Series comparison

-[PULL for-6.0 0/2] tcg patch queue
+[PULL 00/23] tcg patch queue
-Folding in a target/alpha patch since both queues
+The following changes since commit 98c7362b1efe651327385a25874a73e008c6549e:
 are singletons this time.
+  Merge tag 'accel-cpus-20250306' of https://github.com/philmd/qemu into staging (2025-03-07 07:39:49 +0800)
 r~
 The following changes since commit 25d75c99b2e5941c67049ee776efdb226414f4c6:
   Merge remote-tracking branch 'remotes/xtensa/tags/20210403-xtensa' into staging (2021-04-04 21:48:45 +0100)
 are available in the Git repository at:
-  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20210405
+  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20250308
-for you to fetch changes up to ef951ee33fba780dd6c2b7f8ff25c84c3f87a6b8:
+for you to fetch changes up to 9e2080766f037857fc366012aaefd6fead0a75f9:
-  target/alpha: fix icount handling for timer instructions (2021-04-05 07:32:56 -0700)
+  accel/tcg: Build tcg-runtime-gvec.c once (2025-03-08 10:06:48 -0800)
 ----------------------------------------------------------------
-tcg/mips tlb lookup fix
+include/qemu: Tidy atomic128 headers.
-target/alpha icount fix
+include/exec: Split out cpu-interrupt.h
 include/exec: Split many tlb_* declarations to cputlb.h
 include/accel/tcg: Split out getpc.h
 accel/tcg: system: Compile some files once
 linux-user/main: Allow setting tb-size
 ----------------------------------------------------------------
-Kele Huang (1):
+Ilya Leoshkevich (1):
-      tcg/mips: Fix SoftTLB comparison on mips backend
+      linux-user/main: Allow setting tb-size
-Pavel Dovgalyuk (1):
+Philippe Mathieu-Daudé (11):
-      target/alpha: fix icount handling for timer instructions
+      accel/tcg: Restrict CPU_TLB_DYN_*_BITS definitions to accel/tcg/
       exec: Declare tlb_reset_dirty*() in 'exec/cputlb.h'
       exec: Declare tlb_set_page_full() in 'exec/cputlb.h'
       exec: Declare tlb_set_page_with_attrs() in 'exec/cputlb.h'
       exec: Declare tlb_set_page() in 'exec/cputlb.h'
       exec: Declare tlb_hit*() in 'exec/cputlb.h'
       exec: Declare tlb_flush*() in 'exec/cputlb.h'
       accel/tcg: Restrict GETPC_ADJ to 'tb-internal.h'
       qemu/atomic: Rename atomic128-cas.h headers using .h.inc suffix
       qemu/atomic: Rename atomic128-ldst.h headers using .h.inc suffix
       qemu/atomic128: Include missing 'qemu/atomic.h' header
- target/alpha/translate.c  | 9 +++++++--
+Richard Henderson (11):
- tcg/mips/tcg-target.c.inc | 2 +-
+      include/exec: Move TARGET_PAGE_{SIZE,MASK,BITS} to target_page.h
-files changed, 8 insertions(+), 3 deletions(-)
+      include/exec: Split out exec/cpu-interrupt.h
       accel/tcg: Compile watchpoint.c once
       system: Build watchpoint.c once
       accel/tcg: Build tcg-accel-ops.c once
       accel/tcg: Build tcg-accel-ops-icount.c once
       accel/tcg: Build tcg-accel-ops-rr.c once
       accel/tcg: Build tcg-accel-ops-mttcg.c once
       accel/tcg: Split out getpc.h
       accel/tcg: Build tcg-runtime.c once
       accel/tcg: Build tcg-runtime-gvec.c once
+ accel/tcg/internal-common.h                        |   2 +
+ accel/tcg/tb-internal.h                            |  40 +++-
+ host/include/aarch64/host/atomic128-cas.h          |   2 +-
+ include/accel/tcg/getpc.h                          |  24 ++
+ include/exec/cpu-all.h                             |  97 +-------
+ include/exec/cpu-defs.h                            |  26 --
+ include/exec/cpu-interrupt.h                       |  70 ++++++
+ include/exec/cputlb.h                              | 263 ++++++++++++++++++++-
+ include/exec/exec-all.h                            | 262 +-------------------
+ include/exec/poison.h                              |  17 --
+ include/exec/ram_addr.h                            |   1 +
+ include/exec/target_page.h                         |  58 ++++-
+ include/qemu/atomic128.h                           |   5 +-
+ accel/tcg/cputlb.c                                 |  23 ++
+ accel/tcg/tcg-accel-ops-icount.c                   |   2 +-
+ accel/tcg/tcg-accel-ops-mttcg.c                    |   1 -
+ accel/tcg/tcg-accel-ops-rr.c                       |   2 +-
+ accel/tcg/tcg-accel-ops.c                          |   2 +-
+ accel/tcg/tcg-runtime-gvec.c                       |   1 -
+ accel/tcg/tcg-runtime.c                            |   8 +-
+ accel/tcg/watchpoint.c                             |   5 +-
+ cpu-target.c                                       |   1 +
+ hw/intc/armv7m_nvic.c                              |   2 +-
+ hw/ppc/spapr_nested.c                              |   1 +
+ hw/sh4/sh7750.c                                    |   1 +
+ linux-user/main.c                                  |  12 +
+ page-target.c                                      |  18 --
+ page-vary-target.c                                 |   2 -
+ system/physmem.c                                   |   1 +
+ system/watchpoint.c                                |   3 +-
+ target/alpha/helper.c                              |   2 +-
+ target/alpha/sys_helper.c                          |   2 +-
+ target/arm/helper.c                                |   1 +
+ target/arm/tcg/tlb-insns.c                         |   2 +-
+ target/avr/helper.c                                |   2 +-
+ target/hppa/mem_helper.c                           |   1 +
+ target/i386/helper.c                               |   2 +-
+ target/i386/machine.c                              |   2 +-
+ target/i386/tcg/fpu_helper.c                       |   2 +-
+ target/i386/tcg/misc_helper.c                      |   2 +-
+ target/i386/tcg/system/excp_helper.c               |   2 +-
+ target/i386/tcg/system/misc_helper.c               |   2 +-
+ target/i386/tcg/system/svm_helper.c                |   2 +-
+ target/loongarch/tcg/csr_helper.c                  |   2 +-
+ target/loongarch/tcg/tlb_helper.c                  |   1 +
+ target/m68k/helper.c                               |   1 +
+ target/microblaze/helper.c                         |   2 +-
+ target/microblaze/mmu.c                            |   2 +-
+ target/mips/system/cp0.c                           |   2 +-
+ target/mips/tcg/system/cp0_helper.c                |   2 +-
+ target/mips/tcg/system/tlb_helper.c                |   1 +
+ target/openrisc/mmu.c                              |   2 +-
+ target/openrisc/sys_helper.c                       |   1 +
+ target/ppc/helper_regs.c                           |   2 +-
+ target/ppc/misc_helper.c                           |   1 +
+ target/ppc/mmu_helper.c                            |   1 +
+ target/riscv/cpu_helper.c                          |   1 +
+ target/riscv/csr.c                                 |   1 +
+ target/riscv/op_helper.c                           |   1 +
+ target/riscv/pmp.c                                 |   2 +-
+ target/rx/cpu.c                                    |   2 +-
+ target/s390x/gdbstub.c                             |   2 +-
+ target/s390x/sigp.c                                |   1 +
+ target/s390x/tcg/excp_helper.c                     |   1 +
+ target/s390x/tcg/mem_helper.c                      |   1 +
+ target/s390x/tcg/misc_helper.c                     |   1 +
+ target/sh4/helper.c                                |   1 +
+ target/sparc/ldst_helper.c                         |   1 +
+ target/sparc/mmu_helper.c                          |   2 +-
+ target/tricore/helper.c                            |   2 +-
+ target/xtensa/helper.c                             |   2 +-
+ target/xtensa/mmu_helper.c                         |   1 +
+ accel/tcg/meson.build                              |  14 +-
+ .../{atomic128-ldst.h => atomic128-ldst.h.inc}     |   0
+ .../host/{atomic128-cas.h => atomic128-cas.h.inc}  |   0
+ .../{atomic128-ldst.h => atomic128-ldst.h.inc}     |   0
+ .../{atomic128-ldst.h => atomic128-ldst.h.inc}     |   0
+ .../{atomic128-ldst.h => atomic128-ldst.h.inc}     |   2 +-
+ .../x86_64/host/load-extract-al16-al8.h.inc        |   2 +-
+ system/meson.build                                 |   2 +-
+files changed, 552 insertions(+), 486 deletions(-)
+ create mode 100644 include/accel/tcg/getpc.h
+ create mode 100644 include/exec/cpu-interrupt.h
+ rename host/include/aarch64/host/{atomic128-ldst.h => atomic128-ldst.h.inc} (100%)
+ rename host/include/generic/host/{atomic128-cas.h => atomic128-cas.h.inc} (100%)
+ rename host/include/generic/host/{atomic128-ldst.h => atomic128-ldst.h.inc} (100%)
+ rename host/include/loongarch64/host/{atomic128-ldst.h => atomic128-ldst.h.inc} (100%)
+ rename host/include/x86_64/host/{atomic128-ldst.h => atomic128-ldst.h.inc} (96%)

-New patch
+[PULL 01/23] linux-user/main: Allow setting tb-size
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+While qemu-system can set tb-size using -accel tcg,tb-size=n, there
+is no similar knob for qemu-user. Add one in a way similar to how
+one-insn-per-tb is already handled.
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-ID: <20240730215532.1442-1-iii@linux.ibm.com>
+---
+ linux-user/main.c | 12 ++++++++++++
+file changed, 12 insertions(+)
+diff --git a/linux-user/main.c b/linux-user/main.c
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/main.c
++++ b/linux-user/main.c
+@@ -XXX,XX +XXX,XX @@ char *exec_path;
+ char real_exec_path[PATH_MAX];
+ static bool opt_one_insn_per_tb;
++static unsigned long opt_tb_size;
+ static const char *argv0;
+ static const char *gdbstub;
+ static envlist_t *envlist;
+@@ -XXX,XX +XXX,XX @@ static void handle_arg_one_insn_per_tb(const char *arg)
+     opt_one_insn_per_tb = true;
+ }
++static void handle_arg_tb_size(const char *arg)
++{
++    if (qemu_strtoul(arg, NULL, 0, &opt_tb_size)) {
++        usage(EXIT_FAILURE);
++    }
++}
++
+ static void handle_arg_strace(const char *arg)
+ {
+     enable_strace = true;
+@@ -XXX,XX +XXX,XX @@ static const struct qemu_argument arg_table[] = {
+     {"one-insn-per-tb",
+                    "QEMU_ONE_INSN_PER_TB",  false, handle_arg_one_insn_per_tb,
+      "",           "run with one guest instruction per emulated TB"},
++    {"tb-size",    "QEMU_TB_SIZE",     true,  handle_arg_tb_size,
++     "size",       "TCG translation block cache size"},
+     {"strace",     "QEMU_STRACE",      false, handle_arg_strace,
+      "",           "log system calls"},
+     {"seed",       "QEMU_RAND_SEED",   true,  handle_arg_seed,
+@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp)
+         accel_init_interfaces(ac);
+         object_property_set_bool(OBJECT(accel), "one-insn-per-tb",
+                                  opt_one_insn_per_tb, &error_abort);
++        object_property_set_int(OBJECT(accel), "tb-size",
++                                opt_tb_size, &error_abort);
+         ac->init_machine(NULL);
+     }
+--
+.43.0

-New patch
+[PULL 02/23] accel/tcg: Restrict CPU_TLB_DYN_*_BITS definitions to accel/tcg/
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
+CPU_TLB_DYN_*_BITS definitions are only used by accel/tcg/cputlb.c
+and accel/tcg/translate-all.c. Move them to accel/tcg/tb-internal.h.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-ID: <20250305191859.71608-1-philmd@linaro.org>
+---
+ accel/tcg/tb-internal.h | 27 +++++++++++++++++++++++++++
+ include/exec/cpu-defs.h | 26 --------------------------
+files changed, 27 insertions(+), 26 deletions(-)
+diff --git a/accel/tcg/tb-internal.h b/accel/tcg/tb-internal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/tb-internal.h
++++ b/accel/tcg/tb-internal.h
+@@ -XXX,XX +XXX,XX @@
+ #include "exec/exec-all.h"
+ #include "exec/translation-block.h"
++#ifdef CONFIG_SOFTMMU
++
++#define CPU_TLB_DYN_MIN_BITS 6
++#define CPU_TLB_DYN_DEFAULT_BITS 8
++
++# if HOST_LONG_BITS == 32
++/* Make sure we do not require a double-word shift for the TLB load */
++#  define CPU_TLB_DYN_MAX_BITS (32 - TARGET_PAGE_BITS)
++# else /* HOST_LONG_BITS == 64 */
++/*
++ * Assuming TARGET_PAGE_BITS==12, with 2**22 entries we can cover 2**(22+12) ==
++ * 2**34 == 16G of address space. This is roughly what one would expect a
++ * TLB to cover in a modern (as of 2018) x86_64 CPU. For instance, Intel
++ * Skylake's Level-2 STLB has 16 1G entries.
++ * Also, make sure we do not size the TLB past the guest's address space.
++ */
++#  ifdef TARGET_PAGE_BITS_VARY
++#   define CPU_TLB_DYN_MAX_BITS                                  \
++    MIN(22, TARGET_VIRT_ADDR_SPACE_BITS - TARGET_PAGE_BITS)
++#  else
++#   define CPU_TLB_DYN_MAX_BITS                                  \
++    MIN_CONST(22, TARGET_VIRT_ADDR_SPACE_BITS - TARGET_PAGE_BITS)
++#  endif
++# endif
++
++#endif /* CONFIG_SOFTMMU */
++
+ #ifdef CONFIG_USER_ONLY
+ #include "user/page-protection.h"
+ /*
+diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/exec/cpu-defs.h
++++ b/include/exec/cpu-defs.h
+@@ -XXX,XX +XXX,XX @@
+ #include "exec/target_long.h"
+-#if defined(CONFIG_SOFTMMU) && defined(CONFIG_TCG)
+-#define CPU_TLB_DYN_MIN_BITS 6
+-#define CPU_TLB_DYN_DEFAULT_BITS 8
+-
+-# if HOST_LONG_BITS == 32
+-/* Make sure we do not require a double-word shift for the TLB load */
+-#  define CPU_TLB_DYN_MAX_BITS (32 - TARGET_PAGE_BITS)
+-# else /* HOST_LONG_BITS == 64 */
+-/*
+- * Assuming TARGET_PAGE_BITS==12, with 2**22 entries we can cover 2**(22+12) ==
+- * 2**34 == 16G of address space. This is roughly what one would expect a
+- * TLB to cover in a modern (as of 2018) x86_64 CPU. For instance, Intel
+- * Skylake's Level-2 STLB has 16 1G entries.
+- * Also, make sure we do not size the TLB past the guest's address space.
+- */
+-#  ifdef TARGET_PAGE_BITS_VARY
+-#   define CPU_TLB_DYN_MAX_BITS                                  \
+-    MIN(22, TARGET_VIRT_ADDR_SPACE_BITS - TARGET_PAGE_BITS)
+-#  else
+-#   define CPU_TLB_DYN_MAX_BITS                                  \
+-    MIN_CONST(22, TARGET_VIRT_ADDR_SPACE_BITS - TARGET_PAGE_BITS)
+-#  endif
+-# endif
+-
+-#endif /* CONFIG_SOFTMMU && CONFIG_TCG */
+-
+ #endif
+--
+.43.0

-New patch
+[PULL 03/23] include/exec: Move TARGET_PAGE_{SIZE, MASK, BITS} to target_page.h
+Re-use the TARGET_PAGE_BITS_VARY mechanism to define
+TARGET_PAGE_SIZE and friends when not compiling per-target.
+Inline qemu_target_page_{size,mask,bits} as they are now trivial.
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ include/exec/cpu-all.h     | 21 +-------------
+ include/exec/poison.h      |  4 ---
+ include/exec/target_page.h | 58 ++++++++++++++++++++++++++++++++++----
+ page-target.c              | 18 ------------
+ page-vary-target.c         |  2 --
+files changed, 53 insertions(+), 50 deletions(-)
+diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/exec/cpu-all.h
++++ b/include/exec/cpu-all.h
+@@ -XXX,XX +XXX,XX @@ static inline void stl_phys_notdirty(AddressSpace *as, hwaddr addr, uint32_t val
+ /* page related stuff */
+ #include "exec/cpu-defs.h"
+-#ifdef TARGET_PAGE_BITS_VARY
+-# include "exec/page-vary.h"
+-extern const TargetPageBits target_page;
+-# ifdef CONFIG_DEBUG_TCG
+-#  define TARGET_PAGE_BITS   ({ assert(target_page.decided); \
+-                                target_page.bits; })
+-#  define TARGET_PAGE_MASK   ({ assert(target_page.decided); \
+-                                (target_long)target_page.mask; })
+-# else
+-#  define TARGET_PAGE_BITS   target_page.bits
+-#  define TARGET_PAGE_MASK   ((target_long)target_page.mask)
+-# endif
+-# define TARGET_PAGE_SIZE    (-(int)TARGET_PAGE_MASK)
+-#else
+-# define TARGET_PAGE_BITS_MIN TARGET_PAGE_BITS
+-# define TARGET_PAGE_SIZE    (1 << TARGET_PAGE_BITS)
+-# define TARGET_PAGE_MASK    ((target_long)-1 << TARGET_PAGE_BITS)
+-#endif
+-
+-#define TARGET_PAGE_ALIGN(addr) ROUND_UP((addr), TARGET_PAGE_SIZE)
++#include "exec/target_page.h"
+ CPUArchState *cpu_copy(CPUArchState *env);
+diff --git a/include/exec/poison.h b/include/exec/poison.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/exec/poison.h
++++ b/include/exec/poison.h
+@@ -XXX,XX +XXX,XX @@
+ #pragma GCC poison TARGET_FMT_ld
+ #pragma GCC poison TARGET_FMT_lu
+-#pragma GCC poison TARGET_PAGE_SIZE
+-#pragma GCC poison TARGET_PAGE_MASK
+-#pragma GCC poison TARGET_PAGE_BITS
+-#pragma GCC poison TARGET_PAGE_ALIGN
+ #pragma GCC poison TARGET_PHYS_ADDR_SPACE_BITS
+ #pragma GCC poison CPU_INTERRUPT_HARD
+diff --git a/include/exec/target_page.h b/include/exec/target_page.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/exec/target_page.h
++++ b/include/exec/target_page.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef EXEC_TARGET_PAGE_H
+ #define EXEC_TARGET_PAGE_H
+-size_t qemu_target_page_size(void);
+-int qemu_target_page_mask(void);
+-int qemu_target_page_bits(void);
+-int qemu_target_page_bits_min(void);
+-
+-size_t qemu_target_pages_to_MiB(size_t pages);
++/*
++ * If compiling per-target, get the real values.
++ * For generic code, reuse the mechanism for variable page size.
++ */
++#ifdef COMPILING_PER_TARGET
++#include "cpu-param.h"
++#include "exec/target_long.h"
++#define TARGET_PAGE_TYPE  target_long
++#else
++#define TARGET_PAGE_BITS_VARY
++#define TARGET_PAGE_TYPE  int
++#endif
++
++#ifdef TARGET_PAGE_BITS_VARY
++# include "exec/page-vary.h"
++extern const TargetPageBits target_page;
++# ifdef CONFIG_DEBUG_TCG
++#  define TARGET_PAGE_BITS   ({ assert(target_page.decided); \
++                                target_page.bits; })
++#  define TARGET_PAGE_MASK   ({ assert(target_page.decided); \
++                                (TARGET_PAGE_TYPE)target_page.mask; })
++# else
++#  define TARGET_PAGE_BITS   target_page.bits
++#  define TARGET_PAGE_MASK   ((TARGET_PAGE_TYPE)target_page.mask)
++# endif
++# define TARGET_PAGE_SIZE    (-(int)TARGET_PAGE_MASK)
++#else
++# define TARGET_PAGE_BITS_MIN TARGET_PAGE_BITS
++# define TARGET_PAGE_SIZE    (1 << TARGET_PAGE_BITS)
++# define TARGET_PAGE_MASK    ((TARGET_PAGE_TYPE)-1 << TARGET_PAGE_BITS)
++#endif
++
++#define TARGET_PAGE_ALIGN(addr) ROUND_UP((addr), TARGET_PAGE_SIZE)
++
++static inline size_t qemu_target_page_size(void)
++{
++    return TARGET_PAGE_SIZE;
++}
++
++static inline int qemu_target_page_mask(void)
++{
++    return TARGET_PAGE_MASK;
++}
++
++static inline int qemu_target_page_bits(void)
++{
++    return TARGET_PAGE_BITS;
++}
++
++int qemu_target_page_bits_min(void);
++size_t qemu_target_pages_to_MiB(size_t pages);
++
+ #endif
+diff --git a/page-target.c b/page-target.c
+index XXXXXXX..XXXXXXX 100644
+--- a/page-target.c
++++ b/page-target.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "exec/target_page.h"
+-#include "exec/cpu-defs.h"
+-#include "cpu.h"
+-#include "exec/cpu-all.h"
+-
+-size_t qemu_target_page_size(void)
+-{
+-    return TARGET_PAGE_SIZE;
+-}
+-
+-int qemu_target_page_mask(void)
+-{
+-    return TARGET_PAGE_MASK;
+-}
+-
+-int qemu_target_page_bits(void)
+-{
+-    return TARGET_PAGE_BITS;
+-}
+ int qemu_target_page_bits_min(void)
+ {
+diff --git a/page-vary-target.c b/page-vary-target.c
+index XXXXXXX..XXXXXXX 100644
+--- a/page-vary-target.c
++++ b/page-vary-target.c
+@@ -XXX,XX +XXX,XX @@ bool set_preferred_target_page_bits(int bits)
+ void finalize_target_page_bits(void)
+ {
+-#ifdef TARGET_PAGE_BITS_VARY
+     finalize_target_page_bits_common(TARGET_PAGE_BITS_MIN);
+-#endif
+ }
+--
+.43.0

