Series comparison

-[PULL 00/33] tcg patch queue
+[PULL 00/35] tcg patch queue
-The following changes since commit 3ccf6cd0e3e1dfd663814640b3b18b55715d7a75:
+The following changes since commit 57b6f58c1d0df757c9311496c32d502925056894:
-  Merge remote-tracking branch 'remotes/kraxel/tags/audio-20210617-pull-request' into staging (2021-06-18 09:54:42 +0100)
+  Merge remote-tracking branch 'remotes/hreitz/tags/pull-block-2021-09-15' into staging (2021-09-15 18:55:59 +0100)
 are available in the Git repository at:
-  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20210619
+  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20210916
-for you to fetch changes up to 8169ec35eb766a12ad0ae898119060fde148ab61:
+for you to fetch changes up to 50febfe212f24a9b91b4224d03f653415fddf8e1:
-  util/oslib-win32: Fix fatal assertion in qemu_try_memalign (2021-06-19 11:09:11 -0700)
+  tcg/mips: Drop special alignment for code_gen_buffer (2021-09-16 09:37:39 -0400)
 ----------------------------------------------------------------
-TCI cleanup and re-encoding
+Restrict cpu_has_work to sysemu, and move to AccelOpsClass.
-Fixes for #367 and #390.
+Move cpu_signal_handler declaration out of target/.
-Move TCGCond to tcg/tcg-cond.h.
+Misc tcg/mips/ cleanups.
 Fix for win32 qemu_try_memalign.
 ----------------------------------------------------------------
-Alessandro Di Federico (1):
+Philippe Mathieu-Daudé (30):
-      tcg: expose TCGCond manipulation routines
+      accel/tcg: Restrict cpu_handle_halt() to sysemu
       hw/core: Restrict cpu_has_work() to sysemu
       hw/core: Un-inline cpu_has_work()
       sysemu: Introduce AccelOpsClass::has_work()
       accel/kvm: Implement AccelOpsClass::has_work()
       accel/whpx: Implement AccelOpsClass::has_work()
       accel/tcg: Implement AccelOpsClass::has_work() as stub
       target/alpha: Restrict has_work() handler to sysemu
       target/arm: Restrict has_work() handler to sysemu and TCG
       target/avr: Restrict has_work() handler to sysemu
       target/cris: Restrict has_work() handler to sysemu
       target/hexagon: Remove unused has_work() handler
       target/hppa: Restrict has_work() handler to sysemu
       target/i386: Restrict has_work() handler to sysemu and TCG
       target/m68k: Restrict has_work() handler to sysemu
       target/microblaze: Restrict has_work() handler to sysemu
       target/mips: Restrict has_work() handler to sysemu and TCG
       target/nios2: Restrict has_work() handler to sysemu
       target/openrisc: Restrict has_work() handler to sysemu
       target/ppc: Introduce PowerPCCPUClass::has_work()
       target/ppc: Restrict has_work() handlers to sysemu and TCG
       target/riscv: Restrict has_work() handler to sysemu and TCG
       target/rx: Restrict has_work() handler to sysemu
       target/s390x: Restrict has_work() handler to sysemu and TCG
       target/sh4: Restrict has_work() handler to sysemu
       target/sparc: Remove pointless use of CONFIG_TCG definition
       target/sparc: Restrict has_work() handler to sysemu
       target/tricore: Restrict has_work() handler to sysemu
       target/xtensa: Restrict has_work() handler to sysemu
       accel: Add missing AccelOpsClass::has_work() and drop SysemuCPUOps one
-Richard Henderson (31):
+Richard Henderson (5):
-      tcg: Combine dh_is_64bit and dh_is_signed to dh_typecode
+      include/exec: Move cpu_signal_handler declaration
-      tcg: Add tcg_call_flags
+      tcg/mips: Drop inline markers
-      accel/tcg/plugin-gen: Drop inline markers
+      tcg/mips: Allow JAL to be out of range in tcg_out_bswap_subr
-      plugins: Drop tcg_flags from struct qemu_plugin_dyn_cb
+      tcg/mips: Unset TCG_TARGET_HAS_direct_jump
-      accel/tcg: Add tcg call flags to plugins helpers
+      tcg/mips: Drop special alignment for code_gen_buffer
       tcg: Store the TCGHelperInfo in the TCGOp for call
       tcg: Add tcg_call_func
       tcg: Build ffi data structures for helpers
       tcg/tci: Improve tcg_target_call_clobber_regs
       tcg/tci: Move call-return regs to end of tcg_target_reg_alloc_order
       tcg/tci: Use ffi for calls
       tcg/tci: Reserve r13 for a temporary
       tcg/tci: Emit setcond before brcond
       tcg/tci: Remove tci_write_reg
       tcg/tci: Change encoding to uint32_t units
       tcg/tci: Implement goto_ptr
       tcg/tci: Implement movcond
       tcg/tci: Implement andc, orc, eqv, nand, nor
       tcg/tci: Implement extract, sextract
       tcg/tci: Implement clz, ctz, ctpop
       tcg/tci: Implement mulu2, muls2
       tcg/tci: Implement add2, sub2
       tcg/tci: Split out tci_qemu_ld, tci_qemu_st
       Revert "tcg/tci: Use exec/cpu_ldst.h interfaces"
       tcg/tci: Remove the qemu_ld/st_type macros
       tcg/tci: Use {set,clear}_helper_retaddr
       tests/tcg: Increase timeout for TCI
       accel/tcg: Probe the proper permissions for atomic ops
       tcg/sparc: Fix temp_allocate_frame vs sparc stack bias
       tcg: Allocate sufficient storage in temp_allocate_frame
       tcg: Restart when exhausting the stack frame
-Stefan Weil (1):
+ include/exec/exec-all.h           |  13 +++++
-      util/oslib-win32: Fix fatal assertion in qemu_try_memalign
+ include/hw/core/cpu.h             |  28 ++++------
  include/hw/core/tcg-cpu-ops.h     |   4 ++
  include/sysemu/accel-ops.h        |   5 ++
  target/alpha/cpu.h                |   6 ---
  target/arm/cpu.h                  |   7 ---
  target/avr/cpu.h                  |   2 -
  target/cris/cpu.h                 |   8 ---
  target/hexagon/cpu.h              |   3 --
  target/hppa/cpu.h                 |   3 --
  target/i386/cpu.h                 |   7 ---
  target/m68k/cpu.h                 |   8 ---
  target/microblaze/cpu.h           |   7 ---
  target/mips/cpu.h                 |   3 --
  target/mips/internal.h            |   2 -
  target/nios2/cpu.h                |   2 -
  target/openrisc/cpu.h             |   2 -
  target/ppc/cpu-qom.h              |   3 ++
  target/ppc/cpu.h                  |   7 ---
  target/riscv/cpu.h                |   2 -
  target/rx/cpu.h                   |   4 --
  target/s390x/cpu.h                |   7 ---
  target/sh4/cpu.h                  |   3 --
  target/sparc/cpu.h                |   2 -
  target/tricore/cpu.h              |   2 -
  target/xtensa/cpu.h               |   2 -
  tcg/mips/tcg-target.h             |  12 ++---
  accel/hvf/hvf-accel-ops.c         |   6 +++
  accel/kvm/kvm-accel-ops.c         |   6 +++
  accel/qtest/qtest.c               |   6 +++
  accel/tcg/cpu-exec.c              |   6 ++-
  accel/tcg/tcg-accel-ops.c         |  12 +++++
  accel/xen/xen-all.c               |   6 +++
  hw/core/cpu-common.c              |   6 ---
  softmmu/cpus.c                    |  10 ++--
  target/alpha/cpu.c                |   4 +-
  target/arm/cpu.c                  |   7 ++-
  target/avr/cpu.c                  |   2 +-
  target/cris/cpu.c                 |   4 +-
  target/hexagon/cpu.c              |   6 ---
  target/hppa/cpu.c                 |   4 +-
  target/i386/cpu.c                 |   6 ---
  target/i386/hax/hax-accel-ops.c   |   6 +++
  target/i386/nvmm/nvmm-accel-ops.c |   6 +++
  target/i386/tcg/tcg-cpu.c         |   8 ++-
  target/i386/whpx/whpx-accel-ops.c |   6 +++
  target/m68k/cpu.c                 |   4 +-
  target/microblaze/cpu.c           |   8 +--
  target/mips/cpu.c                 |   4 +-
  target/nios2/cpu.c                |   4 +-
  target/openrisc/cpu.c             |   4 +-
  target/ppc/cpu_init.c             |  37 ++++++++++----
  target/riscv/cpu.c                |   8 ++-
  target/rx/cpu.c                   |   4 +-
  target/s390x/cpu.c                |   4 +-
  target/sh4/cpu.c                  |   5 +-
  target/sparc/cpu.c                |   6 +--
  target/tricore/cpu.c              |   6 ++-
  target/xtensa/cpu.c               |  14 ++---
  tcg/region.c                      |  91 ---------------------------------
  tcg/mips/tcg-target.c.inc         | 105 +++++++++++++-------------------------
 files changed, 233 insertions(+), 342 deletions(-)
- configure                                          |    3 +
- accel/tcg/atomic_template.h                        |   24 +-
- accel/tcg/plugin-helpers.h                         |    5 +-
- include/exec/helper-head.h                         |   37 +-
- include/exec/helper-tcg.h                          |   34 +-
- include/qemu/plugin.h                              |    1 -
- include/tcg/tcg-cond.h                             |  101 ++
- include/tcg/tcg-opc.h                              |    4 +-
- include/tcg/tcg.h                                  |   71 +-
- target/hppa/helper.h                               |    3 -
- target/i386/ops_sse_header.h                       |    3 -
- target/m68k/helper.h                               |    1 -
- target/ppc/helper.h                                |    3 -
- tcg/tcg-internal.h                                 |   22 +
- tcg/tci/tcg-target-con-set.h                       |    1 +
- tcg/tci/tcg-target.h                               |   68 +-
- accel/tcg/cputlb.c                                 |   95 +-
- accel/tcg/plugin-gen.c                             |   20 +-
- accel/tcg/user-exec.c                              |    8 +-
- plugins/core.c                                     |   30 +-
- tcg/optimize.c                                     |    3 +-
- tcg/tcg.c                                          |  300 +++--
- tcg/tci.c                                          | 1203 ++++++++++----------
- util/oslib-win32.c                                 |    6 +-
- tcg/sparc/tcg-target.c.inc                         |   16 +-
- tcg/tci/tcg-target.c.inc                           |  550 ++++-----
- tcg/meson.build                                    |    8 +-
- tcg/tci/README                                     |   20 +-
- tests/docker/dockerfiles/alpine.docker             |    1 +
- tests/docker/dockerfiles/centos8.docker            |    1 +
- tests/docker/dockerfiles/debian10.docker           |    1 +
- tests/docker/dockerfiles/fedora-i386-cross.docker  |    1 +
- tests/docker/dockerfiles/fedora-win32-cross.docker |    1 +
- tests/docker/dockerfiles/fedora-win64-cross.docker |    1 +
- tests/docker/dockerfiles/fedora.docker             |    1 +
- tests/docker/dockerfiles/ubuntu.docker             |    1 +
- tests/docker/dockerfiles/ubuntu1804.docker         |    1 +
- tests/docker/dockerfiles/ubuntu2004.docker         |    1 +
- tests/tcg/Makefile.target                          |    6 +-
-files changed, 1454 insertions(+), 1202 deletions(-)
- create mode 100644 include/tcg/tcg-cond.h

-[PULL 17/33] tcg/tci: Implement movcond
+[PULL 01/35] include/exec: Move cpu_signal_handler declaration
-When this opcode is not available in the backend, tcg middle-end
+There is nothing target specific about this.  The implementation
-will expand this as a series of 5 opcodes.  So implementing this
+is host specific, but the declaration is 100% common.
 saves bytecode space.
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-By: Warner Losh <imp@bsdimp.com>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci/tcg-target.h     |  4 ++--
+ include/exec/exec-all.h | 13 +++++++++++++
- tcg/tci.c                | 16 +++++++++++++++-
+ target/alpha/cpu.h      |  6 ------
- tcg/tci/tcg-target.c.inc | 10 +++++++---
+ target/arm/cpu.h        |  7 -------
-files changed, 24 insertions(+), 6 deletions(-)
+ target/avr/cpu.h        |  2 --
  target/cris/cpu.h       |  8 --------
  target/hexagon/cpu.h    |  3 ---
  target/hppa/cpu.h       |  3 ---
  target/i386/cpu.h       |  7 -------
  target/m68k/cpu.h       |  8 --------
  target/microblaze/cpu.h |  7 -------
  target/mips/cpu.h       |  3 ---
  target/mips/internal.h  |  2 --
  target/nios2/cpu.h      |  2 --
  target/openrisc/cpu.h   |  2 --
  target/ppc/cpu.h        |  7 -------
  target/riscv/cpu.h      |  2 --
  target/rx/cpu.h         |  4 ----
  target/s390x/cpu.h      |  7 -------
  target/sh4/cpu.h        |  3 ---
  target/sparc/cpu.h      |  2 --
  target/tricore/cpu.h    |  2 --
  target/xtensa/cpu.h     |  2 --
 files changed, 13 insertions(+), 89 deletions(-)
-diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
+diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target.h
+--- a/include/exec/exec-all.h
-+++ b/tcg/tci/tcg-target.h
++++ b/include/exec/exec-all.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static inline tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env,
- #define TCG_TARGET_HAS_not_i32          1
+     }
- #define TCG_TARGET_HAS_orc_i32          0
+     return addr;
  #define TCG_TARGET_HAS_rot_i32          1
 -#define TCG_TARGET_HAS_movcond_i32      0
 +#define TCG_TARGET_HAS_movcond_i32      1
  #define TCG_TARGET_HAS_muls2_i32        0
  #define TCG_TARGET_HAS_muluh_i32        0
  #define TCG_TARGET_HAS_mulsh_i32        0
@@ -XXX,XX +XXX,XX @@
  #define TCG_TARGET_HAS_not_i64          1
  #define TCG_TARGET_HAS_orc_i64          0
  #define TCG_TARGET_HAS_rot_i64          1
 -#define TCG_TARGET_HAS_movcond_i64      0
 +#define TCG_TARGET_HAS_movcond_i64      1
  #define TCG_TARGET_HAS_muls2_i64        0
  #define TCG_TARGET_HAS_add2_i32         0
  #define TCG_TARGET_HAS_sub2_i32         0
 diff --git a/tcg/tci.c b/tcg/tci.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci.c
 +++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ static void tci_args_rrrr(uint32_t insn,
      *r2 = extract32(insn, 16, 4);
      *r3 = extract32(insn, 20, 4);
  }
-+#endif
++
++/**
- static void tci_args_rrrrrc(uint32_t insn, TCGReg *r0, TCGReg *r1,
++ * cpu_signal_handler
-                             TCGReg *r2, TCGReg *r3, TCGReg *r4, TCGCond *c5)
++ * @signum: host signal number
-@@ -XXX,XX +XXX,XX @@ static void tci_args_rrrrrc(uint32_t insn, TCGReg *r0, TCGReg *r1,
++ * @pinfo: host siginfo_t
-     *c5 = extract32(insn, 28, 4);
++ * @puc: host ucontext_t
 + *
 + * To be called from the SIGBUS and SIGSEGV signal handler to inform the
 + * virtual cpu of exceptions.  Returns true if the signal was handled by
 + * the virtual CPU.
 + */
 +int cpu_signal_handler(int signum, void *pinfo, void *puc);
 +
  #else
  static inline void mmap_lock(void) {}
  static inline void mmap_unlock(void) {}
 diff --git a/target/alpha/cpu.h b/target/alpha/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/alpha/cpu.h
 +++ b/target/alpha/cpu.h
@@ -XXX,XX +XXX,XX @@ void alpha_cpu_do_unaligned_access(CPUState *cpu, vaddr addr,
                                     int mmu_idx, uintptr_t retaddr);
  #define cpu_list alpha_cpu_list
 -#define cpu_signal_handler cpu_alpha_signal_handler
  typedef CPUAlphaState CPUArchState;
  typedef AlphaCPU ArchCPU;
@@ -XXX,XX +XXX,XX @@ void alpha_translate_init(void);
  #define CPU_RESOLVING_TYPE TYPE_ALPHA_CPU
  void alpha_cpu_list(void);
 -/* you can call this signal handler from your SIGBUS and SIGSEGV
 -   signal handlers to inform the virtual CPU of exceptions. non zero
 -   is returned if the signal was handled by the virtual CPU.  */
 -int cpu_alpha_signal_handler(int host_signum, void *pinfo,
 -                             void *puc);
  bool alpha_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                          MMUAccessType access_type, int mmu_idx,
                          bool probe, uintptr_t retaddr);
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool is_a64(CPUARMState *env)
      return env->aarch64;
  }
-+#if TCG_TARGET_REG_BITS == 32
+-/* you can call this signal handler from your SIGBUS and SIGSEGV
- static void tci_args_rrrrrr(uint32_t insn, TCGReg *r0, TCGReg *r1,
+-   signal handlers to inform the virtual CPU of exceptions. non zero
-                             TCGReg *r2, TCGReg *r3, TCGReg *r4, TCGReg *r5)
+-   is returned if the signal was handled by the virtual CPU.  */
 -int cpu_arm_signal_handler(int host_signum, void *pinfo,
 -                           void *puc);
 -
  /**
   * pmu_op_start/finish
   * @env: CPUARMState
@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);
  #define ARM_CPU_TYPE_NAME(name) (name ARM_CPU_TYPE_SUFFIX)
  #define CPU_RESOLVING_TYPE TYPE_ARM_CPU
 -#define cpu_signal_handler cpu_arm_signal_handler
  #define cpu_list arm_cpu_list
  /* ARM has the following "translation regimes" (as the ARM ARM calls them):
 diff --git a/target/avr/cpu.h b/target/avr/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/avr/cpu.h
 +++ b/target/avr/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline void set_avr_feature(CPUAVRState *env, int feature)
  }
  #define cpu_list avr_cpu_list
 -#define cpu_signal_handler cpu_avr_signal_handler
  #define cpu_mmu_index avr_cpu_mmu_index
  static inline int avr_cpu_mmu_index(CPUAVRState *env, bool ifetch)
@@ -XXX,XX +XXX,XX @@ void avr_cpu_tcg_init(void);
  void avr_cpu_list(void);
  int cpu_avr_exec(CPUState *cpu);
 -int cpu_avr_signal_handler(int host_signum, void *pinfo, void *puc);
  int avr_cpu_memory_rw_debug(CPUState *cs, vaddr address, uint8_t *buf,
                              int len, bool is_write);
 diff --git a/target/cris/cpu.h b/target/cris/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/cris/cpu.h
 +++ b/target/cris/cpu.h
@@ -XXX,XX +XXX,XX @@ int crisv10_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
  int cris_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
  int cris_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 -/* you can call this signal handler from your SIGBUS and SIGSEGV
 -   signal handlers to inform the virtual CPU of exceptions. non zero
 -   is returned if the signal was handled by the virtual CPU.  */
 -int cpu_cris_signal_handler(int host_signum, void *pinfo,
 -                           void *puc);
 -
  void cris_initialize_tcg(void);
  void cris_initialize_crisv10_tcg(void);
@@ -XXX,XX +XXX,XX @@ enum {
  #define CRIS_CPU_TYPE_NAME(name) (name CRIS_CPU_TYPE_SUFFIX)
  #define CPU_RESOLVING_TYPE TYPE_CRIS_CPU
 -#define cpu_signal_handler cpu_cris_signal_handler
 -
  /* MMU modes definitions */
  #define MMU_USER_IDX 1
  static inline int cpu_mmu_index (CPUCRISState *env, bool ifetch)
 diff --git a/target/hexagon/cpu.h b/target/hexagon/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hexagon/cpu.h
 +++ b/target/hexagon/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct HexagonCPU {
  #include "cpu_bits.h"
 -#define cpu_signal_handler cpu_hexagon_signal_handler
 -int cpu_hexagon_signal_handler(int host_signum, void *pinfo, void *puc);
 -
  static inline void cpu_get_tb_cpu_state(CPUHexagonState *env, target_ulong *pc,
                                          target_ulong *cs_base, uint32_t *flags)
  {
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+diff --git a/target/hppa/cpu.h b/target/hppa/cpu.h
-             tci_args_rrrc(insn, &r0, &r1, &r2, &condition);
+index XXXXXXX..XXXXXXX 100644
-             regs[r0] = tci_compare32(regs[r1], regs[r2], condition);
+--- a/target/hppa/cpu.h
-             break;
++++ b/target/hppa/cpu.h
-+        case INDEX_op_movcond_i32:
+@@ -XXX,XX +XXX,XX @@ static inline void cpu_hppa_change_prot_id(CPUHPPAState *env) { }
-+            tci_args_rrrrrc(insn, &r0, &r1, &r2, &r3, &r4, &condition);
+ void cpu_hppa_change_prot_id(CPUHPPAState *env);
 +            tmp32 = tci_compare32(regs[r1], regs[r2], condition);
 +            regs[r0] = regs[tmp32 ? r3 : r4];
 +            break;
  #if TCG_TARGET_REG_BITS == 32
          case INDEX_op_setcond2_i32:
              tci_args_rrrrrc(insn, &r0, &r1, &r2, &r3, &r4, &condition);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              tci_args_rrrc(insn, &r0, &r1, &r2, &condition);
              regs[r0] = tci_compare64(regs[r1], regs[r2], condition);
              break;
 +        case INDEX_op_movcond_i64:
 +            tci_args_rrrrrc(insn, &r0, &r1, &r2, &r3, &r4, &condition);
 +            tmp32 = tci_compare64(regs[r1], regs[r2], condition);
 +            regs[r0] = regs[tmp32 ? r3 : r4];
 +            break;
  #endif
-         CASE_32_64(mov)
-             tci_args_rr(insn, &r0, &r1);
+-#define cpu_signal_handler cpu_hppa_signal_handler
-@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
+-
-                            op_name, str_r(r0), str_r(r1), str_r(r2), pos, len);
+-int cpu_hppa_signal_handler(int host_signum, void *pinfo, void *puc);
-         break;
+ hwaddr hppa_cpu_get_phys_page_debug(CPUState *cs, vaddr addr);
+ int hppa_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
--#if TCG_TARGET_REG_BITS == 32
+ int hppa_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
-+    case INDEX_op_movcond_i32:
+diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-+    case INDEX_op_movcond_i64:
+index XXXXXXX..XXXXXXX 100644
-     case INDEX_op_setcond2_i32:
+--- a/target/i386/cpu.h
-         tci_args_rrrrrc(insn, &r0, &r1, &r2, &r3, &r4, &c);
++++ b/target/i386/cpu.h
-         info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s, %s, %s",
+@@ -XXX,XX +XXX,XX @@ void cpu_x86_frstor(CPUX86State *s, target_ulong ptr, int data32);
-@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
+ void cpu_x86_fxsave(CPUX86State *s, target_ulong ptr);
-                            str_r(r3), str_r(r4), str_c(c));
+ void cpu_x86_fxrstor(CPUX86State *s, target_ulong ptr);
-         break;
+-/* you can call this signal handler from your SIGBUS and SIGSEGV
-+#if TCG_TARGET_REG_BITS == 32
+-   signal handlers to inform the virtual CPU of exceptions. non zero
-     case INDEX_op_mulu2_i32:
+-   is returned if the signal was handled by the virtual CPU.  */
-         tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
+-int cpu_x86_signal_handler(int host_signum, void *pinfo,
-         info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s",
+-                           void *puc);
-diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
+-
-index XXXXXXX..XXXXXXX 100644
+ /* cpu.c */
---- a/tcg/tci/tcg-target.c.inc
+ void x86_cpu_vendor_words2str(char *dst, uint32_t vendor1,
-+++ b/tcg/tci/tcg-target.c.inc
+                               uint32_t vendor2, uint32_t vendor3);
-@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
+@@ -XXX,XX +XXX,XX @@ uint64_t cpu_get_tsc(CPUX86State *env);
-         return C_O0_I4(r, r, r, r);
+ #define TARGET_DEFAULT_CPU_TYPE X86_CPU_TYPE_NAME("qemu32")
-     case INDEX_op_mulu2_i32:
+ #endif
-         return C_O2_I2(r, r, r, r);
-+#endif
+-#define cpu_signal_handler cpu_x86_signal_handler
-+
+ #define cpu_list x86_cpu_list
-+    case INDEX_op_movcond_i32:
-+    case INDEX_op_movcond_i64:
+ /* MMU modes definitions */
-     case INDEX_op_setcond2_i32:
+diff --git a/target/m68k/cpu.h b/target/m68k/cpu.h
-         return C_O1_I4(r, r, r, r, r);
+index XXXXXXX..XXXXXXX 100644
--#endif
+--- a/target/m68k/cpu.h
++++ b/target/m68k/cpu.h
-     case INDEX_op_qemu_ld_i32:
+@@ -XXX,XX +XXX,XX @@ int m68k_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
-         return (TARGET_LONG_BITS <= TCG_TARGET_REG_BITS
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op_rrrr(TCGContext *s, TCGOpcode op,
+ void m68k_tcg_init(void);
-     insn = deposit32(insn, 20, 4, r3);
+ void m68k_cpu_init_gdb(M68kCPU *cpu);
-     tcg_out32(s, insn);
+-/*
 - * you can call this signal handler from your SIGBUS and SIGSEGV
 - * signal handlers to inform the virtual CPU of exceptions. non zero
 - * is returned if the signal was handled by the virtual CPU.
 - */
 -int cpu_m68k_signal_handler(int host_signum, void *pinfo,
 -                           void *puc);
  uint32_t cpu_m68k_get_ccr(CPUM68KState *env);
  void cpu_m68k_set_ccr(CPUM68KState *env, uint32_t);
  void cpu_m68k_set_sr(CPUM68KState *env, uint32_t);
@@ -XXX,XX +XXX,XX @@ enum {
  #define M68K_CPU_TYPE_NAME(model) model M68K_CPU_TYPE_SUFFIX
  #define CPU_RESOLVING_TYPE TYPE_M68K_CPU
 -#define cpu_signal_handler cpu_m68k_signal_handler
  #define cpu_list m68k_cpu_list
  /* MMU modes definitions */
 diff --git a/target/microblaze/cpu.h b/target/microblaze/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/microblaze/cpu.h
 +++ b/target/microblaze/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline void mb_cpu_write_msr(CPUMBState *env, uint32_t val)
  }
-+#endif
+ void mb_tcg_init(void);
- static void tcg_out_op_rrrrrc(TCGContext *s, TCGOpcode op,
+-/* you can call this signal handler from your SIGBUS and SIGSEGV
-                               TCGReg r0, TCGReg r1, TCGReg r2,
+-   signal handlers to inform the virtual CPU of exceptions. non zero
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op_rrrrrc(TCGContext *s, TCGOpcode op,
+-   is returned if the signal was handled by the virtual CPU.  */
-     tcg_out32(s, insn);
+-int cpu_mb_signal_handler(int host_signum, void *pinfo,
- }
+-                          void *puc);
-+#if TCG_TARGET_REG_BITS == 32
+ #define CPU_RESOLVING_TYPE TYPE_MICROBLAZE_CPU
- static void tcg_out_op_rrrrrr(TCGContext *s, TCGOpcode op,
-                               TCGReg r0, TCGReg r1, TCGReg r2,
+-#define cpu_signal_handler cpu_mb_signal_handler
-                               TCGReg r3, TCGReg r4, TCGReg r5)
+-
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+ /* MMU modes definitions */
-         tcg_out_op_rrrc(s, opc, args[0], args[1], args[2], args[3]);
+ #define MMU_NOMMU_IDX   0
-         break;
+ #define MMU_KERNEL_IDX  1
+diff --git a/target/mips/cpu.h b/target/mips/cpu.h
--#if TCG_TARGET_REG_BITS == 32
+index XXXXXXX..XXXXXXX 100644
-+    CASE_32_64(movcond)
+--- a/target/mips/cpu.h
-     case INDEX_op_setcond2_i32:
++++ b/target/mips/cpu.h
-         tcg_out_op_rrrrrc(s, opc, args[0], args[1], args[2],
+@@ -XXX,XX +XXX,XX @@ struct MIPSCPU {
-                           args[3], args[4], args[5]);
-         break;
+ void mips_cpu_list(void);
--#endif
+-#define cpu_signal_handler cpu_mips_signal_handler
-     CASE_32_64(ld8u)
+ #define cpu_list mips_cpu_list
-     CASE_32_64(ld8s)
  extern void cpu_wrdsp(uint32_t rs, uint32_t mask_num, CPUMIPSState *env);
@@ -XXX,XX +XXX,XX @@ enum {
   */
  #define CPU_INTERRUPT_WAKE CPU_INTERRUPT_TGT_INT_0
 -int cpu_mips_signal_handler(int host_signum, void *pinfo, void *puc);
 -
  #define MIPS_CPU_TYPE_SUFFIX "-" TYPE_MIPS_CPU
  #define MIPS_CPU_TYPE_NAME(model) model MIPS_CPU_TYPE_SUFFIX
  #define CPU_RESOLVING_TYPE TYPE_MIPS_CPU
 diff --git a/target/mips/internal.h b/target/mips/internal.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/internal.h
 +++ b/target/mips/internal.h
@@ -XXX,XX +XXX,XX @@ extern const VMStateDescription vmstate_mips_cpu;
  #endif /* !CONFIG_USER_ONLY */
 -#define cpu_signal_handler cpu_mips_signal_handler
 -
  static inline bool cpu_mips_hw_interrupts_enabled(CPUMIPSState *env)
  {
      return (env->CP0_Status & (1 << CP0St_IE)) &&
 diff --git a/target/nios2/cpu.h b/target/nios2/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/nios2/cpu.h
 +++ b/target/nios2/cpu.h
@@ -XXX,XX +XXX,XX @@ struct Nios2CPU {
  void nios2_tcg_init(void);
  void nios2_cpu_do_interrupt(CPUState *cs);
 -int cpu_nios2_signal_handler(int host_signum, void *pinfo, void *puc);
  void dump_mmu(CPUNios2State *env);
  void nios2_cpu_dump_state(CPUState *cpu, FILE *f, int flags);
  hwaddr nios2_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
@@ -XXX,XX +XXX,XX @@ void do_nios2_semihosting(CPUNios2State *env);
  #define CPU_RESOLVING_TYPE TYPE_NIOS2_CPU
  #define cpu_gen_code cpu_nios2_gen_code
 -#define cpu_signal_handler cpu_nios2_signal_handler
  #define CPU_SAVE_VERSION 1
 diff --git a/target/openrisc/cpu.h b/target/openrisc/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/openrisc/cpu.h
 +++ b/target/openrisc/cpu.h
@@ -XXX,XX +XXX,XX @@ void openrisc_translate_init(void);
  bool openrisc_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                             MMUAccessType access_type, int mmu_idx,
                             bool probe, uintptr_t retaddr);
 -int cpu_openrisc_signal_handler(int host_signum, void *pinfo, void *puc);
  int print_insn_or1k(bfd_vma addr, disassemble_info *info);
  #define cpu_list cpu_openrisc_list
 -#define cpu_signal_handler cpu_openrisc_signal_handler
  #ifndef CONFIG_USER_ONLY
  extern const VMStateDescription vmstate_openrisc_cpu;
 diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/ppc/cpu.h
 +++ b/target/ppc/cpu.h
@@ -XXX,XX +XXX,XX @@ extern const VMStateDescription vmstate_ppc_cpu;
  /*****************************************************************************/
  void ppc_translate_init(void);
 -/*
 - * you can call this signal handler from your SIGBUS and SIGSEGV
 - * signal handlers to inform the virtual CPU of exceptions. non zero
 - * is returned if the signal was handled by the virtual CPU.
 - */
 -int cpu_ppc_signal_handler(int host_signum, void *pinfo, void *puc);
  bool ppc_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                        MMUAccessType access_type, int mmu_idx,
                        bool probe, uintptr_t retaddr);
@@ -XXX,XX +XXX,XX @@ int ppc_dcr_write(ppc_dcr_t *dcr_env, int dcrn, uint32_t val);
  #define POWERPC_CPU_TYPE_NAME(model) model POWERPC_CPU_TYPE_SUFFIX
  #define CPU_RESOLVING_TYPE TYPE_POWERPC_CPU
 -#define cpu_signal_handler cpu_ppc_signal_handler
  #define cpu_list ppc_cpu_list
  /* MMU modes definitions */
 diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.h
 +++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
  char *riscv_isa_string(RISCVCPU *cpu);
  void riscv_cpu_list(void);
 -#define cpu_signal_handler riscv_cpu_signal_handler
  #define cpu_list riscv_cpu_list
  #define cpu_mmu_index riscv_cpu_mmu_index
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_rdtime_fn(CPURISCVState *env, uint64_t (*fn)(uint32_t),
  void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv);
  void riscv_translate_init(void);
 -int riscv_cpu_signal_handler(int host_signum, void *pinfo, void *puc);
  void QEMU_NORETURN riscv_raise_exception(CPURISCVState *env,
                                           uint32_t exception, uintptr_t pc);
 diff --git a/target/rx/cpu.h b/target/rx/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/rx/cpu.h
 +++ b/target/rx/cpu.h
@@ -XXX,XX +XXX,XX @@ int rx_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
  hwaddr rx_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
  void rx_translate_init(void);
 -int cpu_rx_signal_handler(int host_signum, void *pinfo,
 -                           void *puc);
 -
  void rx_cpu_list(void);
  void rx_cpu_unpack_psw(CPURXState *env, uint32_t psw, int rte);
 -#define cpu_signal_handler cpu_rx_signal_handler
  #define cpu_list rx_cpu_list
  #include "exec/cpu-all.h"
 diff --git a/target/s390x/cpu.h b/target/s390x/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/cpu.h
 +++ b/target/s390x/cpu.h
@@ -XXX,XX +XXX,XX @@ void s390_set_qemu_cpu_model(uint16_t type, uint8_t gen, uint8_t ec_ga,
  #define S390_CPU_TYPE_NAME(name) (name S390_CPU_TYPE_SUFFIX)
  #define CPU_RESOLVING_TYPE TYPE_S390_CPU
 -/* you can call this signal handler from your SIGBUS and SIGSEGV
 -   signal handlers to inform the virtual CPU of exceptions. non zero
 -   is returned if the signal was handled by the virtual CPU.  */
 -int cpu_s390x_signal_handler(int host_signum, void *pinfo, void *puc);
 -#define cpu_signal_handler cpu_s390x_signal_handler
 -
 -
  /* interrupt.c */
  #define RA_IGNORED                  0
  void s390_program_interrupt(CPUS390XState *env, uint32_t code, uintptr_t ra);
 diff --git a/target/sh4/cpu.h b/target/sh4/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sh4/cpu.h
 +++ b/target/sh4/cpu.h
@@ -XXX,XX +XXX,XX @@ void superh_cpu_do_unaligned_access(CPUState *cpu, vaddr addr,
                                      int mmu_idx, uintptr_t retaddr);
  void sh4_translate_init(void);
 -int cpu_sh4_signal_handler(int host_signum, void *pinfo,
 -                           void *puc);
  bool superh_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                           MMUAccessType access_type, int mmu_idx,
                           bool probe, uintptr_t retaddr);
@@ -XXX,XX +XXX,XX @@ void cpu_load_tlb(CPUSH4State * env);
  #define SUPERH_CPU_TYPE_NAME(model) model SUPERH_CPU_TYPE_SUFFIX
  #define CPU_RESOLVING_TYPE TYPE_SUPERH_CPU
 -#define cpu_signal_handler cpu_sh4_signal_handler
  #define cpu_list sh4_cpu_list
  /* MMU modes definitions */
 diff --git a/target/sparc/cpu.h b/target/sparc/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sparc/cpu.h
 +++ b/target/sparc/cpu.h
@@ -XXX,XX +XXX,XX @@ hwaddr cpu_get_phys_page_nofault(CPUSPARCState *env, target_ulong addr,
                                             int mmu_idx);
  #endif
  #endif
 -int cpu_sparc_signal_handler(int host_signum, void *pinfo, void *puc);
  #define SPARC_CPU_TYPE_SUFFIX "-" TYPE_SPARC_CPU
  #define SPARC_CPU_TYPE_NAME(model) model SPARC_CPU_TYPE_SUFFIX
  #define CPU_RESOLVING_TYPE TYPE_SPARC_CPU
 -#define cpu_signal_handler cpu_sparc_signal_handler
  #define cpu_list sparc_cpu_list
  /* MMU modes definitions */
 diff --git a/target/tricore/cpu.h b/target/tricore/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tricore/cpu.h
 +++ b/target/tricore/cpu.h
@@ -XXX,XX +XXX,XX @@ void fpu_set_state(CPUTriCoreState *env);
  void tricore_cpu_list(void);
 -#define cpu_signal_handler cpu_tricore_signal_handler
  #define cpu_list tricore_cpu_list
  static inline int cpu_mmu_index(CPUTriCoreState *env, bool ifetch)
@@ -XXX,XX +XXX,XX @@ typedef TriCoreCPU ArchCPU;
  void cpu_state_reset(CPUTriCoreState *s);
  void tricore_tcg_init(void);
 -int cpu_tricore_signal_handler(int host_signum, void *pinfo, void *puc);
  static inline void cpu_get_tb_cpu_state(CPUTriCoreState *env, target_ulong *pc,
                                          target_ulong *cs_base, uint32_t *flags)
 diff --git a/target/xtensa/cpu.h b/target/xtensa/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/xtensa/cpu.h
 +++ b/target/xtensa/cpu.h
@@ -XXX,XX +XXX,XX @@ void xtensa_cpu_do_unaligned_access(CPUState *cpu, vaddr addr,
                                      MMUAccessType access_type,
                                      int mmu_idx, uintptr_t retaddr);
 -#define cpu_signal_handler cpu_xtensa_signal_handler
  #define cpu_list xtensa_cpu_list
  #define XTENSA_CPU_TYPE_SUFFIX "-" TYPE_XTENSA_CPU
@@ -XXX,XX +XXX,XX @@ void check_interrupts(CPUXtensaState *s);
  void xtensa_irq_init(CPUXtensaState *env);
  qemu_irq *xtensa_get_extints(CPUXtensaState *env);
  qemu_irq xtensa_get_runstall(CPUXtensaState *env);
 -int cpu_xtensa_signal_handler(int host_signum, void *pinfo, void *puc);
  void xtensa_cpu_list(void);
  void xtensa_sync_window_from_phys(CPUXtensaState *env);
  void xtensa_sync_phys_from_window(CPUXtensaState *env);
 --
 .25.1

