr)
@@ -XXX,XX +XXX,XX @@ static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
 {
     CPUClass *cc = CPU_GET_CLASS(cpu);
 
-    if (!cpu->ignore_memory_transaction_failures && cc->do_transaction_failed) {
-        cc->do_transaction_failed(cpu, physaddr, addr, size, access_type,
-                                  mmu_idx, attrs, response, retaddr);
+    if (!cpu->ignore_memory_transaction_failures &&
+        cc->tcg_ops.do_transaction_failed) {
+        cc->tcg_ops.do_transaction_failed(cpu, physaddr, addr, size,
+                                          access_type, mmu_idx, attrs,
+                                          response, retaddr);
     }
 }
-#endif
-
-#endif /* NEED_CPU_H */
 
 /**
  * cpu_set_pc:
diff --git a/hw/mips/jazz.c b/hw/mips/jazz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/mips/jazz.c
+++ b/hw/mips/jazz.c
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps dma_dummy_ops = {
 #define MAGNUM_BIOS_SIZE_MAX 0x7e000
 #define MAGNUM_BIOS_SIZE                                                       \
         (BIOS_SIZE < MAGNUM_BIOS_SIZE_MAX ? BIOS_SIZE : MAGNUM_BIOS_SIZE_MAX)
+
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
 static void (*real_do_transaction_failed)(CPUState *cpu, hwaddr physaddr,
                                           vaddr addr, unsigned size,
                                           MMUAccessType access_type,
@@ -XXX,XX +XXX,XX @@ static void mips_jazz_do_transaction_failed(CPUState *cs, hwaddr physaddr,
     (*real_do_transaction_failed)(cs, physaddr, addr, size, access_type,
                                   mmu_idx, attrs, response, retaddr);
 }
+#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 
 static void mips_jazz_init(MachineState *machine,
                            enum jazz_model_e jazz_model)
@@ -XXX,XX +XXX,XX @@ static void mips_jazz_init(MachineState *machine,
      * memory region that catches all memory accesses, as we do on Malta.
      */
     cc = CPU_GET_CLASS(cpu);
-    real_do_transaction_failed = cc->do_transaction_failed;
-    cc->do_transaction_failed = mips_jazz_do_transaction_failed;
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
+    real_do_transaction_failed = cc->tcg_ops.do_transaction_failed;
+    cc->tcg_ops.do_transaction_failed = mips_jazz_do_transaction_failed;
+#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 
     /* allocate RAM */
     memory_region_add_subregion(address_space, 0, machine->ram);
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_write_register = alpha_cpu_gdb_write_register;
     cc->tcg_ops.tlb_fill = alpha_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->do_transaction_failed = alpha_cpu_do_transaction_failed;
+    cc->tcg_ops.do_transaction_failed = alpha_cpu_do_transaction_failed;
     cc->do_unaligned_access = alpha_cpu_do_unaligned_access;
     cc->get_phys_page_debug = alpha_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_alpha_cpu;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->debug_check_watchpoint = arm_debug_check_watchpoint;
     cc->do_unaligned_access = arm_cpu_do_unaligned_access;
 #if !defined(CONFIG_USER_ONLY)
-    cc->do_transaction_failed = arm_cpu_do_transaction_failed;
+    cc->tcg_ops.do_transaction_failed = arm_cpu_do_transaction_failed;
     cc->adjust_watchpoint_address = arm_adjust_watchpoint_address;
     cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
 #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
-#endif
+#endif /* CONFIG_TCG */
 }
 
 #ifdef CONFIG_KVM
diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
     cc->gdb_write_register = m68k_cpu_gdb_write_register;
     cc->tcg_ops.tlb_fill = m68k_cpu_tlb_fill;
 #if defined(CONFIG_SOFTMMU)
-    cc->do_transaction_failed = m68k_cpu_transaction_failed;
+    cc->tcg_ops.do_transaction_failed = m68k_cpu_transaction_failed;
     cc->get_phys_page_debug = m68k_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_m68k_cpu;
 #endif
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_write_register = mb_cpu_gdb_write_register;
     cc->tcg_ops.tlb_fill = mb_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->do_transaction_failed = mb_cpu_transaction_failed;
+    cc->tcg_ops.do_transaction_failed = mb_cpu_transaction_failed;
     cc->get_phys_page_attrs_debug = mb_cpu_get_phys_page_attrs_debug;
     dc->vmsd = &vmstate_mb_cpu;
 #endif
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->gdb_read_register = mips_cpu_gdb_read_register;
     cc->gdb_write_register = mips_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
-    cc->do_transaction_failed = mips_cpu_do_transaction_failed;
     cc->do_unaligned_access = mips_cpu_do_unaligned_access;
     cc->get_phys_page_debug = mips_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_mips_cpu;
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->tcg_ops.cpu_exec_interrupt = mips_cpu_exec_interrupt;
     cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
     cc->tcg_ops.tlb_fill = mips_cpu_tlb_fill;
+#ifndef CONFIG_USER_ONLY
+    cc->tcg_ops.do_transaction_failed = mips_cpu_do_transaction_failed;
+#endif /* CONFIG_USER_ONLY */
 #endif /* CONFIG_TCG */
 
     cc->gdb_num_core_regs = 73;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     cc->gdb_stop_before_watchpoint = true;
     cc->disas_set_info = riscv_cpu_disas_set_info;
 #ifndef CONFIG_USER_ONLY
-    cc->do_transaction_failed = riscv_cpu_do_transaction_failed;
+    cc->tcg_ops.do_transaction_failed = riscv_cpu_do_transaction_failed;
     cc->do_unaligned_access = riscv_cpu_do_unaligned_access;
     cc->get_phys_page_debug = riscv_cpu_get_phys_page_debug;
     /* For now, mark unmigratable: */
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
     env->badaddr = addr;
     riscv_raise_exception(env, cs->exception_index, retaddr);
 }
-#endif
+#endif /* !CONFIG_USER_ONLY */
 
 bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                         MMUAccessType access_type, int mmu_idx,
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_write_register = sparc_cpu_gdb_write_register;
     cc->tcg_ops.tlb_fill = sparc_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->do_transaction_failed = sparc_cpu_do_transaction_failed;
+    cc->tcg_ops.do_transaction_failed = sparc_cpu_do_transaction_failed;
     cc->do_unaligned_access = sparc_cpu_do_unaligned_access;
     cc->get_phys_page_debug = sparc_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_sparc_cpu;
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
 #ifndef CONFIG_USER_ONLY
     cc->do_unaligned_access = xtensa_cpu_do_unaligned_access;
     cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
-    cc->do_transaction_failed = xtensa_cpu_do_transaction_failed;
+    cc->tcg_ops.do_transaction_failed = xtensa_cpu_do_transaction_failed;
 #endif
     cc->tcg_ops.debug_excp_handler = xtensa_breakpoint_handler;
     cc->disas_set_info = xtensa_cpu_disas_set_info;
diff --git a/target/xtensa/helper.c b/target/xtensa/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/helper.c
+++ b/target/xtensa/helper.c
@@ -XXX,XX +XXX,XX @@ bool xtensa_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
     cpu_loop_exit_restore(cs, retaddr);
 }
 
-#else
+#else /* !CONFIG_USER_ONLY */
 
 void xtensa_cpu_do_unaligned_access(CPUState *cs,
                                     vaddr addr, MMUAccessType access_type,
@@ -XXX,XX +XXX,XX @@ void xtensa_runstall(CPUXtensaState *env, bool runstall)
         qemu_cpu_kick(cpu);
     }
 }
-#endif
+#endif /* !CONFIG_USER_ONLY */
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

make it consistently SOFTMMU-only.

[claudio: make the field presence in cpu.h unconditional, removing the ifdefs]
Message-Id: <20210204163931.7358-12-cfontana@suse.de>

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
                                   unsigned size, MMUAccessType access_type,
                                   int mmu_idx, MemTxAttrs attrs,
                                   MemTxResult response, uintptr_t retaddr);
+    /**
+     * @do_unaligned_access: Callback for unaligned access handling
+     */
+    void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
+                                MMUAccessType access_type,
+                                int mmu_idx, uintptr_t retaddr);
 } TcgCpuOperations;
 
 /**
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
  * @parse_features: Callback to parse command line arguments.
  * @reset_dump_flags: #CPUDumpFlags to use for reset logging.
  * @has_work: Callback for checking if there is work to do.
- * @do_unaligned_access: Callback for unaligned access handling, if
- * the target defines #TARGET_ALIGNED_ONLY.
  * @virtio_is_big_endian: Callback to return %true if a CPU which supports
  * runtime configurable endianness is currently big-endian. Non-configurable
  * CPUs can use the default implementation of this method. This method should
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
 
     int reset_dump_flags;
     bool (*has_work)(CPUState *cpu);
-    void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
-                                MMUAccessType access_type,
-                                int mmu_idx, uintptr_t retaddr);
     bool (*virtio_is_big_endian)(CPUState *cpu);
     int (*memory_rw_debug)(CPUState *cpu, vaddr addr,
                            uint8_t *buf, int len, bool is_write);
@@ -XXX,XX +XXX,XX @@ static inline void cpu_unaligned_access(CPUState *cpu, vaddr addr,
 {
     CPUClass *cc = CPU_GET_CLASS(cpu);
 
-    cc->do_unaligned_access(cpu, addr, access_type, mmu_idx, retaddr);
+    cc->tcg_ops.do_unaligned_access(cpu, addr, access_type, mmu_idx, retaddr);
 }
 
 static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.tlb_fill = alpha_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->tcg_ops.do_transaction_failed = alpha_cpu_do_transaction_failed;
-    cc->do_unaligned_access = alpha_cpu_do_unaligned_access;
+    cc->tcg_ops.do_unaligned_access = alpha_cpu_do_unaligned_access;
     cc->get_phys_page_debug = alpha_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_alpha_cpu;
 #endif
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.tlb_fill = arm_cpu_tlb_fill;
     cc->tcg_ops.debug_excp_handler = arm_debug_excp_handler;
     cc->debug_check_watchpoint = arm_debug_check_watchpoint;
-    cc->do_unaligned_access = arm_cpu_do_unaligned_access;
 #if !defined(CONFIG_USER_ONLY)
     cc->tcg_ops.do_transaction_failed = arm_cpu_do_transaction_failed;
+    cc->tcg_ops.do_unaligned_access = arm_cpu_do_unaligned_access;
     cc->adjust_watchpoint_address = arm_adjust_watchpoint_address;
     cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
 #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_disas_set_info(CPUState *cs, disassemble_info *info)
     info->print_insn = print_insn_hppa;
 }
 
+#ifndef CONFIG_USER_ONLY
 static void hppa_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
                                          MMUAccessType access_type,
                                          int mmu_idx, uintptr_t retaddr)
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
 
     cpu_loop_exit_restore(cs, retaddr);
 }
+#endif /* CONFIG_USER_ONLY */
 
 static void hppa_cpu_realizefn(DeviceState *dev, Error **errp)
 {
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.tlb_fill = hppa_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = hppa_cpu_get_phys_page_debug;
+    cc->tcg_ops.do_unaligned_access = hppa_cpu_do_unaligned_access;
     dc->vmsd = &vmstate_hppa_cpu;
 #endif
-    cc->do_unaligned_access = hppa_cpu_do_unaligned_access;
     cc->disas_set_info = hppa_cpu_disas_set_info;
     cc->tcg_ops.initialize = hppa_translate_init;
 
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = mb_cpu_class_by_name;
     cc->has_work = mb_cpu_has_work;
     cc->tcg_ops.do_interrupt = mb_cpu_do_interrupt;
-    cc->do_unaligned_access = mb_cpu_do_unaligned_access;
     cc->tcg_ops.cpu_exec_interrupt = mb_cpu_exec_interrupt;
     cc->dump_state = mb_cpu_dump_state;
     cc->set_pc = mb_cpu_set_pc;
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.tlb_fill = mb_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->tcg_ops.do_transaction_failed = mb_cpu_transaction_failed;
+    cc->tcg_ops.do_unaligned_access = mb_cpu_do_unaligned_access;
     cc->get_phys_page_attrs_debug = mb_cpu_get_phys_page_attrs_debug;
     dc->vmsd = &vmstate_mb_cpu;
 #endif
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->gdb_read_register = mips_cpu_gdb_read_register;
     cc->gdb_write_register = mips_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
-    cc->do_unaligned_access = mips_cpu_do_unaligned_access;
     cc->get_phys_page_debug = mips_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_mips_cpu;
 #endif
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->tcg_ops.tlb_fill = mips_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->tcg_ops.do_transaction_failed = mips_cpu_do_transaction_failed;
+    cc->tcg_ops.do_unaligned_access = mips_cpu_do_unaligned_access;
+
 #endif /* CONFIG_USER_ONLY */
 #endif /* CONFIG_TCG */
 
diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/cpu.c
+++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
     cc->disas_set_info = nios2_cpu_disas_set_info;
     cc->tcg_ops.tlb_fill = nios2_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->do_unaligned_access = nios2_cpu_do_unaligned_access;
+    cc->tcg_ops.do_unaligned_access = nios2_cpu_do_unaligned_access;
     cc->get_phys_page_debug = nios2_cpu_get_phys_page_debug;
 #endif
     cc->gdb_read_register = nios2_cpu_gdb_read_register;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     cc->disas_set_info = riscv_cpu_disas_set_info;
 #ifndef CONFIG_USER_ONLY
     cc->tcg_ops.do_transaction_failed = riscv_cpu_do_transaction_failed;
-    cc->do_unaligned_access = riscv_cpu_do_unaligned_access;
+    cc->tcg_ops.do_unaligned_access = riscv_cpu_do_unaligned_access;
     cc->get_phys_page_debug = riscv_cpu_get_phys_page_debug;
     /* For now, mark unmigratable: */
     cc->vmsd = &vmstate_riscv_cpu;
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
 #ifdef CONFIG_TCG
     cc->tcg_ops.cpu_exec_interrupt = s390_cpu_exec_interrupt;
     cc->tcg_ops.debug_excp_handler = s390x_cpu_debug_excp_handler;
-    cc->do_unaligned_access = s390x_cpu_do_unaligned_access;
+    cc->tcg_ops.do_unaligned_access = s390x_cpu_do_unaligned_access;
 #endif
 #endif
     cc->disas_set_info = s390_cpu_disas_set_info;
diff --git a/target/s390x/excp_helper.c b/target/s390x/excp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/excp_helper.c
+++ b/target/s390x/excp_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(monitor_call)(CPUS390XState *env, uint64_t monitor_code,
     }
 }
 
-#endif /* CONFIG_USER_ONLY */
+#endif /* !CONFIG_USER_ONLY */
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_write_register = superh_cpu_gdb_write_register;
     cc->tcg_ops.tlb_fill = superh_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->do_unaligned_access = superh_cpu_do_unaligned_access;
+    cc->tcg_ops.do_unaligned_access = superh_cpu_do_unaligned_access;
     cc->get_phys_page_debug = superh_cpu_get_phys_page_debug;
 #endif
     cc->disas_set_info = superh_cpu_disas_set_info;
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.tlb_fill = sparc_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->tcg_ops.do_transaction_failed = sparc_cpu_do_transaction_failed;
-    cc->do_unaligned_access = sparc_cpu_do_unaligned_access;
+    cc->tcg_ops.do_unaligned_access = sparc_cpu_do_unaligned_access;
     cc->get_phys_page_debug = sparc_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_sparc_cpu;
 #endif
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_stop_before_watchpoint = true;
     cc->tcg_ops.tlb_fill = xtensa_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->do_unaligned_access = xtensa_cpu_do_unaligned_access;
+    cc->tcg_ops.do_unaligned_access = xtensa_cpu_do_unaligned_access;
     cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
     cc->tcg_ops.do_transaction_failed = xtensa_cpu_do_transaction_failed;
 #endif
diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/translate_init.c.inc
+++ b/target/ppc/translate_init.c.inc
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
     cc->set_pc = ppc_cpu_set_pc;
     cc->gdb_read_register = ppc_cpu_gdb_read_register;
     cc->gdb_write_register = ppc_cpu_gdb_write_register;
-    cc->do_unaligned_access = ppc_cpu_do_unaligned_access;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = ppc_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_ppc_cpu;
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
 #ifndef CONFIG_USER_ONLY
     cc->tcg_ops.cpu_exec_enter = ppc_cpu_exec_enter;
     cc->tcg_ops.cpu_exec_exit = ppc_cpu_exec_exit;
+    cc->tcg_ops.do_unaligned_access = ppc_cpu_do_unaligned_access;
 #endif /* !CONFIG_USER_ONLY */
 #endif /* CONFIG_TCG */
 
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

cpu_check_watchpoint, watchpoint_address_matches are TCG-only.

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20210204163931.7358-13-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 softmmu/physmem.c | 141 +++++++++++++++++++++++-----------------------
 1 file changed, 72 insertions(+), 69 deletions(-)

diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -XXX,XX +XXX,XX @@ void cpu_watchpoint_remove_all(CPUState *cpu, int mask)
     }
 }
 
+#ifdef CONFIG_TCG
 /* Return true if this watchpoint address matches the specified
  * access (ie the address range covered by the watchpoint overlaps
  * partially or completely with the address range covered by the
@@ -XXX,XX +XXX,XX @@ int cpu_watchpoint_address_matches(CPUState *cpu, vaddr addr, vaddr len)
     return ret;
 }
 
+/* Generate a debug exception if a watchpoint has been hit.  */
+void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
+                          MemTxAttrs attrs, int flags, uintptr_t ra)
+{
+    CPUClass *cc = CPU_GET_CLASS(cpu);
+    CPUWatchpoint *wp;
+
+    assert(tcg_enabled());
+    if (cpu->watchpoint_hit) {
+        /*
+         * We re-entered the check after replacing the TB.
+         * Now raise the debug interrupt so that it will
+         * trigger after the current instruction.
+         */
+        qemu_mutex_lock_iothread();
+        cpu_interrupt(cpu, CPU_INTERRUPT_DEBUG);
+        qemu_mutex_unlock_iothread();
+        return;
+    }
+
+    addr = cc->adjust_watchpoint_address(cpu, addr, len);
+    QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
+        if (watchpoint_address_matches(wp, addr, len)
+            && (wp->flags & flags)) {
+            if (replay_running_debug()) {
+                /*
+                 * Don't process the watchpoints when we are
+                 * in a reverse debugging operation.
+                 */
+                replay_breakpoint();
+                return;
+            }
+            if (flags == BP_MEM_READ) {
+                wp->flags |= BP_WATCHPOINT_HIT_READ;
+            } else {
+                wp->flags |= BP_WATCHPOINT_HIT_WRITE;
+            }
+            wp->hitaddr = MAX(addr, wp->vaddr);
+            wp->hitattrs = attrs;
+            if (!cpu->watchpoint_hit) {
+                if (wp->flags & BP_CPU &&
+                    !cc->debug_check_watchpoint(cpu, wp)) {
+                    wp->flags &= ~BP_WATCHPOINT_HIT;
+                    continue;
+                }
+                cpu->watchpoint_hit = wp;
+
+                mmap_lock();
+                tb_check_watchpoint(cpu, ra);
+                if (wp->flags & BP_STOP_BEFORE_ACCESS) {
+                    cpu->exception_index = EXCP_DEBUG;
+                    mmap_unlock();
+                    cpu_loop_exit_restore(cpu, ra);
+                } else {
+                    /* Force execution of one insn next time.  */
+                    cpu->cflags_next_tb = 1 | curr_cflags();
+                    mmap_unlock();
+                    if (ra) {
+                        cpu_restore_state(cpu, ra, true);
+                    }
+                    cpu_loop_exit_noexc(cpu);
+                }
+            }
+        } else {
+            wp->flags &= ~BP_WATCHPOINT_HIT;
+        }
+    }
+}
+
+#endif /* CONFIG_TCG */
+
 /* Called from RCU critical section */
 static RAMBlock *qemu_get_ram_block(ram_addr_t addr)
 {
@@ -XXX,XX +XXX,XX @@ ram_addr_t qemu_ram_addr_from_host(void *ptr)
     return block->offset + offset;
 }
 
-/* Generate a debug exception if a watchpoint has been hit.  */
-void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
-                          MemTxAttrs attrs, int flags, uintptr_t ra)
-{
-    CPUClass *cc = CPU_GET_CLASS(cpu);
-    CPUWatchpoint *wp;
-
-    assert(tcg_enabled());
-    if (cpu->watchpoint_hit) {
-        /*
-         * We re-entered the check after replacing the TB.
-         * Now raise the debug interrupt so that it will
-         * trigger after the current instruction.
-         */
-        qemu_mutex_lock_iothread();
-        cpu_interrupt(cpu, CPU_INTERRUPT_DEBUG);
-        qemu_mutex_unlock_iothread();
-        return;
-    }
-
-    addr = cc->adjust_watchpoint_address(cpu, addr, len);
-    QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
-        if (watchpoint_address_matches(wp, addr, len)
-            && (wp->flags & flags)) {
-            if (replay_running_debug()) {
-                /*
-                 * Don't process the watchpoints when we are
-                 * in a reverse debugging operation.
-                 */
-                replay_breakpoint();
-                return;
-            }
-            if (flags == BP_MEM_READ) {
-                wp->flags |= BP_WATCHPOINT_HIT_READ;
-            } else {
-                wp->flags |= BP_WATCHPOINT_HIT_WRITE;
-            }
-            wp->hitaddr = MAX(addr, wp->vaddr);
-            wp->hitattrs = attrs;
-            if (!cpu->watchpoint_hit) {
-                if (wp->flags & BP_CPU &&
-                    !cc->debug_check_watchpoint(cpu, wp)) {
-                    wp->flags &= ~BP_WATCHPOINT_HIT;
-                    continue;
-                }
-                cpu->watchpoint_hit = wp;
-
-                mmap_lock();
-                tb_check_watchpoint(cpu, ra);
-                if (wp->flags & BP_STOP_BEFORE_ACCESS) {
-                    cpu->exception_index = EXCP_DEBUG;
-                    mmap_unlock();
-                    cpu_loop_exit_restore(cpu, ra);
-                } else {
-                    /* Force execution of one insn next time.  */
-                    cpu->cflags_next_tb = 1 | curr_cflags();
-                    mmap_unlock();
-                    if (ra) {
-                        cpu_restore_state(cpu, ra, true);
-                    }
-                    cpu_loop_exit_noexc(cpu);
-                }
-            }
-        } else {
-            wp->flags &= ~BP_WATCHPOINT_HIT;
-        }
-    }
-}
-
 static MemTxResult flatview_read(FlatView *fv, hwaddr addr,
                                  MemTxAttrs attrs, void *buf, hwaddr len);
 static MemTxResult flatview_write(FlatView *fv, hwaddr addr, MemTxAttrs attrs,
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

commit 40612000599e ("arm: Correctly handle watchpoints for BE32 CPUs")

introduced this ARM-specific, TCG-specific hack to adjust the address,
before checking it with cpu_check_watchpoint.

Make adjust_watchpoint_address optional and move it to tcg_ops.

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20210204163931.7358-14-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h | 6 +++++-
 hw/core/cpu.c         | 6 ------
 softmmu/physmem.c     | 5 ++++-
 target/arm/cpu.c      | 2 +-
 4 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
     void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
                                 MMUAccessType access_type,
                                 int mmu_idx, uintptr_t retaddr);
+    /**
+     * @adjust_watchpoint_address: hack for cpu_check_watchpoint used by ARM
+     */
+    vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
+
 } TcgCpuOperations;
 
 /**
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     const char * (*gdb_get_dynamic_xml)(CPUState *cpu, const char *xmlname);
 
     void (*disas_set_info)(CPUState *cpu, disassemble_info *info);
-    vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
 
     const char *deprecation_note;
     /* Keep non-pointer data at the end to minimize holes.  */
diff --git a/hw/core/cpu.c b/hw/core/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/cpu.c
+++ b/hw/core/cpu.c
@@ -XXX,XX +XXX,XX @@ static int64_t cpu_common_get_arch_id(CPUState *cpu)
     return cpu->cpu_index;
 }
 
-static vaddr cpu_adjust_watchpoint_address(CPUState *cpu, vaddr addr, int len)
-{
-    return addr;
-}
-
 static Property cpu_common_props[] = {
 #ifndef CONFIG_USER_ONLY
     /* Create a memory property for softmmu CPU object,
@@ -XXX,XX +XXX,XX @@ static void cpu_class_init(ObjectClass *klass, void *data)
     k->gdb_write_register = cpu_common_gdb_write_register;
     k->virtio_is_big_endian = cpu_common_virtio_is_big_endian;
     k->debug_check_watchpoint = cpu_common_debug_check_watchpoint;
-    k->adjust_watchpoint_address = cpu_adjust_watchpoint_address;
     set_bit(DEVICE_CATEGORY_CPU, dc->categories);
     dc->realize = cpu_common_realizefn;
     dc->unrealize = cpu_common_unrealizefn;
diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
         return;
     }
 
-    addr = cc->adjust_watchpoint_address(cpu, addr, len);
+    if (cc->tcg_ops.adjust_watchpoint_address) {
+        /* this is currently used only by ARM BE32 */
+        addr = cc->tcg_ops.adjust_watchpoint_address(cpu, addr, len);
+    }
     QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
         if (watchpoint_address_matches(wp, addr, len)
             && (wp->flags & flags)) {
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
 #if !defined(CONFIG_USER_ONLY)
     cc->tcg_ops.do_transaction_failed = arm_cpu_do_transaction_failed;
     cc->tcg_ops.do_unaligned_access = arm_cpu_do_unaligned_access;
-    cc->adjust_watchpoint_address = arm_adjust_watchpoint_address;
+    cc->tcg_ops.adjust_watchpoint_address = arm_adjust_watchpoint_address;
     cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
 #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 #endif /* CONFIG_TCG */
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

commit 568496c0c0f1 ("cpu: Add callback to check architectural") and
commit 3826121d9298 ("target-arm: Implement checking of fired")
introduced an ARM-specific hack for cpu_check_watchpoint.

Make debug_check_watchpoint optional, and move it to tcg_ops.

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20210204163931.7358-15-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h | 9 ++++++---
 accel/tcg/user-exec.c | 3 ++-
 hw/core/cpu.c         | 9 ---------
 softmmu/physmem.c     | 4 ++--
 target/arm/cpu.c      | 4 ++--
 5 files changed, 12 insertions(+), 17 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
      */
     vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
 
+    /**
+     * @debug_check_watchpoint: return true if the architectural
+     * watchpoint whose address has matched should really fire, used by ARM
+     */
+    bool (*debug_check_watchpoint)(CPUState *cpu, CPUWatchpoint *wp);
+
 } TcgCpuOperations;
 
 /**
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
  *       a memory access with the specified memory transaction attributes.
  * @gdb_read_register: Callback for letting GDB read a register.
  * @gdb_write_register: Callback for letting GDB write a register.
- * @debug_check_watchpoint: Callback: return true if the architectural
- *       watchpoint whose address has matched should really fire.
  * @write_elf64_note: Callback for writing a CPU-specific ELF note to a
  * 64-bit VM coredump.
  * @write_elf32_qemunote: Callback for writing a CPU- and QEMU-specific ELF
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     int (*asidx_from_attrs)(CPUState *cpu, MemTxAttrs attrs);
     int (*gdb_read_register)(CPUState *cpu, GByteArray *buf, int reg);
     int (*gdb_write_register)(CPUState *cpu, uint8_t *buf, int reg);
-    bool (*debug_check_watchpoint)(CPUState *cpu, CPUWatchpoint *wp);
 
     int (*write_elf64_note)(WriteCoreDumpFunction f, CPUState *cpu,
                             int cpuid, void *opaque);
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ static inline int handle_cpu_signal(uintptr_t pc, siginfo_t *info,
     clear_helper_retaddr();
 
     cc = CPU_GET_CLASS(cpu);
-    cc->tcg_ops.tlb_fill(cpu, address, 0, access_type, MMU_USER_IDX, false, pc);
+    cc->tcg_ops.tlb_fill(cpu, address, 0, access_type,
+                         MMU_USER_IDX, false, pc);
     g_assert_not_reached();
 }
 
diff --git a/hw/core/cpu.c b/hw/core/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/cpu.c
+++ b/hw/core/cpu.c
@@ -XXX,XX +XXX,XX @@ static int cpu_common_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg)
     return 0;
 }
 
-static bool cpu_common_debug_check_watchpoint(CPUState *cpu, CPUWatchpoint *wp)
-{
-    /* If no extra check is required, QEMU watchpoint match can be considered
-     * as an architectural match.
-     */
-    return true;
-}
-
 static bool cpu_common_virtio_is_big_endian(CPUState *cpu)
 {
     return target_words_bigendian();
@@ -XXX,XX +XXX,XX @@ static void cpu_class_init(ObjectClass *klass, void *data)
     k->gdb_read_register = cpu_common_gdb_read_register;
     k->gdb_write_register = cpu_common_gdb_write_register;
     k->virtio_is_big_endian = cpu_common_virtio_is_big_endian;
-    k->debug_check_watchpoint = cpu_common_debug_check_watchpoint;
     set_bit(DEVICE_CATEGORY_CPU, dc->categories);
     dc->realize = cpu_common_realizefn;
     dc->unrealize = cpu_common_unrealizefn;
diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
             wp->hitaddr = MAX(addr, wp->vaddr);
             wp->hitattrs = attrs;
             if (!cpu->watchpoint_hit) {
-                if (wp->flags & BP_CPU &&
-                    !cc->debug_check_watchpoint(cpu, wp)) {
+                if (wp->flags & BP_CPU && cc->tcg_ops.debug_check_watchpoint &&
+                    !cc->tcg_ops.debug_check_watchpoint(cpu, wp)) {
                     wp->flags &= ~BP_WATCHPOINT_HIT;
                     continue;
                 }
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
     cc->tcg_ops.tlb_fill = arm_cpu_tlb_fill;
     cc->tcg_ops.debug_excp_handler = arm_debug_excp_handler;
-    cc->debug_check_watchpoint = arm_debug_check_watchpoint;
 #if !defined(CONFIG_USER_ONLY)
+    cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
     cc->tcg_ops.do_transaction_failed = arm_cpu_do_transaction_failed;
     cc->tcg_ops.do_unaligned_access = arm_cpu_do_unaligned_access;
     cc->tcg_ops.adjust_watchpoint_address = arm_adjust_watchpoint_address;
-    cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
+    cc->tcg_ops.debug_check_watchpoint = arm_debug_check_watchpoint;
 #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 #endif /* CONFIG_TCG */
 }
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

we cannot in principle make the TCG Operations field definitions
conditional on CONFIG_TCG in code that is included by both common_ss
and specific_ss modules.

Therefore, what we can do safely to restrict the TCG fields to TCG-only
builds, is to move all tcg cpu operations into a separate header file,
which is only included by TCG, target-specific code.

This leaves just a NULL pointer in the cpu.h for the non-TCG builds.

This also tidies up the code in all targets a bit, having all TCG cpu
operations neatly contained by a dedicated data struct.

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUWatchpoint CPUWatchpoint;
 
 struct TranslationBlock;
 
-/**
- * struct TcgCpuOperations: TCG operations specific to a CPU class
- */
-typedef struct TcgCpuOperations {
-    /**
-     * @initialize: Initalize TCG state
-     *
-     * Called when the first CPU is realized.
-     */
-    void (*initialize)(void);
-    /**
-     * @synchronize_from_tb: Synchronize state from a TCG #TranslationBlock
-     *
-     * This is called when we abandon execution of a TB before starting it,
-     * and must set all parts of the CPU state which the previous TB in the
-     * chain may not have updated.
-     * By default, when this is NULL, a call is made to @set_pc(tb->pc).
-     *
-     * If more state needs to be restored, the target must implement a
-     * function to restore all the state, and register it here.
-     */
-    void (*synchronize_from_tb)(CPUState *cpu,
-                                const struct TranslationBlock *tb);
-    /** @cpu_exec_enter: Callback for cpu_exec preparation */
-    void (*cpu_exec_enter)(CPUState *cpu);
-    /** @cpu_exec_exit: Callback for cpu_exec cleanup */
-    void (*cpu_exec_exit)(CPUState *cpu);
-    /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
-    bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
-    /** @do_interrupt: Callback for interrupt handling. */
-    void (*do_interrupt)(CPUState *cpu);
-    /**
-     * @tlb_fill: Handle a softmmu tlb miss or user-only address fault
-     *
-     * For system mode, if the access is valid, call tlb_set_page
-     * and return true; if the access is invalid, and probe is
-     * true, return false; otherwise raise an exception and do
-     * not return.  For user-only mode, always raise an exception
-     * and do not return.
-     */
-    bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
-                     MMUAccessType access_type, int mmu_idx,
-                     bool probe, uintptr_t retaddr);
-    /** @debug_excp_handler: Callback for handling debug exceptions */
-    void (*debug_excp_handler)(CPUState *cpu);
-
-    /**
-     * @do_transaction_failed: Callback for handling failed memory transactions
-     * (ie bus faults or external aborts; not MMU faults)
-     */
-    void (*do_transaction_failed)(CPUState *cpu, hwaddr physaddr, vaddr addr,
-                                  unsigned size, MMUAccessType access_type,
-                                  int mmu_idx, MemTxAttrs attrs,
-                                  MemTxResult response, uintptr_t retaddr);
-    /**
-     * @do_unaligned_access: Callback for unaligned access handling
-     */
-    void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
-                                MMUAccessType access_type,
-                                int mmu_idx, uintptr_t retaddr);
-    /**
-     * @adjust_watchpoint_address: hack for cpu_check_watchpoint used by ARM
-     */
-    vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
-
-    /**
-     * @debug_check_watchpoint: return true if the architectural
-     * watchpoint whose address has matched should really fire, used by ARM
-     */
-    bool (*debug_check_watchpoint)(CPUState *cpu, CPUWatchpoint *wp);
-
-} TcgCpuOperations;
+/* see tcg-cpu-ops.h */
+struct TCGCPUOps;
 
 /**
  * CPUClass:
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     int gdb_num_core_regs;
     bool gdb_stop_before_watchpoint;
 
-    TcgCpuOperations tcg_ops;
+    /* when TCG is not available, this pointer is NULL */
+    struct TCGCPUOps *tcg_ops;
 };
 
 /*
@@ -XXX,XX +XXX,XX @@ CPUState *cpu_by_arch_id(int64_t id);
 
 void cpu_interrupt(CPUState *cpu, int mask);
 
-static inline void cpu_unaligned_access(CPUState *cpu, vaddr addr,
-                                        MMUAccessType access_type,
-                                        int mmu_idx, uintptr_t retaddr)
-{
-    CPUClass *cc = CPU_GET_CLASS(cpu);
-
-    cc->tcg_ops.do_unaligned_access(cpu, addr, access_type, mmu_idx, retaddr);
-}
-
-static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
-                                          vaddr addr, unsigned size,
-                                          MMUAccessType access_type,
-                                          int mmu_idx, MemTxAttrs attrs,
-                                          MemTxResult response,
-                                          uintptr_t retaddr)
-{
-    CPUClass *cc = CPU_GET_CLASS(cpu);
-
-    if (!cpu->ignore_memory_transaction_failures &&
-        cc->tcg_ops.do_transaction_failed) {
-        cc->tcg_ops.do_transaction_failed(cpu, physaddr, addr, size,
-                                          access_type, mmu_idx, attrs,
-                                          response, retaddr);
-    }
-}
-
 /**
  * cpu_set_pc:
  * @cpu: The CPU to set the program counter for.
diff --git a/include/hw/core/tcg-cpu-ops.h b/include/hw/core/tcg-cpu-ops.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/core/tcg-cpu-ops.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * TCG CPU-specific operations
+ *
+ * Copyright 2021 SUSE LLC
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef TCG_CPU_OPS_H
+#define TCG_CPU_OPS_H
+
+#include "hw/core/cpu.h"
+
+struct TCGCPUOps {
+    /**
+     * @initialize: Initalize TCG state
+     *
+     * Called when the first CPU is realized.
+     */
+    void (*initialize)(void);
+    /**
+     * @synchronize_from_tb: Synchronize state from a TCG #TranslationBlock
+     *
+     * This is called when we abandon execution of a TB before starting it,
+     * and must set all parts of the CPU state which the previous TB in the
+     * chain may not have updated.
+     * By default, when this is NULL, a call is made to @set_pc(tb->pc).
+     *
+     * If more state needs to be restored, the target must implement a
+     * function to restore all the state, and register it here.
+     */
+    void (*synchronize_from_tb)(CPUState *cpu,
+                                const struct TranslationBlock *tb);
+    /** @cpu_exec_enter: Callback for cpu_exec preparation */
+    void (*cpu_exec_enter)(CPUState *cpu);
+    /** @cpu_exec_exit: Callback for cpu_exec cleanup */
+    void (*cpu_exec_exit)(CPUState *cpu);
+    /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
+    bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
+    /**
+     * @do_interrupt: Callback for interrupt handling.
+     *
+     * note that this is in general SOFTMMU only, but it actually isn't
+     * because of an x86 hack (accel/tcg/cpu-exec.c), so we cannot put it
+     * in the SOFTMMU section in general.
+     */
+    void (*do_interrupt)(CPUState *cpu);
+    /**
+     * @tlb_fill: Handle a softmmu tlb miss or user-only address fault
+     *
+     * For system mode, if the access is valid, call tlb_set_page
+     * and return true; if the access is invalid, and probe is
+     * true, return false; otherwise raise an exception and do
+     * not return.  For user-only mode, always raise an exception
+     * and do not return.
+     */
+    bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
+                     MMUAccessType access_type, int mmu_idx,
+                     bool probe, uintptr_t retaddr);
+    /** @debug_excp_handler: Callback for handling debug exceptions */
+    void (*debug_excp_handler)(CPUState *cpu);
+
+#ifdef NEED_CPU_H
+#ifdef CONFIG_SOFTMMU
+    /**
+     * @do_transaction_failed: Callback for handling failed memory transactions
+     * (ie bus faults or external aborts; not MMU faults)
+     */
+    void (*do_transaction_failed)(CPUState *cpu, hwaddr physaddr, vaddr addr,
+                                  unsigned size, MMUAccessType access_type,
+                                  int mmu_idx, MemTxAttrs attrs,
+                                  MemTxResult response, uintptr_t retaddr);
+    /**
+     * @do_unaligned_access: Callback for unaligned access handling
+     */
+    void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
+                                MMUAccessType access_type,
+                                int mmu_idx, uintptr_t retaddr);
+
+    /**
+     * @adjust_watchpoint_address: hack for cpu_check_watchpoint used by ARM
+     */
+    vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
+
+    /**
+     * @debug_check_watchpoint: return true if the architectural
+     * watchpoint whose address has matched should really fire, used by ARM
+     */
+    bool (*debug_check_watchpoint)(CPUState *cpu, CPUWatchpoint *wp);
+
+#endif /* CONFIG_SOFTMMU */
+#endif /* NEED_CPU_H */
+
+};
+
+#endif /* TCG_CPU_OPS_H */
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline int r14_bank_number(int mode)
 void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu);
 void arm_translate_init(void);
 
+#ifdef CONFIG_TCG
+void arm_cpu_synchronize_from_tb(CPUState *cs,
+                                 const struct TranslationBlock *tb);
+#endif /* CONFIG_TCG */
+
+
 enum arm_fprounding {
     FPROUNDING_TIEEVEN,
     FPROUNDING_POSINF,
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "qemu/qemu-print.h"
 #include "cpu.h"
+#include "hw/core/tcg-cpu-ops.h"
 #include "trace.h"
 #include "disas/disas.h"
 #include "exec/exec-all.h"
@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
                                TARGET_FMT_lx "] %s\n",
                                last_tb->tc.ptr, last_tb->pc,
                                lookup_symbol(last_tb->pc));
-        if (cc->tcg_ops.synchronize_from_tb) {
-            cc->tcg_ops.synchronize_from_tb(cpu, last_tb);
+        if (cc->tcg_ops->synchronize_from_tb) {
+            cc->tcg_ops->synchronize_from_tb(cpu, last_tb);
         } else {
             assert(cc->set_pc);
             cc->set_pc(cpu, last_tb->pc);
@@ -XXX,XX +XXX,XX @@ static void cpu_exec_enter(CPUState *cpu)
 {
     CPUClass *cc = CPU_GET_CLASS(cpu);
 
-    if (cc->tcg_ops.cpu_exec_enter) {
-        cc->tcg_ops.cpu_exec_enter(cpu);
+    if (cc->tcg_ops->cpu_exec_enter) {
+        cc->tcg_ops->cpu_exec_enter(cpu);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void cpu_exec_exit(CPUState *cpu)
 {
     CPUClass *cc = CPU_GET_CLASS(cpu);
 
-    if (cc->tcg_ops.cpu_exec_exit) {
-        cc->tcg_ops.cpu_exec_exit(cpu);
+    if (cc->tcg_ops->cpu_exec_exit) {
+        cc->tcg_ops->cpu_exec_exit(cpu);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static inline void cpu_handle_debug_exception(CPUState *cpu)
         }
     }
 
-    if (cc->tcg_ops.debug_excp_handler) {
-        cc->tcg_ops.debug_excp_handler(cpu);
+    if (cc->tcg_ops->debug_excp_handler) {
+        cc->tcg_ops->debug_excp_handler(cpu);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
            loop */
 #if defined(TARGET_I386)
         CPUClass *cc = CPU_GET_CLASS(cpu);
-        cc->tcg_ops.do_interrupt(cpu);
+        cc->tcg_ops->do_interrupt(cpu);
 #endif
         *ret = cpu->exception_index;
         cpu->exception_index = -1;
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
         if (replay_exception()) {
             CPUClass *cc = CPU_GET_CLASS(cpu);
             qemu_mutex_lock_iothread();
-            cc->tcg_ops.do_interrupt(cpu);
+            cc->tcg_ops->do_interrupt(cpu);
             qemu_mutex_unlock_iothread();
             cpu->exception_index = -1;
 