-New patch
+[PULL 04/23] include/exec: Split out exec/cpu-interrupt.h
+Some of these bits are actually common to all cpus; while the
+reset have common reservations for target-specific usage.
+While generic code cannot know what the target-specific usage is,
+common code can know what to do with the bits, e.g. single-step.
+Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ include/exec/cpu-all.h       | 53 +--------------------------
+ include/exec/cpu-interrupt.h | 70 ++++++++++++++++++++++++++++++++++++
+ include/exec/poison.h        | 13 -------
+files changed, 71 insertions(+), 65 deletions(-)
+ create mode 100644 include/exec/cpu-interrupt.h
+diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/exec/cpu-all.h
++++ b/include/exec/cpu-all.h
+@@ -XXX,XX +XXX,XX @@
+ #include "exec/page-protection.h"
+ #include "exec/cpu-common.h"
++#include "exec/cpu-interrupt.h"
+ #include "exec/memory.h"
+ #include "exec/tswap.h"
+ #include "hw/core/cpu.h"
+@@ -XXX,XX +XXX,XX @@ static inline void stl_phys_notdirty(AddressSpace *as, hwaddr addr, uint32_t val
+ CPUArchState *cpu_copy(CPUArchState *env);
+-/* Flags for use in ENV->INTERRUPT_PENDING.
+-
+-   The numbers assigned here are non-sequential in order to preserve
+-   binary compatibility with the vmstate dump.  Bit 0 (0x0001) was
+-   previously used for CPU_INTERRUPT_EXIT, and is cleared when loading
+-   the vmstate dump.  */
+-
+-/* External hardware interrupt pending.  This is typically used for
+-   interrupts from devices.  */
+-#define CPU_INTERRUPT_HARD        0x0002
+-
+-/* Exit the current TB.  This is typically used when some system-level device
+-   makes some change to the memory mapping.  E.g. the a20 line change.  */
+-#define CPU_INTERRUPT_EXITTB      0x0004
+-
+-/* Halt the CPU.  */
+-#define CPU_INTERRUPT_HALT        0x0020
+-
+-/* Debug event pending.  */
+-#define CPU_INTERRUPT_DEBUG       0x0080
+-
+-/* Reset signal.  */
+-#define CPU_INTERRUPT_RESET       0x0400
+-
+-/* Several target-specific external hardware interrupts.  Each target/cpu.h
+-   should define proper names based on these defines.  */
+-#define CPU_INTERRUPT_TGT_EXT_0   0x0008
+-#define CPU_INTERRUPT_TGT_EXT_1   0x0010
+-#define CPU_INTERRUPT_TGT_EXT_2   0x0040
+-#define CPU_INTERRUPT_TGT_EXT_3   0x0200
+-#define CPU_INTERRUPT_TGT_EXT_4   0x1000
+-
+-/* Several target-specific internal interrupts.  These differ from the
+-   preceding target-specific interrupts in that they are intended to
+-   originate from within the cpu itself, typically in response to some
+-   instruction being executed.  These, therefore, are not masked while
+-   single-stepping within the debugger.  */
+-#define CPU_INTERRUPT_TGT_INT_0   0x0100
+-#define CPU_INTERRUPT_TGT_INT_1   0x0800
+-#define CPU_INTERRUPT_TGT_INT_2   0x2000
+-
+-/* First unused bit: 0x4000.  */
+-
+-/* The set of all bits that should be masked when single-stepping.  */
+-#define CPU_INTERRUPT_SSTEP_MASK \
+-    (CPU_INTERRUPT_HARD          \
+-     | CPU_INTERRUPT_TGT_EXT_0   \
+-     | CPU_INTERRUPT_TGT_EXT_1   \
+-     | CPU_INTERRUPT_TGT_EXT_2   \
+-     | CPU_INTERRUPT_TGT_EXT_3   \
+-     | CPU_INTERRUPT_TGT_EXT_4)
+-
+ #include "cpu.h"
+ #ifdef CONFIG_USER_ONLY
+diff --git a/include/exec/cpu-interrupt.h b/include/exec/cpu-interrupt.h
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/include/exec/cpu-interrupt.h
+@@ -XXX,XX +XXX,XX @@
++/*
++ * Flags for use with cpu_interrupt()
++ *
++ * Copyright (c) 2003 Fabrice Bellard
++ * SPDX-License-Identifier: LGPL-2.1-or-later
++ */
++
++#ifndef CPU_INTERRUPT_H
++#define CPU_INTERRUPT_H
++
++/*
++ * The numbers assigned here are non-sequential in order to preserve binary
++ * compatibility with the vmstate dump.  Bit 0 (0x0001) was previously used
++ * for CPU_INTERRUPT_EXIT, and is cleared when loading the vmstate dump.
++ */
++
++/*
++ * External hardware interrupt pending.
++ * This is typically used for interrupts from devices.
++ */
++#define CPU_INTERRUPT_HARD        0x0002
++
++/*
++ * Exit the current TB.  This is typically used when some system-level device
++ * makes some change to the memory mapping.  E.g. the a20 line change.
++ */
++#define CPU_INTERRUPT_EXITTB      0x0004
++
++/* Halt the CPU.  */
++#define CPU_INTERRUPT_HALT        0x0020
++
++/* Debug event pending.  */
++#define CPU_INTERRUPT_DEBUG       0x0080
++
++/* Reset signal.  */
++#define CPU_INTERRUPT_RESET       0x0400
++
++/*
++ * Several target-specific external hardware interrupts.  Each target/cpu.h
++ * should define proper names based on these defines.
++ */
++#define CPU_INTERRUPT_TGT_EXT_0   0x0008
++#define CPU_INTERRUPT_TGT_EXT_1   0x0010
++#define CPU_INTERRUPT_TGT_EXT_2   0x0040
++#define CPU_INTERRUPT_TGT_EXT_3   0x0200
++#define CPU_INTERRUPT_TGT_EXT_4   0x1000
++
++/*
++ * Several target-specific internal interrupts.  These differ from the
++ * preceding target-specific interrupts in that they are intended to
++ * originate from within the cpu itself, typically in response to some
++ * instruction being executed.  These, therefore, are not masked while
++ * single-stepping within the debugger.
++ */
++#define CPU_INTERRUPT_TGT_INT_0   0x0100
++#define CPU_INTERRUPT_TGT_INT_1   0x0800
++#define CPU_INTERRUPT_TGT_INT_2   0x2000
++
++/* First unused bit: 0x4000.  */
++
++/* The set of all bits that should be masked when single-stepping.  */
++#define CPU_INTERRUPT_SSTEP_MASK \
++    (CPU_INTERRUPT_HARD          \
++     | CPU_INTERRUPT_TGT_EXT_0   \
++     | CPU_INTERRUPT_TGT_EXT_1   \
++     | CPU_INTERRUPT_TGT_EXT_2   \
++     | CPU_INTERRUPT_TGT_EXT_3   \
++     | CPU_INTERRUPT_TGT_EXT_4)
++
++#endif /* CPU_INTERRUPT_H */
+diff --git a/include/exec/poison.h b/include/exec/poison.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/exec/poison.h
++++ b/include/exec/poison.h
+@@ -XXX,XX +XXX,XX @@
+ #pragma GCC poison TARGET_PHYS_ADDR_SPACE_BITS
+-#pragma GCC poison CPU_INTERRUPT_HARD
+-#pragma GCC poison CPU_INTERRUPT_EXITTB
+-#pragma GCC poison CPU_INTERRUPT_HALT
+-#pragma GCC poison CPU_INTERRUPT_DEBUG
+-#pragma GCC poison CPU_INTERRUPT_TGT_EXT_0
+-#pragma GCC poison CPU_INTERRUPT_TGT_EXT_1
+-#pragma GCC poison CPU_INTERRUPT_TGT_EXT_2
+-#pragma GCC poison CPU_INTERRUPT_TGT_EXT_3
+-#pragma GCC poison CPU_INTERRUPT_TGT_EXT_4
+-#pragma GCC poison CPU_INTERRUPT_TGT_INT_0
+-#pragma GCC poison CPU_INTERRUPT_TGT_INT_1
+-#pragma GCC poison CPU_INTERRUPT_TGT_INT_2
+-
+ #pragma GCC poison CONFIG_ALPHA_DIS
+ #pragma GCC poison CONFIG_HPPA_DIS
+ #pragma GCC poison CONFIG_I386_DIS
+--
+.43.0

-New patch
+[PULL 05/23] accel/tcg: Compile watchpoint.c once
+Move tb_check_watchpoint declaration from tb-internal.h, which is
+still target-specific, to internal-common.h, which isn't.
+Otherwise, all that is required to build watchpoint.c once is
+to include the new exec/cpu-interrupt.h instead of exec/exec-all.h.
+Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ accel/tcg/internal-common.h | 2 ++
+ accel/tcg/tb-internal.h     | 2 --
+ accel/tcg/watchpoint.c      | 5 ++---
+ accel/tcg/meson.build       | 2 +-
+files changed, 5 insertions(+), 6 deletions(-)
+diff --git a/accel/tcg/internal-common.h b/accel/tcg/internal-common.h
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/internal-common.h
++++ b/accel/tcg/internal-common.h
+@@ -XXX,XX +XXX,XX @@ void tcg_exec_unrealizefn(CPUState *cpu);
+ /* current cflags for hashing/comparison */
+ uint32_t curr_cflags(CPUState *cpu);
++void tb_check_watchpoint(CPUState *cpu, uintptr_t retaddr);
++
+ #endif
+diff --git a/accel/tcg/tb-internal.h b/accel/tcg/tb-internal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/tb-internal.h
++++ b/accel/tcg/tb-internal.h
+@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_range_fast(ram_addr_t ram_addr,
+ bool tb_invalidate_phys_page_unwind(tb_page_addr_t addr, uintptr_t pc);
+-void tb_check_watchpoint(CPUState *cpu, uintptr_t retaddr);
+-
+ #endif
+diff --git a/accel/tcg/watchpoint.c b/accel/tcg/watchpoint.c
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/watchpoint.c
++++ b/accel/tcg/watchpoint.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qemu/main-loop.h"
+-#include "qemu/error-report.h"
+-#include "exec/exec-all.h"
++#include "exec/breakpoint.h"
++#include "exec/cpu-interrupt.h"
+ #include "exec/page-protection.h"
+ #include "exec/translation-block.h"
+-#include "tb-internal.h"
+ #include "system/tcg.h"
+ #include "system/replay.h"
+ #include "accel/tcg/cpu-ops.h"
+diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/meson.build
++++ b/accel/tcg/meson.build
+@@ -XXX,XX +XXX,XX @@ specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_specific_ss)
+ specific_ss.add(when: ['CONFIG_SYSTEM_ONLY', 'CONFIG_TCG'], if_true: files(
+   'cputlb.c',
+-  'watchpoint.c',
+   'tcg-accel-ops.c',
+   'tcg-accel-ops-mttcg.c',
+   'tcg-accel-ops-icount.c',
+@@ -XXX,XX +XXX,XX @@ specific_ss.add(when: ['CONFIG_SYSTEM_ONLY', 'CONFIG_TCG'], if_true: files(
+ system_ss.add(when: ['CONFIG_TCG'], if_true: files(
+   'icount-common.c',
+   'monitor.c',
++  'watchpoint.c',
+ ))
+--
+.43.0

-New patch
+[PULL 06/23] exec: Declare tlb_reset_dirty*() in 'exec/cputlb.h'
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
+Move CPU TLB related methods to "exec/cputlb.h".
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Message-ID: <20241114011310.3615-14-philmd@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ include/exec/cputlb.h   | 7 +++++++
+ include/exec/exec-all.h | 3 ---
+ include/exec/ram_addr.h | 1 +
+ system/physmem.c        | 1 +
+files changed, 9 insertions(+), 3 deletions(-)
+diff --git a/include/exec/cputlb.h b/include/exec/cputlb.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/exec/cputlb.h
++++ b/include/exec/cputlb.h
+@@ -XXX,XX +XXX,XX @@ void tlb_unprotect_code(ram_addr_t ram_addr);
+ #endif /* CONFIG_TCG */
++#ifndef CONFIG_USER_ONLY
++
++void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length);
++void tlb_reset_dirty_range_all(ram_addr_t start, ram_addr_t length);
++
++#endif
++
+ #endif
+diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/exec/exec-all.h
++++ b/include/exec/exec-all.h
+@@ -XXX,XX +XXX,XX @@ static inline tb_page_addr_t get_page_addr_code(CPUArchState *env,
+ #if !defined(CONFIG_USER_ONLY)
+-void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length);
+-void tlb_reset_dirty_range_all(ram_addr_t start, ram_addr_t length);
+-
+ MemoryRegionSection *
+ address_space_translate_for_iotlb(CPUState *cpu, int asidx, hwaddr addr,
+                                   hwaddr *xlat, hwaddr *plen,
+diff --git a/include/exec/ram_addr.h b/include/exec/ram_addr.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/exec/ram_addr.h
++++ b/include/exec/ram_addr.h
+@@ -XXX,XX +XXX,XX @@
+ #include "cpu.h"
+ #include "system/xen.h"
+ #include "system/tcg.h"
++#include "exec/cputlb.h"
+ #include "exec/ramlist.h"
+ #include "exec/ramblock.h"
+ #include "exec/exec-all.h"
+diff --git a/system/physmem.c b/system/physmem.c
+index XXXXXXX..XXXXXXX 100644
+--- a/system/physmem.c
++++ b/system/physmem.c
+@@ -XXX,XX +XXX,XX @@
+ #endif /* CONFIG_TCG */
+ #include "exec/exec-all.h"
++#include "exec/cputlb.h"
+ #include "exec/page-protection.h"
+ #include "exec/target_page.h"
+ #include "exec/translation-block.h"
+--
+.43.0

-New patch
+[PULL 07/23] exec: Declare tlb_set_page_full() in 'exec/cputlb.h'
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
+Move CPU TLB related methods to "exec/cputlb.h".
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-ID: <20241114011310.3615-16-philmd@linaro.org>
+---
+ include/exec/cputlb.h     | 23 +++++++++++++++++++++++
+ include/exec/exec-all.h   | 22 ----------------------
+ target/sparc/mmu_helper.c |  2 +-
+files changed, 24 insertions(+), 23 deletions(-)
+diff --git a/include/exec/cputlb.h b/include/exec/cputlb.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/exec/cputlb.h
++++ b/include/exec/cputlb.h
+@@ -XXX,XX +XXX,XX @@
+ #define CPUTLB_H
+ #include "exec/cpu-common.h"
++#include "exec/vaddr.h"
+ #ifdef CONFIG_TCG
+@@ -XXX,XX +XXX,XX @@ void tlb_reset_dirty_range_all(ram_addr_t start, ram_addr_t length);
+ #endif
++/**
++ * tlb_set_page_full:
++ * @cpu: CPU context
++ * @mmu_idx: mmu index of the tlb to modify
++ * @addr: virtual address of the entry to add
++ * @full: the details of the tlb entry
++ *
++ * Add an entry to @cpu tlb index @mmu_idx.  All of the fields of
++ * @full must be filled, except for xlat_section, and constitute
++ * the complete description of the translated page.
++ *
++ * This is generally called by the target tlb_fill function after
++ * having performed a successful page table walk to find the physical
++ * address and attributes for the translation.
++ *
++ * At most one entry for a given virtual address is permitted. Only a
++ * single TARGET_PAGE_SIZE region is mapped; @full->lg_page_size is only
++ * used by tlb_flush_page.
++ */
++void tlb_set_page_full(CPUState *cpu, int mmu_idx, vaddr addr,
++                       CPUTLBEntryFull *full);
++
+ #endif
+diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/exec/exec-all.h
++++ b/include/exec/exec-all.h
+@@ -XXX,XX +XXX,XX @@ void tlb_flush_range_by_mmuidx_all_cpus_synced(CPUState *cpu,
+                                                uint16_t idxmap,
+                                                unsigned bits);
+-/**
+- * tlb_set_page_full:
+- * @cpu: CPU context
+- * @mmu_idx: mmu index of the tlb to modify
+- * @addr: virtual address of the entry to add
+- * @full: the details of the tlb entry
+- *
+- * Add an entry to @cpu tlb index @mmu_idx.  All of the fields of
+- * @full must be filled, except for xlat_section, and constitute
+- * the complete description of the translated page.
+- *
+- * This is generally called by the target tlb_fill function after
+- * having performed a successful page table walk to find the physical
+- * address and attributes for the translation.
+- *
+- * At most one entry for a given virtual address is permitted. Only a
+- * single TARGET_PAGE_SIZE region is mapped; @full->lg_page_size is only
+- * used by tlb_flush_page.
+- */
+-void tlb_set_page_full(CPUState *cpu, int mmu_idx, vaddr addr,
+-                       CPUTLBEntryFull *full);
+-
+ /**
+  * tlb_set_page_with_attrs:
+  * @cpu: CPU to add this TLB entry for
+diff --git a/target/sparc/mmu_helper.c b/target/sparc/mmu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/sparc/mmu_helper.c
++++ b/target/sparc/mmu_helper.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qemu/log.h"
+ #include "cpu.h"
+-#include "exec/exec-all.h"
++#include "exec/cputlb.h"
+ #include "exec/page-protection.h"
+ #include "qemu/qemu-print.h"
+ #include "trace.h"
+--
+.43.0

-New patch
+[PULL 08/23] exec: Declare tlb_set_page_with_attrs() in 'exec/cputlb.h'
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
+Move CPU TLB related methods to "exec/cputlb.h".
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-ID: <20241114011310.3615-17-philmd@linaro.org>
+---
+ include/exec/cputlb.h                | 28 ++++++++++++++++++++++++++++
+ include/exec/exec-all.h              | 25 -------------------------
+ target/i386/tcg/system/excp_helper.c |  2 +-
+ target/microblaze/helper.c           |  2 +-
+files changed, 30 insertions(+), 27 deletions(-)
+diff --git a/include/exec/cputlb.h b/include/exec/cputlb.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/exec/cputlb.h
++++ b/include/exec/cputlb.h
+@@ -XXX,XX +XXX,XX @@
+ #define CPUTLB_H
+ #include "exec/cpu-common.h"
++#include "exec/hwaddr.h"
++#include "exec/memattrs.h"
+ #include "exec/vaddr.h"
+ #ifdef CONFIG_TCG
+@@ -XXX,XX +XXX,XX @@ void tlb_reset_dirty_range_all(ram_addr_t start, ram_addr_t length);
+ void tlb_set_page_full(CPUState *cpu, int mmu_idx, vaddr addr,
+                        CPUTLBEntryFull *full);
++/**
++ * tlb_set_page_with_attrs:
++ * @cpu: CPU to add this TLB entry for
++ * @addr: virtual address of page to add entry for
++ * @paddr: physical address of the page
++ * @attrs: memory transaction attributes
++ * @prot: access permissions (PAGE_READ/PAGE_WRITE/PAGE_EXEC bits)
++ * @mmu_idx: MMU index to insert TLB entry for
++ * @size: size of the page in bytes
++ *
++ * Add an entry to this CPU's TLB (a mapping from virtual address
++ * @addr to physical address @paddr) with the specified memory
++ * transaction attributes. This is generally called by the target CPU
++ * specific code after it has been called through the tlb_fill()
++ * entry point and performed a successful page table walk to find
++ * the physical address and attributes for the virtual address
++ * which provoked the TLB miss.
++ *
++ * At most one entry for a given virtual address is permitted. Only a
++ * single TARGET_PAGE_SIZE region is mapped; the supplied @size is only
++ * used by tlb_flush_page.
++ */
++void tlb_set_page_with_attrs(CPUState *cpu, vaddr addr,
++                             hwaddr paddr, MemTxAttrs attrs,
++                             int prot, int mmu_idx, vaddr size);
++
+ #endif
+diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/exec/exec-all.h
++++ b/include/exec/exec-all.h
+@@ -XXX,XX +XXX,XX @@ void tlb_flush_range_by_mmuidx_all_cpus_synced(CPUState *cpu,
+                                                uint16_t idxmap,
+                                                unsigned bits);
+-/**
+- * tlb_set_page_with_attrs:
+- * @cpu: CPU to add this TLB entry for
+- * @addr: virtual address of page to add entry for
+- * @paddr: physical address of the page
+- * @attrs: memory transaction attributes
+- * @prot: access permissions (PAGE_READ/PAGE_WRITE/PAGE_EXEC bits)
+- * @mmu_idx: MMU index to insert TLB entry for
+- * @size: size of the page in bytes
+- *
+- * Add an entry to this CPU's TLB (a mapping from virtual address
+- * @addr to physical address @paddr) with the specified memory
+- * transaction attributes. This is generally called by the target CPU
+- * specific code after it has been called through the tlb_fill()
+- * entry point and performed a successful page table walk to find
+- * the physical address and attributes for the virtual address
+- * which provoked the TLB miss.
+- *
+- * At most one entry for a given virtual address is permitted. Only a
+- * single TARGET_PAGE_SIZE region is mapped; the supplied @size is only
+- * used by tlb_flush_page.
+- */
+-void tlb_set_page_with_attrs(CPUState *cpu, vaddr addr,
+-                             hwaddr paddr, MemTxAttrs attrs,
+-                             int prot, int mmu_idx, vaddr size);
+ /* tlb_set_page:
+  *
+  * This function is equivalent to calling tlb_set_page_with_attrs()
+diff --git a/target/i386/tcg/system/excp_helper.c b/target/i386/tcg/system/excp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/i386/tcg/system/excp_helper.c
++++ b/target/i386/tcg/system/excp_helper.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "cpu.h"
+ #include "exec/cpu_ldst.h"
+-#include "exec/exec-all.h"
++#include "exec/cputlb.h"
+ #include "exec/page-protection.h"
+ #include "tcg/helper-tcg.h"
+diff --git a/target/microblaze/helper.c b/target/microblaze/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/microblaze/helper.c
++++ b/target/microblaze/helper.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "cpu.h"
+-#include "exec/exec-all.h"
++#include "exec/cputlb.h"
+ #include "exec/page-protection.h"
+ #include "qemu/host-utils.h"
+ #include "exec/log.h"
+--
+.43.0

-New patch
+[PULL 09/23] exec: Declare tlb_set_page() in 'exec/cputlb.h'
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
 Move CPU TLB related methods to "exec/cputlb.h".
 Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-ID: <20241114011310.3615-18-philmd@linaro.org>
 ---
  include/exec/cputlb.h               | 11 +++++++++++
  include/exec/exec-all.h             |  9 ---------
  target/alpha/helper.c               |  2 +-
  target/avr/helper.c                 |  2 +-
  target/loongarch/tcg/tlb_helper.c   |  1 +
  target/m68k/helper.c                |  1 +
  target/mips/tcg/system/tlb_helper.c |  1 +
  target/openrisc/mmu.c               |  2 +-
  target/ppc/mmu_helper.c             |  1 +
  target/riscv/cpu_helper.c           |  1 +
  target/rx/cpu.c                     |  2 +-
  target/s390x/tcg/excp_helper.c      |  1 +
  target/sh4/helper.c                 |  1 +
  target/tricore/helper.c             |  2 +-
  target/xtensa/helper.c              |  2 +-
 files changed, 24 insertions(+), 15 deletions(-)
 diff --git a/include/exec/cputlb.h b/include/exec/cputlb.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/exec/cputlb.h
 +++ b/include/exec/cputlb.h
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, vaddr addr,
                               hwaddr paddr, MemTxAttrs attrs,
                               int prot, int mmu_idx, vaddr size);
 +/**
 + * tlb_set_page:
 + *
 + * This function is equivalent to calling tlb_set_page_with_attrs()
 + * with an @attrs argument of MEMTXATTRS_UNSPECIFIED. It's provided
 + * as a convenience for CPUs which don't use memory transaction attributes.
 + */
 +void tlb_set_page(CPUState *cpu, vaddr addr,
 +                  hwaddr paddr, int prot,
 +                  int mmu_idx, vaddr size);
 +
  #endif
 diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/exec/exec-all.h
 +++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ void tlb_flush_range_by_mmuidx_all_cpus_synced(CPUState *cpu,
                                                 uint16_t idxmap,
                                                 unsigned bits);
 -/* tlb_set_page:
 - *
 - * This function is equivalent to calling tlb_set_page_with_attrs()
 - * with an @attrs argument of MEMTXATTRS_UNSPECIFIED. It's provided
 - * as a convenience for CPUs which don't use memory transaction attributes.
 - */
 -void tlb_set_page(CPUState *cpu, vaddr addr,
 -                  hwaddr paddr, int prot,
 -                  int mmu_idx, vaddr size);
  #else
  static inline void tlb_flush_page(CPUState *cpu, vaddr addr)
  {
 diff --git a/target/alpha/helper.c b/target/alpha/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/alpha/helper.c
 +++ b/target/alpha/helper.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qemu/log.h"
  #include "cpu.h"
 -#include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "exec/page-protection.h"
  #include "fpu/softfloat-types.h"
  #include "exec/helper-proto.h"
 diff --git a/target/avr/helper.c b/target/avr/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/avr/helper.c
 +++ b/target/avr/helper.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/error-report.h"
  #include "cpu.h"
  #include "accel/tcg/cpu-ops.h"
 -#include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "exec/page-protection.h"
  #include "exec/cpu_ldst.h"
  #include "exec/address-spaces.h"
 diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/loongarch/tcg/tlb_helper.c
 +++ b/target/loongarch/tcg/tlb_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "cpu.h"
  #include "internals.h"
  #include "exec/helper-proto.h"
 +#include "exec/cputlb.h"
  #include "exec/exec-all.h"
  #include "exec/page-protection.h"
  #include "exec/cpu_ldst.h"
 diff --git a/target/m68k/helper.c b/target/m68k/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/m68k/helper.c
 +++ b/target/m68k/helper.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "cpu.h"
 +#include "exec/cputlb.h"
  #include "exec/exec-all.h"
  #include "exec/page-protection.h"
  #include "exec/gdbstub.h"
 diff --git a/target/mips/tcg/system/tlb_helper.c b/target/mips/tcg/system/tlb_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/tcg/system/tlb_helper.c
 +++ b/target/mips/tcg/system/tlb_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "cpu.h"
  #include "internal.h"
 +#include "exec/cputlb.h"
  #include "exec/exec-all.h"
  #include "exec/page-protection.h"
  #include "exec/cpu_ldst.h"
 diff --git a/target/openrisc/mmu.c b/target/openrisc/mmu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/openrisc/mmu.c
 +++ b/target/openrisc/mmu.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qemu/log.h"
  #include "cpu.h"
 -#include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "exec/page-protection.h"
  #include "gdbstub/helpers.h"
  #include "qemu/host-utils.h"
 diff --git a/target/ppc/mmu_helper.c b/target/ppc/mmu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/ppc/mmu_helper.c
 +++ b/target/ppc/mmu_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "kvm_ppc.h"
  #include "mmu-hash64.h"
  #include "mmu-hash32.h"
 +#include "exec/cputlb.h"
  #include "exec/exec-all.h"
  #include "exec/page-protection.h"
  #include "exec/log.h"
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "cpu.h"
  #include "internals.h"
  #include "pmu.h"
 +#include "exec/cputlb.h"
  #include "exec/exec-all.h"
  #include "exec/page-protection.h"
  #include "instmap.h"
 diff --git a/target/rx/cpu.c b/target/rx/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/rx/cpu.c
 +++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include "cpu.h"
  #include "migration/vmstate.h"
 -#include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "exec/page-protection.h"
  #include "exec/translation-block.h"
  #include "hw/loader.h"
 diff --git a/target/s390x/tcg/excp_helper.c b/target/s390x/tcg/excp_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/tcg/excp_helper.c
 +++ b/target/s390x/tcg/excp_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/log.h"
  #include "cpu.h"
  #include "exec/helper-proto.h"
 +#include "exec/cputlb.h"
  #include "exec/exec-all.h"
  #include "s390x-internal.h"
  #include "tcg_s390x.h"
 diff --git a/target/sh4/helper.c b/target/sh4/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sh4/helper.c
 +++ b/target/sh4/helper.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "cpu.h"
 +#include "exec/cputlb.h"
  #include "exec/exec-all.h"
  #include "exec/page-protection.h"
  #include "exec/log.h"
 diff --git a/target/tricore/helper.c b/target/tricore/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tricore/helper.c
 +++ b/target/tricore/helper.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/log.h"
  #include "hw/registerfields.h"
  #include "cpu.h"
 -#include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "exec/page-protection.h"
  #include "fpu/softfloat-helpers.h"
  #include "qemu/qemu-print.h"
 diff --git a/target/xtensa/helper.c b/target/xtensa/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/xtensa/helper.c
 +++ b/target/xtensa/helper.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qemu/log.h"
  #include "cpu.h"
 -#include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "gdbstub/helpers.h"
  #include "exec/helper-proto.h"
  #include "qemu/error-report.h"
 --
 .43.0