-New patch
+[PULL 02/35] accel/tcg: Restrict cpu_handle_halt() to sysemu
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Commit 372579427a5 ("tcg: enable thread-per-vCPU") added the following
+comment describing EXCP_HALTED in qemu_tcg_cpu_thread_fn():
+    case EXCP_HALTED:
+         /* during start-up the vCPU is reset and the thread is
+          * kicked several times. If we don't ensure we go back
+          * to sleep in the halted state we won't cleanly
+          * start-up when the vCPU is enabled.
+          *
+          * cpu->halted should ensure we sleep in wait_io_event
+          */
+         g_assert(cpu->halted);
+         break;
+qemu_wait_io_event() is sysemu-specific, so we can restrict the
+cpu_handle_halt() call in cpu_exec() to system emulation.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20210912172731.789788-2-f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ accel/tcg/cpu-exec.c | 6 ++++--
+file changed, 4 insertions(+), 2 deletions(-)
+diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/cpu-exec.c
++++ b/accel/tcg/cpu-exec.c
+@@ -XXX,XX +XXX,XX @@ static inline void tb_add_jump(TranslationBlock *tb, int n,
+ static inline bool cpu_handle_halt(CPUState *cpu)
+ {
++#ifndef CONFIG_USER_ONLY
+     if (cpu->halted) {
+-#if defined(TARGET_I386) && !defined(CONFIG_USER_ONLY)
++#if defined(TARGET_I386)
+         if (cpu->interrupt_request & CPU_INTERRUPT_POLL) {
+             X86CPU *x86_cpu = X86_CPU(cpu);
+             qemu_mutex_lock_iothread();
+@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_halt(CPUState *cpu)
+             cpu_reset_interrupt(cpu, CPU_INTERRUPT_POLL);
+             qemu_mutex_unlock_iothread();
+         }
+-#endif
++#endif /* TARGET_I386 */
+         if (!cpu_has_work(cpu)) {
+             return true;
+         }
+         cpu->halted = 0;
+     }
++#endif /* !CONFIG_USER_ONLY */
+     return false;
+ }
+--
+.25.1

-[PULL 32/33] tcg: expose TCGCond manipulation routines
+[PULL 03/35] hw/core: Restrict cpu_has_work() to sysemu
-From: Alessandro Di Federico <ale@rev.ng>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-This commit moves into a separate file routines used to manipulate
+cpu_has_work() is only called from system emulation code.
 TCGCond. These will be employed by the idef-parser.
-Signed-off-by: Alessandro Di Federico <ale@rev.ng>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Paolo Montesel <babush@rev.ng>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <20210619093713.1845446-2-ale.qemu@rev.ng>
+Message-Id: <20210912172731.789788-3-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/tcg/tcg-cond.h | 101 +++++++++++++++++++++++++++++++++++++++++
+ include/hw/core/cpu.h | 32 ++++++++++++++++----------------
- include/tcg/tcg.h      |  70 +---------------------------
+file changed, 16 insertions(+), 16 deletions(-)
 files changed, 102 insertions(+), 69 deletions(-)
  create mode 100644 include/tcg/tcg-cond.h
-diff --git a/include/tcg/tcg-cond.h b/include/tcg/tcg-cond.h
+diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
-new file mode 100644
+index XXXXXXX..XXXXXXX 100644
-index XXXXXXX..XXXXXXX
+--- a/include/hw/core/cpu.h
---- /dev/null
++++ b/include/hw/core/cpu.h
-+++ b/include/tcg/tcg-cond.h
+@@ -XXX,XX +XXX,XX @@ enum CPUDumpFlags {
-@@ -XXX,XX +XXX,XX @@
+ void cpu_dump_state(CPUState *cpu, FILE *f, int flags);
-+/*
-+ * Tiny Code Generator for QEMU
+ #ifndef CONFIG_USER_ONLY
 +/**
 + * cpu_has_work:
 + * @cpu: The vCPU to check.
 + *
-+ * Copyright (c) 2008 Fabrice Bellard
++ * Checks whether the CPU has work to do.
 + *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
++ * Returns: %true if the CPU has work, %false otherwise.
 + * of this software and associated documentation files (the "Software"), to deal
 + * in the Software without restriction, including without limitation the rights
 + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 + * copies of the Software, and to permit persons to whom the Software is
 + * furnished to do so, subject to the following conditions:
 + *
 + * The above copyright notice and this permission notice shall be included in
 + * all copies or substantial portions of the Software.
 + *
 + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 + * THE SOFTWARE.
 + */
++static inline bool cpu_has_work(CPUState *cpu)
++{
++    CPUClass *cc = CPU_GET_CLASS(cpu);
 +
-+#ifndef TCG_COND_H
++    g_assert(cc->has_work);
-+#define TCG_COND_H
++    return cc->has_work(cpu);
 +
 +/*
 + * Conditions.  Note that these are laid out for easy manipulation by
 + * the functions below:
 + *    bit 0 is used for inverting;
 + *    bit 1 is signed,
 + *    bit 2 is unsigned,
 + *    bit 3 is used with bit 0 for swapping signed/unsigned.
 + */
 +typedef enum {
 +    /* non-signed */
 +    TCG_COND_NEVER  = 0 | 0 | 0 | 0,
 +    TCG_COND_ALWAYS = 0 | 0 | 0 | 1,
 +    TCG_COND_EQ     = 8 | 0 | 0 | 0,
 +    TCG_COND_NE     = 8 | 0 | 0 | 1,
 +    /* signed */
 +    TCG_COND_LT     = 0 | 0 | 2 | 0,
 +    TCG_COND_GE     = 0 | 0 | 2 | 1,
 +    TCG_COND_LE     = 8 | 0 | 2 | 0,
 +    TCG_COND_GT     = 8 | 0 | 2 | 1,
 +    /* unsigned */
 +    TCG_COND_LTU    = 0 | 4 | 0 | 0,
 +    TCG_COND_GEU    = 0 | 4 | 0 | 1,
 +    TCG_COND_LEU    = 8 | 4 | 0 | 0,
 +    TCG_COND_GTU    = 8 | 4 | 0 | 1,
 +} TCGCond;
 +
 +/* Invert the sense of the comparison.  */
 +static inline TCGCond tcg_invert_cond(TCGCond c)
 +{
 +    return (TCGCond)(c ^ 1);
 +}
 +
-+/* Swap the operands in a comparison.  */
+ /**
-+static inline TCGCond tcg_swap_cond(TCGCond c)
+  * cpu_get_phys_page_attrs_debug:
-+{
+  * @cpu: The CPU to obtain the physical page address for.
-+    return c & 6 ? (TCGCond)(c ^ 9) : c;
+@@ -XXX,XX +XXX,XX @@ CPUState *cpu_create(const char *typename);
-+}
+  */
-+
+ const char *parse_cpu_option(const char *cpu_option);
-+/* Create an "unsigned" version of a "signed" comparison.  */
-+static inline TCGCond tcg_unsigned_cond(TCGCond c)
+-/**
-+{
+- * cpu_has_work:
-+    return c & 2 ? (TCGCond)(c ^ 6) : c;
+- * @cpu: The vCPU to check.
-+}
+- *
-+
+- * Checks whether the CPU has work to do.
-+/* Create a "signed" version of an "unsigned" comparison.  */
+- *
-+static inline TCGCond tcg_signed_cond(TCGCond c)
+- * Returns: %true if the CPU has work, %false otherwise.
-+{
+- */
-+    return c & 4 ? (TCGCond)(c ^ 6) : c;
+-static inline bool cpu_has_work(CPUState *cpu)
-+}
+-{
-+
+-    CPUClass *cc = CPU_GET_CLASS(cpu);
 +/* Must a comparison be considered unsigned?  */
 +static inline bool is_unsigned_cond(TCGCond c)
 +{
 +    return (c & 4) != 0;
 +}
 +
 +/*
 + * Create a "high" version of a double-word comparison.
 + * This removes equality from a LTE or GTE comparison.
 + */
 +static inline TCGCond tcg_high_cond(TCGCond c)
 +{
 +    switch (c) {
 +    case TCG_COND_GE:
 +    case TCG_COND_LE:
 +    case TCG_COND_GEU:
 +    case TCG_COND_LEU:
 +        return (TCGCond)(c ^ 8);
 +    default:
 +        return c;
 +    }
 +}
 +
 +#endif /* TCG_COND_H */
 diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/tcg/tcg.h
 +++ b/include/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@
  #include "tcg/tcg-mo.h"
  #include "tcg-target.h"
  #include "qemu/int128.h"
 +#include "tcg/tcg-cond.h"
  /* XXX: make safe guess about sizes */
  #define MAX_OP_PER_INSTR 266
@@ -XXX,XX +XXX,XX @@ typedef TCGv_ptr TCGv_env;
  /* Used to align parameters.  See the comment before tcgv_i32_temp.  */
  #define TCG_CALL_DUMMY_ARG      ((TCGArg)0)
 -/* Conditions.  Note that these are laid out for easy manipulation by
 -   the functions below:
 -     bit 0 is used for inverting;
 -     bit 1 is signed,
 -     bit 2 is unsigned,
 -     bit 3 is used with bit 0 for swapping signed/unsigned.  */
 -typedef enum {
 -    /* non-signed */
 -    TCG_COND_NEVER  = 0 | 0 | 0 | 0,
 -    TCG_COND_ALWAYS = 0 | 0 | 0 | 1,
 -    TCG_COND_EQ     = 8 | 0 | 0 | 0,
 -    TCG_COND_NE     = 8 | 0 | 0 | 1,
 -    /* signed */
 -    TCG_COND_LT     = 0 | 0 | 2 | 0,
 -    TCG_COND_GE     = 0 | 0 | 2 | 1,
 -    TCG_COND_LE     = 8 | 0 | 2 | 0,
 -    TCG_COND_GT     = 8 | 0 | 2 | 1,
 -    /* unsigned */
 -    TCG_COND_LTU    = 0 | 4 | 0 | 0,
 -    TCG_COND_GEU    = 0 | 4 | 0 | 1,
 -    TCG_COND_LEU    = 8 | 4 | 0 | 0,
 -    TCG_COND_GTU    = 8 | 4 | 0 | 1,
 -} TCGCond;
 -
--/* Invert the sense of the comparison.  */
+-    g_assert(cc->has_work);
--static inline TCGCond tcg_invert_cond(TCGCond c)
+-    return cc->has_work(cpu);
 -{
 -    return (TCGCond)(c ^ 1);
 -}
 -
--/* Swap the operands in a comparison.  */
+ /**
--static inline TCGCond tcg_swap_cond(TCGCond c)
+  * qemu_cpu_is_self:
--{
+  * @cpu: The vCPU to check against.
 -    return c & 6 ? (TCGCond)(c ^ 9) : c;
 -}
 -
 -/* Create an "unsigned" version of a "signed" comparison.  */
 -static inline TCGCond tcg_unsigned_cond(TCGCond c)
 -{
 -    return c & 2 ? (TCGCond)(c ^ 6) : c;
 -}
 -
 -/* Create a "signed" version of an "unsigned" comparison.  */
 -static inline TCGCond tcg_signed_cond(TCGCond c)
 -{
 -    return c & 4 ? (TCGCond)(c ^ 6) : c;
 -}
 -
 -/* Must a comparison be considered unsigned?  */
 -static inline bool is_unsigned_cond(TCGCond c)
 -{
 -    return (c & 4) != 0;
 -}
 -
 -/* Create a "high" version of a double-word comparison.
 -   This removes equality from a LTE or GTE comparison.  */
 -static inline TCGCond tcg_high_cond(TCGCond c)
 -{
 -    switch (c) {
 -    case TCG_COND_GE:
 -    case TCG_COND_LE:
 -    case TCG_COND_GEU:
 -    case TCG_COND_LEU:
 -        return (TCGCond)(c ^ 8);
 -    default:
 -        return c;
 -    }
 -}
 -
  typedef enum TCGTempVal {
      TEMP_VAL_DEAD,
      TEMP_VAL_REG,
 --
 .25.1

-[PULL 23/33] tcg/tci: Split out tci_qemu_ld, tci_qemu_st
+[PULL 04/35] hw/core: Un-inline cpu_has_work()
-We can share this code between 32-bit and 64-bit loads and stores.
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+We want to make cpu_has_work() per-accelerator. Only declare its
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+prototype and move its definition to softmmu/cpus.c.
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210912172731.789788-4-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c | 183 +++++++++++++++++++++---------------------------------
+ include/hw/core/cpu.h | 8 +-------
-file changed, 71 insertions(+), 112 deletions(-)
+ softmmu/cpus.c        | 8 ++++++++
 files changed, 9 insertions(+), 7 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
+diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/include/hw/core/cpu.h
-+++ b/tcg/tci.c
++++ b/include/hw/core/cpu.h
-@@ -XXX,XX +XXX,XX @@ static bool tci_compare64(uint64_t u0, uint64_t u1, TCGCond condition)
+@@ -XXX,XX +XXX,XX @@ void cpu_dump_state(CPUState *cpu, FILE *f, int flags);
- #define qemu_st_beq(X) \
+  *
-     cpu_stq_be_mmuidx_ra(env, taddr, X, get_mmuidx(oi), (uintptr_t)tb_ptr)
+  * Returns: %true if the CPU has work, %false otherwise.
+  */
-+static uint64_t tci_qemu_ld(CPUArchState *env, target_ulong taddr,
+-static inline bool cpu_has_work(CPUState *cpu)
-+                            TCGMemOpIdx oi, const void *tb_ptr)
+-{
 -    CPUClass *cc = CPU_GET_CLASS(cpu);
 -
 -    g_assert(cc->has_work);
 -    return cc->has_work(cpu);
 -}
 +bool cpu_has_work(CPUState *cpu);
  /**
   * cpu_get_phys_page_attrs_debug:
 diff --git a/softmmu/cpus.c b/softmmu/cpus.c
 index XXXXXXX..XXXXXXX 100644
 --- a/softmmu/cpus.c
 +++ b/softmmu/cpus.c
@@ -XXX,XX +XXX,XX @@ void cpu_interrupt(CPUState *cpu, int mask)
      }
  }
 +bool cpu_has_work(CPUState *cpu)
 +{
-+    MemOp mop = get_memop(oi) & (MO_BSWAP | MO_SSIZE);
++    CPUClass *cc = CPU_GET_CLASS(cpu);
 +
-+    switch (mop) {
++    g_assert(cc->has_work);
-+    case MO_UB:
++    return cc->has_work(cpu);
 +        return qemu_ld_ub;
 +    case MO_SB:
 +        return (int8_t)qemu_ld_ub;
 +    case MO_LEUW:
 +        return qemu_ld_leuw;
 +    case MO_LESW:
 +        return (int16_t)qemu_ld_leuw;
 +    case MO_LEUL:
 +        return qemu_ld_leul;
 +    case MO_LESL:
 +        return (int32_t)qemu_ld_leul;
 +    case MO_LEQ:
 +        return qemu_ld_leq;
 +    case MO_BEUW:
 +        return qemu_ld_beuw;
 +    case MO_BESW:
 +        return (int16_t)qemu_ld_beuw;
 +    case MO_BEUL:
 +        return qemu_ld_beul;
 +    case MO_BESL:
 +        return (int32_t)qemu_ld_beul;
 +    case MO_BEQ:
 +        return qemu_ld_beq;
 +    default:
 +        g_assert_not_reached();
 +    }
 +}
 +
-+static void tci_qemu_st(CPUArchState *env, target_ulong taddr, uint64_t val,
+ static int do_vm_stop(RunState state, bool send_stop)
-+                        TCGMemOpIdx oi, const void *tb_ptr)
+ {
-+{
+     int ret = 0;
 +    MemOp mop = get_memop(oi) & (MO_BSWAP | MO_SSIZE);
 +
 +    switch (mop) {
 +    case MO_UB:
 +        qemu_st_b(val);
 +        break;
 +    case MO_LEUW:
 +        qemu_st_lew(val);
 +        break;
 +    case MO_LEUL:
 +        qemu_st_lel(val);
 +        break;
 +    case MO_LEQ:
 +        qemu_st_leq(val);
 +        break;
 +    case MO_BEUW:
 +        qemu_st_bew(val);
 +        break;
 +    case MO_BEUL:
 +        qemu_st_bel(val);
 +        break;
 +    case MO_BEQ:
 +        qemu_st_beq(val);
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +}
 +
  #if TCG_TARGET_REG_BITS == 64
  # define CASE_32_64(x) \
          case glue(glue(INDEX_op_, x), _i64): \
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                  tci_args_rrrm(insn, &r0, &r1, &r2, &oi);
                  taddr = tci_uint64(regs[r2], regs[r1]);
              }
 -            switch (get_memop(oi) & (MO_BSWAP | MO_SSIZE)) {
 -            case MO_UB:
 -                tmp32 = qemu_ld_ub;
 -                break;
 -            case MO_SB:
 -                tmp32 = (int8_t)qemu_ld_ub;
 -                break;
 -            case MO_LEUW:
 -                tmp32 = qemu_ld_leuw;
 -                break;
 -            case MO_LESW:
 -                tmp32 = (int16_t)qemu_ld_leuw;
 -                break;
 -            case MO_LEUL:
 -                tmp32 = qemu_ld_leul;
 -                break;
 -            case MO_BEUW:
 -                tmp32 = qemu_ld_beuw;
 -                break;
 -            case MO_BESW:
 -                tmp32 = (int16_t)qemu_ld_beuw;
 -                break;
 -            case MO_BEUL:
 -                tmp32 = qemu_ld_beul;
 -                break;
 -            default:
 -                g_assert_not_reached();
 -            }
 +            tmp32 = tci_qemu_ld(env, taddr, oi, tb_ptr);
              regs[r0] = tmp32;
              break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                  taddr = tci_uint64(regs[r3], regs[r2]);
                  oi = regs[r4];
              }
 -            switch (get_memop(oi) & (MO_BSWAP | MO_SSIZE)) {
 -            case MO_UB:
 -                tmp64 = qemu_ld_ub;
 -                break;
 -            case MO_SB:
 -                tmp64 = (int8_t)qemu_ld_ub;
 -                break;
 -            case MO_LEUW:
 -                tmp64 = qemu_ld_leuw;
 -                break;
 -            case MO_LESW:
 -                tmp64 = (int16_t)qemu_ld_leuw;
 -                break;
 -            case MO_LEUL:
 -                tmp64 = qemu_ld_leul;
 -                break;
 -            case MO_LESL:
 -                tmp64 = (int32_t)qemu_ld_leul;
 -                break;
 -            case MO_LEQ:
 -                tmp64 = qemu_ld_leq;
 -                break;
 -            case MO_BEUW:
 -                tmp64 = qemu_ld_beuw;
 -                break;
 -            case MO_BESW:
 -                tmp64 = (int16_t)qemu_ld_beuw;
 -                break;
 -            case MO_BEUL:
 -                tmp64 = qemu_ld_beul;
 -                break;
 -            case MO_BESL:
 -                tmp64 = (int32_t)qemu_ld_beul;
 -                break;
 -            case MO_BEQ:
 -                tmp64 = qemu_ld_beq;
 -                break;
 -            default:
 -                g_assert_not_reached();
 -            }
 +            tmp64 = tci_qemu_ld(env, taddr, oi, tb_ptr);
              if (TCG_TARGET_REG_BITS == 32) {
                  tci_write_reg64(regs, r1, r0, tmp64);
              } else {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                  taddr = tci_uint64(regs[r2], regs[r1]);
              }
              tmp32 = regs[r0];
 -            switch (get_memop(oi) & (MO_BSWAP | MO_SIZE)) {
 -            case MO_UB:
 -                qemu_st_b(tmp32);
 -                break;
 -            case MO_LEUW:
 -                qemu_st_lew(tmp32);
 -                break;
 -            case MO_LEUL:
 -                qemu_st_lel(tmp32);
 -                break;
 -            case MO_BEUW:
 -                qemu_st_bew(tmp32);
 -                break;
 -            case MO_BEUL:
 -                qemu_st_bel(tmp32);
 -                break;
 -            default:
 -                g_assert_not_reached();
 -            }
 +            tci_qemu_st(env, taddr, tmp32, oi, tb_ptr);
              break;
          case INDEX_op_qemu_st_i64:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                  }
                  tmp64 = tci_uint64(regs[r1], regs[r0]);
              }
 -            switch (get_memop(oi) & (MO_BSWAP | MO_SIZE)) {
 -            case MO_UB:
 -                qemu_st_b(tmp64);
 -                break;
 -            case MO_LEUW:
 -                qemu_st_lew(tmp64);
 -                break;
 -            case MO_LEUL:
 -                qemu_st_lel(tmp64);
 -                break;
 -            case MO_LEQ:
 -                qemu_st_leq(tmp64);
 -                break;
 -            case MO_BEUW:
 -                qemu_st_bew(tmp64);
 -                break;
 -            case MO_BEUL:
 -                qemu_st_bel(tmp64);
 -                break;
 -            case MO_BEQ:
 -                qemu_st_beq(tmp64);
 -                break;
 -            default:
 -                g_assert_not_reached();
 -            }
 +            tci_qemu_st(env, taddr, tmp64, oi, tb_ptr);
              break;
          case INDEX_op_mb:
 --
 .25.1

-New patch
+[PULL 05/35] sysemu: Introduce AccelOpsClass::has_work()
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Introduce an accelerator-specific has_work() handler.
+Eventually call it from cpu_has_work().
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20210912172731.789788-5-f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ include/sysemu/accel-ops.h | 5 +++++
+ softmmu/cpus.c             | 3 +++
+files changed, 8 insertions(+)
+diff --git a/include/sysemu/accel-ops.h b/include/sysemu/accel-ops.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/sysemu/accel-ops.h
++++ b/include/sysemu/accel-ops.h
+@@ -XXX,XX +XXX,XX @@ struct AccelOpsClass {
+     void (*create_vcpu_thread)(CPUState *cpu); /* MANDATORY NON-NULL */
+     void (*kick_vcpu_thread)(CPUState *cpu);
++    /**
++     * @has_work: Callback for checking if there is work to do.
++     */
++    bool (*has_work)(CPUState *cpu);
++
+     void (*synchronize_post_reset)(CPUState *cpu);
+     void (*synchronize_post_init)(CPUState *cpu);
+     void (*synchronize_state)(CPUState *cpu);
+diff --git a/softmmu/cpus.c b/softmmu/cpus.c
+index XXXXXXX..XXXXXXX 100644
+--- a/softmmu/cpus.c
++++ b/softmmu/cpus.c
+@@ -XXX,XX +XXX,XX @@ bool cpu_has_work(CPUState *cpu)
+ {
+     CPUClass *cc = CPU_GET_CLASS(cpu);
++    if (cpus_accel->has_work) {
++        return cpus_accel->has_work(cpu);
++    }
+     g_assert(cc->has_work);
+     return cc->has_work(cpu);
+ }
+--
+.25.1

-[PULL 13/33] tcg/tci: Emit setcond before brcond
+[PULL 06/35] accel/kvm: Implement AccelOpsClass::has_work()
-The encoding planned for tci does not have enough room for
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 brcond2, with 4 registers and a condition as input as well
 as the label.  Resolve the condition into TCG_REG_TMP, and
 relax brcond to one register plus a label, considering the
 condition to always be reg != 0.
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Implement KVM has_work() handler in AccelOpsClass and
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+remove it from cpu_thread_is_idle() since cpu_has_work()
 is already called.
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210912172731.789788-6-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c                | 68 ++++++++++------------------------------
+ accel/kvm/kvm-accel-ops.c | 6 ++++++
- tcg/tci/tcg-target.c.inc | 52 +++++++++++-------------------
+ softmmu/cpus.c            | 2 +-
-files changed, 35 insertions(+), 85 deletions(-)
+files changed, 7 insertions(+), 1 deletion(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
+diff --git a/accel/kvm/kvm-accel-ops.c b/accel/kvm/kvm-accel-ops.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/accel/kvm/kvm-accel-ops.c
-+++ b/tcg/tci.c
++++ b/accel/kvm/kvm-accel-ops.c
-@@ -XXX,XX +XXX,XX @@ static void tci_args_nll(const uint8_t **tb_ptr, uint8_t *n0,
+@@ -XXX,XX +XXX,XX @@ static void kvm_start_vcpu_thread(CPUState *cpu)
-     check_size(start, tb_ptr);
+                        cpu, QEMU_THREAD_JOINABLE);
  }
-+static void tci_args_rl(const uint8_t **tb_ptr, TCGReg *r0, void **l1)
++static bool kvm_cpu_has_work(CPUState *cpu)
 +{
-+    const uint8_t *start = *tb_ptr;
++    return kvm_halt_in_kernel();
 +
 +    *r0 = tci_read_r(tb_ptr);
 +    *l1 = (void *)tci_read_label(tb_ptr);
 +
 +    check_size(start, tb_ptr);
 +}
 +
- static void tci_args_rr(const uint8_t **tb_ptr,
+ static void kvm_accel_ops_class_init(ObjectClass *oc, void *data)
                          TCGReg *r0, TCGReg *r1)
  {
-@@ -XXX,XX +XXX,XX @@ static void tci_args_rrs(const uint8_t **tb_ptr,
+     AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
-     check_size(start, tb_ptr);
+@@ -XXX,XX +XXX,XX @@ static void kvm_accel_ops_class_init(ObjectClass *oc, void *data)
      ops->synchronize_post_init = kvm_cpu_synchronize_post_init;
      ops->synchronize_state = kvm_cpu_synchronize_state;
      ops->synchronize_pre_loadvm = kvm_cpu_synchronize_pre_loadvm;
 +    ops->has_work = kvm_cpu_has_work;
  }
--static void tci_args_rrcl(const uint8_t **tb_ptr,
+ static const TypeInfo kvm_accel_ops_type = {
--                          TCGReg *r0, TCGReg *r1, TCGCond *c2, void **l3)
+diff --git a/softmmu/cpus.c b/softmmu/cpus.c
 -{
 -    const uint8_t *start = *tb_ptr;
 -
 -    *r0 = tci_read_r(tb_ptr);
 -    *r1 = tci_read_r(tb_ptr);
 -    *c2 = tci_read_b(tb_ptr);
 -    *l3 = (void *)tci_read_label(tb_ptr);
 -
 -    check_size(start, tb_ptr);
 -}
 -
  static void tci_args_rrrc(const uint8_t **tb_ptr,
                            TCGReg *r0, TCGReg *r1, TCGReg *r2, TCGCond *c3)
  {
@@ -XXX,XX +XXX,XX @@ static void tci_args_rrrr(const uint8_t **tb_ptr,
      check_size(start, tb_ptr);
  }
 -static void tci_args_rrrrcl(const uint8_t **tb_ptr, TCGReg *r0, TCGReg *r1,
 -                            TCGReg *r2, TCGReg *r3, TCGCond *c4, void **l5)
 -{
 -    const uint8_t *start = *tb_ptr;
 -
 -    *r0 = tci_read_r(tb_ptr);
 -    *r1 = tci_read_r(tb_ptr);
 -    *r2 = tci_read_r(tb_ptr);
 -    *r3 = tci_read_r(tb_ptr);
 -    *c4 = tci_read_b(tb_ptr);
 -    *l5 = (void *)tci_read_label(tb_ptr);
 -
 -    check_size(start, tb_ptr);
 -}
 -
  static void tci_args_rrrrrc(const uint8_t **tb_ptr, TCGReg *r0, TCGReg *r1,
                              TCGReg *r2, TCGReg *r3, TCGReg *r4, TCGCond *c5)
  {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              break;
  #endif
          case INDEX_op_brcond_i32:
 -            tci_args_rrcl(&tb_ptr, &r0, &r1, &condition, &ptr);
 -            if (tci_compare32(regs[r0], regs[r1], condition)) {
 +            tci_args_rl(&tb_ptr, &r0, &ptr);
 +            if ((uint32_t)regs[r0]) {
                  tb_ptr = ptr;
              }
              break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              T2 = tci_uint64(regs[r5], regs[r4]);
              tci_write_reg64(regs, r1, r0, T1 - T2);
              break;
 -        case INDEX_op_brcond2_i32:
 -            tci_args_rrrrcl(&tb_ptr, &r0, &r1, &r2, &r3, &condition, &ptr);
 -            T1 = tci_uint64(regs[r1], regs[r0]);
 -            T2 = tci_uint64(regs[r3], regs[r2]);
 -            if (tci_compare64(T1, T2, condition)) {
 -                tb_ptr = ptr;
 -                continue;
 -            }
 -            break;
          case INDEX_op_mulu2_i32:
              tci_args_rrrr(&tb_ptr, &r0, &r1, &r2, &r3);
              tci_write_reg64(regs, r1, r0, (uint64_t)regs[r2] * regs[r3]);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              break;
  #endif
          case INDEX_op_brcond_i64:
 -            tci_args_rrcl(&tb_ptr, &r0, &r1, &condition, &ptr);
 -            if (tci_compare64(regs[r0], regs[r1], condition)) {
 +            tci_args_rl(&tb_ptr, &r0, &ptr);
 +            if (regs[r0]) {
                  tb_ptr = ptr;
              }
              break;
@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
      case INDEX_op_brcond_i32:
      case INDEX_op_brcond_i64:
 -        tci_args_rrcl(&tb_ptr, &r0, &r1, &c, &ptr);
 -        info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %p",
 -                           op_name, str_r(r0), str_r(r1), str_c(c), ptr);
 +        tci_args_rl(&tb_ptr, &r0, &ptr);
 +        info->fprintf_func(info->stream, "%-12s  %s, 0, ne, %p",
 +                           op_name, str_r(r0), ptr);
          break;
      case INDEX_op_setcond_i32:
@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
                             str_r(r3), str_r(r4), str_c(c));
          break;
 -    case INDEX_op_brcond2_i32:
 -        tci_args_rrrrcl(&tb_ptr, &r0, &r1, &r2, &r3, &c, &ptr);
 -        info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s, %s, %p",
 -                           op_name, str_r(r0), str_r(r1),
 -                           str_r(r2), str_r(r3), str_c(c), ptr);
 -        break;
 -
      case INDEX_op_mulu2_i32:
          tci_args_rrrr(&tb_ptr, &r0, &r1, &r2, &r3);
          info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s",
 diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target.c.inc
+--- a/softmmu/cpus.c
-+++ b/tcg/tci/tcg-target.c.inc
++++ b/softmmu/cpus.c
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op_rI(TCGContext *s, TCGOpcode op,
+@@ -XXX,XX +XXX,XX @@ bool cpu_thread_is_idle(CPUState *cpu)
- }
+         return true;
- #endif
+     }
+     if (!cpu->halted || cpu_has_work(cpu) ||
-+static void tcg_out_op_rl(TCGContext *s, TCGOpcode op, TCGReg r0, TCGLabel *l1)
+-        kvm_halt_in_kernel() || whpx_apic_in_platform()) {
-+{
++        whpx_apic_in_platform()) {
-+    uint8_t *old_code_ptr = s->code_ptr;
+         return false;
-+
+     }
-+    tcg_out_op_t(s, op);
+     return true;
 +    tcg_out_r(s, r0);
 +    tci_out_label(s, l1);
 +
 +    old_code_ptr[1] = s->code_ptr - old_code_ptr;
 +}
 +
  static void tcg_out_op_rr(TCGContext *s, TCGOpcode op, TCGReg r0, TCGReg r1)
  {
      uint8_t *old_code_ptr = s->code_ptr;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op_rrs(TCGContext *s, TCGOpcode op,
      old_code_ptr[1] = s->code_ptr - old_code_ptr;
  }
 -static void tcg_out_op_rrcl(TCGContext *s, TCGOpcode op,
 -                            TCGReg r0, TCGReg r1, TCGCond c2, TCGLabel *l3)
 -{
 -    uint8_t *old_code_ptr = s->code_ptr;
 -
 -    tcg_out_op_t(s, op);
 -    tcg_out_r(s, r0);
 -    tcg_out_r(s, r1);
 -    tcg_out8(s, c2);
 -    tci_out_label(s, l3);
 -
 -    old_code_ptr[1] = s->code_ptr - old_code_ptr;
 -}
 -
  static void tcg_out_op_rrrc(TCGContext *s, TCGOpcode op,
                              TCGReg r0, TCGReg r1, TCGReg r2, TCGCond c3)
  {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op_rrrr(TCGContext *s, TCGOpcode op,
      old_code_ptr[1] = s->code_ptr - old_code_ptr;
  }
 -static void tcg_out_op_rrrrcl(TCGContext *s, TCGOpcode op,
 -                              TCGReg r0, TCGReg r1, TCGReg r2, TCGReg r3,
 -                              TCGCond c4, TCGLabel *l5)
 -{
 -    uint8_t *old_code_ptr = s->code_ptr;
 -
 -    tcg_out_op_t(s, op);
 -    tcg_out_r(s, r0);
 -    tcg_out_r(s, r1);
 -    tcg_out_r(s, r2);
 -    tcg_out_r(s, r3);
 -    tcg_out8(s, c4);
 -    tci_out_label(s, l5);
 -
 -    old_code_ptr[1] = s->code_ptr - old_code_ptr;
 -}
 -
  static void tcg_out_op_rrrrrc(TCGContext *s, TCGOpcode op,
                                TCGReg r0, TCGReg r1, TCGReg r2,
                                TCGReg r3, TCGReg r4, TCGCond c5)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          break;
      CASE_32_64(brcond)
 -        tcg_out_op_rrcl(s, opc, args[0], args[1], args[2], arg_label(args[3]));
 +        tcg_out_op_rrrc(s, (opc == INDEX_op_brcond_i32
 +                            ? INDEX_op_setcond_i32 : INDEX_op_setcond_i64),
 +                        TCG_REG_TMP, args[0], args[1], args[2]);
 +        tcg_out_op_rl(s, opc, TCG_REG_TMP, arg_label(args[3]));
          break;
      CASE_32_64(neg)      /* Optional (TCG_TARGET_HAS_neg_*). */
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
                            args[3], args[4], args[5]);
          break;
      case INDEX_op_brcond2_i32:
 -        tcg_out_op_rrrrcl(s, opc, args[0], args[1], args[2],
 -                          args[3], args[4], arg_label(args[5]));
 +        tcg_out_op_rrrrrc(s, INDEX_op_setcond2_i32, TCG_REG_TMP,
 +                          args[0], args[1], args[2], args[3], args[4]);
 +        tcg_out_op_rl(s, INDEX_op_brcond_i32, TCG_REG_TMP, arg_label(args[5]));
          break;
      case INDEX_op_mulu2_i32:
          tcg_out_op_rrrr(s, opc, args[0], args[1], args[2], args[3]);
 --
 .25.1

-[PULL 07/33] tcg: Add tcg_call_func
+[PULL 07/35] accel/whpx: Implement AccelOpsClass::has_work()
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Implement WHPX has_work() handler in AccelOpsClass and
 remove it from cpu_thread_is_idle() since cpu_has_work()
 is already called.
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210912172731.789788-7-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tcg-internal.h | 5 +++++
+ softmmu/cpus.c                    | 4 +---
- tcg/tcg.c          | 5 ++---
+ target/i386/whpx/whpx-accel-ops.c | 6 ++++++
 files changed, 7 insertions(+), 3 deletions(-)
-diff --git a/tcg/tcg-internal.h b/tcg/tcg-internal.h
+diff --git a/softmmu/cpus.c b/softmmu/cpus.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-internal.h
+--- a/softmmu/cpus.c
-+++ b/tcg/tcg-internal.h
++++ b/softmmu/cpus.c
-@@ -XXX,XX +XXX,XX @@ bool tcg_region_alloc(TCGContext *s);
+@@ -XXX,XX +XXX,XX @@
- void tcg_region_initial_alloc(TCGContext *s);
+ #include "sysemu/replay.h"
- void tcg_region_prologue_set(TCGContext *s);
+ #include "sysemu/runstate.h"
+ #include "sysemu/cpu-timers.h"
-+static inline void *tcg_call_func(TCGOp *op)
+-#include "sysemu/whpx.h"
  #include "hw/boards.h"
  #include "hw/hw.h"
  #include "trace.h"
@@ -XXX,XX +XXX,XX @@ bool cpu_thread_is_idle(CPUState *cpu)
      if (cpu_is_stopped(cpu)) {
          return true;
      }
 -    if (!cpu->halted || cpu_has_work(cpu) ||
 -        whpx_apic_in_platform()) {
 +    if (!cpu->halted || cpu_has_work(cpu)) {
          return false;
      }
      return true;
 diff --git a/target/i386/whpx/whpx-accel-ops.c b/target/i386/whpx/whpx-accel-ops.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/whpx/whpx-accel-ops.c
 +++ b/target/i386/whpx/whpx-accel-ops.c
@@ -XXX,XX +XXX,XX @@ static void whpx_kick_vcpu_thread(CPUState *cpu)
      }
  }
 +static bool whpx_cpu_has_work(CPUState *cpu)
 +{
-+    return (void *)(uintptr_t)op->args[TCGOP_CALLO(op) + TCGOP_CALLI(op)];
++    return whpx_apic_in_platform();
 +}
 +
- static inline const TCGHelperInfo *tcg_call_info(TCGOp *op)
+ static void whpx_accel_ops_class_init(ObjectClass *oc, void *data)
  {
-     return (void *)(uintptr_t)op->args[TCGOP_CALLO(op) + TCGOP_CALLI(op) + 1];
+     AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
-diff --git a/tcg/tcg.c b/tcg/tcg.c
+@@ -XXX,XX +XXX,XX @@ static void whpx_accel_ops_class_init(ObjectClass *oc, void *data)
-index XXXXXXX..XXXXXXX 100644
+     ops->synchronize_post_init = whpx_cpu_synchronize_post_init;
---- a/tcg/tcg.c
+     ops->synchronize_state = whpx_cpu_synchronize_state;
-+++ b/tcg/tcg.c
+     ops->synchronize_pre_loadvm = whpx_cpu_synchronize_pre_loadvm;
-@@ -XXX,XX +XXX,XX @@ static void tcg_dump_ops(TCGContext *s, bool have_prefs)
++    ops->has_work = whpx_cpu_has_work;
-             }
+ }
-         } else if (c == INDEX_op_call) {
-             const TCGHelperInfo *info = tcg_call_info(op);
+ static const TypeInfo whpx_accel_ops_type = {
 -            void *func;
 +            void *func = tcg_call_func(op);
              /* variable number of arguments */
              nb_oargs = TCGOP_CALLO(op);
@@ -XXX,XX +XXX,XX @@ static void tcg_dump_ops(TCGContext *s, bool have_prefs)
               * Note that plugins have a template function for the info,
               * but the actual function pointer comes from the plugin.
               */
 -            func = (void *)(uintptr_t)op->args[nb_oargs + nb_iargs];
              if (func == info->func) {
                  col += qemu_log("%s", info->name);
              } else {
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_call(TCGContext *s, TCGOp *op)
      int allocate_args;
      TCGRegSet allocated_regs;
 -    func_addr = (tcg_insn_unit *)(intptr_t)op->args[nb_oargs + nb_iargs];
 +    func_addr = tcg_call_func(op);
      flags = tcg_call_flags(op);
      nb_regs = ARRAY_SIZE(tcg_target_call_iarg_regs);
 --
 .25.1