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
            True when it is, and we should restart on a new TB,
            and via longjmp via cpu_loop_exit.  */
         else {
-            if (cc->tcg_ops.cpu_exec_interrupt &&
-                cc->tcg_ops.cpu_exec_interrupt(cpu, interrupt_request)) {
+            if (cc->tcg_ops->cpu_exec_interrupt &&
+                cc->tcg_ops->cpu_exec_interrupt(cpu, interrupt_request)) {
                 if (need_replay_interrupt(interrupt_request)) {
                     replay_interrupt();
                 }
@@ -XXX,XX +XXX,XX @@ void tcg_exec_realizefn(CPUState *cpu, Error **errp)
     CPUClass *cc = CPU_GET_CLASS(cpu);
 
     if (!tcg_target_initialized) {
-        cc->tcg_ops.initialize();
+        cc->tcg_ops->initialize();
         tcg_target_initialized = true;
     }
     tlb_init(cpu);
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu/main-loop.h"
 #include "cpu.h"
+#include "hw/core/tcg-cpu-ops.h"
 #include "exec/exec-all.h"
 #include "exec/memory.h"
 #include "exec/address-spaces.h"
@@ -XXX,XX +XXX,XX @@ static void tlb_fill(CPUState *cpu, target_ulong addr, int size,
      * This is not a probe, so only valid return is success; failure
      * should result in exception + longjmp to the cpu loop.
      */
-    ok = cc->tcg_ops.tlb_fill(cpu, addr, size,
-                              access_type, mmu_idx, false, retaddr);
+    ok = cc->tcg_ops->tlb_fill(cpu, addr, size,
+                               access_type, mmu_idx, false, retaddr);
     assert(ok);
 }
 
+static inline void cpu_unaligned_access(CPUState *cpu, vaddr addr,
+                                        MMUAccessType access_type,
+                                        int mmu_idx, uintptr_t retaddr)
+{
+    CPUClass *cc = CPU_GET_CLASS(cpu);
+
+    cc->tcg_ops->do_unaligned_access(cpu, addr, access_type, mmu_idx, retaddr);
+}
+
+static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
+                                          vaddr addr, unsigned size,
+                                          MMUAccessType access_type,
+                                          int mmu_idx, MemTxAttrs attrs,
+                                          MemTxResult response,
+                                          uintptr_t retaddr)
+{
+    CPUClass *cc = CPU_GET_CLASS(cpu);
+
+    if (!cpu->ignore_memory_transaction_failures &&
+        cc->tcg_ops->do_transaction_failed) {
+        cc->tcg_ops->do_transaction_failed(cpu, physaddr, addr, size,
+                                           access_type, mmu_idx, attrs,
+                                           response, retaddr);
+    }
+}
+
 static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
                          int mmu_idx, target_ulong addr, uintptr_t retaddr,
                          MMUAccessType access_type, MemOp op)
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
             CPUState *cs = env_cpu(env);
             CPUClass *cc = CPU_GET_CLASS(cs);
 
-            if (!cc->tcg_ops.tlb_fill(cs, addr, fault_size, access_type,
-                                      mmu_idx, nonfault, retaddr)) {
+            if (!cc->tcg_ops->tlb_fill(cs, addr, fault_size, access_type,
+                                       mmu_idx, nonfault, retaddr)) {
                 /* Non-faulting page table read failed.  */
                 *phost = NULL;
                 return TLB_INVALID_MASK;
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@
  */
 #include "qemu/osdep.h"
 #include "cpu.h"
+#include "hw/core/tcg-cpu-ops.h"
 #include "disas/disas.h"
 #include "exec/exec-all.h"
 #include "tcg/tcg.h"
@@ -XXX,XX +XXX,XX @@ static inline int handle_cpu_signal(uintptr_t pc, siginfo_t *info,
     clear_helper_retaddr();
 
     cc = CPU_GET_CLASS(cpu);
-    cc->tcg_ops.tlb_fill(cpu, address, 0, access_type,
-                         MMU_USER_IDX, false, pc);
+    cc->tcg_ops->tlb_fill(cpu, address, 0, access_type,
+                          MMU_USER_IDX, false, pc);
     g_assert_not_reached();
 }
 
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
         } else {
             CPUState *cpu = env_cpu(env);
             CPUClass *cc = CPU_GET_CLASS(cpu);
-            cc->tcg_ops.tlb_fill(cpu, addr, fault_size, access_type,
-                                 MMU_USER_IDX, false, ra);
+            cc->tcg_ops->tlb_fill(cpu, addr, fault_size, access_type,
+                                  MMU_USER_IDX, false, ra);
             g_assert_not_reached();
         }
     }
diff --git a/hw/mips/jazz.c b/hw/mips/jazz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/mips/jazz.c
+++ b/hw/mips/jazz.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "qemu/help_option.h"
+#ifdef CONFIG_TCG
+#include "hw/core/tcg-cpu-ops.h"
+#endif /* CONFIG_TCG */
 
 enum jazz_model_e {
     JAZZ_MAGNUM,
@@ -XXX,XX +XXX,XX @@ static void mips_jazz_init(MachineState *machine,
      */
     cc = CPU_GET_CLASS(cpu);
 #if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
-    real_do_transaction_failed = cc->tcg_ops.do_transaction_failed;
-    cc->tcg_ops.do_transaction_failed = mips_jazz_do_transaction_failed;
+    real_do_transaction_failed = cc->tcg_ops->do_transaction_failed;
+    cc->tcg_ops->do_transaction_failed = mips_jazz_do_transaction_failed;
 #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 
     /* allocate RAM */
diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/cutils.h"
 #include "qemu/cacheflush.h"
 #include "cpu.h"
+
+#ifdef CONFIG_TCG
+#include "hw/core/tcg-cpu-ops.h"
+#endif /* CONFIG_TCG */
+
 #include "exec/exec-all.h"
 #include "exec/target_page.h"
 #include "hw/qdev-core.h"
@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
         return;
     }
 
-    if (cc->tcg_ops.adjust_watchpoint_address) {
+    if (cc->tcg_ops->adjust_watchpoint_address) {
         /* this is currently used only by ARM BE32 */
-        addr = cc->tcg_ops.adjust_watchpoint_address(cpu, addr, len);
+        addr = cc->tcg_ops->adjust_watchpoint_address(cpu, addr, len);
     }
     QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
         if (watchpoint_address_matches(wp, addr, len)
@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
             wp->hitaddr = MAX(addr, wp->vaddr);
             wp->hitattrs = attrs;
             if (!cpu->watchpoint_hit) {
-                if (wp->flags & BP_CPU && cc->tcg_ops.debug_check_watchpoint &&
-                    !cc->tcg_ops.debug_check_watchpoint(cpu, wp)) {
+                if (wp->flags & BP_CPU && cc->tcg_ops->debug_check_watchpoint &&
+                    !cc->tcg_ops->debug_check_watchpoint(cpu, wp)) {
                     wp->flags &= ~BP_WATCHPOINT_HIT;
                     continue;
                 }
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_initfn(Object *obj)
 #endif
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps alpha_tcg_ops = {
+    .initialize = alpha_translate_init,
+    .cpu_exec_interrupt = alpha_cpu_exec_interrupt,
+    .tlb_fill = alpha_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = alpha_cpu_do_interrupt,
+    .do_transaction_failed = alpha_cpu_do_transaction_failed,
+    .do_unaligned_access = alpha_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void alpha_cpu_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = alpha_cpu_class_by_name;
     cc->has_work = alpha_cpu_has_work;
-    cc->tcg_ops.do_interrupt = alpha_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = alpha_cpu_exec_interrupt;
     cc->dump_state = alpha_cpu_dump_state;
     cc->set_pc = alpha_cpu_set_pc;
     cc->gdb_read_register = alpha_cpu_gdb_read_register;
     cc->gdb_write_register = alpha_cpu_gdb_write_register;
-    cc->tcg_ops.tlb_fill = alpha_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.do_transaction_failed = alpha_cpu_do_transaction_failed;
-    cc->tcg_ops.do_unaligned_access = alpha_cpu_do_unaligned_access;
     cc->get_phys_page_debug = alpha_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_alpha_cpu;
 #endif
     cc->disas_set_info = alpha_cpu_disas_set_info;
-    cc->tcg_ops.initialize = alpha_translate_init;
 
+    cc->tcg_ops = &alpha_tcg_ops;
     cc->gdb_num_core_regs = 67;
 }
 
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "qapi/visitor.h"
 #include "cpu.h"
+#ifdef CONFIG_TCG
+#include "hw/core/tcg-cpu-ops.h"
+#endif /* CONFIG_TCG */
 #include "internals.h"
 #include "exec/exec-all.h"
 #include "hw/qdev-properties.h"
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_set_pc(CPUState *cs, vaddr value)
 }
 
 #ifdef CONFIG_TCG
-static void arm_cpu_synchronize_from_tb(CPUState *cs,
-                                        const TranslationBlock *tb)
+void arm_cpu_synchronize_from_tb(CPUState *cs,
+                                 const TranslationBlock *tb)
 {
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
@@ -XXX,XX +XXX,XX @@ bool arm_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
  found:
     cs->exception_index = excp_idx;
     env->exception.target_el = target_el;
-    cc->tcg_ops.do_interrupt(cs);
+    cc->tcg_ops->do_interrupt(cs);
     return true;
 }
 
@@ -XXX,XX +XXX,XX @@ static gchar *arm_gdb_arch_name(CPUState *cs)
     return g_strdup("arm");
 }
 
+#ifdef CONFIG_TCG
+static struct TCGCPUOps arm_tcg_ops = {
+    .initialize = arm_translate_init,
+    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
+    .cpu_exec_interrupt = arm_cpu_exec_interrupt,
+    .tlb_fill = arm_cpu_tlb_fill,
+    .debug_excp_handler = arm_debug_excp_handler,
+
+#if !defined(CONFIG_USER_ONLY)
+    .do_interrupt = arm_cpu_do_interrupt,
+    .do_transaction_failed = arm_cpu_do_transaction_failed,
+    .do_unaligned_access = arm_cpu_do_unaligned_access,
+    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
+    .debug_check_watchpoint = arm_debug_check_watchpoint,
+#endif /* !CONFIG_USER_ONLY */
+};
+#endif /* CONFIG_TCG */
+
 static void arm_cpu_class_init(ObjectClass *oc, void *data)
 {
     ARMCPUClass *acc = ARM_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_get_dynamic_xml = arm_gdb_get_dynamic_xml;
     cc->gdb_stop_before_watchpoint = true;
     cc->disas_set_info = arm_disas_set_info;
+
 #ifdef CONFIG_TCG
-    cc->tcg_ops.initialize = arm_translate_init;
-    cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
-    cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
-    cc->tcg_ops.tlb_fill = arm_cpu_tlb_fill;
-    cc->tcg_ops.debug_excp_handler = arm_debug_excp_handler;
-#if !defined(CONFIG_USER_ONLY)
-    cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
-    cc->tcg_ops.do_transaction_failed = arm_cpu_do_transaction_failed;
-    cc->tcg_ops.do_unaligned_access = arm_cpu_do_unaligned_access;
-    cc->tcg_ops.adjust_watchpoint_address = arm_adjust_watchpoint_address;
-    cc->tcg_ops.debug_check_watchpoint = arm_debug_check_watchpoint;
-#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
+    cc->tcg_ops = &arm_tcg_ops;
 #endif /* CONFIG_TCG */
 }
 
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "cpu.h"
+#ifdef CONFIG_TCG
+#include "hw/core/tcg-cpu-ops.h"
+#endif /* CONFIG_TCG */
 #include "qemu/module.h"
 #if !defined(CONFIG_USER_ONLY)
 #include "hw/loader.h"
@@ -XXX,XX +XXX,XX @@ static void aarch64_cpu_class_init(ObjectClass *oc, void *data)
 {
     CPUClass *cc = CPU_CLASS(oc);
 
-#ifdef CONFIG_TCG
-    cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
-#endif /* CONFIG_TCG */
-
     cc->gdb_read_register = aarch64_cpu_gdb_read_register;
     cc->gdb_write_register = aarch64_cpu_gdb_write_register;
     cc->gdb_num_core_regs = 34;
diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu_tcg.c
+++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
+#ifdef CONFIG_TCG
+#include "hw/core/tcg-cpu-ops.h"
+#endif /* CONFIG_TCG */
 #include "internals.h"
 
 /* CPU models. These are not needed for the AArch64 linux-user build. */
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
     if (interrupt_request & CPU_INTERRUPT_HARD
         && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
         cs->exception_index = EXCP_IRQ;
-        cc->tcg_ops.do_interrupt(cs);
+        cc->tcg_ops->do_interrupt(cs);
         ret = true;
     }
     return ret;
@@ -XXX,XX +XXX,XX @@ static void pxa270c5_initfn(Object *obj)
     cpu->reset_sctlr = 0x00000078;
 }
 
+#ifdef CONFIG_TCG
+static struct TCGCPUOps arm_v7m_tcg_ops = {
+    .initialize = arm_translate_init,
+    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
+    .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
+    .tlb_fill = arm_cpu_tlb_fill,
+    .debug_excp_handler = arm_debug_excp_handler,
+
+#if !defined(CONFIG_USER_ONLY)
+    .do_interrupt = arm_v7m_cpu_do_interrupt,
+    .do_transaction_failed = arm_cpu_do_transaction_failed,
+    .do_unaligned_access = arm_cpu_do_unaligned_access,
+    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
+    .debug_check_watchpoint = arm_debug_check_watchpoint,
+#endif /* !CONFIG_USER_ONLY */
+};
+#endif /* CONFIG_TCG */
+
 static void arm_v7m_class_init(ObjectClass *oc, void *data)
 {
     ARMCPUClass *acc = ARM_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
 
     acc->info = data;
 #ifdef CONFIG_TCG
-    cc->tcg_ops.cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt;
-#ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.do_interrupt = arm_v7m_cpu_do_interrupt;
-#endif
+    cc->tcg_ops = &arm_v7m_tcg_ops;
 #endif /* CONFIG_TCG */
 
     cc->gdb_core_xml_file = "arm-m-profile.xml";
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_dump_state(CPUState *cs, FILE *f, int flags)
     qemu_fprintf(f, "\n");
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps avr_tcg_ops = {
+    .initialize = avr_cpu_tcg_init,
+    .synchronize_from_tb = avr_cpu_synchronize_from_tb,
+    .cpu_exec_interrupt = avr_cpu_exec_interrupt,
+    .tlb_fill = avr_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = avr_cpu_do_interrupt,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void avr_cpu_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = avr_cpu_class_by_name;
 
     cc->has_work = avr_cpu_has_work;
-    cc->tcg_ops.do_interrupt = avr_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = avr_cpu_exec_interrupt;
     cc->dump_state = avr_cpu_dump_state;
     cc->set_pc = avr_cpu_set_pc;
     cc->memory_rw_debug = avr_cpu_memory_rw_debug;
     cc->get_phys_page_debug = avr_cpu_get_phys_page_debug;
-    cc->tcg_ops.tlb_fill = avr_cpu_tlb_fill;
     cc->vmsd = &vms_avr_cpu;
     cc->disas_set_info = avr_cpu_disas_set_info;
-    cc->tcg_ops.initialize = avr_cpu_tcg_init;
-    cc->tcg_ops.synchronize_from_tb = avr_cpu_synchronize_from_tb;
     cc->gdb_read_register = avr_cpu_gdb_read_register;
     cc->gdb_write_register = avr_cpu_gdb_write_register;
     cc->gdb_num_core_regs = 35;
     cc->gdb_core_xml_file = "avr-cpu.xml";
+    cc->tcg_ops = &avr_tcg_ops;
 }
 
 /*
diff --git a/target/avr/helper.c b/target/avr/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/helper.c
+++ b/target/avr/helper.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
+#include "hw/core/tcg-cpu-ops.h"
 #include "exec/exec-all.h"
 #include "exec/address-spaces.h"
 #include "exec/helper-proto.h"
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
     if (interrupt_request & CPU_INTERRUPT_RESET) {
         if (cpu_interrupts_enabled(env)) {
             cs->exception_index = EXCP_RESET;
-            cc->tcg_ops.do_interrupt(cs);
+            cc->tcg_ops->do_interrupt(cs);
 
             cs->interrupt_request &= ~CPU_INTERRUPT_RESET;
 
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
         if (cpu_interrupts_enabled(env) && env->intsrc != 0) {
             int index = ctz32(env->intsrc);
             cs->exception_index = EXCP_INT(index);
-            cc->tcg_ops.do_interrupt(cs);
+            cc->tcg_ops->do_interrupt(cs);
 
             env->intsrc &= env->intsrc - 1; /* clear the interrupt */
             cs->interrupt_request &= ~CPU_INTERRUPT_HARD;
diff --git a/target/cris/cpu.c b/target/cris/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/cpu.c
+++ b/target/cris/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_initfn(Object *obj)
 #endif
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps crisv10_tcg_ops = {
+    .initialize = cris_initialize_crisv10_tcg,
+    .cpu_exec_interrupt = cris_cpu_exec_interrupt,
+    .tlb_fill = cris_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = crisv10_cpu_do_interrupt,
+#endif /* !CONFIG_USER_ONLY */
+};
+
+static struct TCGCPUOps crisv32_tcg_ops = {
+    .initialize = cris_initialize_tcg,
+    .cpu_exec_interrupt = cris_cpu_exec_interrupt,
+    .tlb_fill = cris_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = cris_cpu_do_interrupt,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void crisv8_cpu_class_init(ObjectClass *oc, void *data)
 {
     CPUClass *cc = CPU_CLASS(oc);
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 8;
-    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
-    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
+    cc->tcg_ops = &crisv10_tcg_ops;
 }
 
 static void crisv9_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void crisv9_cpu_class_init(ObjectClass *oc, void *data)
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 9;
-    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
-    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
+    cc->tcg_ops = &crisv10_tcg_ops;
 }
 
 static void crisv10_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void crisv10_cpu_class_init(ObjectClass *oc, void *data)
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 10;
-    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
-    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
+    cc->tcg_ops = &crisv10_tcg_ops;
 }
 
 static void crisv11_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void crisv11_cpu_class_init(ObjectClass *oc, void *data)
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 11;
-    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
-    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
+    cc->tcg_ops = &crisv10_tcg_ops;
 }
 
 static void crisv17_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void crisv17_cpu_class_init(ObjectClass *oc, void *data)
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 17;
-    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
-    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
+    cc->tcg_ops = &crisv10_tcg_ops;
 }
 
 static void crisv32_cpu_class_init(ObjectClass *oc, void *data)
 {
+    CPUClass *cc = CPU_CLASS(oc);
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 32;
+    cc->tcg_ops = &crisv32_tcg_ops;
 }
 
 static void cris_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = cris_cpu_class_by_name;
     cc->has_work = cris_cpu_has_work;
-    cc->tcg_ops.do_interrupt = cris_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = cris_cpu_exec_interrupt;
     cc->dump_state = cris_cpu_dump_state;
     cc->set_pc = cris_cpu_set_pc;
     cc->gdb_read_register = cris_cpu_gdb_read_register;
     cc->gdb_write_register = cris_cpu_gdb_write_register;
-    cc->tcg_ops.tlb_fill = cris_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = cris_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_cris_cpu;
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_stop_before_watchpoint = true;
 
     cc->disas_set_info = cris_disas_set_info;
-    cc->tcg_ops.initialize = cris_initialize_tcg;
 }
 
 #define DEFINE_CRIS_CPU_TYPE(cpu_model, initfn) \
diff --git a/target/cris/helper.c b/target/cris/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/helper.c
+++ b/target/cris/helper.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
+#include "hw/core/tcg-cpu-ops.h"
 #include "mmu.h"
 #include "qemu/host-utils.h"
 #include "exec/exec-all.h"
@@ -XXX,XX +XXX,XX @@ bool cris_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
         && (env->pregs[PR_CCS] & I_FLAG)
         && !env->locked_irq) {
         cs->exception_index = EXCP_IRQ;
-        cc->tcg_ops.do_interrupt(cs);
+        cc->tcg_ops->do_interrupt(cs);
         ret = true;
     }
     if (interrupt_request & CPU_INTERRUPT_NMI) {
@@ -XXX,XX +XXX,XX @@ bool cris_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
         }
         if ((env->pregs[PR_CCS] & m_flag_archval)) {
             cs->exception_index = EXCP_NMI;
-            cc->tcg_ops.do_interrupt(cs);
+            cc->tcg_ops->do_interrupt(cs);
             ret = true;
         }
     }
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static ObjectClass *hppa_cpu_class_by_name(const char *cpu_model)
     return object_class_by_name(TYPE_HPPA_CPU);
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps hppa_tcg_ops = {
+    .initialize = hppa_translate_init,
+    .synchronize_from_tb = hppa_cpu_synchronize_from_tb,
+    .cpu_exec_interrupt = hppa_cpu_exec_interrupt,
+    .tlb_fill = hppa_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = hppa_cpu_do_interrupt,
+    .do_unaligned_access = hppa_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void hppa_cpu_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = hppa_cpu_class_by_name;
     cc->has_work = hppa_cpu_has_work;
-    cc->tcg_ops.do_interrupt = hppa_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = hppa_cpu_exec_interrupt;
     cc->dump_state = hppa_cpu_dump_state;
     cc->set_pc = hppa_cpu_set_pc;
-    cc->tcg_ops.synchronize_from_tb = hppa_cpu_synchronize_from_tb;
     cc->gdb_read_register = hppa_cpu_gdb_read_register;
     cc->gdb_write_register = hppa_cpu_gdb_write_register;
-    cc->tcg_ops.tlb_fill = hppa_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = hppa_cpu_get_phys_page_debug;
-    cc->tcg_ops.do_unaligned_access = hppa_cpu_do_unaligned_access;
     dc->vmsd = &vmstate_hppa_cpu;
 #endif
     cc->disas_set_info = hppa_cpu_disas_set_info;
-    cc->tcg_ops.initialize = hppa_translate_init;
-
     cc->gdb_num_core_regs = 128;
+    cc->tcg_ops = &hppa_tcg_ops;
 }
 
 static const TypeInfo hppa_cpu_type_info = {
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void x86_cpu_synchronize_from_tb(CPUState *cs,
     cpu->env.eip = tb->pc - tb->cs_base;
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps x86_tcg_ops = {
+    .initialize = tcg_x86_init,
+    .synchronize_from_tb = x86_cpu_synchronize_from_tb,
+    .cpu_exec_enter = x86_cpu_exec_enter,
+    .cpu_exec_exit = x86_cpu_exec_exit,
+    .cpu_exec_interrupt = x86_cpu_exec_interrupt,
+    .do_interrupt = x86_cpu_do_interrupt,
+    .tlb_fill = x86_cpu_tlb_fill,
+#ifndef CONFIG_USER_ONLY
+    .debug_excp_handler = breakpoint_handler,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 void tcg_cpu_common_class_init(CPUClass *cc)
 {
-    cc->tcg_ops.do_interrupt = x86_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = x86_cpu_exec_interrupt;
-    cc->tcg_ops.synchronize_from_tb = x86_cpu_synchronize_from_tb;
-    cc->tcg_ops.cpu_exec_enter = x86_cpu_exec_enter;
-    cc->tcg_ops.cpu_exec_exit = x86_cpu_exec_exit;
-    cc->tcg_ops.initialize = tcg_x86_init;
-    cc->tcg_ops.tlb_fill = x86_cpu_tlb_fill;
-#ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.debug_excp_handler = breakpoint_handler;
-#endif
+    cc->tcg_ops = &x86_tcg_ops;
 }
diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/lm32/cpu.c
+++ b/target/lm32/cpu.c
@@ -XXX,XX +XXX,XX @@ static ObjectClass *lm32_cpu_class_by_name(const char *cpu_model)
     return oc;
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps lm32_tcg_ops = {
+    .initialize = lm32_translate_init,
+    .cpu_exec_interrupt = lm32_cpu_exec_interrupt,
+    .tlb_fill = lm32_cpu_tlb_fill,
+    .debug_excp_handler = lm32_debug_excp_handler,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = lm32_cpu_do_interrupt,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void lm32_cpu_class_init(ObjectClass *oc, void *data)
 {
     LM32CPUClass *lcc = LM32_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = lm32_cpu_class_by_name;
     cc->has_work = lm32_cpu_has_work;
-    cc->tcg_ops.do_interrupt = lm32_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = lm32_cpu_exec_interrupt;
     cc->dump_state = lm32_cpu_dump_state;
     cc->set_pc = lm32_cpu_set_pc;
     cc->gdb_read_register = lm32_cpu_gdb_read_register;
     cc->gdb_write_register = lm32_cpu_gdb_write_register;
-    cc->tcg_ops.tlb_fill = lm32_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = lm32_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_lm32_cpu;
 #endif
     cc->gdb_num_core_regs = 32 + 7;
     cc->gdb_stop_before_watchpoint = true;
-    cc->tcg_ops.debug_excp_handler = lm32_debug_excp_handler;
     cc->disas_set_info = lm32_cpu_disas_set_info;
-    cc->tcg_ops.initialize = lm32_translate_init;
+    cc->tcg_ops = &lm32_tcg_ops;
 }
 
 #define DEFINE_LM32_CPU_TYPE(cpu_model, initfn) \
diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m68k_cpu = {
 };
 #endif
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps m68k_tcg_ops = {
+    .initialize = m68k_tcg_init,
+    .cpu_exec_interrupt = m68k_cpu_exec_interrupt,
+    .tlb_fill = m68k_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = m68k_cpu_do_interrupt,
+    .do_transaction_failed = m68k_cpu_transaction_failed,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void m68k_cpu_class_init(ObjectClass *c, void *data)
 {
     M68kCPUClass *mcc = M68K_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
 
     cc->class_by_name = m68k_cpu_class_by_name;
     cc->has_work = m68k_cpu_has_work;
-    cc->tcg_ops.do_interrupt = m68k_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = m68k_cpu_exec_interrupt;
     cc->dump_state = m68k_cpu_dump_state;
     cc->set_pc = m68k_cpu_set_pc;
     cc->gdb_read_register = m68k_cpu_gdb_read_register;
     cc->gdb_write_register = m68k_cpu_gdb_write_register;
-    cc->tcg_ops.tlb_fill = m68k_cpu_tlb_fill;
 #if defined(CONFIG_SOFTMMU)
-    cc->tcg_ops.do_transaction_failed = m68k_cpu_transaction_failed;
     cc->get_phys_page_debug = m68k_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_m68k_cpu;
 #endif
     cc->disas_set_info = m68k_cpu_disas_set_info;
-    cc->tcg_ops.initialize = m68k_tcg_init;
 
     cc->gdb_num_core_regs = 18;
+    cc->tcg_ops = &m68k_tcg_ops;
 }
 
 static void m68k_cpu_class_init_cf_core(ObjectClass *c, void *data)
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static ObjectClass *mb_cpu_class_by_name(const char *cpu_model)
     return object_class_by_name(TYPE_MICROBLAZE_CPU);
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps mb_tcg_ops = {
+    .initialize = mb_tcg_init,
+    .synchronize_from_tb = mb_cpu_synchronize_from_tb,
+    .cpu_exec_interrupt = mb_cpu_exec_interrupt,
+    .tlb_fill = mb_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = mb_cpu_do_interrupt,
+    .do_transaction_failed = mb_cpu_transaction_failed,
+    .do_unaligned_access = mb_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void mb_cpu_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = mb_cpu_class_by_name;
     cc->has_work = mb_cpu_has_work;
-    cc->tcg_ops.do_interrupt = mb_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = mb_cpu_exec_interrupt;
+
     cc->dump_state = mb_cpu_dump_state;
     cc->set_pc = mb_cpu_set_pc;
-    cc->tcg_ops.synchronize_from_tb = mb_cpu_synchronize_from_tb;
     cc->gdb_read_register = mb_cpu_gdb_read_register;
     cc->gdb_write_register = mb_cpu_gdb_write_register;
-    cc->tcg_ops.tlb_fill = mb_cpu_tlb_fill;
+
 #ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.do_transaction_failed = mb_cpu_transaction_failed;
-    cc->tcg_ops.do_unaligned_access = mb_cpu_do_unaligned_access;
     cc->get_phys_page_attrs_debug = mb_cpu_get_phys_page_attrs_debug;
     dc->vmsd = &vmstate_mb_cpu;
 #endif
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_num_core_regs = 32 + 27;
 
     cc->disas_set_info = mb_disas_set_info;
-    cc->tcg_ops.initialize = mb_tcg_init;
+    cc->tcg_ops = &mb_tcg_ops;
 }
 
 static const TypeInfo mb_cpu_type_info = {
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property mips_cpu_properties[] = {
     DEFINE_PROP_END_OF_LIST()
 };
 
+#ifdef CONFIG_TCG
+#include "hw/core/tcg-cpu-ops.h"
+/*
+ * NB: cannot be const, as some elements are changed for specific
+ * mips hardware (see hw/mips/jazz.c).
+ */
+static struct TCGCPUOps mips_tcg_ops = {
+    .initialize = mips_tcg_init,
+    .synchronize_from_tb = mips_cpu_synchronize_from_tb,
+    .cpu_exec_interrupt = mips_cpu_exec_interrupt,
+    .tlb_fill = mips_cpu_tlb_fill,
+
+#if !defined(CONFIG_USER_ONLY)
+    .do_interrupt = mips_cpu_do_interrupt,
+    .do_transaction_failed = mips_cpu_do_transaction_failed,
+    .do_unaligned_access = mips_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
+#endif /* CONFIG_TCG */
+
 static void mips_cpu_class_init(ObjectClass *c, void *data)
 {
     MIPSCPUClass *mcc = MIPS_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->vmsd = &vmstate_mips_cpu;
 #endif
     cc->disas_set_info = mips_cpu_disas_set_info;
-#ifdef CONFIG_TCG
-    cc->tcg_ops.initialize = mips_tcg_init;
-    cc->tcg_ops.do_interrupt = mips_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = mips_cpu_exec_interrupt;
-    cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
-    cc->tcg_ops.tlb_fill = mips_cpu_tlb_fill;
-#ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.do_transaction_failed = mips_cpu_do_transaction_failed;
-    cc->tcg_ops.do_unaligned_access = mips_cpu_do_unaligned_access;
-
-#endif /* CONFIG_USER_ONLY */
-#endif /* CONFIG_TCG */
-
     cc->gdb_num_core_regs = 73;
     cc->gdb_stop_before_watchpoint = true;
+#ifdef CONFIG_TCG
+    cc->tcg_ops = &mips_tcg_ops;
+#endif /* CONFIG_TCG */
 }
 
 static const TypeInfo mips_cpu_type_info = {
diff --git a/target/moxie/cpu.c b/target/moxie/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/moxie/cpu.c
+++ b/target/moxie/cpu.c
@@ -XXX,XX +XXX,XX @@ static ObjectClass *moxie_cpu_class_by_name(const char *cpu_model)
     return oc;
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps moxie_tcg_ops = {
+    .initialize = moxie_translate_init,
+    .tlb_fill = moxie_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = moxie_cpu_do_interrupt,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void moxie_cpu_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void moxie_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = moxie_cpu_class_by_name;
 
     cc->has_work = moxie_cpu_has_work;
-    cc->tcg_ops.do_interrupt = moxie_cpu_do_interrupt;
     cc->dump_state = moxie_cpu_dump_state;
     cc->set_pc = moxie_cpu_set_pc;
-    cc->tcg_ops.tlb_fill = moxie_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = moxie_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_moxie_cpu;
 #endif
     cc->disas_set_info = moxie_cpu_disas_set_info;
-    cc->tcg_ops.initialize = moxie_translate_init;
+    cc->tcg_ops = &moxie_tcg_ops;
 }
 
 static void moxielite_initfn(Object *obj)
diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/cpu.c
+++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property nios2_properties[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps nios2_tcg_ops = {
+    .initialize = nios2_tcg_init,
+    .cpu_exec_interrupt = nios2_cpu_exec_interrupt,
+    .tlb_fill = nios2_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = nios2_cpu_do_interrupt,
+    .do_unaligned_access = nios2_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
 
 static void nios2_cpu_class_init(ObjectClass *oc, void *data)
 {
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = nios2_cpu_class_by_name;
     cc->has_work = nios2_cpu_has_work;
-    cc->tcg_ops.do_interrupt = nios2_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = nios2_cpu_exec_interrupt;
     cc->dump_state = nios2_cpu_dump_state;
     cc->set_pc = nios2_cpu_set_pc;
     cc->disas_set_info = nios2_cpu_disas_set_info;
-    cc->tcg_ops.tlb_fill = nios2_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.do_unaligned_access = nios2_cpu_do_unaligned_access;
     cc->get_phys_page_debug = nios2_cpu_get_phys_page_debug;
 #endif
     cc->gdb_read_register = nios2_cpu_gdb_read_register;
     cc->gdb_write_register = nios2_cpu_gdb_write_register;
     cc->gdb_num_core_regs = 49;
-    cc->tcg_ops.initialize = nios2_tcg_init;
+    cc->tcg_ops = &nios2_tcg_ops;
 }
 
 static const TypeInfo nios2_cpu_type_info = {
diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_any_initfn(Object *obj)
                       | (IMMUCFGR_NTS & (ctz32(TLB_SIZE) << 2));
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps openrisc_tcg_ops = {
+    .initialize = openrisc_translate_init,
+    .cpu_exec_interrupt = openrisc_cpu_exec_interrupt,
+    .tlb_fill = openrisc_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = openrisc_cpu_do_interrupt,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
 {
     OpenRISCCPUClass *occ = OPENRISC_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = openrisc_cpu_class_by_name;
     cc->has_work = openrisc_cpu_has_work;
-    cc->tcg_ops.do_interrupt = openrisc_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = openrisc_cpu_exec_interrupt;
     cc->dump_state = openrisc_cpu_dump_state;
     cc->set_pc = openrisc_cpu_set_pc;
     cc->gdb_read_register = openrisc_cpu_gdb_read_register;
     cc->gdb_write_register = openrisc_cpu_gdb_write_register;
-    cc->tcg_ops.tlb_fill = openrisc_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = openrisc_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_openrisc_cpu;
 #endif
     cc->gdb_num_core_regs = 32 + 3;
-    cc->tcg_ops.initialize = openrisc_translate_init;
     cc->disas_set_info = openrisc_disas_set_info;
+    cc->tcg_ops = &openrisc_tcg_ops;
 }
 
 /* Sort alphabetically by type name, except for "any". */
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const char *riscv_gdb_get_dynamic_xml(CPUState *cs, const char *xmlname)
     return NULL;
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps riscv_tcg_ops = {
+    .initialize = riscv_translate_init,
+    .synchronize_from_tb = riscv_cpu_synchronize_from_tb,
+    .cpu_exec_interrupt = riscv_cpu_exec_interrupt,
+    .tlb_fill = riscv_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = riscv_cpu_do_interrupt,
+    .do_transaction_failed = riscv_cpu_do_transaction_failed,
+    .do_unaligned_access = riscv_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void riscv_cpu_class_init(ObjectClass *c, void *data)
 {
     RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
 
     cc->class_by_name = riscv_cpu_class_by_name;
     cc->has_work = riscv_cpu_has_work;
-    cc->tcg_ops.do_interrupt = riscv_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = riscv_cpu_exec_interrupt;
     cc->dump_state = riscv_cpu_dump_state;
     cc->set_pc = riscv_cpu_set_pc;
-    cc->tcg_ops.synchronize_from_tb = riscv_cpu_synchronize_from_tb;
     cc->gdb_read_register = riscv_cpu_gdb_read_register;
     cc->gdb_write_register = riscv_cpu_gdb_write_register;
     cc->gdb_num_core_regs = 33;
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     cc->gdb_stop_before_watchpoint = true;
     cc->disas_set_info = riscv_cpu_disas_set_info;
 #ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.do_transaction_failed = riscv_cpu_do_transaction_failed;
-    cc->tcg_ops.do_unaligned_access = riscv_cpu_do_unaligned_access;
     cc->get_phys_page_debug = riscv_cpu_get_phys_page_debug;
     /* For now, mark unmigratable: */
     cc->vmsd = &vmstate_riscv_cpu;
 #endif
     cc->gdb_arch_name = riscv_gdb_arch_name;
     cc->gdb_get_dynamic_xml = riscv_gdb_get_dynamic_xml;
-    cc->tcg_ops.initialize = riscv_translate_init;
-    cc->tcg_ops.tlb_fill = riscv_cpu_tlb_fill;
+    cc->tcg_ops = &riscv_tcg_ops;
 
     device_class_set_props(dc, riscv_cpu_properties);
 }
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_init(Object *obj)
     qdev_init_gpio_in(DEVICE(cpu), rx_cpu_set_irq, 2);
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps rx_tcg_ops = {
+    .initialize = rx_translate_init,
+    .synchronize_from_tb = rx_cpu_synchronize_from_tb,
+    .cpu_exec_interrupt = rx_cpu_exec_interrupt,
+    .tlb_fill = rx_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = rx_cpu_do_interrupt,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void rx_cpu_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
 
     cc->class_by_name = rx_cpu_class_by_name;
     cc->has_work = rx_cpu_has_work;
-    cc->tcg_ops.do_interrupt = rx_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = rx_cpu_exec_interrupt;
     cc->dump_state = rx_cpu_dump_state;
     cc->set_pc = rx_cpu_set_pc;
-    cc->tcg_ops.synchronize_from_tb = rx_cpu_synchronize_from_tb;
+
     cc->gdb_read_register = rx_cpu_gdb_read_register;
     cc->gdb_write_register = rx_cpu_gdb_write_register;
     cc->get_phys_page_debug = rx_cpu_get_phys_page_debug;
     cc->disas_set_info = rx_cpu_disas_set_info;
-    cc->tcg_ops.initialize = rx_translate_init;
-    cc->tcg_ops.tlb_fill = rx_cpu_tlb_fill;
 
     cc->gdb_num_core_regs = 26;
     cc->gdb_core_xml_file = "rx-core.xml";
+    cc->tcg_ops = &rx_tcg_ops;
 }
 
 static const TypeInfo rx_cpu_info = {
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_reset_full(DeviceState *dev)
     return s390_cpu_reset(s, S390_CPU_RESET_CLEAR);
 }
 
+#ifdef CONFIG_TCG
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps s390_tcg_ops = {
+    .initialize = s390x_translate_init,
+    .tlb_fill = s390_cpu_tlb_fill,
+
+#if !defined(CONFIG_USER_ONLY)
+    .cpu_exec_interrupt = s390_cpu_exec_interrupt,
+    .do_interrupt = s390_cpu_do_interrupt,
+    .debug_excp_handler = s390x_cpu_debug_excp_handler,
+    .do_unaligned_access = s390x_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
+#endif /* CONFIG_TCG */
+
 static void s390_cpu_class_init(ObjectClass *oc, void *data)
 {
     S390CPUClass *scc = S390_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
     scc->reset = s390_cpu_reset;
     cc->class_by_name = s390_cpu_class_by_name,
     cc->has_work = s390_cpu_has_work;
-#ifdef CONFIG_TCG
-    cc->tcg_ops.do_interrupt = s390_cpu_do_interrupt;
-#endif
     cc->dump_state = s390_cpu_dump_state;
     cc->set_pc = s390_cpu_set_pc;
     cc->gdb_read_register = s390_cpu_gdb_read_register;
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
     cc->vmsd = &vmstate_s390_cpu;
     cc->get_crash_info = s390_cpu_get_crash_info;
     cc->write_elf64_note = s390_cpu_write_elf64_note;
-#ifdef CONFIG_TCG
-    cc->tcg_ops.cpu_exec_interrupt = s390_cpu_exec_interrupt;
-    cc->tcg_ops.debug_excp_handler = s390x_cpu_debug_excp_handler;
-    cc->tcg_ops.do_unaligned_access = s390x_cpu_do_unaligned_access;
-#endif
 #endif
     cc->disas_set_info = s390_cpu_disas_set_info;
-#ifdef CONFIG_TCG
-    cc->tcg_ops.initialize = s390x_translate_init;
-    cc->tcg_ops.tlb_fill = s390_cpu_tlb_fill;
-#endif
-
     cc->gdb_num_core_regs = S390_NUM_CORE_REGS;
     cc->gdb_core_xml_file = "s390x-core64.xml";
     cc->gdb_arch_name = s390_gdb_arch_name;
 
     s390_cpu_model_class_register_props(oc);
+
+#ifdef CONFIG_TCG
+    cc->tcg_ops = &s390_tcg_ops;
+#endif /* CONFIG_TCG */
 }
 
 static const TypeInfo s390_cpu_type_info = {
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_sh_cpu = {
     .unmigratable = 1,
 };
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps superh_tcg_ops = {
+    .initialize = sh4_translate_init,
+    .synchronize_from_tb = superh_cpu_synchronize_from_tb,
+    .cpu_exec_interrupt = superh_cpu_exec_interrupt,
+    .tlb_fill = superh_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = superh_cpu_do_interrupt,
+    .do_unaligned_access = superh_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void superh_cpu_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = superh_cpu_class_by_name;
     cc->has_work = superh_cpu_has_work;
-    cc->tcg_ops.do_interrupt = superh_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = superh_cpu_exec_interrupt;
     cc->dump_state = superh_cpu_dump_state;
     cc->set_pc = superh_cpu_set_pc;
-    cc->tcg_ops.synchronize_from_tb = superh_cpu_synchronize_from_tb;
     cc->gdb_read_register = superh_cpu_gdb_read_register;
     cc->gdb_write_register = superh_cpu_gdb_write_register;
-    cc->tcg_ops.tlb_fill = superh_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.do_unaligned_access = superh_cpu_do_unaligned_access;
     cc->get_phys_page_debug = superh_cpu_get_phys_page_debug;
 #endif
     cc->disas_set_info = superh_cpu_disas_set_info;
-    cc->tcg_ops.initialize = sh4_translate_init;
 
     cc->gdb_num_core_regs = 59;
 
     dc->vmsd = &vmstate_sh_cpu;
+    cc->tcg_ops = &superh_tcg_ops;
 }
 
 #define DEFINE_SUPERH_CPU_TYPE(type_name, cinit, initfn) \
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property sparc_cpu_properties[] = {
     DEFINE_PROP_END_OF_LIST()
 };
 