-New patch
+[PULL 10/23] exec: Declare tlb_hit*() in 'exec/cputlb.h'
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
+Move CPU TLB related methods to "exec/cputlb.h".
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-ID: <20241114011310.3615-20-philmd@linaro.org>
+---
+ include/exec/cpu-all.h | 23 -----------------------
+ accel/tcg/cputlb.c     | 23 +++++++++++++++++++++++
+files changed, 23 insertions(+), 23 deletions(-)
+diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/exec/cpu-all.h
++++ b/include/exec/cpu-all.h
+@@ -XXX,XX +XXX,XX @@ static inline int cpu_mmu_index(CPUState *cs, bool ifetch)
+ /* The two sets of flags must not overlap. */
+ QEMU_BUILD_BUG_ON(TLB_FLAGS_MASK & TLB_SLOW_FLAGS_MASK);
+-/**
+- * tlb_hit_page: return true if page aligned @addr is a hit against the
+- * TLB entry @tlb_addr
+- *
+- * @addr: virtual address to test (must be page aligned)
+- * @tlb_addr: TLB entry address (a CPUTLBEntry addr_read/write/code value)
+- */
+-static inline bool tlb_hit_page(uint64_t tlb_addr, vaddr addr)
+-{
+-    return addr == (tlb_addr & (TARGET_PAGE_MASK | TLB_INVALID_MASK));
+-}
+-
+-/**
+- * tlb_hit: return true if @addr is a hit against the TLB entry @tlb_addr
+- *
+- * @addr: virtual address to test (need not be page aligned)
+- * @tlb_addr: TLB entry address (a CPUTLBEntry addr_read/write/code value)
+- */
+-static inline bool tlb_hit(uint64_t tlb_addr, vaddr addr)
+-{
+-    return tlb_hit_page(tlb_addr, addr & TARGET_PAGE_MASK);
+-}
+-
+ #endif /* !CONFIG_USER_ONLY */
+ /* Validate correct placement of CPUArchState. */
+diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/cputlb.c
++++ b/accel/tcg/cputlb.c
+@@ -XXX,XX +XXX,XX @@ void tlb_set_page(CPUState *cpu, vaddr addr,
+                             prot, mmu_idx, size);
+ }
++/**
++ * tlb_hit_page: return true if page aligned @addr is a hit against the
++ * TLB entry @tlb_addr
++ *
++ * @addr: virtual address to test (must be page aligned)
++ * @tlb_addr: TLB entry address (a CPUTLBEntry addr_read/write/code value)
++ */
++static inline bool tlb_hit_page(uint64_t tlb_addr, vaddr addr)
++{
++    return addr == (tlb_addr & (TARGET_PAGE_MASK | TLB_INVALID_MASK));
++}
++
++/**
++ * tlb_hit: return true if @addr is a hit against the TLB entry @tlb_addr
++ *
++ * @addr: virtual address to test (need not be page aligned)
++ * @tlb_addr: TLB entry address (a CPUTLBEntry addr_read/write/code value)
++ */
++static inline bool tlb_hit(uint64_t tlb_addr, vaddr addr)
++{
++    return tlb_hit_page(tlb_addr, addr & TARGET_PAGE_MASK);
++}
++
+ /*
+  * Note: tlb_fill_align() can trigger a resize of the TLB.
+  * This means that all of the caller's prior references to the TLB table
+--
+.43.0

-[PULL for-6.0 2/2] target/alpha: fix icount handling for timer instructions
+[PULL 11/23] exec: Declare tlb_flush*() in 'exec/cputlb.h'
-From: Pavel Dovgalyuk <pavel.dovgalyuk@ispras.ru>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-This patch handles icount mode for timer read/write instructions,
+Move CPU TLB related methods to "exec/cputlb.h".
 because it is required to call gen_io_start in such cases.
-Signed-off-by: Pavel Dovgalyuk <pavel.dovgalyuk@ispras.ru>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <161700373035.1135822.16451510827008616793.stgit@pasha-ThinkPad-X280>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Message-ID: <20241114011310.3615-19-philmd@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/alpha/translate.c | 9 +++++++--
+ include/exec/cputlb.h                | 200 +++++++++++++++++++++++++--
-file changed, 7 insertions(+), 2 deletions(-)
+ include/exec/exec-all.h              | 184 ------------------------
  accel/tcg/tcg-accel-ops.c            |   2 +-
  cpu-target.c                         |   1 +
  hw/intc/armv7m_nvic.c                |   2 +-
  hw/ppc/spapr_nested.c                |   1 +
  hw/sh4/sh7750.c                      |   1 +
  system/watchpoint.c                  |   3 +-
  target/alpha/sys_helper.c            |   2 +-
  target/arm/helper.c                  |   1 +
  target/arm/tcg/tlb-insns.c           |   2 +-
  target/hppa/mem_helper.c             |   1 +
  target/i386/helper.c                 |   2 +-
  target/i386/machine.c                |   2 +-
  target/i386/tcg/fpu_helper.c         |   2 +-
  target/i386/tcg/misc_helper.c        |   2 +-
  target/i386/tcg/system/misc_helper.c |   2 +-
  target/i386/tcg/system/svm_helper.c  |   2 +-
  target/loongarch/tcg/csr_helper.c    |   2 +-
  target/microblaze/mmu.c              |   2 +-
  target/mips/system/cp0.c             |   2 +-
  target/mips/tcg/system/cp0_helper.c  |   2 +-
  target/openrisc/sys_helper.c         |   1 +
  target/ppc/helper_regs.c             |   2 +-
  target/ppc/misc_helper.c             |   1 +
  target/riscv/csr.c                   |   1 +
  target/riscv/op_helper.c             |   1 +
  target/riscv/pmp.c                   |   2 +-
  target/s390x/gdbstub.c               |   2 +-
  target/s390x/sigp.c                  |   1 +
  target/s390x/tcg/mem_helper.c        |   1 +
  target/s390x/tcg/misc_helper.c       |   1 +
  target/sparc/ldst_helper.c           |   1 +
  target/xtensa/mmu_helper.c           |   1 +
 files changed, 224 insertions(+), 211 deletions(-)
-diff --git a/target/alpha/translate.c b/target/alpha/translate.c
+diff --git a/include/exec/cputlb.h b/include/exec/cputlb.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/alpha/translate.c
+--- a/include/exec/cputlb.h
-+++ b/target/alpha/translate.c
++++ b/include/exec/cputlb.h
-@@ -XXX,XX +XXX,XX @@ static DisasJumpType gen_mfpr(DisasContext *ctx, TCGv va, int regno)
+@@ -XXX,XX +XXX,XX @@
-     case 249: /* VMTIME */
+ #include "exec/memattrs.h"
-         helper = gen_helper_get_vmtime;
+ #include "exec/vaddr.h"
-     do_helper:
--        if (icount_enabled()) {
+-#ifdef CONFIG_TCG
-+        if (tb_cflags(ctx->base.tb) & CF_USE_ICOUNT) {
+-
-             gen_io_start();
+-#if !defined(CONFIG_USER_ONLY)
-             helper(va);
+-/* cputlb.c */
-             return DISAS_PC_STALE;
++#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
-@@ -XXX,XX +XXX,XX @@ static DisasJumpType gen_mfpr(DisasContext *ctx, TCGv va, int regno)
+ void tlb_protect_code(ram_addr_t ram_addr);
- static DisasJumpType gen_mtpr(DisasContext *ctx, TCGv vb, int regno)
+ void tlb_unprotect_code(ram_addr_t ram_addr);
- {
+ #endif
-     int data;
-+    DisasJumpType ret = DISAS_NEXT;
+-#endif /* CONFIG_TCG */
+-
-     switch (regno) {
+ #ifndef CONFIG_USER_ONLY
-     case 255:
+-
-@@ -XXX,XX +XXX,XX @@ static DisasJumpType gen_mtpr(DisasContext *ctx, TCGv vb, int regno)
+ void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length);
+ void tlb_reset_dirty_range_all(ram_addr_t start, ram_addr_t length);
-     case 251:
+-
-         /* ALARM */
+ #endif
-+        if (tb_cflags(ctx->base.tb) & CF_USE_ICOUNT) {
-+            gen_io_start();
+ /**
-+            ret = DISAS_PC_STALE;
+@@ -XXX,XX +XXX,XX @@ void tlb_set_page(CPUState *cpu, vaddr addr,
-+        }
+                   hwaddr paddr, int prot,
-         gen_helper_set_alarm(cpu_env, vb);
+                   int mmu_idx, vaddr size);
-         break;
+-#endif
-@@ -XXX,XX +XXX,XX @@ static DisasJumpType gen_mtpr(DisasContext *ctx, TCGv vb, int regno)
++#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
-         break;
++/**
-     }
++ * tlb_flush_page:
++ * @cpu: CPU whose TLB should be flushed
--    return DISAS_NEXT;
++ * @addr: virtual address of page to be flushed
-+    return ret;
++ *
- }
++ * Flush one page from the TLB of the specified CPU, for all
- #endif /* !USER_ONLY*/
++ * MMU indexes.
 + */
 +void tlb_flush_page(CPUState *cpu, vaddr addr);
 +
 +/**
 + * tlb_flush_page_all_cpus_synced:
 + * @cpu: src CPU of the flush
 + * @addr: virtual address of page to be flushed
 + *
 + * Flush one page from the TLB of all CPUs, for all
 + * MMU indexes.
 + *
 + * When this function returns, no CPUs will subsequently perform
 + * translations using the flushed TLBs.
 + */
 +void tlb_flush_page_all_cpus_synced(CPUState *src, vaddr addr);
 +
 +/**
 + * tlb_flush:
 + * @cpu: CPU whose TLB should be flushed
 + *
 + * Flush the entire TLB for the specified CPU. Most CPU architectures
 + * allow the implementation to drop entries from the TLB at any time
 + * so this is generally safe. If more selective flushing is required
 + * use one of the other functions for efficiency.
 + */
 +void tlb_flush(CPUState *cpu);
 +
 +/**
 + * tlb_flush_all_cpus_synced:
 + * @cpu: src CPU of the flush
 + *
 + * Flush the entire TLB for all CPUs, for all MMU indexes.
 + *
 + * When this function returns, no CPUs will subsequently perform
 + * translations using the flushed TLBs.
 + */
 +void tlb_flush_all_cpus_synced(CPUState *src_cpu);
 +
 +/**
 + * tlb_flush_page_by_mmuidx:
 + * @cpu: CPU whose TLB should be flushed
 + * @addr: virtual address of page to be flushed
 + * @idxmap: bitmap of MMU indexes to flush
 + *
 + * Flush one page from the TLB of the specified CPU, for the specified
 + * MMU indexes.
 + */
 +void tlb_flush_page_by_mmuidx(CPUState *cpu, vaddr addr,
 +                              uint16_t idxmap);
 +
 +/**
 + * tlb_flush_page_by_mmuidx_all_cpus_synced:
 + * @cpu: Originating CPU of the flush
 + * @addr: virtual address of page to be flushed
 + * @idxmap: bitmap of MMU indexes to flush
 + *
 + * Flush one page from the TLB of all CPUs, for the specified
 + * MMU indexes.
 + *
 + * When this function returns, no CPUs will subsequently perform
 + * translations using the flushed TLBs.
 + */
 +void tlb_flush_page_by_mmuidx_all_cpus_synced(CPUState *cpu, vaddr addr,
 +                                              uint16_t idxmap);
 +
 +/**
 + * tlb_flush_by_mmuidx:
 + * @cpu: CPU whose TLB should be flushed
 + * @wait: If true ensure synchronisation by exiting the cpu_loop
 + * @idxmap: bitmap of MMU indexes to flush
 + *
 + * Flush all entries from the TLB of the specified CPU, for the specified
 + * MMU indexes.
 + */
 +void tlb_flush_by_mmuidx(CPUState *cpu, uint16_t idxmap);
 +
 +/**
 + * tlb_flush_by_mmuidx_all_cpus_synced:
 + * @cpu: Originating CPU of the flush
 + * @idxmap: bitmap of MMU indexes to flush
 + *
 + * Flush all entries from the TLB of all CPUs, for the specified
 + * MMU indexes.
 + *
 + * When this function returns, no CPUs will subsequently perform
 + * translations using the flushed TLBs.
 + */
 +void tlb_flush_by_mmuidx_all_cpus_synced(CPUState *cpu, uint16_t idxmap);
 +
 +/**
 + * tlb_flush_page_bits_by_mmuidx
 + * @cpu: CPU whose TLB should be flushed
 + * @addr: virtual address of page to be flushed
 + * @idxmap: bitmap of mmu indexes to flush
 + * @bits: number of significant bits in address
 + *
 + * Similar to tlb_flush_page_mask, but with a bitmap of indexes.
 + */
 +void tlb_flush_page_bits_by_mmuidx(CPUState *cpu, vaddr addr,
 +                                   uint16_t idxmap, unsigned bits);
 +
 +/* Similarly, with broadcast and syncing. */
 +void tlb_flush_page_bits_by_mmuidx_all_cpus_synced(CPUState *cpu, vaddr addr,
 +                                                   uint16_t idxmap,
 +                                                   unsigned bits);
 +
 +/**
 + * tlb_flush_range_by_mmuidx
 + * @cpu: CPU whose TLB should be flushed
 + * @addr: virtual address of the start of the range to be flushed
 + * @len: length of range to be flushed
 + * @idxmap: bitmap of mmu indexes to flush
 + * @bits: number of significant bits in address
 + *
 + * For each mmuidx in @idxmap, flush all pages within [@addr,@addr+@len),
 + * comparing only the low @bits worth of each virtual page.
 + */
 +void tlb_flush_range_by_mmuidx(CPUState *cpu, vaddr addr,
 +                               vaddr len, uint16_t idxmap,
 +                               unsigned bits);
 +
 +/* Similarly, with broadcast and syncing. */
 +void tlb_flush_range_by_mmuidx_all_cpus_synced(CPUState *cpu,
 +                                               vaddr addr,
 +                                               vaddr len,
 +                                               uint16_t idxmap,
 +                                               unsigned bits);
 +#else
 +static inline void tlb_flush_page(CPUState *cpu, vaddr addr)
 +{
 +}
 +static inline void tlb_flush_page_all_cpus_synced(CPUState *src, vaddr addr)
 +{
 +}
 +static inline void tlb_flush(CPUState *cpu)
 +{
 +}
 +static inline void tlb_flush_all_cpus_synced(CPUState *src_cpu)
 +{
 +}
 +static inline void tlb_flush_page_by_mmuidx(CPUState *cpu,
 +                                            vaddr addr, uint16_t idxmap)
 +{
 +}
 +
 +static inline void tlb_flush_by_mmuidx(CPUState *cpu, uint16_t idxmap)
 +{
 +}
 +static inline void tlb_flush_page_by_mmuidx_all_cpus_synced(CPUState *cpu,
 +                                                            vaddr addr,
 +                                                            uint16_t idxmap)
 +{
 +}
 +static inline void tlb_flush_by_mmuidx_all_cpus_synced(CPUState *cpu,
 +                                                       uint16_t idxmap)
 +{
 +}
 +static inline void tlb_flush_page_bits_by_mmuidx(CPUState *cpu,
 +                                                 vaddr addr,
 +                                                 uint16_t idxmap,
 +                                                 unsigned bits)
 +{
 +}
 +static inline void
 +tlb_flush_page_bits_by_mmuidx_all_cpus_synced(CPUState *cpu, vaddr addr,
 +                                              uint16_t idxmap, unsigned bits)
 +{
 +}
 +static inline void tlb_flush_range_by_mmuidx(CPUState *cpu, vaddr addr,
 +                                             vaddr len, uint16_t idxmap,
 +                                             unsigned bits)
 +{
 +}
 +static inline void tlb_flush_range_by_mmuidx_all_cpus_synced(CPUState *cpu,
 +                                                             vaddr addr,
 +                                                             vaddr len,
 +                                                             uint16_t idxmap,
 +                                                             unsigned bits)
 +{
 +}
 +#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 +#endif /* CPUTLB_H */
 diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/exec/exec-all.h
 +++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@
  #include "exec/mmu-access-type.h"
  #include "exec/translation-block.h"
 -#if !defined(CONFIG_USER_ONLY) && defined(CONFIG_TCG)
 -/* cputlb.c */
 -/**
 - * tlb_flush_page:
 - * @cpu: CPU whose TLB should be flushed
 - * @addr: virtual address of page to be flushed
 - *
 - * Flush one page from the TLB of the specified CPU, for all
 - * MMU indexes.
 - */
 -void tlb_flush_page(CPUState *cpu, vaddr addr);
 -/**
 - * tlb_flush_page_all_cpus_synced:
 - * @cpu: src CPU of the flush
 - * @addr: virtual address of page to be flushed
 - *
 - * Flush one page from the TLB of all CPUs, for all
 - * MMU indexes.
 - *
 - * When this function returns, no CPUs will subsequently perform
 - * translations using the flushed TLBs.
 - */
 -void tlb_flush_page_all_cpus_synced(CPUState *src, vaddr addr);
 -/**
 - * tlb_flush:
 - * @cpu: CPU whose TLB should be flushed
 - *
 - * Flush the entire TLB for the specified CPU. Most CPU architectures
 - * allow the implementation to drop entries from the TLB at any time
 - * so this is generally safe. If more selective flushing is required
 - * use one of the other functions for efficiency.
 - */
 -void tlb_flush(CPUState *cpu);
 -/**
 - * tlb_flush_all_cpus_synced:
 - * @cpu: src CPU of the flush
 - *
 - * Flush the entire TLB for all CPUs, for all MMU indexes.
 - *
 - * When this function returns, no CPUs will subsequently perform
 - * translations using the flushed TLBs.
 - */
 -void tlb_flush_all_cpus_synced(CPUState *src_cpu);
 -/**
 - * tlb_flush_page_by_mmuidx:
 - * @cpu: CPU whose TLB should be flushed
 - * @addr: virtual address of page to be flushed
 - * @idxmap: bitmap of MMU indexes to flush
 - *
 - * Flush one page from the TLB of the specified CPU, for the specified
 - * MMU indexes.
 - */
 -void tlb_flush_page_by_mmuidx(CPUState *cpu, vaddr addr,
 -                              uint16_t idxmap);
 -/**
 - * tlb_flush_page_by_mmuidx_all_cpus_synced:
 - * @cpu: Originating CPU of the flush
 - * @addr: virtual address of page to be flushed
 - * @idxmap: bitmap of MMU indexes to flush
 - *
 - * Flush one page from the TLB of all CPUs, for the specified
 - * MMU indexes.
 - *
 - * When this function returns, no CPUs will subsequently perform
 - * translations using the flushed TLBs.
 - */
 -void tlb_flush_page_by_mmuidx_all_cpus_synced(CPUState *cpu, vaddr addr,
 -                                              uint16_t idxmap);
 -/**
 - * tlb_flush_by_mmuidx:
 - * @cpu: CPU whose TLB should be flushed
 - * @wait: If true ensure synchronisation by exiting the cpu_loop
 - * @idxmap: bitmap of MMU indexes to flush
 - *
 - * Flush all entries from the TLB of the specified CPU, for the specified
 - * MMU indexes.
 - */
 -void tlb_flush_by_mmuidx(CPUState *cpu, uint16_t idxmap);
 -/**
 - * tlb_flush_by_mmuidx_all_cpus_synced:
 - * @cpu: Originating CPU of the flush
 - * @idxmap: bitmap of MMU indexes to flush
 - *
 - * Flush all entries from the TLB of all CPUs, for the specified
 - * MMU indexes.
 - *
 - * When this function returns, no CPUs will subsequently perform
 - * translations using the flushed TLBs.
 - */
 -void tlb_flush_by_mmuidx_all_cpus_synced(CPUState *cpu, uint16_t idxmap);
 -
 -/**
 - * tlb_flush_page_bits_by_mmuidx
 - * @cpu: CPU whose TLB should be flushed
 - * @addr: virtual address of page to be flushed
 - * @idxmap: bitmap of mmu indexes to flush
 - * @bits: number of significant bits in address
 - *
 - * Similar to tlb_flush_page_mask, but with a bitmap of indexes.
 - */
 -void tlb_flush_page_bits_by_mmuidx(CPUState *cpu, vaddr addr,
 -                                   uint16_t idxmap, unsigned bits);
 -
 -/* Similarly, with broadcast and syncing. */
 -void tlb_flush_page_bits_by_mmuidx_all_cpus_synced
 -    (CPUState *cpu, vaddr addr, uint16_t idxmap, unsigned bits);
 -
 -/**
 - * tlb_flush_range_by_mmuidx
 - * @cpu: CPU whose TLB should be flushed
 - * @addr: virtual address of the start of the range to be flushed
 - * @len: length of range to be flushed
 - * @idxmap: bitmap of mmu indexes to flush
 - * @bits: number of significant bits in address
 - *
 - * For each mmuidx in @idxmap, flush all pages within [@addr,@addr+@len),
 - * comparing only the low @bits worth of each virtual page.
 - */
 -void tlb_flush_range_by_mmuidx(CPUState *cpu, vaddr addr,
 -                               vaddr len, uint16_t idxmap,
 -                               unsigned bits);
 -
 -/* Similarly, with broadcast and syncing. */
 -void tlb_flush_range_by_mmuidx_all_cpus_synced(CPUState *cpu,
 -                                               vaddr addr,
 -                                               vaddr len,
 -                                               uint16_t idxmap,
 -                                               unsigned bits);
 -
 -#else
 -static inline void tlb_flush_page(CPUState *cpu, vaddr addr)
 -{
 -}
 -static inline void tlb_flush_page_all_cpus_synced(CPUState *src, vaddr addr)
 -{
 -}
 -static inline void tlb_flush(CPUState *cpu)
 -{
 -}
 -static inline void tlb_flush_all_cpus_synced(CPUState *src_cpu)
 -{
 -}
 -static inline void tlb_flush_page_by_mmuidx(CPUState *cpu,
 -                                            vaddr addr, uint16_t idxmap)
 -{
 -}
 -
 -static inline void tlb_flush_by_mmuidx(CPUState *cpu, uint16_t idxmap)
 -{
 -}
 -static inline void tlb_flush_page_by_mmuidx_all_cpus_synced(CPUState *cpu,
 -                                                            vaddr addr,
 -                                                            uint16_t idxmap)
 -{
 -}
 -static inline void tlb_flush_by_mmuidx_all_cpus_synced(CPUState *cpu,
 -                                                       uint16_t idxmap)
 -{
 -}
 -static inline void tlb_flush_page_bits_by_mmuidx(CPUState *cpu,
 -                                                 vaddr addr,
 -                                                 uint16_t idxmap,
 -                                                 unsigned bits)
 -{
 -}
 -static inline void
 -tlb_flush_page_bits_by_mmuidx_all_cpus_synced(CPUState *cpu, vaddr addr,
 -                                              uint16_t idxmap, unsigned bits)
 -{
 -}
 -static inline void tlb_flush_range_by_mmuidx(CPUState *cpu, vaddr addr,
 -                                             vaddr len, uint16_t idxmap,
 -                                             unsigned bits)
 -{
 -}
 -static inline void tlb_flush_range_by_mmuidx_all_cpus_synced(CPUState *cpu,
 -                                                             vaddr addr,
 -                                                             vaddr len,
 -                                                             uint16_t idxmap,
 -                                                             unsigned bits)
 -{
 -}
 -#endif
 -
  #if defined(CONFIG_TCG)
  /**
 diff --git a/accel/tcg/tcg-accel-ops.c b/accel/tcg/tcg-accel-ops.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/tcg-accel-ops.c
 +++ b/accel/tcg/tcg-accel-ops.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/main-loop.h"
  #include "qemu/guest-random.h"
  #include "qemu/timer.h"
 -#include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "exec/hwaddr.h"
  #include "exec/tb-flush.h"
  #include "exec/translation-block.h"
 diff --git a/cpu-target.c b/cpu-target.c
 index XXXXXXX..XXXXXXX 100644
 --- a/cpu-target.c
 +++ b/cpu-target.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/tswap.h"
  #include "exec/replay-core.h"
  #include "exec/cpu-common.h"
 +#include "exec/cputlb.h"
  #include "exec/exec-all.h"
  #include "exec/tb-flush.h"
  #include "exec/log.h"
 diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/armv7m_nvic.c
 +++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@
  #include "system/runstate.h"
  #include "target/arm/cpu.h"
  #include "target/arm/cpu-features.h"
 -#include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "exec/memop.h"
  #include "qemu/log.h"
  #include "qemu/module.h"
 diff --git a/hw/ppc/spapr_nested.c b/hw/ppc/spapr_nested.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/ppc/spapr_nested.c
 +++ b/hw/ppc/spapr_nested.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qemu/cutils.h"
  #include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "helper_regs.h"
  #include "hw/ppc/ppc.h"
  #include "hw/ppc/spapr.h"
 diff --git a/hw/sh4/sh7750.c b/hw/sh4/sh7750.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/sh4/sh7750.c
 +++ b/hw/sh4/sh7750.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/sh4/sh_intc.h"
  #include "hw/timer/tmu012.h"
  #include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "trace.h"
  typedef struct SH7750State {
 diff --git a/system/watchpoint.c b/system/watchpoint.c
 index XXXXXXX..XXXXXXX 100644
 --- a/system/watchpoint.c
 +++ b/system/watchpoint.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qemu/error-report.h"
 -#include "exec/exec-all.h"
 +#include "exec/cputlb.h"
 +#include "exec/target_page.h"
  #include "hw/core/cpu.h"
  /* Add a watchpoint.  */
 diff --git a/target/alpha/sys_helper.c b/target/alpha/sys_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/alpha/sys_helper.c
 +++ b/target/alpha/sys_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "cpu.h"
 -#include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "exec/tb-flush.h"
  #include "exec/helper-proto.h"
  #include "system/runstate.h"
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/timer.h"
  #include "qemu/bitops.h"
  #include "qemu/qemu-print.h"
 +#include "exec/cputlb.h"
  #include "exec/exec-all.h"
  #include "exec/translation-block.h"
  #include "hw/irq.h"
 diff --git a/target/arm/tcg/tlb-insns.c b/target/arm/tcg/tlb-insns.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/tlb-insns.c
 +++ b/target/arm/tcg/tlb-insns.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
  #include "qemu/log.h"
 -#include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "cpu.h"
  #include "internals.h"
  #include "cpu-features.h"
 diff --git a/target/hppa/mem_helper.c b/target/hppa/mem_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hppa/mem_helper.c
 +++ b/target/hppa/mem_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/log.h"
  #include "cpu.h"
  #include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "exec/page-protection.h"
  #include "exec/helper-proto.h"
  #include "hw/core/cpu.h"
 diff --git a/target/i386/helper.c b/target/i386/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/helper.c
 +++ b/target/i386/helper.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qapi/qapi-events-run-state.h"
  #include "cpu.h"
 -#include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "exec/translation-block.h"
  #include "system/runstate.h"
  #ifndef CONFIG_USER_ONLY
 diff --git a/target/i386/machine.c b/target/i386/machine.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/machine.c
 +++ b/target/i386/machine.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "cpu.h"
 -#include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "hw/isa/isa.h"
  #include "migration/cpu.h"
  #include "kvm/hyperv.h"
 diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/fpu_helper.c
 +++ b/target/i386/tcg/fpu_helper.c
@@ -XXX,XX +XXX,XX @@
  #include <math.h>
  #include "cpu.h"
  #include "tcg-cpu.h"
 -#include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "exec/cpu_ldst.h"
  #include "exec/helper-proto.h"
  #include "fpu/softfloat.h"
 diff --git a/target/i386/tcg/misc_helper.c b/target/i386/tcg/misc_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/misc_helper.c
 +++ b/target/i386/tcg/misc_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/log.h"
  #include "cpu.h"
  #include "exec/helper-proto.h"
 -#include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "helper-tcg.h"
  /*
 diff --git a/target/i386/tcg/system/misc_helper.c b/target/i386/tcg/system/misc_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/system/misc_helper.c
 +++ b/target/i386/tcg/system/misc_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/helper-proto.h"
  #include "exec/cpu_ldst.h"
  #include "exec/address-spaces.h"
 -#include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "tcg/helper-tcg.h"
  #include "hw/i386/apic.h"
 diff --git a/target/i386/tcg/system/svm_helper.c b/target/i386/tcg/system/svm_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/system/svm_helper.c
 +++ b/target/i386/tcg/system/svm_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/log.h"
  #include "cpu.h"
  #include "exec/helper-proto.h"
 -#include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "exec/cpu_ldst.h"
  #include "tcg/helper-tcg.h"
 diff --git a/target/loongarch/tcg/csr_helper.c b/target/loongarch/tcg/csr_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/loongarch/tcg/csr_helper.c
 +++ b/target/loongarch/tcg/csr_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "internals.h"
  #include "qemu/host-utils.h"
  #include "exec/helper-proto.h"
 -#include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "exec/cpu_ldst.h"
  #include "hw/irq.h"
  #include "cpu-csr.h"
 diff --git a/target/microblaze/mmu.c b/target/microblaze/mmu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/microblaze/mmu.c
 +++ b/target/microblaze/mmu.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qemu/log.h"
  #include "cpu.h"
 -#include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "exec/page-protection.h"
  static unsigned int tlb_decode_size(unsigned int f)
 diff --git a/target/mips/system/cp0.c b/target/mips/system/cp0.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/system/cp0.c
 +++ b/target/mips/system/cp0.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "cpu.h"
  #include "internal.h"
 -#include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  /* Called for updates to CP0_Status.  */
  void sync_c0_status(CPUMIPSState *env, CPUMIPSState *cpu, int tc)
 diff --git a/target/mips/tcg/system/cp0_helper.c b/target/mips/tcg/system/cp0_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/tcg/system/cp0_helper.c
 +++ b/target/mips/tcg/system/cp0_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "internal.h"
  #include "qemu/host-utils.h"
  #include "exec/helper-proto.h"
 -#include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  /* SMP helpers.  */
 diff --git a/target/openrisc/sys_helper.c b/target/openrisc/sys_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/openrisc/sys_helper.c
 +++ b/target/openrisc/sys_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "cpu.h"
  #include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "exec/helper-proto.h"
  #include "exception.h"
  #ifndef CONFIG_USER_ONLY
 diff --git a/target/ppc/helper_regs.c b/target/ppc/helper_regs.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/ppc/helper_regs.c
 +++ b/target/ppc/helper_regs.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "cpu.h"
  #include "qemu/main-loop.h"
 -#include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "system/kvm.h"
  #include "system/tcg.h"
  #include "helper_regs.h"
 diff --git a/target/ppc/misc_helper.c b/target/ppc/misc_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/ppc/misc_helper.c
 +++ b/target/ppc/misc_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/log.h"
  #include "cpu.h"
  #include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "exec/helper-proto.h"
  #include "qemu/error-report.h"
  #include "qemu/main-loop.h"
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@
  #include "pmu.h"
  #include "time_helper.h"
  #include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "exec/tb-flush.h"
  #include "system/cpu-timers.h"
  #include "qemu/guest-random.h"
 diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/op_helper.c
 +++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "cpu.h"
  #include "internals.h"
  #include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "exec/cpu_ldst.h"
  #include "exec/helper-proto.h"
  #include "trace.h"
 diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/pmp.c
 +++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include "cpu.h"
  #include "trace.h"
 -#include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "exec/page-protection.h"
  static bool pmp_write_cfg(CPURISCVState *env, uint32_t addr_index,
 diff --git a/target/s390x/gdbstub.c b/target/s390x/gdbstub.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/gdbstub.c
 +++ b/target/s390x/gdbstub.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "cpu.h"
  #include "s390x-internal.h"
 -#include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "exec/gdbstub.h"
  #include "gdbstub/helpers.h"
  #include "qemu/bitops.h"
 diff --git a/target/s390x/sigp.c b/target/s390x/sigp.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/sigp.c
 +++ b/target/s390x/sigp.c
@@ -XXX,XX +XXX,XX @@
  #include "system/hw_accel.h"
  #include "system/runstate.h"
  #include "exec/address-spaces.h"
 +#include "exec/cputlb.h"
  #include "exec/exec-all.h"
  #include "system/tcg.h"
  #include "trace.h"
 diff --git a/target/s390x/tcg/mem_helper.c b/target/s390x/tcg/mem_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/tcg/mem_helper.c
 +++ b/target/s390x/tcg/mem_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/helper-proto.h"
  #include "exec/cpu-common.h"
  #include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "exec/page-protection.h"
  #include "exec/cpu_ldst.h"
  #include "accel/tcg/cpu-ops.h"
 diff --git a/target/s390x/tcg/misc_helper.c b/target/s390x/tcg/misc_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/tcg/misc_helper.c
 +++ b/target/s390x/tcg/misc_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/helper-proto.h"
  #include "qemu/timer.h"
  #include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "exec/cpu_ldst.h"
  #include "qapi/error.h"
  #include "tcg_s390x.h"
 diff --git a/target/sparc/ldst_helper.c b/target/sparc/ldst_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sparc/ldst_helper.c
 +++ b/target/sparc/ldst_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "tcg/tcg.h"
  #include "exec/helper-proto.h"
  #include "exec/exec-all.h"
 +#include "exec/cputlb.h"
  #include "exec/page-protection.h"
  #include "exec/cpu_ldst.h"
  #ifdef CONFIG_USER_ONLY
 diff --git a/target/xtensa/mmu_helper.c b/target/xtensa/mmu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/xtensa/mmu_helper.c
 +++ b/target/xtensa/mmu_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "cpu.h"
  #include "exec/helper-proto.h"
  #include "qemu/host-utils.h"
 +#include "exec/cputlb.h"
  #include "exec/exec-all.h"
  #include "exec/page-protection.h"
 --
-.25.1
+.43.0