-[PULL 19/33] tcg/tci: Implement extract, sextract
+[PULL 08/35] accel/tcg: Implement AccelOpsClass::has_work() as stub
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Add TCG target-specific has_work() handler in TCGCPUOps,
 and add tcg_cpu_has_work() as AccelOpsClass has_work()
 implementation.
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210912172731.789788-8-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci/tcg-target.h     |  8 ++++----
+ include/hw/core/tcg-cpu-ops.h |  4 ++++
- tcg/tci.c                | 42 ++++++++++++++++++++++++++++++++++++++++
+ accel/tcg/tcg-accel-ops.c     | 12 ++++++++++++
- tcg/tci/tcg-target.c.inc | 32 ++++++++++++++++++++++++++++++
+files changed, 16 insertions(+)
 files changed, 78 insertions(+), 4 deletions(-)
-diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
+diff --git a/include/hw/core/tcg-cpu-ops.h b/include/hw/core/tcg-cpu-ops.h
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target.h
+--- a/include/hw/core/tcg-cpu-ops.h
-+++ b/tcg/tci/tcg-target.h
++++ b/include/hw/core/tcg-cpu-ops.h
@@ -XXX,XX +XXX,XX @@ struct TCGCPUOps {
      void (*do_interrupt)(CPUState *cpu);
  #endif /* !CONFIG_USER_ONLY || !TARGET_I386 */
  #ifdef CONFIG_SOFTMMU
 +    /**
 +     * @has_work: Callback for checking if there is work to do.
 +     */
 +    bool (*has_work)(CPUState *cpu);
      /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
      bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
      /**
 diff --git a/accel/tcg/tcg-accel-ops.c b/accel/tcg/tcg-accel-ops.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/tcg-accel-ops.c
 +++ b/accel/tcg/tcg-accel-ops.c
 @@ -XXX,XX +XXX,XX @@
- #define TCG_TARGET_HAS_ext16u_i32       1
+ #include "qemu/main-loop.h"
- #define TCG_TARGET_HAS_andc_i32         1
+ #include "qemu/guest-random.h"
- #define TCG_TARGET_HAS_deposit_i32      1
+ #include "exec/exec-all.h"
--#define TCG_TARGET_HAS_extract_i32      0
++#include "hw/core/tcg-cpu-ops.h"
--#define TCG_TARGET_HAS_sextract_i32     0
-+#define TCG_TARGET_HAS_extract_i32      1
+ #include "tcg-accel-ops.h"
-+#define TCG_TARGET_HAS_sextract_i32     1
+ #include "tcg-accel-ops-mttcg.h"
- #define TCG_TARGET_HAS_extract2_i32     0
+@@ -XXX,XX +XXX,XX @@ int tcg_cpus_exec(CPUState *cpu)
- #define TCG_TARGET_HAS_eqv_i32          1
+     return ret;
  #define TCG_TARGET_HAS_nand_i32         1
@@ -XXX,XX +XXX,XX @@
  #define TCG_TARGET_HAS_bswap32_i64      1
  #define TCG_TARGET_HAS_bswap64_i64      1
  #define TCG_TARGET_HAS_deposit_i64      1
 -#define TCG_TARGET_HAS_extract_i64      0
 -#define TCG_TARGET_HAS_sextract_i64     0
 +#define TCG_TARGET_HAS_extract_i64      1
 +#define TCG_TARGET_HAS_sextract_i64     1
  #define TCG_TARGET_HAS_extract2_i64     0
  #define TCG_TARGET_HAS_div_i64          1
  #define TCG_TARGET_HAS_rem_i64          1
 diff --git a/tcg/tci.c b/tcg/tci.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci.c
 +++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ static void tci_args_rrs(uint32_t insn, TCGReg *r0, TCGReg *r1, int32_t *i2)
      *i2 = sextract32(insn, 16, 16);
  }
-+static void tci_args_rrbb(uint32_t insn, TCGReg *r0, TCGReg *r1,
++static bool tcg_cpu_has_work(CPUState *cpu)
 +                          uint8_t *i2, uint8_t *i3)
 +{
-+    *r0 = extract32(insn, 8, 4);
++    CPUClass *cc = CPU_GET_CLASS(cpu);
-+    *r1 = extract32(insn, 12, 4);
++
-+    *i2 = extract32(insn, 16, 6);
++    if (!cc->tcg_ops->has_work) {
-+    *i3 = extract32(insn, 22, 6);
++        return false;
 +    }
 +    return cc->tcg_ops->has_work(cpu);
 +}
 +
- static void tci_args_rrrc(uint32_t insn,
+ /* mask must never be zero, except for A20 change call */
-                           TCGReg *r0, TCGReg *r1, TCGReg *r2, TCGCond *c3)
+ void tcg_handle_interrupt(CPUState *cpu, int mask)
  {
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+@@ -XXX,XX +XXX,XX @@ static void tcg_accel_ops_init(AccelOpsClass *ops)
-             tci_args_rrrbb(insn, &r0, &r1, &r2, &pos, &len);
+         ops->kick_vcpu_thread = rr_kick_vcpu_thread;
-             regs[r0] = deposit32(regs[r1], pos, len, regs[r2]);
+         ops->handle_interrupt = tcg_handle_interrupt;
-             break;
+     }
-+#endif
++    ops->has_work = tcg_cpu_has_work;
 +#if TCG_TARGET_HAS_extract_i32
 +        case INDEX_op_extract_i32:
 +            tci_args_rrbb(insn, &r0, &r1, &pos, &len);
 +            regs[r0] = extract32(regs[r1], pos, len);
 +            break;
 +#endif
 +#if TCG_TARGET_HAS_sextract_i32
 +        case INDEX_op_sextract_i32:
 +            tci_args_rrbb(insn, &r0, &r1, &pos, &len);
 +            regs[r0] = sextract32(regs[r1], pos, len);
 +            break;
  #endif
          case INDEX_op_brcond_i32:
              tci_args_rl(insn, tb_ptr, &r0, &ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              tci_args_rrrbb(insn, &r0, &r1, &r2, &pos, &len);
              regs[r0] = deposit64(regs[r1], pos, len, regs[r2]);
              break;
 +#endif
 +#if TCG_TARGET_HAS_extract_i64
 +        case INDEX_op_extract_i64:
 +            tci_args_rrbb(insn, &r0, &r1, &pos, &len);
 +            regs[r0] = extract64(regs[r1], pos, len);
 +            break;
 +#endif
 +#if TCG_TARGET_HAS_sextract_i64
 +        case INDEX_op_sextract_i64:
 +            tci_args_rrbb(insn, &r0, &r1, &pos, &len);
 +            regs[r0] = sextract64(regs[r1], pos, len);
 +            break;
  #endif
          case INDEX_op_brcond_i64:
              tci_args_rl(insn, tb_ptr, &r0, &ptr);
@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
                             op_name, str_r(r0), str_r(r1), str_r(r2), pos, len);
          break;
 +    case INDEX_op_extract_i32:
 +    case INDEX_op_extract_i64:
 +    case INDEX_op_sextract_i32:
 +    case INDEX_op_sextract_i64:
 +        tci_args_rrbb(insn, &r0, &r1, &pos, &len);
 +        info->fprintf_func(info->stream, "%-12s  %s,%s,%d,%d",
 +                           op_name, str_r(r0), str_r(r1), pos, len);
 +        break;
 +
      case INDEX_op_movcond_i32:
      case INDEX_op_movcond_i64:
      case INDEX_op_setcond2_i32:
 diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.c.inc
 +++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
      case INDEX_op_bswap32_i32:
      case INDEX_op_bswap32_i64:
      case INDEX_op_bswap64_i64:
 +    case INDEX_op_extract_i32:
 +    case INDEX_op_extract_i64:
 +    case INDEX_op_sextract_i32:
 +    case INDEX_op_sextract_i64:
          return C_O1_I1(r, r);
      case INDEX_op_st8_i32:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op_rrs(TCGContext *s, TCGOpcode op,
      tcg_out32(s, insn);
  }
-+static void tcg_out_op_rrbb(TCGContext *s, TCGOpcode op, TCGReg r0,
+ static void tcg_accel_ops_class_init(ObjectClass *oc, void *data)
 +                            TCGReg r1, uint8_t b2, uint8_t b3)
 +{
 +    tcg_insn_unit insn = 0;
 +
 +    tcg_debug_assert(b2 == extract32(b2, 0, 6));
 +    tcg_debug_assert(b3 == extract32(b3, 0, 6));
 +    insn = deposit32(insn, 0, 8, op);
 +    insn = deposit32(insn, 8, 4, r0);
 +    insn = deposit32(insn, 12, 4, r1);
 +    insn = deposit32(insn, 16, 6, b2);
 +    insn = deposit32(insn, 22, 6, b3);
 +    tcg_out32(s, insn);
 +}
 +
  static void tcg_out_op_rrrc(TCGContext *s, TCGOpcode op,
                              TCGReg r0, TCGReg r1, TCGReg r2, TCGCond c3)
  {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          }
          break;
 +    CASE_32_64(extract)  /* Optional (TCG_TARGET_HAS_extract_*). */
 +    CASE_32_64(sextract) /* Optional (TCG_TARGET_HAS_sextract_*). */
 +        {
 +            TCGArg pos = args[2], len = args[3];
 +            TCGArg max = tcg_op_defs[opc].flags & TCG_OPF_64BIT ? 64 : 32;
 +
 +            tcg_debug_assert(pos < max);
 +            tcg_debug_assert(pos + len <= max);
 +
 +            tcg_out_op_rrbb(s, opc, args[0], args[1], pos, len);
 +        }
 +        break;
 +
      CASE_32_64(brcond)
          tcg_out_op_rrrc(s, (opc == INDEX_op_brcond_i32
                              ? INDEX_op_setcond_i32 : INDEX_op_setcond_i64),
 --
 .25.1

-[PULL 33/33] util/oslib-win32: Fix fatal assertion in qemu_try_memalign
+[PULL 09/35] target/alpha: Restrict has_work() handler to sysemu
-From: Stefan Weil <sw@weilnetz.de>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-The function is called with alignment == 0 which caused an assertion.
+Restrict has_work() to sysemu.
 Use the code from oslib-posix.c to fix that regression.
-Fixes: ed6f53f9ca9
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Stefan Weil <sw@weilnetz.de>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-Id: <20210912172731.789788-9-f4bug@amsat.org>
 Message-Id: <20210611105846.347954-1-sw@weilnetz.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- util/oslib-win32.c | 6 +++++-
+ target/alpha/cpu.c | 4 +++-
-file changed, 5 insertions(+), 1 deletion(-)
+file changed, 3 insertions(+), 1 deletion(-)
-diff --git a/util/oslib-win32.c b/util/oslib-win32.c
+diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/util/oslib-win32.c
+--- a/target/alpha/cpu.c
-+++ b/util/oslib-win32.c
++++ b/target/alpha/cpu.c
-@@ -XXX,XX +XXX,XX @@ void *qemu_try_memalign(size_t alignment, size_t size)
+@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_set_pc(CPUState *cs, vaddr value)
-     void *ptr;
+     cpu->env.pc = value;
+ }
-     g_assert(size != 0);
--    g_assert(is_power_of_2(alignment));
++#if !defined(CONFIG_USER_ONLY)
-+    if (alignment < sizeof(void *)) {
+ static bool alpha_cpu_has_work(CPUState *cs)
-+        alignment = sizeof(void *);
+ {
-+    } else {
+     /* Here we are checking to see if the CPU should wake up from HALT.
-+        g_assert(is_power_of_2(alignment));
+@@ -XXX,XX +XXX,XX @@ static bool alpha_cpu_has_work(CPUState *cs)
-+    }
+                                     | CPU_INTERRUPT_SMP
-     ptr = _aligned_malloc(size, alignment);
+                                     | CPU_INTERRUPT_MCHK);
-     trace_qemu_memalign(alignment, size, ptr);
+ }
-     return ptr;
++#endif /* !CONFIG_USER_ONLY */
  static void alpha_cpu_disas_set_info(CPUState *cpu, disassemble_info *info)
  {
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps alpha_tcg_ops = {
      .tlb_fill = alpha_cpu_tlb_fill,
  #ifndef CONFIG_USER_ONLY
 +    .has_work = alpha_cpu_has_work,
      .cpu_exec_interrupt = alpha_cpu_exec_interrupt,
      .do_interrupt = alpha_cpu_do_interrupt,
      .do_transaction_failed = alpha_cpu_do_transaction_failed,
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
                                      &acc->parent_realize);
      cc->class_by_name = alpha_cpu_class_by_name;
 -    cc->has_work = alpha_cpu_has_work;
      cc->dump_state = alpha_cpu_dump_state;
      cc->set_pc = alpha_cpu_set_pc;
      cc->gdb_read_register = alpha_cpu_gdb_read_register;
 --
 .25.1

-[PULL 31/33] tcg: Restart when exhausting the stack frame
+[PULL 10/35] target/arm: Restrict has_work() handler to sysemu and TCG
-Assume that we'll have fewer temps allocated after
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 restarting with a fewer number of instructions.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Restrict has_work() to TCG sysemu.
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210912172731.789788-10-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tcg.c | 6 +++++-
+ target/arm/cpu.c | 7 +++++--
-file changed, 5 insertions(+), 1 deletion(-)
+file changed, 5 insertions(+), 2 deletions(-)
-diff --git a/tcg/tcg.c b/tcg/tcg.c
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg.c
+--- a/target/arm/cpu.c
-+++ b/tcg/tcg.c
++++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void temp_allocate_frame(TCGContext *s, TCGTemp *ts)
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_synchronize_from_tb(CPUState *cs,
+         env->regs[15] = tb->pc;
-     assert(align <= TCG_TARGET_STACK_ALIGN);
+     }
-     off = ROUND_UP(s->current_frame_offset, align);
+ }
--    assert(off + size <= s->frame_end);
+-#endif /* CONFIG_TCG */
 +#ifndef CONFIG_USER_ONLY
  static bool arm_cpu_has_work(CPUState *cs)
  {
      ARMCPU *cpu = ARM_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool arm_cpu_has_work(CPUState *cs)
           | CPU_INTERRUPT_VFIQ | CPU_INTERRUPT_VIRQ
           | CPU_INTERRUPT_EXITTB);
  }
 +#endif /* !CONFIG_USER_ONLY */
 +
-+    /* If we've exhausted the stack frame, restart with a smaller TB. */
++#endif /* CONFIG_TCG */
-+    if (off + size > s->frame_end) {
-+        tcg_raise_tb_overflow(s);
+ void arm_register_pre_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
-+    }
+                                  void *opaque)
-     s->current_frame_offset = off + size;
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps arm_tcg_ops = {
+     .debug_excp_handler = arm_debug_excp_handler,
-     ts->mem_offset = off;
  #if !defined(CONFIG_USER_ONLY)
 +    .has_work = arm_cpu_has_work,
      .cpu_exec_interrupt = arm_cpu_exec_interrupt,
      .do_interrupt = arm_cpu_do_interrupt,
      .do_transaction_failed = arm_cpu_do_transaction_failed,
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
      device_class_set_parent_reset(dc, arm_cpu_reset, &acc->parent_reset);
      cc->class_by_name = arm_cpu_class_by_name;
 -    cc->has_work = arm_cpu_has_work;
      cc->dump_state = arm_cpu_dump_state;
      cc->set_pc = arm_cpu_set_pc;
      cc->gdb_read_register = arm_cpu_gdb_read_register;
 --
 .25.1

-[PULL 29/33] tcg/sparc: Fix temp_allocate_frame vs sparc stack bias
+[PULL 11/35] target/avr: Restrict has_work() handler to sysemu
-We should not be aligning the offset in temp_allocate_frame,
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 because the odd offset produces an aligned address in the end.
 Instead, pass the logical offset into tcg_set_frame and add
 the stack bias last.
-Cc: qemu-stable@nongnu.org
+Restrict has_work() to sysemu.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210912172731.789788-11-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tcg.c                  |  9 +++------
+ target/avr/cpu.c | 2 +-
- tcg/sparc/tcg-target.c.inc | 16 ++++++++++------
+file changed, 1 insertion(+), 1 deletion(-)
 files changed, 13 insertions(+), 12 deletions(-)
-diff --git a/tcg/tcg.c b/tcg/tcg.c
+diff --git a/target/avr/cpu.c b/target/avr/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg.c
+--- a/target/avr/cpu.c
-+++ b/tcg/tcg.c
++++ b/target/avr/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void check_regs(TCGContext *s)
+@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps avr_sysemu_ops = {
+ static const struct TCGCPUOps avr_tcg_ops = {
- static void temp_allocate_frame(TCGContext *s, TCGTemp *ts)
+     .initialize = avr_cpu_tcg_init,
- {
+     .synchronize_from_tb = avr_cpu_synchronize_from_tb,
--#if !(defined(__sparc__) && TCG_TARGET_REG_BITS == 64)
++    .has_work = avr_cpu_has_work,
--    /* Sparc64 stack is accessed with offset of 2047 */
+     .cpu_exec_interrupt = avr_cpu_exec_interrupt,
--    s->current_frame_offset = (s->current_frame_offset +
+     .tlb_fill = avr_cpu_tlb_fill,
--                               (tcg_target_long)sizeof(tcg_target_long) - 1) &
+     .do_interrupt = avr_cpu_do_interrupt,
--        ~(sizeof(tcg_target_long) - 1);
+@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
--#endif
-     if (s->current_frame_offset + (tcg_target_long)sizeof(tcg_target_long) >
+     cc->class_by_name = avr_cpu_class_by_name;
-         s->frame_end) {
-         tcg_abort();
+-    cc->has_work = avr_cpu_has_work;
-     }
+     cc->dump_state = avr_cpu_dump_state;
-     ts->mem_offset = s->current_frame_offset;
+     cc->set_pc = avr_cpu_set_pc;
-+#if defined(__sparc__)
+     cc->memory_rw_debug = avr_cpu_memory_rw_debug;
 +    ts->mem_offset += TCG_TARGET_STACK_BIAS;
 +#endif
      ts->mem_base = s->frame_temp;
      ts->mem_allocated = 1;
      s->current_frame_offset += sizeof(tcg_target_long);
 diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/sparc/tcg-target.c.inc
 +++ b/tcg/sparc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_target_qemu_prologue(TCGContext *s)
  {
      int tmp_buf_size, frame_size;
 -    /* The TCG temp buffer is at the top of the frame, immediately
 -       below the frame pointer.  */
 +    /*
 +     * The TCG temp buffer is at the top of the frame, immediately
 +     * below the frame pointer.  Use the logical (aligned) offset here;
 +     * the stack bias is applied in temp_allocate_frame().
 +     */
      tmp_buf_size = CPU_TEMP_BUF_NLONGS * (int)sizeof(long);
 -    tcg_set_frame(s, TCG_REG_I6, TCG_TARGET_STACK_BIAS - tmp_buf_size,
 -                  tmp_buf_size);
 +    tcg_set_frame(s, TCG_REG_I6, -tmp_buf_size, tmp_buf_size);
 -    /* TCG_TARGET_CALL_STACK_OFFSET includes the stack bias, but is
 -       otherwise the minimal frame usable by callees.  */
 +    /*
 +     * TCG_TARGET_CALL_STACK_OFFSET includes the stack bias, but is
 +     * otherwise the minimal frame usable by callees.
 +     */
      frame_size = TCG_TARGET_CALL_STACK_OFFSET - TCG_TARGET_STACK_BIAS;
      frame_size += TCG_STATIC_CALL_ARGS_SIZE + tmp_buf_size;
      frame_size += TCG_TARGET_STACK_ALIGN - 1;
 --
 .25.1

-[PULL 28/33] accel/tcg: Probe the proper permissions for atomic ops
+[PULL 12/35] target/cris: Restrict has_work() handler to sysemu
-We had a single ATOMIC_MMU_LOOKUP macro that probed for
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 read+write on all atomic ops.  This is incorrect for
 plain atomic load and atomic store.
-For user-only, we rely on the host page permissions.
+Restrict has_work() to sysemu.
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/390
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210912172731.789788-12-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/atomic_template.h | 24 +++++-----
+ target/cris/cpu.c | 4 +++-
- accel/tcg/cputlb.c          | 95 ++++++++++++++++++++++++++-----------
+file changed, 3 insertions(+), 1 deletion(-)
  accel/tcg/user-exec.c       |  8 ++--
 files changed, 83 insertions(+), 44 deletions(-)
-diff --git a/accel/tcg/atomic_template.h b/accel/tcg/atomic_template.h
+diff --git a/target/cris/cpu.c b/target/cris/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/atomic_template.h
+--- a/target/cris/cpu.c
-+++ b/accel/tcg/atomic_template.h
++++ b/target/cris/cpu.c
-@@ -XXX,XX +XXX,XX @@ ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, target_ulong addr,
+@@ -XXX,XX +XXX,XX @@ static void cris_cpu_set_pc(CPUState *cs, vaddr value)
-                               ABI_TYPE cmpv, ABI_TYPE newv EXTRA_ARGS)
+     cpu->env.pc = value;
  }
 +#if !defined(CONFIG_USER_ONLY)
  static bool cris_cpu_has_work(CPUState *cs)
  {
-     ATOMIC_MMU_DECLS;
+     return cs->interrupt_request & (CPU_INTERRUPT_HARD | CPU_INTERRUPT_NMI);
--    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
+ }
-+    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP_RW;
++#endif /* !CONFIG_USER_ONLY */
-     DATA_TYPE ret;
-     uint16_t info = trace_mem_build_info(SHIFT, false, 0, false,
+ static void cris_cpu_reset(DeviceState *dev)
                                           ATOMIC_MMU_IDX);
@@ -XXX,XX +XXX,XX @@ ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, target_ulong addr,
  ABI_TYPE ATOMIC_NAME(ld)(CPUArchState *env, target_ulong addr EXTRA_ARGS)
  {
-     ATOMIC_MMU_DECLS;
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps crisv10_tcg_ops = {
--    DATA_TYPE val, *haddr = ATOMIC_MMU_LOOKUP;
+     .tlb_fill = cris_cpu_tlb_fill,
-+    DATA_TYPE val, *haddr = ATOMIC_MMU_LOOKUP_R;
-     uint16_t info = trace_mem_build_info(SHIFT, false, 0, false,
+ #ifndef CONFIG_USER_ONLY
-                                          ATOMIC_MMU_IDX);
++    .has_work = cris_cpu_has_work,
+     .cpu_exec_interrupt = cris_cpu_exec_interrupt,
-@@ -XXX,XX +XXX,XX @@ void ATOMIC_NAME(st)(CPUArchState *env, target_ulong addr,
+     .do_interrupt = crisv10_cpu_do_interrupt,
-                      ABI_TYPE val EXTRA_ARGS)
+ #endif /* !CONFIG_USER_ONLY */
- {
+@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
-     ATOMIC_MMU_DECLS;
+     device_class_set_parent_reset(dc, cris_cpu_reset, &ccc->parent_reset);
--    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
-+    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP_W;
+     cc->class_by_name = cris_cpu_class_by_name;
-     uint16_t info = trace_mem_build_info(SHIFT, false, 0, true,
+-    cc->has_work = cris_cpu_has_work;
-                                          ATOMIC_MMU_IDX);
+     cc->dump_state = cris_cpu_dump_state;
+     cc->set_pc = cris_cpu_set_pc;
-@@ -XXX,XX +XXX,XX @@ ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, target_ulong addr,
+     cc->gdb_read_register = cris_cpu_gdb_read_register;
                             ABI_TYPE val EXTRA_ARGS)
  {
      ATOMIC_MMU_DECLS;
 -    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
 +    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP_RW;
      DATA_TYPE ret;
      uint16_t info = trace_mem_build_info(SHIFT, false, 0, false,
                                           ATOMIC_MMU_IDX);
@@ -XXX,XX +XXX,XX @@ ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
                          ABI_TYPE val EXTRA_ARGS)                    \
  {                                                                   \
      ATOMIC_MMU_DECLS;                                               \
 -    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;                           \
 +    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP_RW;                        \
      DATA_TYPE ret;                                                  \
      uint16_t info = trace_mem_build_info(SHIFT, false, 0, false,    \
                                           ATOMIC_MMU_IDX);           \
@@ -XXX,XX +XXX,XX @@ ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
                          ABI_TYPE xval EXTRA_ARGS)                   \
  {                                                                   \
      ATOMIC_MMU_DECLS;                                               \
 -    XDATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;                          \
 +    XDATA_TYPE *haddr = ATOMIC_MMU_LOOKUP_RW;                       \
      XDATA_TYPE cmp, old, new, val = xval;                           \
      uint16_t info = trace_mem_build_info(SHIFT, false, 0, false,    \
                                           ATOMIC_MMU_IDX);           \
@@ -XXX,XX +XXX,XX @@ ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, target_ulong addr,
                                ABI_TYPE cmpv, ABI_TYPE newv EXTRA_ARGS)
  {
      ATOMIC_MMU_DECLS;
 -    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
 +    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP_RW;
      DATA_TYPE ret;
      uint16_t info = trace_mem_build_info(SHIFT, false, MO_BSWAP, false,
                                           ATOMIC_MMU_IDX);
@@ -XXX,XX +XXX,XX @@ ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, target_ulong addr,
  ABI_TYPE ATOMIC_NAME(ld)(CPUArchState *env, target_ulong addr EXTRA_ARGS)
  {
      ATOMIC_MMU_DECLS;
 -    DATA_TYPE val, *haddr = ATOMIC_MMU_LOOKUP;
 +    DATA_TYPE val, *haddr = ATOMIC_MMU_LOOKUP_R;
      uint16_t info = trace_mem_build_info(SHIFT, false, MO_BSWAP, false,
                                           ATOMIC_MMU_IDX);
@@ -XXX,XX +XXX,XX @@ void ATOMIC_NAME(st)(CPUArchState *env, target_ulong addr,
                       ABI_TYPE val EXTRA_ARGS)
  {
      ATOMIC_MMU_DECLS;
 -    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
 +    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP_W;
      uint16_t info = trace_mem_build_info(SHIFT, false, MO_BSWAP, true,
                                           ATOMIC_MMU_IDX);
@@ -XXX,XX +XXX,XX @@ ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, target_ulong addr,
                             ABI_TYPE val EXTRA_ARGS)
  {
      ATOMIC_MMU_DECLS;
 -    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
 +    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP_RW;
      ABI_TYPE ret;
      uint16_t info = trace_mem_build_info(SHIFT, false, MO_BSWAP, false,
                                           ATOMIC_MMU_IDX);
@@ -XXX,XX +XXX,XX @@ ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
                          ABI_TYPE val EXTRA_ARGS)                    \
  {                                                                   \
      ATOMIC_MMU_DECLS;                                               \
 -    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;                           \
 +    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP_RW;                        \
      DATA_TYPE ret;                                                  \
      uint16_t info = trace_mem_build_info(SHIFT, false, MO_BSWAP,    \
                                           false, ATOMIC_MMU_IDX);    \
@@ -XXX,XX +XXX,XX @@ ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
                          ABI_TYPE xval EXTRA_ARGS)                   \
  {                                                                   \
      ATOMIC_MMU_DECLS;                                               \
 -    XDATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;                          \
 +    XDATA_TYPE *haddr = ATOMIC_MMU_LOOKUP_RW;                       \
      XDATA_TYPE ldo, ldn, old, new, val = xval;                      \
      uint16_t info = trace_mem_build_info(SHIFT, false, MO_BSWAP,    \
                                           false, ATOMIC_MMU_IDX);    \
 diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cputlb.c
 +++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ bool tlb_plugin_lookup(CPUState *cpu, target_ulong addr, int mmu_idx,
  #endif
 -/* Probe for a read-modify-write atomic operation.  Do not allow unaligned
 - * operations, or io operations to proceed.  Return the host address.  */
 +/*
 + * Probe for an atomic operation.  Do not allow unaligned operations,
 + * or io operations to proceed.  Return the host address.
 + *
 + * @prot may be PAGE_READ, PAGE_WRITE, or PAGE_READ|PAGE_WRITE.
 + */
  static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
 -                               TCGMemOpIdx oi, uintptr_t retaddr)
 +                               TCGMemOpIdx oi, int size, int prot,
 +                               uintptr_t retaddr)
  {
      size_t mmu_idx = get_mmuidx(oi);
 -    uintptr_t index = tlb_index(env, mmu_idx, addr);
 -    CPUTLBEntry *tlbe = tlb_entry(env, mmu_idx, addr);
 -    target_ulong tlb_addr = tlb_addr_write(tlbe);
      MemOp mop = get_memop(oi);
      int a_bits = get_alignment_bits(mop);
 -    int s_bits = mop & MO_SIZE;
 +    uintptr_t index;
 +    CPUTLBEntry *tlbe;
 +    target_ulong tlb_addr;
      void *hostaddr;
      /* Adjust the given return address.  */
@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
      }
      /* Enforce qemu required alignment.  */
 -    if (unlikely(addr & ((1 << s_bits) - 1))) {
 +    if (unlikely(addr & (size - 1))) {
          /* We get here if guest alignment was not requested,
             or was not enforced by cpu_unaligned_access above.
             We might widen the access and emulate, but for now
@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
          goto stop_the_world;
      }
 +    index = tlb_index(env, mmu_idx, addr);
 +    tlbe = tlb_entry(env, mmu_idx, addr);
 +
      /* Check TLB entry and enforce page permissions.  */
 -    if (!tlb_hit(tlb_addr, addr)) {
 -        if (!VICTIM_TLB_HIT(addr_write, addr)) {
 -            tlb_fill(env_cpu(env), addr, 1 << s_bits, MMU_DATA_STORE,
 -                     mmu_idx, retaddr);
 -            index = tlb_index(env, mmu_idx, addr);
 -            tlbe = tlb_entry(env, mmu_idx, addr);
 +    if (prot & PAGE_WRITE) {
 +        tlb_addr = tlb_addr_write(tlbe);
 +        if (!tlb_hit(tlb_addr, addr)) {
 +            if (!VICTIM_TLB_HIT(addr_write, addr)) {
 +                tlb_fill(env_cpu(env), addr, size,
 +                         MMU_DATA_STORE, mmu_idx, retaddr);
 +                index = tlb_index(env, mmu_idx, addr);
 +                tlbe = tlb_entry(env, mmu_idx, addr);
 +            }
 +            tlb_addr = tlb_addr_write(tlbe) & ~TLB_INVALID_MASK;
 +        }
 +
 +        /* Let the guest notice RMW on a write-only page.  */
 +        if ((prot & PAGE_READ) &&
 +            unlikely(tlbe->addr_read != (tlb_addr & ~TLB_NOTDIRTY))) {
 +            tlb_fill(env_cpu(env), addr, size,
 +                     MMU_DATA_LOAD, mmu_idx, retaddr);
 +            /*
 +             * Since we don't support reads and writes to different addresses,
 +             * and we do have the proper page loaded for write, this shouldn't
 +             * ever return.  But just in case, handle via stop-the-world.
 +             */
 +            goto stop_the_world;
 +        }
 +    } else /* if (prot & PAGE_READ) */ {
 +        tlb_addr = tlbe->addr_read;
 +        if (!tlb_hit(tlb_addr, addr)) {
 +            if (!VICTIM_TLB_HIT(addr_write, addr)) {
 +                tlb_fill(env_cpu(env), addr, size,
 +                         MMU_DATA_LOAD, mmu_idx, retaddr);
 +                index = tlb_index(env, mmu_idx, addr);
 +                tlbe = tlb_entry(env, mmu_idx, addr);
 +            }
 +            tlb_addr = tlbe->addr_read & ~TLB_INVALID_MASK;
          }
 -        tlb_addr = tlb_addr_write(tlbe) & ~TLB_INVALID_MASK;
      }
      /* Notice an IO access or a needs-MMU-lookup access */
@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
          goto stop_the_world;
      }
 -    /* Let the guest notice RMW on a write-only page.  */
 -    if (unlikely(tlbe->addr_read != (tlb_addr & ~TLB_NOTDIRTY))) {
 -        tlb_fill(env_cpu(env), addr, 1 << s_bits, MMU_DATA_LOAD,
 -                 mmu_idx, retaddr);
 -        /* Since we don't support reads and writes to different addresses,
 -           and we do have the proper page loaded for write, this shouldn't
 -           ever return.  But just in case, handle via stop-the-world.  */
 -        goto stop_the_world;
 -    }
 -
      hostaddr = (void *)((uintptr_t)addr + tlbe->addend);
      if (unlikely(tlb_addr & TLB_NOTDIRTY)) {
 -        notdirty_write(env_cpu(env), addr, 1 << s_bits,
 +        notdirty_write(env_cpu(env), addr, size,
                         &env_tlb(env)->d[mmu_idx].iotlb[index], retaddr);
      }
@@ -XXX,XX +XXX,XX @@ void cpu_stq_le_data(CPUArchState *env, target_ulong ptr, uint64_t val)
  #define ATOMIC_NAME(X) \
      HELPER(glue(glue(glue(atomic_ ## X, SUFFIX), END), _mmu))
  #define ATOMIC_MMU_DECLS
 -#define ATOMIC_MMU_LOOKUP atomic_mmu_lookup(env, addr, oi, retaddr)
 +#define ATOMIC_MMU_LOOKUP_RW \
 +    atomic_mmu_lookup(env, addr, oi, DATA_SIZE, PAGE_READ | PAGE_WRITE, retaddr)
 +#define ATOMIC_MMU_LOOKUP_R \
 +    atomic_mmu_lookup(env, addr, oi, DATA_SIZE, PAGE_READ, retaddr)
 +#define ATOMIC_MMU_LOOKUP_W \
 +    atomic_mmu_lookup(env, addr, oi, DATA_SIZE, PAGE_WRITE, retaddr)
  #define ATOMIC_MMU_CLEANUP
  #define ATOMIC_MMU_IDX   get_mmuidx(oi)
@@ -XXX,XX +XXX,XX @@ void cpu_stq_le_data(CPUArchState *env, target_ulong ptr, uint64_t val)
  #undef EXTRA_ARGS
  #undef ATOMIC_NAME
 -#undef ATOMIC_MMU_LOOKUP
 +#undef ATOMIC_MMU_LOOKUP_RW
 +#undef ATOMIC_MMU_LOOKUP_R
 +#undef ATOMIC_MMU_LOOKUP_W
 +
  #define EXTRA_ARGS         , TCGMemOpIdx oi
  #define ATOMIC_NAME(X)     HELPER(glue(glue(atomic_ ## X, SUFFIX), END))
 -#define ATOMIC_MMU_LOOKUP  atomic_mmu_lookup(env, addr, oi, GETPC())
 +#define ATOMIC_MMU_LOOKUP_RW \
 +    atomic_mmu_lookup(env, addr, oi, DATA_SIZE, PAGE_READ | PAGE_WRITE, GETPC())
 +#define ATOMIC_MMU_LOOKUP_R \
 +    atomic_mmu_lookup(env, addr, oi, DATA_SIZE, PAGE_READ, GETPC())
 +#define ATOMIC_MMU_LOOKUP_W \
 +    atomic_mmu_lookup(env, addr, oi, DATA_SIZE, PAGE_WRITE, GETPC())
  #define DATA_SIZE 1
  #include "atomic_template.h"
 diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/user-exec.c
 +++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
  /* Macro to call the above, with local variables from the use context.  */
  #define ATOMIC_MMU_DECLS do {} while (0)
 -#define ATOMIC_MMU_LOOKUP  atomic_mmu_lookup(env, addr, DATA_SIZE, GETPC())
 +#define ATOMIC_MMU_LOOKUP_RW  atomic_mmu_lookup(env, addr, DATA_SIZE, GETPC())
 +#define ATOMIC_MMU_LOOKUP_R   ATOMIC_MMU_LOOKUP_RW
 +#define ATOMIC_MMU_LOOKUP_W   ATOMIC_MMU_LOOKUP_RW
  #define ATOMIC_MMU_CLEANUP do { clear_helper_retaddr(); } while (0)
  #define ATOMIC_MMU_IDX MMU_USER_IDX
@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
  #undef EXTRA_ARGS
  #undef ATOMIC_NAME
 -#undef ATOMIC_MMU_LOOKUP
 +#undef ATOMIC_MMU_LOOKUP_RW
  #define EXTRA_ARGS     , TCGMemOpIdx oi, uintptr_t retaddr
  #define ATOMIC_NAME(X) \
      HELPER(glue(glue(glue(atomic_ ## X, SUFFIX), END), _mmu))
 -#define ATOMIC_MMU_LOOKUP  atomic_mmu_lookup(env, addr, DATA_SIZE, retaddr)
 +#define ATOMIC_MMU_LOOKUP_RW  atomic_mmu_lookup(env, addr, DATA_SIZE, retaddr)
  #define DATA_SIZE 16
  #include "atomic_template.h"
 --
 .25.1