+#ifdef CONFIG_TCG
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps sparc_tcg_ops = {
+    .initialize = sparc_tcg_init,
+    .synchronize_from_tb = sparc_cpu_synchronize_from_tb,
+    .cpu_exec_interrupt = sparc_cpu_exec_interrupt,
+    .tlb_fill = sparc_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = sparc_cpu_do_interrupt,
+    .do_transaction_failed = sparc_cpu_do_transaction_failed,
+    .do_unaligned_access = sparc_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
+#endif /* CONFIG_TCG */
+
 static void sparc_cpu_class_init(ObjectClass *oc, void *data)
 {
     SPARCCPUClass *scc = SPARC_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = sparc_cpu_class_by_name;
     cc->parse_features = sparc_cpu_parse_features;
     cc->has_work = sparc_cpu_has_work;
-    cc->tcg_ops.do_interrupt = sparc_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = sparc_cpu_exec_interrupt;
     cc->dump_state = sparc_cpu_dump_state;
 #if !defined(TARGET_SPARC64) && !defined(CONFIG_USER_ONLY)
     cc->memory_rw_debug = sparc_cpu_memory_rw_debug;
 #endif
     cc->set_pc = sparc_cpu_set_pc;
-    cc->tcg_ops.synchronize_from_tb = sparc_cpu_synchronize_from_tb;
     cc->gdb_read_register = sparc_cpu_gdb_read_register;
     cc->gdb_write_register = sparc_cpu_gdb_write_register;
-    cc->tcg_ops.tlb_fill = sparc_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.do_transaction_failed = sparc_cpu_do_transaction_failed;
-    cc->tcg_ops.do_unaligned_access = sparc_cpu_do_unaligned_access;
     cc->get_phys_page_debug = sparc_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_sparc_cpu;
 #endif
     cc->disas_set_info = cpu_sparc_disas_set_info;
-    cc->tcg_ops.initialize = sparc_tcg_init;
 
 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
     cc->gdb_num_core_regs = 86;
 #else
     cc->gdb_num_core_regs = 72;
 #endif
+    cc->tcg_ops = &sparc_tcg_ops;
 }
 
 static const TypeInfo sparc_cpu_type_info = {
diff --git a/target/tilegx/cpu.c b/target/tilegx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tilegx/cpu.c
+++ b/target/tilegx/cpu.c
@@ -XXX,XX +XXX,XX @@ static bool tilegx_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
     return false;
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps tilegx_tcg_ops = {
+    .initialize = tilegx_tcg_init,
+    .cpu_exec_interrupt = tilegx_cpu_exec_interrupt,
+    .tlb_fill = tilegx_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = tilegx_cpu_do_interrupt,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = tilegx_cpu_class_by_name;
     cc->has_work = tilegx_cpu_has_work;
-    cc->tcg_ops.do_interrupt = tilegx_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = tilegx_cpu_exec_interrupt;
     cc->dump_state = tilegx_cpu_dump_state;
     cc->set_pc = tilegx_cpu_set_pc;
-    cc->tcg_ops.tlb_fill = tilegx_cpu_tlb_fill;
     cc->gdb_num_core_regs = 0;
-    cc->tcg_ops.initialize = tilegx_tcg_init;
+    cc->tcg_ops = &tilegx_tcg_ops;
 }
 
 static const TypeInfo tilegx_cpu_type_info = {
diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tc27x_initfn(Object *obj)
     set_feature(&cpu->env, TRICORE_FEATURE_161);
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps tricore_tcg_ops = {
+    .initialize = tricore_tcg_init,
+    .synchronize_from_tb = tricore_cpu_synchronize_from_tb,
+    .tlb_fill = tricore_cpu_tlb_fill,
+};
+
 static void tricore_cpu_class_init(ObjectClass *c, void *data)
 {
     TriCoreCPUClass *mcc = TRICORE_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_class_init(ObjectClass *c, void *data)
 
     cc->dump_state = tricore_cpu_dump_state;
     cc->set_pc = tricore_cpu_set_pc;
-    cc->tcg_ops.synchronize_from_tb = tricore_cpu_synchronize_from_tb;
     cc->get_phys_page_debug = tricore_cpu_get_phys_page_debug;
-    cc->tcg_ops.initialize = tricore_tcg_init;
-    cc->tcg_ops.tlb_fill = tricore_cpu_tlb_fill;
+    cc->tcg_ops = &tricore_tcg_ops;
 }
 
 #define DEFINE_TRICORE_CPU_TYPE(cpu_model, initfn) \
diff --git a/target/unicore32/cpu.c b/target/unicore32/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/unicore32/cpu.c
+++ b/target/unicore32/cpu.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_uc32_cpu = {
     .unmigratable = 1,
 };
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps uc32_tcg_ops = {
+    .initialize = uc32_translate_init,
+    .cpu_exec_interrupt = uc32_cpu_exec_interrupt,
+    .tlb_fill = uc32_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = uc32_cpu_do_interrupt,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void uc32_cpu_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = uc32_cpu_class_by_name;
     cc->has_work = uc32_cpu_has_work;
-    cc->tcg_ops.do_interrupt = uc32_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = uc32_cpu_exec_interrupt;
     cc->dump_state = uc32_cpu_dump_state;
     cc->set_pc = uc32_cpu_set_pc;
-    cc->tcg_ops.tlb_fill = uc32_cpu_tlb_fill;
     cc->get_phys_page_debug = uc32_cpu_get_phys_page_debug;
-    cc->tcg_ops.initialize = uc32_translate_init;
     dc->vmsd = &vmstate_uc32_cpu;
+    cc->tcg_ops = &uc32_tcg_ops;
 }
 
 #define DEFINE_UNICORE32_CPU_TYPE(cpu_model, initfn) \
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_xtensa_cpu = {
     .unmigratable = 1,
 };
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps xtensa_tcg_ops = {
+    .initialize = xtensa_translate_init,
+    .cpu_exec_interrupt = xtensa_cpu_exec_interrupt,
+    .tlb_fill = xtensa_cpu_tlb_fill,
+    .debug_excp_handler = xtensa_breakpoint_handler,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = xtensa_cpu_do_interrupt,
+    .do_transaction_failed = xtensa_cpu_do_transaction_failed,
+    .do_unaligned_access = xtensa_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = xtensa_cpu_class_by_name;
     cc->has_work = xtensa_cpu_has_work;
-    cc->tcg_ops.do_interrupt = xtensa_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = xtensa_cpu_exec_interrupt;
     cc->dump_state = xtensa_cpu_dump_state;
     cc->set_pc = xtensa_cpu_set_pc;
     cc->gdb_read_register = xtensa_cpu_gdb_read_register;
     cc->gdb_write_register = xtensa_cpu_gdb_write_register;
     cc->gdb_stop_before_watchpoint = true;
-    cc->tcg_ops.tlb_fill = xtensa_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.do_unaligned_access = xtensa_cpu_do_unaligned_access;
     cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
-    cc->tcg_ops.do_transaction_failed = xtensa_cpu_do_transaction_failed;
 #endif
-    cc->tcg_ops.debug_excp_handler = xtensa_breakpoint_handler;
     cc->disas_set_info = xtensa_cpu_disas_set_info;
-    cc->tcg_ops.initialize = xtensa_translate_init;
     dc->vmsd = &vmstate_xtensa_cpu;
+    cc->tcg_ops = &xtensa_tcg_ops;
 }
 
 static const TypeInfo xtensa_cpu_type_info = {
diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/translate_init.c.inc
+++ b/target/ppc/translate_init.c.inc
@@ -XXX,XX +XXX,XX @@ static Property ppc_cpu_properties[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+#ifdef CONFIG_TCG
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps ppc_tcg_ops = {
+  .initialize = ppc_translate_init,
+  .cpu_exec_interrupt = ppc_cpu_exec_interrupt,
+  .tlb_fill = ppc_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+  .do_interrupt = ppc_cpu_do_interrupt,
+  .cpu_exec_enter = ppc_cpu_exec_enter,
+  .cpu_exec_exit = ppc_cpu_exec_exit,
+  .do_unaligned_access = ppc_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
+#endif /* CONFIG_TCG */
+
 static void ppc_cpu_class_init(ObjectClass *oc, void *data)
 {
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
 #ifndef CONFIG_USER_ONLY
     cc->virtio_is_big_endian = ppc_cpu_is_big_endian;
 #endif
-#ifdef CONFIG_TCG
-    cc->tcg_ops.initialize = ppc_translate_init;
-    cc->tcg_ops.cpu_exec_interrupt = ppc_cpu_exec_interrupt;
-    cc->tcg_ops.do_interrupt = ppc_cpu_do_interrupt;
-    cc->tcg_ops.tlb_fill = ppc_cpu_tlb_fill;
-#ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.cpu_exec_enter = ppc_cpu_exec_enter;
-    cc->tcg_ops.cpu_exec_exit = ppc_cpu_exec_exit;
-    cc->tcg_ops.do_unaligned_access = ppc_cpu_do_unaligned_access;
-#endif /* !CONFIG_USER_ONLY */
-#endif /* CONFIG_TCG */
-
     cc->disas_set_info = ppc_disas_set_info;
 
     dc->fw_name = "PowerPC,UNKNOWN";
+
+#ifdef CONFIG_TCG
+    cc->tcg_ops = &ppc_tcg_ops;
+#endif /* CONFIG_TCG */
 }
 
 static const TypeInfo ppc_cpu_type_info = {
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: include/exec/helper*.h
 F: include/exec/tb-hash.h
 F: include/sysemu/cpus.h
 F: include/sysemu/tcg.h
+F: include/hw/core/tcg-cpu-ops.h
 
 FPU emulation
 M: Aurelien Jarno <aurelien@aurel32.net>
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

[claudio: rebased on Richard's splitwx work]

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Message-Id: <20210204163931.7358-17-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/boards.h                |  2 +-
 include/{sysemu => qemu}/accel.h   | 14 +++++----
 include/sysemu/hvf.h               |  2 +-
 include/sysemu/kvm.h               |  2 +-
 include/sysemu/kvm_int.h           |  2 +-
 target/i386/hvf/hvf-i386.h         |  2 +-
 accel/accel-common.c               | 50 ++++++++++++++++++++++++++++++
 accel/{accel.c => accel-softmmu.c} | 27 ++--------------
 accel/accel-user.c                 | 24 ++++++++++++++
 accel/qtest/qtest.c                |  2 +-
 accel/tcg/tcg-all.c                | 15 +++++++--
 accel/xen/xen-all.c                |  2 +-
 bsd-user/main.c                    |  6 +++-
 linux-user/main.c                  |  6 +++-
 softmmu/memory.c                   |  2 +-
 softmmu/qtest.c                    |  2 +-
 softmmu/vl.c                       |  2 +-
 target/i386/hax/hax-all.c          |  2 +-
 target/i386/hvf/hvf.c              |  2 +-
 target/i386/hvf/x86_task.c         |  2 +-
 target/i386/whpx/whpx-all.c        |  2 +-
 MAINTAINERS                        |  2 +-
 accel/meson.build                  |  4 ++-
 accel/tcg/meson.build              |  2 +-
 24 files changed, 125 insertions(+), 53 deletions(-)
 rename include/{sysemu => qemu}/accel.h (95%)
 create mode 100644 accel/accel-common.c
 rename accel/{accel.c => accel-softmmu.c} (75%)
 create mode 100644 accel/accel-user.c

diff --git a/include/hw/boards.h b/include/hw/boards.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -XXX,XX +XXX,XX @@
 #include "exec/memory.h"
 #include "sysemu/hostmem.h"
 #include "sysemu/blockdev.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "qapi/qapi-types-machine.h"
 #include "qemu/module.h"
 #include "qom/object.h"
diff --git a/include/sysemu/accel.h b/include/qemu/accel.h
similarity index 95%
rename from include/sysemu/accel.h
rename to include/qemu/accel.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/accel.h
+++ b/include/qemu/accel.h
@@ -XXX,XX +XXX,XX @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#ifndef HW_ACCEL_H
-#define HW_ACCEL_H
+#ifndef QEMU_ACCEL_H
+#define QEMU_ACCEL_H
 
 #include "qom/object.h"
 #include "exec/hwaddr.h"
@@ -XXX,XX +XXX,XX @@ typedef struct AccelClass {
     /*< public >*/
 
     const char *name;
-#ifndef CONFIG_USER_ONLY
     int (*init_machine)(MachineState *ms);
+#ifndef CONFIG_USER_ONLY
     void (*setup_post)(MachineState *ms, AccelState *accel);
     bool (*has_memory)(MachineState *ms, AddressSpace *as,
                        hwaddr start_addr, hwaddr size);
@@ -XXX,XX +XXX,XX @@ typedef struct AccelClass {
     OBJECT_GET_CLASS(AccelClass, (obj), TYPE_ACCEL)
 
 AccelClass *accel_find(const char *opt_name);
+AccelState *current_accel(void);
+
+#ifndef CONFIG_USER_ONLY
 int accel_init_machine(AccelState *accel, MachineState *ms);
 
 /* Called just before os_setup_post (ie just before drop OS privs) */
 void accel_setup_post(MachineState *ms);
+#endif /* !CONFIG_USER_ONLY */
 
-AccelState *current_accel(void);
-
-#endif
+#endif /* QEMU_ACCEL_H */
diff --git a/include/sysemu/hvf.h b/include/sysemu/hvf.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/hvf.h
+++ b/include/sysemu/hvf.h
@@ -XXX,XX +XXX,XX @@
 #ifndef HVF_H
 #define HVF_H
 
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "qom/object.h"
 
 #ifdef CONFIG_HVF
diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -XXX,XX +XXX,XX @@
 #include "qemu/queue.h"
 #include "hw/core/cpu.h"
 #include "exec/memattrs.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "qom/object.h"
 
 #ifdef NEED_CPU_H
diff --git a/include/sysemu/kvm_int.h b/include/sysemu/kvm_int.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/kvm_int.h
+++ b/include/sysemu/kvm_int.h
@@ -XXX,XX +XXX,XX @@
 #define QEMU_KVM_INT_H
 
 #include "exec/memory.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "sysemu/kvm.h"
 
 typedef struct KVMSlot
diff --git a/target/i386/hvf/hvf-i386.h b/target/i386/hvf/hvf-i386.h
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hvf/hvf-i386.h
+++ b/target/i386/hvf/hvf-i386.h
@@ -XXX,XX +XXX,XX @@
 #ifndef HVF_I386_H
 #define HVF_I386_H
 
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "sysemu/hvf.h"
 #include "cpu.h"
 #include "x86.h"
diff --git a/accel/accel-common.c b/accel/accel-common.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/accel/accel-common.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU accel class, components common to system emulation and user mode
+ *
+ * Copyright (c) 2003-2008 Fabrice Bellard
+ * Copyright (c) 2014 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/accel.h"
+
+static const TypeInfo accel_type = {
+    .name = TYPE_ACCEL,
+    .parent = TYPE_OBJECT,
+    .class_size = sizeof(AccelClass),
+    .instance_size = sizeof(AccelState),
+};
+
+/* Lookup AccelClass from opt_name. Returns NULL if not found */
+AccelClass *accel_find(const char *opt_name)
+{
+    char *class_name = g_strdup_printf(ACCEL_CLASS_NAME("%s"), opt_name);
+    AccelClass *ac = ACCEL_CLASS(object_class_by_name(class_name));
+    g_free(class_name);
+    return ac;
+}
+
+static void register_accel_types(void)
+{
+    type_register_static(&accel_type);
+}
+
+type_init(register_accel_types);
diff --git a/accel/accel.c b/accel/accel-softmmu.c
similarity index 75%
rename from accel/accel.c
rename to accel/accel-softmmu.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/accel.c
+++ b/accel/accel-softmmu.c
@@ -XXX,XX +XXX,XX @@
 /*
- * QEMU System Emulator, accelerator interfaces
+ * QEMU accel class, system emulation components
  *
  * Copyright (c) 2003-2008 Fabrice Bellard
  * Copyright (c) 2014 Red Hat Inc.
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "hw/boards.h"
 #include "sysemu/arch_init.h"
 #include "sysemu/sysemu.h"
 #include "qom/object.h"
 
-static const TypeInfo accel_type = {
-    .name = TYPE_ACCEL,
-    .parent = TYPE_OBJECT,
-    .class_size = sizeof(AccelClass),
-    .instance_size = sizeof(AccelState),
-};
-
-/* Lookup AccelClass from opt_name. Returns NULL if not found */
-AccelClass *accel_find(const char *opt_name)
-{
-    char *class_name = g_strdup_printf(ACCEL_CLASS_NAME("%s"), opt_name);
-    AccelClass *ac = ACCEL_CLASS(object_class_by_name(class_name));
-    g_free(class_name);
-    return ac;
-}
-
 int accel_init_machine(AccelState *accel, MachineState *ms)
 {
     AccelClass *acc = ACCEL_GET_CLASS(accel);
@@ -XXX,XX +XXX,XX @@ void accel_setup_post(MachineState *ms)
         acc->setup_post(ms, accel);
     }
 }
-
-static void register_accel_types(void)
-{
-    type_register_static(&accel_type);
-}
-
-type_init(register_accel_types);
diff --git a/accel/accel-user.c b/accel/accel-user.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/accel/accel-user.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU accel class, user-mode components
+ *
+ * Copyright 2021 SUSE LLC
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/accel.h"
+
+AccelState *current_accel(void)
+{
+    static AccelState *accel;
+
+    if (!accel) {
+        AccelClass *ac = accel_find("tcg");
+
+        g_assert(ac != NULL);
+        accel = ACCEL(object_new_with_class(OBJECT_CLASS(ac)));
+    }
+    return accel;
+}
diff --git a/accel/qtest/qtest.c b/accel/qtest/qtest.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/qtest/qtest.c
+++ b/accel/qtest/qtest.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/module.h"
 #include "qemu/option.h"
 #include "qemu/config-file.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "sysemu/qtest.h"
 #include "sysemu/cpus.h"
 #include "sysemu/cpu-timers.h"
diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -XXX,XX +XXX,XX @@
 #include "tcg/tcg.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
-#include "hw/boards.h"
+#include "qemu/accel.h"
 #include "qapi/qapi-builtin-visit.h"
+
+#ifndef CONFIG_USER_ONLY
 #include "tcg-cpus.h"
+#endif /* CONFIG_USER_ONLY */
 
 struct TCGState {
     AccelState parent_obj;
@@ -XXX,XX +XXX,XX @@ static void tcg_accel_instance_init(Object *obj)
     s->mttcg_enabled = default_mttcg_enabled();
 
     /* If debugging enabled, default "auto on", otherwise off. */
-#ifdef CONFIG_DEBUG_TCG
+#if defined(CONFIG_DEBUG_TCG) && !defined(CONFIG_USER_ONLY)
     s->splitwx_enabled = -1;
 #else
     s->splitwx_enabled = 0;
@@ -XXX,XX +XXX,XX @@ static int tcg_init(MachineState *ms)
     mttcg_enabled = s->mttcg_enabled;
 
     /*
-     * Initialize TCG regions
+     * Initialize TCG regions only for softmmu.
+     *
+     * This needs to be done later for user mode, because the prologue
+     * generation needs to be delayed so that GUEST_BASE is already set.
      */
+#ifndef CONFIG_USER_ONLY
     tcg_region_init();
 
     if (mttcg_enabled) {
@@ -XXX,XX +XXX,XX @@ static int tcg_init(MachineState *ms)
     } else {
         cpus_register_accel(&tcg_cpus_rr);
     }
+#endif /* !CONFIG_USER_ONLY */
+
     return 0;
 }
 
diff --git a/accel/xen/xen-all.c b/accel/xen/xen-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/xen/xen-all.c
+++ b/accel/xen/xen-all.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/xen/xen-legacy-backend.h"
 #include "hw/xen/xen_pt.h"
 #include "chardev/char.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "sysemu/cpus.h"
 #include "sysemu/xen.h"
 #include "sysemu/runstate.h"
diff --git a/bsd-user/main.c b/bsd-user/main.c
index XXXXXXX..XXXXXXX 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu-common.h"
 #include "qemu/units.h"
+#include "qemu/accel.h"
 #include "sysemu/tcg.h"
 #include "qemu-version.h"
 #include <machine/trap.h>
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
     }
 
     /* init tcg before creating CPUs and to get qemu_host_page_size */
-    tcg_exec_init(0, false);
+    {
+        AccelClass *ac = ACCEL_GET_CLASS(current_accel());
 
+        ac->init_machine(NULL);
+    }
     cpu_type = parse_cpu_option(cpu_model);
     cpu = cpu_create(cpu_type);
     env = cpu->env_ptr;
diff --git a/linux-user/main.c b/linux-user/main.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu-common.h"
 #include "qemu/units.h"
+#include "qemu/accel.h"
 #include "sysemu/tcg.h"
 #include "qemu-version.h"
 #include <sys/syscall.h>
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp)
     cpu_type = parse_cpu_option(cpu_model);
 
     /* init tcg before creating CPUs and to get qemu_host_page_size */
-    tcg_exec_init(0, false);
+    {
+        AccelClass *ac = ACCEL_GET_CLASS(current_accel());
 
+        ac->init_machine(NULL);
+    }
     cpu = cpu_create(cpu_type);
     env = cpu->env_ptr;
     cpu_reset(cpu);
diff --git a/softmmu/memory.c b/softmmu/memory.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/memory.c
+++ b/softmmu/memory.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/kvm.h"
 #include "sysemu/runstate.h"
 #include "sysemu/tcg.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "hw/boards.h"
 #include "migration/vmstate.h"
 
diff --git a/softmmu/qtest.c b/softmmu/qtest.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/qtest.c
+++ b/softmmu/qtest.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/ioport.h"
 #include "exec/memory.h"
 #include "hw/irq.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "sysemu/cpu-timers.h"
 #include "qemu/config-file.h"
 #include "qemu/option.h"
diff --git a/softmmu/vl.c b/softmmu/vl.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/vl.c
+++ b/softmmu/vl.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/error-report.h"
 #include "qemu/sockets.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "hw/usb.h"
 #include "hw/isa/isa.h"
 #include "hw/scsi/scsi.h"
diff --git a/target/i386/hax/hax-all.c b/target/i386/hax/hax-all.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hax/hax-all.c
+++ b/target/i386/hax/hax-all.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/address-spaces.h"
 
 #include "qemu-common.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "sysemu/reset.h"
 #include "sysemu/runstate.h"
 #include "hw/boards.h"
diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hvf/hvf.c
+++ b/target/i386/hvf/hvf.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/address-spaces.h"
 #include "hw/i386/apic_internal.h"
 #include "qemu/main-loop.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "target/i386/cpu.h"
 
 #include "hvf-cpus.h"
diff --git a/target/i386/hvf/x86_task.c b/target/i386/hvf/x86_task.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hvf/x86_task.c
+++ b/target/i386/hvf/x86_task.c
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/i386/apic_internal.h"
 #include "qemu/main-loop.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "target/i386/cpu.h"
 
 // TODO: taskswitch handling
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/address-spaces.h"
 #include "exec/ioport.h"
 #include "qemu-common.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "sysemu/whpx.h"
 #include "sysemu/cpus.h"
 #include "sysemu/runstate.h"
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ Overall
 M: Richard Henderson <richard.henderson@linaro.org>
 R: Paolo Bonzini <pbonzini@redhat.com>
 S: Maintained
-F: include/sysemu/accel.h
+F: include/qemu/accel.h
 F: accel/accel.c
 F: accel/Makefile.objs
 F: accel/stubs/Makefile.objs
diff --git a/accel/meson.build b/accel/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/accel/meson.build
+++ b/accel/meson.build
@@ -XXX,XX +XXX,XX @@
-softmmu_ss.add(files('accel.c'))
+specific_ss.add(files('accel-common.c'))
+softmmu_ss.add(files('accel-softmmu.c'))
+user_ss.add(files('accel-user.c'))
 
 subdir('qtest')
 subdir('kvm')
diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/meson.build
+++ b/accel/tcg/meson.build
@@ -XXX,XX +XXX,XX @@
 tcg_ss = ss.source_set()
 tcg_ss.add(files(
+  'tcg-all.c',
   'cpu-exec-common.c',
   'cpu-exec.c',
   'tcg-runtime-gvec.c',
@@ -XXX,XX +XXX,XX @@ tcg_ss.add(when: 'CONFIG_PLUGIN', if_true: [files('plugin-gen.c'), libdl])
 specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_ss)
 
 specific_ss.add(when: ['CONFIG_SOFTMMU', 'CONFIG_TCG'], if_true: files(
-  'tcg-all.c',
   'cputlb.c',
   'tcg-cpus.c',
   'tcg-cpus-mttcg.c',
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

This will allow us to centralize the registration of
the cpus.c module accelerator operations (in accel/accel-softmmu.c),
and trigger it automatically using object hierarchy lookup from the
new accel_init_interfaces() initialization step, depending just on
which accelerators are available in the code.

Rename all tcg-cpus.c, kvm-cpus.c, etc to tcg-accel-ops.c,
kvm-accel-ops.c, etc, matching the object type names.

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Message-Id: <20210204163931.7358-18-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/accel-softmmu.h                         | 15 ++++++
 accel/kvm/kvm-cpus.h                          |  2 -
 ...g-cpus-icount.h => tcg-accel-ops-icount.h} |  2 +
 accel/tcg/tcg-accel-ops-mttcg.h               | 19 ++++++++
 .../tcg/{tcg-cpus-rr.h => tcg-accel-ops-rr.h} |  0
 accel/tcg/{tcg-cpus.h => tcg-accel-ops.h}     |  6 +--
 include/qemu/accel.h                          |  2 +
 include/sysemu/accel-ops.h                    | 45 ++++++++++++++++++
 include/sysemu/cpus.h                         | 26 ++--------
 .../i386/hax/{hax-cpus.h => hax-accel-ops.h}  |  2 -
 target/i386/hax/hax-windows.h                 |  2 +-
 .../i386/hvf/{hvf-cpus.h => hvf-accel-ops.h}  |  2 -
 .../whpx/{whpx-cpus.h => whpx-accel-ops.h}    |  2 -
 accel/accel-common.c                          | 11 +++++
 accel/accel-softmmu.c                         | 44 +++++++++++++++--
 accel/kvm/{kvm-cpus.c => kvm-accel-ops.c}     | 28 ++++++++---
 accel/kvm/kvm-all.c                           |  2 -
 accel/qtest/qtest.c                           | 23 ++++++---
 ...g-cpus-icount.c => tcg-accel-ops-icount.c} | 21 +++------
 ...tcg-cpus-mttcg.c => tcg-accel-ops-mttcg.c} | 14 ++----
 .../tcg/{tcg-cpus-rr.c => tcg-accel-ops-rr.c} | 13 ++---
 accel/tcg/{tcg-cpus.c => tcg-accel-ops.c}     | 47 ++++++++++++++++++-
 accel/tcg/tcg-all.c                           | 12 -----
 accel/xen/xen-all.c                           | 24 ++++++----
 bsd-user/main.c                               |  3 +-
 linux-user/main.c                             |  1 +
 softmmu/cpus.c                                | 12 ++---
 softmmu/vl.c                                  |  7 ++-
 .../i386/hax/{hax-cpus.c => hax-accel-ops.c}  | 33 +++++++++----
 target/i386/hax/hax-all.c                     |  5 +-
 target/i386/hax/hax-mem.c                     |  2 +-
 target/i386/hax/hax-posix.c                   |  2 +-
 target/i386/hax/hax-windows.c                 |  2 +-
 .../i386/hvf/{hvf-cpus.c => hvf-accel-ops.c}  | 29 +++++++++---
 target/i386/hvf/hvf.c                         |  3 +-
 target/i386/hvf/x86hvf.c                      |  2 +-
 .../whpx/{whpx-cpus.c => whpx-accel-ops.c}    | 33 +++++++++----
 target/i386/whpx/whpx-all.c                   |  7 +--
 MAINTAINERS                                   |  3 +-
 accel/kvm/meson.build                         |  2 +-
 accel/tcg/meson.build                         |  8 ++--
 target/i386/hax/meson.build                   |  2 +-
 target/i386/hvf/meson.build                   |  2 +-
 target/i386/whpx/meson.build                  |  2 +-
 44 files changed, 361 insertions(+), 163 deletions(-)
 create mode 100644 accel/accel-softmmu.h
 rename accel/tcg/{tcg-cpus-icount.h => tcg-accel-ops-icount.h} (88%)
 create mode 100644 accel/tcg/tcg-accel-ops-mttcg.h
 rename accel/tcg/{tcg-cpus-rr.h => tcg-accel-ops-rr.h} (100%)
 rename accel/tcg/{tcg-cpus.h => tcg-accel-ops.h} (72%)
 create mode 100644 include/sysemu/accel-ops.h
 rename target/i386/hax/{hax-cpus.h => hax-accel-ops.h} (95%)
 rename target/i386/hvf/{hvf-cpus.h => hvf-accel-ops.h} (94%)
 rename target/i386/whpx/{whpx-cpus.h => whpx-accel-ops.h} (96%)
 rename accel/kvm/{kvm-cpus.c => kvm-accel-ops.c} (72%)
 rename accel/tcg/{tcg-cpus-icount.c => tcg-accel-ops-icount.c} (89%)
 rename accel/tcg/{tcg-cpus-mttcg.c => tcg-accel-ops-mttcg.c} (92%)
 rename accel/tcg/{tcg-cpus-rr.c => tcg-accel-ops-rr.c} (97%)
 rename accel/tcg/{tcg-cpus.c => tcg-accel-ops.c} (63%)
 rename target/i386/hax/{hax-cpus.c => hax-accel-ops.c} (69%)
 rename target/i386/hvf/{hvf-cpus.c => hvf-accel-ops.c} (84%)
 rename target/i386/whpx/{whpx-cpus.c => whpx-accel-ops.c} (71%)

diff --git a/accel/accel-softmmu.h b/accel/accel-softmmu.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/accel/accel-softmmu.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU System Emulation accel internal functions
+ *
+ * Copyright 2021 SUSE LLC
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef ACCEL_SOFTMMU_H
+#define ACCEL_SOFTMMU_H
+
+void accel_init_ops_interfaces(AccelClass *ac);
+
+#endif /* ACCEL_SOFTMMU_H */
diff --git a/accel/kvm/kvm-cpus.h b/accel/kvm/kvm-cpus.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/kvm/kvm-cpus.h
+++ b/accel/kvm/kvm-cpus.h
@@ -XXX,XX +XXX,XX @@
 
 #include "sysemu/cpus.h"
 
-extern const CpusAccel kvm_cpus;
-
 int kvm_init_vcpu(CPUState *cpu, Error **errp);
 int kvm_cpu_exec(CPUState *cpu);
 void kvm_destroy_vcpu(CPUState *cpu);
diff --git a/accel/tcg/tcg-cpus-icount.h b/accel/tcg/tcg-accel-ops-icount.h
similarity index 88%
rename from accel/tcg/tcg-cpus-icount.h
rename to accel/tcg/tcg-accel-ops-icount.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-cpus-icount.h
+++ b/accel/tcg/tcg-accel-ops-icount.h
@@ -XXX,XX +XXX,XX @@ void icount_handle_deadline(void);
 void icount_prepare_for_run(CPUState *cpu);
 void icount_process_data(CPUState *cpu);
 
+void icount_handle_interrupt(CPUState *cpu, int mask);
+
 #endif /* TCG_CPUS_ICOUNT_H */
diff --git a/accel/tcg/tcg-accel-ops-mttcg.h b/accel/tcg/tcg-accel-ops-mttcg.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/accel/tcg/tcg-accel-ops-mttcg.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU TCG Multi Threaded vCPUs implementation
+ *
+ * Copyright 2021 SUSE LLC
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef TCG_CPUS_MTTCG_H
+#define TCG_CPUS_MTTCG_H
+
+/* kick MTTCG vCPU thread */
+void mttcg_kick_vcpu_thread(CPUState *cpu);
+
+/* start an mttcg vCPU thread */
+void mttcg_start_vcpu_thread(CPUState *cpu);
+
+#endif /* TCG_CPUS_MTTCG_H */
diff --git a/accel/tcg/tcg-cpus-rr.h b/accel/tcg/tcg-accel-ops-rr.h
similarity index 100%
rename from accel/tcg/tcg-cpus-rr.h
rename to accel/tcg/tcg-accel-ops-rr.h
diff --git a/accel/tcg/tcg-cpus.h b/accel/tcg/tcg-accel-ops.h
similarity index 72%
rename from accel/tcg/tcg-cpus.h
rename to accel/tcg/tcg-accel-ops.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-cpus.h
+++ b/accel/tcg/tcg-accel-ops.h
@@ -XXX,XX +XXX,XX @@
 
 #include "sysemu/cpus.h"
 
-extern const CpusAccel tcg_cpus_mttcg;
-extern const CpusAccel tcg_cpus_icount;
-extern const CpusAccel tcg_cpus_rr;
-
 void tcg_cpus_destroy(CPUState *cpu);
 int tcg_cpus_exec(CPUState *cpu);
-void tcg_cpus_handle_interrupt(CPUState *cpu, int mask);
+void tcg_handle_interrupt(CPUState *cpu, int mask);
 
 #endif /* TCG_CPUS_H */
diff --git a/include/qemu/accel.h b/include/qemu/accel.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/accel.h
+++ b/include/qemu/accel.h
@@ -XXX,XX +XXX,XX @@ typedef struct AccelClass {
 AccelClass *accel_find(const char *opt_name);
 AccelState *current_accel(void);
 
+void accel_init_interfaces(AccelClass *ac);
+
 #ifndef CONFIG_USER_ONLY
 int accel_init_machine(AccelState *accel, MachineState *ms);
 
diff --git a/include/sysemu/accel-ops.h b/include/sysemu/accel-ops.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/sysemu/accel-ops.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Accelerator OPS, used for cpus.c module
+ *
+ * Copyright 2021 SUSE LLC
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef ACCEL_OPS_H
+#define ACCEL_OPS_H
+
+#include "qom/object.h"
+
+#define ACCEL_OPS_SUFFIX "-ops"
+#define TYPE_ACCEL_OPS "accel" ACCEL_OPS_SUFFIX
+#define ACCEL_OPS_NAME(name) (name "-" TYPE_ACCEL_OPS)
+
+typedef struct AccelOpsClass AccelOpsClass;
+DECLARE_CLASS_CHECKERS(AccelOpsClass, ACCEL_OPS, TYPE_ACCEL_OPS)
+
+/* cpus.c operations interface */
+struct AccelOpsClass {
+    /*< private >*/
+    ObjectClass parent_class;
+    /*< public >*/
+
+    /* initialization function called when accel is chosen */
+    void (*ops_init)(AccelOpsClass *ops);
+
+    void (*create_vcpu_thread)(CPUState *cpu); /* MANDATORY NON-NULL */
+    void (*kick_vcpu_thread)(CPUState *cpu);
+
+    void (*synchronize_post_reset)(CPUState *cpu);
+    void (*synchronize_post_init)(CPUState *cpu);
+    void (*synchronize_state)(CPUState *cpu);
+    void (*synchronize_pre_loadvm)(CPUState *cpu);
+
+    void (*handle_interrupt)(CPUState *cpu, int mask);
+
+    int64_t (*get_virtual_clock)(void);
+    int64_t (*get_elapsed_ticks)(void);
+};
+
+#endif /* ACCEL_OPS_H */
diff --git a/include/sysemu/cpus.h b/include/sysemu/cpus.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/cpus.h
+++ b/include/sysemu/cpus.h
@@ -XXX,XX +XXX,XX @@
 #define QEMU_CPUS_H
 
 #include "qemu/timer.h"
+#include "sysemu/accel-ops.h"
 
-/* cpus.c */
+/* register accel-specific operations */
+void cpus_register_accel(const AccelOpsClass *i);
 
-/* CPU execution threads */
+/* accel/dummy-cpus.c */
 
-typedef struct CpusAccel {
-    void (*create_vcpu_thread)(CPUState *cpu); /* MANDATORY */
-    void (*kick_vcpu_thread)(CPUState *cpu);
-
-    void (*synchronize_post_reset)(CPUState *cpu);
-    void (*synchronize_post_init)(CPUState *cpu);
-    void (*synchronize_state)(CPUState *cpu);
-    void (*synchronize_pre_loadvm)(CPUState *cpu);
-
-    void (*handle_interrupt)(CPUState *cpu, int mask);
-
-    int64_t (*get_virtual_clock)(void);
-    int64_t (*get_elapsed_ticks)(void);
-} CpusAccel;
-
-/* register accel-specific cpus interface implementation */
-void cpus_register_accel(const CpusAccel *i);
-
-/* Create a dummy vcpu for CpusAccel->create_vcpu_thread */
+/* Create a dummy vcpu for AccelOpsClass->create_vcpu_thread */
 void dummy_start_vcpu_thread(CPUState *);
 
 /* interface available for cpus accelerator threads */
diff --git a/target/i386/hax/hax-cpus.h b/target/i386/hax/hax-accel-ops.h
similarity index 95%
rename from target/i386/hax/hax-cpus.h
rename to target/i386/hax/hax-accel-ops.h
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hax/hax-cpus.h
+++ b/target/i386/hax/hax-accel-ops.h
@@ -XXX,XX +XXX,XX @@
 
 #include "sysemu/cpus.h"
 
-extern const CpusAccel hax_cpus;
-
 #include "hax-interface.h"
 #include "hax-i386.h"
 
diff --git a/target/i386/hax/hax-windows.h b/target/i386/hax/hax-windows.h
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hax/hax-windows.h
+++ b/target/i386/hax/hax-windows.h
@@ -XXX,XX +XXX,XX @@
 #include <winioctl.h>
 #include <windef.h>
 
-#include "hax-cpus.h"
+#include "hax-accel-ops.h"
 
 #define HAX_INVALID_FD INVALID_HANDLE_VALUE
 
diff --git a/target/i386/hvf/hvf-cpus.h b/target/i386/hvf/hvf-accel-ops.h
similarity index 94%
rename from target/i386/hvf/hvf-cpus.h
rename to target/i386/hvf/hvf-accel-ops.h
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hvf/hvf-cpus.h
+++ b/target/i386/hvf/hvf-accel-ops.h
@@ -XXX,XX +XXX,XX @@
 
 #include "sysemu/cpus.h"
 
-extern const CpusAccel hvf_cpus;
-
 int hvf_init_vcpu(CPUState *);
 int hvf_vcpu_exec(CPUState *);
 void hvf_cpu_synchronize_state(CPUState *);
diff --git a/target/i386/whpx/whpx-cpus.h b/target/i386/whpx/whpx-accel-ops.h
similarity index 96%
rename from target/i386/whpx/whpx-cpus.h
rename to target/i386/whpx/whpx-accel-ops.h
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/whpx/whpx-cpus.h
+++ b/target/i386/whpx/whpx-accel-ops.h
@@ -XXX,XX +XXX,XX @@
 
 #include "sysemu/cpus.h"
 
-extern const CpusAccel whpx_cpus;
-
 int whpx_init_vcpu(CPUState *cpu);
 int whpx_vcpu_exec(CPUState *cpu);
 void whpx_destroy_vcpu(CPUState *cpu);
diff --git a/accel/accel-common.c b/accel/accel-common.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/accel-common.c
+++ b/accel/accel-common.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu/accel.h"
 
+#ifndef CONFIG_USER_ONLY
+#include "accel-softmmu.h"
+#endif /* !CONFIG_USER_ONLY */
+
 static const TypeInfo accel_type = {
     .name = TYPE_ACCEL,
     .parent = TYPE_OBJECT,
@@ -XXX,XX +XXX,XX @@ AccelClass *accel_find(const char *opt_name)
     return ac;
 }
 
+void accel_init_interfaces(AccelClass *ac)
+{
+#ifndef CONFIG_USER_ONLY
+    accel_init_ops_interfaces(ac);
+#endif /* !CONFIG_USER_ONLY */
+}
+
 static void register_accel_types(void)
 {
     type_register_static(&accel_type);
diff --git a/accel/accel-softmmu.c b/accel/accel-softmmu.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/accel-softmmu.c
+++ b/accel/accel-softmmu.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu/accel.h"
 #include "hw/boards.h"
-#include "sysemu/arch_init.h"
-#include "sysemu/sysemu.h"
-#include "qom/object.h"
+#include "sysemu/cpus.h"
+
+#include "accel-softmmu.h"
 
 int accel_init_machine(AccelState *accel, MachineState *ms)
 {
@@ -XXX,XX +XXX,XX @@ void accel_setup_post(MachineState *ms)
         acc->setup_post(ms, accel);
     }
 }
+
+/* initialize the arch-independent accel operation interfaces */
+void accel_init_ops_interfaces(AccelClass *ac)
+{
+    const char *ac_name;
+    char *ops_name;
+    AccelOpsClass *ops;
+
+    ac_name = object_class_get_name(OBJECT_CLASS(ac));
+    g_assert(ac_name != NULL);
+
+    ops_name = g_strdup_printf("%s" ACCEL_OPS_SUFFIX, ac_name);
+    ops = ACCEL_OPS_CLASS(object_class_by_name(ops_name));
+    g_free(ops_name);
+
+    /*
+     * all accelerators need to define ops, providing at least a mandatory
+     * non-NULL create_vcpu_thread operation.
+     */
+    g_assert(ops != NULL);
+    if (ops->ops_init) {
+        ops->ops_init(ops);
+    }
+    cpus_register_accel(ops);
+}
+
+static const TypeInfo accel_ops_type_info = {
+    .name = TYPE_ACCEL_OPS,
+    .parent = TYPE_OBJECT,
+    .abstract = true,
+    .class_size = sizeof(AccelOpsClass),
+};
+
+static void accel_softmmu_register_types(void)
+{
+    type_register_static(&accel_ops_type_info);
+}
+type_init(accel_softmmu_register_types);
diff --git a/accel/kvm/kvm-cpus.c b/accel/kvm/kvm-accel-ops.c
similarity index 72%
rename from accel/kvm/kvm-cpus.c
rename to accel/kvm/kvm-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/kvm/kvm-cpus.c
+++ b/accel/kvm/kvm-accel-ops.c
@@ -XXX,XX +XXX,XX @@ static void kvm_start_vcpu_thread(CPUState *cpu)
                        cpu, QEMU_THREAD_JOINABLE);
 }
 