-[PULL for-6.0 1/2] tcg/mips: Fix SoftTLB comparison on mips backend
+[PULL 12/23] system: Build watchpoint.c once
-From: Kele Huang <kele.hwang@gmail.com>
+Now that watchpoint.c uses cputlb.h instead of exec-all.h,
 it can be built once.
-The addrl used to compare with SoftTLB entry should be sign-extended
+Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-in common case, and it will cause constant failing in SoftTLB
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-comparisons for the addrl whose address is over 0x80000000 on the
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 emulation of 32-bit guest on 64-bit host.
 This is an important performance bug fix. Spec2000 gzip rate increase
 from ~45 to ~140 on Loongson 3A4000 (MIPS compatible platform).
 Signed-off-by: Kele Huang <kele.hwang@gmail.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-Id: <20210401100457.191458-1-kele.hwang@gmail.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/mips/tcg-target.c.inc | 2 +-
+ system/meson.build | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
+diff --git a/system/meson.build b/system/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/mips/tcg-target.c.inc
+--- a/system/meson.build
-+++ b/tcg/mips/tcg-target.c.inc
++++ b/system/meson.build
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_tlb_load(TCGContext *s, TCGReg base, TCGReg addrl,
+@@ -XXX,XX +XXX,XX @@ specific_ss.add(when: 'CONFIG_SYSTEM_ONLY', if_true: [files(
-            load the tlb addend for the fast path.  */
+   'ioport.c',
-         tcg_out_ld(s, TCG_TYPE_PTR, TCG_TMP2, TCG_TMP3, add_off);
+   'memory.c',
-     }
+   'physmem.c',
--    tcg_out_opc_reg(s, OPC_AND, TCG_TMP1, TCG_TMP1, addrl);
+-  'watchpoint.c',
+ )])
-     /* Zero extend a 32-bit guest address for a 64-bit host. */
-     if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS) {
+ system_ss.add(files(
-         tcg_out_ext32u(s, base, addrl);
+@@ -XXX,XX +XXX,XX @@ system_ss.add(files(
-         addrl = base;
+   'runstate.c',
-     }
+   'tpm-hmp-cmds.c',
-+    tcg_out_opc_reg(s, OPC_AND, TCG_TMP1, TCG_TMP1, addrl);
+   'vl.c',
++  'watchpoint.c',
-     label_ptr[0] = s->code_ptr;
+ ), sdl, libpmem, libdaxctl)
-     tcg_out_opc_br(s, OPC_BNE, TCG_TMP1, TCG_TMP0);
  if have_tpm
 --
-.25.1
+.43.0

-New patch
+[PULL 13/23] accel/tcg: Build tcg-accel-ops.c once
+Now that tcg-accel-ops.c uses cputlb.h instead of exec-all.h,
+it can be built once.
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ accel/tcg/meson.build | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/meson.build
++++ b/accel/tcg/meson.build
+@@ -XXX,XX +XXX,XX @@ specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_specific_ss)
+ specific_ss.add(when: ['CONFIG_SYSTEM_ONLY', 'CONFIG_TCG'], if_true: files(
+   'cputlb.c',
+-  'tcg-accel-ops.c',
+   'tcg-accel-ops-mttcg.c',
+   'tcg-accel-ops-icount.c',
+   'tcg-accel-ops-rr.c',
+@@ -XXX,XX +XXX,XX @@ specific_ss.add(when: ['CONFIG_SYSTEM_ONLY', 'CONFIG_TCG'], if_true: files(
+ system_ss.add(when: ['CONFIG_TCG'], if_true: files(
+   'icount-common.c',
+   'monitor.c',
++  'tcg-accel-ops.c',
+   'watchpoint.c',
+ ))
+--
+.43.0

-New patch
+[PULL 14/23] accel/tcg: Build tcg-accel-ops-icount.c once
+All that is required is to avoid including exec-all.h.
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ accel/tcg/tcg-accel-ops-icount.c | 2 +-
+ accel/tcg/meson.build            | 2 +-
+files changed, 2 insertions(+), 2 deletions(-)
+diff --git a/accel/tcg/tcg-accel-ops-icount.c b/accel/tcg/tcg-accel-ops-icount.c
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/tcg-accel-ops-icount.c
++++ b/accel/tcg/tcg-accel-ops-icount.c
+@@ -XXX,XX +XXX,XX @@
+ #include "system/cpu-timers.h"
+ #include "qemu/main-loop.h"
+ #include "qemu/guest-random.h"
+-#include "exec/exec-all.h"
++#include "hw/core/cpu.h"
+ #include "tcg-accel-ops.h"
+ #include "tcg-accel-ops-icount.h"
+diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/meson.build
++++ b/accel/tcg/meson.build
+@@ -XXX,XX +XXX,XX @@ specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_specific_ss)
+ specific_ss.add(when: ['CONFIG_SYSTEM_ONLY', 'CONFIG_TCG'], if_true: files(
+   'cputlb.c',
+   'tcg-accel-ops-mttcg.c',
+-  'tcg-accel-ops-icount.c',
+   'tcg-accel-ops-rr.c',
+ ))
+@@ -XXX,XX +XXX,XX @@ system_ss.add(when: ['CONFIG_TCG'], if_true: files(
+   'icount-common.c',
+   'monitor.c',
+   'tcg-accel-ops.c',
++  'tcg-accel-ops-icount.c',
+   'watchpoint.c',
+ ))
+--
+.43.0

-New patch
+[PULL 15/23] accel/tcg: Build tcg-accel-ops-rr.c once
+All that is required is to use cpu-common.h instead of exec-all.h.
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ accel/tcg/tcg-accel-ops-rr.c | 2 +-
+ accel/tcg/meson.build        | 2 +-
+files changed, 2 insertions(+), 2 deletions(-)
+diff --git a/accel/tcg/tcg-accel-ops-rr.c b/accel/tcg/tcg-accel-ops-rr.c
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/tcg-accel-ops-rr.c
++++ b/accel/tcg/tcg-accel-ops-rr.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/main-loop.h"
+ #include "qemu/notify.h"
+ #include "qemu/guest-random.h"
+-#include "exec/exec-all.h"
++#include "exec/cpu-common.h"
+ #include "tcg/startup.h"
+ #include "tcg-accel-ops.h"
+ #include "tcg-accel-ops-rr.h"
+diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/meson.build
++++ b/accel/tcg/meson.build
+@@ -XXX,XX +XXX,XX @@ specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_specific_ss)
+ specific_ss.add(when: ['CONFIG_SYSTEM_ONLY', 'CONFIG_TCG'], if_true: files(
+   'cputlb.c',
+   'tcg-accel-ops-mttcg.c',
+-  'tcg-accel-ops-rr.c',
+ ))
+ system_ss.add(when: ['CONFIG_TCG'], if_true: files(
+@@ -XXX,XX +XXX,XX @@ system_ss.add(when: ['CONFIG_TCG'], if_true: files(
+   'monitor.c',
+   'tcg-accel-ops.c',
+   'tcg-accel-ops-icount.c',
++  'tcg-accel-ops-rr.c',
+   'watchpoint.c',
+ ))
+--
+.43.0

-New patch
+[PULL 16/23] accel/tcg: Build tcg-accel-ops-mttcg.c once
+All that is required is to avoid including exec-all.h.
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ accel/tcg/tcg-accel-ops-mttcg.c | 1 -
+ accel/tcg/meson.build           | 2 +-
+files changed, 1 insertion(+), 2 deletions(-)
+diff --git a/accel/tcg/tcg-accel-ops-mttcg.c b/accel/tcg/tcg-accel-ops-mttcg.c
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/tcg-accel-ops-mttcg.c
++++ b/accel/tcg/tcg-accel-ops-mttcg.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/main-loop.h"
+ #include "qemu/notify.h"
+ #include "qemu/guest-random.h"
+-#include "exec/exec-all.h"
+ #include "hw/boards.h"
+ #include "tcg/startup.h"
+ #include "tcg-accel-ops.h"
+diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/meson.build
++++ b/accel/tcg/meson.build
+@@ -XXX,XX +XXX,XX @@ specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_specific_ss)
+ specific_ss.add(when: ['CONFIG_SYSTEM_ONLY', 'CONFIG_TCG'], if_true: files(
+   'cputlb.c',
+-  'tcg-accel-ops-mttcg.c',
+ ))
+ system_ss.add(when: ['CONFIG_TCG'], if_true: files(
+@@ -XXX,XX +XXX,XX @@ system_ss.add(when: ['CONFIG_TCG'], if_true: files(
+   'monitor.c',
+   'tcg-accel-ops.c',
+   'tcg-accel-ops-icount.c',
++  'tcg-accel-ops-mttcg.c',
+   'tcg-accel-ops-rr.c',
+   'watchpoint.c',
+ ))
+--
+.43.0

-New patch
+[PULL 17/23] accel/tcg: Restrict GETPC_ADJ to 'tb-internal.h'
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
+GETPC_ADJ is only used within accel/tcg/, no need to
+expose it to all the code base.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Message-ID: <20250308072348.65723-2-philmd@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ accel/tcg/tb-internal.h | 11 +++++++++++
+ include/exec/exec-all.h |  9 ---------
+files changed, 11 insertions(+), 9 deletions(-)
+diff --git a/accel/tcg/tb-internal.h b/accel/tcg/tb-internal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/tb-internal.h
++++ b/accel/tcg/tb-internal.h
+@@ -XXX,XX +XXX,XX @@
+ #include "exec/exec-all.h"
+ #include "exec/translation-block.h"
++/*
++ * The true return address will often point to a host insn that is part of
++ * the next translated guest insn.  Adjust the address backward to point to
++ * the middle of the call insn.  Subtracting one would do the job except for
++ * several compressed mode architectures (arm, mips) which set the low bit
++ * to indicate the compressed mode; subtracting two works around that.  It
++ * is also the case that there are no host isas that contain a call insn
++ * smaller than 4 bytes, so we don't worry about special-casing this.
++ */
++#define GETPC_ADJ   2
++
+ #ifdef CONFIG_SOFTMMU
+ #define CPU_TLB_DYN_MIN_BITS 6
+diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/exec/exec-all.h
++++ b/include/exec/exec-all.h
+@@ -XXX,XX +XXX,XX @@ extern __thread uintptr_t tci_tb_ptr;
+     ((uintptr_t)__builtin_extract_return_addr(__builtin_return_address(0)))
+ #endif
+-/* The true return address will often point to a host insn that is part of
+-   the next translated guest insn.  Adjust the address backward to point to
+-   the middle of the call insn.  Subtracting one would do the job except for
+-   several compressed mode architectures (arm, mips) which set the low bit
+-   to indicate the compressed mode; subtracting two works around that.  It
+-   is also the case that there are no host isas that contain a call insn
+-   smaller than 4 bytes, so we don't worry about special-casing this.  */
+-#define GETPC_ADJ   2
+-
+ #if !defined(CONFIG_USER_ONLY)
+ /**
+--
+.43.0

-New patch
+[PULL 18/23] accel/tcg: Split out getpc.h
+Split out GETPC to a target-independent header.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Message-ID: <20250308072348.65723-3-philmd@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ include/accel/tcg/getpc.h | 24 ++++++++++++++++++++++++
+ include/exec/exec-all.h   | 10 +---------
+files changed, 25 insertions(+), 9 deletions(-)
+ create mode 100644 include/accel/tcg/getpc.h
+diff --git a/include/accel/tcg/getpc.h b/include/accel/tcg/getpc.h
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/include/accel/tcg/getpc.h
+@@ -XXX,XX +XXX,XX @@
++/*
++ * Get host pc for helper unwinding.
++ *
++ * Copyright (c) 2003 Fabrice Bellard
++ * SPDX-License-Identifier: LGPL-2.1-or-later
++ */
++
++#ifndef ACCEL_TCG_GETPC_H
++#define ACCEL_TCG_GETPC_H
++
++#ifndef CONFIG_TCG
++#error Can only include this header with TCG
++#endif
++
++/* GETPC is the true target of the return instruction that we'll execute.  */
++#ifdef CONFIG_TCG_INTERPRETER
++extern __thread uintptr_t tci_tb_ptr;
++# define GETPC() tci_tb_ptr
++#else
++# define GETPC() \
++    ((uintptr_t)__builtin_extract_return_addr(__builtin_return_address(0)))
++#endif
++
++#endif /* ACCEL_TCG_GETPC_H */
+diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/exec/exec-all.h
++++ b/include/exec/exec-all.h
+@@ -XXX,XX +XXX,XX @@
+ #include "exec/translation-block.h"
+ #if defined(CONFIG_TCG)
++#include "accel/tcg/getpc.h"
+ /**
+  * probe_access:
+@@ -XXX,XX +XXX,XX @@ void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr);
+ void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t last);
+ void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr);
+-/* GETPC is the true target of the return instruction that we'll execute.  */
+-#if defined(CONFIG_TCG_INTERPRETER)
+-extern __thread uintptr_t tci_tb_ptr;
+-# define GETPC() tci_tb_ptr
+-#else
+-# define GETPC() \
+-    ((uintptr_t)__builtin_extract_return_addr(__builtin_return_address(0)))
+-#endif
+-
+ #if !defined(CONFIG_USER_ONLY)
+ /**
+--
+.43.0

-New patch
+[PULL 19/23] qemu/atomic: Rename atomic128-cas.h headers using .h.inc suffix
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
+Since commit 139c1837db ("meson: rename included C source files
+to .c.inc"), QEMU standard procedure for included C files is to
+use *.c.inc.
+Besides, since commit 6a0057aa22 ("docs/devel: make a statement
+about includes") this is documented in the Coding Style:
+  If you do use template header files they should be named with
+  the ``.c.inc`` or ``.h.inc`` suffix to make it clear they are
+  being included for expansion.
+Therefore rename 'atomic128-cas.h' as 'atomic128-cas.h.inc'.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-ID: <20241212141018.59428-2-philmd@linaro.org>
+---
+ host/include/aarch64/host/atomic128-cas.h                       | 2 +-
+ include/qemu/atomic128.h                                        | 2 +-
+ .../generic/host/{atomic128-cas.h => atomic128-cas.h.inc}       | 0
+files changed, 2 insertions(+), 2 deletions(-)
+ rename host/include/generic/host/{atomic128-cas.h => atomic128-cas.h.inc} (100%)
+diff --git a/host/include/aarch64/host/atomic128-cas.h b/host/include/aarch64/host/atomic128-cas.h
+index XXXXXXX..XXXXXXX 100644
+--- a/host/include/aarch64/host/atomic128-cas.h
++++ b/host/include/aarch64/host/atomic128-cas.h
+@@ -XXX,XX +XXX,XX @@
+ /* Through gcc 10, aarch64 has no support for 128-bit atomics.  */
+ #if defined(CONFIG_ATOMIC128) || defined(CONFIG_CMPXCHG128)
+-#include "host/include/generic/host/atomic128-cas.h"
++#include "host/include/generic/host/atomic128-cas.h.inc"
+ #else
+ static inline Int128 atomic16_cmpxchg(Int128 *ptr, Int128 cmp, Int128 new)
+ {
+diff --git a/include/qemu/atomic128.h b/include/qemu/atomic128.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/qemu/atomic128.h
++++ b/include/qemu/atomic128.h
+@@ -XXX,XX +XXX,XX @@
+  * Therefore, special case each platform.
+  */
+-#include "host/atomic128-cas.h"
++#include "host/atomic128-cas.h.inc"
+ #include "host/atomic128-ldst.h"
+ #endif /* QEMU_ATOMIC128_H */
+diff --git a/host/include/generic/host/atomic128-cas.h b/host/include/generic/host/atomic128-cas.h.inc
+similarity index 100%
+rename from host/include/generic/host/atomic128-cas.h
+rename to host/include/generic/host/atomic128-cas.h.inc
+--
+.43.0

-New patch
+[PULL 20/23] qemu/atomic: Rename atomic128-ldst.h headers using .h.inc suffix
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
+Since commit 139c1837db ("meson: rename included C source files
+to .c.inc"), QEMU standard procedure for included C files is to
+use *.c.inc.
+Besides, since commit 6a0057aa22 ("docs/devel: make a statement
+about includes") this is documented in the Coding Style:
+  If you do use template header files they should be named with
+  the ``.c.inc`` or ``.h.inc`` suffix to make it clear they are
+  being included for expansion.
+Therefore rename 'atomic128-ldst.h' as 'atomic128-ldst.h.inc'.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-ID: <20241212141018.59428-3-philmd@linaro.org>
+---
+ include/qemu/atomic128.h                                        | 2 +-
+ .../aarch64/host/{atomic128-ldst.h => atomic128-ldst.h.inc}     | 0
+ .../generic/host/{atomic128-ldst.h => atomic128-ldst.h.inc}     | 0
+ .../loongarch64/host/{atomic128-ldst.h => atomic128-ldst.h.inc} | 0
+ .../x86_64/host/{atomic128-ldst.h => atomic128-ldst.h.inc}      | 2 +-
+ host/include/x86_64/host/load-extract-al16-al8.h.inc            | 2 +-
+files changed, 3 insertions(+), 3 deletions(-)
+ rename host/include/aarch64/host/{atomic128-ldst.h => atomic128-ldst.h.inc} (100%)
+ rename host/include/generic/host/{atomic128-ldst.h => atomic128-ldst.h.inc} (100%)
+ rename host/include/loongarch64/host/{atomic128-ldst.h => atomic128-ldst.h.inc} (100%)
+ rename host/include/x86_64/host/{atomic128-ldst.h => atomic128-ldst.h.inc} (96%)
+diff --git a/include/qemu/atomic128.h b/include/qemu/atomic128.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/qemu/atomic128.h
++++ b/include/qemu/atomic128.h
+@@ -XXX,XX +XXX,XX @@
+  */
+ #include "host/atomic128-cas.h.inc"
+-#include "host/atomic128-ldst.h"
++#include "host/atomic128-ldst.h.inc"
+ #endif /* QEMU_ATOMIC128_H */
+diff --git a/host/include/aarch64/host/atomic128-ldst.h b/host/include/aarch64/host/atomic128-ldst.h.inc
+similarity index 100%
+rename from host/include/aarch64/host/atomic128-ldst.h
+rename to host/include/aarch64/host/atomic128-ldst.h.inc
+diff --git a/host/include/generic/host/atomic128-ldst.h b/host/include/generic/host/atomic128-ldst.h.inc
+similarity index 100%
+rename from host/include/generic/host/atomic128-ldst.h
+rename to host/include/generic/host/atomic128-ldst.h.inc
+diff --git a/host/include/loongarch64/host/atomic128-ldst.h b/host/include/loongarch64/host/atomic128-ldst.h.inc
+similarity index 100%
+rename from host/include/loongarch64/host/atomic128-ldst.h
+rename to host/include/loongarch64/host/atomic128-ldst.h.inc
+diff --git a/host/include/x86_64/host/atomic128-ldst.h b/host/include/x86_64/host/atomic128-ldst.h.inc
+similarity index 96%
+rename from host/include/x86_64/host/atomic128-ldst.h
+rename to host/include/x86_64/host/atomic128-ldst.h.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/host/include/x86_64/host/atomic128-ldst.h
++++ b/host/include/x86_64/host/atomic128-ldst.h.inc
+@@ -XXX,XX +XXX,XX @@ static inline void atomic16_set(Int128 *ptr, Int128 val)
+ }
+ #else
+ /* Provide QEMU_ERROR stubs. */
+-#include "host/include/generic/host/atomic128-ldst.h"
++#include "host/include/generic/host/atomic128-ldst.h.inc"
+ #endif
+ #endif /* X86_64_ATOMIC128_LDST_H */
+diff --git a/host/include/x86_64/host/load-extract-al16-al8.h.inc b/host/include/x86_64/host/load-extract-al16-al8.h.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/host/include/x86_64/host/load-extract-al16-al8.h.inc
++++ b/host/include/x86_64/host/load-extract-al16-al8.h.inc
+@@ -XXX,XX +XXX,XX @@
+ #define X86_64_LOAD_EXTRACT_AL16_AL8_H
+ #ifdef CONFIG_INT128_TYPE
+-#include "host/atomic128-ldst.h"
++#include "host/atomic128-ldst.h.inc"
+ /**
+  * load_atom_extract_al16_or_al8:
+--
+.43.0