-[PULL 04/33] plugins: Drop tcg_flags from struct qemu_plugin_dyn_cb
+[PULL 13/35] target/hexagon: Remove unused has_work() handler
-As noted by qemu-plugins.h, enum qemu_plugin_cb_flags is
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 currently unused -- plugins can neither read nor write
 guest registers.
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+has_work() is sysemu specific, and Hexagon target only provides
 a linux-user implementation. Remove the unused hexagon_cpu_has_work().
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210912172731.789788-13-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/plugin-helpers.h |  1 -
+ target/hexagon/cpu.c | 6 ------
- include/qemu/plugin.h      |  1 -
+file changed, 6 deletions(-)
  accel/tcg/plugin-gen.c     |  8 ++++----
  plugins/core.c             | 30 ++++++------------------------
 files changed, 10 insertions(+), 30 deletions(-)
-diff --git a/accel/tcg/plugin-helpers.h b/accel/tcg/plugin-helpers.h
+diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/plugin-helpers.h
+--- a/target/hexagon/cpu.c
-+++ b/accel/tcg/plugin-helpers.h
++++ b/target/hexagon/cpu.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void hexagon_cpu_synchronize_from_tb(CPUState *cs,
- #ifdef CONFIG_PLUGIN
+     env->gpr[HEX_REG_PC] = tb->pc;
 -/* Note: no TCG flags because those are overwritten later */
  DEF_HELPER_2(plugin_vcpu_udata_cb, void, i32, ptr)
  DEF_HELPER_4(plugin_vcpu_mem_cb, void, i32, i32, i64, ptr)
  #endif
 diff --git a/include/qemu/plugin.h b/include/qemu/plugin.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/qemu/plugin.h
 +++ b/include/qemu/plugin.h
@@ -XXX,XX +XXX,XX @@ enum plugin_dyn_cb_subtype {
  struct qemu_plugin_dyn_cb {
      union qemu_plugin_cb_sig f;
      void *userp;
 -    unsigned tcg_flags;
      enum plugin_dyn_cb_subtype type;
      /* @rw applies to mem callbacks only (both regular and inline) */
      enum qemu_plugin_mem_rw rw;
 diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/plugin-gen.c
 +++ b/accel/tcg/plugin-gen.c
@@ -XXX,XX +XXX,XX @@ static TCGOp *copy_st_ptr(TCGOp **begin_op, TCGOp *op)
  }
- static TCGOp *copy_call(TCGOp **begin_op, TCGOp *op, void *empty_func,
+-static bool hexagon_cpu_has_work(CPUState *cs)
 -                        void *func, unsigned tcg_flags, int *cb_idx)
 +                        void *func, int *cb_idx)
  {
      /* copy all ops until the call */
      do {
@@ -XXX,XX +XXX,XX @@ static TCGOp *copy_call(TCGOp **begin_op, TCGOp *op, void *empty_func,
          tcg_debug_assert(i < MAX_OPC_PARAM_ARGS);
      }
      op->args[*cb_idx] = (uintptr_t)func;
 -    op->args[*cb_idx + 1] = tcg_flags;
 +    op->args[*cb_idx + 1] = (*begin_op)->args[*cb_idx + 1];
      return op;
  }
@@ -XXX,XX +XXX,XX @@ static TCGOp *append_udata_cb(const struct qemu_plugin_dyn_cb *cb,
      /* call */
      op = copy_call(&begin_op, op, HELPER(plugin_vcpu_udata_cb),
 -                   cb->f.vcpu_udata, cb->tcg_flags, cb_idx);
 +                   cb->f.vcpu_udata, cb_idx);
      return op;
  }
@@ -XXX,XX +XXX,XX @@ static TCGOp *append_mem_cb(const struct qemu_plugin_dyn_cb *cb,
      if (type == PLUGIN_GEN_CB_MEM) {
          /* call */
          op = copy_call(&begin_op, op, HELPER(plugin_vcpu_mem_cb),
 -                       cb->f.vcpu_udata, cb->tcg_flags, cb_idx);
 +                       cb->f.vcpu_udata, cb_idx);
      }
      return op;
 diff --git a/plugins/core.c b/plugins/core.c
 index XXXXXXX..XXXXXXX 100644
 --- a/plugins/core.c
 +++ b/plugins/core.c
@@ -XXX,XX +XXX,XX @@ void plugin_register_inline_op(GArray **arr,
      dyn_cb->inline_insn.imm = imm;
  }
 -static inline uint32_t cb_to_tcg_flags(enum qemu_plugin_cb_flags flags)
 -{
--    uint32_t ret;
+-    return true;
 -
 -    switch (flags) {
 -    case QEMU_PLUGIN_CB_RW_REGS:
 -        ret = 0;
 -        break;
 -    case QEMU_PLUGIN_CB_R_REGS:
 -        ret = TCG_CALL_NO_WG;
 -        break;
 -    case QEMU_PLUGIN_CB_NO_REGS:
 -    default:
 -        ret = TCG_CALL_NO_RWG;
 -    }
 -    return ret;
 -}
 -
--inline void
+ void restore_state_to_opc(CPUHexagonState *env, TranslationBlock *tb,
--plugin_register_dyn_cb__udata(GArray **arr,
+                           target_ulong *data)
 -                              qemu_plugin_vcpu_udata_cb_t cb,
 -                              enum qemu_plugin_cb_flags flags, void *udata)
 +void plugin_register_dyn_cb__udata(GArray **arr,
 +                                   qemu_plugin_vcpu_udata_cb_t cb,
 +                                   enum qemu_plugin_cb_flags flags,
 +                                   void *udata)
  {
-     struct qemu_plugin_dyn_cb *dyn_cb = plugin_get_dyn_cb(arr);
+@@ -XXX,XX +XXX,XX @@ static void hexagon_cpu_class_init(ObjectClass *c, void *data)
+     device_class_set_parent_reset(dc, hexagon_cpu_reset, &mcc->parent_reset);
-     dyn_cb->userp = udata;
--    dyn_cb->tcg_flags = cb_to_tcg_flags(flags);
+     cc->class_by_name = hexagon_cpu_class_by_name;
-+    /* Note flags are discarded as unused. */
+-    cc->has_work = hexagon_cpu_has_work;
-     dyn_cb->f.vcpu_udata = cb;
+     cc->dump_state = hexagon_dump_state;
-     dyn_cb->type = PLUGIN_CB_REGULAR;
+     cc->set_pc = hexagon_cpu_set_pc;
- }
+     cc->gdb_read_register = hexagon_gdb_read_register;
@@ -XXX,XX +XXX,XX @@ void plugin_register_vcpu_mem_cb(GArray **arr,
      dyn_cb = plugin_get_dyn_cb(arr);
      dyn_cb->userp = udata;
 -    dyn_cb->tcg_flags = cb_to_tcg_flags(flags);
 +    /* Note flags are discarded as unused. */
      dyn_cb->type = PLUGIN_CB_REGULAR;
      dyn_cb->rw = rw;
      dyn_cb->f.generic = cb;
 --
 .25.1

-[PULL 27/33] tests/tcg: Increase timeout for TCI
+[PULL 14/35] target/hppa: Restrict has_work() handler to sysemu
-The longest test at the moment seems to be a (slower)
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 aarch64 host, for which test-mmap takes 64 seconds.
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Restrict has_work() to sysemu.
-Acked-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210912172731.789788-14-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- configure                 | 3 +++
+ target/hppa/cpu.c | 4 +++-
- tests/tcg/Makefile.target | 6 ++++--
+file changed, 3 insertions(+), 1 deletion(-)
 files changed, 7 insertions(+), 2 deletions(-)
-diff --git a/configure b/configure
+diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
 index XXXXXXX..XXXXXXX 100755
 --- a/configure
 +++ b/configure
@@ -XXX,XX +XXX,XX @@ fi
  if test "$optreset" = "yes" ; then
    echo "HAVE_OPTRESET=y" >> $config_host_mak
  fi
 +if test "$tcg" = "enabled" -a "$tcg_interpreter" = "true" ; then
 +  echo "CONFIG_TCG_INTERPRETER=y" >> $config_host_mak
 +fi
  if test "$fdatasync" = "yes" ; then
    echo "CONFIG_FDATASYNC=y" >> $config_host_mak
  fi
 diff --git a/tests/tcg/Makefile.target b/tests/tcg/Makefile.target
 index XXXXXXX..XXXXXXX 100644
---- a/tests/tcg/Makefile.target
+--- a/target/hppa/cpu.c
-+++ b/tests/tcg/Makefile.target
++++ b/target/hppa/cpu.c
-@@ -XXX,XX +XXX,XX @@ LDFLAGS=
+@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_synchronize_from_tb(CPUState *cs,
- QEMU_OPTS=
+     cpu->env.psw_n = (tb->flags & PSW_N) != 0;
+ }
--# If TCG debugging is enabled things are a lot slower
++#if !defined(CONFIG_USER_ONLY)
--ifeq ($(CONFIG_DEBUG_TCG),y)
+ static bool hppa_cpu_has_work(CPUState *cs)
-+# If TCG debugging, or TCI is enabled things are a lot slower
+ {
-+ifneq ($(CONFIG_TCG_INTERPRETER),)
+     return cs->interrupt_request & CPU_INTERRUPT_HARD;
-+TIMEOUT=90
+ }
-+else ifneq ($(CONFIG_DEBUG_TCG),)
++#endif /* !CONFIG_USER_ONLY */
- TIMEOUT=60
- else
+ static void hppa_cpu_disas_set_info(CPUState *cs, disassemble_info *info)
- TIMEOUT=15
+ {
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps hppa_tcg_ops = {
      .tlb_fill = hppa_cpu_tlb_fill,
  #ifndef CONFIG_USER_ONLY
 +    .has_work = hppa_cpu_has_work,
      .cpu_exec_interrupt = hppa_cpu_exec_interrupt,
      .do_interrupt = hppa_cpu_do_interrupt,
      .do_unaligned_access = hppa_cpu_do_unaligned_access,
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
                                      &acc->parent_realize);
      cc->class_by_name = hppa_cpu_class_by_name;
 -    cc->has_work = hppa_cpu_has_work;
      cc->dump_state = hppa_cpu_dump_state;
      cc->set_pc = hppa_cpu_set_pc;
      cc->gdb_read_register = hppa_cpu_gdb_read_register;
 --
 .25.1

-[PULL 02/33] tcg: Add tcg_call_flags
+[PULL 15/35] target/i386: Restrict has_work() handler to sysemu and TCG
-We're going to change how to look up the call flags from a TCGop,
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 so extract it as a helper.
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Restrict has_work() to TCG sysemu.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210912172731.789788-15-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tcg-internal.h |  5 +++++
+ target/i386/cpu.c         | 6 ------
- tcg/optimize.c     |  3 ++-
+ target/i386/tcg/tcg-cpu.c | 8 +++++++-
- tcg/tcg.c          | 14 ++++++--------
+files changed, 7 insertions(+), 7 deletions(-)
 files changed, 13 insertions(+), 9 deletions(-)
-diff --git a/tcg/tcg-internal.h b/tcg/tcg-internal.h
+diff --git a/target/i386/cpu.c b/target/i386/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-internal.h
+--- a/target/i386/cpu.c
-+++ b/tcg/tcg-internal.h
++++ b/target/i386/cpu.c
-@@ -XXX,XX +XXX,XX @@ bool tcg_region_alloc(TCGContext *s);
+@@ -XXX,XX +XXX,XX @@ int x86_cpu_pending_interrupt(CPUState *cs, int interrupt_request)
- void tcg_region_initial_alloc(TCGContext *s);
+     return 0;
- void tcg_region_prologue_set(TCGContext *s);
+ }
-+static inline unsigned tcg_call_flags(TCGOp *op)
+-static bool x86_cpu_has_work(CPUState *cs)
 -{
 -    return x86_cpu_pending_interrupt(cs, cs->interrupt_request) != 0;
 -}
 -
  static void x86_disas_set_info(CPUState *cs, disassemble_info *info)
  {
      X86CPU *cpu = X86_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static void x86_cpu_common_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = x86_cpu_class_by_name;
      cc->parse_features = x86_cpu_parse_featurestr;
 -    cc->has_work = x86_cpu_has_work;
      cc->dump_state = x86_cpu_dump_state;
      cc->set_pc = x86_cpu_set_pc;
      cc->gdb_read_register = x86_cpu_gdb_read_register;
 diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/tcg-cpu.c
 +++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void x86_cpu_synchronize_from_tb(CPUState *cs,
  }
  #ifndef CONFIG_USER_ONLY
 +static bool x86_cpu_has_work(CPUState *cs)
 +{
-+    return op->args[TCGOP_CALLO(op) + TCGOP_CALLI(op) + 1];
++    return x86_cpu_pending_interrupt(cs, cs->interrupt_request) != 0;
 +}
 +
- #endif /* TCG_INTERNAL_H */
+ static bool x86_debug_check_breakpoint(CPUState *cs)
-diff --git a/tcg/optimize.c b/tcg/optimize.c
+ {
-index XXXXXXX..XXXXXXX 100644
+     X86CPU *cpu = X86_CPU(cs);
---- a/tcg/optimize.c
+@@ -XXX,XX +XXX,XX @@ static bool x86_debug_check_breakpoint(CPUState *cs)
-+++ b/tcg/optimize.c
+     /* RF disables all architectural breakpoints. */
-@@ -XXX,XX +XXX,XX @@
+     return !(env->eflags & RF_MASK);
+ }
- #include "qemu/osdep.h"
+-#endif
- #include "tcg/tcg-op.h"
++#endif /* CONFIG_USER_ONLY */
-+#include "tcg-internal.h"
+ #include "hw/core/tcg-cpu-ops.h"
- #define CASE_OP_32_64(x)                        \
-         glue(glue(case INDEX_op_, x), _i32):    \
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps x86_tcg_ops = {
-@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
+ #ifdef CONFIG_USER_ONLY
-             break;
+     .fake_user_interrupt = x86_cpu_do_interrupt,
+ #else
-         case INDEX_op_call:
++    .has_work = x86_cpu_has_work,
--            if (!(op->args[nb_oargs + nb_iargs + 1]
+     .do_interrupt = x86_cpu_do_interrupt,
-+            if (!(tcg_call_flags(op)
+     .cpu_exec_interrupt = x86_cpu_exec_interrupt,
-                   & (TCG_CALL_NO_READ_GLOBALS | TCG_CALL_NO_WRITE_GLOBALS))) {
+     .debug_excp_handler = breakpoint_handler,
                  for (i = 0; i < nb_globals; i++) {
                      if (test_bit(i, temps_used.l)) {
 diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg.c
 +++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static void tcg_dump_ops(TCGContext *s, bool have_prefs)
              nb_cargs = def->nb_cargs;
              /* function name, flags, out args */
 -            col += qemu_log(" %s %s,$0x%" TCG_PRIlx ",$%d", def->name,
 +            col += qemu_log(" %s %s,$0x%x,$%d", def->name,
                              tcg_find_helper(s, op->args[nb_oargs + nb_iargs]),
 -                            op->args[nb_oargs + nb_iargs + 1], nb_oargs);
 +                            tcg_call_flags(op), nb_oargs);
              for (i = 0; i < nb_oargs; i++) {
                  col += qemu_log(",%s", tcg_get_arg_str(s, buf, sizeof(buf),
                                                         op->args[i]));
@@ -XXX,XX +XXX,XX @@ static void reachable_code_pass(TCGContext *s)
      QTAILQ_FOREACH_SAFE(op, &s->ops, link, op_next) {
          bool remove = dead;
          TCGLabel *label;
 -        int call_flags;
          switch (op->opc) {
          case INDEX_op_set_label:
@@ -XXX,XX +XXX,XX @@ static void reachable_code_pass(TCGContext *s)
          case INDEX_op_call:
              /* Notice noreturn helper calls, raising exceptions.  */
 -            call_flags = op->args[TCGOP_CALLO(op) + TCGOP_CALLI(op) + 1];
 -            if (call_flags & TCG_CALL_NO_RETURN) {
 +            if (tcg_call_flags(op) & TCG_CALL_NO_RETURN) {
                  dead = true;
              }
              break;
@@ -XXX,XX +XXX,XX @@ static void liveness_pass_1(TCGContext *s)
                  nb_oargs = TCGOP_CALLO(op);
                  nb_iargs = TCGOP_CALLI(op);
 -                call_flags = op->args[nb_oargs + nb_iargs + 1];
 +                call_flags = tcg_call_flags(op);
                  /* pure functions can be removed if their result is unused */
                  if (call_flags & TCG_CALL_NO_SIDE_EFFECTS) {
@@ -XXX,XX +XXX,XX @@ static bool liveness_pass_2(TCGContext *s)
          if (opc == INDEX_op_call) {
              nb_oargs = TCGOP_CALLO(op);
              nb_iargs = TCGOP_CALLI(op);
 -            call_flags = op->args[nb_oargs + nb_iargs + 1];
 +            call_flags = tcg_call_flags(op);
          } else {
              nb_iargs = def->nb_iargs;
              nb_oargs = def->nb_oargs;
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_call(TCGContext *s, TCGOp *op)
      TCGRegSet allocated_regs;
      func_addr = (tcg_insn_unit *)(intptr_t)op->args[nb_oargs + nb_iargs];
 -    flags = op->args[nb_oargs + nb_iargs + 1];
 +    flags = tcg_call_flags(op);
      nb_regs = ARRAY_SIZE(tcg_target_call_iarg_regs);
      if (nb_regs > nb_iargs) {
 --
 .25.1

-[PULL 25/33] tcg/tci: Remove the qemu_ld/st_type macros
+[PULL 16/35] target/m68k: Restrict has_work() handler to sysemu
-These macros are only used in one place.  By expanding,
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 we get to apply some common-subexpression elimination
 and create some local variables.
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Restrict has_work() to sysemu.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210912172731.789788-16-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c | 165 +++++++++++++++++++++++++++++++++---------------------
+ target/m68k/cpu.c | 4 +++-
-file changed, 100 insertions(+), 65 deletions(-)
+file changed, 3 insertions(+), 1 deletion(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
+diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/target/m68k/cpu.c
-+++ b/tcg/tci.c
++++ b/target/m68k/cpu.c
-@@ -XXX,XX +XXX,XX @@ static bool tci_compare64(uint64_t u0, uint64_t u1, TCGCond condition)
+@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_set_pc(CPUState *cs, vaddr value)
-     return result;
+     cpu->env.pc = value;
  }
--#ifdef CONFIG_SOFTMMU
++#if !defined(CONFIG_USER_ONLY)
--# define qemu_ld_ub \
+ static bool m68k_cpu_has_work(CPUState *cs)
 -    helper_ret_ldub_mmu(env, taddr, oi, (uintptr_t)tb_ptr)
 -# define qemu_ld_leuw \
 -    helper_le_lduw_mmu(env, taddr, oi, (uintptr_t)tb_ptr)
 -# define qemu_ld_leul \
 -    helper_le_ldul_mmu(env, taddr, oi, (uintptr_t)tb_ptr)
 -# define qemu_ld_leq \
 -    helper_le_ldq_mmu(env, taddr, oi, (uintptr_t)tb_ptr)
 -# define qemu_ld_beuw \
 -    helper_be_lduw_mmu(env, taddr, oi, (uintptr_t)tb_ptr)
 -# define qemu_ld_beul \
 -    helper_be_ldul_mmu(env, taddr, oi, (uintptr_t)tb_ptr)
 -# define qemu_ld_beq \
 -    helper_be_ldq_mmu(env, taddr, oi, (uintptr_t)tb_ptr)
 -# define qemu_st_b(X) \
 -    helper_ret_stb_mmu(env, taddr, X, oi, (uintptr_t)tb_ptr)
 -# define qemu_st_lew(X) \
 -    helper_le_stw_mmu(env, taddr, X, oi, (uintptr_t)tb_ptr)
 -# define qemu_st_lel(X) \
 -    helper_le_stl_mmu(env, taddr, X, oi, (uintptr_t)tb_ptr)
 -# define qemu_st_leq(X) \
 -    helper_le_stq_mmu(env, taddr, X, oi, (uintptr_t)tb_ptr)
 -# define qemu_st_bew(X) \
 -    helper_be_stw_mmu(env, taddr, X, oi, (uintptr_t)tb_ptr)
 -# define qemu_st_bel(X) \
 -    helper_be_stl_mmu(env, taddr, X, oi, (uintptr_t)tb_ptr)
 -# define qemu_st_beq(X) \
 -    helper_be_stq_mmu(env, taddr, X, oi, (uintptr_t)tb_ptr)
 -#else
 -# define qemu_ld_ub      ldub_p(g2h(env_cpu(env), taddr))
 -# define qemu_ld_leuw    lduw_le_p(g2h(env_cpu(env), taddr))
 -# define qemu_ld_leul    (uint32_t)ldl_le_p(g2h(env_cpu(env), taddr))
 -# define qemu_ld_leq     ldq_le_p(g2h(env_cpu(env), taddr))
 -# define qemu_ld_beuw    lduw_be_p(g2h(env_cpu(env), taddr))
 -# define qemu_ld_beul    (uint32_t)ldl_be_p(g2h(env_cpu(env), taddr))
 -# define qemu_ld_beq     ldq_be_p(g2h(env_cpu(env), taddr))
 -# define qemu_st_b(X)    stb_p(g2h(env_cpu(env), taddr), X)
 -# define qemu_st_lew(X)  stw_le_p(g2h(env_cpu(env), taddr), X)
 -# define qemu_st_lel(X)  stl_le_p(g2h(env_cpu(env), taddr), X)
 -# define qemu_st_leq(X)  stq_le_p(g2h(env_cpu(env), taddr), X)
 -# define qemu_st_bew(X)  stw_be_p(g2h(env_cpu(env), taddr), X)
 -# define qemu_st_bel(X)  stl_be_p(g2h(env_cpu(env), taddr), X)
 -# define qemu_st_beq(X)  stq_be_p(g2h(env_cpu(env), taddr), X)
 -#endif
 -
  static uint64_t tci_qemu_ld(CPUArchState *env, target_ulong taddr,
                              TCGMemOpIdx oi, const void *tb_ptr)
  {
-     MemOp mop = get_memop(oi) & (MO_BSWAP | MO_SSIZE);
+     return cs->interrupt_request & CPU_INTERRUPT_HARD;
 +#ifdef CONFIG_SOFTMMU
 +    uintptr_t ra = (uintptr_t)tb_ptr;
 +
      switch (mop) {
      case MO_UB:
 -        return qemu_ld_ub;
 +        return helper_ret_ldub_mmu(env, taddr, oi, ra);
      case MO_SB:
 -        return (int8_t)qemu_ld_ub;
 +        return helper_ret_ldsb_mmu(env, taddr, oi, ra);
      case MO_LEUW:
 -        return qemu_ld_leuw;
 +        return helper_le_lduw_mmu(env, taddr, oi, ra);
      case MO_LESW:
 -        return (int16_t)qemu_ld_leuw;
 +        return helper_le_ldsw_mmu(env, taddr, oi, ra);
      case MO_LEUL:
 -        return qemu_ld_leul;
 +        return helper_le_ldul_mmu(env, taddr, oi, ra);
      case MO_LESL:
 -        return (int32_t)qemu_ld_leul;
 +        return helper_le_ldsl_mmu(env, taddr, oi, ra);
      case MO_LEQ:
 -        return qemu_ld_leq;
 +        return helper_le_ldq_mmu(env, taddr, oi, ra);
      case MO_BEUW:
 -        return qemu_ld_beuw;
 +        return helper_be_lduw_mmu(env, taddr, oi, ra);
      case MO_BESW:
 -        return (int16_t)qemu_ld_beuw;
 +        return helper_be_ldsw_mmu(env, taddr, oi, ra);
      case MO_BEUL:
 -        return qemu_ld_beul;
 +        return helper_be_ldul_mmu(env, taddr, oi, ra);
      case MO_BESL:
 -        return (int32_t)qemu_ld_beul;
 +        return helper_be_ldsl_mmu(env, taddr, oi, ra);
      case MO_BEQ:
 -        return qemu_ld_beq;
 +        return helper_be_ldq_mmu(env, taddr, oi, ra);
      default:
          g_assert_not_reached();
      }
 +#else
 +    void *haddr = g2h(env_cpu(env), taddr);
 +    uint64_t ret;
 +
 +    switch (mop) {
 +    case MO_UB:
 +        ret = ldub_p(haddr);
 +        break;
 +    case MO_SB:
 +        ret = ldsb_p(haddr);
 +        break;
 +    case MO_LEUW:
 +        ret = lduw_le_p(haddr);
 +        break;
 +    case MO_LESW:
 +        ret = ldsw_le_p(haddr);
 +        break;
 +    case MO_LEUL:
 +        ret = (uint32_t)ldl_le_p(haddr);
 +        break;
 +    case MO_LESL:
 +        ret = (int32_t)ldl_le_p(haddr);
 +        break;
 +    case MO_LEQ:
 +        ret = ldq_le_p(haddr);
 +        break;
 +    case MO_BEUW:
 +        ret = lduw_be_p(haddr);
 +        break;
 +    case MO_BESW:
 +        ret = ldsw_be_p(haddr);
 +        break;
 +    case MO_BEUL:
 +        ret = (uint32_t)ldl_be_p(haddr);
 +        break;
 +    case MO_BESL:
 +        ret = (int32_t)ldl_be_p(haddr);
 +        break;
 +    case MO_BEQ:
 +        ret = ldq_be_p(haddr);
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +    return ret;
 +#endif
  }
++#endif /* !CONFIG_USER_ONLY */
- static void tci_qemu_st(CPUArchState *env, target_ulong taddr, uint64_t val,
-@@ -XXX,XX +XXX,XX @@ static void tci_qemu_st(CPUArchState *env, target_ulong taddr, uint64_t val,
+ static void m68k_set_feature(CPUM68KState *env, int feature)
  {
-     MemOp mop = get_memop(oi) & (MO_BSWAP | MO_SSIZE);
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps m68k_tcg_ops = {
+     .tlb_fill = m68k_cpu_tlb_fill,
-+#ifdef CONFIG_SOFTMMU
-+    uintptr_t ra = (uintptr_t)tb_ptr;
+ #ifndef CONFIG_USER_ONLY
-+
++    .has_work = m68k_cpu_has_work,
-     switch (mop) {
+     .cpu_exec_interrupt = m68k_cpu_exec_interrupt,
-     case MO_UB:
+     .do_interrupt = m68k_cpu_do_interrupt,
--        qemu_st_b(val);
+     .do_transaction_failed = m68k_cpu_transaction_failed,
-+        helper_ret_stb_mmu(env, taddr, val, oi, ra);
+@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
-         break;
+     device_class_set_parent_reset(dc, m68k_cpu_reset, &mcc->parent_reset);
-     case MO_LEUW:
--        qemu_st_lew(val);
+     cc->class_by_name = m68k_cpu_class_by_name;
-+        helper_le_stw_mmu(env, taddr, val, oi, ra);
+-    cc->has_work = m68k_cpu_has_work;
-         break;
+     cc->dump_state = m68k_cpu_dump_state;
-     case MO_LEUL:
+     cc->set_pc = m68k_cpu_set_pc;
--        qemu_st_lel(val);
+     cc->gdb_read_register = m68k_cpu_gdb_read_register;
 +        helper_le_stl_mmu(env, taddr, val, oi, ra);
          break;
      case MO_LEQ:
 -        qemu_st_leq(val);
 +        helper_le_stq_mmu(env, taddr, val, oi, ra);
          break;
      case MO_BEUW:
 -        qemu_st_bew(val);
 +        helper_be_stw_mmu(env, taddr, val, oi, ra);
          break;
      case MO_BEUL:
 -        qemu_st_bel(val);
 +        helper_be_stl_mmu(env, taddr, val, oi, ra);
          break;
      case MO_BEQ:
 -        qemu_st_beq(val);
 +        helper_be_stq_mmu(env, taddr, val, oi, ra);
          break;
      default:
          g_assert_not_reached();
      }
 +#else
 +    void *haddr = g2h(env_cpu(env), taddr);
 +
 +    switch (mop) {
 +    case MO_UB:
 +        stb_p(haddr, val);
 +        break;
 +    case MO_LEUW:
 +        stw_le_p(haddr, val);
 +        break;
 +    case MO_LEUL:
 +        stl_le_p(haddr, val);
 +        break;
 +    case MO_LEQ:
 +        stq_le_p(haddr, val);
 +        break;
 +    case MO_BEUW:
 +        stw_be_p(haddr, val);
 +        break;
 +    case MO_BEUL:
 +        stl_be_p(haddr, val);
 +        break;
 +    case MO_BEQ:
 +        stq_be_p(haddr, val);
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +#endif
  }
  #if TCG_TARGET_REG_BITS == 64
 --
 .25.1

-[PULL 22/33] tcg/tci: Implement add2, sub2
+[PULL 17/35] target/microblaze: Restrict has_work() handler to sysemu
-We already had the 32-bit versions for a 32-bit host; expand this
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 to 64-bit hosts as well.  The 64-bit opcodes are new.
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Restrict has_work() to sysemu.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210912172731.789788-17-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci/tcg-target.h     |  8 ++++----
+ target/microblaze/cpu.c | 8 ++++----
- tcg/tci.c                | 40 ++++++++++++++++++++++++++--------------
+file changed, 4 insertions(+), 4 deletions(-)
  tcg/tci/tcg-target.c.inc | 15 ++++++++-------
 files changed, 38 insertions(+), 25 deletions(-)
-diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
+diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target.h
+--- a/target/microblaze/cpu.c
-+++ b/tcg/tci/tcg-target.h
++++ b/target/microblaze/cpu.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void mb_cpu_synchronize_from_tb(CPUState *cs,
- #define TCG_TARGET_HAS_rot_i64          1
+     cpu->env.iflags = tb->flags & IFLAGS_TB_MASK;
  #define TCG_TARGET_HAS_movcond_i64      1
  #define TCG_TARGET_HAS_muls2_i64        1
 -#define TCG_TARGET_HAS_add2_i32         0
 -#define TCG_TARGET_HAS_sub2_i32         0
 +#define TCG_TARGET_HAS_add2_i32         1
 +#define TCG_TARGET_HAS_sub2_i32         1
  #define TCG_TARGET_HAS_mulu2_i32        1
 -#define TCG_TARGET_HAS_add2_i64         0
 -#define TCG_TARGET_HAS_sub2_i64         0
 +#define TCG_TARGET_HAS_add2_i64         1
 +#define TCG_TARGET_HAS_sub2_i64         1
  #define TCG_TARGET_HAS_mulu2_i64        1
  #define TCG_TARGET_HAS_muluh_i64        0
  #define TCG_TARGET_HAS_mulsh_i64        0
 diff --git a/tcg/tci.c b/tcg/tci.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci.c
 +++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ static void tci_args_rrrrrc(uint32_t insn, TCGReg *r0, TCGReg *r1,
      *c5 = extract32(insn, 28, 4);
  }
--#if TCG_TARGET_REG_BITS == 32
++#ifndef CONFIG_USER_ONLY
- static void tci_args_rrrrrr(uint32_t insn, TCGReg *r0, TCGReg *r1,
++
-                             TCGReg *r2, TCGReg *r3, TCGReg *r4, TCGReg *r5)
+ static bool mb_cpu_has_work(CPUState *cs)
  {
-@@ -XXX,XX +XXX,XX @@ static void tci_args_rrrrrr(uint32_t insn, TCGReg *r0, TCGReg *r1,
+     return cs->interrupt_request & (CPU_INTERRUPT_HARD | CPU_INTERRUPT_NMI);
-     *r4 = extract32(insn, 24, 4);
+ }
-     *r5 = extract32(insn, 28, 4);
 -#ifndef CONFIG_USER_ONLY
  static void mb_cpu_ns_axi_dp(void *opaque, int irq, int level)
  {
      MicroBlazeCPU *cpu = opaque;
@@ -XXX,XX +XXX,XX @@ static void microblaze_cpu_set_irq(void *opaque, int irq, int level)
          cpu_reset_interrupt(cs, type);
      }
  }
 -#endif
++#endif /* !CONFIG_USER_ONLY */
- static bool tci_compare32(uint32_t u0, uint32_t u1, TCGCond condition)
  static void mb_cpu_reset(DeviceState *dev)
  {
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps mb_tcg_ops = {
-     for (;;) {
+     .tlb_fill = mb_cpu_tlb_fill,
-         uint32_t insn;
-         TCGOpcode opc;
+ #ifndef CONFIG_USER_ONLY
--        TCGReg r0, r1, r2, r3, r4;
++    .has_work = mb_cpu_has_work,
-+        TCGReg r0, r1, r2, r3, r4, r5;
+     .cpu_exec_interrupt = mb_cpu_exec_interrupt,
-         tcg_target_ulong t1;
+     .do_interrupt = mb_cpu_do_interrupt,
-         TCGCond condition;
+     .do_transaction_failed = mb_cpu_transaction_failed,
-         target_ulong taddr;
+@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
-         uint8_t pos, len;
+     device_class_set_parent_reset(dc, mb_cpu_reset, &mcc->parent_reset);
-         uint32_t tmp32;
-         uint64_t tmp64;
+     cc->class_by_name = mb_cpu_class_by_name;
--#if TCG_TARGET_REG_BITS == 32
+-    cc->has_work = mb_cpu_has_work;
--        TCGReg r5;
+-
-         uint64_t T1, T2;
+     cc->dump_state = mb_cpu_dump_state;
--#endif
+     cc->set_pc = mb_cpu_set_pc;
-         TCGMemOpIdx oi;
+     cc->gdb_read_register = mb_cpu_gdb_read_register;
          int32_t ofs;
          void *ptr;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                  tb_ptr = ptr;
              }
              break;
 -#if TCG_TARGET_REG_BITS == 32
 +#if TCG_TARGET_REG_BITS == 32 || TCG_TARGET_HAS_add2_i32
          case INDEX_op_add2_i32:
              tci_args_rrrrrr(insn, &r0, &r1, &r2, &r3, &r4, &r5);
              T1 = tci_uint64(regs[r3], regs[r2]);
              T2 = tci_uint64(regs[r5], regs[r4]);
              tci_write_reg64(regs, r1, r0, T1 + T2);
              break;
 +#endif
 +#if TCG_TARGET_REG_BITS == 32 || TCG_TARGET_HAS_sub2_i32
          case INDEX_op_sub2_i32:
              tci_args_rrrrrr(insn, &r0, &r1, &r2, &r3, &r4, &r5);
              T1 = tci_uint64(regs[r3], regs[r2]);
              T2 = tci_uint64(regs[r5], regs[r4]);
              tci_write_reg64(regs, r1, r0, T1 - T2);
              break;
 -#endif /* TCG_TARGET_REG_BITS == 32 */
 +#endif
  #if TCG_TARGET_HAS_mulu2_i32
          case INDEX_op_mulu2_i32:
              tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              muls64(&regs[r0], &regs[r1], regs[r2], regs[r3]);
              break;
  #endif
 +#if TCG_TARGET_HAS_add2_i64
 +        case INDEX_op_add2_i64:
 +            tci_args_rrrrrr(insn, &r0, &r1, &r2, &r3, &r4, &r5);
 +            T1 = regs[r2] + regs[r4];
 +            T2 = regs[r3] + regs[r5] + (T1 < regs[r2]);
 +            regs[r0] = T1;
 +            regs[r1] = T2;
 +            break;
 +#endif
 +#if TCG_TARGET_HAS_add2_i64
 +        case INDEX_op_sub2_i64:
 +            tci_args_rrrrrr(insn, &r0, &r1, &r2, &r3, &r4, &r5);
 +            T1 = regs[r2] - regs[r4];
 +            T2 = regs[r3] - regs[r5] - (regs[r2] < regs[r4]);
 +            regs[r0] = T1;
 +            regs[r1] = T2;
 +            break;
 +#endif
              /* Shift/rotate operations (64 bit). */
@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
      const char *op_name;
      uint32_t insn;
      TCGOpcode op;
 -    TCGReg r0, r1, r2, r3, r4;
 -#if TCG_TARGET_REG_BITS == 32
 -    TCGReg r5;
 -#endif
 +    TCGReg r0, r1, r2, r3, r4, r5;
      tcg_target_ulong i1;
      int32_t s2;
      TCGCond c;
@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
                             str_r(r2), str_r(r3));
          break;
 -#if TCG_TARGET_REG_BITS == 32
      case INDEX_op_add2_i32:
 +    case INDEX_op_add2_i64:
      case INDEX_op_sub2_i32:
 +    case INDEX_op_sub2_i64:
          tci_args_rrrrrr(insn, &r0, &r1, &r2, &r3, &r4, &r5);
          info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s, %s, %s",
                             op_name, str_r(r0), str_r(r1), str_r(r2),
                             str_r(r3), str_r(r4), str_r(r5));
          break;
 -#endif
      case INDEX_op_qemu_ld_i64:
      case INDEX_op_qemu_st_i64:
 diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.c.inc
 +++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
      case INDEX_op_brcond_i64:
          return C_O0_I2(r, r);
 -#if TCG_TARGET_REG_BITS == 32
 -    /* TODO: Support R, R, R, R, RI, RI? Will it be faster? */
      case INDEX_op_add2_i32:
 +    case INDEX_op_add2_i64:
      case INDEX_op_sub2_i32:
 +    case INDEX_op_sub2_i64:
          return C_O2_I4(r, r, r, r, r, r);
 +
 +#if TCG_TARGET_REG_BITS == 32
      case INDEX_op_brcond2_i32:
          return C_O0_I4(r, r, r, r);
  #endif
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op_rrrrrc(TCGContext *s, TCGOpcode op,
      tcg_out32(s, insn);
  }
 -#if TCG_TARGET_REG_BITS == 32
  static void tcg_out_op_rrrrrr(TCGContext *s, TCGOpcode op,
                                TCGReg r0, TCGReg r1, TCGReg r2,
                                TCGReg r3, TCGReg r4, TCGReg r5)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op_rrrrrr(TCGContext *s, TCGOpcode op,
      insn = deposit32(insn, 28, 4, r5);
      tcg_out32(s, insn);
  }
 -#endif
  static void tcg_out_ldst(TCGContext *s, TCGOpcode op, TCGReg val,
                           TCGReg base, intptr_t offset)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          tcg_out_op_rr(s, opc, args[0], args[1]);
          break;
 -#if TCG_TARGET_REG_BITS == 32
 -    case INDEX_op_add2_i32:
 -    case INDEX_op_sub2_i32:
 +    CASE_32_64(add2)
 +    CASE_32_64(sub2)
          tcg_out_op_rrrrrr(s, opc, args[0], args[1], args[2],
                            args[3], args[4], args[5]);
          break;
 +
 +#if TCG_TARGET_REG_BITS == 32
      case INDEX_op_brcond2_i32:
          tcg_out_op_rrrrrc(s, INDEX_op_setcond2_i32, TCG_REG_TMP,
                            args[0], args[1], args[2], args[3], args[4]);
 --
 .25.1