-const CpusAccel kvm_cpus = {
-    .create_vcpu_thread = kvm_start_vcpu_thread,
+static void kvm_accel_ops_class_init(ObjectClass *oc, void *data)
+{
+    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 
-    .synchronize_post_reset = kvm_cpu_synchronize_post_reset,
-    .synchronize_post_init = kvm_cpu_synchronize_post_init,
-    .synchronize_state = kvm_cpu_synchronize_state,
-    .synchronize_pre_loadvm = kvm_cpu_synchronize_pre_loadvm,
+    ops->create_vcpu_thread = kvm_start_vcpu_thread;
+    ops->synchronize_post_reset = kvm_cpu_synchronize_post_reset;
+    ops->synchronize_post_init = kvm_cpu_synchronize_post_init;
+    ops->synchronize_state = kvm_cpu_synchronize_state;
+    ops->synchronize_pre_loadvm = kvm_cpu_synchronize_pre_loadvm;
+}
+
+static const TypeInfo kvm_accel_ops_type = {
+    .name = ACCEL_OPS_NAME("kvm"),
+
+    .parent = TYPE_ACCEL_OPS,
+    .class_init = kvm_accel_ops_class_init,
+    .abstract = true,
 };
+
+static void kvm_accel_ops_register_types(void)
+{
+    type_register_static(&kvm_accel_ops_type);
+}
+type_init(kvm_accel_ops_register_types);
diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -XXX,XX +XXX,XX @@ static int kvm_init(MachineState *ms)
         ret = ram_block_discard_disable(true);
         assert(!ret);
     }
-
-    cpus_register_accel(&kvm_cpus);
     return 0;
 
 err:
diff --git a/accel/qtest/qtest.c b/accel/qtest/qtest.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/qtest/qtest.c
+++ b/accel/qtest/qtest.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/main-loop.h"
 #include "hw/core/cpu.h"
 
-const CpusAccel qtest_cpus = {
-    .create_vcpu_thread = dummy_start_vcpu_thread,
-    .get_virtual_clock = qtest_get_virtual_clock,
-};
-
 static int qtest_init_accel(MachineState *ms)
 {
-    cpus_register_accel(&qtest_cpus);
     return 0;
 }
 
@@ -XXX,XX +XXX,XX @@ static const TypeInfo qtest_accel_type = {
     .class_init = qtest_accel_class_init,
 };
 
+static void qtest_accel_ops_class_init(ObjectClass *oc, void *data)
+{
+    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
+
+    ops->create_vcpu_thread = dummy_start_vcpu_thread;
+    ops->get_virtual_clock = qtest_get_virtual_clock;
+};
+
+static const TypeInfo qtest_accel_ops_type = {
+    .name = ACCEL_OPS_NAME("qtest"),
+
+    .parent = TYPE_ACCEL_OPS,
+    .class_init = qtest_accel_ops_class_init,
+    .abstract = true,
+};
+
 static void qtest_type_init(void)
 {
     type_register_static(&qtest_accel_type);
+    type_register_static(&qtest_accel_ops_type);
 }
 
 type_init(qtest_type_init);
diff --git a/accel/tcg/tcg-cpus-icount.c b/accel/tcg/tcg-accel-ops-icount.c
similarity index 89%
rename from accel/tcg/tcg-cpus-icount.c
rename to accel/tcg/tcg-accel-ops-icount.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-cpus-icount.c
+++ b/accel/tcg/tcg-accel-ops-icount.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/exec-all.h"
 #include "hw/boards.h"
 
-#include "tcg-cpus.h"
-#include "tcg-cpus-icount.h"
-#include "tcg-cpus-rr.h"
+#include "tcg-accel-ops.h"
+#include "tcg-accel-ops-icount.h"
+#include "tcg-accel-ops-rr.h"
 
 static int64_t icount_get_limit(void)
 {
@@ -XXX,XX +XXX,XX @@ void icount_prepare_for_run(CPUState *cpu)
     /*
      * These should always be cleared by icount_process_data after
      * each vCPU execution. However u16.high can be raised
-     * asynchronously by cpu_exit/cpu_interrupt/tcg_cpus_handle_interrupt
+     * asynchronously by cpu_exit/cpu_interrupt/tcg_handle_interrupt
      */
     g_assert(cpu_neg(cpu)->icount_decr.u16.low == 0);
     g_assert(cpu->icount_extra == 0);
@@ -XXX,XX +XXX,XX @@ void icount_process_data(CPUState *cpu)
     replay_mutex_unlock();
 }
 
-static void icount_handle_interrupt(CPUState *cpu, int mask)
+void icount_handle_interrupt(CPUState *cpu, int mask)
 {
     int old_mask = cpu->interrupt_request;
 
-    tcg_cpus_handle_interrupt(cpu, mask);
+    tcg_handle_interrupt(cpu, mask);
     if (qemu_cpu_is_self(cpu) &&
         !cpu->can_do_io
         && (mask & ~old_mask) != 0) {
         cpu_abort(cpu, "Raised interrupt while not in I/O function");
     }
 }
-
-const CpusAccel tcg_cpus_icount = {
-    .create_vcpu_thread = rr_start_vcpu_thread,
-    .kick_vcpu_thread = rr_kick_vcpu_thread,
-
-    .handle_interrupt = icount_handle_interrupt,
-    .get_virtual_clock = icount_get,
-    .get_elapsed_ticks = icount_get,
-};
diff --git a/accel/tcg/tcg-cpus-mttcg.c b/accel/tcg/tcg-accel-ops-mttcg.c
similarity index 92%
rename from accel/tcg/tcg-cpus-mttcg.c
rename to accel/tcg/tcg-accel-ops-mttcg.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-cpus-mttcg.c
+++ b/accel/tcg/tcg-accel-ops-mttcg.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/exec-all.h"
 #include "hw/boards.h"
 
-#include "tcg-cpus.h"
+#include "tcg-accel-ops.h"
+#include "tcg-accel-ops-mttcg.h"
 
 /*
  * In the multi-threaded case each vCPU has its own thread. The TLS
@@ -XXX,XX +XXX,XX @@ static void *mttcg_cpu_thread_fn(void *arg)
     return NULL;
 }
 
-static void mttcg_kick_vcpu_thread(CPUState *cpu)
+void mttcg_kick_vcpu_thread(CPUState *cpu)
 {
     cpu_exit(cpu);
 }
 
-static void mttcg_start_vcpu_thread(CPUState *cpu)
+void mttcg_start_vcpu_thread(CPUState *cpu)
 {
     char thread_name[VCPU_THREAD_NAME_SIZE];
 
@@ -XXX,XX +XXX,XX @@ static void mttcg_start_vcpu_thread(CPUState *cpu)
     cpu->hThread = qemu_thread_get_handle(cpu->thread);
 #endif
 }
-
-const CpusAccel tcg_cpus_mttcg = {
-    .create_vcpu_thread = mttcg_start_vcpu_thread,
-    .kick_vcpu_thread = mttcg_kick_vcpu_thread,
-
-    .handle_interrupt = tcg_cpus_handle_interrupt,
-};
diff --git a/accel/tcg/tcg-cpus-rr.c b/accel/tcg/tcg-accel-ops-rr.c
similarity index 97%
rename from accel/tcg/tcg-cpus-rr.c
rename to accel/tcg/tcg-accel-ops-rr.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-cpus-rr.c
+++ b/accel/tcg/tcg-accel-ops-rr.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/exec-all.h"
 #include "hw/boards.h"
 
-#include "tcg-cpus.h"
-#include "tcg-cpus-rr.h"
-#include "tcg-cpus-icount.h"
+#include "tcg-accel-ops.h"
+#include "tcg-accel-ops-rr.h"
+#include "tcg-accel-ops-icount.h"
 
 /* Kick all RR vCPUs */
 void rr_kick_vcpu_thread(CPUState *unused)
@@ -XXX,XX +XXX,XX @@ void rr_start_vcpu_thread(CPUState *cpu)
         cpu->created = true;
     }
 }
-
-const CpusAccel tcg_cpus_rr = {
-    .create_vcpu_thread = rr_start_vcpu_thread,
-    .kick_vcpu_thread = rr_kick_vcpu_thread,
-
-    .handle_interrupt = tcg_cpus_handle_interrupt,
-};
diff --git a/accel/tcg/tcg-cpus.c b/accel/tcg/tcg-accel-ops.c
similarity index 63%
rename from accel/tcg/tcg-cpus.c
rename to accel/tcg/tcg-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-cpus.c
+++ b/accel/tcg/tcg-accel-ops.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/exec-all.h"
 #include "hw/boards.h"
 
-#include "tcg-cpus.h"
+#include "tcg-accel-ops.h"
+#include "tcg-accel-ops-mttcg.h"
+#include "tcg-accel-ops-rr.h"
+#include "tcg-accel-ops-icount.h"
 
 /* common functionality among all TCG variants */
 
@@ -XXX,XX +XXX,XX @@ int tcg_cpus_exec(CPUState *cpu)
 }
 
 /* mask must never be zero, except for A20 change call */
-void tcg_cpus_handle_interrupt(CPUState *cpu, int mask)
+void tcg_handle_interrupt(CPUState *cpu, int mask)
 {
     g_assert(qemu_mutex_iothread_locked());
 
@@ -XXX,XX +XXX,XX @@ void tcg_cpus_handle_interrupt(CPUState *cpu, int mask)
         qatomic_set(&cpu_neg(cpu)->icount_decr.u16.high, -1);
     }
 }
+
+static void tcg_accel_ops_init(AccelOpsClass *ops)
+{
+    if (qemu_tcg_mttcg_enabled()) {
+        ops->create_vcpu_thread = mttcg_start_vcpu_thread;
+        ops->kick_vcpu_thread = mttcg_kick_vcpu_thread;
+        ops->handle_interrupt = tcg_handle_interrupt;
+    } else if (icount_enabled()) {
+        ops->create_vcpu_thread = rr_start_vcpu_thread;
+        ops->kick_vcpu_thread = rr_kick_vcpu_thread;
+        ops->handle_interrupt = icount_handle_interrupt;
+        ops->get_virtual_clock = icount_get;
+        ops->get_elapsed_ticks = icount_get;
+    } else {
+        ops->create_vcpu_thread = rr_start_vcpu_thread;
+        ops->kick_vcpu_thread = rr_kick_vcpu_thread;
+        ops->handle_interrupt = tcg_handle_interrupt;
+    }
+}
+
+static void tcg_accel_ops_class_init(ObjectClass *oc, void *data)
+{
+    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
+
+    ops->ops_init = tcg_accel_ops_init;
+}
+
+static const TypeInfo tcg_accel_ops_type = {
+    .name = ACCEL_OPS_NAME("tcg"),
+
+    .parent = TYPE_ACCEL_OPS,
+    .class_init = tcg_accel_ops_class_init,
+    .abstract = true,
+};
+
+static void tcg_accel_ops_register_types(void)
+{
+    type_register_static(&tcg_accel_ops_type);
+}
+type_init(tcg_accel_ops_register_types);
diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/accel.h"
 #include "qapi/qapi-builtin-visit.h"
 
-#ifndef CONFIG_USER_ONLY
-#include "tcg-cpus.h"
-#endif /* CONFIG_USER_ONLY */
-
 struct TCGState {
     AccelState parent_obj;
 
@@ -XXX,XX +XXX,XX @@ static int tcg_init(MachineState *ms)
      */
 #ifndef CONFIG_USER_ONLY
     tcg_region_init();
-
-    if (mttcg_enabled) {
-        cpus_register_accel(&tcg_cpus_mttcg);
-    } else if (icount_enabled()) {
-        cpus_register_accel(&tcg_cpus_icount);
-    } else {
-        cpus_register_accel(&tcg_cpus_rr);
-    }
 #endif /* !CONFIG_USER_ONLY */
 
     return 0;
diff --git a/accel/xen/xen-all.c b/accel/xen/xen-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/xen/xen-all.c
+++ b/accel/xen/xen-all.c
@@ -XXX,XX +XXX,XX @@ static void xen_setup_post(MachineState *ms, AccelState *accel)
     }
 }
 
-const CpusAccel xen_cpus = {
-    .create_vcpu_thread = dummy_start_vcpu_thread,
-};
-
 static int xen_init(MachineState *ms)
 {
     MachineClass *mc = MACHINE_GET_CLASS(ms);
@@ -XXX,XX +XXX,XX @@ static int xen_init(MachineState *ms)
      * opt out of system RAM being allocated by generic code
      */
     mc->default_ram_id = NULL;
-
-    cpus_register_accel(&xen_cpus);
-
     return 0;
 }
 
@@ -XXX,XX +XXX,XX @@ static const TypeInfo xen_accel_type = {
     .class_init = xen_accel_class_init,
 };
 
+static void xen_accel_ops_class_init(ObjectClass *oc, void *data)
+{
+    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
+
+    ops->create_vcpu_thread = dummy_start_vcpu_thread;
+}
+
+static const TypeInfo xen_accel_ops_type = {
+    .name = ACCEL_OPS_NAME("xen"),
+
+    .parent = TYPE_ACCEL_OPS,
+    .class_init = xen_accel_ops_class_init,
+    .abstract = true,
+};
+
 static void xen_type_init(void)
 {
     type_register_static(&xen_accel_type);
+    type_register_static(&xen_accel_ops_type);
 }
-
 type_init(xen_type_init);
diff --git a/bsd-user/main.c b/bsd-user/main.c
index XXXXXXX..XXXXXXX 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
 #endif
     }
 
+    cpu_type = parse_cpu_option(cpu_model);
     /* init tcg before creating CPUs and to get qemu_host_page_size */
     {
         AccelClass *ac = ACCEL_GET_CLASS(current_accel());
 
         ac->init_machine(NULL);
+        accel_init_interfaces(ac);
     }
-    cpu_type = parse_cpu_option(cpu_model);
     cpu = cpu_create(cpu_type);
     env = cpu->env_ptr;
 #if defined(TARGET_SPARC) || defined(TARGET_PPC)
diff --git a/linux-user/main.c b/linux-user/main.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp)
         AccelClass *ac = ACCEL_GET_CLASS(current_accel());
 
         ac->init_machine(NULL);
+        accel_init_interfaces(ac);
     }
     cpu = cpu_create(cpu_type);
     env = cpu->env_ptr;
diff --git a/softmmu/cpus.c b/softmmu/cpus.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/cpus.c
+++ b/softmmu/cpus.c
@@ -XXX,XX +XXX,XX @@ void hw_error(const char *fmt, ...)
 /*
  * The chosen accelerator is supposed to register this.
  */
-static const CpusAccel *cpus_accel;
+static const AccelOpsClass *cpus_accel;
 
 void cpu_synchronize_all_states(void)
 {
@@ -XXX,XX +XXX,XX @@ void cpu_remove_sync(CPUState *cpu)
     qemu_mutex_lock_iothread();
 }
 
-void cpus_register_accel(const CpusAccel *ca)
+void cpus_register_accel(const AccelOpsClass *ops)
 {
-    assert(ca != NULL);
-    assert(ca->create_vcpu_thread != NULL); /* mandatory */
-    cpus_accel = ca;
+    assert(ops != NULL);
+    assert(ops->create_vcpu_thread != NULL); /* mandatory */
+    cpus_accel = ops;
 }
 
 void qemu_init_vcpu(CPUState *cpu)
@@ -XXX,XX +XXX,XX @@ void qemu_init_vcpu(CPUState *cpu)
         cpu_address_space_init(cpu, 0, "cpu-memory", cpu->memory);
     }
 
-    /* accelerators all implement the CpusAccel interface */
+    /* accelerators all implement the AccelOpsClass */
     g_assert(cpus_accel != NULL && cpus_accel->create_vcpu_thread != NULL);
     cpus_accel->create_vcpu_thread(cpu);
 
diff --git a/softmmu/vl.c b/softmmu/vl.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/vl.c
+++ b/softmmu/vl.c
@@ -XXX,XX +XXX,XX @@ static bool object_create_early(const char *type, QemuOpts *opts)
         return false;
     }
 
-    /* Allocation of large amounts of memory may delay
+    /*
+     * Allocation of large amounts of memory may delay
      * chardev initialization for too long, and trigger timeouts
      * on software that waits for a monitor socket to be created
      * (e.g. libvirt).
@@ -XXX,XX +XXX,XX @@ void qemu_init(int argc, char **argv, char **envp)
      *
      * Machine compat properties: object_set_machine_compat_props().
      * Accelerator compat props: object_set_accelerator_compat_props(),
-     * called from configure_accelerator().
+     * called from do_configure_accelerator().
      */
 
     machine_class = MACHINE_GET_CLASS(current_machine);
@@ -XXX,XX +XXX,XX @@ void qemu_init(int argc, char **argv, char **envp)
     if (cpu_option) {
         current_machine->cpu_type = parse_cpu_option(cpu_option);
     }
+    /* NB: for machine none cpu_type could STILL be NULL here! */
+    accel_init_interfaces(ACCEL_GET_CLASS(current_machine->accelerator));
 
     qemu_resolve_machine_memdev();
     parse_numa_opts(current_machine);
diff --git a/target/i386/hax/hax-cpus.c b/target/i386/hax/hax-accel-ops.c
similarity index 69%
rename from target/i386/hax/hax-cpus.c
rename to target/i386/hax/hax-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hax/hax-cpus.c
+++ b/target/i386/hax/hax-accel-ops.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/cpus.h"
 #include "qemu/guest-random.h"
 
-#include "hax-cpus.h"
+#include "hax-accel-ops.h"
 
 static void *hax_cpu_thread_fn(void *arg)
 {
@@ -XXX,XX +XXX,XX @@ static void hax_start_vcpu_thread(CPUState *cpu)
 #endif
 }
 
-const CpusAccel hax_cpus = {
-    .create_vcpu_thread = hax_start_vcpu_thread,
-    .kick_vcpu_thread = hax_kick_vcpu_thread,
+static void hax_accel_ops_class_init(ObjectClass *oc, void *data)
+{
+    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 
-    .synchronize_post_reset = hax_cpu_synchronize_post_reset,
-    .synchronize_post_init = hax_cpu_synchronize_post_init,
-    .synchronize_state = hax_cpu_synchronize_state,
-    .synchronize_pre_loadvm = hax_cpu_synchronize_pre_loadvm,
+    ops->create_vcpu_thread = hax_start_vcpu_thread;
+    ops->kick_vcpu_thread = hax_kick_vcpu_thread;
+
+    ops->synchronize_post_reset = hax_cpu_synchronize_post_reset;
+    ops->synchronize_post_init = hax_cpu_synchronize_post_init;
+    ops->synchronize_state = hax_cpu_synchronize_state;
+    ops->synchronize_pre_loadvm = hax_cpu_synchronize_pre_loadvm;
+}
+
+static const TypeInfo hax_accel_ops_type = {
+    .name = ACCEL_OPS_NAME("hax"),
+
+    .parent = TYPE_ACCEL_OPS,
+    .class_init = hax_accel_ops_class_init,
+    .abstract = true,
 };
+
+static void hax_accel_ops_register_types(void)
+{
+    type_register_static(&hax_accel_ops_type);
+}
+type_init(hax_accel_ops_register_types);
diff --git a/target/i386/hax/hax-all.c b/target/i386/hax/hax-all.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hax/hax-all.c
+++ b/target/i386/hax/hax-all.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/runstate.h"
 #include "hw/boards.h"
 
-#include "hax-cpus.h"
+#include "hax-accel-ops.h"
 
 #define DEBUG_HAX 0
 
@@ -XXX,XX +XXX,XX @@ static int hax_accel_init(MachineState *ms)
                 !ret ? "working" : "not working",
                 !ret ? "fast virt" : "emulation");
     }
-    if (ret == 0) {
-        cpus_register_accel(&hax_cpus);
-    }
     return ret;
 }
 
diff --git a/target/i386/hax/hax-mem.c b/target/i386/hax/hax-mem.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hax/hax-mem.c
+++ b/target/i386/hax/hax-mem.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/address-spaces.h"
 #include "qemu/error-report.h"
 
-#include "hax-cpus.h"
+#include "hax-accel-ops.h"
 #include "qemu/queue.h"
 
 #define DEBUG_HAX_MEM 0
diff --git a/target/i386/hax/hax-posix.c b/target/i386/hax/hax-posix.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hax/hax-posix.c
+++ b/target/i386/hax/hax-posix.c
@@ -XXX,XX +XXX,XX @@
 #include <sys/ioctl.h>
 
 #include "sysemu/cpus.h"
-#include "hax-cpus.h"
+#include "hax-accel-ops.h"
 
 hax_fd hax_mod_open(void)
 {
diff --git a/target/i386/hax/hax-windows.c b/target/i386/hax/hax-windows.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hax/hax-windows.c
+++ b/target/i386/hax/hax-windows.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "hax-cpus.h"
+#include "hax-accel-ops.h"
 
 /*
  * return 0 when success, -1 when driver not loaded,
diff --git a/target/i386/hvf/hvf-cpus.c b/target/i386/hvf/hvf-accel-ops.c
similarity index 84%
rename from target/i386/hvf/hvf-cpus.c
rename to target/i386/hvf/hvf-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hvf/hvf-cpus.c
+++ b/target/i386/hvf/hvf-accel-ops.c
@@ -XXX,XX +XXX,XX @@
 #include "target/i386/cpu.h"
 #include "qemu/guest-random.h"
 
-#include "hvf-cpus.h"
+#include "hvf-accel-ops.h"
 
 /*
  * The HVF-specific vCPU thread function. This one should only run when the host
@@ -XXX,XX +XXX,XX @@ static void hvf_start_vcpu_thread(CPUState *cpu)
                        cpu, QEMU_THREAD_JOINABLE);
 }
 
-const CpusAccel hvf_cpus = {
-    .create_vcpu_thread = hvf_start_vcpu_thread,
+static void hvf_accel_ops_class_init(ObjectClass *oc, void *data)
+{
+    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 
-    .synchronize_post_reset = hvf_cpu_synchronize_post_reset,
-    .synchronize_post_init = hvf_cpu_synchronize_post_init,
-    .synchronize_state = hvf_cpu_synchronize_state,
-    .synchronize_pre_loadvm = hvf_cpu_synchronize_pre_loadvm,
+    ops->create_vcpu_thread = hvf_start_vcpu_thread;
+
+    ops->synchronize_post_reset = hvf_cpu_synchronize_post_reset;
+    ops->synchronize_post_init = hvf_cpu_synchronize_post_init;
+    ops->synchronize_state = hvf_cpu_synchronize_state;
+    ops->synchronize_pre_loadvm = hvf_cpu_synchronize_pre_loadvm;
 };
+static const TypeInfo hvf_accel_ops_type = {
+    .name = ACCEL_OPS_NAME("hvf"),
+
+    .parent = TYPE_ACCEL_OPS,
+    .class_init = hvf_accel_ops_class_init,
+    .abstract = true,
+};
+static void hvf_accel_ops_register_types(void)
+{
+    type_register_static(&hvf_accel_ops_type);
+}
+type_init(hvf_accel_ops_register_types);
diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hvf/hvf.c
+++ b/target/i386/hvf/hvf.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/accel.h"
 #include "target/i386/cpu.h"
 
-#include "hvf-cpus.h"
+#include "hvf-accel-ops.h"
 
 HVFState *hvf_state;
 
@@ -XXX,XX +XXX,XX @@ static int hvf_accel_init(MachineState *ms)
   
     hvf_state = s;
     memory_listener_register(&hvf_memory_listener, &address_space_memory);
-    cpus_register_accel(&hvf_cpus);
     return 0;
 }
 
diff --git a/target/i386/hvf/x86hvf.c b/target/i386/hvf/x86hvf.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hvf/x86hvf.c
+++ b/target/i386/hvf/x86hvf.c
@@ -XXX,XX +XXX,XX @@
 #include <Hypervisor/hv.h>
 #include <Hypervisor/hv_vmx.h>
 
-#include "hvf-cpus.h"
+#include "hvf-accel-ops.h"
 
 void hvf_set_segment(struct CPUState *cpu, struct vmx_segment *vmx_seg,
                      SegmentCache *qseg, bool is_tr)
diff --git a/target/i386/whpx/whpx-cpus.c b/target/i386/whpx/whpx-accel-ops.c
similarity index 71%
rename from target/i386/whpx/whpx-cpus.c
rename to target/i386/whpx/whpx-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/whpx/whpx-cpus.c
+++ b/target/i386/whpx/whpx-accel-ops.c
@@ -XXX,XX +XXX,XX @@
 
 #include "sysemu/whpx.h"
 #include "whpx-internal.h"
-#include "whpx-cpus.h"
+#include "whpx-accel-ops.h"
 
 static void *whpx_cpu_thread_fn(void *arg)
 {
@@ -XXX,XX +XXX,XX @@ static void whpx_kick_vcpu_thread(CPUState *cpu)
     }
 }
 
-const CpusAccel whpx_cpus = {
-    .create_vcpu_thread = whpx_start_vcpu_thread,
-    .kick_vcpu_thread = whpx_kick_vcpu_thread,
+static void whpx_accel_ops_class_init(ObjectClass *oc, void *data)
+{
+    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 
-    .synchronize_post_reset = whpx_cpu_synchronize_post_reset,
-    .synchronize_post_init = whpx_cpu_synchronize_post_init,
-    .synchronize_state = whpx_cpu_synchronize_state,
-    .synchronize_pre_loadvm = whpx_cpu_synchronize_pre_loadvm,
+    ops->create_vcpu_thread = whpx_start_vcpu_thread;
+    ops->kick_vcpu_thread = whpx_kick_vcpu_thread;
+
+    ops->synchronize_post_reset = whpx_cpu_synchronize_post_reset;
+    ops->synchronize_post_init = whpx_cpu_synchronize_post_init;
+    ops->synchronize_state = whpx_cpu_synchronize_state;
+    ops->synchronize_pre_loadvm = whpx_cpu_synchronize_pre_loadvm;
+}
+
+static const TypeInfo whpx_accel_ops_type = {
+    .name = ACCEL_OPS_NAME("whpx"),
+
+    .parent = TYPE_ACCEL_OPS,
+    .class_init = whpx_accel_ops_class_init,
+    .abstract = true,
 };
+
+static void whpx_accel_ops_register_types(void)
+{
+    type_register_static(&whpx_accel_ops_type);
+}
+type_init(whpx_accel_ops_register_types);
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -XXX,XX +XXX,XX @@
 #include "migration/blocker.h"
 #include <winerror.h>
 
-#include "whpx-cpus.h"
 #include "whpx-internal.h"
+#include "whpx-accel-ops.h"
+
+#include <WinHvPlatform.h>
+#include <WinHvEmulation.h>
 
 #define HYPERV_APIC_BUS_FREQUENCY      (200000000ULL)
 
@@ -XXX,XX +XXX,XX @@ static int whpx_accel_init(MachineState *ms)
 
     whpx_memory_init();
 
-    cpus_register_accel(&whpx_cpus);
-
     printf("Windows Hypervisor Platform accelerator is operational\n");
     return 0;
 
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ M: Richard Henderson <richard.henderson@linaro.org>
 R: Paolo Bonzini <pbonzini@redhat.com>
 S: Maintained
 F: include/qemu/accel.h
-F: accel/accel.c
+F: include/sysemu/accel-ops.h
+F: accel/accel-*.c
 F: accel/Makefile.objs
 F: accel/stubs/Makefile.objs
 
diff --git a/accel/kvm/meson.build b/accel/kvm/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/accel/kvm/meson.build
+++ b/accel/kvm/meson.build
@@ -XXX,XX +XXX,XX @@
 kvm_ss = ss.source_set()
 kvm_ss.add(files(
   'kvm-all.c',
-  'kvm-cpus.c',
+  'kvm-accel-ops.c',
 ))
 kvm_ss.add(when: 'CONFIG_SEV', if_false: files('sev-stub.c'))
 
diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/meson.build
+++ b/accel/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_ss)
 
 specific_ss.add(when: ['CONFIG_SOFTMMU', 'CONFIG_TCG'], if_true: files(
   'cputlb.c',
-  'tcg-cpus.c',
-  'tcg-cpus-mttcg.c',
-  'tcg-cpus-icount.c',
-  'tcg-cpus-rr.c'
+  'tcg-accel-ops.c',
+  'tcg-accel-ops-mttcg.c',
+  'tcg-accel-ops-icount.c',
+  'tcg-accel-ops-rr.c'
 ))
diff --git a/target/i386/hax/meson.build b/target/i386/hax/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hax/meson.build
+++ b/target/i386/hax/meson.build
@@ -XXX,XX +XXX,XX @@
 i386_softmmu_ss.add(when: 'CONFIG_HAX', if_true: files(
   'hax-all.c',
   'hax-mem.c',
-  'hax-cpus.c',
+  'hax-accel-ops.c',
 ))
 i386_softmmu_ss.add(when: ['CONFIG_HAX', 'CONFIG_POSIX'], if_true: files('hax-posix.c'))
 i386_softmmu_ss.add(when: ['CONFIG_HAX', 'CONFIG_WIN32'], if_true: files('hax-windows.c'))
diff --git a/target/i386/hvf/meson.build b/target/i386/hvf/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hvf/meson.build
+++ b/target/i386/hvf/meson.build
@@ -XXX,XX +XXX,XX @@
 i386_softmmu_ss.add(when: [hvf, 'CONFIG_HVF'], if_true: files(
   'hvf.c',
-  'hvf-cpus.c',
+  'hvf-accel-ops.c',
   'x86.c',
   'x86_cpuid.c',
   'x86_decode.c',
diff --git a/target/i386/whpx/meson.build b/target/i386/whpx/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/whpx/meson.build
+++ b/target/i386/whpx/meson.build
@@ -XXX,XX +XXX,XX @@
 i386_softmmu_ss.add(when: 'CONFIG_WHPX', if_true: files(
   'whpx-all.c',
   'whpx-apic.c',
-  'whpx-cpus.c',
+  'whpx-accel-ops.c',
 ))
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

add a new optional interface to CPUClass, which allows accelerators
to extend the CPUClass with additional accelerator-specific
initializations.

This will allow to separate the target cpu code that is specific
to each accelerator, and register it automatically with object
hierarchy lookup depending on accelerator code availability,
as part of the accel_init_interfaces() initialization step.

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Message-Id: <20210204163931.7358-19-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/accel-cpu.h | 38 ++++++++++++++++++++++++++++++++
 include/hw/core/cpu.h       |  4 ++++
 accel/accel-common.c        | 44 +++++++++++++++++++++++++++++++++++++
 MAINTAINERS                 |  1 +
 4 files changed, 87 insertions(+)
 create mode 100644 include/hw/core/accel-cpu.h

diff --git a/include/hw/core/accel-cpu.h b/include/hw/core/accel-cpu.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/core/accel-cpu.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Accelerator interface, specializes CPUClass
+ * This header is used only by target-specific code.
+ *
+ * Copyright 2021 SUSE LLC
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef ACCEL_CPU_H
+#define ACCEL_CPU_H
+
+/*
+ * This header is used to define new accelerator-specific target-specific
+ * accelerator cpu subclasses.
+ * It uses CPU_RESOLVING_TYPE, so this is clearly target-specific.
+ *
+ * Do not try to use for any other purpose than the implementation of new
+ * subclasses in target/, or the accel implementation itself in accel/
+ */
+
+#define TYPE_ACCEL_CPU "accel-" CPU_RESOLVING_TYPE
+#define ACCEL_CPU_NAME(name) (name "-" TYPE_ACCEL_CPU)
+typedef struct AccelCPUClass AccelCPUClass;
+DECLARE_CLASS_CHECKERS(AccelCPUClass, ACCEL_CPU, TYPE_ACCEL_CPU)
+
+typedef struct AccelCPUClass {
+    /*< private >*/
+    ObjectClass parent_class;
+    /*< public >*/
+
+    void (*cpu_class_init)(CPUClass *cc);
+    void (*cpu_instance_init)(CPUState *cpu);
+    void (*cpu_realizefn)(CPUState *cpu, Error **errp);
+} AccelCPUClass;
+
+#endif /* ACCEL_CPU_H */
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ struct TranslationBlock;
 /* see tcg-cpu-ops.h */
 struct TCGCPUOps;
 
+/* see accel-cpu.h */
+struct AccelCPUClass;
+
 /**
  * CPUClass:
  * @class_by_name: Callback to map -cpu command line model name to an
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     /* Keep non-pointer data at the end to minimize holes.  */
     int gdb_num_core_regs;
     bool gdb_stop_before_watchpoint;
+    struct AccelCPUClass *accel_cpu;
 
     /* when TCG is not available, this pointer is NULL */
     struct TCGCPUOps *tcg_ops;
diff --git a/accel/accel-common.c b/accel/accel-common.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/accel-common.c
+++ b/accel/accel-common.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu/accel.h"
 
+#include "cpu.h"
+#include "hw/core/accel-cpu.h"
+
 #ifndef CONFIG_USER_ONLY
 #include "accel-softmmu.h"
 #endif /* !CONFIG_USER_ONLY */
@@ -XXX,XX +XXX,XX @@ AccelClass *accel_find(const char *opt_name)
     return ac;
 }
 
+static void accel_init_cpu_int_aux(ObjectClass *klass, void *opaque)
+{
+    CPUClass *cc = CPU_CLASS(klass);
+    AccelCPUClass *accel_cpu = opaque;
+
+    cc->accel_cpu = accel_cpu;
+    if (accel_cpu->cpu_class_init) {
+        accel_cpu->cpu_class_init(cc);
+    }
+}
+
+/* initialize the arch-specific accel CpuClass interfaces */
+static void accel_init_cpu_interfaces(AccelClass *ac)
+{
+    const char *ac_name; /* AccelClass name */
+    char *acc_name;      /* AccelCPUClass name */
+    ObjectClass *acc;    /* AccelCPUClass */
+
+    ac_name = object_class_get_name(OBJECT_CLASS(ac));
+    g_assert(ac_name != NULL);
+
+    acc_name = g_strdup_printf("%s-%s", ac_name, CPU_RESOLVING_TYPE);
+    acc = object_class_by_name(acc_name);
+    g_free(acc_name);
+
+    if (acc) {
+        object_class_foreach(accel_init_cpu_int_aux,
+                             CPU_RESOLVING_TYPE, false, acc);
+    }
+}
+
 void accel_init_interfaces(AccelClass *ac)
 {
 #ifndef CONFIG_USER_ONLY
     accel_init_ops_interfaces(ac);
 #endif /* !CONFIG_USER_ONLY */
+
+    accel_init_cpu_interfaces(ac);
 }
 
+static const TypeInfo accel_cpu_type = {
+    .name = TYPE_ACCEL_CPU,
+    .parent = TYPE_OBJECT,
+    .abstract = true,
+    .class_size = sizeof(AccelCPUClass),
+};
+
 static void register_accel_types(void)
 {
     type_register_static(&accel_type);
+    type_register_static(&accel_cpu_type);
 }
 
 type_init(register_accel_types);
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ R: Paolo Bonzini <pbonzini@redhat.com>
 S: Maintained
 F: include/qemu/accel.h
 F: include/sysemu/accel-ops.h
+F: include/hw/core/accel-cpu.h
 F: accel/accel-*.c
 F: accel/Makefile.objs
 F: accel/stubs/Makefile.objs
-- 
2.25.1

The following changes since commit aa3a285b5bc56a4208b3b57d4a55291e9c260107:

Merge tag 'mem-2024-12-21' of https://github.com/davidhildenbrand/qemu into staging (2024-12-22 14:33:27 -0500)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20241224

for you to fetch changes up to e4a8e093dc74be049f4829831dce76e5edab0003:

accel/tcg: Move gen_intermediate_code to TCGCPUOps.translate_core (2024-12-24 08:32:15 -0800)

----------------------------------------------------------------
tcg/optimize: Remove in-flight mask data from OptContext
fpu: Add float*_muladd_scalbn
fpu: Remove float_muladd_halve_result
fpu: Add float_round_nearest_even_max
fpu: Add float_muladd_suppress_add_product_zero
target/hexagon: Use float32_muladd
accel/tcg: Move gen_intermediate_code to TCGCPUOps.translate_core

----------------------------------------------------------------
Ilya Leoshkevich (1):
      tests/tcg: Do not use inttypes.h in multiarch/system/memory.c

Pierrick Bouvier (1):
      plugins: optimize cpu_index code generation

Richard Henderson (70):
      tcg/optimize: Split out finish_bb, finish_ebb
      tcg/optimize: Split out fold_affected_mask
      tcg/optimize: Copy mask writeback to fold_masks
      tcg/optimize: Split out fold_masks_zs
      tcg/optimize: Augment s_mask from z_mask in fold_masks_zs
      tcg/optimize: Change representation of s_mask
      tcg/optimize: Use finish_folding in fold_add, fold_add_vec, fold_addsub2
      tcg/optimize: Introduce const value accessors for TempOptInfo
      tcg/optimize: Use fold_masks_zs in fold_and
      tcg/optimize: Use fold_masks_zs in fold_andc
      tcg/optimize: Use fold_masks_zs in fold_bswap
      tcg/optimize: Use fold_masks_zs in fold_count_zeros
      tcg/optimize: Use fold_masks_z in fold_ctpop
      tcg/optimize: Use fold_and and fold_masks_z in fold_deposit
      tcg/optimize: Compute sign mask in fold_deposit
      tcg/optimize: Use finish_folding in fold_divide
      tcg/optimize: Use finish_folding in fold_dup, fold_dup2
      tcg/optimize: Use fold_masks_s in fold_eqv
      tcg/optimize: Use fold_masks_z in fold_extract
      tcg/optimize: Use finish_folding in fold_extract2
      tcg/optimize: Use fold_masks_zs in fold_exts
      tcg/optimize: Use fold_masks_z in fold_extu
      tcg/optimize: Use fold_masks_zs in fold_movcond
      tcg/optimize: Use finish_folding in fold_mul*
      tcg/optimize: Use fold_masks_s in fold_nand
      tcg/optimize: Use fold_masks_z in fold_neg_no_const
      tcg/optimize: Use fold_masks_s in fold_nor
      tcg/optimize: Use fold_masks_s in fold_not
      tcg/optimize: Use fold_masks_zs in fold_or
      tcg/optimize: Use fold_masks_zs in fold_orc
      tcg/optimize: Use fold_masks_zs in fold_qemu_ld
      tcg/optimize: Return true from fold_qemu_st, fold_tcg_st
      tcg/optimize: Use finish_folding in fold_remainder
      tcg/optimize: Distinguish simplification in fold_setcond_zmask
      tcg/optimize: Use fold_masks_z in fold_setcond
      tcg/optimize: Use fold_masks_s in fold_negsetcond
      tcg/optimize: Use fold_masks_z in fold_setcond2
      tcg/optimize: Use finish_folding in fold_cmp_vec
      tcg/optimize: Use finish_folding in fold_cmpsel_vec
      tcg/optimize: Use fold_masks_zs in fold_sextract
      tcg/optimize: Use fold_masks_zs, fold_masks_s in fold_shift
      tcg/optimize: Simplify sign bit test in fold_shift
      tcg/optimize: Use finish_folding in fold_sub, fold_sub_vec
      tcg/optimize: Use fold_masks_zs in fold_tcg_ld
      tcg/optimize: Use finish_folding in fold_tcg_ld_memcopy
      tcg/optimize: Use fold_masks_zs in fold_xor
      tcg/optimize: Use finish_folding in fold_bitsel_vec
      tcg/optimize: Use finish_folding as default in tcg_optimize
      tcg/optimize: Remove z_mask, s_mask from OptContext
      tcg/optimize: Re-enable sign-mask optimizations
      tcg/optimize: Move fold_bitsel_vec into alphabetic sort
      tcg/optimize: Move fold_cmp_vec, fold_cmpsel_vec into alphabetic sort
      softfloat: Add float{16,32,64}_muladd_scalbn
      target/arm: Use float*_muladd_scalbn
      target/sparc: Use float*_muladd_scalbn
      softfloat: Remove float_muladd_halve_result
      softfloat: Add float_round_nearest_even_max
      softfloat: Add float_muladd_suppress_add_product_zero
      target/hexagon: Use float32_mul in helper_sfmpy
      target/hexagon: Use float32_muladd for helper_sffma
      target/hexagon: Use float32_muladd for helper_sffms
      target/hexagon: Use float32_muladd_scalbn for helper_sffma_sc
      target/hexagon: Use float32_muladd for helper_sffm[as]_lib
      target/hexagon: Remove internal_fmafx
      target/hexagon: Expand GEN_XF_ROUND
      target/hexagon: Remove Float
      target/hexagon: Remove Double
      target/hexagon: Use mulu64 for int128_mul_6464
      target/hexagon: Simplify internal_mpyhh setup
      accel/tcg: Move gen_intermediate_code to TCGCPUOps.translate_core

From: Ilya Leoshkevich <iii@linux.ibm.com>

make check-tcg fails on Fedora with the following error message:

alpha-linux-gnu-gcc [...] qemu/tests/tcg/multiarch/system/memory.c -o memory [...]
    qemu/tests/tcg/multiarch/system/memory.c:17:10: fatal error: inttypes.h: No such file or directory
       17 | #include <inttypes.h>
          |          ^~~~~~~~~~~~
    compilation terminated.

The reason is that Fedora has cross-compilers, but no cross-glibc
headers. Fix by hardcoding the format specifiers and dropping the
include.

An alternative fix would be to introduce a configure check for
inttypes.h. But this would make it impossible to use Fedora
cross-compilers for softmmu tests, which used to work so far.