-New patch
+[PULL 21/23] qemu/atomic128: Include missing 'qemu/atomic.h' header
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
+qatomic_cmpxchg__nocheck() is declared in "qemu/atomic.h".
+Include it in order to avoid when refactoring unrelated headers:
+    In file included from ../../accel/tcg/tcg-runtime-gvec.c:22:
+    In file included from include/exec/helper-proto-common.h:10:
+    In file included from include/qemu/atomic128.h:61:
+    host/include/generic/host/atomic128-cas.h.inc:23:11: error: call to undeclared function 'qatomic_cmpxchg__nocheck'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
+|     r.i = qatomic_cmpxchg__nocheck(ptr_align, c.i, n.i);
+          |           ^
+error generated.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-ID: <20241212141018.59428-4-philmd@linaro.org>
+---
+ include/qemu/atomic128.h | 1 +
+file changed, 1 insertion(+)
+diff --git a/include/qemu/atomic128.h b/include/qemu/atomic128.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/qemu/atomic128.h
++++ b/include/qemu/atomic128.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef QEMU_ATOMIC128_H
+ #define QEMU_ATOMIC128_H
++#include "qemu/atomic.h"
+ #include "qemu/int128.h"
+ /*
+--
+.43.0

-New patch
+[PULL 22/23] accel/tcg: Build tcg-runtime.c once
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ accel/tcg/tcg-runtime.c | 8 ++------
+ accel/tcg/meson.build   | 2 +-
+files changed, 3 insertions(+), 7 deletions(-)
+diff --git a/accel/tcg/tcg-runtime.c b/accel/tcg/tcg-runtime.c
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/tcg-runtime.c
++++ b/accel/tcg/tcg-runtime.c
+@@ -XXX,XX +XXX,XX @@
+  */
+ #include "qemu/osdep.h"
+ #include "qemu/host-utils.h"
+-#include "cpu.h"
++#include "exec/cpu-common.h"
+ #include "exec/helper-proto-common.h"
+-#include "exec/cpu_ldst.h"
+-#include "exec/exec-all.h"
+-#include "disas/disas.h"
+-#include "exec/log.h"
+-#include "tcg/tcg.h"
++#include "accel/tcg/getpc.h"
+ #define HELPER_H  "accel/tcg/tcg-runtime.h"
+ #include "exec/helper-info.c.inc"
+diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/meson.build
++++ b/accel/tcg/meson.build
+@@ -XXX,XX +XXX,XX @@
+ common_ss.add(when: 'CONFIG_TCG', if_true: files(
+   'cpu-exec-common.c',
++  'tcg-runtime.c',
+ ))
+ tcg_specific_ss = ss.source_set()
+ tcg_specific_ss.add(files(
+@@ -XXX,XX +XXX,XX @@ tcg_specific_ss.add(files(
+   'cpu-exec.c',
+   'tb-maint.c',
+   'tcg-runtime-gvec.c',
+-  'tcg-runtime.c',
+   'translate-all.c',
+   'translator.c',
+ ))
+--
+.43.0

-New patch
+[PULL 23/23] accel/tcg: Build tcg-runtime-gvec.c once
+Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ accel/tcg/tcg-runtime-gvec.c | 1 -
+ accel/tcg/meson.build        | 2 +-
+files changed, 1 insertion(+), 2 deletions(-)
+diff --git a/accel/tcg/tcg-runtime-gvec.c b/accel/tcg/tcg-runtime-gvec.c
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/tcg-runtime-gvec.c
++++ b/accel/tcg/tcg-runtime-gvec.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qemu/host-utils.h"
+-#include "cpu.h"
+ #include "exec/helper-proto-common.h"
+ #include "tcg/tcg-gvec-desc.h"
+diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/meson.build
++++ b/accel/tcg/meson.build
+@@ -XXX,XX +XXX,XX @@
+ common_ss.add(when: 'CONFIG_TCG', if_true: files(
+   'cpu-exec-common.c',
+   'tcg-runtime.c',
++  'tcg-runtime-gvec.c',
+ ))
+ tcg_specific_ss = ss.source_set()
+ tcg_specific_ss.add(files(
+   'tcg-all.c',
+   'cpu-exec.c',
+   'tb-maint.c',
+-  'tcg-runtime-gvec.c',
+   'translate-all.c',
+   'translator.c',
+ ))
+--
+.43.0

-New patch
+[PATCH v2] linux-user/riscv: Fix handling of cpu mask in riscv_hwprobe syscall
+The third argument of the syscall contains the size of the
+cpu mask in bytes, not bits.  Nor is the size rounded up to
+a multiple of sizeof(abi_ulong).
+Cc: qemu-stable@nongnu.org
+Reported-by: Andreas Schwab <schwab@suse.de>
+Fixes: 9e1c7d982d7 ("linux-user/riscv: Add syscall riscv_hwprobe")
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ linux-user/syscall.c | 55 +++++++++++++++++++++++---------------------
+file changed, 29 insertions(+), 26 deletions(-)
+diff --git a/linux-user/syscall.c b/linux-user/syscall.c
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/syscall.c
++++ b/linux-user/syscall.c
+@@ -XXX,XX +XXX,XX @@ static void risc_hwprobe_fill_pairs(CPURISCVState *env,
+     }
+ }
+-static int cpu_set_valid(abi_long arg3, abi_long arg4)
++/*
++ * If the cpumask_t of (target_cpus, cpusetsize) cannot be read: -EFAULT.
++ * If the cpumast_t has no bits set: -EINVAL.
++ * Otherwise the cpumask_t contains some bit set: 0.
++ * Unlike the kernel, we do not mask cpumask_t by the set of online cpus,
++ * nor bound the search by cpumask_size().
++ */
++static int nonempty_cpu_set(abi_ulong cpusetsize, abi_ptr target_cpus)
+ {
+-    int ret, i, tmp;
+-    size_t host_mask_size, target_mask_size;
+-    unsigned long *host_mask;
++    unsigned char *p = lock_user(VERIFY_READ, target_cpus, cpusetsize, 1);
++    int ret = -TARGET_EFAULT;
+-    /*
+-     * cpu_set_t represent CPU masks as bit masks of type unsigned long *.
+-     * arg3 contains the cpu count.
+-     */
+-    tmp = (8 * sizeof(abi_ulong));
+-    target_mask_size = ((arg3 + tmp - 1) / tmp) * sizeof(abi_ulong);
+-    host_mask_size = (target_mask_size + (sizeof(*host_mask) - 1)) &
+-                     ~(sizeof(*host_mask) - 1);
+-
+-    host_mask = alloca(host_mask_size);
+-
+-    ret = target_to_host_cpu_mask(host_mask, host_mask_size,
+-                                  arg4, target_mask_size);
+-    if (ret != 0) {
+-        return ret;
+-    }
+-
+-    for (i = 0 ; i < host_mask_size / sizeof(*host_mask); i++) {
+-        if (host_mask[i] != 0) {
+-            return 0;
++    if (p) {
++        ret = -TARGET_EINVAL;
++        /*
++         * Since we only care about the empty/non-empty state of the cpumask_t
++         * not the individual bits, we do not need to repartition the bits
++         * from target abi_ulong to host unsigned long.
++         *
++         * Note that the kernel does not round up cpusetsize to a multiple of
++         * sizeof(abi_ulong).  After bounding cpusetsize by cpumask_size(),
++         * it copies exactly cpusetsize bytes into a zeroed buffer.
++         */
++        for (abi_ulong i = 0; i < cpusetsize; ++i) {
++            if (p[i]) {
++                ret = 0;
++                break;
++            }
+         }
++        unlock_user(p, target_cpus, 0);
+     }
+-    return -TARGET_EINVAL;
++    return ret;
+ }
+ static abi_long do_riscv_hwprobe(CPUArchState *cpu_env, abi_long arg1,
+@@ -XXX,XX +XXX,XX @@ static abi_long do_riscv_hwprobe(CPUArchState *cpu_env, abi_long arg1,
+     /* check cpu_set */
+     if (arg3 != 0) {
+-        ret = cpu_set_valid(arg3, arg4);
++        ret = nonempty_cpu_set(arg3, arg4);
+         if (ret != 0) {
+             return ret;
+         }
+--
+.43.0

From: Kele Huang <kele.hwang@gmail.com>

The addrl used to compare with SoftTLB entry should be sign-extended
in common case, and it will cause constant failing in SoftTLB
comparisons for the addrl whose address is over 0x80000000 on the
emulation of 32-bit guest on 64-bit host.

This is an important performance bug fix. Spec2000 gzip rate increase
from ~45 to ~140 on Loongson 3A4000 (MIPS compatible platform).

Signed-off-by: Kele Huang <kele.hwang@gmail.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210401100457.191458-1-kele.hwang@gmail.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/mips/tcg-target.c.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_tlb_load(TCGContext *s, TCGReg base, TCGReg addrl,
            load the tlb addend for the fast path.  */
         tcg_out_ld(s, TCG_TYPE_PTR, TCG_TMP2, TCG_TMP3, add_off);
     }
-    tcg_out_opc_reg(s, OPC_AND, TCG_TMP1, TCG_TMP1, addrl);
 
     /* Zero extend a 32-bit guest address for a 64-bit host. */
     if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS) {
         tcg_out_ext32u(s, base, addrl);
         addrl = base;
     }
+    tcg_out_opc_reg(s, OPC_AND, TCG_TMP1, TCG_TMP1, addrl);
 
     label_ptr[0] = s->code_ptr;
     tcg_out_opc_br(s, OPC_BNE, TCG_TMP1, TCG_TMP0);
-- 
2.25.1

From: Pavel Dovgalyuk <pavel.dovgalyuk@ispras.ru>

This patch handles icount mode for timer read/write instructions,
because it is required to call gen_io_start in such cases.

Signed-off-by: Pavel Dovgalyuk <pavel.dovgalyuk@ispras.ru>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <161700373035.1135822.16451510827008616793.stgit@pasha-ThinkPad-X280>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/alpha/translate.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/target/alpha/translate.c b/target/alpha/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/translate.c
+++ b/target/alpha/translate.c
@@ -XXX,XX +XXX,XX @@ static DisasJumpType gen_mfpr(DisasContext *ctx, TCGv va, int regno)
     case 249: /* VMTIME */
         helper = gen_helper_get_vmtime;
     do_helper:
-        if (icount_enabled()) {
+        if (tb_cflags(ctx->base.tb) & CF_USE_ICOUNT) {
             gen_io_start();
             helper(va);
             return DISAS_PC_STALE;
@@ -XXX,XX +XXX,XX @@ static DisasJumpType gen_mfpr(DisasContext *ctx, TCGv va, int regno)
 static DisasJumpType gen_mtpr(DisasContext *ctx, TCGv vb, int regno)
 {
     int data;
+    DisasJumpType ret = DISAS_NEXT;
 
     switch (regno) {
     case 255:
@@ -XXX,XX +XXX,XX @@ static DisasJumpType gen_mtpr(DisasContext *ctx, TCGv vb, int regno)
 
     case 251:
         /* ALARM */
+        if (tb_cflags(ctx->base.tb) & CF_USE_ICOUNT) {
+            gen_io_start();
+            ret = DISAS_PC_STALE;
+        }
         gen_helper_set_alarm(cpu_env, vb);
         break;
 
@@ -XXX,XX +XXX,XX @@ static DisasJumpType gen_mtpr(DisasContext *ctx, TCGv vb, int regno)
         break;
     }
 
-    return DISAS_NEXT;
+    return ret;
 }
 #endif /* !USER_ONLY*/
 
-- 
2.25.1

The following changes since commit 98c7362b1efe651327385a25874a73e008c6549e:

Merge tag 'accel-cpus-20250306' of https://github.com/philmd/qemu into staging (2025-03-07 07:39:49 +0800)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20250308

for you to fetch changes up to 9e2080766f037857fc366012aaefd6fead0a75f9:

accel/tcg: Build tcg-runtime-gvec.c once (2025-03-08 10:06:48 -0800)

----------------------------------------------------------------
include/qemu: Tidy atomic128 headers.
include/exec: Split out cpu-interrupt.h
include/exec: Split many tlb_* declarations to cputlb.h
include/accel/tcg: Split out getpc.h
accel/tcg: system: Compile some files once
linux-user/main: Allow setting tb-size

----------------------------------------------------------------
Ilya Leoshkevich (1):
      linux-user/main: Allow setting tb-size

Philippe Mathieu-Daudé (11):
      accel/tcg: Restrict CPU_TLB_DYN_*_BITS definitions to accel/tcg/
      exec: Declare tlb_reset_dirty*() in 'exec/cputlb.h'
      exec: Declare tlb_set_page_full() in 'exec/cputlb.h'
      exec: Declare tlb_set_page_with_attrs() in 'exec/cputlb.h'
      exec: Declare tlb_set_page() in 'exec/cputlb.h'
      exec: Declare tlb_hit*() in 'exec/cputlb.h'
      exec: Declare tlb_flush*() in 'exec/cputlb.h'
      accel/tcg: Restrict GETPC_ADJ to 'tb-internal.h'
      qemu/atomic: Rename atomic128-cas.h headers using .h.inc suffix
      qemu/atomic: Rename atomic128-ldst.h headers using .h.inc suffix
      qemu/atomic128: Include missing 'qemu/atomic.h' header

Richard Henderson (11):
      include/exec: Move TARGET_PAGE_{SIZE,MASK,BITS} to target_page.h
      include/exec: Split out exec/cpu-interrupt.h
      accel/tcg: Compile watchpoint.c once
      system: Build watchpoint.c once
      accel/tcg: Build tcg-accel-ops.c once
      accel/tcg: Build tcg-accel-ops-icount.c once
      accel/tcg: Build tcg-accel-ops-rr.c once
      accel/tcg: Build tcg-accel-ops-mttcg.c once
      accel/tcg: Split out getpc.h
      accel/tcg: Build tcg-runtime.c once
      accel/tcg: Build tcg-runtime-gvec.c once

accel/tcg/internal-common.h                        |   2 +
 accel/tcg/tb-internal.h                            |  40 +++-
 host/include/aarch64/host/atomic128-cas.h          |   2 +-
 include/accel/tcg/getpc.h                          |  24 ++
 include/exec/cpu-all.h                             |  97 +-------
 include/exec/cpu-defs.h                            |  26 --
 include/exec/cpu-interrupt.h                       |  70 ++++++
 include/exec/cputlb.h                              | 263 ++++++++++++++++++++-
 include/exec/exec-all.h                            | 262 +-------------------
 include/exec/poison.h                              |  17 --
 include/exec/ram_addr.h                            |   1 +
 include/exec/target_page.h                         |  58 ++++-
 include/qemu/atomic128.h                           |   5 +-
 accel/tcg/cputlb.c                                 |  23 ++
 accel/tcg/tcg-accel-ops-icount.c                   |   2 +-
 accel/tcg/tcg-accel-ops-mttcg.c                    |   1 -
 accel/tcg/tcg-accel-ops-rr.c                       |   2 +-
 accel/tcg/tcg-accel-ops.c                          |   2 +-
 accel/tcg/tcg-runtime-gvec.c                       |   1 -
 accel/tcg/tcg-runtime.c                            |   8 +-
 accel/tcg/watchpoint.c                             |   5 +-
 cpu-target.c                                       |   1 +
 hw/intc/armv7m_nvic.c                              |   2 +-
 hw/ppc/spapr_nested.c                              |   1 +
 hw/sh4/sh7750.c                                    |   1 +
 linux-user/main.c                                  |  12 +
 page-target.c                                      |  18 --
 page-vary-target.c                                 |   2 -
 system/physmem.c                                   |   1 +
 system/watchpoint.c                                |   3 +-
 target/alpha/helper.c                              |   2 +-
 target/alpha/sys_helper.c                          |   2 +-
 target/arm/helper.c                                |   1 +
 target/arm/tcg/tlb-insns.c                         |   2 +-
 target/avr/helper.c                                |   2 +-
 target/hppa/mem_helper.c                           |   1 +
 target/i386/helper.c                               |   2 +-
 target/i386/machine.c                              |   2 +-
 target/i386/tcg/fpu_helper.c                       |   2 +-
 target/i386/tcg/misc_helper.c                      |   2 +-
 target/i386/tcg/system/excp_helper.c               |   2 +-
 target/i386/tcg/system/misc_helper.c               |   2 +-
 target/i386/tcg/system/svm_helper.c                |   2 +-
 target/loongarch/tcg/csr_helper.c                  |   2 +-
 target/loongarch/tcg/tlb_helper.c                  |   1 +
 target/m68k/helper.c                               |   1 +
 target/microblaze/helper.c                         |   2 +-
 target/microblaze/mmu.c                            |   2 +-
 target/mips/system/cp0.c                           |   2 +-
 target/mips/tcg/system/cp0_helper.c                |   2 +-
 target/mips/tcg/system/tlb_helper.c                |   1 +
 target/openrisc/mmu.c                              |   2 +-
 target/openrisc/sys_helper.c                       |   1 +
 target/ppc/helper_regs.c                           |   2 +-
 target/ppc/misc_helper.c                           |   1 +
 target/ppc/mmu_helper.c                            |   1 +
 target/riscv/cpu_helper.c                          |   1 +
 target/riscv/csr.c                                 |   1 +
 target/riscv/op_helper.c                           |   1 +
 target/riscv/pmp.c                                 |   2 +-
 target/rx/cpu.c                                    |   2 +-
 target/s390x/gdbstub.c                             |   2 +-
 target/s390x/sigp.c                                |   1 +
 target/s390x/tcg/excp_helper.c                     |   1 +
 target/s390x/tcg/mem_helper.c                      |   1 +
 target/s390x/tcg/misc_helper.c                     |   1 +
 target/sh4/helper.c                                |   1 +
 target/sparc/ldst_helper.c                         |   1 +
 target/sparc/mmu_helper.c                          |   2 +-
 target/tricore/helper.c                            |   2 +-
 target/xtensa/helper.c                             |   2 +-
 target/xtensa/mmu_helper.c                         |   1 +
 accel/tcg/meson.build                              |  14 +-
 .../{atomic128-ldst.h => atomic128-ldst.h.inc}     |   0
 .../host/{atomic128-cas.h => atomic128-cas.h.inc}  |   0
 .../{atomic128-ldst.h => atomic128-ldst.h.inc}     |   0
 .../{atomic128-ldst.h => atomic128-ldst.h.inc}     |   0
 .../{atomic128-ldst.h => atomic128-ldst.h.inc}     |   2 +-
 .../x86_64/host/load-extract-al16-al8.h.inc        |   2 +-
 system/meson.build                                 |   2 +-
 80 files changed, 552 insertions(+), 486 deletions(-)
 create mode 100644 include/accel/tcg/getpc.h
 create mode 100644 include/exec/cpu-interrupt.h
 rename host/include/aarch64/host/{atomic128-ldst.h => atomic128-ldst.h.inc} (100%)
 rename host/include/generic/host/{atomic128-cas.h => atomic128-cas.h.inc} (100%)
 rename host/include/generic/host/{atomic128-ldst.h => atomic128-ldst.h.inc} (100%)
 rename host/include/loongarch64/host/{atomic128-ldst.h => atomic128-ldst.h.inc} (100%)
 rename host/include/x86_64/host/{atomic128-ldst.h => atomic128-ldst.h.inc} (96%)

From: Ilya Leoshkevich <iii@linux.ibm.com>

While qemu-system can set tb-size using -accel tcg,tb-size=n, there
is no similar knob for qemu-user. Add one in a way similar to how
one-insn-per-tb is already handled.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240730215532.1442-1-iii@linux.ibm.com>
---
 linux-user/main.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/linux-user/main.c b/linux-user/main.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -XXX,XX +XXX,XX @@ char *exec_path;
 char real_exec_path[PATH_MAX];
 
 static bool opt_one_insn_per_tb;
+static unsigned long opt_tb_size;
 static const char *argv0;
 static const char *gdbstub;
 static envlist_t *envlist;
@@ -XXX,XX +XXX,XX @@ static void handle_arg_one_insn_per_tb(const char *arg)
     opt_one_insn_per_tb = true;
 }
 
+static void handle_arg_tb_size(const char *arg)
+{
+    if (qemu_strtoul(arg, NULL, 0, &opt_tb_size)) {
+        usage(EXIT_FAILURE);
+    }
+}
+
 static void handle_arg_strace(const char *arg)
 {
     enable_strace = true;
@@ -XXX,XX +XXX,XX @@ static const struct qemu_argument arg_table[] = {
     {"one-insn-per-tb",
                    "QEMU_ONE_INSN_PER_TB",  false, handle_arg_one_insn_per_tb,
      "",           "run with one guest instruction per emulated TB"},
+    {"tb-size",    "QEMU_TB_SIZE",     true,  handle_arg_tb_size,
+     "size",       "TCG translation block cache size"},
     {"strace",     "QEMU_STRACE",      false, handle_arg_strace,
      "",           "log system calls"},
     {"seed",       "QEMU_RAND_SEED",   true,  handle_arg_seed,
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp)
         accel_init_interfaces(ac);
         object_property_set_bool(OBJECT(accel), "one-insn-per-tb",
                                  opt_one_insn_per_tb, &error_abort);
+        object_property_set_int(OBJECT(accel), "tb-size",
+                                opt_tb_size, &error_abort);
         ac->init_machine(NULL);
     }
 
-- 
2.43.0

From: Philippe Mathieu-Daudé <philmd@linaro.org>

CPU_TLB_DYN_*_BITS definitions are only used by accel/tcg/cputlb.c
and accel/tcg/translate-all.c. Move them to accel/tcg/tb-internal.h.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250305191859.71608-1-philmd@linaro.org>
---
 accel/tcg/tb-internal.h | 27 +++++++++++++++++++++++++++
 include/exec/cpu-defs.h | 26 --------------------------
 2 files changed, 27 insertions(+), 26 deletions(-)

diff --git a/accel/tcg/tb-internal.h b/accel/tcg/tb-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tb-internal.h
+++ b/accel/tcg/tb-internal.h
@@ -XXX,XX +XXX,XX @@
 #include "exec/exec-all.h"
 #include "exec/translation-block.h"
 
+#ifdef CONFIG_SOFTMMU
+
+#define CPU_TLB_DYN_MIN_BITS 6
+#define CPU_TLB_DYN_DEFAULT_BITS 8
+
+# if HOST_LONG_BITS == 32
+/* Make sure we do not require a double-word shift for the TLB load */
+#  define CPU_TLB_DYN_MAX_BITS (32 - TARGET_PAGE_BITS)
+# else /* HOST_LONG_BITS == 64 */
+/*
+ * Assuming TARGET_PAGE_BITS==12, with 2**22 entries we can cover 2**(22+12) ==
+ * 2**34 == 16G of address space. This is roughly what one would expect a
+ * TLB to cover in a modern (as of 2018) x86_64 CPU. For instance, Intel
+ * Skylake's Level-2 STLB has 16 1G entries.
+ * Also, make sure we do not size the TLB past the guest's address space.
+ */
+#  ifdef TARGET_PAGE_BITS_VARY
+#   define CPU_TLB_DYN_MAX_BITS                                  \
+    MIN(22, TARGET_VIRT_ADDR_SPACE_BITS - TARGET_PAGE_BITS)
+#  else
+#   define CPU_TLB_DYN_MAX_BITS                                  \
+    MIN_CONST(22, TARGET_VIRT_ADDR_SPACE_BITS - TARGET_PAGE_BITS)
+#  endif
+# endif
+
+#endif /* CONFIG_SOFTMMU */
+
 #ifdef CONFIG_USER_ONLY
 #include "user/page-protection.h"
 /*
diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -XXX,XX +XXX,XX @@
 
 #include "exec/target_long.h"
 
-#if defined(CONFIG_SOFTMMU) && defined(CONFIG_TCG)
-#define CPU_TLB_DYN_MIN_BITS 6
-#define CPU_TLB_DYN_DEFAULT_BITS 8
-
-# if HOST_LONG_BITS == 32
-/* Make sure we do not require a double-word shift for the TLB load */
-#  define CPU_TLB_DYN_MAX_BITS (32 - TARGET_PAGE_BITS)
-# else /* HOST_LONG_BITS == 64 */
-/*
- * Assuming TARGET_PAGE_BITS==12, with 2**22 entries we can cover 2**(22+12) ==
- * 2**34 == 16G of address space. This is roughly what one would expect a
- * TLB to cover in a modern (as of 2018) x86_64 CPU. For instance, Intel
- * Skylake's Level-2 STLB has 16 1G entries.
- * Also, make sure we do not size the TLB past the guest's address space.
- */
-#  ifdef TARGET_PAGE_BITS_VARY
-#   define CPU_TLB_DYN_MAX_BITS                                  \
-    MIN(22, TARGET_VIRT_ADDR_SPACE_BITS - TARGET_PAGE_BITS)
-#  else
-#   define CPU_TLB_DYN_MAX_BITS                                  \
-    MIN_CONST(22, TARGET_VIRT_ADDR_SPACE_BITS - TARGET_PAGE_BITS)
-#  endif
-# endif
-
-#endif /* CONFIG_SOFTMMU && CONFIG_TCG */
-
 #endif
-- 
2.43.0

Re-use the TARGET_PAGE_BITS_VARY mechanism to define
TARGET_PAGE_SIZE and friends when not compiling per-target.
Inline qemu_target_page_{size,mask,bits} as they are now trivial.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-all.h     | 21 +-------------
 include/exec/poison.h      |  4 ---
 include/exec/target_page.h | 58 ++++++++++++++++++++++++++++++++++----
 page-target.c              | 18 ------------
 page-vary-target.c         |  2 --
 5 files changed, 53 insertions(+), 50 deletions(-)

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -XXX,XX +XXX,XX @@ static inline void stl_phys_notdirty(AddressSpace *as, hwaddr addr, uint32_t val
 