-[PULL 24/33] Revert "tcg/tci: Use exec/cpu_ldst.h interfaces"
+[PULL 18/35] target/mips: Restrict has_work() handler to sysemu and TCG
-This reverts commit dc09f047eddec8f4a1991c4f5f4a428d7aa3f2c0.
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-For tcg, tracepoints are expanded inline in tcg opcodes.
+Restrict has_work() to TCG sysemu.
 Using a helper which generates a second tracepoint is incorrect.
-For system mode, the extraction and re-packing of MemOp and mmu_idx
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-lost the alignment information from MemOp.  So we were no longer
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-raising alignment exceptions for !TARGET_ALIGNED_ONLY guests.
+Message-Id: <20210912172731.789788-18-f4bug@amsat.org>
 This can be seen in tests/tcg/xtensa/test_load_store.S.
 For user mode, we must update to the new signature of g2h() so that
 the revert compiles.  We can leave set_helper_retaddr for later.
 Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c | 73 ++++++++++++++++++++++++++++++++++---------------------
+ target/mips/cpu.c | 4 +++-
-file changed, 45 insertions(+), 28 deletions(-)
+file changed, 3 insertions(+), 1 deletion(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
+diff --git a/target/mips/cpu.c b/target/mips/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/target/mips/cpu.c
-+++ b/tcg/tci.c
++++ b/target/mips/cpu.c
-@@ -XXX,XX +XXX,XX @@ static bool tci_compare64(uint64_t u0, uint64_t u1, TCGCond condition)
+@@ -XXX,XX +XXX,XX @@ static void mips_cpu_set_pc(CPUState *cs, vaddr value)
-     return result;
+     mips_env_set_pc(&cpu->env, value);
  }
--#define qemu_ld_ub \
++#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
--    cpu_ldub_mmuidx_ra(env, taddr, get_mmuidx(oi), (uintptr_t)tb_ptr)
+ static bool mips_cpu_has_work(CPUState *cs)
--#define qemu_ld_leuw \
+ {
--    cpu_lduw_le_mmuidx_ra(env, taddr, get_mmuidx(oi), (uintptr_t)tb_ptr)
+     MIPSCPU *cpu = MIPS_CPU(cs);
--#define qemu_ld_leul \
+@@ -XXX,XX +XXX,XX @@ static bool mips_cpu_has_work(CPUState *cs)
--    cpu_ldl_le_mmuidx_ra(env, taddr, get_mmuidx(oi), (uintptr_t)tb_ptr)
+     }
--#define qemu_ld_leq \
+     return has_work;
--    cpu_ldq_le_mmuidx_ra(env, taddr, get_mmuidx(oi), (uintptr_t)tb_ptr)
+ }
--#define qemu_ld_beuw \
++#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
--    cpu_lduw_be_mmuidx_ra(env, taddr, get_mmuidx(oi), (uintptr_t)tb_ptr)
--#define qemu_ld_beul \
+ #include "cpu-defs.c.inc"
--    cpu_ldl_be_mmuidx_ra(env, taddr, get_mmuidx(oi), (uintptr_t)tb_ptr)
--#define qemu_ld_beq \
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps mips_tcg_ops = {
--    cpu_ldq_be_mmuidx_ra(env, taddr, get_mmuidx(oi), (uintptr_t)tb_ptr)
+     .tlb_fill = mips_cpu_tlb_fill,
--#define qemu_st_b(X) \
--    cpu_stb_mmuidx_ra(env, taddr, X, get_mmuidx(oi), (uintptr_t)tb_ptr)
+ #if !defined(CONFIG_USER_ONLY)
--#define qemu_st_lew(X) \
++    .has_work = mips_cpu_has_work,
--    cpu_stw_le_mmuidx_ra(env, taddr, X, get_mmuidx(oi), (uintptr_t)tb_ptr)
+     .cpu_exec_interrupt = mips_cpu_exec_interrupt,
--#define qemu_st_lel(X) \
+     .do_interrupt = mips_cpu_do_interrupt,
--    cpu_stl_le_mmuidx_ra(env, taddr, X, get_mmuidx(oi), (uintptr_t)tb_ptr)
+     .do_transaction_failed = mips_cpu_do_transaction_failed,
--#define qemu_st_leq(X) \
+@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
--    cpu_stq_le_mmuidx_ra(env, taddr, X, get_mmuidx(oi), (uintptr_t)tb_ptr)
+     device_class_set_props(dc, mips_cpu_properties);
--#define qemu_st_bew(X) \
--    cpu_stw_be_mmuidx_ra(env, taddr, X, get_mmuidx(oi), (uintptr_t)tb_ptr)
+     cc->class_by_name = mips_cpu_class_by_name;
--#define qemu_st_bel(X) \
+-    cc->has_work = mips_cpu_has_work;
--    cpu_stl_be_mmuidx_ra(env, taddr, X, get_mmuidx(oi), (uintptr_t)tb_ptr)
+     cc->dump_state = mips_cpu_dump_state;
--#define qemu_st_beq(X) \
+     cc->set_pc = mips_cpu_set_pc;
--    cpu_stq_be_mmuidx_ra(env, taddr, X, get_mmuidx(oi), (uintptr_t)tb_ptr)
+     cc->gdb_read_register = mips_cpu_gdb_read_register;
 +#ifdef CONFIG_SOFTMMU
 +# define qemu_ld_ub \
 +    helper_ret_ldub_mmu(env, taddr, oi, (uintptr_t)tb_ptr)
 +# define qemu_ld_leuw \
 +    helper_le_lduw_mmu(env, taddr, oi, (uintptr_t)tb_ptr)
 +# define qemu_ld_leul \
 +    helper_le_ldul_mmu(env, taddr, oi, (uintptr_t)tb_ptr)
 +# define qemu_ld_leq \
 +    helper_le_ldq_mmu(env, taddr, oi, (uintptr_t)tb_ptr)
 +# define qemu_ld_beuw \
 +    helper_be_lduw_mmu(env, taddr, oi, (uintptr_t)tb_ptr)
 +# define qemu_ld_beul \
 +    helper_be_ldul_mmu(env, taddr, oi, (uintptr_t)tb_ptr)
 +# define qemu_ld_beq \
 +    helper_be_ldq_mmu(env, taddr, oi, (uintptr_t)tb_ptr)
 +# define qemu_st_b(X) \
 +    helper_ret_stb_mmu(env, taddr, X, oi, (uintptr_t)tb_ptr)
 +# define qemu_st_lew(X) \
 +    helper_le_stw_mmu(env, taddr, X, oi, (uintptr_t)tb_ptr)
 +# define qemu_st_lel(X) \
 +    helper_le_stl_mmu(env, taddr, X, oi, (uintptr_t)tb_ptr)
 +# define qemu_st_leq(X) \
 +    helper_le_stq_mmu(env, taddr, X, oi, (uintptr_t)tb_ptr)
 +# define qemu_st_bew(X) \
 +    helper_be_stw_mmu(env, taddr, X, oi, (uintptr_t)tb_ptr)
 +# define qemu_st_bel(X) \
 +    helper_be_stl_mmu(env, taddr, X, oi, (uintptr_t)tb_ptr)
 +# define qemu_st_beq(X) \
 +    helper_be_stq_mmu(env, taddr, X, oi, (uintptr_t)tb_ptr)
 +#else
 +# define qemu_ld_ub      ldub_p(g2h(env_cpu(env), taddr))
 +# define qemu_ld_leuw    lduw_le_p(g2h(env_cpu(env), taddr))
 +# define qemu_ld_leul    (uint32_t)ldl_le_p(g2h(env_cpu(env), taddr))
 +# define qemu_ld_leq     ldq_le_p(g2h(env_cpu(env), taddr))
 +# define qemu_ld_beuw    lduw_be_p(g2h(env_cpu(env), taddr))
 +# define qemu_ld_beul    (uint32_t)ldl_be_p(g2h(env_cpu(env), taddr))
 +# define qemu_ld_beq     ldq_be_p(g2h(env_cpu(env), taddr))
 +# define qemu_st_b(X)    stb_p(g2h(env_cpu(env), taddr), X)
 +# define qemu_st_lew(X)  stw_le_p(g2h(env_cpu(env), taddr), X)
 +# define qemu_st_lel(X)  stl_le_p(g2h(env_cpu(env), taddr), X)
 +# define qemu_st_leq(X)  stq_le_p(g2h(env_cpu(env), taddr), X)
 +# define qemu_st_bew(X)  stw_be_p(g2h(env_cpu(env), taddr), X)
 +# define qemu_st_bel(X)  stl_be_p(g2h(env_cpu(env), taddr), X)
 +# define qemu_st_beq(X)  stq_be_p(g2h(env_cpu(env), taddr), X)
 +#endif
  static uint64_t tci_qemu_ld(CPUArchState *env, target_ulong taddr,
                              TCGMemOpIdx oi, const void *tb_ptr)
 --
 .25.1

-[PULL 18/33] tcg/tci: Implement andc, orc, eqv, nand, nor
+[PULL 19/35] target/nios2: Restrict has_work() handler to sysemu
-These were already present in tcg-target.c.inc,
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 but not in the interpreter.
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Restrict has_work() to sysemu.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210912172731.789788-19-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci/tcg-target.h | 20 ++++++++++----------
+ target/nios2/cpu.c | 4 +++-
- tcg/tci.c            | 40 ++++++++++++++++++++++++++++++++++++++++
+file changed, 3 insertions(+), 1 deletion(-)
 files changed, 50 insertions(+), 10 deletions(-)
-diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
+diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target.h
+--- a/target/nios2/cpu.c
-+++ b/tcg/tci/tcg-target.h
++++ b/target/nios2/cpu.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_set_pc(CPUState *cs, vaddr value)
- #define TCG_TARGET_HAS_ext16s_i32       1
+     env->regs[R_PC] = value;
- #define TCG_TARGET_HAS_ext8u_i32        1
+ }
- #define TCG_TARGET_HAS_ext16u_i32       1
--#define TCG_TARGET_HAS_andc_i32         0
++#if !defined(CONFIG_USER_ONLY)
-+#define TCG_TARGET_HAS_andc_i32         1
+ static bool nios2_cpu_has_work(CPUState *cs)
- #define TCG_TARGET_HAS_deposit_i32      1
+ {
- #define TCG_TARGET_HAS_extract_i32      0
+     return cs->interrupt_request & (CPU_INTERRUPT_HARD | CPU_INTERRUPT_NMI);
- #define TCG_TARGET_HAS_sextract_i32     0
+ }
- #define TCG_TARGET_HAS_extract2_i32     0
++#endif /* !CONFIG_USER_ONLY */
--#define TCG_TARGET_HAS_eqv_i32          0
--#define TCG_TARGET_HAS_nand_i32         0
+ static void nios2_cpu_reset(DeviceState *dev)
--#define TCG_TARGET_HAS_nor_i32          0
+ {
-+#define TCG_TARGET_HAS_eqv_i32          1
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps nios2_tcg_ops = {
-+#define TCG_TARGET_HAS_nand_i32         1
+     .tlb_fill = nios2_cpu_tlb_fill,
-+#define TCG_TARGET_HAS_nor_i32          1
- #define TCG_TARGET_HAS_clz_i32          0
+ #ifndef CONFIG_USER_ONLY
- #define TCG_TARGET_HAS_ctz_i32          0
++    .has_work = nios2_cpu_has_work,
- #define TCG_TARGET_HAS_ctpop_i32        0
+     .cpu_exec_interrupt = nios2_cpu_exec_interrupt,
- #define TCG_TARGET_HAS_neg_i32          1
+     .do_interrupt = nios2_cpu_do_interrupt,
- #define TCG_TARGET_HAS_not_i32          1
+     .do_unaligned_access = nios2_cpu_do_unaligned_access,
--#define TCG_TARGET_HAS_orc_i32          0
+@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
-+#define TCG_TARGET_HAS_orc_i32          1
+     device_class_set_parent_reset(dc, nios2_cpu_reset, &ncc->parent_reset);
- #define TCG_TARGET_HAS_rot_i32          1
- #define TCG_TARGET_HAS_movcond_i32      1
+     cc->class_by_name = nios2_cpu_class_by_name;
- #define TCG_TARGET_HAS_muls2_i32        0
+-    cc->has_work = nios2_cpu_has_work;
-@@ -XXX,XX +XXX,XX @@
+     cc->dump_state = nios2_cpu_dump_state;
- #define TCG_TARGET_HAS_ext8u_i64        1
+     cc->set_pc = nios2_cpu_set_pc;
- #define TCG_TARGET_HAS_ext16u_i64       1
+     cc->disas_set_info = nios2_cpu_disas_set_info;
  #define TCG_TARGET_HAS_ext32u_i64       1
 -#define TCG_TARGET_HAS_andc_i64         0
 -#define TCG_TARGET_HAS_eqv_i64          0
 -#define TCG_TARGET_HAS_nand_i64         0
 -#define TCG_TARGET_HAS_nor_i64          0
 +#define TCG_TARGET_HAS_andc_i64         1
 +#define TCG_TARGET_HAS_eqv_i64          1
 +#define TCG_TARGET_HAS_nand_i64         1
 +#define TCG_TARGET_HAS_nor_i64          1
  #define TCG_TARGET_HAS_clz_i64          0
  #define TCG_TARGET_HAS_ctz_i64          0
  #define TCG_TARGET_HAS_ctpop_i64        0
  #define TCG_TARGET_HAS_neg_i64          1
  #define TCG_TARGET_HAS_not_i64          1
 -#define TCG_TARGET_HAS_orc_i64          0
 +#define TCG_TARGET_HAS_orc_i64          1
  #define TCG_TARGET_HAS_rot_i64          1
  #define TCG_TARGET_HAS_movcond_i64      1
  #define TCG_TARGET_HAS_muls2_i64        0
 diff --git a/tcg/tci.c b/tcg/tci.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci.c
 +++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              tci_args_rrr(insn, &r0, &r1, &r2);
              regs[r0] = regs[r1] ^ regs[r2];
              break;
 +#if TCG_TARGET_HAS_andc_i32 || TCG_TARGET_HAS_andc_i64
 +        CASE_32_64(andc)
 +            tci_args_rrr(insn, &r0, &r1, &r2);
 +            regs[r0] = regs[r1] & ~regs[r2];
 +            break;
 +#endif
 +#if TCG_TARGET_HAS_orc_i32 || TCG_TARGET_HAS_orc_i64
 +        CASE_32_64(orc)
 +            tci_args_rrr(insn, &r0, &r1, &r2);
 +            regs[r0] = regs[r1] | ~regs[r2];
 +            break;
 +#endif
 +#if TCG_TARGET_HAS_eqv_i32 || TCG_TARGET_HAS_eqv_i64
 +        CASE_32_64(eqv)
 +            tci_args_rrr(insn, &r0, &r1, &r2);
 +            regs[r0] = ~(regs[r1] ^ regs[r2]);
 +            break;
 +#endif
 +#if TCG_TARGET_HAS_nand_i32 || TCG_TARGET_HAS_nand_i64
 +        CASE_32_64(nand)
 +            tci_args_rrr(insn, &r0, &r1, &r2);
 +            regs[r0] = ~(regs[r1] & regs[r2]);
 +            break;
 +#endif
 +#if TCG_TARGET_HAS_nor_i32 || TCG_TARGET_HAS_nor_i64
 +        CASE_32_64(nor)
 +            tci_args_rrr(insn, &r0, &r1, &r2);
 +            regs[r0] = ~(regs[r1] | regs[r2]);
 +            break;
 +#endif
              /* Arithmetic operations (32 bit). */
@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
      case INDEX_op_or_i64:
      case INDEX_op_xor_i32:
      case INDEX_op_xor_i64:
 +    case INDEX_op_andc_i32:
 +    case INDEX_op_andc_i64:
 +    case INDEX_op_orc_i32:
 +    case INDEX_op_orc_i64:
 +    case INDEX_op_eqv_i32:
 +    case INDEX_op_eqv_i64:
 +    case INDEX_op_nand_i32:
 +    case INDEX_op_nand_i64:
 +    case INDEX_op_nor_i32:
 +    case INDEX_op_nor_i64:
      case INDEX_op_div_i32:
      case INDEX_op_div_i64:
      case INDEX_op_rem_i32:
 --
 .25.1

-[PULL 12/33] tcg/tci: Reserve r13 for a temporary
+[PULL 20/35] target/openrisc: Restrict has_work() handler to sysemu
-We're about to adjust the offset range on host memory ops,
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 and the format of branches.  Both will require a temporary.
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Restrict has_work() to sysemu.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210912172731.789788-20-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci/tcg-target.h     | 1 +
+ target/openrisc/cpu.c | 4 +++-
- tcg/tci/tcg-target.c.inc | 1 +
+file changed, 3 insertions(+), 1 deletion(-)
 files changed, 2 insertions(+)
-diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
+diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target.h
+--- a/target/openrisc/cpu.c
-+++ b/tcg/tci/tcg-target.h
++++ b/target/openrisc/cpu.c
-@@ -XXX,XX +XXX,XX @@ typedef enum {
+@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_set_pc(CPUState *cs, vaddr value)
-     TCG_REG_R14,
+     cpu->env.dflag = 0;
-     TCG_REG_R15,
+ }
-+    TCG_REG_TMP = TCG_REG_R13,
++#if !defined(CONFIG_USER_ONLY)
-     TCG_AREG0 = TCG_REG_R14,
+ static bool openrisc_cpu_has_work(CPUState *cs)
-     TCG_REG_CALL_STACK = TCG_REG_R15,
+ {
- } TCGReg;
+     return cs->interrupt_request & (CPU_INTERRUPT_HARD |
-diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
+                                     CPU_INTERRUPT_TIMER);
-index XXXXXXX..XXXXXXX 100644
+ }
---- a/tcg/tci/tcg-target.c.inc
++#endif /* !CONFIG_USER_ONLY */
-+++ b/tcg/tci/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static void tcg_target_init(TCGContext *s)
+ static void openrisc_disas_set_info(CPUState *cpu, disassemble_info *info)
-         MAKE_64BIT_MASK(TCG_REG_R0, 64 / TCG_TARGET_REG_BITS);
+ {
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps openrisc_tcg_ops = {
-     s->reserved_regs = 0;
+     .tlb_fill = openrisc_cpu_tlb_fill,
-+    tcg_regset_set_reg(s->reserved_regs, TCG_REG_TMP);
-     tcg_regset_set_reg(s->reserved_regs, TCG_REG_CALL_STACK);
+ #ifndef CONFIG_USER_ONLY
++    .has_work = openrisc_cpu_has_work,
-     /* The call arguments come first, followed by the temp storage. */
+     .cpu_exec_interrupt = openrisc_cpu_exec_interrupt,
      .do_interrupt = openrisc_cpu_do_interrupt,
  #endif /* !CONFIG_USER_ONLY */
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
      device_class_set_parent_reset(dc, openrisc_cpu_reset, &occ->parent_reset);
      cc->class_by_name = openrisc_cpu_class_by_name;
 -    cc->has_work = openrisc_cpu_has_work;
      cc->dump_state = openrisc_cpu_dump_state;
      cc->set_pc = openrisc_cpu_set_pc;
      cc->gdb_read_register = openrisc_cpu_gdb_read_register;
 --
 .25.1

-[PULL 16/33] tcg/tci: Implement goto_ptr
+[PULL 21/35] target/ppc: Introduce PowerPCCPUClass::has_work()
-This operation is critical to staying within the interpretation
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 loop longer, which avoids the overhead of setup and teardown for
 many TBs.
-The check in tcg_prologue_init is disabled because TCI does
+We're moving the hook from CPUState to TCGCPUOps. TCGCPUOps is
-want to use NULL to indicate exit, as opposed to branching to
+a const structure, so to avoid creating multiple versions of
-a real epilogue.
+the same structure, simply changing the has_work() handler,
 introduce yet another indirection with a has_work() handler in
 PowerPCCPUClass, and ppc_cpu_has_work() method which dispatch
 to it.
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210912172731.789788-21-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci/tcg-target-con-set.h |  1 +
+ target/ppc/cpu-qom.h  |  1 +
- tcg/tci/tcg-target.h         |  2 +-
+ target/ppc/cpu_init.c | 23 ++++++++++++++---------
- tcg/tcg.c                    |  8 +++++++-
+files changed, 15 insertions(+), 9 deletions(-)
  tcg/tci.c                    | 19 +++++++++++++++++++
  tcg/tci/tcg-target.c.inc     | 16 ++++++++++++++++
 files changed, 44 insertions(+), 2 deletions(-)
-diff --git a/tcg/tci/tcg-target-con-set.h b/tcg/tci/tcg-target-con-set.h
+diff --git a/target/ppc/cpu-qom.h b/target/ppc/cpu-qom.h
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target-con-set.h
+--- a/target/ppc/cpu-qom.h
-+++ b/tcg/tci/tcg-target-con-set.h
++++ b/target/ppc/cpu-qom.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ struct PowerPCCPUClass {
-  * Each operand should be a sequence of constraint letters as defined by
+     uint32_t flags;
-  * tcg-target-con-str.h; the constraint combination is inclusive or.
+     int bfd_mach;
-  */
+     uint32_t l1_dcache_size, l1_icache_size;
-+C_O0_I1(r)
++    bool (*has_work)(CPUState *cpu);
- C_O0_I2(r, r)
+ #ifndef CONFIG_USER_ONLY
- C_O0_I3(r, r, r)
+     unsigned int gdb_num_sprs;
- C_O0_I4(r, r, r, r)
+     const char *gdb_spr_xml;
-diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
+diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target.h
+--- a/target/ppc/cpu_init.c
-+++ b/tcg/tci/tcg-target.h
++++ b/target/ppc/cpu_init.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER7)(ObjectClass *oc, void *data)
- #define TCG_TARGET_HAS_muls2_i32        0
+ {
- #define TCG_TARGET_HAS_muluh_i32        0
+     DeviceClass *dc = DEVICE_CLASS(oc);
- #define TCG_TARGET_HAS_mulsh_i32        0
+     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
--#define TCG_TARGET_HAS_goto_ptr         0
+-    CPUClass *cc = CPU_CLASS(oc);
-+#define TCG_TARGET_HAS_goto_ptr         1
- #define TCG_TARGET_HAS_direct_jump      0
+     dc->fw_name = "PowerPC,POWER7";
- #define TCG_TARGET_HAS_qemu_st8_i32     0
+     dc->desc = "POWER7";
+@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER7)(ObjectClass *oc, void *data)
-diff --git a/tcg/tcg.c b/tcg/tcg.c
+     pcc->pcr_supported = PCR_COMPAT_2_06 | PCR_COMPAT_2_05;
-index XXXXXXX..XXXXXXX 100644
+     pcc->init_proc = init_proc_POWER7;
---- a/tcg/tcg.c
+     pcc->check_pow = check_pow_nocheck;
-+++ b/tcg/tcg.c
+-    cc->has_work = cpu_has_work_POWER7;
-@@ -XXX,XX +XXX,XX @@ void tcg_prologue_init(TCGContext *s)
++    pcc->has_work = cpu_has_work_POWER7;
-     }
+     pcc->insns_flags = PPC_INSNS_BASE | PPC_ISEL | PPC_STRING | PPC_MFTB |
- #endif
+                        PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
+                        PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |
--    /* Assert that goto_ptr is implemented completely.  */
+@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER8)(ObjectClass *oc, void *data)
-+#ifndef CONFIG_TCG_INTERPRETER
+ {
-+    /*
+     DeviceClass *dc = DEVICE_CLASS(oc);
-+     * Assert that goto_ptr is implemented completely, setting an epilogue.
+     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
-+     * For tci, we use NULL as the signal to return from the interpreter,
+-    CPUClass *cc = CPU_CLASS(oc);
-+     * so skip this check.
-+     */
+     dc->fw_name = "PowerPC,POWER8";
-     if (TCG_TARGET_HAS_goto_ptr) {
+     dc->desc = "POWER8";
-         tcg_debug_assert(tcg_code_gen_epilogue != NULL);
+@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER8)(ObjectClass *oc, void *data)
-     }
+     pcc->pcr_supported = PCR_COMPAT_2_07 | PCR_COMPAT_2_06 | PCR_COMPAT_2_05;
-+#endif
+     pcc->init_proc = init_proc_POWER8;
      pcc->check_pow = check_pow_nocheck;
 -    cc->has_work = cpu_has_work_POWER8;
 +    pcc->has_work = cpu_has_work_POWER8;
      pcc->insns_flags = PPC_INSNS_BASE | PPC_ISEL | PPC_STRING | PPC_MFTB |
                         PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
                         PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER9)(ObjectClass *oc, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(oc);
      PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
 -    CPUClass *cc = CPU_CLASS(oc);
      dc->fw_name = "PowerPC,POWER9";
      dc->desc = "POWER9";
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER9)(ObjectClass *oc, void *data)
                           PCR_COMPAT_2_05;
      pcc->init_proc = init_proc_POWER9;
      pcc->check_pow = check_pow_nocheck;
 -    cc->has_work = cpu_has_work_POWER9;
 +    pcc->has_work = cpu_has_work_POWER9;
      pcc->insns_flags = PPC_INSNS_BASE | PPC_ISEL | PPC_STRING | PPC_MFTB |
                         PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
                         PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER10)(ObjectClass *oc, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(oc);
      PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
 -    CPUClass *cc = CPU_CLASS(oc);
      dc->fw_name = "PowerPC,POWER10";
      dc->desc = "POWER10";
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER10)(ObjectClass *oc, void *data)
                           PCR_COMPAT_2_06 | PCR_COMPAT_2_05;
      pcc->init_proc = init_proc_POWER10;
      pcc->check_pow = check_pow_nocheck;
 -    cc->has_work = cpu_has_work_POWER10;
 +    pcc->has_work = cpu_has_work_POWER10;
      pcc->insns_flags = PPC_INSNS_BASE | PPC_ISEL | PPC_STRING | PPC_MFTB |
                         PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
                         PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_set_pc(CPUState *cs, vaddr value)
      cpu->env.nip = value;
  }
- void tcg_func_start(TCGContext *s)
+-static bool ppc_cpu_has_work(CPUState *cs)
-diff --git a/tcg/tci.c b/tcg/tci.c
++static bool cpu_has_work_default(CPUState *cs)
-index XXXXXXX..XXXXXXX 100644
+ {
---- a/tcg/tci.c
+     PowerPCCPU *cpu = POWERPC_CPU(cs);
-+++ b/tcg/tci.c
+     CPUPPCState *env = &cpu->env;
-@@ -XXX,XX +XXX,XX @@ static void tci_args_l(uint32_t insn, const void *tb_ptr, void **l0)
+@@ -XXX,XX +XXX,XX @@ static bool ppc_cpu_has_work(CPUState *cs)
-     *l0 = diff ? (void *)tb_ptr + diff : NULL;
+     return msr_ee && (cs->interrupt_request & CPU_INTERRUPT_HARD);
  }
-+static void tci_args_r(uint32_t insn, TCGReg *r0)
++static bool ppc_cpu_has_work(CPUState *cs)
 +{
-+    *r0 = extract32(insn, 8, 4);
++    PowerPCCPU *cpu = POWERPC_CPU(cs);
 +    PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cpu);
 +
 +    return pcc->has_work(cs);
 +}
 +
- static void tci_args_nl(uint32_t insn, const void *tb_ptr,
+ static void ppc_cpu_reset(DeviceState *dev)
                          uint8_t *n0, void **l1)
  {
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+     CPUState *s = CPU(dev);
-             tb_ptr = *(void **)ptr;
+@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
-             break;
+     device_class_set_parent_unrealize(dc, ppc_cpu_unrealize,
+                                       &pcc->parent_unrealize);
-+        case INDEX_op_goto_ptr:
+     pcc->pvr_match = ppc_pvr_match_default;
-+            tci_args_r(insn, &r0);
++    pcc->has_work = cpu_has_work_default;
-+            ptr = (void *)regs[r0];
+     device_class_set_props(dc, ppc_cpu_properties);
-+            if (!ptr) {
-+                return 0;
+     device_class_set_parent_reset(dc, ppc_cpu_reset, &pcc->parent_reset);
 +            }
 +            tb_ptr = ptr;
 +            break;
 +
          case INDEX_op_qemu_ld_i32:
              if (TARGET_LONG_BITS <= TCG_TARGET_REG_BITS) {
                  tci_args_rrm(insn, &r0, &r1, &oi);
@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
          info->fprintf_func(info->stream, "%-12s  %p", op_name, ptr);
          break;
 +    case INDEX_op_goto_ptr:
 +        tci_args_r(insn, &r0);
 +        info->fprintf_func(info->stream, "%-12s  %s", op_name, str_r(r0));
 +        break;
 +
      case INDEX_op_call:
          tci_args_nl(insn, tb_ptr, &len, &ptr);
          info->fprintf_func(info->stream, "%-12s  %d, %p", op_name, len, ptr);
 diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.c.inc
 +++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@
  static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
  {
      switch (op) {
 +    case INDEX_op_goto_ptr:
 +        return C_O0_I1(r);
 +
      case INDEX_op_ld8u_i32:
      case INDEX_op_ld8s_i32:
      case INDEX_op_ld16u_i32:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op_p(TCGContext *s, TCGOpcode op, void *p0)
      tcg_out32(s, insn);
  }
 +static void tcg_out_op_r(TCGContext *s, TCGOpcode op, TCGReg r0)
 +{
 +    tcg_insn_unit insn = 0;
 +
 +    insn = deposit32(insn, 0, 8, op);
 +    insn = deposit32(insn, 8, 4, r0);
 +    tcg_out32(s, insn);
 +}
 +
  static void tcg_out_op_v(TCGContext *s, TCGOpcode op)
  {
      tcg_out32(s, (uint8_t)op);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          set_jmp_reset_offset(s, args[0]);
          break;
 +    case INDEX_op_goto_ptr:
 +        tcg_out_op_r(s, opc, args[0]);
 +        break;
 +
      case INDEX_op_br:
          tcg_out_op_l(s, opc, arg_label(args[0]));
          break;
 --
 .25.1

-[PULL 26/33] tcg/tci: Use {set,clear}_helper_retaddr
+[PULL 22/35] target/ppc: Restrict has_work() handlers to sysemu and TCG
-Wrap guest memory operations for tci like we do for cpu_ld*_data.
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-We cannot actually use the cpu_ldst.h interface without duplicating
+Restrict PowerPCCPUClass::has_work() and ppc_cpu_has_work()
-the memory trace operations performed within, which will already
+- SysemuCPUOps::has_work() implementation - to TCG sysemu.
-have been expanded into the tcg opcode stream.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-Id: <20210912172731.789788-22-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c | 10 ++++++----
+ target/ppc/cpu-qom.h  |  4 +++-
-file changed, 6 insertions(+), 4 deletions(-)
+ target/ppc/cpu_init.c | 24 ++++++++++++++++++------
+files changed, 21 insertions(+), 7 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
 diff --git a/target/ppc/cpu-qom.h b/target/ppc/cpu-qom.h
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/target/ppc/cpu-qom.h
-+++ b/tcg/tci.c
++++ b/target/ppc/cpu-qom.h
-@@ -XXX,XX +XXX,XX @@ static uint64_t tci_qemu_ld(CPUArchState *env, target_ulong taddr,
+@@ -XXX,XX +XXX,XX @@ struct PowerPCCPUClass {
-                             TCGMemOpIdx oi, const void *tb_ptr)
+     uint32_t flags;
- {
+     int bfd_mach;
-     MemOp mop = get_memop(oi) & (MO_BSWAP | MO_SSIZE);
+     uint32_t l1_dcache_size, l1_icache_size;
--
+-    bool (*has_work)(CPUState *cpu);
--#ifdef CONFIG_SOFTMMU
+ #ifndef CONFIG_USER_ONLY
-     uintptr_t ra = (uintptr_t)tb_ptr;
++#ifdef CONFIG_TCG
++    bool (*has_work)(CPUState *cpu);
-+#ifdef CONFIG_SOFTMMU
++#endif /* CONFIG_TCG */
-     switch (mop) {
+     unsigned int gdb_num_sprs;
-     case MO_UB:
+     const char *gdb_spr_xml;
          return helper_ret_ldub_mmu(env, taddr, oi, ra);
@@ -XXX,XX +XXX,XX @@ static uint64_t tci_qemu_ld(CPUArchState *env, target_ulong taddr,
      void *haddr = g2h(env_cpu(env), taddr);
      uint64_t ret;
 +    set_helper_retaddr(ra);
      switch (mop) {
      case MO_UB:
          ret = ldub_p(haddr);
@@ -XXX,XX +XXX,XX @@ static uint64_t tci_qemu_ld(CPUArchState *env, target_ulong taddr,
      default:
          g_assert_not_reached();
      }
 +    clear_helper_retaddr();
      return ret;
  #endif
- }
+diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
-@@ -XXX,XX +XXX,XX @@ static void tci_qemu_st(CPUArchState *env, target_ulong taddr, uint64_t val,
+index XXXXXXX..XXXXXXX 100644
-                         TCGMemOpIdx oi, const void *tb_ptr)
+--- a/target/ppc/cpu_init.c
- {
++++ b/target/ppc/cpu_init.c
-     MemOp mop = get_memop(oi) & (MO_BSWAP | MO_SSIZE);
+@@ -XXX,XX +XXX,XX @@ static bool ppc_pvr_match_power7(PowerPCCPUClass *pcc, uint32_t pvr)
--
+     return false;
--#ifdef CONFIG_SOFTMMU
+ }
-     uintptr_t ra = (uintptr_t)tb_ptr;
++#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
-+#ifdef CONFIG_SOFTMMU
+ static bool cpu_has_work_POWER7(CPUState *cs)
-     switch (mop) {
+ {
-     case MO_UB:
+     PowerPCCPU *cpu = POWERPC_CPU(cs);
-         helper_ret_stb_mmu(env, taddr, val, oi, ra);
+@@ -XXX,XX +XXX,XX @@ static bool cpu_has_work_POWER7(CPUState *cs)
-@@ -XXX,XX +XXX,XX @@ static void tci_qemu_st(CPUArchState *env, target_ulong taddr, uint64_t val,
+         return msr_ee && (cs->interrupt_request & CPU_INTERRUPT_HARD);
- #else
+     }
-     void *haddr = g2h(env_cpu(env), taddr);
+ }
++#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
-+    set_helper_retaddr(ra);
-     switch (mop) {
+ POWERPC_FAMILY(POWER7)(ObjectClass *oc, void *data)
-     case MO_UB:
+ {
-         stb_p(haddr, val);
+@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER7)(ObjectClass *oc, void *data)
-@@ -XXX,XX +XXX,XX @@ static void tci_qemu_st(CPUArchState *env, target_ulong taddr, uint64_t val,
+     pcc->pcr_supported = PCR_COMPAT_2_06 | PCR_COMPAT_2_05;
-     default:
+     pcc->init_proc = init_proc_POWER7;
-         g_assert_not_reached();
+     pcc->check_pow = check_pow_nocheck;
-     }
+-    pcc->has_work = cpu_has_work_POWER7;
-+    clear_helper_retaddr();
+     pcc->insns_flags = PPC_INSNS_BASE | PPC_ISEL | PPC_STRING | PPC_MFTB |
                         PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
                         PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER7)(ObjectClass *oc, void *data)
      pcc->lpcr_pm = LPCR_P7_PECE0 | LPCR_P7_PECE1 | LPCR_P7_PECE2;
      pcc->mmu_model = POWERPC_MMU_2_06;
  #if defined(CONFIG_SOFTMMU)
 +    pcc->has_work = cpu_has_work_POWER7;
      pcc->hash64_opts = &ppc_hash64_opts_POWER7;
      pcc->lrg_decr_bits = 32;
  #endif
- }
+@@ -XXX,XX +XXX,XX @@ static bool ppc_pvr_match_power8(PowerPCCPUClass *pcc, uint32_t pvr)
      return false;
  }
 +#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
  static bool cpu_has_work_POWER8(CPUState *cs)
  {
      PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool cpu_has_work_POWER8(CPUState *cs)
          return msr_ee && (cs->interrupt_request & CPU_INTERRUPT_HARD);
      }
  }
 +#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
  POWERPC_FAMILY(POWER8)(ObjectClass *oc, void *data)
  {
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER8)(ObjectClass *oc, void *data)
      pcc->pcr_supported = PCR_COMPAT_2_07 | PCR_COMPAT_2_06 | PCR_COMPAT_2_05;
      pcc->init_proc = init_proc_POWER8;
      pcc->check_pow = check_pow_nocheck;
 -    pcc->has_work = cpu_has_work_POWER8;
      pcc->insns_flags = PPC_INSNS_BASE | PPC_ISEL | PPC_STRING | PPC_MFTB |
                         PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
                         PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER8)(ObjectClass *oc, void *data)
                     LPCR_P8_PECE3 | LPCR_P8_PECE4;
      pcc->mmu_model = POWERPC_MMU_2_07;
  #if defined(CONFIG_SOFTMMU)
 +    pcc->has_work = cpu_has_work_POWER8;
      pcc->hash64_opts = &ppc_hash64_opts_POWER7;
      pcc->lrg_decr_bits = 32;
      pcc->n_host_threads = 8;
@@ -XXX,XX +XXX,XX @@ static bool ppc_pvr_match_power9(PowerPCCPUClass *pcc, uint32_t pvr)
      return false;
  }
 +#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
  static bool cpu_has_work_POWER9(CPUState *cs)
  {
      PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool cpu_has_work_POWER9(CPUState *cs)
          return msr_ee && (cs->interrupt_request & CPU_INTERRUPT_HARD);
      }
  }
 +#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
  POWERPC_FAMILY(POWER9)(ObjectClass *oc, void *data)
  {
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER9)(ObjectClass *oc, void *data)
                           PCR_COMPAT_2_05;
      pcc->init_proc = init_proc_POWER9;
      pcc->check_pow = check_pow_nocheck;
 -    pcc->has_work = cpu_has_work_POWER9;
      pcc->insns_flags = PPC_INSNS_BASE | PPC_ISEL | PPC_STRING | PPC_MFTB |
                         PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
                         PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER9)(ObjectClass *oc, void *data)
      pcc->lpcr_pm = LPCR_PDEE | LPCR_HDEE | LPCR_EEE | LPCR_DEE | LPCR_OEE;
      pcc->mmu_model = POWERPC_MMU_3_00;
  #if defined(CONFIG_SOFTMMU)
 +    pcc->has_work = cpu_has_work_POWER9;
      /* segment page size remain the same */
      pcc->hash64_opts = &ppc_hash64_opts_POWER7;
      pcc->radix_page_info = &POWER9_radix_page_info;
@@ -XXX,XX +XXX,XX @@ static bool ppc_pvr_match_power10(PowerPCCPUClass *pcc, uint32_t pvr)
      return false;
  }
 +#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
  static bool cpu_has_work_POWER10(CPUState *cs)
  {
      PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool cpu_has_work_POWER10(CPUState *cs)
          return msr_ee && (cs->interrupt_request & CPU_INTERRUPT_HARD);
      }
  }
 +#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
  POWERPC_FAMILY(POWER10)(ObjectClass *oc, void *data)
  {
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER10)(ObjectClass *oc, void *data)
                           PCR_COMPAT_2_06 | PCR_COMPAT_2_05;
      pcc->init_proc = init_proc_POWER10;
      pcc->check_pow = check_pow_nocheck;
 -    pcc->has_work = cpu_has_work_POWER10;
      pcc->insns_flags = PPC_INSNS_BASE | PPC_ISEL | PPC_STRING | PPC_MFTB |
                         PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
                         PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER10)(ObjectClass *oc, void *data)
      pcc->lpcr_pm = LPCR_PDEE | LPCR_HDEE | LPCR_EEE | LPCR_DEE | LPCR_OEE;
      pcc->mmu_model = POWERPC_MMU_3_00;
  #if defined(CONFIG_SOFTMMU)
 +    pcc->has_work = cpu_has_work_POWER10;
      /* segment page size remain the same */
      pcc->hash64_opts = &ppc_hash64_opts_POWER7;
      pcc->radix_page_info = &POWER10_radix_page_info;
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_set_pc(CPUState *cs, vaddr value)
      cpu->env.nip = value;
  }
 +#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
  static bool cpu_has_work_default(CPUState *cs)
  {
      PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool ppc_cpu_has_work(CPUState *cs)
      return pcc->has_work(cs);
  }
 +#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
  static void ppc_cpu_reset(DeviceState *dev)
  {
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps ppc_tcg_ops = {
    .tlb_fill = ppc_cpu_tlb_fill,
  #ifndef CONFIG_USER_ONLY
 +  .has_work = ppc_cpu_has_work,
    .cpu_exec_interrupt = ppc_cpu_exec_interrupt,
    .do_interrupt = ppc_cpu_do_interrupt,
    .cpu_exec_enter = ppc_cpu_exec_enter,
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
      device_class_set_parent_unrealize(dc, ppc_cpu_unrealize,
                                        &pcc->parent_unrealize);
      pcc->pvr_match = ppc_pvr_match_default;
 -    pcc->has_work = cpu_has_work_default;
      device_class_set_props(dc, ppc_cpu_properties);
      device_class_set_parent_reset(dc, ppc_cpu_reset, &pcc->parent_reset);
      cc->class_by_name = ppc_cpu_class_by_name;
 -    cc->has_work = ppc_cpu_has_work;
      cc->dump_state = ppc_cpu_dump_state;
      cc->set_pc = ppc_cpu_set_pc;
      cc->gdb_read_register = ppc_cpu_gdb_read_register;
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
  #ifdef CONFIG_TCG
      cc->tcg_ops = &ppc_tcg_ops;
 +#ifndef CONFIG_USER_ONLY
 +    pcc->has_work = cpu_has_work_default;
 +#endif
  #endif /* CONFIG_TCG */
  }
 --
 .25.1