Fixes: ecbcc9ead2f8 ("tests/tcg: add a system test to check memory instrumentation")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20241010085906.226249-1-iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tests/tcg/multiarch/system/memory.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/tests/tcg/multiarch/system/memory.c b/tests/tcg/multiarch/system/memory.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/multiarch/system/memory.c
+++ b/tests/tcg/multiarch/system/memory.c
@@ -XXX,XX +XXX,XX @@
 
 #include <stdint.h>
 #include <stdbool.h>
-#include <inttypes.h>
 #include <minilib.h>
 
 #ifndef CHECK_UNALIGNED
@@ -XXX,XX +XXX,XX @@ int main(void)
     int i;
     bool ok = true;
 
-    ml_printf("Test data start: 0x%"PRIxPTR"\n", &test_data[0]);
-    ml_printf("Test data end: 0x%"PRIxPTR"\n", &test_data[TEST_SIZE]);
+    ml_printf("Test data start: 0x%lx\n", (unsigned long)&test_data[0]);
+    ml_printf("Test data end: 0x%lx\n", (unsigned long)&test_data[TEST_SIZE]);
 
     /* Run through the unsigned tests first */
     for (i = 0; i < ARRAY_SIZE(init_ufns) && ok; i++) {
@@ -XXX,XX +XXX,XX @@ int main(void)
         ok = do_signed_reads(true);
     }
 
-    ml_printf("Test data read: %"PRId32"\n", test_read_count);
-    ml_printf("Test data write: %"PRId32"\n", test_write_count);
+    ml_printf("Test data read: %lu\n", (unsigned long)test_read_count);
+    ml_printf("Test data write: %lu\n", (unsigned long)test_write_count);
     ml_printf("Test complete: %s\n", ok ? "PASSED" : "FAILED");
     return ok ? 0 : -1;
 }
-- 
2.43.0

From: Pierrick Bouvier <pierrick.bouvier@linaro.org>

When running with a single vcpu, we can return a constant instead of a
load when accessing cpu_index.
A side effect is that all tcg operations using it are optimized, most
notably scoreboard access.
When running a simple loop in user-mode, the speedup is around 20%.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20241128213843.1023080-1-pierrick.bouvier@linaro.org>
---
 accel/tcg/plugin-gen.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/plugin-gen.c
+++ b/accel/tcg/plugin-gen.c
@@ -XXX,XX +XXX,XX @@ static void gen_disable_mem_helper(void)
 
 static TCGv_i32 gen_cpu_index(void)
 {
+    /*
+     * Optimize when we run with a single vcpu. All values using cpu_index,
+     * including scoreboard index, will be optimized out.
+     * User-mode calls tb_flush when setting this flag. In system-mode, all
+     * vcpus are created before generating code.
+     */
+    if (!tcg_cflags_has(current_cpu, CF_PARALLEL)) {
+        return tcg_constant_i32(current_cpu->cpu_index);
+    }
     TCGv_i32 cpu_index = tcg_temp_ebb_new_i32();
     tcg_gen_ld_i32(cpu_index, tcg_env,
                    -offsetof(ArchCPU, env) + offsetof(CPUState, cpu_index));
-- 
2.43.0

Call them directly from the opcode switch statement in tcg_optimize,
rather than in finish_folding based on opcode flags.  Adjust folding
of conditional branches to match.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 47 +++++++++++++++++++++++++++++++----------------
 1 file changed, 31 insertions(+), 16 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static void copy_propagate(OptContext *ctx, TCGOp *op,
     }
 }
 
+static void finish_bb(OptContext *ctx)
+{
+    /* We only optimize memory barriers across basic blocks. */
+    ctx->prev_mb = NULL;
+}
+
+static void finish_ebb(OptContext *ctx)
+{
+    finish_bb(ctx);
+    /* We only optimize across extended basic blocks. */
+    memset(&ctx->temps_used, 0, sizeof(ctx->temps_used));
+    remove_mem_copy_all(ctx);
+}
+
 static void finish_folding(OptContext *ctx, TCGOp *op)
 {
     const TCGOpDef *def = &tcg_op_defs[op->opc];
     int i, nb_oargs;
 
-    /*
-     * We only optimize extended basic blocks.  If the opcode ends a BB
-     * and is not a conditional branch, reset all temp data.
-     */
-    if (def->flags & TCG_OPF_BB_END) {
-        ctx->prev_mb = NULL;
-        if (!(def->flags & TCG_OPF_COND_BRANCH)) {
-            memset(&ctx->temps_used, 0, sizeof(ctx->temps_used));
-            remove_mem_copy_all(ctx);
-        }
-        return;
-    }
-
     nb_oargs = def->nb_oargs;
     for (i = 0; i < nb_oargs; i++) {
         TCGTemp *ts = arg_temp(op->args[i]);
@@ -XXX,XX +XXX,XX @@ static bool fold_brcond(OptContext *ctx, TCGOp *op)
     if (i > 0) {
         op->opc = INDEX_op_br;
         op->args[0] = op->args[3];
+        finish_ebb(ctx);
+    } else {
+        finish_bb(ctx);
     }
-    return false;
+    return true;
 }
 
 static bool fold_brcond2(OptContext *ctx, TCGOp *op)
@@ -XXX,XX +XXX,XX @@ static bool fold_brcond2(OptContext *ctx, TCGOp *op)
         }
         op->opc = INDEX_op_br;
         op->args[0] = label;
-        break;
+        finish_ebb(ctx);
+        return true;
     }
-    return false;
+
+    finish_bb(ctx);
+    return true;
 }
 
 static bool fold_bswap(OptContext *ctx, TCGOp *op)
@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
         CASE_OP_32_64_VEC(xor):
             done = fold_xor(&ctx, op);
             break;
+        case INDEX_op_set_label:
+        case INDEX_op_br:
+        case INDEX_op_exit_tb:
+        case INDEX_op_goto_tb:
+        case INDEX_op_goto_ptr:
+            finish_ebb(&ctx);
+            done = true;
+            break;
         default:
             break;
         }
-- 
2.43.0

There are only a few logical operations which can compute
an "affected" mask.  Split out handling of this optimization
to a separate function, only to be called when applicable.

Remove the a_mask field from OptContext, as the mask is
no longer stored anywhere.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 42 +++++++++++++++++++++++++++---------------
 1 file changed, 27 insertions(+), 15 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ typedef struct OptContext {
     QSIMPLEQ_HEAD(, MemCopyInfo) mem_free;
 
     /* In flight values from optimization. */
-    uint64_t a_mask;  /* mask bit is 0 iff value identical to first input */
     uint64_t z_mask;  /* mask bit is 0 iff value bit is 0 */
     uint64_t s_mask;  /* mask of clrsb(value) bits */
     TCGType type;
@@ -XXX,XX +XXX,XX @@ static bool fold_const2_commutative(OptContext *ctx, TCGOp *op)
 
 static bool fold_masks(OptContext *ctx, TCGOp *op)
 {
-    uint64_t a_mask = ctx->a_mask;
     uint64_t z_mask = ctx->z_mask;
     uint64_t s_mask = ctx->s_mask;
 
@@ -XXX,XX +XXX,XX @@ static bool fold_masks(OptContext *ctx, TCGOp *op)
      * type changing opcodes.
      */
     if (ctx->type == TCG_TYPE_I32) {
-        a_mask = (int32_t)a_mask;
         z_mask = (int32_t)z_mask;
         s_mask |= MAKE_64BIT_MASK(32, 32);
         ctx->z_mask = z_mask;
@@ -XXX,XX +XXX,XX @@ static bool fold_masks(OptContext *ctx, TCGOp *op)
     if (z_mask == 0) {
         return tcg_opt_gen_movi(ctx, op, op->args[0], 0);
     }
+    return false;
+}
+
+/*
+ * An "affected" mask bit is 0 if and only if the result is identical
+ * to the first input.  Thus if the entire mask is 0, the operation
+ * is equivalent to a copy.
+ */
+static bool fold_affected_mask(OptContext *ctx, TCGOp *op, uint64_t a_mask)
+{
+    if (ctx->type == TCG_TYPE_I32) {
+        a_mask = (uint32_t)a_mask;
+    }
     if (a_mask == 0) {
         return tcg_opt_gen_mov(ctx, op, op->args[0], op->args[1]);
     }
@@ -XXX,XX +XXX,XX @@ static bool fold_and(OptContext *ctx, TCGOp *op)
      * Known-zeros does not imply known-ones.  Therefore unless
      * arg2 is constant, we can't infer affected bits from it.
      */
-    if (arg_is_const(op->args[2])) {
-        ctx->a_mask = z1 & ~z2;
+    if (arg_is_const(op->args[2]) &&
+        fold_affected_mask(ctx, op, z1 & ~z2)) {
+        return true;
     }
 
     return fold_masks(ctx, op);
@@ -XXX,XX +XXX,XX @@ static bool fold_andc(OptContext *ctx, TCGOp *op)
      */
     if (arg_is_const(op->args[2])) {
         uint64_t z2 = ~arg_info(op->args[2])->z_mask;
-        ctx->a_mask = z1 & ~z2;
+        if (fold_affected_mask(ctx, op, z1 & ~z2)) {
+            return true;
+        }
         z1 &= z2;
     }
     ctx->z_mask = z1;
@@ -XXX,XX +XXX,XX @@ static bool fold_extract(OptContext *ctx, TCGOp *op)
 
     z_mask_old = arg_info(op->args[1])->z_mask;
     z_mask = extract64(z_mask_old, pos, len);
-    if (pos == 0) {
-        ctx->a_mask = z_mask_old ^ z_mask;
+    if (pos == 0 && fold_affected_mask(ctx, op, z_mask_old ^ z_mask)) {
+        return true;
     }
     ctx->z_mask = z_mask;
     ctx->s_mask = smask_from_zmask(z_mask);
@@ -XXX,XX +XXX,XX @@ static bool fold_exts(OptContext *ctx, TCGOp *op)
 
     ctx->z_mask = z_mask;
     ctx->s_mask = s_mask;
-    if (!type_change) {
-        ctx->a_mask = s_mask & ~s_mask_old;
+    if (!type_change && fold_affected_mask(ctx, op, s_mask & ~s_mask_old)) {
+        return true;
     }
 
     return fold_masks(ctx, op);
@@ -XXX,XX +XXX,XX @@ static bool fold_extu(OptContext *ctx, TCGOp *op)
 
     ctx->z_mask = z_mask;
     ctx->s_mask = smask_from_zmask(z_mask);
-    if (!type_change) {
-        ctx->a_mask = z_mask_old ^ z_mask;
+    if (!type_change && fold_affected_mask(ctx, op, z_mask_old ^ z_mask)) {
+        return true;
     }
     return fold_masks(ctx, op);
 }
@@ -XXX,XX +XXX,XX @@ static bool fold_sextract(OptContext *ctx, TCGOp *op)
     s_mask |= MAKE_64BIT_MASK(len, 64 - len);
     ctx->s_mask = s_mask;
 
-    if (pos == 0) {
-        ctx->a_mask = s_mask & ~s_mask_old;
+    if (pos == 0 && fold_affected_mask(ctx, op, s_mask & ~s_mask_old)) {
+        return true;
     }
 
     return fold_masks(ctx, op);
@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
         }
 
         /* Assume all bits affected, no bits known zero, no sign reps. */
-        ctx.a_mask = -1;
         ctx.z_mask = -1;
         ctx.s_mask = 0;
 
-- 
2.43.0

Use of fold_masks should be restricted to those opcodes that
can reliably make use of it -- those with a single output,
and from higher-level folders that set up the masks.
Prepare for conversion of each folder in turn.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static bool fold_masks(OptContext *ctx, TCGOp *op)
 {
     uint64_t z_mask = ctx->z_mask;
     uint64_t s_mask = ctx->s_mask;
+    const TCGOpDef *def = &tcg_op_defs[op->opc];
+    TCGTemp *ts;
+    TempOptInfo *ti;
+
+    /* Only single-output opcodes are supported here. */
+    tcg_debug_assert(def->nb_oargs == 1);
 
     /*
      * 32-bit ops generate 32-bit results, which for the purpose of
@@ -XXX,XX +XXX,XX @@ static bool fold_masks(OptContext *ctx, TCGOp *op)
     if (ctx->type == TCG_TYPE_I32) {
         z_mask = (int32_t)z_mask;
         s_mask |= MAKE_64BIT_MASK(32, 32);
-        ctx->z_mask = z_mask;
-        ctx->s_mask = s_mask;
     }
 
     if (z_mask == 0) {
         return tcg_opt_gen_movi(ctx, op, op->args[0], 0);
     }
-    return false;
+
+    ts = arg_temp(op->args[0]);
+    reset_ts(ctx, ts);
+
+    ti = ts_info(ts);
+    ti->z_mask = z_mask;
+    ti->s_mask = s_mask;
+    return true;
 }
 
 /*
-- 
2.43.0

Add a routine to which masks can be passed directly, rather than
storing them into OptContext.  To be used in upcoming patches.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static bool fold_const2_commutative(OptContext *ctx, TCGOp *op)
     return fold_const2(ctx, op);
 }
 
-static bool fold_masks(OptContext *ctx, TCGOp *op)
+/*
+ * Record "zero" and "sign" masks for the single output of @op.
+ * See TempOptInfo definition of z_mask and s_mask.
+ * If z_mask allows, fold the output to constant zero.
+ */
+static bool fold_masks_zs(OptContext *ctx, TCGOp *op,
+                          uint64_t z_mask, uint64_t s_mask)
 {
-    uint64_t z_mask = ctx->z_mask;
-    uint64_t s_mask = ctx->s_mask;
     const TCGOpDef *def = &tcg_op_defs[op->opc];
     TCGTemp *ts;
     TempOptInfo *ti;
@@ -XXX,XX +XXX,XX @@ static bool fold_masks(OptContext *ctx, TCGOp *op)
     return true;
 }
 
+static bool fold_masks(OptContext *ctx, TCGOp *op)
+{
+    return fold_masks_zs(ctx, op, ctx->z_mask, ctx->s_mask);
+}
+
 /*
  * An "affected" mask bit is 0 if and only if the result is identical
  * to the first input.  Thus if the entire mask is 0, the operation
-- 
2.43.0

Consider the passed s_mask to be a minimum deduced from
either existing s_mask or from a sign-extension operation.
We may be able to deduce more from the set of known zeros.
Remove identical logic from several opcode folders.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 21 ++++++---------------
 1 file changed, 6 insertions(+), 15 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static bool fold_const2_commutative(OptContext *ctx, TCGOp *op)
  * Record "zero" and "sign" masks for the single output of @op.
  * See TempOptInfo definition of z_mask and s_mask.
  * If z_mask allows, fold the output to constant zero.
+ * The passed s_mask may be augmented by z_mask.
  */
 static bool fold_masks_zs(OptContext *ctx, TCGOp *op,
                           uint64_t z_mask, uint64_t s_mask)
@@ -XXX,XX +XXX,XX @@ static bool fold_masks_zs(OptContext *ctx, TCGOp *op,
 
     ti = ts_info(ts);
     ti->z_mask = z_mask;
-    ti->s_mask = s_mask;
+    ti->s_mask = s_mask | smask_from_zmask(z_mask);
     return true;
 }
 
@@ -XXX,XX +XXX,XX @@ static bool fold_bswap(OptContext *ctx, TCGOp *op)
     default:
         g_assert_not_reached();
     }
-    s_mask = smask_from_zmask(z_mask);
 
+    s_mask = 0;
     switch (op->args[2] & (TCG_BSWAP_OZ | TCG_BSWAP_OS)) {
     case TCG_BSWAP_OZ:
         break;
@@ -XXX,XX +XXX,XX @@ static bool fold_bswap(OptContext *ctx, TCGOp *op)
     default:
         /* The high bits are undefined: force all bits above the sign to 1. */
         z_mask |= sign << 1;
-        s_mask = 0;
         break;
     }
     ctx->z_mask = z_mask;
@@ -XXX,XX +XXX,XX @@ static bool fold_count_zeros(OptContext *ctx, TCGOp *op)
         g_assert_not_reached();
     }
     ctx->z_mask = arg_info(op->args[2])->z_mask | z_mask;
-    ctx->s_mask = smask_from_zmask(ctx->z_mask);
     return false;
 }
 
@@ -XXX,XX +XXX,XX @@ static bool fold_ctpop(OptContext *ctx, TCGOp *op)
     default:
         g_assert_not_reached();
     }
-    ctx->s_mask = smask_from_zmask(ctx->z_mask);
     return false;
 }
 
@@ -XXX,XX +XXX,XX @@ static bool fold_extract(OptContext *ctx, TCGOp *op)
         return true;
     }
     ctx->z_mask = z_mask;
-    ctx->s_mask = smask_from_zmask(z_mask);
 
     return fold_masks(ctx, op);
 }
@@ -XXX,XX +XXX,XX @@ static bool fold_extu(OptContext *ctx, TCGOp *op)
     }
 
     ctx->z_mask = z_mask;
-    ctx->s_mask = smask_from_zmask(z_mask);
     if (!type_change && fold_affected_mask(ctx, op, z_mask_old ^ z_mask)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool fold_qemu_ld(OptContext *ctx, TCGOp *op)
     int width = 8 * memop_size(mop);
 
     if (width < 64) {
-        ctx->s_mask = MAKE_64BIT_MASK(width, 64 - width);
-        if (!(mop & MO_SIGN)) {
+        if (mop & MO_SIGN) {
+            ctx->s_mask = MAKE_64BIT_MASK(width, 64 - width);
+        } else {
             ctx->z_mask = MAKE_64BIT_MASK(0, width);
-            ctx->s_mask <<= 1;
         }
     }
 
@@ -XXX,XX +XXX,XX @@ static bool fold_setcond(OptContext *ctx, TCGOp *op)
     fold_setcond_tst_pow2(ctx, op, false);
 
     ctx->z_mask = 1;
-    ctx->s_mask = smask_from_zmask(1);
     return false;
 }
 
@@ -XXX,XX +XXX,XX @@ static bool fold_setcond2(OptContext *ctx, TCGOp *op)
     }
 
     ctx->z_mask = 1;
-    ctx->s_mask = smask_from_zmask(1);
     return false;
 
  do_setcond_const:
@@ -XXX,XX +XXX,XX @@ static bool fold_tcg_ld(OptContext *ctx, TCGOp *op)
         break;
     CASE_OP_32_64(ld8u):
         ctx->z_mask = MAKE_64BIT_MASK(0, 8);
-        ctx->s_mask = MAKE_64BIT_MASK(9, 55);
         break;
     CASE_OP_32_64(ld16s):
         ctx->s_mask = MAKE_64BIT_MASK(16, 48);
         break;
     CASE_OP_32_64(ld16u):
         ctx->z_mask = MAKE_64BIT_MASK(0, 16);
-        ctx->s_mask = MAKE_64BIT_MASK(17, 47);
         break;
     case INDEX_op_ld32s_i64:
         ctx->s_mask = MAKE_64BIT_MASK(32, 32);
         break;
     case INDEX_op_ld32u_i64:
         ctx->z_mask = MAKE_64BIT_MASK(0, 32);
-        ctx->s_mask = MAKE_64BIT_MASK(33, 31);
         break;
     default:
         g_assert_not_reached();
-- 
2.43.0

Change the representation from sign bit repetitions to all bits equal
to the sign bit, including the sign bit itself.

The previous format has a problem in that it is difficult to recreate
a valid sign mask after a shift operation: the "repetitions" part of
the previous format meant that applying the same shift as for the value
lead to an off-by-one value.

The new format, including the sign bit itself, means that the sign mask
can be manipulated in exactly the same way as the value, canonicalization
is easier.

Canonicalize the s_mask in fold_masks_zs, rather than requiring callers
to do so.  Treat 0 as a non-canonical but typeless input for no sign
information, which will be reset as appropriate for the data type.
We can easily fold in the data from z_mask while canonicalizing.

Temporarily disable optimizations using s_mask while each operation is
converted to use fold_masks_zs and to the new form.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 64 ++++++++++++--------------------------------------
 1 file changed, 15 insertions(+), 49 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ typedef struct TempOptInfo {
     QSIMPLEQ_HEAD(, MemCopyInfo) mem_copy;
     uint64_t val;
     uint64_t z_mask;  /* mask bit is 0 if and only if value bit is 0 */
-    uint64_t s_mask;  /* a left-aligned mask of clrsb(value) bits. */
+    uint64_t s_mask;  /* mask bit is 1 if value bit matches msb */
 } TempOptInfo;
 
 typedef struct OptContext {
@@ -XXX,XX +XXX,XX @@ typedef struct OptContext {
 
     /* In flight values from optimization. */
     uint64_t z_mask;  /* mask bit is 0 iff value bit is 0 */
-    uint64_t s_mask;  /* mask of clrsb(value) bits */
+    uint64_t s_mask;  /* mask bit is 1 if value bit matches msb */
     TCGType type;
 } OptContext;
 
-/* Calculate the smask for a specific value. */
-static uint64_t smask_from_value(uint64_t value)
-{
-    int rep = clrsb64(value);
-    return ~(~0ull >> rep);
-}
-
-/*
- * Calculate the smask for a given set of known-zeros.
- * If there are lots of zeros on the left, we can consider the remainder
- * an unsigned field, and thus the corresponding signed field is one bit
- * larger.
- */
-static uint64_t smask_from_zmask(uint64_t zmask)
-{
-    /*
-     * Only the 0 bits are significant for zmask, thus the msb itself
-     * must be zero, else we have no sign information.
-     */
-    int rep = clz64(zmask);
-    if (rep == 0) {
-        return 0;
-    }
-    rep -= 1;
-    return ~(~0ull >> rep);
-}
-
-/*
- * Recreate a properly left-aligned smask after manipulation.
- * Some bit-shuffling, particularly shifts and rotates, may
- * retain sign bits on the left, but may scatter disconnected
- * sign bits on the right.  Retain only what remains to the left.
- */
-static uint64_t smask_from_smask(int64_t smask)
-{
-    /* Only the 1 bits are significant for smask */
-    return smask_from_zmask(~smask);
-}
-
 static inline TempOptInfo *ts_info(TCGTemp *ts)
 {
     return ts->state_ptr;
@@ -XXX,XX +XXX,XX @@ static void init_ts_info(OptContext *ctx, TCGTemp *ts)
         ti->is_const = true;
         ti->val = ts->val;
         ti->z_mask = ts->val;
-        ti->s_mask = smask_from_value(ts->val);
+        ti->s_mask = INT64_MIN >> clrsb64(ts->val);
     } else {
         ti->is_const = false;
         ti->z_mask = -1;
@@ -XXX,XX +XXX,XX @@ static void finish_folding(OptContext *ctx, TCGOp *op)
          */
         if (i == 0) {
             ts_info(ts)->z_mask = ctx->z_mask;
-            ts_info(ts)->s_mask = ctx->s_mask;
         }
     }
 }
@@ -XXX,XX +XXX,XX @@ static bool fold_const2_commutative(OptContext *ctx, TCGOp *op)
  * The passed s_mask may be augmented by z_mask.
  */
 static bool fold_masks_zs(OptContext *ctx, TCGOp *op,
-                          uint64_t z_mask, uint64_t s_mask)
+                          uint64_t z_mask, int64_t s_mask)
 {
     const TCGOpDef *def = &tcg_op_defs[op->opc];
     TCGTemp *ts;
     TempOptInfo *ti;
+    int rep;
 
     /* Only single-output opcodes are supported here. */
     tcg_debug_assert(def->nb_oargs == 1);
@@ -XXX,XX +XXX,XX @@ static bool fold_masks_zs(OptContext *ctx, TCGOp *op,
      */
     if (ctx->type == TCG_TYPE_I32) {
         z_mask = (int32_t)z_mask;
-        s_mask |= MAKE_64BIT_MASK(32, 32);
+        s_mask |= INT32_MIN;
     }
 
     if (z_mask == 0) {
@@ -XXX,XX +XXX,XX @@ static bool fold_masks_zs(OptContext *ctx, TCGOp *op,
 
     ti = ts_info(ts);
     ti->z_mask = z_mask;
-    ti->s_mask = s_mask | smask_from_zmask(z_mask);
+
+    /* Canonicalize s_mask and incorporate data from z_mask. */
+    rep = clz64(~s_mask);
+    rep = MAX(rep, clz64(z_mask));
+    rep = MAX(rep - 1, 0);
+    ti->s_mask = INT64_MIN >> rep;
+
     return true;
 }
 
@@ -XXX,XX +XXX,XX @@ static bool fold_exts(OptContext *ctx, TCGOp *op)
 
     ctx->z_mask = z_mask;
     ctx->s_mask = s_mask;
-    if (!type_change && fold_affected_mask(ctx, op, s_mask & ~s_mask_old)) {
+    if (0 && !type_change && fold_affected_mask(ctx, op, s_mask & ~s_mask_old)) {
         return true;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool fold_sextract(OptContext *ctx, TCGOp *op)
     s_mask |= MAKE_64BIT_MASK(len, 64 - len);
     ctx->s_mask = s_mask;
 
-    if (pos == 0 && fold_affected_mask(ctx, op, s_mask & ~s_mask_old)) {
+    if (0 && pos == 0 && fold_affected_mask(ctx, op, s_mask & ~s_mask_old)) {
         return true;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool fold_shift(OptContext *ctx, TCGOp *op)
         ctx->z_mask = do_constant_folding(op->opc, ctx->type, z_mask, sh);
 
         s_mask = do_constant_folding(op->opc, ctx->type, s_mask, sh);
-        ctx->s_mask = smask_from_smask(s_mask);
 
         return fold_masks(ctx, op);
     }
-- 
2.43.0

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static void finish_ebb(OptContext *ctx)
     remove_mem_copy_all(ctx);
 }
 
-static void finish_folding(OptContext *ctx, TCGOp *op)
+static bool finish_folding(OptContext *ctx, TCGOp *op)
 {
     const TCGOpDef *def = &tcg_op_defs[op->opc];
     int i, nb_oargs;
@@ -XXX,XX +XXX,XX @@ static void finish_folding(OptContext *ctx, TCGOp *op)
             ts_info(ts)->z_mask = ctx->z_mask;
         }
     }
+    return true;
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static bool fold_add(OptContext *ctx, TCGOp *op)
         fold_xi_to_x(ctx, op, 0)) {
         return true;
     }
-    return false;
+    return finish_folding(ctx, op);
 }
 
 /* We cannot as yet do_constant_folding with vectors. */
@@ -XXX,XX +XXX,XX @@ static bool fold_add_vec(OptContext *ctx, TCGOp *op)
         fold_xi_to_x(ctx, op, 0)) {
         return true;
     }
-    return false;
+    return finish_folding(ctx, op);
 }
 
 static bool fold_addsub2(OptContext *ctx, TCGOp *op, bool add)
@@ -XXX,XX +XXX,XX @@ static bool fold_addsub2(OptContext *ctx, TCGOp *op, bool add)
         op->args[4] = arg_new_constant(ctx, bl);
         op->args[5] = arg_new_constant(ctx, bh);
     }
-    return false;
+    return finish_folding(ctx, op);
 }
 
 static bool fold_add2(OptContext *ctx, TCGOp *op)
-- 
2.43.0

Introduce ti_is_const, ti_const_val, ti_is_const_val.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static inline TempOptInfo *arg_info(TCGArg arg)
     return ts_info(arg_temp(arg));
 }
 
+static inline bool ti_is_const(TempOptInfo *ti)
+{
+    return ti->is_const;
+}
+
+static inline uint64_t ti_const_val(TempOptInfo *ti)
+{
+    return ti->val;
+}
+
+static inline bool ti_is_const_val(TempOptInfo *ti, uint64_t val)
+{
+    return ti_is_const(ti) && ti_const_val(ti) == val;
+}
+
 static inline bool ts_is_const(TCGTemp *ts)
 {
-    return ts_info(ts)->is_const;
+    return ti_is_const(ts_info(ts));
 }
 
 static inline bool ts_is_const_val(TCGTemp *ts, uint64_t val)
 {
-    TempOptInfo *ti = ts_info(ts);
-    return ti->is_const && ti->val == val;
+    return ti_is_const_val(ts_info(ts), val);
 }
 
 static inline bool arg_is_const(TCGArg arg)
-- 
2.43.0

Avoid the use of the OptContext slots.  Find TempOptInfo once.
Sink mask computation below fold_affected_mask early exit.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 30 ++++++++++++++++--------------
 1 file changed, 16 insertions(+), 14 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static bool fold_add2(OptContext *ctx, TCGOp *op)
 
 static bool fold_and(OptContext *ctx, TCGOp *op)
 {
-    uint64_t z1, z2;
+    uint64_t z1, z2, z_mask, s_mask;
+    TempOptInfo *t1, *t2;
 
     if (fold_const2_commutative(ctx, op) ||
         fold_xi_to_i(ctx, op, 0) ||
@@ -XXX,XX +XXX,XX @@ static bool fold_and(OptContext *ctx, TCGOp *op)
         return true;
     }
 
-    z1 = arg_info(op->args[1])->z_mask;
-    z2 = arg_info(op->args[2])->z_mask;
-    ctx->z_mask = z1 & z2;
-
-    /*
-     * Sign repetitions are perforce all identical, whether they are 1 or 0.
-     * Bitwise operations preserve the relative quantity of the repetitions.
-     */
-    ctx->s_mask = arg_info(op->args[1])->s_mask
-                & arg_info(op->args[2])->s_mask;
+    t1 = arg_info(op->args[1]);
+    t2 = arg_info(op->args[2]);
+    z1 = t1->z_mask;
+    z2 = t2->z_mask;
 
     /*
      * Known-zeros does not imply known-ones.  Therefore unless
      * arg2 is constant, we can't infer affected bits from it.
      */
-    if (arg_is_const(op->args[2]) &&
-        fold_affected_mask(ctx, op, z1 & ~z2)) {
+    if (ti_is_const(t2) && fold_affected_mask(ctx, op, z1 & ~z2)) {
         return true;
     }
 
-    return fold_masks(ctx, op);
+    z_mask = z1 & z2;
+
+    /*
+     * Sign repetitions are perforce all identical, whether they are 1 or 0.
+     * Bitwise operations preserve the relative quantity of the repetitions.
+     */
+    s_mask = t1->s_mask & t2->s_mask;
+
+    return fold_masks_zs(ctx, op, z_mask, s_mask);
 }
 
 static bool fold_andc(OptContext *ctx, TCGOp *op)
-- 
2.43.0

Avoid the use of the OptContext slots.  Find TempOptInfo once.
Avoid double inversion of the value of second const operand.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static bool fold_and(OptContext *ctx, TCGOp *op)
 
 static bool fold_andc(OptContext *ctx, TCGOp *op)
 {
-    uint64_t z1;
+    uint64_t z_mask, s_mask;
+    TempOptInfo *t1, *t2;
 
     if (fold_const2(ctx, op) ||
         fold_xx_to_i(ctx, op, 0) ||
@@ -XXX,XX +XXX,XX @@ static bool fold_andc(OptContext *ctx, TCGOp *op)
         return true;
     }
 
-    z1 = arg_info(op->args[1])->z_mask;
+    t1 = arg_info(op->args[1]);
+    t2 = arg_info(op->args[2]);
+    z_mask = t1->z_mask;
 
     /*
      * Known-zeros does not imply known-ones.  Therefore unless
      * arg2 is constant, we can't infer anything from it.
      */
-    if (arg_is_const(op->args[2])) {
-        uint64_t z2 = ~arg_info(op->args[2])->z_mask;
-        if (fold_affected_mask(ctx, op, z1 & ~z2)) {
+    if (ti_is_const(t2)) {
+        uint64_t v2 = ti_const_val(t2);
+        if (fold_affected_mask(ctx, op, z_mask & v2)) {
             return true;
         }
-        z1 &= z2;
+        z_mask &= ~v2;
     }
-    ctx->z_mask = z1;
 
-    ctx->s_mask = arg_info(op->args[1])->s_mask
-                & arg_info(op->args[2])->s_mask;
-    return fold_masks(ctx, op);
+    s_mask = t1->s_mask & t2->s_mask;
+    return fold_masks_zs(ctx, op, z_mask, s_mask);
 }
 
 static bool fold_brcond(OptContext *ctx, TCGOp *op)
-- 
2.43.0

Avoid the use of the OptContext slots.  Find TempOptInfo once.
Always set s_mask along the BSWAP_OS path, since the result is
being explicitly sign-extended.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 21 ++++++++++-----------
 1 file changed, 10 insertions(+), 11 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static bool fold_brcond2(OptContext *ctx, TCGOp *op)
 static bool fold_bswap(OptContext *ctx, TCGOp *op)
 {
     uint64_t z_mask, s_mask, sign;
+    TempOptInfo *t1 = arg_info(op->args[1]);
 
-    if (arg_is_const(op->args[1])) {
-        uint64_t t = arg_info(op->args[1])->val;
-
-        t = do_constant_folding(op->opc, ctx->type, t, op->args[2]);
-        return tcg_opt_gen_movi(ctx, op, op->args[0], t);
+    if (ti_is_const(t1)) {
+        return tcg_opt_gen_movi(ctx, op, op->args[0],
+                                do_constant_folding(op->opc, ctx->type,
+                                                    ti_const_val(t1),
+                                                    op->args[2]));
     }
 
-    z_mask = arg_info(op->args[1])->z_mask;
-
+    z_mask = t1->z_mask;
     switch (op->opc) {
     case INDEX_op_bswap16_i32:
     case INDEX_op_bswap16_i64:
@@ -XXX,XX +XXX,XX @@ static bool fold_bswap(OptContext *ctx, TCGOp *op)
         /* If the sign bit may be 1, force all the bits above to 1. */
         if (z_mask & sign) {
             z_mask |= sign;
-            s_mask = sign << 1;
         }
+        /* The value and therefore s_mask is explicitly sign-extended. */
+        s_mask = sign;
         break;
     default:
         /* The high bits are undefined: force all bits above the sign to 1. */
         z_mask |= sign << 1;
         break;
     }
-    ctx->z_mask = z_mask;
-    ctx->s_mask = s_mask;
 
-    return fold_masks(ctx, op);
+    return fold_masks_zs(ctx, op, z_mask, s_mask);
 }
 
 static bool fold_call(OptContext *ctx, TCGOp *op)
-- 
2.43.0

Avoid the use of the OptContext slots. Find TempOptInfo once.
Compute s_mask from the union of the maximum count and the
op2 fallback for op1 being zero.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static bool fold_call(OptContext *ctx, TCGOp *op)
 
 static bool fold_count_zeros(OptContext *ctx, TCGOp *op)
 {
-    uint64_t z_mask;
+    uint64_t z_mask, s_mask;
+    TempOptInfo *t1 = arg_info(op->args[1]);
+    TempOptInfo *t2 = arg_info(op->args[2]);
 
-    if (arg_is_const(op->args[1])) {
-        uint64_t t = arg_info(op->args[1])->val;
+    if (ti_is_const(t1)) {
+        uint64_t t = ti_const_val(t1);
 
         if (t != 0) {
             t = do_constant_folding(op->opc, ctx->type, t, 0);
@@ -XXX,XX +XXX,XX @@ static bool fold_count_zeros(OptContext *ctx, TCGOp *op)
     default:
         g_assert_not_reached();
     }
-    ctx->z_mask = arg_info(op->args[2])->z_mask | z_mask;
-    return false;
+    s_mask = ~z_mask;
+    z_mask |= t2->z_mask;
+    s_mask &= t2->s_mask;
+
+    return fold_masks_zs(ctx, op, z_mask, s_mask);
 }
 
 static bool fold_ctpop(OptContext *ctx, TCGOp *op)
-- 
2.43.0

Add fold_masks_z as a trivial wrapper around fold_masks_zs.
Avoid the use of the OptContext slots.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static bool fold_masks_zs(OptContext *ctx, TCGOp *op,
     return true;
 }
 
+static bool fold_masks_z(OptContext *ctx, TCGOp *op, uint64_t z_mask)
+{
+    return fold_masks_zs(ctx, op, z_mask, 0);
+}
+
 static bool fold_masks(OptContext *ctx, TCGOp *op)
 {
     return fold_masks_zs(ctx, op, ctx->z_mask, ctx->s_mask);
@@ -XXX,XX +XXX,XX @@ static bool fold_count_zeros(OptContext *ctx, TCGOp *op)
 
 static bool fold_ctpop(OptContext *ctx, TCGOp *op)
 {
+    uint64_t z_mask;
+
     if (fold_const1(ctx, op)) {
         return true;
     }
 
     switch (ctx->type) {
     case TCG_TYPE_I32:
-        ctx->z_mask = 32 | 31;
+        z_mask = 32 | 31;
         break;
     case TCG_TYPE_I64:
-        ctx->z_mask = 64 | 63;
+        z_mask = 64 | 63;
         break;
     default:
         g_assert_not_reached();
     }
-    return false;
+    return fold_masks_z(ctx, op, z_mask);
 }
 
 static bool fold_deposit(OptContext *ctx, TCGOp *op)
-- 
2.43.0

Avoid the use of the OptContext slots.  Find TempOptInfo once.
When we fold to and, use fold_and.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 35 +++++++++++++++++------------------
 1 file changed, 17 insertions(+), 18 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static bool fold_ctpop(OptContext *ctx, TCGOp *op)
 
 static bool fold_deposit(OptContext *ctx, TCGOp *op)
 {
+    TempOptInfo *t1 = arg_info(op->args[1]);
+    TempOptInfo *t2 = arg_info(op->args[2]);
+    int ofs = op->args[3];
+    int len = op->args[4];
     TCGOpcode and_opc;
+    uint64_t z_mask;
 
-    if (arg_is_const(op->args[1]) && arg_is_const(op->args[2])) {
-        uint64_t t1 = arg_info(op->args[1])->val;
-        uint64_t t2 = arg_info(op->args[2])->val;
-
-        t1 = deposit64(t1, op->args[3], op->args[4], t2);
-        return tcg_opt_gen_movi(ctx, op, op->args[0], t1);
+    if (ti_is_const(t1) && ti_is_const(t2)) {
+        return tcg_opt_gen_movi(ctx, op, op->args[0],
+                                deposit64(ti_const_val(t1), ofs, len,
+                                          ti_const_val(t2)));
     }
 
     switch (ctx->type) {
@@ -XXX,XX +XXX,XX @@ static bool fold_deposit(OptContext *ctx, TCGOp *op)
     }
 
     /* Inserting a value into zero at offset 0. */
-    if (arg_is_const_val(op->args[1], 0) && op->args[3] == 0) {
-        uint64_t mask = MAKE_64BIT_MASK(0, op->args[4]);
+    if (ti_is_const_val(t1, 0) && ofs == 0) {
+        uint64_t mask = MAKE_64BIT_MASK(0, len);
 
         op->opc = and_opc;
         op->args[1] = op->args[2];
         op->args[2] = arg_new_constant(ctx, mask);
-        ctx->z_mask = mask & arg_info(op->args[1])->z_mask;
-        return false;
+        return fold_and(ctx, op);
     }
 
     /* Inserting zero into a value. */
-    if (arg_is_const_val(op->args[2], 0)) {
-        uint64_t mask = deposit64(-1, op->args[3], op->args[4], 0);
+    if (ti_is_const_val(t2, 0)) {
+        uint64_t mask = deposit64(-1, ofs, len, 0);
 
         op->opc = and_opc;
         op->args[2] = arg_new_constant(ctx, mask);
-        ctx->z_mask = mask & arg_info(op->args[1])->z_mask;
-        return false;
+        return fold_and(ctx, op);
     }
 
-    ctx->z_mask = deposit64(arg_info(op->args[1])->z_mask,
-                            op->args[3], op->args[4],
-                            arg_info(op->args[2])->z_mask);
-    return false;
+    z_mask = deposit64(t1->z_mask, ofs, len, t2->z_mask);
+    return fold_masks_z(ctx, op, z_mask);
 }
 
 static bool fold_divide(OptContext *ctx, TCGOp *op)
-- 
2.43.0

The input which overlaps the sign bit of the output can
have its input s_mask propagated to the output s_mask.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static bool fold_deposit(OptContext *ctx, TCGOp *op)
     TempOptInfo *t2 = arg_info(op->args[2]);
     int ofs = op->args[3];
     int len = op->args[4];
+    int width;
     TCGOpcode and_opc;
-    uint64_t z_mask;
+    uint64_t z_mask, s_mask;
 
     if (ti_is_const(t1) && ti_is_const(t2)) {
         return tcg_opt_gen_movi(ctx, op, op->args[0],
@@ -XXX,XX +XXX,XX @@ static bool fold_deposit(OptContext *ctx, TCGOp *op)
     switch (ctx->type) {
     case TCG_TYPE_I32:
         and_opc = INDEX_op_and_i32;
+        width = 32;
         break;
     case TCG_TYPE_I64:
         and_opc = INDEX_op_and_i64;
+        width = 64;
         break;
     default:
         g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ static bool fold_deposit(OptContext *ctx, TCGOp *op)
         return fold_and(ctx, op);
     }
 
+    /* The s_mask from the top portion of the deposit is still valid. */
+    if (ofs + len == width) {
+        s_mask = t2->s_mask << ofs;
+    } else {
+        s_mask = t1->s_mask & ~MAKE_64BIT_MASK(0, ofs + len);
+    }
+
     z_mask = deposit64(t1->z_mask, ofs, len, t2->z_mask);
-    return fold_masks_z(ctx, op, z_mask);
+    return fold_masks_zs(ctx, op, z_mask, s_mask);
 }
 
 static bool fold_divide(OptContext *ctx, TCGOp *op)
-- 
2.43.0

Add fold_masks_s as a trivial wrapper around fold_masks_zs.
Avoid the use of the OptContext slots.