 /* page related stuff */
 #include "exec/cpu-defs.h"
-#ifdef TARGET_PAGE_BITS_VARY
-# include "exec/page-vary.h"
-extern const TargetPageBits target_page;
-# ifdef CONFIG_DEBUG_TCG
-#  define TARGET_PAGE_BITS   ({ assert(target_page.decided); \
-                                target_page.bits; })
-#  define TARGET_PAGE_MASK   ({ assert(target_page.decided); \
-                                (target_long)target_page.mask; })
-# else
-#  define TARGET_PAGE_BITS   target_page.bits
-#  define TARGET_PAGE_MASK   ((target_long)target_page.mask)
-# endif
-# define TARGET_PAGE_SIZE    (-(int)TARGET_PAGE_MASK)
-#else
-# define TARGET_PAGE_BITS_MIN TARGET_PAGE_BITS
-# define TARGET_PAGE_SIZE    (1 << TARGET_PAGE_BITS)
-# define TARGET_PAGE_MASK    ((target_long)-1 << TARGET_PAGE_BITS)
-#endif
-
-#define TARGET_PAGE_ALIGN(addr) ROUND_UP((addr), TARGET_PAGE_SIZE)
+#include "exec/target_page.h"
 
 CPUArchState *cpu_copy(CPUArchState *env);
 
diff --git a/include/exec/poison.h b/include/exec/poison.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/poison.h
+++ b/include/exec/poison.h
@@ -XXX,XX +XXX,XX @@
 #pragma GCC poison TARGET_FMT_ld
 #pragma GCC poison TARGET_FMT_lu
 
-#pragma GCC poison TARGET_PAGE_SIZE
-#pragma GCC poison TARGET_PAGE_MASK
-#pragma GCC poison TARGET_PAGE_BITS
-#pragma GCC poison TARGET_PAGE_ALIGN
 #pragma GCC poison TARGET_PHYS_ADDR_SPACE_BITS
 
 #pragma GCC poison CPU_INTERRUPT_HARD
diff --git a/include/exec/target_page.h b/include/exec/target_page.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/target_page.h
+++ b/include/exec/target_page.h
@@ -XXX,XX +XXX,XX @@
 #ifndef EXEC_TARGET_PAGE_H
 #define EXEC_TARGET_PAGE_H
 
-size_t qemu_target_page_size(void);
-int qemu_target_page_mask(void);
-int qemu_target_page_bits(void);
-int qemu_target_page_bits_min(void);
-
-size_t qemu_target_pages_to_MiB(size_t pages);
+/*
+ * If compiling per-target, get the real values.
+ * For generic code, reuse the mechanism for variable page size.
+ */
+#ifdef COMPILING_PER_TARGET
+#include "cpu-param.h"
+#include "exec/target_long.h"
+#define TARGET_PAGE_TYPE  target_long
+#else
+#define TARGET_PAGE_BITS_VARY
+#define TARGET_PAGE_TYPE  int
+#endif
+
+#ifdef TARGET_PAGE_BITS_VARY
+# include "exec/page-vary.h"
+extern const TargetPageBits target_page;
+# ifdef CONFIG_DEBUG_TCG
+#  define TARGET_PAGE_BITS   ({ assert(target_page.decided); \
+                                target_page.bits; })
+#  define TARGET_PAGE_MASK   ({ assert(target_page.decided); \
+                                (TARGET_PAGE_TYPE)target_page.mask; })
+# else
+#  define TARGET_PAGE_BITS   target_page.bits
+#  define TARGET_PAGE_MASK   ((TARGET_PAGE_TYPE)target_page.mask)
+# endif
+# define TARGET_PAGE_SIZE    (-(int)TARGET_PAGE_MASK)
+#else
+# define TARGET_PAGE_BITS_MIN TARGET_PAGE_BITS
+# define TARGET_PAGE_SIZE    (1 << TARGET_PAGE_BITS)
+# define TARGET_PAGE_MASK    ((TARGET_PAGE_TYPE)-1 << TARGET_PAGE_BITS)
+#endif
+
+#define TARGET_PAGE_ALIGN(addr) ROUND_UP((addr), TARGET_PAGE_SIZE)
+
+static inline size_t qemu_target_page_size(void)
+{
+    return TARGET_PAGE_SIZE;
+}
+
+static inline int qemu_target_page_mask(void)
+{
+    return TARGET_PAGE_MASK;
+}
+
+static inline int qemu_target_page_bits(void)
+{
+    return TARGET_PAGE_BITS;
+}
+
+int qemu_target_page_bits_min(void);
+size_t qemu_target_pages_to_MiB(size_t pages);
+
 #endif
diff --git a/page-target.c b/page-target.c
index XXXXXXX..XXXXXXX 100644
--- a/page-target.c
+++ b/page-target.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "exec/target_page.h"
-#include "exec/cpu-defs.h"
-#include "cpu.h"
-#include "exec/cpu-all.h"
-
-size_t qemu_target_page_size(void)
-{
-    return TARGET_PAGE_SIZE;
-}
-
-int qemu_target_page_mask(void)
-{
-    return TARGET_PAGE_MASK;
-}
-
-int qemu_target_page_bits(void)
-{
-    return TARGET_PAGE_BITS;
-}
 
 int qemu_target_page_bits_min(void)
 {
diff --git a/page-vary-target.c b/page-vary-target.c
index XXXXXXX..XXXXXXX 100644
--- a/page-vary-target.c
+++ b/page-vary-target.c
@@ -XXX,XX +XXX,XX @@ bool set_preferred_target_page_bits(int bits)
 
 void finalize_target_page_bits(void)
 {
-#ifdef TARGET_PAGE_BITS_VARY
     finalize_target_page_bits_common(TARGET_PAGE_BITS_MIN);
-#endif
 }
-- 
2.43.0

Some of these bits are actually common to all cpus; while the
reset have common reservations for target-specific usage.
While generic code cannot know what the target-specific usage is,
common code can know what to do with the bits, e.g. single-step.

Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-all.h       | 53 +--------------------------
 include/exec/cpu-interrupt.h | 70 ++++++++++++++++++++++++++++++++++++
 include/exec/poison.h        | 13 -------
 3 files changed, 71 insertions(+), 65 deletions(-)
 create mode 100644 include/exec/cpu-interrupt.h

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -XXX,XX +XXX,XX @@
 
 #include "exec/page-protection.h"
 #include "exec/cpu-common.h"
+#include "exec/cpu-interrupt.h"
 #include "exec/memory.h"
 #include "exec/tswap.h"
 #include "hw/core/cpu.h"
@@ -XXX,XX +XXX,XX @@ static inline void stl_phys_notdirty(AddressSpace *as, hwaddr addr, uint32_t val
 
 CPUArchState *cpu_copy(CPUArchState *env);
 
-/* Flags for use in ENV->INTERRUPT_PENDING.
-
-   The numbers assigned here are non-sequential in order to preserve
-   binary compatibility with the vmstate dump.  Bit 0 (0x0001) was
-   previously used for CPU_INTERRUPT_EXIT, and is cleared when loading
-   the vmstate dump.  */
-
-/* External hardware interrupt pending.  This is typically used for
-   interrupts from devices.  */
-#define CPU_INTERRUPT_HARD        0x0002
-
-/* Exit the current TB.  This is typically used when some system-level device
-   makes some change to the memory mapping.  E.g. the a20 line change.  */
-#define CPU_INTERRUPT_EXITTB      0x0004
-
-/* Halt the CPU.  */
-#define CPU_INTERRUPT_HALT        0x0020
-
-/* Debug event pending.  */
-#define CPU_INTERRUPT_DEBUG       0x0080
-
-/* Reset signal.  */
-#define CPU_INTERRUPT_RESET       0x0400
-
-/* Several target-specific external hardware interrupts.  Each target/cpu.h
-   should define proper names based on these defines.  */
-#define CPU_INTERRUPT_TGT_EXT_0   0x0008
-#define CPU_INTERRUPT_TGT_EXT_1   0x0010
-#define CPU_INTERRUPT_TGT_EXT_2   0x0040
-#define CPU_INTERRUPT_TGT_EXT_3   0x0200
-#define CPU_INTERRUPT_TGT_EXT_4   0x1000
-
-/* Several target-specific internal interrupts.  These differ from the
-   preceding target-specific interrupts in that they are intended to
-   originate from within the cpu itself, typically in response to some
-   instruction being executed.  These, therefore, are not masked while
-   single-stepping within the debugger.  */
-#define CPU_INTERRUPT_TGT_INT_0   0x0100
-#define CPU_INTERRUPT_TGT_INT_1   0x0800
-#define CPU_INTERRUPT_TGT_INT_2   0x2000
-
-/* First unused bit: 0x4000.  */
-
-/* The set of all bits that should be masked when single-stepping.  */
-#define CPU_INTERRUPT_SSTEP_MASK \
-    (CPU_INTERRUPT_HARD          \
-     | CPU_INTERRUPT_TGT_EXT_0   \
-     | CPU_INTERRUPT_TGT_EXT_1   \
-     | CPU_INTERRUPT_TGT_EXT_2   \
-     | CPU_INTERRUPT_TGT_EXT_3   \
-     | CPU_INTERRUPT_TGT_EXT_4)
-
 #include "cpu.h"
 
 #ifdef CONFIG_USER_ONLY
diff --git a/include/exec/cpu-interrupt.h b/include/exec/cpu-interrupt.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/exec/cpu-interrupt.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Flags for use with cpu_interrupt()
+ *
+ * Copyright (c) 2003 Fabrice Bellard
+ * SPDX-License-Identifier: LGPL-2.1-or-later
+ */
+
+#ifndef CPU_INTERRUPT_H
+#define CPU_INTERRUPT_H
+
+/*
+ * The numbers assigned here are non-sequential in order to preserve binary
+ * compatibility with the vmstate dump.  Bit 0 (0x0001) was previously used
+ * for CPU_INTERRUPT_EXIT, and is cleared when loading the vmstate dump.
+ */
+
+/*
+ * External hardware interrupt pending.
+ * This is typically used for interrupts from devices.
+ */
+#define CPU_INTERRUPT_HARD        0x0002
+
+/*
+ * Exit the current TB.  This is typically used when some system-level device
+ * makes some change to the memory mapping.  E.g. the a20 line change.
+ */
+#define CPU_INTERRUPT_EXITTB      0x0004
+
+/* Halt the CPU.  */
+#define CPU_INTERRUPT_HALT        0x0020
+
+/* Debug event pending.  */
+#define CPU_INTERRUPT_DEBUG       0x0080
+
+/* Reset signal.  */
+#define CPU_INTERRUPT_RESET       0x0400
+
+/*
+ * Several target-specific external hardware interrupts.  Each target/cpu.h
+ * should define proper names based on these defines.
+ */
+#define CPU_INTERRUPT_TGT_EXT_0   0x0008
+#define CPU_INTERRUPT_TGT_EXT_1   0x0010
+#define CPU_INTERRUPT_TGT_EXT_2   0x0040
+#define CPU_INTERRUPT_TGT_EXT_3   0x0200
+#define CPU_INTERRUPT_TGT_EXT_4   0x1000
+
+/*
+ * Several target-specific internal interrupts.  These differ from the
+ * preceding target-specific interrupts in that they are intended to
+ * originate from within the cpu itself, typically in response to some
+ * instruction being executed.  These, therefore, are not masked while
+ * single-stepping within the debugger.
+ */
+#define CPU_INTERRUPT_TGT_INT_0   0x0100
+#define CPU_INTERRUPT_TGT_INT_1   0x0800
+#define CPU_INTERRUPT_TGT_INT_2   0x2000
+
+/* First unused bit: 0x4000.  */
+
+/* The set of all bits that should be masked when single-stepping.  */
+#define CPU_INTERRUPT_SSTEP_MASK \
+    (CPU_INTERRUPT_HARD          \
+     | CPU_INTERRUPT_TGT_EXT_0   \
+     | CPU_INTERRUPT_TGT_EXT_1   \
+     | CPU_INTERRUPT_TGT_EXT_2   \
+     | CPU_INTERRUPT_TGT_EXT_3   \
+     | CPU_INTERRUPT_TGT_EXT_4)
+
+#endif /* CPU_INTERRUPT_H */
diff --git a/include/exec/poison.h b/include/exec/poison.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/poison.h
+++ b/include/exec/poison.h
@@ -XXX,XX +XXX,XX @@
 
 #pragma GCC poison TARGET_PHYS_ADDR_SPACE_BITS
 
-#pragma GCC poison CPU_INTERRUPT_HARD
-#pragma GCC poison CPU_INTERRUPT_EXITTB
-#pragma GCC poison CPU_INTERRUPT_HALT
-#pragma GCC poison CPU_INTERRUPT_DEBUG
-#pragma GCC poison CPU_INTERRUPT_TGT_EXT_0
-#pragma GCC poison CPU_INTERRUPT_TGT_EXT_1
-#pragma GCC poison CPU_INTERRUPT_TGT_EXT_2
-#pragma GCC poison CPU_INTERRUPT_TGT_EXT_3
-#pragma GCC poison CPU_INTERRUPT_TGT_EXT_4
-#pragma GCC poison CPU_INTERRUPT_TGT_INT_0
-#pragma GCC poison CPU_INTERRUPT_TGT_INT_1
-#pragma GCC poison CPU_INTERRUPT_TGT_INT_2
-
 #pragma GCC poison CONFIG_ALPHA_DIS
 #pragma GCC poison CONFIG_HPPA_DIS
 #pragma GCC poison CONFIG_I386_DIS
-- 
2.43.0

Move tb_check_watchpoint declaration from tb-internal.h, which is
still target-specific, to internal-common.h, which isn't.
Otherwise, all that is required to build watchpoint.c once is
to include the new exec/cpu-interrupt.h instead of exec/exec-all.h.

Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/internal-common.h | 2 ++
 accel/tcg/tb-internal.h     | 2 --
 accel/tcg/watchpoint.c      | 5 ++---
 accel/tcg/meson.build       | 2 +-
 4 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/accel/tcg/internal-common.h b/accel/tcg/internal-common.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/internal-common.h
+++ b/accel/tcg/internal-common.h
@@ -XXX,XX +XXX,XX @@ void tcg_exec_unrealizefn(CPUState *cpu);
 /* current cflags for hashing/comparison */
 uint32_t curr_cflags(CPUState *cpu);
 
+void tb_check_watchpoint(CPUState *cpu, uintptr_t retaddr);
+
 #endif
diff --git a/accel/tcg/tb-internal.h b/accel/tcg/tb-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tb-internal.h
+++ b/accel/tcg/tb-internal.h
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_range_fast(ram_addr_t ram_addr,
 
 bool tb_invalidate_phys_page_unwind(tb_page_addr_t addr, uintptr_t pc);
 
-void tb_check_watchpoint(CPUState *cpu, uintptr_t retaddr);
-
 #endif
diff --git a/accel/tcg/watchpoint.c b/accel/tcg/watchpoint.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/watchpoint.c
+++ b/accel/tcg/watchpoint.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "qemu/main-loop.h"
-#include "qemu/error-report.h"
-#include "exec/exec-all.h"
+#include "exec/breakpoint.h"
+#include "exec/cpu-interrupt.h"
 #include "exec/page-protection.h"
 #include "exec/translation-block.h"
-#include "tb-internal.h"
 #include "system/tcg.h"
 #include "system/replay.h"
 #include "accel/tcg/cpu-ops.h"
diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/meson.build
+++ b/accel/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_specific_ss)
 
 specific_ss.add(when: ['CONFIG_SYSTEM_ONLY', 'CONFIG_TCG'], if_true: files(
   'cputlb.c',
-  'watchpoint.c',
   'tcg-accel-ops.c',
   'tcg-accel-ops-mttcg.c',
   'tcg-accel-ops-icount.c',
@@ -XXX,XX +XXX,XX @@ specific_ss.add(when: ['CONFIG_SYSTEM_ONLY', 'CONFIG_TCG'], if_true: files(
 system_ss.add(when: ['CONFIG_TCG'], if_true: files(
   'icount-common.c',
   'monitor.c',
+  'watchpoint.c',
 ))
-- 
2.43.0

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Move CPU TLB related methods to "exec/cputlb.h".

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20241114011310.3615-14-philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cputlb.h   | 7 +++++++
 include/exec/exec-all.h | 3 ---
 include/exec/ram_addr.h | 1 +
 system/physmem.c        | 1 +
 4 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/include/exec/cputlb.h b/include/exec/cputlb.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cputlb.h
+++ b/include/exec/cputlb.h
@@ -XXX,XX +XXX,XX @@ void tlb_unprotect_code(ram_addr_t ram_addr);
 
 #endif /* CONFIG_TCG */
 
+#ifndef CONFIG_USER_ONLY
+
+void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length);
+void tlb_reset_dirty_range_all(ram_addr_t start, ram_addr_t length);
+
+#endif
+
 #endif
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ static inline tb_page_addr_t get_page_addr_code(CPUArchState *env,
 
 #if !defined(CONFIG_USER_ONLY)
 
-void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length);
-void tlb_reset_dirty_range_all(ram_addr_t start, ram_addr_t length);
-
 MemoryRegionSection *
 address_space_translate_for_iotlb(CPUState *cpu, int asidx, hwaddr addr,
                                   hwaddr *xlat, hwaddr *plen,
diff --git a/include/exec/ram_addr.h b/include/exec/ram_addr.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/ram_addr.h
+++ b/include/exec/ram_addr.h
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "system/xen.h"
 #include "system/tcg.h"
+#include "exec/cputlb.h"
 #include "exec/ramlist.h"
 #include "exec/ramblock.h"
 #include "exec/exec-all.h"
diff --git a/system/physmem.c b/system/physmem.c
index XXXXXXX..XXXXXXX 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -XXX,XX +XXX,XX @@
 #endif /* CONFIG_TCG */
 
 #include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "exec/page-protection.h"
 #include "exec/target_page.h"
 #include "exec/translation-block.h"
-- 
2.43.0

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Move CPU TLB related methods to "exec/cputlb.h".

diff --git a/include/exec/cputlb.h b/include/exec/cputlb.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cputlb.h
+++ b/include/exec/cputlb.h
@@ -XXX,XX +XXX,XX @@
 #define CPUTLB_H
 
 #include "exec/cpu-common.h"
+#include "exec/vaddr.h"
 
 #ifdef CONFIG_TCG
 
@@ -XXX,XX +XXX,XX @@ void tlb_reset_dirty_range_all(ram_addr_t start, ram_addr_t length);
 
 #endif
 
+/**
+ * tlb_set_page_full:
+ * @cpu: CPU context
+ * @mmu_idx: mmu index of the tlb to modify
+ * @addr: virtual address of the entry to add
+ * @full: the details of the tlb entry
+ *
+ * Add an entry to @cpu tlb index @mmu_idx.  All of the fields of
+ * @full must be filled, except for xlat_section, and constitute
+ * the complete description of the translated page.
+ *
+ * This is generally called by the target tlb_fill function after
+ * having performed a successful page table walk to find the physical
+ * address and attributes for the translation.
+ *
+ * At most one entry for a given virtual address is permitted. Only a
+ * single TARGET_PAGE_SIZE region is mapped; @full->lg_page_size is only
+ * used by tlb_flush_page.
+ */
+void tlb_set_page_full(CPUState *cpu, int mmu_idx, vaddr addr,
+                       CPUTLBEntryFull *full);
+
 #endif
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ void tlb_flush_range_by_mmuidx_all_cpus_synced(CPUState *cpu,
                                                uint16_t idxmap,
                                                unsigned bits);
 
-/**
- * tlb_set_page_full:
- * @cpu: CPU context
- * @mmu_idx: mmu index of the tlb to modify
- * @addr: virtual address of the entry to add
- * @full: the details of the tlb entry
- *
- * Add an entry to @cpu tlb index @mmu_idx.  All of the fields of
- * @full must be filled, except for xlat_section, and constitute
- * the complete description of the translated page.
- *
- * This is generally called by the target tlb_fill function after
- * having performed a successful page table walk to find the physical
- * address and attributes for the translation.
- *
- * At most one entry for a given virtual address is permitted. Only a
- * single TARGET_PAGE_SIZE region is mapped; @full->lg_page_size is only
- * used by tlb_flush_page.
- */
-void tlb_set_page_full(CPUState *cpu, int mmu_idx, vaddr addr,
-                       CPUTLBEntryFull *full);
-
 /**
  * tlb_set_page_with_attrs:
  * @cpu: CPU to add this TLB entry for
diff --git a/target/sparc/mmu_helper.c b/target/sparc/mmu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/mmu_helper.c
+++ b/target/sparc/mmu_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu/log.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "exec/page-protection.h"
 #include "qemu/qemu-print.h"
 #include "trace.h"
-- 
2.43.0

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Move CPU TLB related methods to "exec/cputlb.h".

diff --git a/include/exec/cputlb.h b/include/exec/cputlb.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cputlb.h
+++ b/include/exec/cputlb.h
@@ -XXX,XX +XXX,XX @@
 #define CPUTLB_H
 
 #include "exec/cpu-common.h"
+#include "exec/hwaddr.h"
+#include "exec/memattrs.h"
 #include "exec/vaddr.h"
 
 #ifdef CONFIG_TCG
@@ -XXX,XX +XXX,XX @@ void tlb_reset_dirty_range_all(ram_addr_t start, ram_addr_t length);
 void tlb_set_page_full(CPUState *cpu, int mmu_idx, vaddr addr,
                        CPUTLBEntryFull *full);
 
+/**
+ * tlb_set_page_with_attrs:
+ * @cpu: CPU to add this TLB entry for
+ * @addr: virtual address of page to add entry for
+ * @paddr: physical address of the page
+ * @attrs: memory transaction attributes
+ * @prot: access permissions (PAGE_READ/PAGE_WRITE/PAGE_EXEC bits)
+ * @mmu_idx: MMU index to insert TLB entry for
+ * @size: size of the page in bytes
+ *
+ * Add an entry to this CPU's TLB (a mapping from virtual address
+ * @addr to physical address @paddr) with the specified memory
+ * transaction attributes. This is generally called by the target CPU
+ * specific code after it has been called through the tlb_fill()
+ * entry point and performed a successful page table walk to find
+ * the physical address and attributes for the virtual address
+ * which provoked the TLB miss.
+ *
+ * At most one entry for a given virtual address is permitted. Only a
+ * single TARGET_PAGE_SIZE region is mapped; the supplied @size is only
+ * used by tlb_flush_page.
+ */
+void tlb_set_page_with_attrs(CPUState *cpu, vaddr addr,
+                             hwaddr paddr, MemTxAttrs attrs,
+                             int prot, int mmu_idx, vaddr size);
+
 #endif
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ void tlb_flush_range_by_mmuidx_all_cpus_synced(CPUState *cpu,
                                                uint16_t idxmap,
                                                unsigned bits);
 
-/**
- * tlb_set_page_with_attrs:
- * @cpu: CPU to add this TLB entry for
- * @addr: virtual address of page to add entry for
- * @paddr: physical address of the page
- * @attrs: memory transaction attributes
- * @prot: access permissions (PAGE_READ/PAGE_WRITE/PAGE_EXEC bits)
- * @mmu_idx: MMU index to insert TLB entry for
- * @size: size of the page in bytes
- *
- * Add an entry to this CPU's TLB (a mapping from virtual address
- * @addr to physical address @paddr) with the specified memory
- * transaction attributes. This is generally called by the target CPU
- * specific code after it has been called through the tlb_fill()
- * entry point and performed a successful page table walk to find
- * the physical address and attributes for the virtual address
- * which provoked the TLB miss.
- *
- * At most one entry for a given virtual address is permitted. Only a
- * single TARGET_PAGE_SIZE region is mapped; the supplied @size is only
- * used by tlb_flush_page.
- */
-void tlb_set_page_with_attrs(CPUState *cpu, vaddr addr,
-                             hwaddr paddr, MemTxAttrs attrs,
-                             int prot, int mmu_idx, vaddr size);
 /* tlb_set_page:
  *
  * This function is equivalent to calling tlb_set_page_with_attrs()
diff --git a/target/i386/tcg/system/excp_helper.c b/target/i386/tcg/system/excp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/system/excp_helper.c
+++ b/target/i386/tcg/system/excp_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "exec/cpu_ldst.h"
-#include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "exec/page-protection.h"
 #include "tcg/helper-tcg.h"
 
diff --git a/target/microblaze/helper.c b/target/microblaze/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/helper.c
+++ b/target/microblaze/helper.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "exec/page-protection.h"
 #include "qemu/host-utils.h"
 #include "exec/log.h"
-- 
2.43.0

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Move CPU TLB related methods to "exec/cputlb.h".