-[PULL 09/33] tcg/tci: Improve tcg_target_call_clobber_regs
+[PULL 23/35] target/riscv: Restrict has_work() handler to sysemu and TCG
-The current setting is much too pessimistic.  Indicating only
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 the one or two registers that are actually assigned after a
 call should avoid unnecessary movement between the register
 array and the stack array.
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Restrict has_work() to TCG sysemu.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210912172731.789788-23-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci/tcg-target.c.inc | 10 ++++++++--
+ target/riscv/cpu.c | 8 +++-----
-file changed, 8 insertions(+), 2 deletions(-)
+file changed, 3 insertions(+), 5 deletions(-)
-diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target.c.inc
+--- a/target/riscv/cpu.c
-+++ b/tcg/tci/tcg-target.c.inc
++++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void tcg_target_init(TCGContext *s)
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_synchronize_from_tb(CPUState *cs,
-     tcg_target_available_regs[TCG_TYPE_I32] = BIT(TCG_TARGET_NB_REGS) - 1;
+     env->pc = tb->pc;
-     /* Registers available for 64 bit operations. */
+ }
-     tcg_target_available_regs[TCG_TYPE_I64] = BIT(TCG_TARGET_NB_REGS) - 1;
--    /* TODO: Which registers should be set here? */
++#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
--    tcg_target_call_clobber_regs = BIT(TCG_TARGET_NB_REGS) - 1;
+ static bool riscv_cpu_has_work(CPUState *cs)
-+    /*
+ {
-+     * The interpreter "registers" are in the local stack frame and
+-#ifndef CONFIG_USER_ONLY
-+     * cannot be clobbered by the called helper functions.  However,
+     RISCVCPU *cpu = RISCV_CPU(cs);
-+     * the interpreter assumes a 64-bit return value and assigns to
+     CPURISCVState *env = &cpu->env;
-+     * the return value registers.
+     /*
-+     */
+@@ -XXX,XX +XXX,XX @@ static bool riscv_cpu_has_work(CPUState *cs)
-+    tcg_target_call_clobber_regs =
+      * mode and delegation registers, but respect individual enables
-+        MAKE_64BIT_MASK(TCG_REG_R0, 64 / TCG_TARGET_REG_BITS);
+      */
+     return (env->mip & env->mie) != 0;
-     s->reserved_regs = 0;
+-#else
-     tcg_regset_set_reg(s->reserved_regs, TCG_REG_CALL_STACK);
+-    return true;
 -#endif
  }
 +#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
  void restore_state_to_opc(CPURISCVState *env, TranslationBlock *tb,
                            target_ulong *data)
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps riscv_tcg_ops = {
      .tlb_fill = riscv_cpu_tlb_fill,
  #ifndef CONFIG_USER_ONLY
 +    .has_work = riscv_cpu_has_work,
      .cpu_exec_interrupt = riscv_cpu_exec_interrupt,
      .do_interrupt = riscv_cpu_do_interrupt,
      .do_transaction_failed = riscv_cpu_do_transaction_failed,
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
      device_class_set_parent_reset(dc, riscv_cpu_reset, &mcc->parent_reset);
      cc->class_by_name = riscv_cpu_class_by_name;
 -    cc->has_work = riscv_cpu_has_work;
      cc->dump_state = riscv_cpu_dump_state;
      cc->set_pc = riscv_cpu_set_pc;
      cc->gdb_read_register = riscv_cpu_gdb_read_register;
 --
 .25.1

-[PULL 20/33] tcg/tci: Implement clz, ctz, ctpop
+[PULL 24/35] target/rx: Restrict has_work() handler to sysemu
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Restrict has_work() to sysemu.
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210912172731.789788-24-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci/tcg-target.h     | 12 +++++------
+ target/rx/cpu.c | 4 +++-
- tcg/tci.c                | 44 ++++++++++++++++++++++++++++++++++++++++
+file changed, 3 insertions(+), 1 deletion(-)
  tcg/tci/tcg-target.c.inc |  9 ++++++++
 files changed, 59 insertions(+), 6 deletions(-)
-diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
+diff --git a/target/rx/cpu.c b/target/rx/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target.h
+--- a/target/rx/cpu.c
-+++ b/tcg/tci/tcg-target.h
++++ b/target/rx/cpu.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void rx_cpu_synchronize_from_tb(CPUState *cs,
- #define TCG_TARGET_HAS_eqv_i32          1
+     cpu->env.pc = tb->pc;
- #define TCG_TARGET_HAS_nand_i32         1
+ }
- #define TCG_TARGET_HAS_nor_i32          1
--#define TCG_TARGET_HAS_clz_i32          0
++#if !defined(CONFIG_USER_ONLY)
--#define TCG_TARGET_HAS_ctz_i32          0
+ static bool rx_cpu_has_work(CPUState *cs)
--#define TCG_TARGET_HAS_ctpop_i32        0
+ {
-+#define TCG_TARGET_HAS_clz_i32          1
+     return cs->interrupt_request &
-+#define TCG_TARGET_HAS_ctz_i32          1
+         (CPU_INTERRUPT_HARD | CPU_INTERRUPT_FIR);
-+#define TCG_TARGET_HAS_ctpop_i32        1
+ }
- #define TCG_TARGET_HAS_neg_i32          1
++#endif /* !CONFIG_USER_ONLY */
- #define TCG_TARGET_HAS_not_i32          1
- #define TCG_TARGET_HAS_orc_i32          1
+ static void rx_cpu_reset(DeviceState *dev)
-@@ -XXX,XX +XXX,XX @@
+ {
- #define TCG_TARGET_HAS_eqv_i64          1
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps rx_tcg_ops = {
- #define TCG_TARGET_HAS_nand_i64         1
+     .tlb_fill = rx_cpu_tlb_fill,
- #define TCG_TARGET_HAS_nor_i64          1
--#define TCG_TARGET_HAS_clz_i64          0
+ #ifndef CONFIG_USER_ONLY
--#define TCG_TARGET_HAS_ctz_i64          0
++    .has_work = rx_cpu_has_work,
--#define TCG_TARGET_HAS_ctpop_i64        0
+     .cpu_exec_interrupt = rx_cpu_exec_interrupt,
-+#define TCG_TARGET_HAS_clz_i64          1
+     .do_interrupt = rx_cpu_do_interrupt,
-+#define TCG_TARGET_HAS_ctz_i64          1
+ #endif /* !CONFIG_USER_ONLY */
-+#define TCG_TARGET_HAS_ctpop_i64        1
+@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
- #define TCG_TARGET_HAS_neg_i64          1
+                                   &rcc->parent_reset);
- #define TCG_TARGET_HAS_not_i64          1
- #define TCG_TARGET_HAS_orc_i64          1
+     cc->class_by_name = rx_cpu_class_by_name;
-diff --git a/tcg/tci.c b/tcg/tci.c
+-    cc->has_work = rx_cpu_has_work;
-index XXXXXXX..XXXXXXX 100644
+     cc->dump_state = rx_cpu_dump_state;
---- a/tcg/tci.c
+     cc->set_pc = rx_cpu_set_pc;
 +++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              tci_args_rrr(insn, &r0, &r1, &r2);
              regs[r0] = (uint32_t)regs[r1] % (uint32_t)regs[r2];
              break;
 +#if TCG_TARGET_HAS_clz_i32
 +        case INDEX_op_clz_i32:
 +            tci_args_rrr(insn, &r0, &r1, &r2);
 +            tmp32 = regs[r1];
 +            regs[r0] = tmp32 ? clz32(tmp32) : regs[r2];
 +            break;
 +#endif
 +#if TCG_TARGET_HAS_ctz_i32
 +        case INDEX_op_ctz_i32:
 +            tci_args_rrr(insn, &r0, &r1, &r2);
 +            tmp32 = regs[r1];
 +            regs[r0] = tmp32 ? ctz32(tmp32) : regs[r2];
 +            break;
 +#endif
 +#if TCG_TARGET_HAS_ctpop_i32
 +        case INDEX_op_ctpop_i32:
 +            tci_args_rr(insn, &r0, &r1);
 +            regs[r0] = ctpop32(regs[r1]);
 +            break;
 +#endif
              /* Shift/rotate operations (32 bit). */
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              tci_args_rrr(insn, &r0, &r1, &r2);
              regs[r0] = (uint64_t)regs[r1] % (uint64_t)regs[r2];
              break;
 +#if TCG_TARGET_HAS_clz_i64
 +        case INDEX_op_clz_i64:
 +            tci_args_rrr(insn, &r0, &r1, &r2);
 +            regs[r0] = regs[r1] ? clz64(regs[r1]) : regs[r2];
 +            break;
 +#endif
 +#if TCG_TARGET_HAS_ctz_i64
 +        case INDEX_op_ctz_i64:
 +            tci_args_rrr(insn, &r0, &r1, &r2);
 +            regs[r0] = regs[r1] ? ctz64(regs[r1]) : regs[r2];
 +            break;
 +#endif
 +#if TCG_TARGET_HAS_ctpop_i64
 +        case INDEX_op_ctpop_i64:
 +            tci_args_rr(insn, &r0, &r1);
 +            regs[r0] = ctpop64(regs[r1]);
 +            break;
 +#endif
              /* Shift/rotate operations (64 bit). */
@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
      case INDEX_op_not_i64:
      case INDEX_op_neg_i32:
      case INDEX_op_neg_i64:
 +    case INDEX_op_ctpop_i32:
 +    case INDEX_op_ctpop_i64:
          tci_args_rr(insn, &r0, &r1);
          info->fprintf_func(info->stream, "%-12s  %s, %s",
                             op_name, str_r(r0), str_r(r1));
@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
      case INDEX_op_rotl_i64:
      case INDEX_op_rotr_i32:
      case INDEX_op_rotr_i64:
 +    case INDEX_op_clz_i32:
 +    case INDEX_op_clz_i64:
 +    case INDEX_op_ctz_i32:
 +    case INDEX_op_ctz_i64:
          tci_args_rrr(insn, &r0, &r1, &r2);
          info->fprintf_func(info->stream, "%-12s  %s, %s, %s",
                             op_name, str_r(r0), str_r(r1), str_r(r2));
 diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.c.inc
 +++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
      case INDEX_op_extract_i64:
      case INDEX_op_sextract_i32:
      case INDEX_op_sextract_i64:
 +    case INDEX_op_ctpop_i32:
 +    case INDEX_op_ctpop_i64:
          return C_O1_I1(r, r);
      case INDEX_op_st8_i32:
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
      case INDEX_op_setcond_i64:
      case INDEX_op_deposit_i32:
      case INDEX_op_deposit_i64:
 +    case INDEX_op_clz_i32:
 +    case INDEX_op_clz_i64:
 +    case INDEX_op_ctz_i32:
 +    case INDEX_op_ctz_i64:
          return C_O1_I2(r, r, r);
      case INDEX_op_brcond_i32:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      CASE_32_64(divu)     /* Optional (TCG_TARGET_HAS_div_*). */
      CASE_32_64(rem)      /* Optional (TCG_TARGET_HAS_div_*). */
      CASE_32_64(remu)     /* Optional (TCG_TARGET_HAS_div_*). */
 +    CASE_32_64(clz)      /* Optional (TCG_TARGET_HAS_clz_*). */
 +    CASE_32_64(ctz)      /* Optional (TCG_TARGET_HAS_ctz_*). */
          tcg_out_op_rrr(s, opc, args[0], args[1], args[2]);
          break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      CASE_32_64(bswap16)  /* Optional (TCG_TARGET_HAS_bswap16_*). */
      CASE_32_64(bswap32)  /* Optional (TCG_TARGET_HAS_bswap32_*). */
      CASE_64(bswap64)     /* Optional (TCG_TARGET_HAS_bswap64_i64). */
 +    CASE_32_64(ctpop)    /* Optional (TCG_TARGET_HAS_ctpop_*). */
          tcg_out_op_rr(s, opc, args[0], args[1]);
          break;
 --
 .25.1

-[PULL 08/33] tcg: Build ffi data structures for helpers
+[PULL 25/35] target/s390x: Restrict has_work() handler to sysemu and TCG
-Add libffi as a build requirement for TCI.
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Add libffi to the dockerfiles to satisfy that requirement.
-Construct an ffi_cif structure for each unique typemask.
+Restrict has_work() to TCG sysemu.
 Record the result in a separate hash table for later lookup;
 this allows helper_table to stay const.
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210912172731.789788-25-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tcg.c                                     | 58 +++++++++++++++++++
+ target/s390x/cpu.c | 4 +++-
- tcg/meson.build                               |  8 ++-
+file changed, 3 insertions(+), 1 deletion(-)
  tests/docker/dockerfiles/alpine.docker        |  1 +
  tests/docker/dockerfiles/centos8.docker       |  1 +
  tests/docker/dockerfiles/debian10.docker      |  1 +
  .../dockerfiles/fedora-i386-cross.docker      |  1 +
  .../dockerfiles/fedora-win32-cross.docker     |  1 +
  .../dockerfiles/fedora-win64-cross.docker     |  1 +
  tests/docker/dockerfiles/fedora.docker        |  1 +
  tests/docker/dockerfiles/ubuntu.docker        |  1 +
  tests/docker/dockerfiles/ubuntu1804.docker    |  1 +
  tests/docker/dockerfiles/ubuntu2004.docker    |  1 +
 files changed, 75 insertions(+), 1 deletion(-)
-diff --git a/tcg/tcg.c b/tcg/tcg.c
+diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg.c
+--- a/target/s390x/cpu.c
-+++ b/tcg/tcg.c
++++ b/target/s390x/cpu.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void s390_cpu_set_pc(CPUState *cs, vaddr value)
- #include "exec/log.h"
+     cpu->env.psw.addr = value;
- #include "tcg-internal.h"
+ }
-+#ifdef CONFIG_TCG_INTERPRETER
++#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
-+#include <ffi.h>
+ static bool s390_cpu_has_work(CPUState *cs)
-+#endif
+ {
-+
+     S390CPU *cpu = S390_CPU(cs);
- /* Forward declarations for functions declared in tcg-target.c.inc and
+@@ -XXX,XX +XXX,XX @@ static bool s390_cpu_has_work(CPUState *cs)
-    used here. */
- static void tcg_target_init(TCGContext *s);
+     return s390_cpu_has_int(cpu);
-@@ -XXX,XX +XXX,XX @@ static const TCGHelperInfo all_helpers[] = {
+ }
- };
++#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
- static GHashTable *helper_table;
+ /* S390CPUClass::reset() */
-+#ifdef CONFIG_TCG_INTERPRETER
+ static void s390_cpu_reset(CPUState *s, cpu_reset_type type)
-+static GHashTable *ffi_table;
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps s390_tcg_ops = {
-+
+     .tlb_fill = s390_cpu_tlb_fill,
-+static ffi_type * const typecode_to_ffi[8] = {
-+    [dh_typecode_void] = &ffi_type_void,
+ #if !defined(CONFIG_USER_ONLY)
-+    [dh_typecode_i32]  = &ffi_type_uint32,
++    .has_work = s390_cpu_has_work,
-+    [dh_typecode_s32]  = &ffi_type_sint32,
+     .cpu_exec_interrupt = s390_cpu_exec_interrupt,
-+    [dh_typecode_i64]  = &ffi_type_uint64,
+     .do_interrupt = s390_cpu_do_interrupt,
-+    [dh_typecode_s64]  = &ffi_type_sint64,
+     .debug_excp_handler = s390x_cpu_debug_excp_handler,
-+    [dh_typecode_ptr]  = &ffi_type_pointer,
+@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
-+};
-+#endif
+     scc->reset = s390_cpu_reset;
-+
+     cc->class_by_name = s390_cpu_class_by_name,
- static int indirect_reg_alloc_order[ARRAY_SIZE(tcg_target_reg_alloc_order)];
+-    cc->has_work = s390_cpu_has_work;
- static void process_op_defs(TCGContext *s);
+     cc->dump_state = s390_cpu_dump_state;
- static TCGTemp *tcg_global_reg_new_internal(TCGContext *s, TCGType type,
+     cc->set_pc = s390_cpu_set_pc;
-@@ -XXX,XX +XXX,XX @@ static void tcg_context_init(unsigned max_cpus)
+     cc->gdb_read_register = s390_cpu_gdb_read_register;
                              (gpointer)&all_helpers[i]);
      }
 +#ifdef CONFIG_TCG_INTERPRETER
 +    /* g_direct_hash/equal for direct comparisons on uint32_t.  */
 +    ffi_table = g_hash_table_new(NULL, NULL);
 +    for (i = 0; i < ARRAY_SIZE(all_helpers); ++i) {
 +        struct {
 +            ffi_cif cif;
 +            ffi_type *args[];
 +        } *ca;
 +        uint32_t typemask = all_helpers[i].typemask;
 +        gpointer hash = (gpointer)(uintptr_t)typemask;
 +        ffi_status status;
 +        int nargs;
 +
 +        if (g_hash_table_lookup(ffi_table, hash)) {
 +            continue;
 +        }
 +
 +        /* Ignoring the return type, find the last non-zero field. */
 +        nargs = 32 - clz32(typemask >> 3);
 +        nargs = DIV_ROUND_UP(nargs, 3);
 +
 +        ca = g_malloc0(sizeof(*ca) + nargs * sizeof(ffi_type *));
 +        ca->cif.rtype = typecode_to_ffi[typemask & 7];
 +        ca->cif.nargs = nargs;
 +
 +        if (nargs != 0) {
 +            ca->cif.arg_types = ca->args;
 +            for (i = 0; i < nargs; ++i) {
 +                int typecode = extract32(typemask, (i + 1) * 3, 3);
 +                ca->args[i] = typecode_to_ffi[typecode];
 +            }
 +        }
 +
 +        status = ffi_prep_cif(&ca->cif, FFI_DEFAULT_ABI, nargs,
 +                              ca->cif.rtype, ca->cif.arg_types);
 +        assert(status == FFI_OK);
 +
 +        g_hash_table_insert(ffi_table, hash, (gpointer)&ca->cif);
 +    }
 +#endif
 +
      tcg_target_init(s);
      process_op_defs(s);
 diff --git a/tcg/meson.build b/tcg/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/meson.build
 +++ b/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ tcg_ss.add(files(
    'tcg-op-gvec.c',
    'tcg-op-vec.c',
  ))
 -tcg_ss.add(when: 'CONFIG_TCG_INTERPRETER', if_true: files('tci.c'))
 +
 +if get_option('tcg_interpreter')
 +  libffi = dependency('libffi', version: '>=3.0', required: true,
 +                      method: 'pkg-config', kwargs: static_kwargs)
 +  specific_ss.add(libffi)
 +  specific_ss.add(files('tci.c'))
 +endif
  specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_ss)
 diff --git a/tests/docker/dockerfiles/alpine.docker b/tests/docker/dockerfiles/alpine.docker
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/docker/dockerfiles/alpine.docker
 +++ b/tests/docker/dockerfiles/alpine.docker
@@ -XXX,XX +XXX,XX @@ ENV PACKAGES \
      libaio-dev \
      libbpf-dev \
      libcap-ng-dev \
 +    libffi-dev \
      libjpeg-turbo-dev \
      libnfs-dev \
      libpng-dev \
 diff --git a/tests/docker/dockerfiles/centos8.docker b/tests/docker/dockerfiles/centos8.docker
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/docker/dockerfiles/centos8.docker
 +++ b/tests/docker/dockerfiles/centos8.docker
@@ -XXX,XX +XXX,XX @@ ENV PACKAGES \
      libbpf-devel \
      libepoxy-devel \
      libfdt-devel \
 +    libffi-devel \
      libgcrypt-devel \
      lzo-devel \
      make \
 diff --git a/tests/docker/dockerfiles/debian10.docker b/tests/docker/dockerfiles/debian10.docker
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/docker/dockerfiles/debian10.docker
 +++ b/tests/docker/dockerfiles/debian10.docker
@@ -XXX,XX +XXX,XX @@ RUN apt update && \
          gdb-multiarch \
          gettext \
          git \
 +        libffi-dev \
          libncurses5-dev \
          ninja-build \
          pkg-config \
 diff --git a/tests/docker/dockerfiles/fedora-i386-cross.docker b/tests/docker/dockerfiles/fedora-i386-cross.docker
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/docker/dockerfiles/fedora-i386-cross.docker
 +++ b/tests/docker/dockerfiles/fedora-i386-cross.docker
@@ -XXX,XX +XXX,XX @@ ENV PACKAGES \
      findutils \
      gcc \
      git \
 +    libffi-devel.i686 \
      libtasn1-devel.i686 \
      libzstd-devel.i686 \
      make \
 diff --git a/tests/docker/dockerfiles/fedora-win32-cross.docker b/tests/docker/dockerfiles/fedora-win32-cross.docker
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/docker/dockerfiles/fedora-win32-cross.docker
 +++ b/tests/docker/dockerfiles/fedora-win32-cross.docker
@@ -XXX,XX +XXX,XX @@ ENV PACKAGES \
      mingw32-gmp \
      mingw32-gnutls \
      mingw32-gtk3 \
 +    mingw32-libffi \
      mingw32-libjpeg-turbo \
      mingw32-libpng \
      mingw32-libtasn1 \
 diff --git a/tests/docker/dockerfiles/fedora-win64-cross.docker b/tests/docker/dockerfiles/fedora-win64-cross.docker
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/docker/dockerfiles/fedora-win64-cross.docker
 +++ b/tests/docker/dockerfiles/fedora-win64-cross.docker
@@ -XXX,XX +XXX,XX @@ ENV PACKAGES \
      mingw64-glib2 \
      mingw64-gmp \
      mingw64-gtk3 \
 +    mingw64-libffi \
      mingw64-libjpeg-turbo \
      mingw64-libpng \
      mingw64-libtasn1 \
 diff --git a/tests/docker/dockerfiles/fedora.docker b/tests/docker/dockerfiles/fedora.docker
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/docker/dockerfiles/fedora.docker
 +++ b/tests/docker/dockerfiles/fedora.docker
@@ -XXX,XX +XXX,XX @@ ENV PACKAGES \
      libepoxy-devel \
      libfdt-devel \
      libbpf-devel \
 +    libffi-devel \
      libiscsi-devel \
      libjpeg-devel \
      libpmem-devel \
 diff --git a/tests/docker/dockerfiles/ubuntu.docker b/tests/docker/dockerfiles/ubuntu.docker
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/docker/dockerfiles/ubuntu.docker
 +++ b/tests/docker/dockerfiles/ubuntu.docker
@@ -XXX,XX +XXX,XX @@ ENV PACKAGES \
      libdrm-dev \
      libepoxy-dev \
      libfdt-dev \
 +    libffi-dev \
      libgbm-dev \
      libgnutls28-dev \
      libgtk-3-dev \
 diff --git a/tests/docker/dockerfiles/ubuntu1804.docker b/tests/docker/dockerfiles/ubuntu1804.docker
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/docker/dockerfiles/ubuntu1804.docker
 +++ b/tests/docker/dockerfiles/ubuntu1804.docker
@@ -XXX,XX +XXX,XX @@ ENV PACKAGES \
      libdrm-dev \
      libepoxy-dev \
      libfdt-dev \
 +    libffi-dev \
      libgbm-dev \
      libgtk-3-dev \
      libibverbs-dev \
 diff --git a/tests/docker/dockerfiles/ubuntu2004.docker b/tests/docker/dockerfiles/ubuntu2004.docker
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/docker/dockerfiles/ubuntu2004.docker
 +++ b/tests/docker/dockerfiles/ubuntu2004.docker
@@ -XXX,XX +XXX,XX @@ ENV PACKAGES flex bison \
      libdrm-dev \
      libepoxy-dev \
      libfdt-dev \
 +    libffi-dev \
      libgbm-dev \
      libgtk-3-dev \
      libibverbs-dev \
 --
 .25.1

-[PULL 21/33] tcg/tci: Implement mulu2, muls2
+[PULL 26/35] target/sh4: Restrict has_work() handler to sysemu
-We already had mulu2_i32 for a 32-bit host; expand this to 64-bit
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 hosts as well.  The muls2_i32 and the 64-bit opcodes are new.
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Restrict has_work() to sysemu.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210912172731.789788-26-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci/tcg-target.h     |  8 ++++----
+ target/sh4/cpu.c | 5 +++--
- tcg/tci.c                | 35 +++++++++++++++++++++++++++++------
+file changed, 3 insertions(+), 2 deletions(-)
  tcg/tci/tcg-target.c.inc | 16 ++++++++++------
 files changed, 43 insertions(+), 16 deletions(-)
-diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
+diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target.h
+--- a/target/sh4/cpu.c
-+++ b/tcg/tci/tcg-target.h
++++ b/target/sh4/cpu.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static bool superh_io_recompile_replay_branch(CPUState *cs,
- #define TCG_TARGET_HAS_orc_i32          1
+     }
- #define TCG_TARGET_HAS_rot_i32          1
+     return false;
  #define TCG_TARGET_HAS_movcond_i32      1
 -#define TCG_TARGET_HAS_muls2_i32        0
 +#define TCG_TARGET_HAS_muls2_i32        1
  #define TCG_TARGET_HAS_muluh_i32        0
  #define TCG_TARGET_HAS_mulsh_i32        0
  #define TCG_TARGET_HAS_goto_ptr         1
@@ -XXX,XX +XXX,XX @@
  #define TCG_TARGET_HAS_orc_i64          1
  #define TCG_TARGET_HAS_rot_i64          1
  #define TCG_TARGET_HAS_movcond_i64      1
 -#define TCG_TARGET_HAS_muls2_i64        0
 +#define TCG_TARGET_HAS_muls2_i64        1
  #define TCG_TARGET_HAS_add2_i32         0
  #define TCG_TARGET_HAS_sub2_i32         0
 -#define TCG_TARGET_HAS_mulu2_i32        0
 +#define TCG_TARGET_HAS_mulu2_i32        1
  #define TCG_TARGET_HAS_add2_i64         0
  #define TCG_TARGET_HAS_sub2_i64         0
 -#define TCG_TARGET_HAS_mulu2_i64        0
 +#define TCG_TARGET_HAS_mulu2_i64        1
  #define TCG_TARGET_HAS_muluh_i64        0
  #define TCG_TARGET_HAS_mulsh_i64        0
  #else
 diff --git a/tcg/tci.c b/tcg/tci.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci.c
 +++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ __thread uintptr_t tci_tb_ptr;
  static void tci_write_reg64(tcg_target_ulong *regs, uint32_t high_index,
                              uint32_t low_index, uint64_t value)
  {
 -    regs[low_index] = value;
 +    regs[low_index] = (uint32_t)value;
      regs[high_index] = value >> 32;
  }
@@ -XXX,XX +XXX,XX @@ static void tci_args_rrrrr(uint32_t insn, TCGReg *r0, TCGReg *r1,
      *r4 = extract32(insn, 24, 4);
  }
 -#if TCG_TARGET_REG_BITS == 32
  static void tci_args_rrrr(uint32_t insn,
                            TCGReg *r0, TCGReg *r1, TCGReg *r2, TCGReg *r3)
  {
@@ -XXX,XX +XXX,XX @@ static void tci_args_rrrr(uint32_t insn,
      *r2 = extract32(insn, 16, 4);
      *r3 = extract32(insn, 20, 4);
  }
 -#endif
- static void tci_args_rrrrrc(uint32_t insn, TCGReg *r0, TCGReg *r1,
+ static bool superh_cpu_has_work(CPUState *cs)
-                             TCGReg *r2, TCGReg *r3, TCGReg *r4, TCGCond *c5)
+ {
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+     return cs->interrupt_request & CPU_INTERRUPT_HARD;
-             T2 = tci_uint64(regs[r5], regs[r4]);
+ }
-             tci_write_reg64(regs, r1, r0, T1 - T2);
-             break;
++#endif /* !CONFIG_USER_ONLY */
 +#endif /* TCG_TARGET_REG_BITS == 32 */
 +#if TCG_TARGET_HAS_mulu2_i32
          case INDEX_op_mulu2_i32:
              tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
 -            tci_write_reg64(regs, r1, r0, (uint64_t)regs[r2] * regs[r3]);
 +            tmp64 = (uint64_t)(uint32_t)regs[r2] * (uint32_t)regs[r3];
 +            tci_write_reg64(regs, r1, r0, tmp64);
              break;
 -#endif /* TCG_TARGET_REG_BITS == 32 */
 +#endif
 +#if TCG_TARGET_HAS_muls2_i32
 +        case INDEX_op_muls2_i32:
 +            tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
 +            tmp64 = (int64_t)(int32_t)regs[r2] * (int32_t)regs[r3];
 +            tci_write_reg64(regs, r1, r0, tmp64);
 +            break;
 +#endif
  #if TCG_TARGET_HAS_ext8s_i32 || TCG_TARGET_HAS_ext8s_i64
          CASE_32_64(ext8s)
              tci_args_rr(insn, &r0, &r1);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              regs[r0] = ctpop64(regs[r1]);
              break;
  #endif
 +#if TCG_TARGET_HAS_mulu2_i64
 +        case INDEX_op_mulu2_i64:
 +            tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
 +            mulu64(&regs[r0], &regs[r1], regs[r2], regs[r3]);
 +            break;
 +#endif
 +#if TCG_TARGET_HAS_muls2_i64
 +        case INDEX_op_muls2_i64:
 +            tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
 +            muls64(&regs[r0], &regs[r1], regs[r2], regs[r3]);
 +            break;
 +#endif
              /* Shift/rotate operations (64 bit). */
@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
                             str_r(r3), str_r(r4), str_c(c));
          break;
 -#if TCG_TARGET_REG_BITS == 32
      case INDEX_op_mulu2_i32:
 +    case INDEX_op_mulu2_i64:
 +    case INDEX_op_muls2_i32:
 +    case INDEX_op_muls2_i64:
          tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
          info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s",
                             op_name, str_r(r0), str_r(r1),
                             str_r(r2), str_r(r3));
          break;
 +#if TCG_TARGET_REG_BITS == 32
      case INDEX_op_add2_i32:
      case INDEX_op_sub2_i32:
          tci_args_rrrrrr(insn, &r0, &r1, &r2, &r3, &r4, &r5);
 diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.c.inc
 +++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
          return C_O2_I4(r, r, r, r, r, r);
      case INDEX_op_brcond2_i32:
          return C_O0_I4(r, r, r, r);
 -    case INDEX_op_mulu2_i32:
 -        return C_O2_I2(r, r, r, r);
  #endif
 +    case INDEX_op_mulu2_i32:
 +    case INDEX_op_mulu2_i64:
 +    case INDEX_op_muls2_i32:
 +    case INDEX_op_muls2_i64:
 +        return C_O2_I2(r, r, r, r);
 +
-     case INDEX_op_movcond_i32:
+ static void superh_cpu_reset(DeviceState *dev)
      case INDEX_op_movcond_i64:
      case INDEX_op_setcond2_i32:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op_rrrrr(TCGContext *s, TCGOpcode op, TCGReg r0,
      tcg_out32(s, insn);
  }
 -#if TCG_TARGET_REG_BITS == 32
  static void tcg_out_op_rrrr(TCGContext *s, TCGOpcode op,
                              TCGReg r0, TCGReg r1, TCGReg r2, TCGReg r3)
  {
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op_rrrr(TCGContext *s, TCGOpcode op,
+     CPUState *s = CPU(dev);
-     insn = deposit32(insn, 20, 4, r3);
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps superh_tcg_ops = {
-     tcg_out32(s, insn);
+     .tlb_fill = superh_cpu_tlb_fill,
- }
--#endif
+ #ifndef CONFIG_USER_ONLY
++    .has_work = superh_cpu_has_work,
- static void tcg_out_op_rrrrrc(TCGContext *s, TCGOpcode op,
+     .cpu_exec_interrupt = superh_cpu_exec_interrupt,
-                               TCGReg r0, TCGReg r1, TCGReg r2,
+     .do_interrupt = superh_cpu_do_interrupt,
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     .do_unaligned_access = superh_cpu_do_unaligned_access,
-                           args[0], args[1], args[2], args[3], args[4]);
+@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
-         tcg_out_op_rl(s, INDEX_op_brcond_i32, TCG_REG_TMP, arg_label(args[5]));
+     device_class_set_parent_reset(dc, superh_cpu_reset, &scc->parent_reset);
-         break;
--    case INDEX_op_mulu2_i32:
+     cc->class_by_name = superh_cpu_class_by_name;
-+#endif
+-    cc->has_work = superh_cpu_has_work;
-+
+     cc->dump_state = superh_cpu_dump_state;
-+    CASE_32_64(mulu2)
+     cc->set_pc = superh_cpu_set_pc;
-+    CASE_32_64(muls2)
+     cc->gdb_read_register = superh_cpu_gdb_read_register;
          tcg_out_op_rrrr(s, opc, args[0], args[1], args[2], args[3]);
          break;
 -#endif
      case INDEX_op_qemu_ld_i32:
      case INDEX_op_qemu_st_i32:
 --
 .25.1

-[PULL 05/33] accel/tcg: Add tcg call flags to plugins helpers
+[PULL 27/35] target/sparc: Remove pointless use of CONFIG_TCG definition
-As noted by qemu-plugins.h, plugins can neither read nor write
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 guest registers.
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+The SPARC target only support TCG acceleration. Remove the CONFIG_TCG
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+definition introduced by mistake in commit 78271684719 ("cpu: tcg_ops:
 move to tcg-cpu-ops.h, keep a pointer in CPUClass").
 Reported-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210912172731.789788-27-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/plugin-helpers.h | 4 ++--
+ target/sparc/cpu.c | 2 --
-file changed, 2 insertions(+), 2 deletions(-)
+file changed, 2 deletions(-)
-diff --git a/accel/tcg/plugin-helpers.h b/accel/tcg/plugin-helpers.h
+diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/plugin-helpers.h
+--- a/target/sparc/cpu.c
-+++ b/accel/tcg/plugin-helpers.h
++++ b/target/sparc/cpu.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps sparc_sysemu_ops = {
- #ifdef CONFIG_PLUGIN
+ };
 -DEF_HELPER_2(plugin_vcpu_udata_cb, void, i32, ptr)
 -DEF_HELPER_4(plugin_vcpu_mem_cb, void, i32, i32, i64, ptr)
 +DEF_HELPER_FLAGS_2(plugin_vcpu_udata_cb, TCG_CALL_NO_RWG, void, i32, ptr)
 +DEF_HELPER_FLAGS_4(plugin_vcpu_mem_cb, TCG_CALL_NO_RWG, void, i32, i32, i64, ptr)
  #endif
+-#ifdef CONFIG_TCG
+ #include "hw/core/tcg-cpu-ops.h"
+ static const struct TCGCPUOps sparc_tcg_ops = {
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps sparc_tcg_ops = {
+     .do_unaligned_access = sparc_cpu_do_unaligned_access,
+ #endif /* !CONFIG_USER_ONLY */
+ };
+-#endif /* CONFIG_TCG */
+ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
+ {
 --
 .25.1