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static bool fold_masks_z(OptContext *ctx, TCGOp *op, uint64_t z_mask)
     return fold_masks_zs(ctx, op, z_mask, 0);
 }
 
+static bool fold_masks_s(OptContext *ctx, TCGOp *op, uint64_t s_mask)
+{
+    return fold_masks_zs(ctx, op, -1, s_mask);
+}
+
 static bool fold_masks(OptContext *ctx, TCGOp *op)
 {
     return fold_masks_zs(ctx, op, ctx->z_mask, ctx->s_mask);
@@ -XXX,XX +XXX,XX @@ static bool fold_dup2(OptContext *ctx, TCGOp *op)
 
 static bool fold_eqv(OptContext *ctx, TCGOp *op)
 {
+    uint64_t s_mask;
+
     if (fold_const2_commutative(ctx, op) ||
         fold_xi_to_x(ctx, op, -1) ||
         fold_xi_to_not(ctx, op, 0)) {
         return true;
     }
 
-    ctx->s_mask = arg_info(op->args[1])->s_mask
-                & arg_info(op->args[2])->s_mask;
-    return false;
+    s_mask = arg_info(op->args[1])->s_mask
+           & arg_info(op->args[2])->s_mask;
+    return fold_masks_s(ctx, op, s_mask);
 }
 
 static bool fold_extract(OptContext *ctx, TCGOp *op)
-- 
2.43.0

Avoid the use of the OptContext slots.  Find TempOptInfo once.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static bool fold_eqv(OptContext *ctx, TCGOp *op)
 static bool fold_extract(OptContext *ctx, TCGOp *op)
 {
     uint64_t z_mask_old, z_mask;
+    TempOptInfo *t1 = arg_info(op->args[1]);
     int pos = op->args[2];
     int len = op->args[3];
 
-    if (arg_is_const(op->args[1])) {
-        uint64_t t;
-
-        t = arg_info(op->args[1])->val;
-        t = extract64(t, pos, len);
-        return tcg_opt_gen_movi(ctx, op, op->args[0], t);
+    if (ti_is_const(t1)) {
+        return tcg_opt_gen_movi(ctx, op, op->args[0],
+                                extract64(ti_const_val(t1), pos, len));
     }
 
-    z_mask_old = arg_info(op->args[1])->z_mask;
+    z_mask_old = t1->z_mask;
     z_mask = extract64(z_mask_old, pos, len);
     if (pos == 0 && fold_affected_mask(ctx, op, z_mask_old ^ z_mask)) {
         return true;
     }
-    ctx->z_mask = z_mask;
 
-    return fold_masks(ctx, op);
+    return fold_masks_z(ctx, op, z_mask);
 }
 
 static bool fold_extract2(OptContext *ctx, TCGOp *op)
-- 
2.43.0

Avoid the use of the OptContext slots.  Find TempOptInfo once.
Explicitly sign-extend z_mask instead of doing that manually.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 29 ++++++++++++-----------------
 1 file changed, 12 insertions(+), 17 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static bool fold_extract2(OptContext *ctx, TCGOp *op)
 
 static bool fold_exts(OptContext *ctx, TCGOp *op)
 {
-    uint64_t s_mask_old, s_mask, z_mask, sign;
+    uint64_t s_mask_old, s_mask, z_mask;
     bool type_change = false;
+    TempOptInfo *t1;
 
     if (fold_const1(ctx, op)) {
         return true;
     }
 
-    z_mask = arg_info(op->args[1])->z_mask;
-    s_mask = arg_info(op->args[1])->s_mask;
+    t1 = arg_info(op->args[1]);
+    z_mask = t1->z_mask;
+    s_mask = t1->s_mask;
     s_mask_old = s_mask;
 
     switch (op->opc) {
     CASE_OP_32_64(ext8s):
-        sign = INT8_MIN;
-        z_mask = (uint8_t)z_mask;
+        s_mask |= INT8_MIN;
+        z_mask = (int8_t)z_mask;
         break;
     CASE_OP_32_64(ext16s):
-        sign = INT16_MIN;
-        z_mask = (uint16_t)z_mask;
+        s_mask |= INT16_MIN;
+        z_mask = (int16_t)z_mask;
         break;
     case INDEX_op_ext_i32_i64:
         type_change = true;
         QEMU_FALLTHROUGH;
     case INDEX_op_ext32s_i64:
-        sign = INT32_MIN;
-        z_mask = (uint32_t)z_mask;
+        s_mask |= INT32_MIN;
+        z_mask = (int32_t)z_mask;
         break;
     default:
         g_assert_not_reached();
     }
 
-    if (z_mask & sign) {
-        z_mask |= sign;
-    }
-    s_mask |= sign << 1;
-
-    ctx->z_mask = z_mask;
-    ctx->s_mask = s_mask;
     if (0 && !type_change && fold_affected_mask(ctx, op, s_mask & ~s_mask_old)) {
         return true;
     }
 
-    return fold_masks(ctx, op);
+    return fold_masks_zs(ctx, op, z_mask, s_mask);
 }
 
 static bool fold_extu(OptContext *ctx, TCGOp *op)
-- 
2.43.0

Avoid the use of the OptContext slots.  Find TempOptInfo once.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static bool fold_mov(OptContext *ctx, TCGOp *op)
 
 static bool fold_movcond(OptContext *ctx, TCGOp *op)
 {
+    uint64_t z_mask, s_mask;
+    TempOptInfo *tt, *ft;
     int i;
 
     /* If true and false values are the same, eliminate the cmp. */
@@ -XXX,XX +XXX,XX @@ static bool fold_movcond(OptContext *ctx, TCGOp *op)
         return tcg_opt_gen_mov(ctx, op, op->args[0], op->args[4 - i]);
     }
 
-    ctx->z_mask = arg_info(op->args[3])->z_mask
-                | arg_info(op->args[4])->z_mask;
-    ctx->s_mask = arg_info(op->args[3])->s_mask
-                & arg_info(op->args[4])->s_mask;
+    tt = arg_info(op->args[3]);
+    ft = arg_info(op->args[4]);
+    z_mask = tt->z_mask | ft->z_mask;
+    s_mask = tt->s_mask & ft->s_mask;
 
-    if (arg_is_const(op->args[3]) && arg_is_const(op->args[4])) {
-        uint64_t tv = arg_info(op->args[3])->val;
-        uint64_t fv = arg_info(op->args[4])->val;
+    if (ti_is_const(tt) && ti_is_const(ft)) {
+        uint64_t tv = ti_const_val(tt);
+        uint64_t fv = ti_const_val(ft);
         TCGOpcode opc, negopc = 0;
         TCGCond cond = op->args[5];
 
@@ -XXX,XX +XXX,XX @@ static bool fold_movcond(OptContext *ctx, TCGOp *op)
             }
         }
     }
-    return false;
+
+    return fold_masks_zs(ctx, op, z_mask, s_mask);
 }
 
 static bool fold_mul(OptContext *ctx, TCGOp *op)
-- 
2.43.0

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static bool fold_mul(OptContext *ctx, TCGOp *op)
         fold_xi_to_x(ctx, op, 1)) {
         return true;
     }
-    return false;
+    return finish_folding(ctx, op);
 }
 
 static bool fold_mul_highpart(OptContext *ctx, TCGOp *op)
@@ -XXX,XX +XXX,XX @@ static bool fold_mul_highpart(OptContext *ctx, TCGOp *op)
         fold_xi_to_i(ctx, op, 0)) {
         return true;
     }
-    return false;
+    return finish_folding(ctx, op);
 }
 
 static bool fold_multiply2(OptContext *ctx, TCGOp *op)
@@ -XXX,XX +XXX,XX @@ static bool fold_multiply2(OptContext *ctx, TCGOp *op)
         tcg_opt_gen_movi(ctx, op2, rh, h);
         return true;
     }
-    return false;
+    return finish_folding(ctx, op);
 }
 
 static bool fold_nand(OptContext *ctx, TCGOp *op)
-- 
2.43.0

Avoid the use of the OptContext slots.  Find TempOptInfo once.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static bool fold_not(OptContext *ctx, TCGOp *op)
 
 static bool fold_or(OptContext *ctx, TCGOp *op)
 {
+    uint64_t z_mask, s_mask;
+    TempOptInfo *t1, *t2;
+
     if (fold_const2_commutative(ctx, op) ||
         fold_xi_to_x(ctx, op, 0) ||
         fold_xx_to_x(ctx, op)) {
         return true;
     }
 
-    ctx->z_mask = arg_info(op->args[1])->z_mask
-                | arg_info(op->args[2])->z_mask;
-    ctx->s_mask = arg_info(op->args[1])->s_mask
-                & arg_info(op->args[2])->s_mask;
-    return fold_masks(ctx, op);
+    t1 = arg_info(op->args[1]);
+    t2 = arg_info(op->args[2]);
+    z_mask = t1->z_mask | t2->z_mask;
+    s_mask = t1->s_mask & t2->s_mask;
+    return fold_masks_zs(ctx, op, z_mask, s_mask);
 }
 
 static bool fold_orc(OptContext *ctx, TCGOp *op)
-- 
2.43.0

Avoid the use of the OptContext slots.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static bool fold_or(OptContext *ctx, TCGOp *op)
 
 static bool fold_orc(OptContext *ctx, TCGOp *op)
 {
+    uint64_t s_mask;
+
     if (fold_const2(ctx, op) ||
         fold_xx_to_i(ctx, op, -1) ||
         fold_xi_to_x(ctx, op, -1) ||
@@ -XXX,XX +XXX,XX @@ static bool fold_orc(OptContext *ctx, TCGOp *op)
         return true;
     }
 
-    ctx->s_mask = arg_info(op->args[1])->s_mask
-                & arg_info(op->args[2])->s_mask;
-    return false;
+    s_mask = arg_info(op->args[1])->s_mask
+           & arg_info(op->args[2])->s_mask;
+    return fold_masks_s(ctx, op, s_mask);
 }
 
 static bool fold_qemu_ld(OptContext *ctx, TCGOp *op)
-- 
2.43.0

Avoid the use of the OptContext slots.

Be careful not to call fold_masks_zs when the memory operation
is wide enough to require multiple outputs, so split into two
functions: fold_qemu_ld_1reg and fold_qemu_ld_2reg.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static bool fold_orc(OptContext *ctx, TCGOp *op)
     return fold_masks_s(ctx, op, s_mask);
 }
 
-static bool fold_qemu_ld(OptContext *ctx, TCGOp *op)
+static bool fold_qemu_ld_1reg(OptContext *ctx, TCGOp *op)
 {
     const TCGOpDef *def = &tcg_op_defs[op->opc];
     MemOpIdx oi = op->args[def->nb_oargs + def->nb_iargs];
     MemOp mop = get_memop(oi);
     int width = 8 * memop_size(mop);
+    uint64_t z_mask = -1, s_mask = 0;
 
     if (width < 64) {
         if (mop & MO_SIGN) {
-            ctx->s_mask = MAKE_64BIT_MASK(width, 64 - width);
+            s_mask = MAKE_64BIT_MASK(width - 1, 64 - (width - 1));
         } else {
-            ctx->z_mask = MAKE_64BIT_MASK(0, width);
+            z_mask = MAKE_64BIT_MASK(0, width);
         }
     }
 
     /* Opcodes that touch guest memory stop the mb optimization.  */
     ctx->prev_mb = NULL;
-    return false;
+
+    return fold_masks_zs(ctx, op, z_mask, s_mask);
+}
+
+static bool fold_qemu_ld_2reg(OptContext *ctx, TCGOp *op)
+{
+    /* Opcodes that touch guest memory stop the mb optimization.  */
+    ctx->prev_mb = NULL;
+    return finish_folding(ctx, op);
 }
 
 static bool fold_qemu_st(OptContext *ctx, TCGOp *op)
@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
             break;
         case INDEX_op_qemu_ld_a32_i32:
         case INDEX_op_qemu_ld_a64_i32:
+            done = fold_qemu_ld_1reg(&ctx, op);
+            break;
         case INDEX_op_qemu_ld_a32_i64:
         case INDEX_op_qemu_ld_a64_i64:
+            if (TCG_TARGET_REG_BITS == 64) {
+                done = fold_qemu_ld_1reg(&ctx, op);
+                break;
+            }
+            QEMU_FALLTHROUGH;
         case INDEX_op_qemu_ld_a32_i128:
         case INDEX_op_qemu_ld_a64_i128:
-            done = fold_qemu_ld(&ctx, op);
+            done = fold_qemu_ld_2reg(&ctx, op);
             break;
         case INDEX_op_qemu_st8_a32_i32:
         case INDEX_op_qemu_st8_a64_i32:
-- 
2.43.0

Stores have no output operands, and so need no further work.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static bool fold_qemu_st(OptContext *ctx, TCGOp *op)
 {
     /* Opcodes that touch guest memory stop the mb optimization.  */
     ctx->prev_mb = NULL;
-    return false;
+    return true;
 }
 
 static bool fold_remainder(OptContext *ctx, TCGOp *op)
@@ -XXX,XX +XXX,XX @@ static bool fold_tcg_st(OptContext *ctx, TCGOp *op)
 
     if (op->args[1] != tcgv_ptr_arg(tcg_env)) {
         remove_mem_copy_all(ctx);
-        return false;
+        return true;
     }
 
     switch (op->opc) {
@@ -XXX,XX +XXX,XX @@ static bool fold_tcg_st(OptContext *ctx, TCGOp *op)
         g_assert_not_reached();
     }
     remove_mem_copy_in(ctx, ofs, ofs + lm1);
-    return false;
+    return true;
 }
 
 static bool fold_tcg_st_memcopy(OptContext *ctx, TCGOp *op)
@@ -XXX,XX +XXX,XX @@ static bool fold_tcg_st_memcopy(OptContext *ctx, TCGOp *op)
     TCGType type;
 
     if (op->args[1] != tcgv_ptr_arg(tcg_env)) {
-        fold_tcg_st(ctx, op);
-        return false;
+        return fold_tcg_st(ctx, op);
     }
 
     src = arg_temp(op->args[0]);
@@ -XXX,XX +XXX,XX @@ static bool fold_tcg_st_memcopy(OptContext *ctx, TCGOp *op)
     last = ofs + tcg_type_size(type) - 1;
     remove_mem_copy_in(ctx, ofs, last);
     record_mem_copy(ctx, type, src, ofs, last);
-    return false;
+    return true;
 }
 
 static bool fold_xor(OptContext *ctx, TCGOp *op)
-- 
2.43.0

Change return from bool to int; distinguish between
complete folding, simplification, and no change.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static bool fold_remainder(OptContext *ctx, TCGOp *op)
     return finish_folding(ctx, op);
 }
 
-static bool fold_setcond_zmask(OptContext *ctx, TCGOp *op, bool neg)
+/* Return 1 if finished, -1 if simplified, 0 if unchanged. */
+static int fold_setcond_zmask(OptContext *ctx, TCGOp *op, bool neg)
 {
     uint64_t a_zmask, b_val;
     TCGCond cond;
@@ -XXX,XX +XXX,XX @@ static bool fold_setcond_zmask(OptContext *ctx, TCGOp *op, bool neg)
                 op->opc = xor_opc;
                 op->args[2] = arg_new_constant(ctx, 1);
             }
-            return false;
+            return -1;
         }
     }
-
-    return false;
+    return 0;
 }
 
 static void fold_setcond_tst_pow2(OptContext *ctx, TCGOp *op, bool neg)
@@ -XXX,XX +XXX,XX @@ static bool fold_setcond(OptContext *ctx, TCGOp *op)
         return tcg_opt_gen_movi(ctx, op, op->args[0], i);
     }
 
-    if (fold_setcond_zmask(ctx, op, false)) {
+    i = fold_setcond_zmask(ctx, op, false);
+    if (i > 0) {
         return true;
     }
-    fold_setcond_tst_pow2(ctx, op, false);
+    if (i == 0) {
+        fold_setcond_tst_pow2(ctx, op, false);
+    }
 
     ctx->z_mask = 1;
     return false;
@@ -XXX,XX +XXX,XX @@ static bool fold_negsetcond(OptContext *ctx, TCGOp *op)
         return tcg_opt_gen_movi(ctx, op, op->args[0], -i);
     }
 
-    if (fold_setcond_zmask(ctx, op, true)) {
+    i = fold_setcond_zmask(ctx, op, true);
+    if (i > 0) {
         return true;
     }
-    fold_setcond_tst_pow2(ctx, op, true);
+    if (i == 0) {
+        fold_setcond_tst_pow2(ctx, op, true);
+    }
 
     /* Value is {0,-1} so all bits are repetitions of the sign. */
     ctx->s_mask = -1;
-- 
2.43.0

Avoid the use of the OptContext slots.  Find TempOptInfo once.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 24 +++++++++---------------
 1 file changed, 9 insertions(+), 15 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static bool fold_cmpsel_vec(OptContext *ctx, TCGOp *op)
 static bool fold_sextract(OptContext *ctx, TCGOp *op)
 {
     uint64_t z_mask, s_mask, s_mask_old;
+    TempOptInfo *t1 = arg_info(op->args[1]);
     int pos = op->args[2];
     int len = op->args[3];
 
-    if (arg_is_const(op->args[1])) {
-        uint64_t t;
-
-        t = arg_info(op->args[1])->val;
-        t = sextract64(t, pos, len);
-        return tcg_opt_gen_movi(ctx, op, op->args[0], t);
+    if (ti_is_const(t1)) {
+        return tcg_opt_gen_movi(ctx, op, op->args[0],
+                                sextract64(ti_const_val(t1), pos, len));
     }
 
-    z_mask = arg_info(op->args[1])->z_mask;
-    z_mask = sextract64(z_mask, pos, len);
-    ctx->z_mask = z_mask;
-
-    s_mask_old = arg_info(op->args[1])->s_mask;
-    s_mask = sextract64(s_mask_old, pos, len);
-    s_mask |= MAKE_64BIT_MASK(len, 64 - len);
-    ctx->s_mask = s_mask;
+    s_mask_old = t1->s_mask;
+    s_mask = s_mask_old >> pos;
+    s_mask |= -1ull << (len - 1);
 
     if (0 && pos == 0 && fold_affected_mask(ctx, op, s_mask & ~s_mask_old)) {
         return true;
     }
 
-    return fold_masks(ctx, op);
+    z_mask = sextract64(t1->z_mask, pos, len);
+    return fold_masks_zs(ctx, op, z_mask, s_mask);
 }
 
 static bool fold_shift(OptContext *ctx, TCGOp *op)
-- 
2.43.0

Avoid the use of the OptContext slots.  Find TempOptInfo once.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 27 ++++++++++++++-------------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static bool fold_sextract(OptContext *ctx, TCGOp *op)
 static bool fold_shift(OptContext *ctx, TCGOp *op)
 {
     uint64_t s_mask, z_mask, sign;
+    TempOptInfo *t1, *t2;
 
     if (fold_const2(ctx, op) ||
         fold_ix_to_i(ctx, op, 0) ||
@@ -XXX,XX +XXX,XX @@ static bool fold_shift(OptContext *ctx, TCGOp *op)
         return true;
     }
 
-    s_mask = arg_info(op->args[1])->s_mask;
-    z_mask = arg_info(op->args[1])->z_mask;
+    t1 = arg_info(op->args[1]);
+    t2 = arg_info(op->args[2]);
+    s_mask = t1->s_mask;
+    z_mask = t1->z_mask;
 
-    if (arg_is_const(op->args[2])) {
-        int sh = arg_info(op->args[2])->val;
-
-        ctx->z_mask = do_constant_folding(op->opc, ctx->type, z_mask, sh);
+    if (ti_is_const(t2)) {
+        int sh = ti_const_val(t2);
 
+        z_mask = do_constant_folding(op->opc, ctx->type, z_mask, sh);
         s_mask = do_constant_folding(op->opc, ctx->type, s_mask, sh);
 
-        return fold_masks(ctx, op);
+        return fold_masks_zs(ctx, op, z_mask, s_mask);
     }
 
     switch (op->opc) {
@@ -XXX,XX +XXX,XX @@ static bool fold_shift(OptContext *ctx, TCGOp *op)
          * Arithmetic right shift will not reduce the number of
          * input sign repetitions.
          */
-        ctx->s_mask = s_mask;
-        break;
+        return fold_masks_s(ctx, op, s_mask);
     CASE_OP_32_64(shr):
         /*
          * If the sign bit is known zero, then logical right shift
-         * will not reduced the number of input sign repetitions.
+         * will not reduce the number of input sign repetitions.
          */
-        sign = (s_mask & -s_mask) >> 1;
+        sign = -s_mask;
         if (sign && !(z_mask & sign)) {
-            ctx->s_mask = s_mask;
+            return fold_masks_s(ctx, op, s_mask);
         }
         break;
     default:
         break;
     }
 
-    return false;
+    return finish_folding(ctx, op);
 }
 
 static bool fold_sub_to_neg(OptContext *ctx, TCGOp *op)
-- 
2.43.0

Merge the two conditions, sign != 0 && !(z_mask & sign),
by testing ~z_mask & sign.   If sign == 0, the logical and
will produce false.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

Duplicate fold_sub_vec into fold_sub instead of calling it,
now that fold_sub_vec always returns true.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static bool fold_sub_vec(OptContext *ctx, TCGOp *op)
         fold_sub_to_neg(ctx, op)) {
         return true;
     }
-    return false;
+    return finish_folding(ctx, op);
 }
 
 static bool fold_sub(OptContext *ctx, TCGOp *op)
 {
-    if (fold_const2(ctx, op) || fold_sub_vec(ctx, op)) {
+    if (fold_const2(ctx, op) ||
+        fold_xx_to_i(ctx, op, 0) ||
+        fold_xi_to_x(ctx, op, 0) ||
+        fold_sub_to_neg(ctx, op)) {
         return true;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool fold_sub(OptContext *ctx, TCGOp *op)
                    ? INDEX_op_add_i32 : INDEX_op_add_i64);
         op->args[2] = arg_new_constant(ctx, -val);
     }
-    return false;
+    return finish_folding(ctx, op);
 }
 
 static bool fold_sub2(OptContext *ctx, TCGOp *op)
-- 
2.43.0

Avoid the use of the OptContext slots.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static bool fold_sub2(OptContext *ctx, TCGOp *op)
 
 static bool fold_tcg_ld(OptContext *ctx, TCGOp *op)
 {
+    uint64_t z_mask = -1, s_mask = 0;
+
     /* We can't do any folding with a load, but we can record bits. */
     switch (op->opc) {
     CASE_OP_32_64(ld8s):
-        ctx->s_mask = MAKE_64BIT_MASK(8, 56);
+        s_mask = INT8_MIN;
         break;
     CASE_OP_32_64(ld8u):
-        ctx->z_mask = MAKE_64BIT_MASK(0, 8);
+        z_mask = MAKE_64BIT_MASK(0, 8);
         break;
     CASE_OP_32_64(ld16s):
-        ctx->s_mask = MAKE_64BIT_MASK(16, 48);
+        s_mask = INT16_MIN;
         break;
     CASE_OP_32_64(ld16u):
-        ctx->z_mask = MAKE_64BIT_MASK(0, 16);
+        z_mask = MAKE_64BIT_MASK(0, 16);
         break;
     case INDEX_op_ld32s_i64:
-        ctx->s_mask = MAKE_64BIT_MASK(32, 32);
+        s_mask = INT32_MIN;
         break;
     case INDEX_op_ld32u_i64:
-        ctx->z_mask = MAKE_64BIT_MASK(0, 32);
+        z_mask = MAKE_64BIT_MASK(0, 32);
         break;
     default:
         g_assert_not_reached();
     }
-    return false;
+    return fold_masks_zs(ctx, op, z_mask, s_mask);
 }
 
 static bool fold_tcg_ld_memcopy(OptContext *ctx, TCGOp *op)
-- 
2.43.0

Avoid the use of the OptContext slots.  Find TempOptInfo once.
Remove fold_masks as the function becomes unused.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static bool fold_masks_s(OptContext *ctx, TCGOp *op, uint64_t s_mask)
     return fold_masks_zs(ctx, op, -1, s_mask);
 }
 
-static bool fold_masks(OptContext *ctx, TCGOp *op)
-{
-    return fold_masks_zs(ctx, op, ctx->z_mask, ctx->s_mask);
-}
-
 /*
  * An "affected" mask bit is 0 if and only if the result is identical
  * to the first input.  Thus if the entire mask is 0, the operation
@@ -XXX,XX +XXX,XX @@ static bool fold_tcg_st_memcopy(OptContext *ctx, TCGOp *op)
 
 static bool fold_xor(OptContext *ctx, TCGOp *op)
 {
+    uint64_t z_mask, s_mask;
+    TempOptInfo *t1, *t2;
+
     if (fold_const2_commutative(ctx, op) ||
         fold_xx_to_i(ctx, op, 0) ||
         fold_xi_to_x(ctx, op, 0) ||
@@ -XXX,XX +XXX,XX @@ static bool fold_xor(OptContext *ctx, TCGOp *op)
         return true;
     }
 
-    ctx->z_mask = arg_info(op->args[1])->z_mask
-                | arg_info(op->args[2])->z_mask;
-    ctx->s_mask = arg_info(op->args[1])->s_mask
-                & arg_info(op->args[2])->s_mask;
-    return fold_masks(ctx, op);
+    t1 = arg_info(op->args[1]);
+    t2 = arg_info(op->args[2]);
+    z_mask = t1->z_mask | t2->z_mask;
+    s_mask = t1->s_mask & t2->s_mask;
+    return fold_masks_zs(ctx, op, z_mask, s_mask);
 }
 
 static bool fold_bitsel_vec(OptContext *ctx, TCGOp *op)
-- 
2.43.0

All mask setting is now done with parameters via fold_masks_*.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 13 -------------
 1 file changed, 13 deletions(-)

All instances of s_mask have been converted to the new
representation.  We can now re-enable usage.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static bool fold_exts(OptContext *ctx, TCGOp *op)
         g_assert_not_reached();
     }
 
-    if (0 && !type_change && fold_affected_mask(ctx, op, s_mask & ~s_mask_old)) {
+    if (!type_change && fold_affected_mask(ctx, op, s_mask & ~s_mask_old)) {
         return true;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool fold_sextract(OptContext *ctx, TCGOp *op)
     s_mask = s_mask_old >> pos;
     s_mask |= -1ull << (len - 1);
 
-    if (0 && pos == 0 && fold_affected_mask(ctx, op, s_mask & ~s_mask_old)) {
+    if (pos == 0 && fold_affected_mask(ctx, op, s_mask & ~s_mask_old)) {
         return true;
     }
 
-- 
2.43.0

The big comment just above says functions should be sorted.
Add forward declarations as needed.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 114 +++++++++++++++++++++++++------------------------
 1 file changed, 59 insertions(+), 55 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static bool fold_xx_to_x(OptContext *ctx, TCGOp *op)
  *   3) those that produce information about the result value.
  */
 
+static bool fold_or(OptContext *ctx, TCGOp *op);
+static bool fold_orc(OptContext *ctx, TCGOp *op);
+static bool fold_xor(OptContext *ctx, TCGOp *op);
+
 static bool fold_add(OptContext *ctx, TCGOp *op)
 {
     if (fold_const2_commutative(ctx, op) ||
@@ -XXX,XX +XXX,XX @@ static bool fold_andc(OptContext *ctx, TCGOp *op)
     return fold_masks_zs(ctx, op, z_mask, s_mask);
 }
 
+static bool fold_bitsel_vec(OptContext *ctx, TCGOp *op)
+{
+    /* If true and false values are the same, eliminate the cmp. */
+    if (args_are_copies(op->args[2], op->args[3])) {
+        return tcg_opt_gen_mov(ctx, op, op->args[0], op->args[2]);
+    }
+
+    if (arg_is_const(op->args[2]) && arg_is_const(op->args[3])) {
+        uint64_t tv = arg_info(op->args[2])->val;
+        uint64_t fv = arg_info(op->args[3])->val;
+
+        if (tv == -1 && fv == 0) {
+            return tcg_opt_gen_mov(ctx, op, op->args[0], op->args[1]);
+        }
+        if (tv == 0 && fv == -1) {
+            if (TCG_TARGET_HAS_not_vec) {
+                op->opc = INDEX_op_not_vec;
+                return fold_not(ctx, op);
+            } else {
+                op->opc = INDEX_op_xor_vec;
+                op->args[2] = arg_new_constant(ctx, -1);
+                return fold_xor(ctx, op);
+            }
+        }
+    }
+    if (arg_is_const(op->args[2])) {
+        uint64_t tv = arg_info(op->args[2])->val;
+        if (tv == -1) {
+            op->opc = INDEX_op_or_vec;
+            op->args[2] = op->args[3];
+            return fold_or(ctx, op);
+        }
+        if (tv == 0 && TCG_TARGET_HAS_andc_vec) {
+            op->opc = INDEX_op_andc_vec;
+            op->args[2] = op->args[1];
+            op->args[1] = op->args[3];
+            return fold_andc(ctx, op);
+        }
+    }
+    if (arg_is_const(op->args[3])) {
+        uint64_t fv = arg_info(op->args[3])->val;
+        if (fv == 0) {
+            op->opc = INDEX_op_and_vec;
+            return fold_and(ctx, op);
+        }
+        if (fv == -1 && TCG_TARGET_HAS_orc_vec) {
+            op->opc = INDEX_op_orc_vec;
+            op->args[2] = op->args[1];
+            op->args[1] = op->args[3];
+            return fold_orc(ctx, op);
+        }
+    }
+    return finish_folding(ctx, op);
+}
+
 static bool fold_brcond(OptContext *ctx, TCGOp *op)
 {
     int i = do_constant_folding_cond1(ctx, op, NO_DEST, &op->args[0],
@@ -XXX,XX +XXX,XX @@ static bool fold_xor(OptContext *ctx, TCGOp *op)
     return fold_masks_zs(ctx, op, z_mask, s_mask);
 }
 
-static bool fold_bitsel_vec(OptContext *ctx, TCGOp *op)
-{
-    /* If true and false values are the same, eliminate the cmp. */
-    if (args_are_copies(op->args[2], op->args[3])) {
-        return tcg_opt_gen_mov(ctx, op, op->args[0], op->args[2]);
-    }
-
-    if (arg_is_const(op->args[2]) && arg_is_const(op->args[3])) {
-        uint64_t tv = arg_info(op->args[2])->val;
-        uint64_t fv = arg_info(op->args[3])->val;
-
-        if (tv == -1 && fv == 0) {
-            return tcg_opt_gen_mov(ctx, op, op->args[0], op->args[1]);
-        }
-        if (tv == 0 && fv == -1) {
-            if (TCG_TARGET_HAS_not_vec) {
-                op->opc = INDEX_op_not_vec;
-                return fold_not(ctx, op);
-            } else {
-                op->opc = INDEX_op_xor_vec;
-                op->args[2] = arg_new_constant(ctx, -1);
-                return fold_xor(ctx, op);
-            }
-        }
-    }
-    if (arg_is_const(op->args[2])) {
-        uint64_t tv = arg_info(op->args[2])->val;
-        if (tv == -1) {
-            op->opc = INDEX_op_or_vec;
-            op->args[2] = op->args[3];
-            return fold_or(ctx, op);
-        }
-        if (tv == 0 && TCG_TARGET_HAS_andc_vec) {
-            op->opc = INDEX_op_andc_vec;
-            op->args[2] = op->args[1];
-            op->args[1] = op->args[3];
-            return fold_andc(ctx, op);
-        }
-    }
-    if (arg_is_const(op->args[3])) {
-        uint64_t fv = arg_info(op->args[3])->val;
-        if (fv == 0) {
-            op->opc = INDEX_op_and_vec;
-            return fold_and(ctx, op);
-        }
-        if (fv == -1 && TCG_TARGET_HAS_orc_vec) {
-            op->opc = INDEX_op_orc_vec;
-            op->args[2] = op->args[1];
-            op->args[1] = op->args[3];
-            return fold_orc(ctx, op);
-        }
-    }
-    return finish_folding(ctx, op);
-}
-
 /* Propagate constants and copies, fold constant expressions. */
 void tcg_optimize(TCGContext *s)
 {
-- 
2.43.0

The big comment just above says functions should be sorted.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 60 +++++++++++++++++++++++++-------------------------
 1 file changed, 30 insertions(+), 30 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static bool fold_call(OptContext *ctx, TCGOp *op)
     return true;
 }
 
+static bool fold_cmp_vec(OptContext *ctx, TCGOp *op)
+{
+    /* Canonicalize the comparison to put immediate second. */
+    if (swap_commutative(NO_DEST, &op->args[1], &op->args[2])) {
+        op->args[3] = tcg_swap_cond(op->args[3]);
+    }
+    return finish_folding(ctx, op);
+}
+
+static bool fold_cmpsel_vec(OptContext *ctx, TCGOp *op)
+{
+    /* If true and false values are the same, eliminate the cmp. */
+    if (args_are_copies(op->args[3], op->args[4])) {
+        return tcg_opt_gen_mov(ctx, op, op->args[0], op->args[3]);
+    }
+
+    /* Canonicalize the comparison to put immediate second. */
+    if (swap_commutative(NO_DEST, &op->args[1], &op->args[2])) {
+        op->args[5] = tcg_swap_cond(op->args[5]);
+    }
+    /*
+     * Canonicalize the "false" input reg to match the destination,
+     * so that the tcg backend can implement "move if true".
+     */
+    if (swap_commutative(op->args[0], &op->args[4], &op->args[3])) {
+        op->args[5] = tcg_invert_cond(op->args[5]);
+    }
+    return finish_folding(ctx, op);
+}
+
 static bool fold_count_zeros(OptContext *ctx, TCGOp *op)
 {
     uint64_t z_mask, s_mask;
@@ -XXX,XX +XXX,XX @@ static bool fold_setcond2(OptContext *ctx, TCGOp *op)
     return tcg_opt_gen_movi(ctx, op, op->args[0], i);
 }
 
-static bool fold_cmp_vec(OptContext *ctx, TCGOp *op)
-{
-    /* Canonicalize the comparison to put immediate second. */
-    if (swap_commutative(NO_DEST, &op->args[1], &op->args[2])) {
-        op->args[3] = tcg_swap_cond(op->args[3]);
-    }
-    return finish_folding(ctx, op);
-}
-
-static bool fold_cmpsel_vec(OptContext *ctx, TCGOp *op)
-{
-    /* If true and false values are the same, eliminate the cmp. */
-    if (args_are_copies(op->args[3], op->args[4])) {
-        return tcg_opt_gen_mov(ctx, op, op->args[0], op->args[3]);
-    }
-
-    /* Canonicalize the comparison to put immediate second. */
-    if (swap_commutative(NO_DEST, &op->args[1], &op->args[2])) {
-        op->args[5] = tcg_swap_cond(op->args[5]);
-    }
-    /*
-     * Canonicalize the "false" input reg to match the destination,
-     * so that the tcg backend can implement "move if true".
-     */
-    if (swap_commutative(op->args[0], &op->args[4], &op->args[3])) {
-        op->args[5] = tcg_invert_cond(op->args[5]);
-    }
-    return finish_folding(ctx, op);
-}
-
 static bool fold_sextract(OptContext *ctx, TCGOp *op)
 {
     uint64_t z_mask, s_mask, s_mask_old;
-- 
2.43.0

We currently have a flag, float_muladd_halve_result, to scale
the result by 2**-1.  Extend this to handle arbitrary scaling.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/fpu/softfloat.h   |  6 ++++
 fpu/softfloat.c           | 58 ++++++++++++++++++++++-----------------
 fpu/softfloat-parts.c.inc |  7 +++--
 3 files changed, 44 insertions(+), 27 deletions(-)

diff --git a/include/fpu/softfloat.h b/include/fpu/softfloat.h
index XXXXXXX..XXXXXXX 100644
--- a/include/fpu/softfloat.h
+++ b/include/fpu/softfloat.h
@@ -XXX,XX +XXX,XX @@ float16 float16_add(float16, float16, float_status *status);
 float16 float16_sub(float16, float16, float_status *status);
 float16 float16_mul(float16, float16, float_status *status);
 float16 float16_muladd(float16, float16, float16, int, float_status *status);
+float16 float16_muladd_scalbn(float16, float16, float16,
+                              int, int, float_status *status);
 float16 float16_div(float16, float16, float_status *status);
 float16 float16_scalbn(float16, int, float_status *status);
 float16 float16_min(float16, float16, float_status *status);
@@ -XXX,XX +XXX,XX @@ float32 float32_mul(float32, float32, float_status *status);
 float32 float32_div(float32, float32, float_status *status);
 float32 float32_rem(float32, float32, float_status *status);
 float32 float32_muladd(float32, float32, float32, int, float_status *status);
+float32 float32_muladd_scalbn(float32, float32, float32,
+                              int, int, float_status *status);
 float32 float32_sqrt(float32, float_status *status);
 float32 float32_exp2(float32, float_status *status);
 float32 float32_log2(float32, float_status *status);
@@ -XXX,XX +XXX,XX @@ float64 float64_mul(float64, float64, float_status *status);
 float64 float64_div(float64, float64, float_status *status);
 float64 float64_rem(float64, float64, float_status *status);
 float64 float64_muladd(float64, float64, float64, int, float_status *status);
+float64 float64_muladd_scalbn(float64, float64, float64,
+                              int, int, float_status *status);
 float64 float64_sqrt(float64, float_status *status);
 float64 float64_log2(float64, float_status *status);
 FloatRelation float64_compare(float64, float64, float_status *status);
diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ static FloatParts128 *parts128_mul(FloatParts128 *a, FloatParts128 *b,
 #define parts_mul(A, B, S) \
     PARTS_GENERIC_64_128(mul, A)(A, B, S)
 
-static FloatParts64 *parts64_muladd(FloatParts64 *a, FloatParts64 *b,
-                                    FloatParts64 *c, int flags,
-                                    float_status *s);
-static FloatParts128 *parts128_muladd(FloatParts128 *a, FloatParts128 *b,
-                                      FloatParts128 *c, int flags,
-                                      float_status *s);
+static FloatParts64 *parts64_muladd_scalbn(FloatParts64 *a, FloatParts64 *b,
+                                           FloatParts64 *c, int scale,
+                                           int flags, float_status *s);
+static FloatParts128 *parts128_muladd_scalbn(FloatParts128 *a, FloatParts128 *b,
+                                             FloatParts128 *c, int scale,
+                                             int flags, float_status *s);
 
-#define parts_muladd(A, B, C, Z, S) \
-    PARTS_GENERIC_64_128(muladd, A)(A, B, C, Z, S)
+#define parts_muladd_scalbn(A, B, C, Z, Y, S) \
+    PARTS_GENERIC_64_128(muladd_scalbn, A)(A, B, C, Z, Y, S)
 
 static FloatParts64 *parts64_div(FloatParts64 *a, FloatParts64 *b,
                                  float_status *s);
@@ -XXX,XX +XXX,XX @@ floatx80_mul(floatx80 a, floatx80 b, float_status *status)
  * Fused multiply-add
  */
 
-float16 QEMU_FLATTEN float16_muladd(float16 a, float16 b, float16 c,
-                                    int flags, float_status *status)
+float16 QEMU_FLATTEN
+float16_muladd_scalbn(float16 a, float16 b, float16 c,
+                      int scale, int flags, float_status *status)
 {
     FloatParts64 pa, pb, pc, *pr;
 
     float16_unpack_canonical(&pa, a, status);
     float16_unpack_canonical(&pb, b, status);
     float16_unpack_canonical(&pc, c, status);
-    pr = parts_muladd(&pa, &pb, &pc, flags, status);
+    pr = parts_muladd_scalbn(&pa, &pb, &pc, scale, flags, status);
 
     return float16_round_pack_canonical(pr, status);
 }
 
-static float32 QEMU_SOFTFLOAT_ATTR
-soft_f32_muladd(float32 a, float32 b, float32 c, int flags,
-                float_status *status)
+float16 float16_muladd(float16 a, float16 b, float16 c,
+                       int flags, float_status *status)
+{
+    return float16_muladd_scalbn(a, b, c, 0, flags, status);
+}
+
+float32 QEMU_SOFTFLOAT_ATTR
+float32_muladd_scalbn(float32 a, float32 b, float32 c,
+                      int scale, int flags, float_status *status)
 {
     FloatParts64 pa, pb, pc, *pr;
 
     float32_unpack_canonical(&pa, a, status);
     float32_unpack_canonical(&pb, b, status);
     float32_unpack_canonical(&pc, c, status);
-    pr = parts_muladd(&pa, &pb, &pc, flags, status);
+    pr = parts_muladd_scalbn(&pa, &pb, &pc, scale, flags, status);
 
     return float32_round_pack_canonical(pr, status);
 }
 
-static float64 QEMU_SOFTFLOAT_ATTR
-soft_f64_muladd(float64 a, float64 b, float64 c, int flags,
-                float_status *status)
+float64 QEMU_SOFTFLOAT_ATTR
+float64_muladd_scalbn(float64 a, float64 b, float64 c,
+                      int scale, int flags, float_status *status)
 {
     FloatParts64 pa, pb, pc, *pr;
 
     float64_unpack_canonical(&pa, a, status);
     float64_unpack_canonical(&pb, b, status);
     float64_unpack_canonical(&pc, c, status);
-    pr = parts_muladd(&pa, &pb, &pc, flags, status);
+    pr = parts_muladd_scalbn(&pa, &pb, &pc, scale, flags, status);
 
     return float64_round_pack_canonical(pr, status);
 }
@@ -XXX,XX +XXX,XX @@ float32_muladd(float32 xa, float32 xb, float32 xc, int flags, float_status *s)
     return ur.s;
 
  soft:
-    return soft_f32_muladd(ua.s, ub.s, uc.s, flags, s);
+    return float32_muladd_scalbn(ua.s, ub.s, uc.s, 0, flags, s);
 }
 
 float64 QEMU_FLATTEN
@@ -XXX,XX +XXX,XX @@ float64_muladd(float64 xa, float64 xb, float64 xc, int flags, float_status *s)
     return ur.s;
 
  soft:
-    return soft_f64_muladd(ua.s, ub.s, uc.s, flags, s);
+    return float64_muladd_scalbn(ua.s, ub.s, uc.s, 0, flags, s);
 }
 
 float64 float64r32_muladd(float64 a, float64 b, float64 c,
@@ -XXX,XX +XXX,XX @@ float64 float64r32_muladd(float64 a, float64 b, float64 c,
     float64_unpack_canonical(&pa, a, status);
     float64_unpack_canonical(&pb, b, status);
     float64_unpack_canonical(&pc, c, status);
-    pr = parts_muladd(&pa, &pb, &pc, flags, status);
+    pr = parts_muladd_scalbn(&pa, &pb, &pc, 0, flags, status);
 
     return float64r32_round_pack_canonical(pr, status);
 }
@@ -XXX,XX +XXX,XX @@ bfloat16 QEMU_FLATTEN bfloat16_muladd(bfloat16 a, bfloat16 b, bfloat16 c,
     bfloat16_unpack_canonical(&pa, a, status);
     bfloat16_unpack_canonical(&pb, b, status);
     bfloat16_unpack_canonical(&pc, c, status);
-    pr = parts_muladd(&pa, &pb, &pc, flags, status);
+    pr = parts_muladd_scalbn(&pa, &pb, &pc, 0, flags, status);
 
     return bfloat16_round_pack_canonical(pr, status);
 }
@@ -XXX,XX +XXX,XX @@ float128 QEMU_FLATTEN float128_muladd(float128 a, float128 b, float128 c,
     float128_unpack_canonical(&pa, a, status);
     float128_unpack_canonical(&pb, b, status);
     float128_unpack_canonical(&pc, c, status);
-    pr = parts_muladd(&pa, &pb, &pc, flags, status);
+    pr = parts_muladd_scalbn(&pa, &pb, &pc, 0, flags, status);
 
     return float128_round_pack_canonical(pr, status);
 }
@@ -XXX,XX +XXX,XX @@ float32 float32_exp2(float32 a, float_status *status)
 
     float64_unpack_canonical(&rp, float64_one, status);
     for (i = 0 ; i < 15 ; i++) {
+
         float64_unpack_canonical(&tp, float32_exp2_coefficients[i], status);
-        rp = *parts_muladd(&tp, &xnp, &rp, 0, status);
+        rp = *parts_muladd_scalbn(&tp, &xnp, &rp, 0, 0, status);
         xnp = *parts_mul(&xnp, &xp, status);
     }
 
diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(mul)(FloatPartsN *a, FloatPartsN *b,
  * Requires A and C extracted into a double-sized structure to provide the
  * extra space for the widening multiply.
  */
-static FloatPartsN *partsN(muladd)(FloatPartsN *a, FloatPartsN *b,
-                                   FloatPartsN *c, int flags, float_status *s)
+static FloatPartsN *partsN(muladd_scalbn)(FloatPartsN *a, FloatPartsN *b,
+                                          FloatPartsN *c, int scale,
+                                          int flags, float_status *s)
 {
     int ab_mask, abc_mask;
     FloatPartsW p_widen, c_widen;
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(muladd)(FloatPartsN *a, FloatPartsN *b,
     a->exp = p_widen.exp;
 
  return_normal:
+    /* TODO: Replace all use of float_muladd_halve_result with scale. */
     if (flags & float_muladd_halve_result) {
         a->exp -= 1;
     }
+    a->exp += scale;
  finish_sign:
     if (flags & float_muladd_negate_result) {
         a->sign ^= 1;
-- 
2.43.0