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20241114011310.3615-18-philmd@linaro.org>
---
 include/exec/cputlb.h               | 11 +++++++++++
 include/exec/exec-all.h             |  9 ---------
 target/alpha/helper.c               |  2 +-
 target/avr/helper.c                 |  2 +-
 target/loongarch/tcg/tlb_helper.c   |  1 +
 target/m68k/helper.c                |  1 +
 target/mips/tcg/system/tlb_helper.c |  1 +
 target/openrisc/mmu.c               |  2 +-
 target/ppc/mmu_helper.c             |  1 +
 target/riscv/cpu_helper.c           |  1 +
 target/rx/cpu.c                     |  2 +-
 target/s390x/tcg/excp_helper.c      |  1 +
 target/sh4/helper.c                 |  1 +
 target/tricore/helper.c             |  2 +-
 target/xtensa/helper.c              |  2 +-
 15 files changed, 24 insertions(+), 15 deletions(-)

diff --git a/include/exec/cputlb.h b/include/exec/cputlb.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cputlb.h
+++ b/include/exec/cputlb.h
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, vaddr addr,
                              hwaddr paddr, MemTxAttrs attrs,
                              int prot, int mmu_idx, vaddr size);
 
+/**
+ * tlb_set_page:
+ *
+ * This function is equivalent to calling tlb_set_page_with_attrs()
+ * with an @attrs argument of MEMTXATTRS_UNSPECIFIED. It's provided
+ * as a convenience for CPUs which don't use memory transaction attributes.
+ */
+void tlb_set_page(CPUState *cpu, vaddr addr,
+                  hwaddr paddr, int prot,
+                  int mmu_idx, vaddr size);
+
 #endif
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ void tlb_flush_range_by_mmuidx_all_cpus_synced(CPUState *cpu,
                                                uint16_t idxmap,
                                                unsigned bits);
 
-/* tlb_set_page:
- *
- * This function is equivalent to calling tlb_set_page_with_attrs()
- * with an @attrs argument of MEMTXATTRS_UNSPECIFIED. It's provided
- * as a convenience for CPUs which don't use memory transaction attributes.
- */
-void tlb_set_page(CPUState *cpu, vaddr addr,
-                  hwaddr paddr, int prot,
-                  int mmu_idx, vaddr size);
 #else
 static inline void tlb_flush_page(CPUState *cpu, vaddr addr)
 {
diff --git a/target/alpha/helper.c b/target/alpha/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/helper.c
+++ b/target/alpha/helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu/log.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "exec/page-protection.h"
 #include "fpu/softfloat-types.h"
 #include "exec/helper-proto.h"
diff --git a/target/avr/helper.c b/target/avr/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/helper.c
+++ b/target/avr/helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/error-report.h"
 #include "cpu.h"
 #include "accel/tcg/cpu-ops.h"
-#include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "exec/page-protection.h"
 #include "exec/cpu_ldst.h"
 #include "exec/address-spaces.h"
diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "internals.h"
 #include "exec/helper-proto.h"
+#include "exec/cputlb.h"
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "exec/cpu_ldst.h"
diff --git a/target/m68k/helper.c b/target/m68k/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/helper.c
+++ b/target/m68k/helper.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
+#include "exec/cputlb.h"
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "exec/gdbstub.h"
diff --git a/target/mips/tcg/system/tlb_helper.c b/target/mips/tcg/system/tlb_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/system/tlb_helper.c
+++ b/target/mips/tcg/system/tlb_helper.c
@@ -XXX,XX +XXX,XX @@
 
 #include "cpu.h"
 #include "internal.h"
+#include "exec/cputlb.h"
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "exec/cpu_ldst.h"
diff --git a/target/openrisc/mmu.c b/target/openrisc/mmu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/mmu.c
+++ b/target/openrisc/mmu.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu/log.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "exec/page-protection.h"
 #include "gdbstub/helpers.h"
 #include "qemu/host-utils.h"
diff --git a/target/ppc/mmu_helper.c b/target/ppc/mmu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/mmu_helper.c
+++ b/target/ppc/mmu_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "kvm_ppc.h"
 #include "mmu-hash64.h"
 #include "mmu-hash32.h"
+#include "exec/cputlb.h"
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "exec/log.h"
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "internals.h"
 #include "pmu.h"
+#include "exec/cputlb.h"
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "instmap.h"
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "cpu.h"
 #include "migration/vmstate.h"
-#include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "exec/page-protection.h"
 #include "exec/translation-block.h"
 #include "hw/loader.h"
diff --git a/target/s390x/tcg/excp_helper.c b/target/s390x/tcg/excp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/tcg/excp_helper.c
+++ b/target/s390x/tcg/excp_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/log.h"
 #include "cpu.h"
 #include "exec/helper-proto.h"
+#include "exec/cputlb.h"
 #include "exec/exec-all.h"
 #include "s390x-internal.h"
 #include "tcg_s390x.h"
diff --git a/target/sh4/helper.c b/target/sh4/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/helper.c
+++ b/target/sh4/helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 
 #include "cpu.h"
+#include "exec/cputlb.h"
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "exec/log.h"
diff --git a/target/tricore/helper.c b/target/tricore/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/helper.c
+++ b/target/tricore/helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/log.h"
 #include "hw/registerfields.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "exec/page-protection.h"
 #include "fpu/softfloat-helpers.h"
 #include "qemu/qemu-print.h"
diff --git a/target/xtensa/helper.c b/target/xtensa/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/helper.c
+++ b/target/xtensa/helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu/log.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "gdbstub/helpers.h"
 #include "exec/helper-proto.h"
 #include "qemu/error-report.h"
-- 
2.43.0

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Move CPU TLB related methods to "exec/cputlb.h".

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -XXX,XX +XXX,XX @@ static inline int cpu_mmu_index(CPUState *cs, bool ifetch)
 /* The two sets of flags must not overlap. */
 QEMU_BUILD_BUG_ON(TLB_FLAGS_MASK & TLB_SLOW_FLAGS_MASK);
 
-/**
- * tlb_hit_page: return true if page aligned @addr is a hit against the
- * TLB entry @tlb_addr
- *
- * @addr: virtual address to test (must be page aligned)
- * @tlb_addr: TLB entry address (a CPUTLBEntry addr_read/write/code value)
- */
-static inline bool tlb_hit_page(uint64_t tlb_addr, vaddr addr)
-{
-    return addr == (tlb_addr & (TARGET_PAGE_MASK | TLB_INVALID_MASK));
-}
-
-/**
- * tlb_hit: return true if @addr is a hit against the TLB entry @tlb_addr
- *
- * @addr: virtual address to test (need not be page aligned)
- * @tlb_addr: TLB entry address (a CPUTLBEntry addr_read/write/code value)
- */
-static inline bool tlb_hit(uint64_t tlb_addr, vaddr addr)
-{
-    return tlb_hit_page(tlb_addr, addr & TARGET_PAGE_MASK);
-}
-
 #endif /* !CONFIG_USER_ONLY */
 
 /* Validate correct placement of CPUArchState. */
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ void tlb_set_page(CPUState *cpu, vaddr addr,
                             prot, mmu_idx, size);
 }
 
+/**
+ * tlb_hit_page: return true if page aligned @addr is a hit against the
+ * TLB entry @tlb_addr
+ *
+ * @addr: virtual address to test (must be page aligned)
+ * @tlb_addr: TLB entry address (a CPUTLBEntry addr_read/write/code value)
+ */
+static inline bool tlb_hit_page(uint64_t tlb_addr, vaddr addr)
+{
+    return addr == (tlb_addr & (TARGET_PAGE_MASK | TLB_INVALID_MASK));
+}
+
+/**
+ * tlb_hit: return true if @addr is a hit against the TLB entry @tlb_addr
+ *
+ * @addr: virtual address to test (need not be page aligned)
+ * @tlb_addr: TLB entry address (a CPUTLBEntry addr_read/write/code value)
+ */
+static inline bool tlb_hit(uint64_t tlb_addr, vaddr addr)
+{
+    return tlb_hit_page(tlb_addr, addr & TARGET_PAGE_MASK);
+}
+
 /*
  * Note: tlb_fill_align() can trigger a resize of the TLB.
  * This means that all of the caller's prior references to the TLB table
-- 
2.43.0

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Move CPU TLB related methods to "exec/cputlb.h".

diff --git a/include/exec/cputlb.h b/include/exec/cputlb.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cputlb.h
+++ b/include/exec/cputlb.h
@@ -XXX,XX +XXX,XX @@
 #include "exec/memattrs.h"
 #include "exec/vaddr.h"
 
-#ifdef CONFIG_TCG
-
-#if !defined(CONFIG_USER_ONLY)
-/* cputlb.c */
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
 void tlb_protect_code(ram_addr_t ram_addr);
 void tlb_unprotect_code(ram_addr_t ram_addr);
 #endif
 
-#endif /* CONFIG_TCG */
-
 #ifndef CONFIG_USER_ONLY
-
 void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length);
 void tlb_reset_dirty_range_all(ram_addr_t start, ram_addr_t length);
-
 #endif
 
 /**
@@ -XXX,XX +XXX,XX @@ void tlb_set_page(CPUState *cpu, vaddr addr,
                   hwaddr paddr, int prot,
                   int mmu_idx, vaddr size);
 
-#endif
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
+/**
+ * tlb_flush_page:
+ * @cpu: CPU whose TLB should be flushed
+ * @addr: virtual address of page to be flushed
+ *
+ * Flush one page from the TLB of the specified CPU, for all
+ * MMU indexes.
+ */
+void tlb_flush_page(CPUState *cpu, vaddr addr);
+
+/**
+ * tlb_flush_page_all_cpus_synced:
+ * @cpu: src CPU of the flush
+ * @addr: virtual address of page to be flushed
+ *
+ * Flush one page from the TLB of all CPUs, for all
+ * MMU indexes.
+ *
+ * When this function returns, no CPUs will subsequently perform
+ * translations using the flushed TLBs.
+ */
+void tlb_flush_page_all_cpus_synced(CPUState *src, vaddr addr);
+
+/**
+ * tlb_flush:
+ * @cpu: CPU whose TLB should be flushed
+ *
+ * Flush the entire TLB for the specified CPU. Most CPU architectures
+ * allow the implementation to drop entries from the TLB at any time
+ * so this is generally safe. If more selective flushing is required
+ * use one of the other functions for efficiency.
+ */
+void tlb_flush(CPUState *cpu);
+
+/**
+ * tlb_flush_all_cpus_synced:
+ * @cpu: src CPU of the flush
+ *
+ * Flush the entire TLB for all CPUs, for all MMU indexes.
+ *
+ * When this function returns, no CPUs will subsequently perform
+ * translations using the flushed TLBs.
+ */
+void tlb_flush_all_cpus_synced(CPUState *src_cpu);
+
+/**
+ * tlb_flush_page_by_mmuidx:
+ * @cpu: CPU whose TLB should be flushed
+ * @addr: virtual address of page to be flushed
+ * @idxmap: bitmap of MMU indexes to flush
+ *
+ * Flush one page from the TLB of the specified CPU, for the specified
+ * MMU indexes.
+ */
+void tlb_flush_page_by_mmuidx(CPUState *cpu, vaddr addr,
+                              uint16_t idxmap);
+
+/**
+ * tlb_flush_page_by_mmuidx_all_cpus_synced:
+ * @cpu: Originating CPU of the flush
+ * @addr: virtual address of page to be flushed
+ * @idxmap: bitmap of MMU indexes to flush
+ *
+ * Flush one page from the TLB of all CPUs, for the specified
+ * MMU indexes.
+ *
+ * When this function returns, no CPUs will subsequently perform
+ * translations using the flushed TLBs.
+ */
+void tlb_flush_page_by_mmuidx_all_cpus_synced(CPUState *cpu, vaddr addr,
+                                              uint16_t idxmap);
+
+/**
+ * tlb_flush_by_mmuidx:
+ * @cpu: CPU whose TLB should be flushed
+ * @wait: If true ensure synchronisation by exiting the cpu_loop
+ * @idxmap: bitmap of MMU indexes to flush
+ *
+ * Flush all entries from the TLB of the specified CPU, for the specified
+ * MMU indexes.
+ */
+void tlb_flush_by_mmuidx(CPUState *cpu, uint16_t idxmap);
+
+/**
+ * tlb_flush_by_mmuidx_all_cpus_synced:
+ * @cpu: Originating CPU of the flush
+ * @idxmap: bitmap of MMU indexes to flush
+ *
+ * Flush all entries from the TLB of all CPUs, for the specified
+ * MMU indexes.
+ *
+ * When this function returns, no CPUs will subsequently perform
+ * translations using the flushed TLBs.
+ */
+void tlb_flush_by_mmuidx_all_cpus_synced(CPUState *cpu, uint16_t idxmap);
+
+/**
+ * tlb_flush_page_bits_by_mmuidx
+ * @cpu: CPU whose TLB should be flushed
+ * @addr: virtual address of page to be flushed
+ * @idxmap: bitmap of mmu indexes to flush
+ * @bits: number of significant bits in address
+ *
+ * Similar to tlb_flush_page_mask, but with a bitmap of indexes.
+ */
+void tlb_flush_page_bits_by_mmuidx(CPUState *cpu, vaddr addr,
+                                   uint16_t idxmap, unsigned bits);
+
+/* Similarly, with broadcast and syncing. */
+void tlb_flush_page_bits_by_mmuidx_all_cpus_synced(CPUState *cpu, vaddr addr,
+                                                   uint16_t idxmap,
+                                                   unsigned bits);
+
+/**
+ * tlb_flush_range_by_mmuidx
+ * @cpu: CPU whose TLB should be flushed
+ * @addr: virtual address of the start of the range to be flushed
+ * @len: length of range to be flushed
+ * @idxmap: bitmap of mmu indexes to flush
+ * @bits: number of significant bits in address
+ *
+ * For each mmuidx in @idxmap, flush all pages within [@addr,@addr+@len),
+ * comparing only the low @bits worth of each virtual page.
+ */
+void tlb_flush_range_by_mmuidx(CPUState *cpu, vaddr addr,
+                               vaddr len, uint16_t idxmap,
+                               unsigned bits);
+
+/* Similarly, with broadcast and syncing. */
+void tlb_flush_range_by_mmuidx_all_cpus_synced(CPUState *cpu,
+                                               vaddr addr,
+                                               vaddr len,
+                                               uint16_t idxmap,
+                                               unsigned bits);
+#else
+static inline void tlb_flush_page(CPUState *cpu, vaddr addr)
+{
+}
+static inline void tlb_flush_page_all_cpus_synced(CPUState *src, vaddr addr)
+{
+}
+static inline void tlb_flush(CPUState *cpu)
+{
+}
+static inline void tlb_flush_all_cpus_synced(CPUState *src_cpu)
+{
+}
+static inline void tlb_flush_page_by_mmuidx(CPUState *cpu,
+                                            vaddr addr, uint16_t idxmap)
+{
+}
+
+static inline void tlb_flush_by_mmuidx(CPUState *cpu, uint16_t idxmap)
+{
+}
+static inline void tlb_flush_page_by_mmuidx_all_cpus_synced(CPUState *cpu,
+                                                            vaddr addr,
+                                                            uint16_t idxmap)
+{
+}
+static inline void tlb_flush_by_mmuidx_all_cpus_synced(CPUState *cpu,
+                                                       uint16_t idxmap)
+{
+}
+static inline void tlb_flush_page_bits_by_mmuidx(CPUState *cpu,
+                                                 vaddr addr,
+                                                 uint16_t idxmap,
+                                                 unsigned bits)
+{
+}
+static inline void
+tlb_flush_page_bits_by_mmuidx_all_cpus_synced(CPUState *cpu, vaddr addr,
+                                              uint16_t idxmap, unsigned bits)
+{
+}
+static inline void tlb_flush_range_by_mmuidx(CPUState *cpu, vaddr addr,
+                                             vaddr len, uint16_t idxmap,
+                                             unsigned bits)
+{
+}
+static inline void tlb_flush_range_by_mmuidx_all_cpus_synced(CPUState *cpu,
+                                                             vaddr addr,
+                                                             vaddr len,
+                                                             uint16_t idxmap,
+                                                             unsigned bits)
+{
+}
+#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
+#endif /* CPUTLB_H */
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@
 #include "exec/mmu-access-type.h"
 #include "exec/translation-block.h"
 
-#if !defined(CONFIG_USER_ONLY) && defined(CONFIG_TCG)
-/* cputlb.c */
-/**
- * tlb_flush_page:
- * @cpu: CPU whose TLB should be flushed
- * @addr: virtual address of page to be flushed
- *
- * Flush one page from the TLB of the specified CPU, for all
- * MMU indexes.
- */
-void tlb_flush_page(CPUState *cpu, vaddr addr);
-/**
- * tlb_flush_page_all_cpus_synced:
- * @cpu: src CPU of the flush
- * @addr: virtual address of page to be flushed
- *
- * Flush one page from the TLB of all CPUs, for all
- * MMU indexes.
- *
- * When this function returns, no CPUs will subsequently perform
- * translations using the flushed TLBs.
- */
-void tlb_flush_page_all_cpus_synced(CPUState *src, vaddr addr);
-/**
- * tlb_flush:
- * @cpu: CPU whose TLB should be flushed
- *
- * Flush the entire TLB for the specified CPU. Most CPU architectures
- * allow the implementation to drop entries from the TLB at any time
- * so this is generally safe. If more selective flushing is required
- * use one of the other functions for efficiency.
- */
-void tlb_flush(CPUState *cpu);
-/**
- * tlb_flush_all_cpus_synced:
- * @cpu: src CPU of the flush
- *
- * Flush the entire TLB for all CPUs, for all MMU indexes.
- *
- * When this function returns, no CPUs will subsequently perform
- * translations using the flushed TLBs.
- */
-void tlb_flush_all_cpus_synced(CPUState *src_cpu);
-/**
- * tlb_flush_page_by_mmuidx:
- * @cpu: CPU whose TLB should be flushed
- * @addr: virtual address of page to be flushed
- * @idxmap: bitmap of MMU indexes to flush
- *
- * Flush one page from the TLB of the specified CPU, for the specified
- * MMU indexes.
- */
-void tlb_flush_page_by_mmuidx(CPUState *cpu, vaddr addr,
-                              uint16_t idxmap);
-/**
- * tlb_flush_page_by_mmuidx_all_cpus_synced:
- * @cpu: Originating CPU of the flush
- * @addr: virtual address of page to be flushed
- * @idxmap: bitmap of MMU indexes to flush
- *
- * Flush one page from the TLB of all CPUs, for the specified
- * MMU indexes.
- *
- * When this function returns, no CPUs will subsequently perform
- * translations using the flushed TLBs.
- */
-void tlb_flush_page_by_mmuidx_all_cpus_synced(CPUState *cpu, vaddr addr,
-                                              uint16_t idxmap);
-/**
- * tlb_flush_by_mmuidx:
- * @cpu: CPU whose TLB should be flushed
- * @wait: If true ensure synchronisation by exiting the cpu_loop
- * @idxmap: bitmap of MMU indexes to flush
- *
- * Flush all entries from the TLB of the specified CPU, for the specified
- * MMU indexes.
- */
-void tlb_flush_by_mmuidx(CPUState *cpu, uint16_t idxmap);
-/**
- * tlb_flush_by_mmuidx_all_cpus_synced:
- * @cpu: Originating CPU of the flush
- * @idxmap: bitmap of MMU indexes to flush
- *
- * Flush all entries from the TLB of all CPUs, for the specified
- * MMU indexes.
- *
- * When this function returns, no CPUs will subsequently perform
- * translations using the flushed TLBs.
- */
-void tlb_flush_by_mmuidx_all_cpus_synced(CPUState *cpu, uint16_t idxmap);
-
-/**
- * tlb_flush_page_bits_by_mmuidx
- * @cpu: CPU whose TLB should be flushed
- * @addr: virtual address of page to be flushed
- * @idxmap: bitmap of mmu indexes to flush
- * @bits: number of significant bits in address
- *
- * Similar to tlb_flush_page_mask, but with a bitmap of indexes.
- */
-void tlb_flush_page_bits_by_mmuidx(CPUState *cpu, vaddr addr,
-                                   uint16_t idxmap, unsigned bits);
-
-/* Similarly, with broadcast and syncing. */
-void tlb_flush_page_bits_by_mmuidx_all_cpus_synced
-    (CPUState *cpu, vaddr addr, uint16_t idxmap, unsigned bits);
-
-/**
- * tlb_flush_range_by_mmuidx
- * @cpu: CPU whose TLB should be flushed
- * @addr: virtual address of the start of the range to be flushed
- * @len: length of range to be flushed
- * @idxmap: bitmap of mmu indexes to flush
- * @bits: number of significant bits in address
- *
- * For each mmuidx in @idxmap, flush all pages within [@addr,@addr+@len),
- * comparing only the low @bits worth of each virtual page.
- */
-void tlb_flush_range_by_mmuidx(CPUState *cpu, vaddr addr,
-                               vaddr len, uint16_t idxmap,
-                               unsigned bits);
-
-/* Similarly, with broadcast and syncing. */
-void tlb_flush_range_by_mmuidx_all_cpus_synced(CPUState *cpu,
-                                               vaddr addr,
-                                               vaddr len,
-                                               uint16_t idxmap,
-                                               unsigned bits);
-
-#else
-static inline void tlb_flush_page(CPUState *cpu, vaddr addr)
-{
-}
-static inline void tlb_flush_page_all_cpus_synced(CPUState *src, vaddr addr)
-{
-}
-static inline void tlb_flush(CPUState *cpu)
-{
-}
-static inline void tlb_flush_all_cpus_synced(CPUState *src_cpu)
-{
-}
-static inline void tlb_flush_page_by_mmuidx(CPUState *cpu,
-                                            vaddr addr, uint16_t idxmap)
-{
-}
-
-static inline void tlb_flush_by_mmuidx(CPUState *cpu, uint16_t idxmap)
-{
-}
-static inline void tlb_flush_page_by_mmuidx_all_cpus_synced(CPUState *cpu,
-                                                            vaddr addr,
-                                                            uint16_t idxmap)
-{
-}
-static inline void tlb_flush_by_mmuidx_all_cpus_synced(CPUState *cpu,
-                                                       uint16_t idxmap)
-{
-}
-static inline void tlb_flush_page_bits_by_mmuidx(CPUState *cpu,
-                                                 vaddr addr,
-                                                 uint16_t idxmap,
-                                                 unsigned bits)
-{
-}
-static inline void
-tlb_flush_page_bits_by_mmuidx_all_cpus_synced(CPUState *cpu, vaddr addr,
-                                              uint16_t idxmap, unsigned bits)
-{
-}
-static inline void tlb_flush_range_by_mmuidx(CPUState *cpu, vaddr addr,
-                                             vaddr len, uint16_t idxmap,
-                                             unsigned bits)
-{
-}
-static inline void tlb_flush_range_by_mmuidx_all_cpus_synced(CPUState *cpu,
-                                                             vaddr addr,
-                                                             vaddr len,
-                                                             uint16_t idxmap,
-                                                             unsigned bits)
-{
-}
-#endif
-
 #if defined(CONFIG_TCG)
 
 /**
diff --git a/accel/tcg/tcg-accel-ops.c b/accel/tcg/tcg-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-accel-ops.c
+++ b/accel/tcg/tcg-accel-ops.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/main-loop.h"
 #include "qemu/guest-random.h"
 #include "qemu/timer.h"
-#include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "exec/hwaddr.h"
 #include "exec/tb-flush.h"
 #include "exec/translation-block.h"
diff --git a/cpu-target.c b/cpu-target.c
index XXXXXXX..XXXXXXX 100644
--- a/cpu-target.c
+++ b/cpu-target.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/tswap.h"
 #include "exec/replay-core.h"
 #include "exec/cpu-common.h"
+#include "exec/cputlb.h"
 #include "exec/exec-all.h"
 #include "exec/tb-flush.h"
 #include "exec/log.h"
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@
 #include "system/runstate.h"
 #include "target/arm/cpu.h"
 #include "target/arm/cpu-features.h"
-#include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "exec/memop.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
diff --git a/hw/ppc/spapr_nested.c b/hw/ppc/spapr_nested.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ppc/spapr_nested.c
+++ b/hw/ppc/spapr_nested.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu/cutils.h"
 #include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "helper_regs.h"
 #include "hw/ppc/ppc.h"
 #include "hw/ppc/spapr.h"
diff --git a/hw/sh4/sh7750.c b/hw/sh4/sh7750.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sh4/sh7750.c
+++ b/hw/sh4/sh7750.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sh4/sh_intc.h"
 #include "hw/timer/tmu012.h"
 #include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "trace.h"
 
 typedef struct SH7750State {
diff --git a/system/watchpoint.c b/system/watchpoint.c
index XXXXXXX..XXXXXXX 100644
--- a/system/watchpoint.c
+++ b/system/watchpoint.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "qemu/error-report.h"
-#include "exec/exec-all.h"
+#include "exec/cputlb.h"
+#include "exec/target_page.h"
 #include "hw/core/cpu.h"
 
 /* Add a watchpoint.  */
diff --git a/target/alpha/sys_helper.c b/target/alpha/sys_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/sys_helper.c
+++ b/target/alpha/sys_helper.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "exec/tb-flush.h"
 #include "exec/helper-proto.h"
 #include "system/runstate.h"
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/timer.h"
 #include "qemu/bitops.h"
 #include "qemu/qemu-print.h"
+#include "exec/cputlb.h"
 #include "exec/exec-all.h"
 #include "exec/translation-block.h"
 #include "hw/irq.h"
diff --git a/target/arm/tcg/tlb-insns.c b/target/arm/tcg/tlb-insns.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/tlb-insns.c
+++ b/target/arm/tcg/tlb-insns.c
@@ -XXX,XX +XXX,XX @@
  */
 #include "qemu/osdep.h"
 #include "qemu/log.h"
-#include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "cpu.h"
 #include "internals.h"
 #include "cpu-features.h"
diff --git a/target/hppa/mem_helper.c b/target/hppa/mem_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/mem_helper.c
+++ b/target/hppa/mem_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/log.h"
 #include "cpu.h"
 #include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "exec/page-protection.h"
 #include "exec/helper-proto.h"
 #include "hw/core/cpu.h"
diff --git a/target/i386/helper.c b/target/i386/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/helper.c
+++ b/target/i386/helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/qapi-events-run-state.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "exec/translation-block.h"
 #include "system/runstate.h"
 #ifndef CONFIG_USER_ONLY
diff --git a/target/i386/machine.c b/target/i386/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/machine.c
+++ b/target/i386/machine.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "hw/isa/isa.h"
 #include "migration/cpu.h"
 #include "kvm/hyperv.h"
diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/fpu_helper.c
+++ b/target/i386/tcg/fpu_helper.c
@@ -XXX,XX +XXX,XX @@
 #include <math.h>
 #include "cpu.h"
 #include "tcg-cpu.h"
-#include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "exec/cpu_ldst.h"
 #include "exec/helper-proto.h"
 #include "fpu/softfloat.h"
diff --git a/target/i386/tcg/misc_helper.c b/target/i386/tcg/misc_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/misc_helper.c
+++ b/target/i386/tcg/misc_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/log.h"
 #include "cpu.h"
 #include "exec/helper-proto.h"
-#include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "helper-tcg.h"
 