-[PULL 01/33] tcg: Combine dh_is_64bit and dh_is_signed to dh_typecode
+[PULL 28/35] target/sparc: Restrict has_work() handler to sysemu
-We will shortly be interested in distinguishing pointers
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 from integers in the helper's declaration, as well as a
 true void return.  We currently have two parallel 1 bit
 fields; merge them and expand to a 3 bit field.
-Our current maximum is 7 helper arguments, plus the return
+Restrict has_work() to sysemu.
 makes 8 * 3 = 24 bits used within the uint32_t typemask.
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210912172731.789788-28-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/helper-head.h   | 37 +++++--------------
+ target/sparc/cpu.c | 4 +++-
- include/exec/helper-tcg.h    | 34 ++++++++---------
+file changed, 3 insertions(+), 1 deletion(-)
  target/hppa/helper.h         |  3 --
  target/i386/ops_sse_header.h |  3 --
  target/m68k/helper.h         |  1 -
  target/ppc/helper.h          |  3 --
  tcg/tcg.c                    | 71 +++++++++++++++++++++---------------
 files changed, 67 insertions(+), 85 deletions(-)
-diff --git a/include/exec/helper-head.h b/include/exec/helper-head.h
+diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/helper-head.h
+--- a/target/sparc/cpu.c
-+++ b/include/exec/helper-head.h
++++ b/target/sparc/cpu.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_synchronize_from_tb(CPUState *cs,
- #define dh_retvar_ptr tcgv_ptr_temp(retval)
+     cpu->env.npc = tb->cs_base;
- #define dh_retvar(t) glue(dh_retvar_, dh_alias(t))
+ }
--#define dh_is_64bit_void 0
++#if !defined(CONFIG_USER_ONLY)
--#define dh_is_64bit_noreturn 0
+ static bool sparc_cpu_has_work(CPUState *cs)
 -#define dh_is_64bit_i32 0
 -#define dh_is_64bit_i64 1
 -#define dh_is_64bit_ptr (sizeof(void *) == 8)
 -#define dh_is_64bit_cptr dh_is_64bit_ptr
 -#define dh_is_64bit(t) glue(dh_is_64bit_, dh_alias(t))
 -
 -#define dh_is_signed_void 0
 -#define dh_is_signed_noreturn 0
 -#define dh_is_signed_i32 0
 -#define dh_is_signed_s32 1
 -#define dh_is_signed_i64 0
 -#define dh_is_signed_s64 1
 -#define dh_is_signed_f16 0
 -#define dh_is_signed_f32 0
 -#define dh_is_signed_f64 0
 -#define dh_is_signed_tl  0
 -#define dh_is_signed_int 1
 -/* ??? This is highly specific to the host cpu.  There are even special
 -   extension instructions that may be required, e.g. ia64's addp4.  But
 -   for now we don't support any 64-bit targets with 32-bit pointers.  */
 -#define dh_is_signed_ptr 0
 -#define dh_is_signed_cptr dh_is_signed_ptr
 -#define dh_is_signed_env dh_is_signed_ptr
 -#define dh_is_signed(t) dh_is_signed_##t
 +#define dh_typecode_void 0
 +#define dh_typecode_noreturn 0
 +#define dh_typecode_i32 2
 +#define dh_typecode_s32 3
 +#define dh_typecode_i64 4
 +#define dh_typecode_s64 5
 +#define dh_typecode_ptr 6
 +#define dh_typecode(t) glue(dh_typecode_, dh_alias(t))
  #define dh_callflag_i32  0
  #define dh_callflag_s32  0
@@ -XXX,XX +XXX,XX @@
  #define dh_callflag_noreturn TCG_CALL_NO_RETURN
  #define dh_callflag(t) glue(dh_callflag_, dh_alias(t))
 -#define dh_sizemask(t, n) \
 -  ((dh_is_64bit(t) << (n*2)) | (dh_is_signed(t) << (n*2+1)))
 +#define dh_typemask(t, n)  (dh_typecode(t) << (n * 3))
  #define dh_arg(t, n) \
    glue(glue(tcgv_, dh_alias(t)), _temp)(glue(arg, n))
 diff --git a/include/exec/helper-tcg.h b/include/exec/helper-tcg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/exec/helper-tcg.h
 +++ b/include/exec/helper-tcg.h
@@ -XXX,XX +XXX,XX @@
  #define DEF_HELPER_FLAGS_0(NAME, FLAGS, ret) \
    { .func = HELPER(NAME), .name = str(NAME), \
      .flags = FLAGS | dh_callflag(ret), \
 -    .sizemask = dh_sizemask(ret, 0) },
 +    .typemask = dh_typemask(ret, 0) },
  #define DEF_HELPER_FLAGS_1(NAME, FLAGS, ret, t1) \
    { .func = HELPER(NAME), .name = str(NAME), \
      .flags = FLAGS | dh_callflag(ret), \
 -    .sizemask = dh_sizemask(ret, 0) | dh_sizemask(t1, 1) },
 +    .typemask = dh_typemask(ret, 0) | dh_typemask(t1, 1) },
  #define DEF_HELPER_FLAGS_2(NAME, FLAGS, ret, t1, t2) \
    { .func = HELPER(NAME), .name = str(NAME), \
      .flags = FLAGS | dh_callflag(ret), \
 -    .sizemask = dh_sizemask(ret, 0) | dh_sizemask(t1, 1) \
 -    | dh_sizemask(t2, 2) },
 +    .typemask = dh_typemask(ret, 0) | dh_typemask(t1, 1) \
 +    | dh_typemask(t2, 2) },
  #define DEF_HELPER_FLAGS_3(NAME, FLAGS, ret, t1, t2, t3) \
    { .func = HELPER(NAME), .name = str(NAME), \
      .flags = FLAGS | dh_callflag(ret), \
 -    .sizemask = dh_sizemask(ret, 0) | dh_sizemask(t1, 1) \
 -    | dh_sizemask(t2, 2) | dh_sizemask(t3, 3) },
 +    .typemask = dh_typemask(ret, 0) | dh_typemask(t1, 1) \
 +    | dh_typemask(t2, 2) | dh_typemask(t3, 3) },
  #define DEF_HELPER_FLAGS_4(NAME, FLAGS, ret, t1, t2, t3, t4) \
    { .func = HELPER(NAME), .name = str(NAME), \
      .flags = FLAGS | dh_callflag(ret), \
 -    .sizemask = dh_sizemask(ret, 0) | dh_sizemask(t1, 1) \
 -    | dh_sizemask(t2, 2) | dh_sizemask(t3, 3) | dh_sizemask(t4, 4) },
 +    .typemask = dh_typemask(ret, 0) | dh_typemask(t1, 1) \
 +    | dh_typemask(t2, 2) | dh_typemask(t3, 3) | dh_typemask(t4, 4) },
  #define DEF_HELPER_FLAGS_5(NAME, FLAGS, ret, t1, t2, t3, t4, t5) \
    { .func = HELPER(NAME), .name = str(NAME), \
      .flags = FLAGS | dh_callflag(ret), \
 -    .sizemask = dh_sizemask(ret, 0) | dh_sizemask(t1, 1) \
 -    | dh_sizemask(t2, 2) | dh_sizemask(t3, 3) | dh_sizemask(t4, 4) \
 -    | dh_sizemask(t5, 5) },
 +    .typemask = dh_typemask(ret, 0) | dh_typemask(t1, 1) \
 +    | dh_typemask(t2, 2) | dh_typemask(t3, 3) | dh_typemask(t4, 4) \
 +    | dh_typemask(t5, 5) },
  #define DEF_HELPER_FLAGS_6(NAME, FLAGS, ret, t1, t2, t3, t4, t5, t6) \
    { .func = HELPER(NAME), .name = str(NAME), \
      .flags = FLAGS | dh_callflag(ret), \
 -    .sizemask = dh_sizemask(ret, 0) | dh_sizemask(t1, 1) \
 -    | dh_sizemask(t2, 2) | dh_sizemask(t3, 3) | dh_sizemask(t4, 4) \
 -    | dh_sizemask(t5, 5) | dh_sizemask(t6, 6) },
 +    .typemask = dh_typemask(ret, 0) | dh_typemask(t1, 1) \
 +    | dh_typemask(t2, 2) | dh_typemask(t3, 3) | dh_typemask(t4, 4) \
 +    | dh_typemask(t5, 5) | dh_typemask(t6, 6) },
  #define DEF_HELPER_FLAGS_7(NAME, FLAGS, ret, t1, t2, t3, t4, t5, t6, t7) \
    { .func = HELPER(NAME), .name = str(NAME), .flags = FLAGS, \
 -    .sizemask = dh_sizemask(ret, 0) | dh_sizemask(t1, 1) \
 -    | dh_sizemask(t2, 2) | dh_sizemask(t3, 3) | dh_sizemask(t4, 4) \
 -    | dh_sizemask(t5, 5) | dh_sizemask(t6, 6) | dh_sizemask(t7, 7) },
 +    .typemask = dh_typemask(ret, 0) | dh_typemask(t1, 1) \
 +    | dh_typemask(t2, 2) | dh_typemask(t3, 3) | dh_typemask(t4, 4) \
 +    | dh_typemask(t5, 5) | dh_typemask(t6, 6) | dh_typemask(t7, 7) },
  #include "helper.h"
  #include "trace/generated-helpers.h"
 diff --git a/target/hppa/helper.h b/target/hppa/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hppa/helper.h
 +++ b/target/hppa/helper.h
@@ -XXX,XX +XXX,XX @@
  #if TARGET_REGISTER_BITS == 64
  # define dh_alias_tr     i64
 -# define dh_is_64bit_tr  1
  #else
  # define dh_alias_tr     i32
 -# define dh_is_64bit_tr  0
  #endif
  #define dh_ctype_tr      target_ureg
 -#define dh_is_signed_tr  0
  DEF_HELPER_2(excp, noreturn, env, int)
  DEF_HELPER_FLAGS_2(tsv, TCG_CALL_NO_WG, void, env, tr)
 diff --git a/target/i386/ops_sse_header.h b/target/i386/ops_sse_header.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/ops_sse_header.h
 +++ b/target/i386/ops_sse_header.h
@@ -XXX,XX +XXX,XX @@
  #define dh_ctype_Reg Reg *
  #define dh_ctype_ZMMReg ZMMReg *
  #define dh_ctype_MMXReg MMXReg *
 -#define dh_is_signed_Reg dh_is_signed_ptr
 -#define dh_is_signed_ZMMReg dh_is_signed_ptr
 -#define dh_is_signed_MMXReg dh_is_signed_ptr
  DEF_HELPER_3(glue(psrlw, SUFFIX), void, env, Reg, Reg)
  DEF_HELPER_3(glue(psraw, SUFFIX), void, env, Reg, Reg)
 diff --git a/target/m68k/helper.h b/target/m68k/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/m68k/helper.h
 +++ b/target/m68k/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_4(cas2l_parallel, void, env, i32, i32, i32)
  #define dh_alias_fp ptr
  #define dh_ctype_fp FPReg *
 -#define dh_is_signed_fp dh_is_signed_ptr
  DEF_HELPER_3(exts32, void, env, fp, s32)
  DEF_HELPER_3(extf32, void, env, fp, f32)
 diff --git a/target/ppc/helper.h b/target/ppc/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/ppc/helper.h
 +++ b/target/ppc/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_1(ftsqrt, TCG_CALL_NO_RWG_SE, i32, i64)
  #define dh_alias_avr ptr
  #define dh_ctype_avr ppc_avr_t *
 -#define dh_is_signed_avr dh_is_signed_ptr
  #define dh_alias_vsr ptr
  #define dh_ctype_vsr ppc_vsr_t *
 -#define dh_is_signed_vsr dh_is_signed_ptr
  DEF_HELPER_3(vavgub, void, avr, avr, avr)
  DEF_HELPER_3(vavguh, void, avr, avr, avr)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(store_601_batu, void, env, i32, tl)
  #define dh_alias_fprp ptr
  #define dh_ctype_fprp ppc_fprp_t *
 -#define dh_is_signed_fprp dh_is_signed_ptr
  DEF_HELPER_4(dadd, void, env, fprp, fprp, fprp)
  DEF_HELPER_4(daddq, void, env, fprp, fprp, fprp)
 diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg.c
 +++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ typedef struct TCGHelperInfo {
      void *func;
      const char *name;
      unsigned flags;
 -    unsigned sizemask;
 +    unsigned typemask;
  } TCGHelperInfo;
  #include "exec/helper-proto.h"
@@ -XXX,XX +XXX,XX @@ bool tcg_op_supported(TCGOpcode op)
  void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args)
  {
-     int i, real_args, nb_rets, pi;
+     SPARCCPU *cpu = SPARC_CPU(cs);
--    unsigned sizemask, flags;
+@@ -XXX,XX +XXX,XX @@ static bool sparc_cpu_has_work(CPUState *cs)
-+    unsigned typemask, flags;
+     return (cs->interrupt_request & CPU_INTERRUPT_HARD) &&
-     TCGHelperInfo *info;
+            cpu_interrupts_enabled(env);
-     TCGOp *op;
+ }
++#endif /* !CONFIG_USER_ONLY */
-     info = g_hash_table_lookup(helper_table, (gpointer)func);
-     flags = info->flags;
+ static char *sparc_cpu_type_name(const char *cpu_model)
--    sizemask = info->sizemask;
+ {
-+    typemask = info->typemask;
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps sparc_tcg_ops = {
+     .tlb_fill = sparc_cpu_tlb_fill,
- #ifdef CONFIG_PLUGIN
-     /* detect non-plugin helpers */
+ #ifndef CONFIG_USER_ONLY
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args)
++    .has_work = sparc_cpu_has_work,
-     && !defined(CONFIG_TCG_INTERPRETER)
+     .cpu_exec_interrupt = sparc_cpu_exec_interrupt,
-     /* We have 64-bit values in one register, but need to pass as two
+     .do_interrupt = sparc_cpu_do_interrupt,
-        separate parameters.  Split them.  */
+     .do_transaction_failed = sparc_cpu_do_transaction_failed,
--    int orig_sizemask = sizemask;
+@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
-+    int orig_typemask = typemask;
-     int orig_nargs = nargs;
+     cc->class_by_name = sparc_cpu_class_by_name;
-     TCGv_i64 retl, reth;
+     cc->parse_features = sparc_cpu_parse_features;
-     TCGTemp *split_args[MAX_OPC_PARAM];
+-    cc->has_work = sparc_cpu_has_work;
+     cc->dump_state = sparc_cpu_dump_state;
-     retl = NULL;
+ #if !defined(TARGET_SPARC64) && !defined(CONFIG_USER_ONLY)
-     reth = NULL;
+     cc->memory_rw_debug = sparc_cpu_memory_rw_debug;
 -    if (sizemask != 0) {
 -        for (i = real_args = 0; i < nargs; ++i) {
 -            int is_64bit = sizemask & (1 << (i+1)*2);
 -            if (is_64bit) {
 -                TCGv_i64 orig = temp_tcgv_i64(args[i]);
 -                TCGv_i32 h = tcg_temp_new_i32();
 -                TCGv_i32 l = tcg_temp_new_i32();
 -                tcg_gen_extr_i64_i32(l, h, orig);
 -                split_args[real_args++] = tcgv_i32_temp(h);
 -                split_args[real_args++] = tcgv_i32_temp(l);
 -            } else {
 -                split_args[real_args++] = args[i];
 -            }
 +    typemask = 0;
 +    for (i = real_args = 0; i < nargs; ++i) {
 +        int argtype = extract32(orig_typemask, (i + 1) * 3, 3);
 +        bool is_64bit = (argtype & ~1) == dh_typecode_i64;
 +
 +        if (is_64bit) {
 +            TCGv_i64 orig = temp_tcgv_i64(args[i]);
 +            TCGv_i32 h = tcg_temp_new_i32();
 +            TCGv_i32 l = tcg_temp_new_i32();
 +            tcg_gen_extr_i64_i32(l, h, orig);
 +            split_args[real_args++] = tcgv_i32_temp(h);
 +            typemask |= dh_typecode_i32 << (real_args * 3);
 +            split_args[real_args++] = tcgv_i32_temp(l);
 +            typemask |= dh_typecode_i32 << (real_args * 3);
 +        } else {
 +            split_args[real_args++] = args[i];
 +            typemask |= argtype << (real_args * 3);
          }
 -        nargs = real_args;
 -        args = split_args;
 -        sizemask = 0;
      }
 +    nargs = real_args;
 +    args = split_args;
  #elif defined(TCG_TARGET_EXTEND_ARGS) && TCG_TARGET_REG_BITS == 64
      for (i = 0; i < nargs; ++i) {
 -        int is_64bit = sizemask & (1 << (i+1)*2);
 -        int is_signed = sizemask & (2 << (i+1)*2);
 -        if (!is_64bit) {
 +        int argtype = extract32(typemask, (i + 1) * 3, 3);
 +        bool is_32bit = (argtype & ~1) == dh_typecode_i32;
 +        bool is_signed = argtype & 1;
 +
 +        if (is_32bit) {
              TCGv_i64 temp = tcg_temp_new_i64();
              TCGv_i64 orig = temp_tcgv_i64(args[i]);
              if (is_signed) {
@@ -XXX,XX +XXX,XX @@ void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args)
      if (ret != NULL) {
  #if defined(__sparc__) && !defined(__arch64__) \
      && !defined(CONFIG_TCG_INTERPRETER)
 -        if (orig_sizemask & 1) {
 +        if ((typemask & 6) == dh_typecode_i64) {
              /* The 32-bit ABI is going to return the 64-bit value in
                 the %o0/%o1 register pair.  Prepare for this by using
                 two return temporaries, and reassemble below.  */
@@ -XXX,XX +XXX,XX @@ void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args)
              nb_rets = 1;
          }
  #else
 -        if (TCG_TARGET_REG_BITS < 64 && (sizemask & 1)) {
 +        if (TCG_TARGET_REG_BITS < 64 && (typemask & 6) == dh_typecode_i64) {
  #ifdef HOST_WORDS_BIGENDIAN
              op->args[pi++] = temp_arg(ret + 1);
              op->args[pi++] = temp_arg(ret);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args)
      real_args = 0;
      for (i = 0; i < nargs; i++) {
 -        int is_64bit = sizemask & (1 << (i+1)*2);
 +        int argtype = extract32(typemask, (i + 1) * 3, 3);
 +        bool is_64bit = (argtype & ~1) == dh_typecode_i64;
 +
          if (TCG_TARGET_REG_BITS < 64 && is_64bit) {
  #ifdef TCG_TARGET_CALL_ALIGN_ARGS
              /* some targets want aligned 64 bit args */
@@ -XXX,XX +XXX,XX @@ void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args)
      && !defined(CONFIG_TCG_INTERPRETER)
      /* Free all of the parts we allocated above.  */
      for (i = real_args = 0; i < orig_nargs; ++i) {
 -        int is_64bit = orig_sizemask & (1 << (i+1)*2);
 +        int argtype = extract32(orig_typemask, (i + 1) * 3, 3);
 +        bool is_64bit = (argtype & ~1) == dh_typecode_i64;
 +
          if (is_64bit) {
              tcg_temp_free_internal(args[real_args++]);
              tcg_temp_free_internal(args[real_args++]);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args)
              real_args++;
          }
      }
 -    if (orig_sizemask & 1) {
 +    if ((orig_typemask & 6) == dh_typecode_i64) {
          /* The 32-bit ABI returned two 32-bit pieces.  Re-assemble them.
             Note that describing these as TCGv_i64 eliminates an unnecessary
             zero-extension that tcg_gen_concat_i32_i64 would create.  */
@@ -XXX,XX +XXX,XX @@ void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args)
      }
  #elif defined(TCG_TARGET_EXTEND_ARGS) && TCG_TARGET_REG_BITS == 64
      for (i = 0; i < nargs; ++i) {
 -        int is_64bit = sizemask & (1 << (i+1)*2);
 -        if (!is_64bit) {
 +        int argtype = extract32(typemask, (i + 1) * 3, 3);
 +        bool is_32bit = (argtype & ~1) == dh_typecode_i32;
 +
 +        if (is_32bit) {
              tcg_temp_free_internal(args[i]);
          }
      }
 --
 .25.1

-[PULL 10/33] tcg/tci: Move call-return regs to end of tcg_target_reg_alloc_order
+[PULL 29/35] target/tricore: Restrict has_work() handler to sysemu
-As the only call-clobbered regs for TCI, these should
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 receive the least priority.
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Restrict has_work() to sysemu.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210912172731.789788-29-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci/tcg-target.c.inc | 4 ++--
+ target/tricore/cpu.c | 6 +++++-
-file changed, 2 insertions(+), 2 deletions(-)
+file changed, 5 insertions(+), 1 deletion(-)
-diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
+diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target.c.inc
+--- a/target/tricore/cpu.c
-+++ b/tcg/tci/tcg-target.c.inc
++++ b/target/tricore/cpu.c
-@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
+@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_reset(DeviceState *dev)
      cpu_state_reset(env);
  }
- static const int tcg_target_reg_alloc_order[] = {
++#if !defined(CONFIG_USER_ONLY)
--    TCG_REG_R0,
+ static bool tricore_cpu_has_work(CPUState *cs)
--    TCG_REG_R1,
+ {
-     TCG_REG_R2,
+     return true;
-     TCG_REG_R3,
+ }
-     TCG_REG_R4,
++#endif /* !CONFIG_USER_ONLY */
-@@ -XXX,XX +XXX,XX @@ static const int tcg_target_reg_alloc_order[] = {
-     TCG_REG_R13,
+ static void tricore_cpu_realizefn(DeviceState *dev, Error **errp)
-     TCG_REG_R14,
+ {
-     TCG_REG_R15,
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps tricore_tcg_ops = {
-+    TCG_REG_R1,
+     .initialize = tricore_tcg_init,
-+    TCG_REG_R0,
+     .synchronize_from_tb = tricore_cpu_synchronize_from_tb,
      .tlb_fill = tricore_cpu_tlb_fill,
 +#if !defined(CONFIG_USER_ONLY)
 +    .has_work = tricore_cpu_has_work,
 +#endif
  };
- #if MAX_OPC_PARAM_IARGS != 6
+ static void tricore_cpu_class_init(ObjectClass *c, void *data)
@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_class_init(ObjectClass *c, void *data)
      device_class_set_parent_reset(dc, tricore_cpu_reset, &mcc->parent_reset);
      cc->class_by_name = tricore_cpu_class_by_name;
 -    cc->has_work = tricore_cpu_has_work;
      cc->gdb_read_register = tricore_cpu_gdb_read_register;
      cc->gdb_write_register = tricore_cpu_gdb_write_register;
 --
 .25.1

-[PULL 03/33] accel/tcg/plugin-gen: Drop inline markers
+[PULL 30/35] target/xtensa: Restrict has_work() handler to sysemu
-Let the compiler decide on inlining.
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Restrict has_work() to sysemu.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210912172731.789788-30-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/plugin-gen.c | 12 +++++-------
+ target/xtensa/cpu.c | 14 +++++++-------
-file changed, 5 insertions(+), 7 deletions(-)
+file changed, 7 insertions(+), 7 deletions(-)
-diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
+diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/plugin-gen.c
+--- a/target/xtensa/cpu.c
-+++ b/accel/tcg/plugin-gen.c
++++ b/target/xtensa/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void gen_empty_mem_helper(void)
+@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_set_pc(CPUState *cs, vaddr value)
-     tcg_temp_free_ptr(ptr);
+     cpu->env.pc = value;
  }
--static inline
++#ifndef CONFIG_USER_ONLY
--void gen_plugin_cb_start(enum plugin_gen_from from,
++
--                         enum plugin_gen_cb type, unsigned wr)
+ static bool xtensa_cpu_has_work(CPUState *cs)
 +static void gen_plugin_cb_start(enum plugin_gen_from from,
 +                                enum plugin_gen_cb type, unsigned wr)
  {
-     TCGOp *op;
+-#ifndef CONFIG_USER_ONLY
+     XtensaCPU *cpu = XTENSA_CPU(cs);
-@@ -XXX,XX +XXX,XX @@ static void gen_wrapped(enum plugin_gen_from from,
-     tcg_gen_plugin_cb_end();
+     return !cpu->env.runstall && cpu->env.pending_irq_level;
 -#else
 -    return true;
 -#endif
  }
--static inline void plugin_gen_empty_callback(enum plugin_gen_from from)
+-#ifdef CONFIG_USER_ONLY
-+static void plugin_gen_empty_callback(enum plugin_gen_from from)
++#else /* CONFIG_USER_ONLY*/
 +
  static bool abi_call0;
  void xtensa_set_abi_call0(void)
@@ -XXX,XX +XXX,XX @@ bool xtensa_abi_call0(void)
  {
-     switch (from) {
+     return abi_call0;
      case PLUGIN_GEN_AFTER_INSN:
@@ -XXX,XX +XXX,XX @@ static bool op_rw(const TCGOp *op, const struct qemu_plugin_dyn_cb *cb)
      return !!(cb->rw & (w + 1));
  }
+-#endif
--static inline
++
--void inject_cb_type(const GArray *cbs, TCGOp *begin_op, inject_fn inject,
++#endif /* CONFIG_USER_ONLY */
--                    op_ok_fn ok)
-+static void inject_cb_type(const GArray *cbs, TCGOp *begin_op,
+ static void xtensa_cpu_reset(DeviceState *dev)
 +                           inject_fn inject, op_ok_fn ok)
  {
-     TCGOp *end_op;
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps xtensa_tcg_ops = {
-     TCGOp *op;
+     .debug_excp_handler = xtensa_breakpoint_handler,
  #ifndef CONFIG_USER_ONLY
 +    .has_work = xtensa_cpu_has_work,
      .cpu_exec_interrupt = xtensa_cpu_exec_interrupt,
      .do_interrupt = xtensa_cpu_do_interrupt,
      .do_transaction_failed = xtensa_cpu_do_transaction_failed,
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
      device_class_set_parent_reset(dc, xtensa_cpu_reset, &xcc->parent_reset);
      cc->class_by_name = xtensa_cpu_class_by_name;
 -    cc->has_work = xtensa_cpu_has_work;
      cc->dump_state = xtensa_cpu_dump_state;
      cc->set_pc = xtensa_cpu_set_pc;
      cc->gdb_read_register = xtensa_cpu_gdb_read_register;
 --
 .25.1

-[PULL 14/33] tcg/tci: Remove tci_write_reg
+[PULL 31/35] accel: Add missing AccelOpsClass::has_work() and drop SysemuCPUOps one
-Inline it into its one caller, tci_write_reg64.
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Drop the asserts that are redundant with tcg_read_r.
+cpu_common_has_work() is the default has_work() implementation
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+and returns 'false'.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Explicit it for the QTest / HAX / HVF / NVMM / Xen accelerators
 and remove cpu_common_has_work().
 Since there are no more implementations of SysemuCPUOps::has_work,
 remove it along with the assertion in cpu_has_work().
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Acked-by: Paul Durrant <paul@xen.org>
 Message-Id: <20210912172731.789788-31-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c | 13 ++-----------
+ include/hw/core/cpu.h             | 2 --
-file changed, 2 insertions(+), 11 deletions(-)
+ accel/hvf/hvf-accel-ops.c         | 6 ++++++
+ accel/qtest/qtest.c               | 6 ++++++
-diff --git a/tcg/tci.c b/tcg/tci.c
+ accel/xen/xen-all.c               | 6 ++++++
-index XXXXXXX..XXXXXXX 100644
+ hw/core/cpu-common.c              | 6 ------
---- a/tcg/tci.c
+ softmmu/cpus.c                    | 9 ++-------
-+++ b/tcg/tci.c
+ target/i386/hax/hax-accel-ops.c   | 6 ++++++
-@@ -XXX,XX +XXX,XX @@
+ target/i386/nvmm/nvmm-accel-ops.c | 6 ++++++
+files changed, 32 insertions(+), 15 deletions(-)
- __thread uintptr_t tci_tb_ptr;
+diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
--static void
+index XXXXXXX..XXXXXXX 100644
--tci_write_reg(tcg_target_ulong *regs, TCGReg index, tcg_target_ulong value)
+--- a/include/hw/core/cpu.h
 +++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ struct SysemuCPUOps;
   * instantiatable CPU type.
   * @parse_features: Callback to parse command line arguments.
   * @reset_dump_flags: #CPUDumpFlags to use for reset logging.
 - * @has_work: Callback for checking if there is work to do.
   * @memory_rw_debug: Callback for GDB memory access.
   * @dump_state: Callback for dumping state.
   * @get_arch_id: Callback for getting architecture-dependent CPU ID.
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
      void (*parse_features)(const char *typename, char *str, Error **errp);
      int reset_dump_flags;
 -    bool (*has_work)(CPUState *cpu);
      int (*memory_rw_debug)(CPUState *cpu, vaddr addr,
                             uint8_t *buf, int len, bool is_write);
      void (*dump_state)(CPUState *cpu, FILE *, int flags);
 diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/hvf/hvf-accel-ops.c
 +++ b/accel/hvf/hvf-accel-ops.c
@@ -XXX,XX +XXX,XX @@ static void hvf_start_vcpu_thread(CPUState *cpu)
                         cpu, QEMU_THREAD_JOINABLE);
  }
 +static bool hvf_cpu_has_work(CPUState *cpu)
 +{
 +    return false;
 +}
 +
  static void hvf_accel_ops_class_init(ObjectClass *oc, void *data)
  {
      AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void hvf_accel_ops_class_init(ObjectClass *oc, void *data)
      ops->synchronize_post_init = hvf_cpu_synchronize_post_init;
      ops->synchronize_state = hvf_cpu_synchronize_state;
      ops->synchronize_pre_loadvm = hvf_cpu_synchronize_pre_loadvm;
 +    ops->has_work = hvf_cpu_has_work;
  };
  static const TypeInfo hvf_accel_ops_type = {
      .name = ACCEL_OPS_NAME("hvf"),
 diff --git a/accel/qtest/qtest.c b/accel/qtest/qtest.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/qtest/qtest.c
 +++ b/accel/qtest/qtest.c
@@ -XXX,XX +XXX,XX @@ static const TypeInfo qtest_accel_type = {
  };
  module_obj(TYPE_QTEST_ACCEL);
 +static bool qtest_cpu_has_work(CPUState *cpu)
 +{
 +    return false;
 +}
 +
  static void qtest_accel_ops_class_init(ObjectClass *oc, void *data)
  {
      AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
      ops->create_vcpu_thread = dummy_start_vcpu_thread;
      ops->get_virtual_clock = qtest_get_virtual_clock;
 +    ops->has_work = qtest_cpu_has_work;
  };
  static const TypeInfo qtest_accel_ops_type = {
 diff --git a/accel/xen/xen-all.c b/accel/xen/xen-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/xen/xen-all.c
 +++ b/accel/xen/xen-all.c
@@ -XXX,XX +XXX,XX @@ static const TypeInfo xen_accel_type = {
      .class_init = xen_accel_class_init,
  };
 +static bool xen_cpu_has_work(CPUState *cpu)
 +{
 +    return false;
 +}
 +
  static void xen_accel_ops_class_init(ObjectClass *oc, void *data)
  {
      AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
      ops->create_vcpu_thread = dummy_start_vcpu_thread;
 +    ops->has_work = xen_cpu_has_work;
  }
  static const TypeInfo xen_accel_ops_type = {
 diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/core/cpu-common.c
 +++ b/hw/core/cpu-common.c
@@ -XXX,XX +XXX,XX @@ static void cpu_common_reset(DeviceState *dev)
      }
  }
 -static bool cpu_common_has_work(CPUState *cs)
 -{
--    tci_assert(index < TCG_TARGET_NB_REGS);
+-    return false;
 -    tci_assert(index != TCG_AREG0);
 -    tci_assert(index != TCG_REG_CALL_STACK);
 -    regs[index] = value;
 -}
 -
- static void tci_write_reg64(tcg_target_ulong *regs, uint32_t high_index,
+ ObjectClass *cpu_class_by_name(const char *typename, const char *cpu_model)
-                             uint32_t low_index, uint64_t value)
+ {
- {
+     CPUClass *cc = CPU_CLASS(object_class_by_name(typename));
--    tci_write_reg(regs, low_index, value);
+@@ -XXX,XX +XXX,XX @@ static void cpu_class_init(ObjectClass *klass, void *data)
--    tci_write_reg(regs, high_index, value >> 32);
-+    regs[low_index] = value;
+     k->parse_features = cpu_common_parse_features;
-+    regs[high_index] = value >> 32;
+     k->get_arch_id = cpu_common_get_arch_id;
- }
+-    k->has_work = cpu_common_has_work;
+     k->gdb_read_register = cpu_common_gdb_read_register;
- /* Create a 64 bit value from two 32 bit values. */
+     k->gdb_write_register = cpu_common_gdb_write_register;
      set_bit(DEVICE_CATEGORY_CPU, dc->categories);
 diff --git a/softmmu/cpus.c b/softmmu/cpus.c
 index XXXXXXX..XXXXXXX 100644
 --- a/softmmu/cpus.c
 +++ b/softmmu/cpus.c
@@ -XXX,XX +XXX,XX @@ void cpu_interrupt(CPUState *cpu, int mask)
  bool cpu_has_work(CPUState *cpu)
  {
 -    CPUClass *cc = CPU_GET_CLASS(cpu);
 -
 -    if (cpus_accel->has_work) {
 -        return cpus_accel->has_work(cpu);
 -    }
 -    g_assert(cc->has_work);
 -    return cc->has_work(cpu);
 +    g_assert(cpus_accel->has_work);
 +    return cpus_accel->has_work(cpu);
  }
  static int do_vm_stop(RunState state, bool send_stop)
 diff --git a/target/i386/hax/hax-accel-ops.c b/target/i386/hax/hax-accel-ops.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hax/hax-accel-ops.c
 +++ b/target/i386/hax/hax-accel-ops.c
@@ -XXX,XX +XXX,XX @@ static void hax_start_vcpu_thread(CPUState *cpu)
  #endif
  }
 +static bool hax_cpu_has_work(CPUState *cpu)
 +{
 +    return false;
 +}
 +
  static void hax_accel_ops_class_init(ObjectClass *oc, void *data)
  {
      AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void hax_accel_ops_class_init(ObjectClass *oc, void *data)
      ops->synchronize_post_init = hax_cpu_synchronize_post_init;
      ops->synchronize_state = hax_cpu_synchronize_state;
      ops->synchronize_pre_loadvm = hax_cpu_synchronize_pre_loadvm;
 +    ops->has_work = hax_cpu_has_work;
  }
  static const TypeInfo hax_accel_ops_type = {
 diff --git a/target/i386/nvmm/nvmm-accel-ops.c b/target/i386/nvmm/nvmm-accel-ops.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/nvmm/nvmm-accel-ops.c
 +++ b/target/i386/nvmm/nvmm-accel-ops.c
@@ -XXX,XX +XXX,XX @@ static void nvmm_kick_vcpu_thread(CPUState *cpu)
      cpus_kick_thread(cpu);
  }
 +static bool nvmm_cpu_has_work(CPUState *cpu)
 +{
 +    return false;
 +}
 +
  static void nvmm_accel_ops_class_init(ObjectClass *oc, void *data)
  {
      AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void nvmm_accel_ops_class_init(ObjectClass *oc, void *data)
      ops->synchronize_post_init = nvmm_cpu_synchronize_post_init;
      ops->synchronize_state = nvmm_cpu_synchronize_state;
      ops->synchronize_pre_loadvm = nvmm_cpu_synchronize_pre_loadvm;
 +    ops->has_work = nvmm_cpu_has_work;
  }
  static const TypeInfo nvmm_accel_ops_type = {
 --
 .25.1