Use the scalbn interface instead of float_muladd_halve_result.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/helper-a64.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/helper-a64.c
+++ b/target/arm/tcg/helper-a64.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(rsqrtsf_f16)(uint32_t a, uint32_t b, float_status *fpst)
         (float16_is_infinity(b) && float16_is_zero(a))) {
         return float16_one_point_five;
     }
-    return float16_muladd(a, b, float16_three, float_muladd_halve_result, fpst);
+    return float16_muladd_scalbn(a, b, float16_three, -1, 0, fpst);
 }
 
 float32 HELPER(rsqrtsf_f32)(float32 a, float32 b, float_status *fpst)
@@ -XXX,XX +XXX,XX @@ float32 HELPER(rsqrtsf_f32)(float32 a, float32 b, float_status *fpst)
         (float32_is_infinity(b) && float32_is_zero(a))) {
         return float32_one_point_five;
     }
-    return float32_muladd(a, b, float32_three, float_muladd_halve_result, fpst);
+    return float32_muladd_scalbn(a, b, float32_three, -1, 0, fpst);
 }
 
 float64 HELPER(rsqrtsf_f64)(float64 a, float64 b, float_status *fpst)
@@ -XXX,XX +XXX,XX @@ float64 HELPER(rsqrtsf_f64)(float64 a, float64 b, float_status *fpst)
         (float64_is_infinity(b) && float64_is_zero(a))) {
         return float64_one_point_five;
     }
-    return float64_muladd(a, b, float64_three, float_muladd_halve_result, fpst);
+    return float64_muladd_scalbn(a, b, float64_three, -1, 0, fpst);
 }
 
 /* Floating-point reciprocal exponent - see FPRecpX in ARM ARM */
-- 
2.43.0

Use the scalbn interface instead of float_muladd_halve_result.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/sparc/helper.h     |  4 +-
 target/sparc/fop_helper.c |  8 ++--
 target/sparc/translate.c  | 80 +++++++++++++++++++++++----------------
 3 files changed, 54 insertions(+), 38 deletions(-)

diff --git a/target/sparc/helper.h b/target/sparc/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/helper.h
+++ b/target/sparc/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(faddd, TCG_CALL_NO_WG, f64, env, f64, f64)
 DEF_HELPER_FLAGS_3(fsubd, TCG_CALL_NO_WG, f64, env, f64, f64)
 DEF_HELPER_FLAGS_3(fmuld, TCG_CALL_NO_WG, f64, env, f64, f64)
 DEF_HELPER_FLAGS_3(fdivd, TCG_CALL_NO_WG, f64, env, f64, f64)
-DEF_HELPER_FLAGS_5(fmaddd, TCG_CALL_NO_WG, f64, env, f64, f64, f64, i32)
+DEF_HELPER_FLAGS_6(fmaddd, TCG_CALL_NO_WG, f64, env, f64, f64, f64, s32, i32)
 DEF_HELPER_FLAGS_3(fnaddd, TCG_CALL_NO_WG, f64, env, f64, f64)
 DEF_HELPER_FLAGS_3(fnmuld, TCG_CALL_NO_WG, f64, env, f64, f64)
 
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(fadds, TCG_CALL_NO_WG, f32, env, f32, f32)
 DEF_HELPER_FLAGS_3(fsubs, TCG_CALL_NO_WG, f32, env, f32, f32)
 DEF_HELPER_FLAGS_3(fmuls, TCG_CALL_NO_WG, f32, env, f32, f32)
 DEF_HELPER_FLAGS_3(fdivs, TCG_CALL_NO_WG, f32, env, f32, f32)
-DEF_HELPER_FLAGS_5(fmadds, TCG_CALL_NO_WG, f32, env, f32, f32, f32, i32)
+DEF_HELPER_FLAGS_6(fmadds, TCG_CALL_NO_WG, f32, env, f32, f32, f32, s32, i32)
 DEF_HELPER_FLAGS_3(fnadds, TCG_CALL_NO_WG, f32, env, f32, f32)
 DEF_HELPER_FLAGS_3(fnmuls, TCG_CALL_NO_WG, f32, env, f32, f32)
 
diff --git a/target/sparc/fop_helper.c b/target/sparc/fop_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/fop_helper.c
+++ b/target/sparc/fop_helper.c
@@ -XXX,XX +XXX,XX @@ Int128 helper_fsqrtq(CPUSPARCState *env, Int128 src)
 }
 
 float32 helper_fmadds(CPUSPARCState *env, float32 s1,
-                      float32 s2, float32 s3, uint32_t op)
+                      float32 s2, float32 s3, int32_t sc, uint32_t op)
 {
-    float32 ret = float32_muladd(s1, s2, s3, op, &env->fp_status);
+    float32 ret = float32_muladd_scalbn(s1, s2, s3, sc, op, &env->fp_status);
     check_ieee_exceptions(env, GETPC());
     return ret;
 }
 
 float64 helper_fmaddd(CPUSPARCState *env, float64 s1,
-                      float64 s2, float64 s3, uint32_t op)
+                      float64 s2, float64 s3, int32_t sc, uint32_t op)
 {
-    float64 ret = float64_muladd(s1, s2, s3, op, &env->fp_status);
+    float64 ret = float64_muladd_scalbn(s1, s2, s3, sc, op, &env->fp_status);
     check_ieee_exceptions(env, GETPC());
     return ret;
 }
diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_op_fabsq(TCGv_i128 dst, TCGv_i128 src)
 
 static void gen_op_fmadds(TCGv_i32 d, TCGv_i32 s1, TCGv_i32 s2, TCGv_i32 s3)
 {
-    gen_helper_fmadds(d, tcg_env, s1, s2, s3, tcg_constant_i32(0));
+    TCGv_i32 z = tcg_constant_i32(0);
+    gen_helper_fmadds(d, tcg_env, s1, s2, s3, z, z);
 }
 
 static void gen_op_fmaddd(TCGv_i64 d, TCGv_i64 s1, TCGv_i64 s2, TCGv_i64 s3)
 {
-    gen_helper_fmaddd(d, tcg_env, s1, s2, s3, tcg_constant_i32(0));
+    TCGv_i32 z = tcg_constant_i32(0);
+    gen_helper_fmaddd(d, tcg_env, s1, s2, s3, z, z);
 }
 
 static void gen_op_fmsubs(TCGv_i32 d, TCGv_i32 s1, TCGv_i32 s2, TCGv_i32 s3)
 {
-    int op = float_muladd_negate_c;
-    gen_helper_fmadds(d, tcg_env, s1, s2, s3, tcg_constant_i32(op));
+    TCGv_i32 z = tcg_constant_i32(0);
+    TCGv_i32 op = tcg_constant_i32(float_muladd_negate_c);
+    gen_helper_fmadds(d, tcg_env, s1, s2, s3, z, op);
 }
 
 static void gen_op_fmsubd(TCGv_i64 d, TCGv_i64 s1, TCGv_i64 s2, TCGv_i64 s3)
 {
-    int op = float_muladd_negate_c;
-    gen_helper_fmaddd(d, tcg_env, s1, s2, s3, tcg_constant_i32(op));
+    TCGv_i32 z = tcg_constant_i32(0);
+    TCGv_i32 op = tcg_constant_i32(float_muladd_negate_c);
+    gen_helper_fmaddd(d, tcg_env, s1, s2, s3, z, op);
 }
 
 static void gen_op_fnmsubs(TCGv_i32 d, TCGv_i32 s1, TCGv_i32 s2, TCGv_i32 s3)
 {
-    int op = float_muladd_negate_c | float_muladd_negate_result;
-    gen_helper_fmadds(d, tcg_env, s1, s2, s3, tcg_constant_i32(op));
+    TCGv_i32 z = tcg_constant_i32(0);
+    TCGv_i32 op = tcg_constant_i32(float_muladd_negate_c |
+                                   float_muladd_negate_result);
+    gen_helper_fmadds(d, tcg_env, s1, s2, s3, z, op);
 }
 
 static void gen_op_fnmsubd(TCGv_i64 d, TCGv_i64 s1, TCGv_i64 s2, TCGv_i64 s3)
 {
-    int op = float_muladd_negate_c | float_muladd_negate_result;
-    gen_helper_fmaddd(d, tcg_env, s1, s2, s3, tcg_constant_i32(op));
+    TCGv_i32 z = tcg_constant_i32(0);
+    TCGv_i32 op = tcg_constant_i32(float_muladd_negate_c |
+                                   float_muladd_negate_result);
+    gen_helper_fmaddd(d, tcg_env, s1, s2, s3, z, op);
 }
 
 static void gen_op_fnmadds(TCGv_i32 d, TCGv_i32 s1, TCGv_i32 s2, TCGv_i32 s3)
 {
-    int op = float_muladd_negate_result;
-    gen_helper_fmadds(d, tcg_env, s1, s2, s3, tcg_constant_i32(op));
+    TCGv_i32 z = tcg_constant_i32(0);
+    TCGv_i32 op = tcg_constant_i32(float_muladd_negate_result);
+    gen_helper_fmadds(d, tcg_env, s1, s2, s3, z, op);
 }
 
 static void gen_op_fnmaddd(TCGv_i64 d, TCGv_i64 s1, TCGv_i64 s2, TCGv_i64 s3)
 {
-    int op = float_muladd_negate_result;
-    gen_helper_fmaddd(d, tcg_env, s1, s2, s3, tcg_constant_i32(op));
+    TCGv_i32 z = tcg_constant_i32(0);
+    TCGv_i32 op = tcg_constant_i32(float_muladd_negate_result);
+    gen_helper_fmaddd(d, tcg_env, s1, s2, s3, z, op);
 }
 
 /* Use muladd to compute (1 * src1) + src2 / 2 with one rounding. */
 static void gen_op_fhadds(TCGv_i32 d, TCGv_i32 s1, TCGv_i32 s2)
 {
-    TCGv_i32 one = tcg_constant_i32(float32_one);
-    int op = float_muladd_halve_result;
-    gen_helper_fmadds(d, tcg_env, one, s1, s2, tcg_constant_i32(op));
+    TCGv_i32 fone = tcg_constant_i32(float32_one);
+    TCGv_i32 mone = tcg_constant_i32(-1);
+    TCGv_i32 op = tcg_constant_i32(0);
+    gen_helper_fmadds(d, tcg_env, fone, s1, s2, mone, op);
 }
 
 static void gen_op_fhaddd(TCGv_i64 d, TCGv_i64 s1, TCGv_i64 s2)
 {
-    TCGv_i64 one = tcg_constant_i64(float64_one);
-    int op = float_muladd_halve_result;
-    gen_helper_fmaddd(d, tcg_env, one, s1, s2, tcg_constant_i32(op));
+    TCGv_i64 fone = tcg_constant_i64(float64_one);
+    TCGv_i32 mone = tcg_constant_i32(-1);
+    TCGv_i32 op = tcg_constant_i32(0);
+    gen_helper_fmaddd(d, tcg_env, fone, s1, s2, mone, op);
 }
 
 /* Use muladd to compute (1 * src1) - src2 / 2 with one rounding. */
 static void gen_op_fhsubs(TCGv_i32 d, TCGv_i32 s1, TCGv_i32 s2)
 {
-    TCGv_i32 one = tcg_constant_i32(float32_one);
-    int op = float_muladd_negate_c | float_muladd_halve_result;
-    gen_helper_fmadds(d, tcg_env, one, s1, s2, tcg_constant_i32(op));
+    TCGv_i32 fone = tcg_constant_i32(float32_one);
+    TCGv_i32 mone = tcg_constant_i32(-1);
+    TCGv_i32 op = tcg_constant_i32(float_muladd_negate_c);
+    gen_helper_fmadds(d, tcg_env, fone, s1, s2, mone, op);
 }
 
 static void gen_op_fhsubd(TCGv_i64 d, TCGv_i64 s1, TCGv_i64 s2)
 {
-    TCGv_i64 one = tcg_constant_i64(float64_one);
-    int op = float_muladd_negate_c | float_muladd_halve_result;
-    gen_helper_fmaddd(d, tcg_env, one, s1, s2, tcg_constant_i32(op));
+    TCGv_i64 fone = tcg_constant_i64(float64_one);
+    TCGv_i32 mone = tcg_constant_i32(-1);
+    TCGv_i32 op = tcg_constant_i32(float_muladd_negate_c);
+    gen_helper_fmaddd(d, tcg_env, fone, s1, s2, mone, op);
 }
 
 /* Use muladd to compute -((1 * src1) + src2 / 2) with one rounding. */
 static void gen_op_fnhadds(TCGv_i32 d, TCGv_i32 s1, TCGv_i32 s2)
 {
-    TCGv_i32 one = tcg_constant_i32(float32_one);
-    int op = float_muladd_negate_result | float_muladd_halve_result;
-    gen_helper_fmadds(d, tcg_env, one, s1, s2, tcg_constant_i32(op));
+    TCGv_i32 fone = tcg_constant_i32(float32_one);
+    TCGv_i32 mone = tcg_constant_i32(-1);
+    TCGv_i32 op = tcg_constant_i32(float_muladd_negate_result);
+    gen_helper_fmadds(d, tcg_env, fone, s1, s2, mone, op);
 }
 
 static void gen_op_fnhaddd(TCGv_i64 d, TCGv_i64 s1, TCGv_i64 s2)
 {
-    TCGv_i64 one = tcg_constant_i64(float64_one);
-    int op = float_muladd_negate_result | float_muladd_halve_result;
-    gen_helper_fmaddd(d, tcg_env, one, s1, s2, tcg_constant_i32(op));
+    TCGv_i64 fone = tcg_constant_i64(float64_one);
+    TCGv_i32 mone = tcg_constant_i32(-1);
+    TCGv_i32 op = tcg_constant_i32(float_muladd_negate_result);
+    gen_helper_fmaddd(d, tcg_env, fone, s1, s2, mone, op);
 }
 
 static void gen_op_fpexception_im(DisasContext *dc, int ftt)
-- 
2.43.0

All uses have been convered to float*_muladd_scalbn.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/fpu/softfloat.h   | 3 ---
 fpu/softfloat.c           | 6 ------
 fpu/softfloat-parts.c.inc | 4 ----
 3 files changed, 13 deletions(-)

diff --git a/include/fpu/softfloat.h b/include/fpu/softfloat.h
index XXXXXXX..XXXXXXX 100644
--- a/include/fpu/softfloat.h
+++ b/include/fpu/softfloat.h
@@ -XXX,XX +XXX,XX @@ bfloat16 bfloat16_squash_input_denormal(bfloat16 a, float_status *status);
 | Using these differs from negating an input or output before calling
 | the muladd function in that this means that a NaN doesn't have its
 | sign bit inverted before it is propagated.
-| We also support halving the result before rounding, as a special
-| case to support the ARM fused-sqrt-step instruction FRSQRTS.
 *----------------------------------------------------------------------------*/
 enum {
     float_muladd_negate_c = 1,
     float_muladd_negate_product = 2,
     float_muladd_negate_result = 4,
-    float_muladd_halve_result = 8,
 };
 
 /*----------------------------------------------------------------------------
diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ float32_muladd(float32 xa, float32 xb, float32 xc, int flags, float_status *s)
     if (unlikely(!can_use_fpu(s))) {
         goto soft;
     }
-    if (unlikely(flags & float_muladd_halve_result)) {
-        goto soft;
-    }
 
     float32_input_flush3(&ua.s, &ub.s, &uc.s, s);
     if (unlikely(!f32_is_zon3(ua, ub, uc))) {
@@ -XXX,XX +XXX,XX @@ float64_muladd(float64 xa, float64 xb, float64 xc, int flags, float_status *s)
     if (unlikely(!can_use_fpu(s))) {
         goto soft;
     }
-    if (unlikely(flags & float_muladd_halve_result)) {
-        goto soft;
-    }
 
     float64_input_flush3(&ua.s, &ub.s, &uc.s, s);
     if (unlikely(!f64_is_zon3(ua, ub, uc))) {
diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(muladd_scalbn)(FloatPartsN *a, FloatPartsN *b,
     a->exp = p_widen.exp;
 
  return_normal:
-    /* TODO: Replace all use of float_muladd_halve_result with scale. */
-    if (flags & float_muladd_halve_result) {
-        a->exp -= 1;
-    }
     a->exp += scale;
  finish_sign:
     if (flags & float_muladd_negate_result) {
-- 
2.43.0

This rounding mode is used by Hexagon.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/fpu/softfloat-types.h | 2 ++
 fpu/softfloat-parts.c.inc     | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
index XXXXXXX..XXXXXXX 100644
--- a/include/fpu/softfloat-types.h
+++ b/include/fpu/softfloat-types.h
@@ -XXX,XX +XXX,XX @@ typedef enum __attribute__((__packed__)) {
     float_round_to_odd       = 5,
     /* Not an IEEE rounding mode: round to closest odd, overflow to inf */
     float_round_to_odd_inf   = 6,
+    /* Not an IEEE rounding mode: round to nearest even, overflow to max */
+    float_round_nearest_even_max = 7,
 } FloatRoundMode;
 
 /*
diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static void partsN(uncanon_normal)(FloatPartsN *p, float_status *s,
     int exp, flags = 0;
 
     switch (s->float_rounding_mode) {
+    case float_round_nearest_even_max:
+        overflow_norm = true;
+        /* fall through */
     case float_round_nearest_even:
         if (N > 64 && frac_lsb == 0) {
             inc = ((p->frac_hi & 1) || (p->frac_lo & round_mask) != frac_lsbm1
-- 
2.43.0

Certain Hexagon instructions suppress changes to the result
when the product of fma() is a true zero.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/fpu/softfloat.h   | 5 +++++
 fpu/softfloat.c           | 3 +++
 fpu/softfloat-parts.c.inc | 4 +++-
 3 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/include/fpu/softfloat.h b/include/fpu/softfloat.h
index XXXXXXX..XXXXXXX 100644
--- a/include/fpu/softfloat.h
+++ b/include/fpu/softfloat.h
@@ -XXX,XX +XXX,XX @@ bfloat16 bfloat16_squash_input_denormal(bfloat16 a, float_status *status);
 | Using these differs from negating an input or output before calling
 | the muladd function in that this means that a NaN doesn't have its
 | sign bit inverted before it is propagated.
+|
+| With float_muladd_suppress_add_product_zero, if A or B is zero
+| such that the product is a true zero, then return C without addition.
+| This preserves the sign of C when C is +/- 0.  Used for Hexagon.
 *----------------------------------------------------------------------------*/
 enum {
     float_muladd_negate_c = 1,
     float_muladd_negate_product = 2,
     float_muladd_negate_result = 4,
+    float_muladd_suppress_add_product_zero = 8,
 };
 
 /*----------------------------------------------------------------------------
diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ float32_muladd(float32 xa, float32 xb, float32 xc, int flags, float_status *s)
     if (unlikely(!can_use_fpu(s))) {
         goto soft;
     }
+    if (unlikely(flags & float_muladd_suppress_add_product_zero)) {
+        goto soft;
+    }
 
     float32_input_flush3(&ua.s, &ub.s, &uc.s, s);
     if (unlikely(!f32_is_zon3(ua, ub, uc))) {
diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(muladd_scalbn)(FloatPartsN *a, FloatPartsN *b,
             goto return_normal;
         }
         if (c->cls == float_class_zero) {
-            if (a->sign != c->sign) {
+            if (flags & float_muladd_suppress_add_product_zero) {
+                a->sign = c->sign;
+            } else if (a->sign != c->sign) {
                 goto return_sub_zero;
             }
             goto return_zero;
-- 
2.43.0

There are no special cases for this instruction.
Remove internal_mpyf as unused.

Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/hexagon/fma_emu.h   | 1 -
 target/hexagon/fma_emu.c   | 8 --------
 target/hexagon/op_helper.c | 2 +-
 3 files changed, 1 insertion(+), 10 deletions(-)

diff --git a/target/hexagon/fma_emu.h b/target/hexagon/fma_emu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/fma_emu.h
+++ b/target/hexagon/fma_emu.h
@@ -XXX,XX +XXX,XX @@ int32_t float32_getexp(float32 f32);
 float32 infinite_float32(uint8_t sign);
 float32 internal_fmafx(float32 a, float32 b, float32 c,
                        int scale, float_status *fp_status);
-float32 internal_mpyf(float32 a, float32 b, float_status *fp_status);
 float64 internal_mpyhh(float64 a, float64 b,
                        unsigned long long int accumulated,
                        float_status *fp_status);
diff --git a/target/hexagon/fma_emu.c b/target/hexagon/fma_emu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/fma_emu.c
+++ b/target/hexagon/fma_emu.c
@@ -XXX,XX +XXX,XX @@ float32 internal_fmafx(float32 a, float32 b, float32 c, int scale,
     return accum_round_float32(result, fp_status);
 }
 
-float32 internal_mpyf(float32 a, float32 b, float_status *fp_status)
-{
-    if (float32_is_zero(a) || float32_is_zero(b)) {
-        return float32_mul(a, b, fp_status);
-    }
-    return internal_fmafx(a, b, float32_zero, 0, fp_status);
-}
-
 float64 internal_mpyhh(float64 a, float64 b,
                       unsigned long long int accumulated,
                       float_status *fp_status)
diff --git a/target/hexagon/op_helper.c b/target/hexagon/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/op_helper.c
+++ b/target/hexagon/op_helper.c
@@ -XXX,XX +XXX,XX @@ float32 HELPER(sfmpy)(CPUHexagonState *env, float32 RsV, float32 RtV)
 {
     float32 RdV;
     arch_fpop_start(env);
-    RdV = internal_mpyf(RsV, RtV, &env->fp_status);
+    RdV = float32_mul(RsV, RtV, &env->fp_status);
     arch_fpop_end(env);
     return RdV;
 }
-- 
2.43.0

There are no special cases for this instruction.  Since hexagon
always uses default-nan mode, explicitly negating the first
input is unnecessary.  Use float_muladd_negate_product instead.

Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/hexagon/op_helper.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

This instruction has a special case that 0 * x + c returns c
without the normal sign folding that comes with 0 + -0.
Use the new float_muladd_suppress_add_product_zero to
describe this.

Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/hexagon/op_helper.c | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/target/hexagon/op_helper.c b/target/hexagon/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/op_helper.c
+++ b/target/hexagon/op_helper.c
@@ -XXX,XX +XXX,XX @@ static float32 check_nan(float32 dst, float32 x, float_status *fp_status)
 float32 HELPER(sffma_sc)(CPUHexagonState *env, float32 RxV,
                          float32 RsV, float32 RtV, float32 PuV)
 {
-    size4s_t tmp;
     arch_fpop_start(env);
-    RxV = check_nan(RxV, RxV, &env->fp_status);
-    RxV = check_nan(RxV, RsV, &env->fp_status);
-    RxV = check_nan(RxV, RtV, &env->fp_status);
-    tmp = internal_fmafx(RsV, RtV, RxV, fSXTN(8, 64, PuV), &env->fp_status);
-    if (!(float32_is_zero(RxV) && is_zero_prod(RsV, RtV))) {
-        RxV = tmp;
-    }
+    RxV = float32_muladd_scalbn(RsV, RtV, RxV, fSXTN(8, 64, PuV),
+                                float_muladd_suppress_add_product_zero,
+                                &env->fp_status);
     arch_fpop_end(env);
     return RxV;
 }
-- 
2.43.0

There are multiple special cases for this instruction.
(1) The saturate to normal maximum instead of overflow to infinity is
    handled by the new float_round_nearest_even_max rounding mode.
(2) The 0 * n + c special case is handled by the new
    float_muladd_suppress_add_product_zero flag.
(3) The Inf - Inf -> 0 special case can be detected after the fact
    by examining float_flag_invalid_isi.

Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/hexagon/op_helper.c | 105 +++++++++----------------------------
 1 file changed, 26 insertions(+), 79 deletions(-)

diff --git a/target/hexagon/op_helper.c b/target/hexagon/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/op_helper.c
+++ b/target/hexagon/op_helper.c
@@ -XXX,XX +XXX,XX @@ float32 HELPER(sffma)(CPUHexagonState *env, float32 RxV,
     return RxV;
 }
 
-static bool is_zero_prod(float32 a, float32 b)
-{
-    return ((float32_is_zero(a) && is_finite(b)) ||
-            (float32_is_zero(b) && is_finite(a)));
-}
-
-static float32 check_nan(float32 dst, float32 x, float_status *fp_status)
-{
-    float32 ret = dst;
-    if (float32_is_any_nan(x)) {
-        if (extract32(x, 22, 1) == 0) {
-            float_raise(float_flag_invalid, fp_status);
-        }
-        ret = make_float32(0xffffffff);    /* nan */
-    }
-    return ret;
-}
-
 float32 HELPER(sffma_sc)(CPUHexagonState *env, float32 RxV,
                          float32 RsV, float32 RtV, float32 PuV)
 {
@@ -XXX,XX +XXX,XX @@ float32 HELPER(sffms)(CPUHexagonState *env, float32 RxV,
     return RxV;
 }
 
-static bool is_inf_prod(int32_t a, int32_t b)
+static float32 do_sffma_lib(CPUHexagonState *env, float32 RxV,
+                            float32 RsV, float32 RtV, int negate)
 {
-    return (float32_is_infinity(a) && float32_is_infinity(b)) ||
-           (float32_is_infinity(a) && is_finite(b) && !float32_is_zero(b)) ||
-           (float32_is_infinity(b) && is_finite(a) && !float32_is_zero(a));
+    int flags;
+
+    arch_fpop_start(env);
+
+    set_float_rounding_mode(float_round_nearest_even_max, &env->fp_status);
+    RxV = float32_muladd(RsV, RtV, RxV,
+                         negate | float_muladd_suppress_add_product_zero,
+                         &env->fp_status);
+
+    flags = get_float_exception_flags(&env->fp_status);
+    if (flags) {
+        /* Flags are suppressed by this instruction. */
+        set_float_exception_flags(0, &env->fp_status);
+
+        /* Return 0 for Inf - Inf. */
+        if (flags & float_flag_invalid_isi) {
+            RxV = 0;
+        }
+    }
+
+    arch_fpop_end(env);
+    return RxV;
 }
 
 float32 HELPER(sffma_lib)(CPUHexagonState *env, float32 RxV,
                           float32 RsV, float32 RtV)
 {
-    bool infinp;
-    bool infminusinf;
-    float32 tmp;
-
-    arch_fpop_start(env);
-    set_float_rounding_mode(float_round_nearest_even, &env->fp_status);
-    infminusinf = float32_is_infinity(RxV) &&
-                  is_inf_prod(RsV, RtV) &&
-                  (fGETBIT(31, RsV ^ RxV ^ RtV) != 0);
-    infinp = float32_is_infinity(RxV) ||
-             float32_is_infinity(RtV) ||
-             float32_is_infinity(RsV);
-    RxV = check_nan(RxV, RxV, &env->fp_status);
-    RxV = check_nan(RxV, RsV, &env->fp_status);
-    RxV = check_nan(RxV, RtV, &env->fp_status);
-    tmp = internal_fmafx(RsV, RtV, RxV, 0, &env->fp_status);
-    if (!(float32_is_zero(RxV) && is_zero_prod(RsV, RtV))) {
-        RxV = tmp;
-    }
-    set_float_exception_flags(0, &env->fp_status);
-    if (float32_is_infinity(RxV) && !infinp) {
-        RxV = RxV - 1;
-    }
-    if (infminusinf) {
-        RxV = 0;
-    }
-    arch_fpop_end(env);
-    return RxV;
+    return do_sffma_lib(env, RxV, RsV, RtV, 0);
 }
 
 float32 HELPER(sffms_lib)(CPUHexagonState *env, float32 RxV,
                           float32 RsV, float32 RtV)
 {
-    bool infinp;
-    bool infminusinf;
-    float32 tmp;
-
-    arch_fpop_start(env);
-    set_float_rounding_mode(float_round_nearest_even, &env->fp_status);
-    infminusinf = float32_is_infinity(RxV) &&
-                  is_inf_prod(RsV, RtV) &&
-                  (fGETBIT(31, RsV ^ RxV ^ RtV) == 0);
-    infinp = float32_is_infinity(RxV) ||
-             float32_is_infinity(RtV) ||
-             float32_is_infinity(RsV);
-    RxV = check_nan(RxV, RxV, &env->fp_status);
-    RxV = check_nan(RxV, RsV, &env->fp_status);
-    RxV = check_nan(RxV, RtV, &env->fp_status);
-    float32 minus_RsV = float32_sub(float32_zero, RsV, &env->fp_status);
-    tmp = internal_fmafx(minus_RsV, RtV, RxV, 0, &env->fp_status);
-    if (!(float32_is_zero(RxV) && is_zero_prod(RsV, RtV))) {
-        RxV = tmp;
-    }
-    set_float_exception_flags(0, &env->fp_status);
-    if (float32_is_infinity(RxV) && !infinp) {
-        RxV = RxV - 1;
-    }
-    if (infminusinf) {
-        RxV = 0;
-    }
-    arch_fpop_end(env);
-    return RxV;
+    return do_sffma_lib(env, RxV, RsV, RtV, float_muladd_negate_product);
 }
 
 float64 HELPER(dfmpyfix)(CPUHexagonState *env, float64 RssV, float64 RttV)
-- 
2.43.0

The function is now unused.

Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/hexagon/fma_emu.h |   2 -
 target/hexagon/fma_emu.c | 171 ---------------------------------------
 2 files changed, 173 deletions(-)

diff --git a/target/hexagon/fma_emu.h b/target/hexagon/fma_emu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/fma_emu.h
+++ b/target/hexagon/fma_emu.h
@@ -XXX,XX +XXX,XX @@ static inline uint32_t float32_getexp_raw(float32 f32)
 }
 int32_t float32_getexp(float32 f32);
 float32 infinite_float32(uint8_t sign);
-float32 internal_fmafx(float32 a, float32 b, float32 c,
-                       int scale, float_status *fp_status);
 float64 internal_mpyhh(float64 a, float64 b,
                        unsigned long long int accumulated,
                        float_status *fp_status);
diff --git a/target/hexagon/fma_emu.c b/target/hexagon/fma_emu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/fma_emu.c
+++ b/target/hexagon/fma_emu.c
@@ -XXX,XX +XXX,XX @@ int32_t float64_getexp(float64 f64)
     return -1;
 }
 
-static uint64_t float32_getmant(float32 f32)
-{
-    Float a = { .i = f32 };
-    if (float32_is_normal(f32)) {
-        return a.mant | 1ULL << 23;
-    }
-    if (float32_is_zero(f32)) {
-        return 0;
-    }
-    if (float32_is_denormal(f32)) {
-        return a.mant;
-    }
-    return ~0ULL;
-}
-
 int32_t float32_getexp(float32 f32)
 {
     Float a = { .i = f32 };
@@ -XXX,XX +XXX,XX @@ float32 infinite_float32(uint8_t sign)
 }
 
 /* Return a maximum finite value with the requested sign */
-static float32 maxfinite_float32(uint8_t sign)
-{
-    if (sign) {
-        return make_float32(SF_MINUS_MAXF);
-    } else {
-        return make_float32(SF_MAXF);
-    }
-}
-
-/* Return a zero value with requested sign */
-static float32 zero_float32(uint8_t sign)
-{
-    if (sign) {
-        return make_float32(0x80000000);
-    } else {
-        return float32_zero;
-    }
-}
-
 #define GEN_XF_ROUND(SUFFIX, MANTBITS, INF_EXP, INTERNAL_TYPE) \
 static SUFFIX accum_round_##SUFFIX(Accum a, float_status * fp_status) \
 { \
@@ -XXX,XX +XXX,XX @@ static SUFFIX accum_round_##SUFFIX(Accum a, float_status * fp_status) \
 }
 
 GEN_XF_ROUND(float64, DF_MANTBITS, DF_INF_EXP, Double)
-GEN_XF_ROUND(float32, SF_MANTBITS, SF_INF_EXP, Float)
-
-static bool is_inf_prod(float64 a, float64 b)
-{
-    return ((float64_is_infinity(a) && float64_is_infinity(b)) ||
-            (float64_is_infinity(a) && is_finite(b) && (!float64_is_zero(b))) ||
-            (float64_is_infinity(b) && is_finite(a) && (!float64_is_zero(a))));
-}
-
-static float64 special_fma(float64 a, float64 b, float64 c,
-                           float_status *fp_status)
-{
-    float64 ret = make_float64(0);
-
-    /*
-     * If A multiplied by B is an exact infinity and C is also an infinity
-     * but with the opposite sign, FMA returns NaN and raises invalid.
-     */
-    uint8_t a_sign = float64_is_neg(a);
-    uint8_t b_sign = float64_is_neg(b);
-    uint8_t c_sign = float64_is_neg(c);
-    if (is_inf_prod(a, b) && float64_is_infinity(c)) {
-        if ((a_sign ^ b_sign) != c_sign) {
-            ret = make_float64(DF_NAN);
-            float_raise(float_flag_invalid, fp_status);
-            return ret;
-        }
-    }
-    if ((float64_is_infinity(a) && float64_is_zero(b)) ||
-        (float64_is_zero(a) && float64_is_infinity(b))) {
-        ret = make_float64(DF_NAN);
-        float_raise(float_flag_invalid, fp_status);
-        return ret;
-    }
-    /*
-     * If none of the above checks are true and C is a NaN,
-     * a NaN shall be returned
-     * If A or B are NaN, a NAN shall be returned.
-     */
-    if (float64_is_any_nan(a) ||
-        float64_is_any_nan(b) ||
-        float64_is_any_nan(c)) {
-        if (float64_is_any_nan(a) && (fGETBIT(51, a) == 0)) {
-            float_raise(float_flag_invalid, fp_status);
-        }
-        if (float64_is_any_nan(b) && (fGETBIT(51, b) == 0)) {
-            float_raise(float_flag_invalid, fp_status);
-        }
-        if (float64_is_any_nan(c) && (fGETBIT(51, c) == 0)) {
-            float_raise(float_flag_invalid, fp_status);
-        }
-        ret = make_float64(DF_NAN);
-        return ret;
-    }
-    /*
-     * We have checked for adding opposite-signed infinities.
-     * Other infinities return infinity with the correct sign
-     */
-    if (float64_is_infinity(c)) {
-        ret = infinite_float64(c_sign);
-        return ret;
-    }
-    if (float64_is_infinity(a) || float64_is_infinity(b)) {
-        ret = infinite_float64(a_sign ^ b_sign);
-        return ret;
-    }
-    g_assert_not_reached();
-}
-
-static float32 special_fmaf(float32 a, float32 b, float32 c,
-                            float_status *fp_status)
-{
-    float64 aa, bb, cc;
-    aa = float32_to_float64(a, fp_status);
-    bb = float32_to_float64(b, fp_status);
-    cc = float32_to_float64(c, fp_status);
-    return float64_to_float32(special_fma(aa, bb, cc, fp_status), fp_status);
-}
-
-float32 internal_fmafx(float32 a, float32 b, float32 c, int scale,
-                       float_status *fp_status)
-{
-    Accum prod;
-    Accum acc;
-    Accum result;
-    accum_init(&prod);
-    accum_init(&acc);
-    accum_init(&result);
-
-    uint8_t a_sign = float32_is_neg(a);
-    uint8_t b_sign = float32_is_neg(b);
-    uint8_t c_sign = float32_is_neg(c);
-    if (float32_is_infinity(a) ||
-        float32_is_infinity(b) ||
-        float32_is_infinity(c)) {
-        return special_fmaf(a, b, c, fp_status);
-    }
-    if (float32_is_any_nan(a) ||
-        float32_is_any_nan(b) ||
-        float32_is_any_nan(c)) {
-        return special_fmaf(a, b, c, fp_status);
-    }
-    if ((scale == 0) && (float32_is_zero(a) || float32_is_zero(b))) {
-        float32 tmp = float32_mul(a, b, fp_status);
-        tmp = float32_add(tmp, c, fp_status);
-        return tmp;
-    }
-
-    /* (a * 2**b) * (c * 2**d) == a*c * 2**(b+d) */
-    prod.mant = int128_mul_6464(float32_getmant(a), float32_getmant(b));
-
-    /*
-     * Note: extracting the mantissa into an int is multiplying by
-     * 2**23, so adjust here
-     */
-    prod.exp = float32_getexp(a) + float32_getexp(b) - SF_BIAS - 23;
-    prod.sign = a_sign ^ b_sign;
-    if (float32_is_zero(a) || float32_is_zero(b)) {
-        prod.exp = -2 * WAY_BIG_EXP;
-    }
-    if ((scale > 0) && float32_is_denormal(c)) {
-        acc.mant = int128_mul_6464(0, 0);
-        acc.exp = -WAY_BIG_EXP;
-        acc.sign = c_sign;
-        acc.sticky = 1;
-        result = accum_add(prod, acc);
-    } else if (!float32_is_zero(c)) {
-        acc.mant = int128_mul_6464(float32_getmant(c), 1);
-        acc.exp = float32_getexp(c);
-        acc.sign = c_sign;
-        result = accum_add(prod, acc);
-    } else {
-        result = prod;
-    }
-    result.exp += scale;
-    return accum_round_float32(result, fp_status);
-}
 
 float64 internal_mpyhh(float64 a, float64 b,
                       unsigned long long int accumulated,
-- 
2.43.0

This massive macro is now only used once.
Expand it for use only by float64.

Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/hexagon/fma_emu.c | 255 +++++++++++++++++++--------------------
 1 file changed, 127 insertions(+), 128 deletions(-)

diff --git a/target/hexagon/fma_emu.c b/target/hexagon/fma_emu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/fma_emu.c
+++ b/target/hexagon/fma_emu.c
@@ -XXX,XX +XXX,XX @@ float32 infinite_float32(uint8_t sign)
 }
 
 /* Return a maximum finite value with the requested sign */
-#define GEN_XF_ROUND(SUFFIX, MANTBITS, INF_EXP, INTERNAL_TYPE) \
-static SUFFIX accum_round_##SUFFIX(Accum a, float_status * fp_status) \
-{ \
-    if ((int128_gethi(a.mant) == 0) && (int128_getlo(a.mant) == 0) \
-        && ((a.guard | a.round | a.sticky) == 0)) { \
-        /* result zero */ \
-        switch (fp_status->float_rounding_mode) { \
-        case float_round_down: \
-            return zero_##SUFFIX(1); \
-        default: \
-            return zero_##SUFFIX(0); \
-        } \
-    } \
-    /* Normalize right */ \
-    /* We want MANTBITS bits of mantissa plus the leading one. */ \
-    /* That means that we want MANTBITS+1 bits, or 0x000000000000FF_FFFF */ \
-    /* So we need to normalize right while the high word is non-zero and \
-    * while the low word is nonzero when masked with 0xffe0_0000_0000_0000 */ \
-    while ((int128_gethi(a.mant) != 0) || \
-           ((int128_getlo(a.mant) >> (MANTBITS + 1)) != 0)) { \
-        a = accum_norm_right(a, 1); \
-    } \
-    /* \
-     * OK, now normalize left \
-     * We want to normalize left until we have a leading one in bit 24 \
-     * Theoretically, we only need to shift a maximum of one to the left if we \
-     * shifted out lots of bits from B, or if we had no shift / 1 shift sticky \
-     * should be 0  \
-     */ \
-    while ((int128_getlo(a.mant) & (1ULL << MANTBITS)) == 0) { \
-        a = accum_norm_left(a); \
-    } \
-    /* \
-     * OK, now we might need to denormalize because of potential underflow. \
-     * We need to do this before rounding, and rounding might make us normal \
-     * again \
-     */ \
-    while (a.exp <= 0) { \
-        a = accum_norm_right(a, 1 - a.exp); \
-        /* \
-         * Do we have underflow? \
-         * That's when we get an inexact answer because we ran out of bits \
-         * in a denormal. \
-         */ \
-        if (a.guard || a.round || a.sticky) { \
-            float_raise(float_flag_underflow, fp_status); \
-        } \
-    } \
-    /* OK, we're relatively canonical... now we need to round */ \
-    if (a.guard || a.round || a.sticky) { \
-        float_raise(float_flag_inexact, fp_status); \
-        switch (fp_status->float_rounding_mode) { \
-        case float_round_to_zero: \
-            /* Chop and we're done */ \
-            break; \
-        case float_round_up: \
-            if (a.sign == 0) { \
-                a.mant = int128_add(a.mant, int128_one()); \
-            } \
-            break; \
-        case float_round_down: \
-            if (a.sign != 0) { \
-                a.mant = int128_add(a.mant, int128_one()); \
-            } \
-            break; \
-        default: \
-            if (a.round || a.sticky) { \
-                /* round up if guard is 1, down if guard is zero */ \
-                a.mant = int128_add(a.mant, int128_make64(a.guard)); \
-            } else if (a.guard) { \
-                /* exactly .5, round up if odd */ \
-                a.mant = int128_add(a.mant, int128_and(a.mant, int128_one())); \
-            } \
-            break; \
-        } \
-    } \
-    /* \
-     * OK, now we might have carried all the way up. \
-     * So we might need to shr once \
-     * at least we know that the lsb should be zero if we rounded and \
-     * got a carry out... \
-     */ \
-    if ((int128_getlo(a.mant) >> (MANTBITS + 1)) != 0) { \
-        a = accum_norm_right(a, 1); \
-    } \
-    /* Overflow? */ \
-    if (a.exp >= INF_EXP) { \
-        /* Yep, inf result */ \
-        float_raise(float_flag_overflow, fp_status); \
-        float_raise(float_flag_inexact, fp_status); \
-        switch (fp_status->float_rounding_mode) { \
-        case float_round_to_zero: \
-            return maxfinite_##SUFFIX(a.sign); \
-        case float_round_up: \
-            if (a.sign == 0) { \
-                return infinite_##SUFFIX(a.sign); \
-            } else { \
-                return maxfinite_##SUFFIX(a.sign); \
-            } \
-        case float_round_down: \
-            if (a.sign != 0) { \
-                return infinite_##SUFFIX(a.sign); \
-            } else { \
-                return maxfinite_##SUFFIX(a.sign); \
-            } \
-        default: \
-            return infinite_##SUFFIX(a.sign); \
-        } \
-    } \
-    /* Underflow? */ \
-    if (int128_getlo(a.mant) & (1ULL << MANTBITS)) { \
-        /* Leading one means: No, we're normal. So, we should be done... */ \
-        INTERNAL_TYPE ret; \
-        ret.i = 0; \
-        ret.sign = a.sign; \
-        ret.exp = a.exp; \
-        ret.mant = int128_getlo(a.mant); \
-        return ret.i; \
-    } \
-    assert(a.exp == 1); \
-    INTERNAL_TYPE ret; \
-    ret.i = 0; \
-    ret.sign = a.sign; \
-    ret.exp = 0; \
-    ret.mant = int128_getlo(a.mant); \
-    return ret.i; \
+static float64 accum_round_float64(Accum a, float_status *fp_status)
+{
+    if ((int128_gethi(a.mant) == 0) && (int128_getlo(a.mant) == 0)
+        && ((a.guard | a.round | a.sticky) == 0)) {
+        /* result zero */
+        switch (fp_status->float_rounding_mode) {
+        case float_round_down:
+            return zero_float64(1);
+        default:
+            return zero_float64(0);
+        }
+    }
+    /*
+     * Normalize right
+     * We want DF_MANTBITS bits of mantissa plus the leading one.
+     * That means that we want DF_MANTBITS+1 bits, or 0x000000000000FF_FFFF
+     * So we need to normalize right while the high word is non-zero and
+     * while the low word is nonzero when masked with 0xffe0_0000_0000_0000
+     */
+    while ((int128_gethi(a.mant) != 0) ||
+           ((int128_getlo(a.mant) >> (DF_MANTBITS + 1)) != 0)) {
+        a = accum_norm_right(a, 1);
+    }
+    /*
+     * OK, now normalize left
+     * We want to normalize left until we have a leading one in bit 24
+     * Theoretically, we only need to shift a maximum of one to the left if we
+     * shifted out lots of bits from B, or if we had no shift / 1 shift sticky
+     * should be 0
+     */
+    while ((int128_getlo(a.mant) & (1ULL << DF_MANTBITS)) == 0) {
+        a = accum_norm_left(a);
+    }
+    /*
+     * OK, now we might need to denormalize because of potential underflow.
+     * We need to do this before rounding, and rounding might make us normal
+     * again
+     */
+    while (a.exp <= 0) {
+        a = accum_norm_right(a, 1 - a.exp);
+        /*
+         * Do we have underflow?
+         * That's when we get an inexact answer because we ran out of bits
+         * in a denormal.
+         */
+        if (a.guard || a.round || a.sticky) {
+            float_raise(float_flag_underflow, fp_status);
+        }
+    }
+    /* OK, we're relatively canonical... now we need to round */
+    if (a.guard || a.round || a.sticky) {
+        float_raise(float_flag_inexact, fp_status);
+        switch (fp_status->float_rounding_mode) {
+        case float_round_to_zero:
+            /* Chop and we're done */
+            break;
+        case float_round_up:
+            if (a.sign == 0) {
+                a.mant = int128_add(a.mant, int128_one());
+            }
+            break;
+        case float_round_down:
+            if (a.sign != 0) {
+                a.mant = int128_add(a.mant, int128_one());
+            }
+            break;
+        default:
+            if (a.round || a.sticky) {
+                /* round up if guard is 1, down if guard is zero */
+                a.mant = int128_add(a.mant, int128_make64(a.guard));
+            } else if (a.guard) {
+                /* exactly .5, round up if odd */
+                a.mant = int128_add(a.mant, int128_and(a.mant, int128_one()));
+            }
+            break;
+        }
+    }
+    /*
+     * OK, now we might have carried all the way up.
+     * So we might need to shr once
+     * at least we know that the lsb should be zero if we rounded and
+     * got a carry out...
+     */
+    if ((int128_getlo(a.mant) >> (DF_MANTBITS + 1)) != 0) {
+        a = accum_norm_right(a, 1);
+    }
+    /* Overflow? */
+    if (a.exp >= DF_INF_EXP) {
+        /* Yep, inf result */
+        float_raise(float_flag_overflow, fp_status);
+        float_raise(float_flag_inexact, fp_status);
+        switch (fp_status->float_rounding_mode) {
+        case float_round_to_zero:
+            return maxfinite_float64(a.sign);
+        case float_round_up:
+            if (a.sign == 0) {
+                return infinite_float64(a.sign);
+            } else {
+                return maxfinite_float64(a.sign);
+            }
+        case float_round_down:
+            if (a.sign != 0) {
+                return infinite_float64(a.sign);
+            } else {
+                return maxfinite_float64(a.sign);
+            }
+        default:
+            return infinite_float64(a.sign);
+        }
+    }
+    /* Underflow? */
+    if (int128_getlo(a.mant) & (1ULL << DF_MANTBITS)) {
+        /* Leading one means: No, we're normal. So, we should be done... */
+        Double ret;
+        ret.i = 0;
+        ret.sign = a.sign;
+        ret.exp = a.exp;
+        ret.mant = int128_getlo(a.mant);
+        return ret.i;
+    }
+    assert(a.exp == 1);
+    Double ret;
+    ret.i = 0;
+    ret.sign = a.sign;
+    ret.exp = 0;
+    ret.mant = int128_getlo(a.mant);
+    return ret.i;
 }
 
-GEN_XF_ROUND(float64, DF_MANTBITS, DF_INF_EXP, Double)
-
 float64 internal_mpyhh(float64 a, float64 b,
                       unsigned long long int accumulated,
                       float_status *fp_status)
-- 
2.43.0

This structure, with bitfields, is incorrect for big-endian.
Use the existing float32_getexp_raw which uses extract32.

Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/hexagon/fma_emu.c | 16 +++-------------
 1 file changed, 3 insertions(+), 13 deletions(-)

diff --git a/target/hexagon/fma_emu.c b/target/hexagon/fma_emu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/fma_emu.c
+++ b/target/hexagon/fma_emu.c
@@ -XXX,XX +XXX,XX @@ typedef union {
     };
 } Double;
 
-typedef union {
-    float f;
-    uint32_t i;
-    struct {
-        uint32_t mant:23;
-        uint32_t exp:8;
-        uint32_t sign:1;
-    };
-} Float;
-
 static uint64_t float64_getmant(float64 f64)
 {
     Double a = { .i = f64 };
@@ -XXX,XX +XXX,XX @@ int32_t float64_getexp(float64 f64)
 
 int32_t float32_getexp(float32 f32)
 {
-    Float a = { .i = f32 };
+    int exp = float32_getexp_raw(f32);
     if (float32_is_normal(f32)) {
-        return a.exp;
+        return exp;
     }
     if (float32_is_denormal(f32)) {
-        return a.exp + 1;
+        return exp + 1;
     }
     return -1;
 }
-- 
2.43.0

This structure, with bitfields, is incorrect for big-endian.
Use extract64 and deposit64 instead.

Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/hexagon/fma_emu.c | 46 ++++++++++++++--------------------------
 1 file changed, 16 insertions(+), 30 deletions(-)

diff --git a/target/hexagon/fma_emu.c b/target/hexagon/fma_emu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/fma_emu.c
+++ b/target/hexagon/fma_emu.c
@@ -XXX,XX +XXX,XX @@
 
 #define WAY_BIG_EXP 4096
 
-typedef union {
-    double f;
-    uint64_t i;
-    struct {
-        uint64_t mant:52;
-        uint64_t exp:11;
-        uint64_t sign:1;
-    };
-} Double;
-
 static uint64_t float64_getmant(float64 f64)
 {
-    Double a = { .i = f64 };
+    uint64_t mant = extract64(f64, 0, 52);
     if (float64_is_normal(f64)) {
-        return a.mant | 1ULL << 52;
+        return mant | 1ULL << 52;
     }
     if (float64_is_zero(f64)) {
         return 0;
     }
     if (float64_is_denormal(f64)) {
-        return a.mant;
+        return mant;
     }
     return ~0ULL;
 }
 
 int32_t float64_getexp(float64 f64)
 {
-    Double a = { .i = f64 };
+    int exp = extract64(f64, 52, 11);
     if (float64_is_normal(f64)) {
-        return a.exp;
+        return exp;
     }
     if (float64_is_denormal(f64)) {
-        return a.exp + 1;
+        return exp + 1;
     }
     return -1;
 }
@@ -XXX,XX +XXX,XX @@ float32 infinite_float32(uint8_t sign)
 /* Return a maximum finite value with the requested sign */
 static float64 accum_round_float64(Accum a, float_status *fp_status)
 {
+    uint64_t ret;
+
     if ((int128_gethi(a.mant) == 0) && (int128_getlo(a.mant) == 0)
         && ((a.guard | a.round | a.sticky) == 0)) {
         /* result zero */
@@ -XXX,XX +XXX,XX @@ static float64 accum_round_float64(Accum a, float_status *fp_status)
         }
     }
     /* Underflow? */
-    if (int128_getlo(a.mant) & (1ULL << DF_MANTBITS)) {
+    ret = int128_getlo(a.mant);
+    if (ret & (1ULL << DF_MANTBITS)) {
         /* Leading one means: No, we're normal. So, we should be done... */
-        Double ret;
-        ret.i = 0;
-        ret.sign = a.sign;
-        ret.exp = a.exp;
-        ret.mant = int128_getlo(a.mant);
-        return ret.i;
+        ret = deposit64(ret, 52, 11, a.exp);
+    } else {
+        assert(a.exp == 1);
+        ret = deposit64(ret, 52, 11, 0);
     }
-    assert(a.exp == 1);
-    Double ret;
-    ret.i = 0;
-    ret.sign = a.sign;
-    ret.exp = 0;
-    ret.mant = int128_getlo(a.mant);
-    return ret.i;
+    ret = deposit64(ret, 63, 1, a.sign);
+    return ret;
 }
 
 float64 internal_mpyhh(float64 a, float64 b,
-- 
2.43.0

No need to open-code 64x64->128-bit multiplication.

Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/hexagon/fma_emu.c | 32 +++-----------------------------
 1 file changed, 3 insertions(+), 29 deletions(-)

diff --git a/target/hexagon/fma_emu.c b/target/hexagon/fma_emu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/fma_emu.c
+++ b/target/hexagon/fma_emu.c
@@ -XXX,XX +XXX,XX @@ int32_t float32_getexp(float32 f32)
     return -1;
 }
 
-static uint32_t int128_getw0(Int128 x)
-{
-    return int128_getlo(x);
-}
-
-static uint32_t int128_getw1(Int128 x)
-{
-    return int128_getlo(x) >> 32;
-}
-
 static Int128 int128_mul_6464(uint64_t ai, uint64_t bi)
 {
-    Int128 a, b;
-    uint64_t pp0, pp1a, pp1b, pp1s, pp2;
+    uint64_t l, h;
 
-    a = int128_make64(ai);
-    b = int128_make64(bi);
-    pp0 = (uint64_t)int128_getw0(a) * (uint64_t)int128_getw0(b);
-    pp1a = (uint64_t)int128_getw1(a) * (uint64_t)int128_getw0(b);
-    pp1b = (uint64_t)int128_getw1(b) * (uint64_t)int128_getw0(a);
-    pp2 = (uint64_t)int128_getw1(a) * (uint64_t)int128_getw1(b);
-
-    pp1s = pp1a + pp1b;
-    if ((pp1s < pp1a) || (pp1s < pp1b)) {
-        pp2 += (1ULL << 32);
-    }
-    uint64_t ret_low = pp0 + (pp1s << 32);
-    if ((ret_low < pp0) || (ret_low < (pp1s << 32))) {
-        pp2 += 1;
-    }
-
-    return int128_make128(ret_low, pp2 + (pp1s >> 32));
+    mulu64(&l, &h, ai, bi);
+    return int128_make128(l, h);
 }
 
 static Int128 int128_sub_borrow(Int128 a, Int128 b, int borrow)
-- 
2.43.0

Convert all targets simultaneously, as the gen_intermediate_code
function disappears from the target.  While there are possible
workarounds, they're larger than simply performing the conversion.

diff --git a/include/exec/translator.h b/include/exec/translator.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/translator.h
+++ b/include/exec/translator.h
@@ -XXX,XX +XXX,XX @@
 #include "qemu/bswap.h"
 #include "exec/vaddr.h"
 
-/**
- * gen_intermediate_code
- * @cpu: cpu context
- * @tb: translation block
- * @max_insns: max number of instructions to translate
- * @pc: guest virtual program counter address
- * @host_pc: host physical program counter address
- *
- * This function must be provided by the target, which should create
- * the target-specific DisasContext, and then invoke translator_loop.
- */
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int *max_insns,
-                           vaddr pc, void *host_pc);
-
 /**
  * DisasJumpType:
  * @DISAS_NEXT: Next instruction in program order.
diff --git a/include/hw/core/tcg-cpu-ops.h b/include/hw/core/tcg-cpu-ops.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/tcg-cpu-ops.h
+++ b/include/hw/core/tcg-cpu-ops.h
@@ -XXX,XX +XXX,XX @@ struct TCGCPUOps {
      * Called when the first CPU is realized.
      */
     void (*initialize)(void);
+    /**
+     * @translate_code: Translate guest instructions to TCGOps
+     * @cpu: cpu context
+     * @tb: translation block
+     * @max_insns: max number of instructions to translate
+     * @pc: guest virtual program counter address
+     * @host_pc: host physical program counter address
+     *
+     * This function must be provided by the target, which should create
+     * the target-specific DisasContext, and then invoke translator_loop.
+     */
+    void (*translate_code)(CPUState *cpu, TranslationBlock *tb,
+                           int *max_insns, vaddr pc, void *host_pc);
     /**
      * @synchronize_from_tb: Synchronize state from a TCG #TranslationBlock
      *
diff --git a/target/alpha/cpu.h b/target/alpha/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/cpu.h
+++ b/target/alpha/cpu.h
@@ -XXX,XX +XXX,XX @@ enum {
 };
 
 void alpha_translate_init(void);
+void alpha_translate_code(CPUState *cs, TranslationBlock *tb,
+                          int *max_insns, vaddr pc, void *host_pc);
 
 #define CPU_RESOLVING_TYPE TYPE_ALPHA_CPU
 
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ void init_cpreg_list(ARMCPU *cpu);
 
 void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu);
 void arm_translate_init(void);
+void arm_translate_code(CPUState *cs, TranslationBlock *tb,
+                        int *max_insns, vaddr pc, void *host_pc);
 
 void arm_cpu_register_gdb_commands(ARMCPU *cpu);
 void aarch64_cpu_register_gdb_commands(ARMCPU *cpu, GString *,
diff --git a/target/avr/cpu.h b/target/avr/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/cpu.h
+++ b/target/avr/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline void set_avr_feature(CPUAVRState *env, int feature)
 }
 
 void avr_cpu_tcg_init(void);
+void avr_cpu_translate_code(CPUState *cs, TranslationBlock *tb,
+                            int *max_insns, vaddr pc, void *host_pc);
 
 int cpu_avr_exec(CPUState *cpu);
 
diff --git a/target/hexagon/cpu.h b/target/hexagon/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/cpu.h
+++ b/target/hexagon/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline void cpu_get_tb_cpu_state(CPUHexagonState *env, vaddr *pc,
 typedef HexagonCPU ArchCPU;
 
 void hexagon_translate_init(void);
+void hexagon_translate_code(CPUState *cs, TranslationBlock *tb,
+                            int *max_insns, vaddr pc, void *host_pc);
 
 #include "exec/cpu-all.h"
 
diff --git a/target/hppa/cpu.h b/target/hppa/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/cpu.h
+++ b/target/hppa/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline int HPPA_BTLB_ENTRIES(CPUHPPAState *env)
 }
 
 void hppa_translate_init(void);
+void hppa_translate_code(CPUState *cs, TranslationBlock *tb,
+                         int *max_insns, vaddr pc, void *host_pc);
 
 #define CPU_RESOLVING_TYPE TYPE_HPPA_CPU
 
diff --git a/target/i386/tcg/helper-tcg.h b/target/i386/tcg/helper-tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/helper-tcg.h
+++ b/target/i386/tcg/helper-tcg.h
@@ -XXX,XX +XXX,XX @@ static inline target_long lshift(target_long x, int n)
 
 /* translate.c */
 void tcg_x86_init(void);
+void x86_translate_code(CPUState *cs, TranslationBlock *tb,
+                        int *max_insns, vaddr pc, void *host_pc);
 
 /* excp_helper.c */
 G_NORETURN void raise_exception(CPUX86State *env, int exception_index);
diff --git a/target/loongarch/internals.h b/target/loongarch/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/internals.h
+++ b/target/loongarch/internals.h
@@ -XXX,XX +XXX,XX @@
 #define TARGET_VIRT_MASK MAKE_64BIT_MASK(0, TARGET_VIRT_ADDR_SPACE_BITS)
 
 void loongarch_translate_init(void);
+void loongarch_translate_code(CPUState *cs, TranslationBlock *tb,
+                              int *max_insns, vaddr pc, void *host_pc);
 
 void G_NORETURN do_raise_exception(CPULoongArchState *env,
                                    uint32_t exception,
diff --git a/target/m68k/cpu.h b/target/m68k/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/cpu.h
+++ b/target/m68k/cpu.h
@@ -XXX,XX +XXX,XX @@ int m68k_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
 int m68k_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 
 void m68k_tcg_init(void);
+void m68k_translate_code(CPUState *cs, TranslationBlock *tb,
+                         int *max_insns, vaddr pc, void *host_pc);
 void m68k_cpu_init_gdb(M68kCPU *cpu);
 uint32_t cpu_m68k_get_ccr(CPUM68KState *env);
 void cpu_m68k_set_ccr(CPUM68KState *env, uint32_t);
diff --git a/target/microblaze/cpu.h b/target/microblaze/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.h
+++ b/target/microblaze/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline void mb_cpu_write_msr(CPUMBState *env, uint32_t val)
 }
 
 void mb_tcg_init(void);
+void mb_translate_code(CPUState *cs, TranslationBlock *tb,
+                       int *max_insns, vaddr pc, void *host_pc);
 
 #define CPU_RESOLVING_TYPE TYPE_MICROBLAZE_CPU
 
diff --git a/target/mips/tcg/tcg-internal.h b/target/mips/tcg/tcg-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/tcg-internal.h
+++ b/target/mips/tcg/tcg-internal.h
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 
 void mips_tcg_init(void);
+void mips_translate_code(CPUState *cs, TranslationBlock *tb,
+                         int *max_insns, vaddr pc, void *host_pc);
 
 void mips_cpu_synchronize_from_tb(CPUState *cs, const TranslationBlock *tb);
 G_NORETURN void mips_cpu_do_unaligned_access(CPUState *cpu, vaddr addr,
diff --git a/target/openrisc/cpu.h b/target/openrisc/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/cpu.h
+++ b/target/openrisc/cpu.h
@@ -XXX,XX +XXX,XX @@ void openrisc_cpu_dump_state(CPUState *cpu, FILE *f, int flags);
 int openrisc_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
 int openrisc_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 void openrisc_translate_init(void);
+void openrisc_translate_code(CPUState *cs, TranslationBlock *tb,
+                             int *max_insns, vaddr pc, void *host_pc);
 int print_insn_or1k(bfd_vma addr, disassemble_info *info);
 
 #ifndef CONFIG_USER_ONLY
diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -XXX,XX +XXX,XX @@ extern const VMStateDescription vmstate_ppc_cpu;
 
 /*****************************************************************************/
 void ppc_translate_init(void);
+void ppc_translate_code(CPUState *cs, TranslationBlock *tb,
+                        int *max_insns, vaddr pc, void *host_pc);
 
 #if !defined(CONFIG_USER_ONLY)
 void ppc_store_sdr1(CPUPPCState *env, target_ulong value);
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ RISCVException smstateen_acc_ok(CPURISCVState *env, int index, uint64_t bit);
 void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv, bool virt_en);
 
 void riscv_translate_init(void);
+void riscv_translate_code(CPUState *cs, TranslationBlock *tb,
+                          int *max_insns, vaddr pc, void *host_pc);
+
 G_NORETURN void riscv_raise_exception(CPURISCVState *env,
                                       uint32_t exception, uintptr_t pc);
 
diff --git a/target/rx/cpu.h b/target/rx/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/cpu.h
+++ b/target/rx/cpu.h
@@ -XXX,XX +XXX,XX @@ int rx_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
 int rx_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 
 void rx_translate_init(void);
+void rx_translate_code(CPUState *cs, TranslationBlock *tb,
+                       int *max_insns, vaddr pc, void *host_pc);
 void rx_cpu_unpack_psw(CPURXState *env, uint32_t psw, int rte);
 
 #include "exec/cpu-all.h"
diff --git a/target/s390x/s390x-internal.h b/target/s390x/s390x-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/s390x-internal.h
+++ b/target/s390x/s390x-internal.h
@@ -XXX,XX +XXX,XX @@ void handle_diag_308(CPUS390XState *env, uint64_t r1, uint64_t r3,
 
 /* translate.c */
 void s390x_translate_init(void);
+void s390x_translate_code(CPUState *cs, TranslationBlock *tb,
+                          int *max_insns, vaddr pc, void *host_pc);
 void s390x_restore_state_to_opc(CPUState *cs,
                                 const TranslationBlock *tb,
                                 const uint64_t *data);
diff --git a/target/sh4/cpu.h b/target/sh4/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.h
+++ b/target/sh4/cpu.h
@@ -XXX,XX +XXX,XX @@ G_NORETURN void superh_cpu_do_unaligned_access(CPUState *cpu, vaddr addr,
                                                uintptr_t retaddr);
 
 void sh4_translate_init(void);
+void sh4_translate_code(CPUState *cs, TranslationBlock *tb,
+                        int *max_insns, vaddr pc, void *host_pc);
 
 #if !defined(CONFIG_USER_ONLY)
 hwaddr superh_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
diff --git a/target/sparc/cpu.h b/target/sparc/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.h
+++ b/target/sparc/cpu.h
@@ -XXX,XX +XXX,XX @@ int sparc_cpu_memory_rw_debug(CPUState *cpu, vaddr addr,
 
 /* translate.c */
 void sparc_tcg_init(void);
+void sparc_translate_code(CPUState *cs, TranslationBlock *tb,
+                          int *max_insns, vaddr pc, void *host_pc);
 
 /* fop_helper.c */
 target_ulong cpu_get_fsr(CPUSPARCState *);
diff --git a/target/tricore/cpu.h b/target/tricore/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/cpu.h
+++ b/target/tricore/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(TB_FLAGS, PRIV, 0, 2)
 
 void cpu_state_reset(CPUTriCoreState *s);
 void tricore_tcg_init(void);
+void tricore_translate_code(CPUState *cs, TranslationBlock *tb,
+                            int *max_insns, vaddr pc, void *host_pc);
 
 static inline void cpu_get_tb_cpu_state(CPUTriCoreState *env, vaddr *pc,
                                         uint64_t *cs_base, uint32_t *flags)
diff --git a/target/xtensa/cpu.h b/target/xtensa/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.h
+++ b/target/xtensa/cpu.h
@@ -XXX,XX +XXX,XX @@ G_NORETURN void xtensa_cpu_do_unaligned_access(CPUState *cpu, vaddr addr,
 
 void xtensa_collect_sr_names(const XtensaConfig *config);
 void xtensa_translate_init(void);
+void xtensa_translate_code(CPUState *cs, TranslationBlock *tb,
+                           int *max_insns, vaddr pc, void *host_pc);
 void **xtensa_get_regfile_by_name(const char *name, int entries, int bits);
 void xtensa_breakpoint_handler(CPUState *cs);
 void xtensa_register_core(XtensaConfigList *node);
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ bool tcg_exec_realizefn(CPUState *cpu, Error **errp)
 
     if (!tcg_target_initialized) {
         /* Check mandatory TCGCPUOps handlers */
+        const TCGCPUOps *tcg_ops = cpu->cc->tcg_ops;
 #ifndef CONFIG_USER_ONLY
-        assert(cpu->cc->tcg_ops->cpu_exec_halt);
-        assert(cpu->cc->tcg_ops->cpu_exec_interrupt);
+        assert(tcg_ops->cpu_exec_halt);
+        assert(tcg_ops->cpu_exec_interrupt);
 #endif /* !CONFIG_USER_ONLY */
-        cpu->cc->tcg_ops->initialize();
+        assert(tcg_ops->translate_code);
+        tcg_ops->initialize();
         tcg_target_initialized = true;
     }
 
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ static int setjmp_gen_code(CPUArchState *env, TranslationBlock *tb,
 
     tcg_func_start(tcg_ctx);
 
-    tcg_ctx->cpu = env_cpu(env);
-    gen_intermediate_code(env_cpu(env), tb, max_insns, pc, host_pc);
+    CPUState *cs = env_cpu(env);
+    tcg_ctx->cpu = cs;
+    cs->cc->tcg_ops->translate_code(cs, tb, max_insns, pc, host_pc);
+
     assert(tb->size != 0);
     tcg_ctx->cpu = NULL;
     *max_insns = tb->icount;
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
             /*
              * Overflow of code_gen_buffer, or the current slice of it.
              *
-             * TODO: We don't need to re-do gen_intermediate_code, nor
+             * TODO: We don't need to re-do tcg_ops->translate_code, nor
              * should we re-do the tcg optimization currently hidden
              * inside tcg_gen_code.  All that should be required is to
              * flush the TBs, allocate a new TB, re-initialize it per
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps alpha_sysemu_ops = {
 
 static const TCGCPUOps alpha_tcg_ops = {
     .initialize = alpha_translate_init,
+    .translate_code = alpha_translate_code,
     .synchronize_from_tb = alpha_cpu_synchronize_from_tb,
     .restore_state_to_opc = alpha_restore_state_to_opc,
 
diff --git a/target/alpha/translate.c b/target/alpha/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/translate.c
+++ b/target/alpha/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps alpha_tr_ops = {
     .tb_stop            = alpha_tr_tb_stop,
 };
 
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int *max_insns,
-                           vaddr pc, void *host_pc)
+void alpha_translate_code(CPUState *cpu, TranslationBlock *tb,
+                          int *max_insns, vaddr pc, void *host_pc)
 {
     DisasContext dc;
     translator_loop(cpu, tb, max_insns, pc, host_pc, &alpha_tr_ops, &dc.base);
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps arm_sysemu_ops = {
 #ifdef CONFIG_TCG
 static const TCGCPUOps arm_tcg_ops = {
     .initialize = arm_translate_init,
+    .translate_code = arm_translate_code,
     .synchronize_from_tb = arm_cpu_synchronize_from_tb,
     .debug_excp_handler = arm_debug_excp_handler,
     .restore_state_to_opc = arm_restore_state_to_opc,
diff --git a/target/arm/tcg/cpu-v7m.c b/target/arm/tcg/cpu-v7m.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/cpu-v7m.c
+++ b/target/arm/tcg/cpu-v7m.c
@@ -XXX,XX +XXX,XX @@ static void cortex_m55_initfn(Object *obj)
 
 static const TCGCPUOps arm_v7m_tcg_ops = {
     .initialize = arm_translate_init,
+    .translate_code = arm_translate_code,
     .synchronize_from_tb = arm_cpu_synchronize_from_tb,
     .debug_excp_handler = arm_debug_excp_handler,
     .restore_state_to_opc = arm_restore_state_to_opc,
diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate.c
+++ b/target/arm/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps thumb_translator_ops = {
     .tb_stop            = arm_tr_tb_stop,
 };
 
-/* generate intermediate code for basic block 'tb'.  */
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int *max_insns,
-                           vaddr pc, void *host_pc)
+void arm_translate_code(CPUState *cpu, TranslationBlock *tb,
+                        int *max_insns, vaddr pc, void *host_pc)
 {
     DisasContext dc = { };
     const TranslatorOps *ops = &arm_translator_ops;
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps avr_sysemu_ops = {
 
 static const TCGCPUOps avr_tcg_ops = {
     .initialize = avr_cpu_tcg_init,
+    .translate_code = avr_cpu_translate_code,
     .synchronize_from_tb = avr_cpu_synchronize_from_tb,
     .restore_state_to_opc = avr_restore_state_to_opc,
     .cpu_exec_interrupt = avr_cpu_exec_interrupt,
diff --git a/target/avr/translate.c b/target/avr/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/translate.c
+++ b/target/avr/translate.c
@@ -XXX,XX +XXX,XX @@ static bool trans_WDR(DisasContext *ctx, arg_WDR *a)
  *
  *    - translate()
  *    - canonicalize_skip()
- *    - gen_intermediate_code()
+ *    - translate_code()
  *    - restore_state_to_opc()
  *
  */
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps avr_tr_ops = {
     .tb_stop            = avr_tr_tb_stop,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int *max_insns,
-                           vaddr pc, void *host_pc)
+void avr_cpu_translate_code(CPUState *cs, TranslationBlock *tb,
+                            int *max_insns, vaddr pc, void *host_pc)
 {
     DisasContext dc = { };
     translator_loop(cs, tb, max_insns, pc, host_pc, &avr_tr_ops, &dc.base);
diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/cpu.c
+++ b/target/hexagon/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hexagon_cpu_init(Object *obj)
 
 static const TCGCPUOps hexagon_tcg_ops = {
     .initialize = hexagon_translate_init,
+    .translate_code = hexagon_translate_code,
     .synchronize_from_tb = hexagon_cpu_synchronize_from_tb,
     .restore_state_to_opc = hexagon_restore_state_to_opc,
 };
diff --git a/target/hexagon/translate.c b/target/hexagon/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/translate.c
+++ b/target/hexagon/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps hexagon_tr_ops = {
     .tb_stop            = hexagon_tr_tb_stop,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int *max_insns,
-                           vaddr pc, void *host_pc)
+void hexagon_translate_code(CPUState *cs, TranslationBlock *tb,
+                            int *max_insns, vaddr pc, void *host_pc)
 {
     DisasContext ctx;
 
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps hppa_sysemu_ops = {
 
 static const TCGCPUOps hppa_tcg_ops = {
     .initialize = hppa_translate_init,
+    .translate_code = hppa_translate_code,
     .synchronize_from_tb = hppa_cpu_synchronize_from_tb,
     .restore_state_to_opc = hppa_restore_state_to_opc,
 
diff --git a/target/hppa/translate.c b/target/hppa/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/translate.c
+++ b/target/hppa/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps hppa_tr_ops = {
 #endif
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int *max_insns,
-                           vaddr pc, void *host_pc)
+void hppa_translate_code(CPUState *cs, TranslationBlock *tb,
+                         int *max_insns, vaddr pc, void *host_pc)
 {
     DisasContext ctx = { };
     translator_loop(cs, tb, max_insns, pc, host_pc, &hppa_tr_ops, &ctx.base);
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static bool x86_debug_check_breakpoint(CPUState *cs)
 
 static const TCGCPUOps x86_tcg_ops = {
     .initialize = tcg_x86_init,
+    .translate_code = x86_translate_code,
     .synchronize_from_tb = x86_cpu_synchronize_from_tb,
     .restore_state_to_opc = x86_restore_state_to_opc,
     .cpu_exec_enter = x86_cpu_exec_enter,
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps i386_tr_ops = {
     .tb_stop            = i386_tr_tb_stop,
 };
 
-/* generate intermediate code for basic block 'tb'.  */
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int *max_insns,
-                           vaddr pc, void *host_pc)
+void x86_translate_code(CPUState *cpu, TranslationBlock *tb,
+                        int *max_insns, vaddr pc, void *host_pc)
 {
     DisasContext dc;
 
diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -XXX,XX +XXX,XX @@ static void loongarch_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 
 static const TCGCPUOps loongarch_tcg_ops = {
     .initialize = loongarch_translate_init,
+    .translate_code = loongarch_translate_code,
     .synchronize_from_tb = loongarch_cpu_synchronize_from_tb,
     .restore_state_to_opc = loongarch_restore_state_to_opc,
 
diff --git a/target/loongarch/tcg/translate.c b/target/loongarch/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/tcg/translate.c
+++ b/target/loongarch/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps loongarch_tr_ops = {
     .tb_stop            = loongarch_tr_tb_stop,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int *max_insns,
-                           vaddr pc, void *host_pc)
+void loongarch_translate_code(CPUState *cs, TranslationBlock *tb,
+                              int *max_insns, vaddr pc, void *host_pc)
 {
     DisasContext ctx;
 
diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps m68k_sysemu_ops = {
 
 static const TCGCPUOps m68k_tcg_ops = {
     .initialize = m68k_tcg_init,
+    .translate_code = m68k_translate_code,
     .restore_state_to_opc = m68k_restore_state_to_opc,
 
 #ifndef CONFIG_USER_ONLY
diff --git a/target/m68k/translate.c b/target/m68k/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/translate.c
+++ b/target/m68k/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps m68k_tr_ops = {
     .tb_stop            = m68k_tr_tb_stop,
 };
 
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int *max_insns,
-                           vaddr pc, void *host_pc)
+void m68k_translate_code(CPUState *cpu, TranslationBlock *tb,
+                         int *max_insns, vaddr pc, void *host_pc)
 {
     DisasContext dc;
     translator_loop(cpu, tb, max_insns, pc, host_pc, &m68k_tr_ops, &dc.base);
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps mb_sysemu_ops = {
 
 static const TCGCPUOps mb_tcg_ops = {
     .initialize = mb_tcg_init,
+    .translate_code = mb_translate_code,
     .synchronize_from_tb = mb_cpu_synchronize_from_tb,
     .restore_state_to_opc = mb_restore_state_to_opc,
 
diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps mb_tr_ops = {
     .tb_stop            = mb_tr_tb_stop,
 };
 
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int *max_insns,
-                           vaddr pc, void *host_pc)
+void mb_translate_code(CPUState *cpu, TranslationBlock *tb,
+                       int *max_insns, vaddr pc, void *host_pc)
 {
     DisasContext dc;
     translator_loop(cpu, tb, max_insns, pc, host_pc, &mb_tr_ops, &dc.base);
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static const Property mips_cpu_properties[] = {
 #include "hw/core/tcg-cpu-ops.h"
 static const TCGCPUOps mips_tcg_ops = {
     .initialize = mips_tcg_init,
+    .translate_code = mips_translate_code,
     .synchronize_from_tb = mips_cpu_synchronize_from_tb,
     .restore_state_to_opc = mips_restore_state_to_opc,
 
diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/translate.c
+++ b/target/mips/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps mips_tr_ops = {
     .tb_stop            = mips_tr_tb_stop,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int *max_insns,
-                           vaddr pc, void *host_pc)
+void mips_translate_code(CPUState *cs, TranslationBlock *tb,
+                         int *max_insns, vaddr pc, void *host_pc)
 {
     DisasContext ctx;
 
diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps openrisc_sysemu_ops = {
 
 static const TCGCPUOps openrisc_tcg_ops = {
     .initialize = openrisc_translate_init,
+    .translate_code = openrisc_translate_code,
     .synchronize_from_tb = openrisc_cpu_synchronize_from_tb,
     .restore_state_to_opc = openrisc_restore_state_to_opc,
 
diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/translate.c
+++ b/target/openrisc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps openrisc_tr_ops = {
     .tb_stop            = openrisc_tr_tb_stop,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int *max_insns,
-                           vaddr pc, void *host_pc)
+void openrisc_translate_code(CPUState *cs, TranslationBlock *tb,
+                             int *max_insns, vaddr pc, void *host_pc)
 {
     DisasContext ctx;
 
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps ppc_sysemu_ops = {
 
 static const TCGCPUOps ppc_tcg_ops = {
   .initialize = ppc_translate_init,
+  .translate_code = ppc_translate_code,
   .restore_state_to_opc = ppc_restore_state_to_opc,
 
 #ifdef CONFIG_USER_ONLY
diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps ppc_tr_ops = {
     .tb_stop            = ppc_tr_tb_stop,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int *max_insns,
-                           vaddr pc, void *host_pc)
+void ppc_translate_code(CPUState *cs, TranslationBlock *tb,
+                        int *max_insns, vaddr pc, void *host_pc)
 {
     DisasContext ctx;
 
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_restore_state_to_opc(CPUState *cs,
 
 static const TCGCPUOps riscv_tcg_ops = {
     .initialize = riscv_translate_init,
+    .translate_code = riscv_translate_code,
     .synchronize_from_tb = riscv_cpu_synchronize_from_tb,
     .restore_state_to_opc = riscv_restore_state_to_opc,
 
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps riscv_tr_ops = {
     .tb_stop            = riscv_tr_tb_stop,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int *max_insns,
-                           vaddr pc, void *host_pc)
+void riscv_translate_code(CPUState *cs, TranslationBlock *tb,
+                          int *max_insns, vaddr pc, void *host_pc)
 {
     DisasContext ctx;
 
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps rx_sysemu_ops = {
 
 static const TCGCPUOps rx_tcg_ops = {
     .initialize = rx_translate_init,
+    .translate_code = rx_translate_code,
     .synchronize_from_tb = rx_cpu_synchronize_from_tb,
     .restore_state_to_opc = rx_restore_state_to_opc,
     .tlb_fill = rx_cpu_tlb_fill,
diff --git a/target/rx/translate.c b/target/rx/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/translate.c
+++ b/target/rx/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps rx_tr_ops = {
     .tb_stop            = rx_tr_tb_stop,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int *max_insns,
-                           vaddr pc, void *host_pc)
+void rx_translate_code(CPUState *cs, TranslationBlock *tb,
+                       int *max_insns, vaddr pc, void *host_pc)
 {
     DisasContext dc;
 
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPUS390XState *env, vaddr *pc,
 
 static const TCGCPUOps s390_tcg_ops = {
     .initialize = s390x_translate_init,
+    .translate_code = s390x_translate_code,
     .restore_state_to_opc = s390x_restore_state_to_opc,
 
 #ifdef CONFIG_USER_ONLY
diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps s390x_tr_ops = {
     .disas_log          = s390x_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int *max_insns,
-                           vaddr pc, void *host_pc)
+void s390x_translate_code(CPUState *cs, TranslationBlock *tb,
+                          int *max_insns, vaddr pc, void *host_pc)
 {
     DisasContext dc;
 
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps sh4_sysemu_ops = {
 
 static const TCGCPUOps superh_tcg_ops = {
     .initialize = sh4_translate_init,
+    .translate_code = sh4_translate_code,
     .synchronize_from_tb = superh_cpu_synchronize_from_tb,
     .restore_state_to_opc = superh_restore_state_to_opc,
 
diff --git a/target/sh4/translate.c b/target/sh4/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/translate.c
+++ b/target/sh4/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps sh4_tr_ops = {
     .tb_stop            = sh4_tr_tb_stop,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int *max_insns,
-                           vaddr pc, void *host_pc)
+void sh4_translate_code(CPUState *cs, TranslationBlock *tb,
+                        int *max_insns, vaddr pc, void *host_pc)
 {
     DisasContext ctx;
 
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps sparc_sysemu_ops = {
 
 static const TCGCPUOps sparc_tcg_ops = {
     .initialize = sparc_tcg_init,
+    .translate_code = sparc_translate_code,
     .synchronize_from_tb = sparc_cpu_synchronize_from_tb,
     .restore_state_to_opc = sparc_restore_state_to_opc,
 
diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps sparc_tr_ops = {
     .tb_stop            = sparc_tr_tb_stop,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int *max_insns,
-                           vaddr pc, void *host_pc)
+void sparc_translate_code(CPUState *cs, TranslationBlock *tb,
+                          int *max_insns, vaddr pc, void *host_pc)
 {
     DisasContext dc = {};
 
diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps tricore_sysemu_ops = {
 
 static const TCGCPUOps tricore_tcg_ops = {
     .initialize = tricore_tcg_init,
+    .translate_code = tricore_translate_code,
     .synchronize_from_tb = tricore_cpu_synchronize_from_tb,
     .restore_state_to_opc = tricore_restore_state_to_opc,
     .tlb_fill = tricore_cpu_tlb_fill,
diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps tricore_tr_ops = {
     .tb_stop            = tricore_tr_tb_stop,
 };
 
-
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int *max_insns,
-                           vaddr pc, void *host_pc)
+void tricore_translate_code(CPUState *cs, TranslationBlock *tb,
+                            int *max_insns, vaddr pc, void *host_pc)
 {
     DisasContext ctx;
     translator_loop(cs, tb, max_insns, pc, host_pc,
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps xtensa_sysemu_ops = {
 
 static const TCGCPUOps xtensa_tcg_ops = {
     .initialize = xtensa_translate_init,
+    .translate_code = xtensa_translate_code,
     .debug_excp_handler = xtensa_breakpoint_handler,
     .restore_state_to_opc = xtensa_restore_state_to_opc,
 
diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/translate.c
+++ b/target/xtensa/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps xtensa_translator_ops = {
     .tb_stop            = xtensa_tr_tb_stop,
 };
 
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int *max_insns,
-                           vaddr pc, void *host_pc)
+void xtensa_translate_code(CPUState *cpu, TranslationBlock *tb,
+                           int *max_insns, vaddr pc, void *host_pc)
 {
     DisasContext dc = {};
     translator_loop(cpu, tb, max_insns, pc, host_pc,
-- 
2.43.0