 /*
diff --git a/target/i386/tcg/system/misc_helper.c b/target/i386/tcg/system/misc_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/system/misc_helper.c
+++ b/target/i386/tcg/system/misc_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/helper-proto.h"
 #include "exec/cpu_ldst.h"
 #include "exec/address-spaces.h"
-#include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "tcg/helper-tcg.h"
 #include "hw/i386/apic.h"
 
diff --git a/target/i386/tcg/system/svm_helper.c b/target/i386/tcg/system/svm_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/system/svm_helper.c
+++ b/target/i386/tcg/system/svm_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/log.h"
 #include "cpu.h"
 #include "exec/helper-proto.h"
-#include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "exec/cpu_ldst.h"
 #include "tcg/helper-tcg.h"
 
diff --git a/target/loongarch/tcg/csr_helper.c b/target/loongarch/tcg/csr_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/tcg/csr_helper.c
+++ b/target/loongarch/tcg/csr_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "internals.h"
 #include "qemu/host-utils.h"
 #include "exec/helper-proto.h"
-#include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "exec/cpu_ldst.h"
 #include "hw/irq.h"
 #include "cpu-csr.h"
diff --git a/target/microblaze/mmu.c b/target/microblaze/mmu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/mmu.c
+++ b/target/microblaze/mmu.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu/log.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "exec/page-protection.h"
 
 static unsigned int tlb_decode_size(unsigned int f)
diff --git a/target/mips/system/cp0.c b/target/mips/system/cp0.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/system/cp0.c
+++ b/target/mips/system/cp0.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "internal.h"
-#include "exec/exec-all.h"
+#include "exec/cputlb.h"
 
 /* Called for updates to CP0_Status.  */
 void sync_c0_status(CPUMIPSState *env, CPUMIPSState *cpu, int tc)
diff --git a/target/mips/tcg/system/cp0_helper.c b/target/mips/tcg/system/cp0_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/system/cp0_helper.c
+++ b/target/mips/tcg/system/cp0_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "internal.h"
 #include "qemu/host-utils.h"
 #include "exec/helper-proto.h"
-#include "exec/exec-all.h"
+#include "exec/cputlb.h"
 
 
 /* SMP helpers.  */
diff --git a/target/openrisc/sys_helper.c b/target/openrisc/sys_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/sys_helper.c
+++ b/target/openrisc/sys_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "exec/helper-proto.h"
 #include "exception.h"
 #ifndef CONFIG_USER_ONLY
diff --git a/target/ppc/helper_regs.c b/target/ppc/helper_regs.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/helper_regs.c
+++ b/target/ppc/helper_regs.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "qemu/main-loop.h"
-#include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "system/kvm.h"
 #include "system/tcg.h"
 #include "helper_regs.h"
diff --git a/target/ppc/misc_helper.c b/target/ppc/misc_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/misc_helper.c
+++ b/target/ppc/misc_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/log.h"
 #include "cpu.h"
 #include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "exec/helper-proto.h"
 #include "qemu/error-report.h"
 #include "qemu/main-loop.h"
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@
 #include "pmu.h"
 #include "time_helper.h"
 #include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "exec/tb-flush.h"
 #include "system/cpu-timers.h"
 #include "qemu/guest-random.h"
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "internals.h"
 #include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "exec/cpu_ldst.h"
 #include "exec/helper-proto.h"
 #include "trace.h"
diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "cpu.h"
 #include "trace.h"
-#include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "exec/page-protection.h"
 
 static bool pmp_write_cfg(CPURISCVState *env, uint32_t addr_index,
diff --git a/target/s390x/gdbstub.c b/target/s390x/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/gdbstub.c
+++ b/target/s390x/gdbstub.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "s390x-internal.h"
-#include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "exec/gdbstub.h"
 #include "gdbstub/helpers.h"
 #include "qemu/bitops.h"
diff --git a/target/s390x/sigp.c b/target/s390x/sigp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/sigp.c
+++ b/target/s390x/sigp.c
@@ -XXX,XX +XXX,XX @@
 #include "system/hw_accel.h"
 #include "system/runstate.h"
 #include "exec/address-spaces.h"
+#include "exec/cputlb.h"
 #include "exec/exec-all.h"
 #include "system/tcg.h"
 #include "trace.h"
diff --git a/target/s390x/tcg/mem_helper.c b/target/s390x/tcg/mem_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/tcg/mem_helper.c
+++ b/target/s390x/tcg/mem_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/helper-proto.h"
 #include "exec/cpu-common.h"
 #include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "exec/page-protection.h"
 #include "exec/cpu_ldst.h"
 #include "accel/tcg/cpu-ops.h"
diff --git a/target/s390x/tcg/misc_helper.c b/target/s390x/tcg/misc_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/tcg/misc_helper.c
+++ b/target/s390x/tcg/misc_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/helper-proto.h"
 #include "qemu/timer.h"
 #include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "exec/cpu_ldst.h"
 #include "qapi/error.h"
 #include "tcg_s390x.h"
diff --git a/target/sparc/ldst_helper.c b/target/sparc/ldst_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/ldst_helper.c
+++ b/target/sparc/ldst_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "tcg/tcg.h"
 #include "exec/helper-proto.h"
 #include "exec/exec-all.h"
+#include "exec/cputlb.h"
 #include "exec/page-protection.h"
 #include "exec/cpu_ldst.h"
 #ifdef CONFIG_USER_ONLY
diff --git a/target/xtensa/mmu_helper.c b/target/xtensa/mmu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/mmu_helper.c
+++ b/target/xtensa/mmu_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "exec/helper-proto.h"
 #include "qemu/host-utils.h"
+#include "exec/cputlb.h"
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
 
-- 
2.43.0

All that is required is to avoid including exec-all.h.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tcg-accel-ops-icount.c | 2 +-
 accel/tcg/meson.build            | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/accel/tcg/tcg-accel-ops-icount.c b/accel/tcg/tcg-accel-ops-icount.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-accel-ops-icount.c
+++ b/accel/tcg/tcg-accel-ops-icount.c
@@ -XXX,XX +XXX,XX @@
 #include "system/cpu-timers.h"
 #include "qemu/main-loop.h"
 #include "qemu/guest-random.h"
-#include "exec/exec-all.h"
+#include "hw/core/cpu.h"
 
 #include "tcg-accel-ops.h"
 #include "tcg-accel-ops-icount.h"
diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/meson.build
+++ b/accel/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_specific_ss)
 specific_ss.add(when: ['CONFIG_SYSTEM_ONLY', 'CONFIG_TCG'], if_true: files(
   'cputlb.c',
   'tcg-accel-ops-mttcg.c',
-  'tcg-accel-ops-icount.c',
   'tcg-accel-ops-rr.c',
 ))
 
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: ['CONFIG_TCG'], if_true: files(
   'icount-common.c',
   'monitor.c',
   'tcg-accel-ops.c',
+  'tcg-accel-ops-icount.c',
   'watchpoint.c',
 ))
-- 
2.43.0

All that is required is to use cpu-common.h instead of exec-all.h.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tcg-accel-ops-rr.c | 2 +-
 accel/tcg/meson.build        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/accel/tcg/tcg-accel-ops-rr.c b/accel/tcg/tcg-accel-ops-rr.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-accel-ops-rr.c
+++ b/accel/tcg/tcg-accel-ops-rr.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/main-loop.h"
 #include "qemu/notify.h"
 #include "qemu/guest-random.h"
-#include "exec/exec-all.h"
+#include "exec/cpu-common.h"
 #include "tcg/startup.h"
 #include "tcg-accel-ops.h"
 #include "tcg-accel-ops-rr.h"
diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/meson.build
+++ b/accel/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_specific_ss)
 specific_ss.add(when: ['CONFIG_SYSTEM_ONLY', 'CONFIG_TCG'], if_true: files(
   'cputlb.c',
   'tcg-accel-ops-mttcg.c',
-  'tcg-accel-ops-rr.c',
 ))
 
 system_ss.add(when: ['CONFIG_TCG'], if_true: files(
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: ['CONFIG_TCG'], if_true: files(
   'monitor.c',
   'tcg-accel-ops.c',
   'tcg-accel-ops-icount.c',
+  'tcg-accel-ops-rr.c',
   'watchpoint.c',
 ))
-- 
2.43.0

All that is required is to avoid including exec-all.h.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tcg-accel-ops-mttcg.c | 1 -
 accel/tcg/meson.build           | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/accel/tcg/tcg-accel-ops-mttcg.c b/accel/tcg/tcg-accel-ops-mttcg.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-accel-ops-mttcg.c
+++ b/accel/tcg/tcg-accel-ops-mttcg.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/main-loop.h"
 #include "qemu/notify.h"
 #include "qemu/guest-random.h"
-#include "exec/exec-all.h"
 #include "hw/boards.h"
 #include "tcg/startup.h"
 #include "tcg-accel-ops.h"
diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/meson.build
+++ b/accel/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_specific_ss)
 
 specific_ss.add(when: ['CONFIG_SYSTEM_ONLY', 'CONFIG_TCG'], if_true: files(
   'cputlb.c',
-  'tcg-accel-ops-mttcg.c',
 ))
 
 system_ss.add(when: ['CONFIG_TCG'], if_true: files(
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: ['CONFIG_TCG'], if_true: files(
   'monitor.c',
   'tcg-accel-ops.c',
   'tcg-accel-ops-icount.c',
+  'tcg-accel-ops-mttcg.c',
   'tcg-accel-ops-rr.c',
   'watchpoint.c',
 ))
-- 
2.43.0

From: Philippe Mathieu-Daudé <philmd@linaro.org>

GETPC_ADJ is only used within accel/tcg/, no need to
expose it to all the code base.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250308072348.65723-2-philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tb-internal.h | 11 +++++++++++
 include/exec/exec-all.h |  9 ---------
 2 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/accel/tcg/tb-internal.h b/accel/tcg/tb-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tb-internal.h
+++ b/accel/tcg/tb-internal.h
@@ -XXX,XX +XXX,XX @@
 #include "exec/exec-all.h"
 #include "exec/translation-block.h"
 
+/*
+ * The true return address will often point to a host insn that is part of
+ * the next translated guest insn.  Adjust the address backward to point to
+ * the middle of the call insn.  Subtracting one would do the job except for
+ * several compressed mode architectures (arm, mips) which set the low bit
+ * to indicate the compressed mode; subtracting two works around that.  It
+ * is also the case that there are no host isas that contain a call insn
+ * smaller than 4 bytes, so we don't worry about special-casing this.
+ */
+#define GETPC_ADJ   2
+
 #ifdef CONFIG_SOFTMMU
 
 #define CPU_TLB_DYN_MIN_BITS 6
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ extern __thread uintptr_t tci_tb_ptr;
     ((uintptr_t)__builtin_extract_return_addr(__builtin_return_address(0)))
 #endif
 
-/* The true return address will often point to a host insn that is part of
-   the next translated guest insn.  Adjust the address backward to point to
-   the middle of the call insn.  Subtracting one would do the job except for
-   several compressed mode architectures (arm, mips) which set the low bit
-   to indicate the compressed mode; subtracting two works around that.  It
-   is also the case that there are no host isas that contain a call insn
-   smaller than 4 bytes, so we don't worry about special-casing this.  */
-#define GETPC_ADJ   2
-
 #if !defined(CONFIG_USER_ONLY)
 
 /**
-- 
2.43.0

Split out GETPC to a target-independent header.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250308072348.65723-3-philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/accel/tcg/getpc.h | 24 ++++++++++++++++++++++++
 include/exec/exec-all.h   | 10 +---------
 2 files changed, 25 insertions(+), 9 deletions(-)
 create mode 100644 include/accel/tcg/getpc.h

diff --git a/include/accel/tcg/getpc.h b/include/accel/tcg/getpc.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/accel/tcg/getpc.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Get host pc for helper unwinding.
+ *
+ * Copyright (c) 2003 Fabrice Bellard
+ * SPDX-License-Identifier: LGPL-2.1-or-later
+ */
+
+#ifndef ACCEL_TCG_GETPC_H
+#define ACCEL_TCG_GETPC_H
+
+#ifndef CONFIG_TCG
+#error Can only include this header with TCG
+#endif
+
+/* GETPC is the true target of the return instruction that we'll execute.  */
+#ifdef CONFIG_TCG_INTERPRETER
+extern __thread uintptr_t tci_tb_ptr;
+# define GETPC() tci_tb_ptr
+#else
+# define GETPC() \
+    ((uintptr_t)__builtin_extract_return_addr(__builtin_return_address(0)))
+#endif
+
+#endif /* ACCEL_TCG_GETPC_H */
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@
 #include "exec/translation-block.h"
 
 #if defined(CONFIG_TCG)
+#include "accel/tcg/getpc.h"
 
 /**
  * probe_access:
@@ -XXX,XX +XXX,XX @@ void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr);
 void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t last);
 void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr);
 
-/* GETPC is the true target of the return instruction that we'll execute.  */
-#if defined(CONFIG_TCG_INTERPRETER)
-extern __thread uintptr_t tci_tb_ptr;
-# define GETPC() tci_tb_ptr
-#else
-# define GETPC() \
-    ((uintptr_t)__builtin_extract_return_addr(__builtin_return_address(0)))
-#endif
-
 #if !defined(CONFIG_USER_ONLY)
 
 /**
-- 
2.43.0

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Since commit 139c1837db ("meson: rename included C source files
to .c.inc"), QEMU standard procedure for included C files is to
use *.c.inc.

Besides, since commit 6a0057aa22 ("docs/devel: make a statement
about includes") this is documented in the Coding Style:

If you do use template header files they should be named with
  the ``.c.inc`` or ``.h.inc`` suffix to make it clear they are
  being included for expansion.

Therefore rename 'atomic128-cas.h' as 'atomic128-cas.h.inc'.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20241212141018.59428-2-philmd@linaro.org>
---
 host/include/aarch64/host/atomic128-cas.h                       | 2 +-
 include/qemu/atomic128.h                                        | 2 +-
 .../generic/host/{atomic128-cas.h => atomic128-cas.h.inc}       | 0
 3 files changed, 2 insertions(+), 2 deletions(-)
 rename host/include/generic/host/{atomic128-cas.h => atomic128-cas.h.inc} (100%)

diff --git a/host/include/aarch64/host/atomic128-cas.h b/host/include/aarch64/host/atomic128-cas.h
index XXXXXXX..XXXXXXX 100644
--- a/host/include/aarch64/host/atomic128-cas.h
+++ b/host/include/aarch64/host/atomic128-cas.h
@@ -XXX,XX +XXX,XX @@
 
 /* Through gcc 10, aarch64 has no support for 128-bit atomics.  */
 #if defined(CONFIG_ATOMIC128) || defined(CONFIG_CMPXCHG128)
-#include "host/include/generic/host/atomic128-cas.h"
+#include "host/include/generic/host/atomic128-cas.h.inc"
 #else
 static inline Int128 atomic16_cmpxchg(Int128 *ptr, Int128 cmp, Int128 new)
 {
diff --git a/include/qemu/atomic128.h b/include/qemu/atomic128.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/atomic128.h
+++ b/include/qemu/atomic128.h
@@ -XXX,XX +XXX,XX @@
  * Therefore, special case each platform.
  */
 
-#include "host/atomic128-cas.h"
+#include "host/atomic128-cas.h.inc"
 #include "host/atomic128-ldst.h"
 
 #endif /* QEMU_ATOMIC128_H */
diff --git a/host/include/generic/host/atomic128-cas.h b/host/include/generic/host/atomic128-cas.h.inc
similarity index 100%
rename from host/include/generic/host/atomic128-cas.h
rename to host/include/generic/host/atomic128-cas.h.inc
-- 
2.43.0

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Since commit 139c1837db ("meson: rename included C source files
to .c.inc"), QEMU standard procedure for included C files is to
use *.c.inc.

Besides, since commit 6a0057aa22 ("docs/devel: make a statement
about includes") this is documented in the Coding Style:

If you do use template header files they should be named with
  the ``.c.inc`` or ``.h.inc`` suffix to make it clear they are
  being included for expansion.

Therefore rename 'atomic128-ldst.h' as 'atomic128-ldst.h.inc'.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20241212141018.59428-3-philmd@linaro.org>
---
 include/qemu/atomic128.h                                        | 2 +-
 .../aarch64/host/{atomic128-ldst.h => atomic128-ldst.h.inc}     | 0
 .../generic/host/{atomic128-ldst.h => atomic128-ldst.h.inc}     | 0
 .../loongarch64/host/{atomic128-ldst.h => atomic128-ldst.h.inc} | 0
 .../x86_64/host/{atomic128-ldst.h => atomic128-ldst.h.inc}      | 2 +-
 host/include/x86_64/host/load-extract-al16-al8.h.inc            | 2 +-
 6 files changed, 3 insertions(+), 3 deletions(-)
 rename host/include/aarch64/host/{atomic128-ldst.h => atomic128-ldst.h.inc} (100%)
 rename host/include/generic/host/{atomic128-ldst.h => atomic128-ldst.h.inc} (100%)
 rename host/include/loongarch64/host/{atomic128-ldst.h => atomic128-ldst.h.inc} (100%)
 rename host/include/x86_64/host/{atomic128-ldst.h => atomic128-ldst.h.inc} (96%)

diff --git a/include/qemu/atomic128.h b/include/qemu/atomic128.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/atomic128.h
+++ b/include/qemu/atomic128.h
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "host/atomic128-cas.h.inc"
-#include "host/atomic128-ldst.h"
+#include "host/atomic128-ldst.h.inc"
 
 #endif /* QEMU_ATOMIC128_H */
diff --git a/host/include/aarch64/host/atomic128-ldst.h b/host/include/aarch64/host/atomic128-ldst.h.inc
similarity index 100%
rename from host/include/aarch64/host/atomic128-ldst.h
rename to host/include/aarch64/host/atomic128-ldst.h.inc
diff --git a/host/include/generic/host/atomic128-ldst.h b/host/include/generic/host/atomic128-ldst.h.inc
similarity index 100%
rename from host/include/generic/host/atomic128-ldst.h
rename to host/include/generic/host/atomic128-ldst.h.inc
diff --git a/host/include/loongarch64/host/atomic128-ldst.h b/host/include/loongarch64/host/atomic128-ldst.h.inc
similarity index 100%
rename from host/include/loongarch64/host/atomic128-ldst.h
rename to host/include/loongarch64/host/atomic128-ldst.h.inc
diff --git a/host/include/x86_64/host/atomic128-ldst.h b/host/include/x86_64/host/atomic128-ldst.h.inc
similarity index 96%
rename from host/include/x86_64/host/atomic128-ldst.h
rename to host/include/x86_64/host/atomic128-ldst.h.inc
index XXXXXXX..XXXXXXX 100644
--- a/host/include/x86_64/host/atomic128-ldst.h
+++ b/host/include/x86_64/host/atomic128-ldst.h.inc
@@ -XXX,XX +XXX,XX @@ static inline void atomic16_set(Int128 *ptr, Int128 val)
 }
 #else
 /* Provide QEMU_ERROR stubs. */
-#include "host/include/generic/host/atomic128-ldst.h"
+#include "host/include/generic/host/atomic128-ldst.h.inc"
 #endif
 
 #endif /* X86_64_ATOMIC128_LDST_H */
diff --git a/host/include/x86_64/host/load-extract-al16-al8.h.inc b/host/include/x86_64/host/load-extract-al16-al8.h.inc
index XXXXXXX..XXXXXXX 100644
--- a/host/include/x86_64/host/load-extract-al16-al8.h.inc
+++ b/host/include/x86_64/host/load-extract-al16-al8.h.inc
@@ -XXX,XX +XXX,XX @@
 #define X86_64_LOAD_EXTRACT_AL16_AL8_H
 
 #ifdef CONFIG_INT128_TYPE
-#include "host/atomic128-ldst.h"
+#include "host/atomic128-ldst.h.inc"
 
 /**
  * load_atom_extract_al16_or_al8:
-- 
2.43.0

From: Philippe Mathieu-Daudé <philmd@linaro.org>

qatomic_cmpxchg__nocheck() is declared in "qemu/atomic.h".
Include it in order to avoid when refactoring unrelated headers:

In file included from ../../accel/tcg/tcg-runtime-gvec.c:22:
    In file included from include/exec/helper-proto-common.h:10:
    In file included from include/qemu/atomic128.h:61:
    host/include/generic/host/atomic128-cas.h.inc:23:11: error: call to undeclared function 'qatomic_cmpxchg__nocheck'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
       23 |     r.i = qatomic_cmpxchg__nocheck(ptr_align, c.i, n.i);
          |           ^
    1 error generated.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20241212141018.59428-4-philmd@linaro.org>
---
 include/qemu/atomic128.h | 1 +
 1 file changed, 1 insertion(+)

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tcg-runtime.c | 8 ++------
 accel/tcg/meson.build   | 2 +-
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/accel/tcg/tcg-runtime.c b/accel/tcg/tcg-runtime.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-runtime.c
+++ b/accel/tcg/tcg-runtime.c
@@ -XXX,XX +XXX,XX @@
  */
 #include "qemu/osdep.h"
 #include "qemu/host-utils.h"
-#include "cpu.h"
+#include "exec/cpu-common.h"
 #include "exec/helper-proto-common.h"
-#include "exec/cpu_ldst.h"
-#include "exec/exec-all.h"
-#include "disas/disas.h"
-#include "exec/log.h"
-#include "tcg/tcg.h"
+#include "accel/tcg/getpc.h"
 
 #define HELPER_H  "accel/tcg/tcg-runtime.h"
 #include "exec/helper-info.c.inc"
diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/meson.build
+++ b/accel/tcg/meson.build
@@ -XXX,XX +XXX,XX @@
 common_ss.add(when: 'CONFIG_TCG', if_true: files(
   'cpu-exec-common.c',
+  'tcg-runtime.c',
 ))
 tcg_specific_ss = ss.source_set()
 tcg_specific_ss.add(files(
@@ -XXX,XX +XXX,XX @@ tcg_specific_ss.add(files(
   'cpu-exec.c',
   'tb-maint.c',
   'tcg-runtime-gvec.c',
-  'tcg-runtime.c',
   'translate-all.c',
   'translator.c',
 ))
-- 
2.43.0

diff --git a/accel/tcg/tcg-runtime-gvec.c b/accel/tcg/tcg-runtime-gvec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-runtime-gvec.c
+++ b/accel/tcg/tcg-runtime-gvec.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "qemu/host-utils.h"
-#include "cpu.h"
 #include "exec/helper-proto-common.h"
 #include "tcg/tcg-gvec-desc.h"
 
diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/meson.build
+++ b/accel/tcg/meson.build
@@ -XXX,XX +XXX,XX @@
 common_ss.add(when: 'CONFIG_TCG', if_true: files(
   'cpu-exec-common.c',
   'tcg-runtime.c',
+  'tcg-runtime-gvec.c',
 ))
 tcg_specific_ss = ss.source_set()
 tcg_specific_ss.add(files(
   'tcg-all.c',
   'cpu-exec.c',
   'tb-maint.c',
-  'tcg-runtime-gvec.c',
   'translate-all.c',
   'translator.c',
 ))
-- 
2.43.0

The third argument of the syscall contains the size of the
cpu mask in bytes, not bits.  Nor is the size rounded up to
a multiple of sizeof(abi_ulong).

Cc: qemu-stable@nongnu.org
Reported-by: Andreas Schwab <schwab@suse.de>
Fixes: 9e1c7d982d7 ("linux-user/riscv: Add syscall riscv_hwprobe")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/syscall.c | 55 +++++++++++++++++++++++---------------------
 1 file changed, 29 insertions(+), 26 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -XXX,XX +XXX,XX @@ static void risc_hwprobe_fill_pairs(CPURISCVState *env,
     }
 }
 
-static int cpu_set_valid(abi_long arg3, abi_long arg4)
+/*
+ * If the cpumask_t of (target_cpus, cpusetsize) cannot be read: -EFAULT.
+ * If the cpumast_t has no bits set: -EINVAL.
+ * Otherwise the cpumask_t contains some bit set: 0.
+ * Unlike the kernel, we do not mask cpumask_t by the set of online cpus,
+ * nor bound the search by cpumask_size().
+ */
+static int nonempty_cpu_set(abi_ulong cpusetsize, abi_ptr target_cpus)
 {
-    int ret, i, tmp;
-    size_t host_mask_size, target_mask_size;
-    unsigned long *host_mask;
+    unsigned char *p = lock_user(VERIFY_READ, target_cpus, cpusetsize, 1);
+    int ret = -TARGET_EFAULT;
 
-    /*
-     * cpu_set_t represent CPU masks as bit masks of type unsigned long *.
-     * arg3 contains the cpu count.
-     */
-    tmp = (8 * sizeof(abi_ulong));
-    target_mask_size = ((arg3 + tmp - 1) / tmp) * sizeof(abi_ulong);
-    host_mask_size = (target_mask_size + (sizeof(*host_mask) - 1)) &
-                     ~(sizeof(*host_mask) - 1);
-
-    host_mask = alloca(host_mask_size);
-
-    ret = target_to_host_cpu_mask(host_mask, host_mask_size,
-                                  arg4, target_mask_size);
-    if (ret != 0) {
-        return ret;
-    }
-
-    for (i = 0 ; i < host_mask_size / sizeof(*host_mask); i++) {
-        if (host_mask[i] != 0) {
-            return 0;
+    if (p) {
+        ret = -TARGET_EINVAL;
+        /*
+         * Since we only care about the empty/non-empty state of the cpumask_t
+         * not the individual bits, we do not need to repartition the bits
+         * from target abi_ulong to host unsigned long.
+         *
+         * Note that the kernel does not round up cpusetsize to a multiple of
+         * sizeof(abi_ulong).  After bounding cpusetsize by cpumask_size(),
+         * it copies exactly cpusetsize bytes into a zeroed buffer.
+         */
+        for (abi_ulong i = 0; i < cpusetsize; ++i) {
+            if (p[i]) {
+                ret = 0;
+                break;
+            }
         }
+        unlock_user(p, target_cpus, 0);
     }
-    return -TARGET_EINVAL;
+    return ret;
 }
 
 static abi_long do_riscv_hwprobe(CPUArchState *cpu_env, abi_long arg1,
@@ -XXX,XX +XXX,XX @@ static abi_long do_riscv_hwprobe(CPUArchState *cpu_env, abi_long arg1,
 
     /* check cpu_set */
     if (arg3 != 0) {
-        ret = cpu_set_valid(arg3, arg4);
+        ret = nonempty_cpu_set(arg3, arg4);
         if (ret != 0) {
             return ret;
         }
-- 
2.43.0