-[PULL 11/33] tcg/tci: Use ffi for calls
+[PULL 32/35] tcg/mips: Drop inline markers
-This requires adjusting where arguments are stored.
+Let the compiler decide about inlining.
-Place them on the stack at left-aligned positions.
+Remove tcg_out_ext8s and tcg_out_ext16s as unused.
-Adjust the stack frame to be at entirely positive offsets.
 Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/tcg/tcg.h        |   1 +
+ tcg/mips/tcg-target.c.inc | 76 ++++++++++++++-------------------------
- tcg/tci/tcg-target.h     |   2 +-
+file changed, 27 insertions(+), 49 deletions(-)
- tcg/tcg.c                |  64 +++++++++++++-----
- tcg/tci.c                | 142 ++++++++++++++++++++++-----------------
+diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
  tcg/tci/tcg-target.c.inc |  50 +++++++-------
 files changed, 153 insertions(+), 106 deletions(-)
 diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/tcg/tcg.h
+--- a/tcg/mips/tcg-target.c.inc
-+++ b/include/tcg/tcg.h
++++ b/tcg/mips/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static bool patch_reloc(tcg_insn_unit *code_ptr, int type,
- #define MAX_OPC_PARAM (4 + (MAX_OPC_PARAM_PER_ARG * MAX_OPC_PARAM_ARGS))
+ #endif
- #define CPU_TEMP_BUF_NLONGS 128
-+#define TCG_STATIC_FRAME_SIZE  (CPU_TEMP_BUF_NLONGS * sizeof(long))
+-static inline bool is_p2m1(tcg_target_long val)
++static bool is_p2m1(tcg_target_long val)
- /* Default target word size to pointer size.  */
+ {
- #ifndef TCG_TARGET_REG_BITS
+     return val && ((val + 1) & val) == 0;
-diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
+ }
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.h
 +++ b/tcg/tci/tcg-target.h
 @@ -XXX,XX +XXX,XX @@ typedef enum {
+ /*
- /* Used for function call generation. */
+  * Type reg
- #define TCG_TARGET_CALL_STACK_OFFSET    0
+  */
--#define TCG_TARGET_STACK_ALIGN          16
+-static inline void tcg_out_opc_reg(TCGContext *s, MIPSInsn opc,
-+#define TCG_TARGET_STACK_ALIGN          8
+-                                   TCGReg rd, TCGReg rs, TCGReg rt)
++static void tcg_out_opc_reg(TCGContext *s, MIPSInsn opc,
- #define HAVE_TCG_QEMU_TB_EXEC
++                            TCGReg rd, TCGReg rs, TCGReg rt)
+ {
-diff --git a/tcg/tcg.c b/tcg/tcg.c
+     int32_t inst;
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg.c
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_opc_reg(TCGContext *s, MIPSInsn opc,
-+++ b/tcg/tcg.c
+ /*
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_st(TCGContext *s, TCGType type, TCGReg arg, TCGReg arg1,
+  * Type immediate
-                        intptr_t arg2);
+  */
- static bool tcg_out_sti(TCGContext *s, TCGType type, TCGArg val,
+-static inline void tcg_out_opc_imm(TCGContext *s, MIPSInsn opc,
-                         TCGReg base, intptr_t ofs);
+-                                   TCGReg rt, TCGReg rs, TCGArg imm)
-+#ifdef CONFIG_TCG_INTERPRETER
++static void tcg_out_opc_imm(TCGContext *s, MIPSInsn opc,
-+static void tcg_out_call(TCGContext *s, const tcg_insn_unit *target,
++                            TCGReg rt, TCGReg rs, TCGArg imm)
-+                         ffi_cif *cif);
+ {
-+#else
+     int32_t inst;
- static void tcg_out_call(TCGContext *s, const tcg_insn_unit *target);
-+#endif
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_opc_imm(TCGContext *s, MIPSInsn opc,
- static bool tcg_target_const_match(int64_t val, TCGType type, int ct);
+ /*
- #ifdef TCG_TARGET_NEED_LDST_LABELS
+  * Type bitfield
- static int tcg_out_ldst_finalize(TCGContext *s);
+  */
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args)
+-static inline void tcg_out_opc_bf(TCGContext *s, MIPSInsn opc, TCGReg rt,
-     for (i = 0; i < nargs; i++) {
+-                                  TCGReg rs, int msb, int lsb)
-         int argtype = extract32(typemask, (i + 1) * 3, 3);
++static void tcg_out_opc_bf(TCGContext *s, MIPSInsn opc, TCGReg rt,
-         bool is_64bit = (argtype & ~1) == dh_typecode_i64;
++                           TCGReg rs, int msb, int lsb)
-+        bool want_align = false;
+ {
-+
+     int32_t inst;
-+#if defined(CONFIG_TCG_INTERPRETER)
-+        /*
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_opc_bf(TCGContext *s, MIPSInsn opc, TCGReg rt,
-+         * Align all arguments, so that they land in predictable places
+     tcg_out32(s, inst);
-+         * for passing off to ffi_call.
+ }
-+         */
-+        want_align = true;
+-static inline void tcg_out_opc_bf64(TCGContext *s, MIPSInsn opc, MIPSInsn opm,
-+#elif defined(TCG_TARGET_CALL_ALIGN_ARGS)
+-                                    MIPSInsn oph, TCGReg rt, TCGReg rs,
-+        /* Some targets want aligned 64 bit args */
++static void tcg_out_opc_bf64(TCGContext *s, MIPSInsn opc, MIPSInsn opm,
-+        want_align = is_64bit;
++                             MIPSInsn oph, TCGReg rt, TCGReg rs,
-+#endif
+                                     int msb, int lsb)
-+
+ {
-+        if (TCG_TARGET_REG_BITS < 64 && want_align && (real_args & 1)) {
+     if (lsb >= 32) {
-+            op->args[pi++] = TCG_CALL_DUMMY_ARG;
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_opc_bf64(TCGContext *s, MIPSInsn opc, MIPSInsn opm,
-+            real_args++;
+ /*
-+        }
+  * Type branch
+  */
-         if (TCG_TARGET_REG_BITS < 64 && is_64bit) {
+-static inline void tcg_out_opc_br(TCGContext *s, MIPSInsn opc,
--#ifdef TCG_TARGET_CALL_ALIGN_ARGS
+-                                  TCGReg rt, TCGReg rs)
--            /* some targets want aligned 64 bit args */
++static void tcg_out_opc_br(TCGContext *s, MIPSInsn opc, TCGReg rt, TCGReg rs)
--            if (real_args & 1) {
+ {
--                op->args[pi++] = TCG_CALL_DUMMY_ARG;
+     tcg_out_opc_imm(s, opc, rt, rs, 0);
--                real_args++;
+ }
--            }
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_opc_br(TCGContext *s, MIPSInsn opc,
--#endif
+ /*
--           /* If stack grows up, then we will be placing successive
+  * Type sa
--              arguments at lower addresses, which means we need to
+  */
--              reverse the order compared to how we would normally
+-static inline void tcg_out_opc_sa(TCGContext *s, MIPSInsn opc,
--              treat either big or little-endian.  For those arguments
+-                                  TCGReg rd, TCGReg rt, TCGArg sa)
--              that will wind up in registers, this still works for
++static void tcg_out_opc_sa(TCGContext *s, MIPSInsn opc,
--              HPPA (the only current STACK_GROWSUP target) since the
++                           TCGReg rd, TCGReg rt, TCGArg sa)
--              argument registers are *also* allocated in decreasing
+ {
--              order.  If another such target is added, this logic may
+     int32_t inst;
--              have to get more complicated to differentiate between
--              stack arguments and register arguments.  */
+@@ -XXX,XX +XXX,XX @@ static bool tcg_out_opc_jmp(TCGContext *s, MIPSInsn opc, const void *target)
-+            /*
+     return true;
-+             * If stack grows up, then we will be placing successive
+ }
-+             * arguments at lower addresses, which means we need to
-+             * reverse the order compared to how we would normally
+-static inline void tcg_out_nop(TCGContext *s)
-+             * treat either big or little-endian.  For those arguments
++static void tcg_out_nop(TCGContext *s)
-+             * that will wind up in registers, this still works for
+ {
-+             * HPPA (the only current STACK_GROWSUP target) since the
+     tcg_out32(s, 0);
-+             * argument registers are *also* allocated in decreasing
+ }
-+             * order.  If another such target is added, this logic may
-+             * have to get more complicated to differentiate between
+-static inline void tcg_out_dsll(TCGContext *s, TCGReg rd, TCGReg rt, TCGArg sa)
-+             * stack arguments and register arguments.
++static void tcg_out_dsll(TCGContext *s, TCGReg rd, TCGReg rt, TCGArg sa)
-+             */
+ {
- #if defined(HOST_WORDS_BIGENDIAN) != defined(TCG_TARGET_STACK_GROWSUP)
+     tcg_out_opc_sa64(s, OPC_DSLL, OPC_DSLL32, rd, rt, sa);
-             op->args[pi++] = temp_arg(args[i] + 1);
+ }
-             op->args[pi++] = temp_arg(args[i]);
-@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_call(TCGContext *s, TCGOp *op)
+-static inline void tcg_out_dsrl(TCGContext *s, TCGReg rd, TCGReg rt, TCGArg sa)
-     const int nb_oargs = TCGOP_CALLO(op);
++static void tcg_out_dsrl(TCGContext *s, TCGReg rd, TCGReg rt, TCGArg sa)
-     const int nb_iargs = TCGOP_CALLI(op);
+ {
-     const TCGLifeData arg_life = op->life;
+     tcg_out_opc_sa64(s, OPC_DSRL, OPC_DSRL32, rd, rt, sa);
-+    const TCGHelperInfo *info;
+ }
-     int flags, nb_regs, i;
-     TCGReg reg;
+-static inline void tcg_out_dsra(TCGContext *s, TCGReg rd, TCGReg rt, TCGArg sa)
-     TCGArg arg;
++static void tcg_out_dsra(TCGContext *s, TCGReg rd, TCGReg rt, TCGArg sa)
-@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_call(TCGContext *s, TCGOp *op)
+ {
-     TCGRegSet allocated_regs;
+     tcg_out_opc_sa64(s, OPC_DSRA, OPC_DSRA32, rd, rt, sa);
+ }
-     func_addr = tcg_call_func(op);
--    flags = tcg_call_flags(op);
+-static inline bool tcg_out_mov(TCGContext *s, TCGType type,
-+    info = tcg_call_info(op);
+-                               TCGReg ret, TCGReg arg)
-+    flags = info->flags;
++static bool tcg_out_mov(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg)
+ {
-     nb_regs = ARRAY_SIZE(tcg_target_call_iarg_regs);
+     /* Simple reg-reg move, optimising out the 'do nothing' case */
-     if (nb_regs > nb_iargs) {
+     if (ret != arg) {
-@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_call(TCGContext *s, TCGOp *op)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_bswap64(TCGContext *s, TCGReg ret, TCGReg arg)
          save_globals(s, allocated_regs);
      }
+ }
-+#ifdef CONFIG_TCG_INTERPRETER
-+    {
+-static inline void tcg_out_ext8s(TCGContext *s, TCGReg ret, TCGReg arg)
 +        gpointer hash = (gpointer)(uintptr_t)info->typemask;
 +        ffi_cif *cif = g_hash_table_lookup(ffi_table, hash);
 +        assert(cif != NULL);
 +        tcg_out_call(s, func_addr, cif);
 +    }
 +#else
      tcg_out_call(s, func_addr);
 +#endif
      /* assign output registers and emit moves if needed */
      for(i = 0; i < nb_oargs; i++) {
 diff --git a/tcg/tci.c b/tcg/tci.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci.c
 +++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
 +#include "qemu-common.h"
 +#include "tcg/tcg.h"           /* MAX_OPC_PARAM_IARGS */
 +#include "exec/cpu_ldst.h"
 +#include "tcg/tcg-op.h"
 +#include "qemu/compiler.h"
 +#include <ffi.h>
 -/* Enable TCI assertions only when debugging TCG (and without NDEBUG defined).
 - * Without assertions, the interpreter runs much faster. */
 +
 +/*
 + * Enable TCI assertions only when debugging TCG (and without NDEBUG defined).
 + * Without assertions, the interpreter runs much faster.
 + */
  #if defined(CONFIG_DEBUG_TCG)
  # define tci_assert(cond) assert(cond)
  #else
  # define tci_assert(cond) ((void)(cond))
  #endif
 -#include "qemu-common.h"
 -#include "tcg/tcg.h"           /* MAX_OPC_PARAM_IARGS */
 -#include "exec/cpu_ldst.h"
 -#include "tcg/tcg-op.h"
 -#include "qemu/compiler.h"
 -
 -#if MAX_OPC_PARAM_IARGS != 6
 -# error Fix needed, number of supported input arguments changed!
 -#endif
 -#if TCG_TARGET_REG_BITS == 32
 -typedef uint64_t (*helper_function)(tcg_target_ulong, tcg_target_ulong,
 -                                    tcg_target_ulong, tcg_target_ulong,
 -                                    tcg_target_ulong, tcg_target_ulong,
 -                                    tcg_target_ulong, tcg_target_ulong,
 -                                    tcg_target_ulong, tcg_target_ulong,
 -                                    tcg_target_ulong, tcg_target_ulong);
 -#else
 -typedef uint64_t (*helper_function)(tcg_target_ulong, tcg_target_ulong,
 -                                    tcg_target_ulong, tcg_target_ulong,
 -                                    tcg_target_ulong, tcg_target_ulong);
 -#endif
 -
  __thread uintptr_t tci_tb_ptr;
 -static tcg_target_ulong tci_read_reg(const tcg_target_ulong *regs, TCGReg index)
 -{
--    tci_assert(index < TCG_TARGET_NB_REGS);
+-    if (use_mips32r2_instructions) {
--    return regs[index];
+-        tcg_out_opc_reg(s, OPC_SEB, ret, 0, arg);
 -    } else {
 -        tcg_out_opc_sa(s, OPC_SLL, ret, arg, 24);
 -        tcg_out_opc_sa(s, OPC_SRA, ret, ret, 24);
 -    }
 -}
 -
- static void
+-static inline void tcg_out_ext16s(TCGContext *s, TCGReg ret, TCGReg arg)
- tci_write_reg(tcg_target_ulong *regs, TCGReg index, tcg_target_ulong value)
+-{
- {
+-    if (use_mips32r2_instructions) {
-@@ -XXX,XX +XXX,XX @@ static tcg_target_ulong tci_read_label(const uint8_t **tb_ptr)
+-        tcg_out_opc_reg(s, OPC_SEH, ret, 0, arg);
-  *   I = immediate (tcg_target_ulong)
+-    } else {
-  *   l = label or pointer
+-        tcg_out_opc_sa(s, OPC_SLL, ret, arg, 16);
-  *   m = immediate (TCGMemOpIdx)
+-        tcg_out_opc_sa(s, OPC_SRA, ret, ret, 16);
-+ *   n = immediate (call return length)
+-    }
-  *   r = register
+-}
-  *   s = signed ldst offset
+-
-  */
+-static inline void tcg_out_ext32u(TCGContext *s, TCGReg ret, TCGReg arg)
-@@ -XXX,XX +XXX,XX @@ static void tci_args_l(const uint8_t **tb_ptr, void **l0)
++static void tcg_out_ext32u(TCGContext *s, TCGReg ret, TCGReg arg)
-     check_size(start, tb_ptr);
+ {
- }
+     if (use_mips32r2_instructions) {
+         tcg_out_opc_bf(s, OPC_DEXT, ret, arg, 31, 0);
-+static void tci_args_nll(const uint8_t **tb_ptr, uint8_t *n0,
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_ldst(TCGContext *s, MIPSInsn opc, TCGReg data,
-+                         void **l1, void **l2)
+     tcg_out_opc_imm(s, opc, data, addr, lo);
-+{
+ }
-+    const uint8_t *start = *tb_ptr;
-+
+-static inline void tcg_out_ld(TCGContext *s, TCGType type, TCGReg arg,
-+    *n0 = tci_read_b(tb_ptr);
+-                              TCGReg arg1, intptr_t arg2)
-+    *l1 = (void *)tci_read_label(tb_ptr);
++static void tcg_out_ld(TCGContext *s, TCGType type, TCGReg arg,
-+    *l2 = (void *)tci_read_label(tb_ptr);
++                       TCGReg arg1, intptr_t arg2)
-+
+ {
-+    check_size(start, tb_ptr);
+     MIPSInsn opc = OPC_LD;
-+}
+     if (TCG_TARGET_REG_BITS == 32 || type == TCG_TYPE_I32) {
-+
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_ld(TCGContext *s, TCGType type, TCGReg arg,
- static void tci_args_rr(const uint8_t **tb_ptr,
+     tcg_out_ldst(s, opc, arg, arg1, arg2);
-                         TCGReg *r0, TCGReg *r1)
+ }
- {
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+-static inline void tcg_out_st(TCGContext *s, TCGType type, TCGReg arg,
- {
+-                              TCGReg arg1, intptr_t arg2)
-     const uint8_t *tb_ptr = v_tb_ptr;
++static void tcg_out_st(TCGContext *s, TCGType type, TCGReg arg,
-     tcg_target_ulong regs[TCG_TARGET_NB_REGS];
++                       TCGReg arg1, intptr_t arg2)
--    long tcg_temps[CPU_TEMP_BUF_NLONGS];
+ {
--    uintptr_t sp_value = (uintptr_t)(tcg_temps + CPU_TEMP_BUF_NLONGS);
+     MIPSInsn opc = OPC_SD;
-+    uint64_t stack[(TCG_STATIC_CALL_ARGS_SIZE + TCG_STATIC_FRAME_SIZE)
+     if (TCG_TARGET_REG_BITS == 32 || type == TCG_TYPE_I32) {
-+                   / sizeof(uint64_t)];
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_st(TCGContext *s, TCGType type, TCGReg arg,
-+    void *call_slots[TCG_STATIC_CALL_ARGS_SIZE / sizeof(uint64_t)];
+     tcg_out_ldst(s, opc, arg, arg1, arg2);
+ }
-     regs[TCG_AREG0] = (tcg_target_ulong)env;
--    regs[TCG_REG_CALL_STACK] = sp_value;
+-static inline bool tcg_out_sti(TCGContext *s, TCGType type, TCGArg val,
-+    regs[TCG_REG_CALL_STACK] = (uintptr_t)stack;
+-                               TCGReg base, intptr_t ofs)
-+    /* Other call_slots entries initialized at first use (see below). */
++static bool tcg_out_sti(TCGContext *s, TCGType type, TCGArg val,
-+    call_slots[0] = NULL;
++                        TCGReg base, intptr_t ofs)
-     tci_assert(tb_ptr);
+ {
+     if (val == 0) {
-     for (;;) {
+         tcg_out_st(s, type, TCG_REG_ZERO, base, ofs);
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_clz(TCGContext *s, MIPSInsn opcv2, MIPSInsn opcv6,
  #endif
          TCGMemOpIdx oi;
          int32_t ofs;
 -        void *ptr;
 +        void *ptr, *cif;
          /* Skip opcode and size entry. */
          tb_ptr += 2;
          switch (opc) {
          case INDEX_op_call:
 -            tci_args_l(&tb_ptr, &ptr);
 +            /*
 +             * Set up the ffi_avalue array once, delayed until now
 +             * because many TB's do not make any calls. In tcg_gen_callN,
 +             * we arranged for every real argument to be "left-aligned"
 +             * in each 64-bit slot.
 +             */
 +            if (unlikely(call_slots[0] == NULL)) {
 +                for (int i = 0; i < ARRAY_SIZE(call_slots); ++i) {
 +                    call_slots[i] = &stack[i];
 +                }
 +            }
 +
 +            tci_args_nll(&tb_ptr, &len, &ptr, &cif);
 +
 +            /* Helper functions may need to access the "return address" */
              tci_tb_ptr = (uintptr_t)tb_ptr;
 -#if TCG_TARGET_REG_BITS == 32
 -            tmp64 = ((helper_function)ptr)(tci_read_reg(regs, TCG_REG_R0),
 -                                           tci_read_reg(regs, TCG_REG_R1),
 -                                           tci_read_reg(regs, TCG_REG_R2),
 -                                           tci_read_reg(regs, TCG_REG_R3),
 -                                           tci_read_reg(regs, TCG_REG_R4),
 -                                           tci_read_reg(regs, TCG_REG_R5),
 -                                           tci_read_reg(regs, TCG_REG_R6),
 -                                           tci_read_reg(regs, TCG_REG_R7),
 -                                           tci_read_reg(regs, TCG_REG_R8),
 -                                           tci_read_reg(regs, TCG_REG_R9),
 -                                           tci_read_reg(regs, TCG_REG_R10),
 -                                           tci_read_reg(regs, TCG_REG_R11));
 -            tci_write_reg(regs, TCG_REG_R0, tmp64);
 -            tci_write_reg(regs, TCG_REG_R1, tmp64 >> 32);
 -#else
 -            tmp64 = ((helper_function)ptr)(tci_read_reg(regs, TCG_REG_R0),
 -                                           tci_read_reg(regs, TCG_REG_R1),
 -                                           tci_read_reg(regs, TCG_REG_R2),
 -                                           tci_read_reg(regs, TCG_REG_R3),
 -                                           tci_read_reg(regs, TCG_REG_R4),
 -                                           tci_read_reg(regs, TCG_REG_R5));
 -            tci_write_reg(regs, TCG_REG_R0, tmp64);
 -#endif
 +
 +            ffi_call(cif, ptr, stack, call_slots);
 +
 +            /* Any result winds up "left-aligned" in the stack[0] slot. */
 +            switch (len) {
 +            case 0: /* void */
 +                break;
 +            case 1: /* uint32_t */
 +                /*
 +                 * Note that libffi has an odd special case in that it will
 +                 * always widen an integral result to ffi_arg.
 +                 */
 +                if (sizeof(ffi_arg) == 4) {
 +                    regs[TCG_REG_R0] = *(uint32_t *)stack;
 +                    break;
 +                }
 +                /* fall through */
 +            case 2: /* uint64_t */
 +                if (TCG_TARGET_REG_BITS == 32) {
 +                    tci_write_reg64(regs, TCG_REG_R1, TCG_REG_R0, stack[0]);
 +                } else {
 +                    regs[TCG_REG_R0] = stack[0];
 +                }
 +                break;
 +            default:
 +                g_assert_not_reached();
 +            }
              break;
 +
          case INDEX_op_br:
              tci_args_l(&tb_ptr, &ptr);
              tb_ptr = ptr;
@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
      TCGCond c;
      TCGMemOpIdx oi;
      uint8_t pos, len;
 -    void *ptr;
 +    void *ptr, *cif;
      const uint8_t *tb_ptr;
      status = info->read_memory_func(addr, buf, 2, info);
@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
      switch (op) {
      case INDEX_op_br:
 -    case INDEX_op_call:
      case INDEX_op_exit_tb:
      case INDEX_op_goto_tb:
          tci_args_l(&tb_ptr, &ptr);
          info->fprintf_func(info->stream, "%-12s  %p", op_name, ptr);
          break;
 +    case INDEX_op_call:
 +        tci_args_nll(&tb_ptr, &len, &ptr, &cif);
 +        info->fprintf_func(info->stream, "%-12s  %d, %p, %p",
 +                           op_name, len, ptr, cif);
 +        break;
 +
      case INDEX_op_brcond_i32:
      case INDEX_op_brcond_i64:
          tci_args_rrcl(&tb_ptr, &r0, &r1, &c, &ptr);
 diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.c.inc
 +++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const int tcg_target_reg_alloc_order[] = {
  # error Fix needed, number of supported input arguments changed!
  #endif
 -static const int tcg_target_call_iarg_regs[] = {
 -    TCG_REG_R0,
 -    TCG_REG_R1,
 -    TCG_REG_R2,
 -    TCG_REG_R3,
 -    TCG_REG_R4,
 -    TCG_REG_R5,
 -#if TCG_TARGET_REG_BITS == 32
 -    /* 32 bit hosts need 2 * MAX_OPC_PARAM_IARGS registers. */
 -    TCG_REG_R6,
 -    TCG_REG_R7,
 -    TCG_REG_R8,
 -    TCG_REG_R9,
 -    TCG_REG_R10,
 -    TCG_REG_R11,
 -#endif
 -};
 +/* No call arguments via registers.  All will be stored on the "stack". */
 +static const int tcg_target_call_iarg_regs[] = { };
  static const int tcg_target_call_oarg_regs[] = {
      TCG_REG_R0,
@@ -XXX,XX +XXX,XX @@ static void tci_out_label(TCGContext *s, TCGLabel *label)
  static void stack_bounds_check(TCGReg base, target_long offset)
  {
      if (base == TCG_REG_CALL_STACK) {
 -        tcg_debug_assert(offset < 0);
 -        tcg_debug_assert(offset >= -(CPU_TEMP_BUF_NLONGS * sizeof(long)));
 +        tcg_debug_assert(offset >= 0);
 +        tcg_debug_assert(offset < (TCG_STATIC_CALL_ARGS_SIZE +
 +                                   TCG_STATIC_FRAME_SIZE));
      }
  }
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi(TCGContext *s, TCGType type,
+-static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
-     }
+-                              const TCGArg args[TCG_MAX_OP_ARGS],
- }
+-                              const int const_args[TCG_MAX_OP_ARGS])
++static void tcg_out_op(TCGContext *s, TCGOpcode opc,
--static inline void tcg_out_call(TCGContext *s, const tcg_insn_unit *arg)
++                       const TCGArg args[TCG_MAX_OP_ARGS],
-+static void tcg_out_call(TCGContext *s, const tcg_insn_unit *func,
++                       const int const_args[TCG_MAX_OP_ARGS])
-+                         ffi_cif *cif)
+ {
- {
+     MIPSInsn i1, i2;
-     uint8_t *old_code_ptr = s->code_ptr;
+     TCGArg a0, a1, a2;
 +    uint8_t which;
 +
 +    if (cif->rtype == &ffi_type_void) {
 +        which = 0;
 +    } else if (cif->rtype->size == 4) {
 +        which = 1;
 +    } else {
 +        tcg_debug_assert(cif->rtype->size == 8);
 +        which = 2;
 +    }
      tcg_out_op_t(s, INDEX_op_call);
 -    tcg_out_i(s, (uintptr_t)arg);
 +    tcg_out8(s, which);
 +    tcg_out_i(s, (uintptr_t)func);
 +    tcg_out_i(s, (uintptr_t)cif);
 +
      old_code_ptr[1] = s->code_ptr - old_code_ptr;
  }
@@ -XXX,XX +XXX,XX @@ static void tcg_target_init(TCGContext *s)
      s->reserved_regs = 0;
      tcg_regset_set_reg(s->reserved_regs, TCG_REG_CALL_STACK);
 -    /* We use negative offsets from "sp" so that we can distinguish
 -       stores that might pretend to be call arguments.  */
 -    tcg_set_frame(s, TCG_REG_CALL_STACK,
 -                  -CPU_TEMP_BUF_NLONGS * sizeof(long),
 -                  CPU_TEMP_BUF_NLONGS * sizeof(long));
 +    /* The call arguments come first, followed by the temp storage. */
 +    tcg_set_frame(s, TCG_REG_CALL_STACK, TCG_STATIC_CALL_ARGS_SIZE,
 +                  TCG_STATIC_FRAME_SIZE);
  }
  /* Generate global QEMU prologue and epilogue code. */
 --
 .25.1

-[PULL 30/33] tcg: Allocate sufficient storage in temp_allocate_frame
+[PULL 33/35] tcg/mips: Allow JAL to be out of range in tcg_out_bswap_subr
-This function should have been updated for vector types
+Weaning off of unique alignment requirements, so allow JAL
-when they were introduced.
+to not reach the target.  TCG_TMP1 is always available for
 use as a scratch because it is clobbered by the subroutine
 being called.
-Fixes: d2fd745fe8b
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/367
-Cc: qemu-stable@nongnu.org
-Tested-by: Stefan Weil <sw@weilnetz.de>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tcg.c | 32 +++++++++++++++++++++++++++-----
+ tcg/mips/tcg-target.c.inc | 6 ++++--
-file changed, 27 insertions(+), 5 deletions(-)
+file changed, 4 insertions(+), 2 deletions(-)
-diff --git a/tcg/tcg.c b/tcg/tcg.c
+diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg.c
+--- a/tcg/mips/tcg-target.c.inc
-+++ b/tcg/tcg.c
++++ b/tcg/mips/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static void check_regs(TCGContext *s)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_bswap16(TCGContext *s, TCGReg ret, TCGReg arg, int flags)
- static void temp_allocate_frame(TCGContext *s, TCGTemp *ts)
+ static void tcg_out_bswap_subr(TCGContext *s, const tcg_insn_unit *sub)
  {
--    if (s->current_frame_offset + (tcg_target_long)sizeof(tcg_target_long) >
+-    bool ok = tcg_out_opc_jmp(s, OPC_JAL, sub);
--        s->frame_end) {
+-    tcg_debug_assert(ok);
--        tcg_abort();
++    if (!tcg_out_opc_jmp(s, OPC_JAL, sub)) {
-+    size_t size, align;
++        tcg_out_movi(s, TCG_TYPE_PTR, TCG_TMP1, (uintptr_t)sub);
-+    intptr_t off;
++        tcg_out_opc_reg(s, OPC_JALR, TCG_REG_RA, TCG_TMP1, 0);
-+
++    }
 +    switch (ts->type) {
 +    case TCG_TYPE_I32:
 +        size = align = 4;
 +        break;
 +    case TCG_TYPE_I64:
 +    case TCG_TYPE_V64:
 +        size = align = 8;
 +        break;
 +    case TCG_TYPE_V128:
 +        size = align = 16;
 +        break;
 +    case TCG_TYPE_V256:
 +        /* Note that we do not require aligned storage for V256. */
 +        size = 32, align = 16;
 +        break;
 +    default:
 +        g_assert_not_reached();
      }
 -    ts->mem_offset = s->current_frame_offset;
 +
 +    assert(align <= TCG_TARGET_STACK_ALIGN);
 +    off = ROUND_UP(s->current_frame_offset, align);
 +    assert(off + size <= s->frame_end);
 +    s->current_frame_offset = off + size;
 +
 +    ts->mem_offset = off;
  #if defined(__sparc__)
      ts->mem_offset += TCG_TARGET_STACK_BIAS;
  #endif
      ts->mem_base = s->frame_temp;
      ts->mem_allocated = 1;
 -    s->current_frame_offset += sizeof(tcg_target_long);
  }
- static void temp_load(TCGContext *, TCGTemp *, TCGRegSet, TCGRegSet, TCGRegSet);
+ static void tcg_out_bswap32(TCGContext *s, TCGReg ret, TCGReg arg, int flags)
 --
 .25.1

-[PULL 06/33] tcg: Store the TCGHelperInfo in the TCGOp for call
+[PULL 34/35] tcg/mips: Unset TCG_TARGET_HAS_direct_jump
-This will give us both flags and typemask for use later.
+Only use indirect jumps.  Finish weaning away from the
 unique alignment requirements for code_gen_buffer.
-We also fix a dumping bug, wherein calls generated for plugins
-fail tcg_find_helper and print (null) instead of either a name
-or the raw function pointer.
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tcg-internal.h | 14 ++++++++++++-
+ tcg/mips/tcg-target.h     | 12 +++++-------
- tcg/tcg.c          | 49 ++++++++++++++++++++--------------------------
+ tcg/mips/tcg-target.c.inc | 23 +++++------------------
-files changed, 34 insertions(+), 29 deletions(-)
+files changed, 10 insertions(+), 25 deletions(-)
-diff --git a/tcg/tcg-internal.h b/tcg/tcg-internal.h
+diff --git a/tcg/mips/tcg-target.h b/tcg/mips/tcg-target.h
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-internal.h
+--- a/tcg/mips/tcg-target.h
-+++ b/tcg/tcg-internal.h
++++ b/tcg/mips/tcg-target.h
 @@ -XXX,XX +XXX,XX @@
+ #define TCG_TARGET_TLB_DISPLACEMENT_BITS 16
- #define TCG_HIGHWATER 1024
+ #define TCG_TARGET_NB_REGS 32
-+typedef struct TCGHelperInfo {
+-/*
-+    void *func;
+- * We have a 256MB branch region, but leave room to make sure the
-+    const char *name;
+- * main executable is also within that region.
-+    unsigned flags;
+- */
-+    unsigned typemask;
+-#define MAX_CODE_GEN_BUFFER_SIZE  (128 * MiB)
-+} TCGHelperInfo;
++#define MAX_CODE_GEN_BUFFER_SIZE  ((size_t)-1)
-+
- extern TCGContext tcg_init_ctx;
+ typedef enum {
- extern TCGContext **tcg_ctxs;
+     TCG_REG_ZERO = 0,
- extern unsigned int tcg_cur_ctxs;
+@@ -XXX,XX +XXX,XX @@ extern bool use_mips32r2_instructions;
-@@ -XXX,XX +XXX,XX @@ bool tcg_region_alloc(TCGContext *s);
+ #define TCG_TARGET_HAS_muluh_i32        1
- void tcg_region_initial_alloc(TCGContext *s);
+ #define TCG_TARGET_HAS_mulsh_i32        1
- void tcg_region_prologue_set(TCGContext *s);
+ #define TCG_TARGET_HAS_bswap32_i32      1
+-#define TCG_TARGET_HAS_direct_jump      1
-+static inline const TCGHelperInfo *tcg_call_info(TCGOp *op)
++#define TCG_TARGET_HAS_direct_jump      0
-+{
-+    return (void *)(uintptr_t)op->args[TCGOP_CALLO(op) + TCGOP_CALLI(op) + 1];
+ #if TCG_TARGET_REG_BITS == 64
-+}
+ #define TCG_TARGET_HAS_add2_i32         0
-+
+@@ -XXX,XX +XXX,XX @@ extern bool use_mips32r2_instructions;
- static inline unsigned tcg_call_flags(TCGOp *op)
+ #define TCG_TARGET_DEFAULT_MO (0)
- {
+ #define TCG_TARGET_HAS_MEMORY_BSWAP     1
--    return op->args[TCGOP_CALLO(op) + TCGOP_CALLI(op) + 1];
-+    return tcg_call_info(op)->flags;
+-void tb_target_set_jmp_target(uintptr_t, uintptr_t, uintptr_t, uintptr_t);
 +/* not defined -- call should be eliminated at compile time */
 +void tb_target_set_jmp_target(uintptr_t, uintptr_t, uintptr_t, uintptr_t)
 +    QEMU_ERROR("code path is reachable");
  #ifdef CONFIG_SOFTMMU
  #define TCG_TARGET_NEED_LDST_LABELS
 diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/mips/tcg-target.c.inc
 +++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          }
          break;
      case INDEX_op_goto_tb:
 -        if (s->tb_jmp_insn_offset) {
 -            /* direct jump method */
 -            s->tb_jmp_insn_offset[a0] = tcg_current_code_size(s);
 -            /* Avoid clobbering the address during retranslation.  */
 -            tcg_out32(s, OPC_J | (*(uint32_t *)s->code_ptr & 0x3ffffff));
 -        } else {
 -            /* indirect jump method */
 -            tcg_out_ld(s, TCG_TYPE_PTR, TCG_TMP0, TCG_REG_ZERO,
 -                       (uintptr_t)(s->tb_jmp_target_addr + a0));
 -            tcg_out_opc_reg(s, OPC_JR, 0, TCG_TMP0, 0);
 -        }
 +        /* indirect jump method */
 +        tcg_debug_assert(s->tb_jmp_insn_offset == 0);
 +        tcg_out_ld(s, TCG_TYPE_PTR, TCG_TMP0, TCG_REG_ZERO,
 +                   (uintptr_t)(s->tb_jmp_target_addr + a0));
 +        tcg_out_opc_reg(s, OPC_JR, 0, TCG_TMP0, 0);
          tcg_out_nop(s);
          set_jmp_reset_offset(s, a0);
          break;
@@ -XXX,XX +XXX,XX @@ static void tcg_target_init(TCGContext *s)
      tcg_regset_set_reg(s->reserved_regs, TCG_REG_GP);   /* global pointer */
  }
- #endif /* TCG_INTERNAL_H */
+-void tb_target_set_jmp_target(uintptr_t tc_ptr, uintptr_t jmp_rx,
-diff --git a/tcg/tcg.c b/tcg/tcg.c
+-                              uintptr_t jmp_rw, uintptr_t addr)
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg.c
 +++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ void tcg_pool_reset(TCGContext *s)
      s->pool_current = NULL;
  }
 -typedef struct TCGHelperInfo {
 -    void *func;
 -    const char *name;
 -    unsigned flags;
 -    unsigned typemask;
 -} TCGHelperInfo;
 -
  #include "exec/helper-proto.h"
  static const TCGHelperInfo all_helpers[] = {
@@ -XXX,XX +XXX,XX @@ bool tcg_op_supported(TCGOpcode op)
  void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args)
  {
      int i, real_args, nb_rets, pi;
 -    unsigned typemask, flags;
 -    TCGHelperInfo *info;
 +    unsigned typemask;
 +    const TCGHelperInfo *info;
      TCGOp *op;
      info = g_hash_table_lookup(helper_table, (gpointer)func);
 -    flags = info->flags;
      typemask = info->typemask;
  #ifdef CONFIG_PLUGIN
@@ -XXX,XX +XXX,XX @@ void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args)
          real_args++;
      }
      op->args[pi++] = (uintptr_t)func;
 -    op->args[pi++] = flags;
 +    op->args[pi++] = (uintptr_t)info;
      TCGOP_CALLI(op) = real_args;
      /* Make sure the fields didn't overflow.  */
@@ -XXX,XX +XXX,XX @@ static char *tcg_get_arg_str(TCGContext *s, char *buf,
      return tcg_get_arg_str_ptr(s, buf, buf_size, arg_temp(arg));
  }
 -/* Find helper name.  */
 -static inline const char *tcg_find_helper(TCGContext *s, uintptr_t val)
 -{
--    const char *ret = NULL;
+-    qatomic_set((uint32_t *)jmp_rw, deposit32(OPC_J, 0, 26, addr >> 2));
--    if (helper_table) {
+-    flush_idcache_range(jmp_rx, jmp_rw, 4);
 -        TCGHelperInfo *info = g_hash_table_lookup(helper_table, (gpointer)val);
 -        if (info) {
 -            ret = info->name;
 -        }
 -    }
 -    return ret;
 -}
 -
- static const char * const cond_name[] =
+ typedef struct {
- {
+     DebugFrameHeader h;
-     [TCG_COND_NEVER] = "never",
+     uint8_t fde_def_cfa[4];
@@ -XXX,XX +XXX,XX @@ static void tcg_dump_ops(TCGContext *s, bool have_prefs)
                  col += qemu_log(" " TARGET_FMT_lx, a);
              }
          } else if (c == INDEX_op_call) {
 +            const TCGHelperInfo *info = tcg_call_info(op);
 +            void *func;
 +
              /* variable number of arguments */
              nb_oargs = TCGOP_CALLO(op);
              nb_iargs = TCGOP_CALLI(op);
              nb_cargs = def->nb_cargs;
 -            /* function name, flags, out args */
 -            col += qemu_log(" %s %s,$0x%x,$%d", def->name,
 -                            tcg_find_helper(s, op->args[nb_oargs + nb_iargs]),
 -                            tcg_call_flags(op), nb_oargs);
 +            col += qemu_log(" %s ", def->name);
 +
 +            /*
 +             * Print the function name from TCGHelperInfo, if available.
 +             * Note that plugins have a template function for the info,
 +             * but the actual function pointer comes from the plugin.
 +             */
 +            func = (void *)(uintptr_t)op->args[nb_oargs + nb_iargs];
 +            if (func == info->func) {
 +                col += qemu_log("%s", info->name);
 +            } else {
 +                col += qemu_log("plugin(%p)", func);
 +            }
 +
 +            col += qemu_log("$0x%x,$%d", info->flags, nb_oargs);
              for (i = 0; i < nb_oargs; i++) {
                  col += qemu_log(",%s", tcg_get_arg_str(s, buf, sizeof(buf),
                                                         op->args[i]));
 --
 .25.1

-[PULL 15/33] tcg/tci: Change encoding to uint32_t units
+[PULL 35/35] tcg/mips: Drop special alignment for code_gen_buffer
-This removes all of the problems with unaligned accesses
-to the bytecode stream.
-With an 8-bit opcode at the bottom, we have 24 bits remaining,
-which are generally split into 6 4-bit slots.  This fits well
-with the maximum length opcodes, e.g. INDEX_op_add2_i32, which
-have 6 register operands.
-We have, in previous patches, rearranged things such that there
-are no operations with a label which have more than one other
-operand.  Which leaves us with a 20-bit field in which to encode
-a label, giving us a maximum TB size of 512k -- easily large.
-Change the INDEX_op_tci_movi_{i32,i64} opcodes to tci_mov[il].
-The former puts the immediate in the upper 20 bits of the insn,
-like we do for the label displacement.  The later uses a label
-to reference an entry in the constant pool.  Thus, in the worst
-case we still have a single memory reference for any constant,
-but now the constants are out-of-line of the bytecode and can
-be shared between different moves saving space.
-Change INDEX_op_call to use a label to reference a pair of
-pointers in the constant pool.  This removes the only slightly
-dodgy link with the layout of struct TCGHelperInfo.
-The re-encode cannot be done in pieces.
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/tcg/tcg-opc.h    |   4 +-
+ tcg/region.c | 91 ----------------------------------------------------
- tcg/tci/tcg-target.h     |   3 +-
+file changed, 91 deletions(-)
  tcg/tci.c                | 539 +++++++++++++++------------------------
  tcg/tci/tcg-target.c.inc | 379 ++++++++++++---------------
  tcg/tci/README           |  20 +-
 files changed, 383 insertions(+), 562 deletions(-)
-diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
+diff --git a/tcg/region.c b/tcg/region.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/tcg/tcg-opc.h
+--- a/tcg/region.c
-+++ b/include/tcg/tcg-opc.h
++++ b/tcg/region.c
-@@ -XXX,XX +XXX,XX @@ DEF(last_generic, 0, 0, 0, TCG_OPF_NOT_PRESENT)
+@@ -XXX,XX +XXX,XX @@ static size_t tcg_n_regions(size_t tb_size, unsigned max_cpus)
+   (DEFAULT_CODE_GEN_BUFFER_SIZE_1 < MAX_CODE_GEN_BUFFER_SIZE \
- #ifdef TCG_TARGET_INTERPRETER
+    ? DEFAULT_CODE_GEN_BUFFER_SIZE_1 : MAX_CODE_GEN_BUFFER_SIZE)
- /* These opcodes are only for use between the tci generator and interpreter. */
--DEF(tci_movi_i32, 1, 0, 1, TCG_OPF_NOT_PRESENT)
+-#ifdef __mips__
--DEF(tci_movi_i64, 1, 0, 1, TCG_OPF_64BIT | TCG_OPF_NOT_PRESENT)
+-/*
-+DEF(tci_movi, 1, 0, 1, TCG_OPF_NOT_PRESENT)
+- * In order to use J and JAL within the code_gen_buffer, we require
-+DEF(tci_movl, 1, 0, 1, TCG_OPF_NOT_PRESENT)
+- * that the buffer not cross a 256MB boundary.
- #endif
+- */
+-static inline bool cross_256mb(void *addr, size_t size)
  #undef TLADDR_ARGS
 diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.h
 +++ b/tcg/tci/tcg-target.h
@@ -XXX,XX +XXX,XX @@
  #define TCG_TARGET_H
  #define TCG_TARGET_INTERPRETER 1
 -#define TCG_TARGET_INSN_UNIT_SIZE 1
 +#define TCG_TARGET_INSN_UNIT_SIZE 4
  #define TCG_TARGET_TLB_DISPLACEMENT_BITS 32
  #define MAX_CODE_GEN_BUFFER_SIZE  ((size_t)-1)
@@ -XXX,XX +XXX,XX @@ typedef enum {
  #define TCG_TARGET_STACK_ALIGN          8
  #define HAVE_TCG_QEMU_TB_EXEC
 +#define TCG_TARGET_NEED_POOL_LABELS
  /* We could notice __i386__ or __s390x__ and reduce the barriers depending
     on the host.  But if you want performance, you use the normal backend.
 diff --git a/tcg/tci.c b/tcg/tci.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci.c
 +++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ static uint64_t tci_uint64(uint32_t high, uint32_t low)
      return ((uint64_t)high << 32) + low;
  }
 -/* Read constant byte from bytecode. */
 -static uint8_t tci_read_b(const uint8_t **tb_ptr)
 -{
--    return *(tb_ptr[0]++);
+-    return ((uintptr_t)addr ^ ((uintptr_t)addr + size)) & ~0x0ffffffful;
 -}
 -
--/* Read register number from bytecode. */
+-/*
--static TCGReg tci_read_r(const uint8_t **tb_ptr)
+- * We weren't able to allocate a buffer without crossing that boundary,
 - * so make do with the larger portion of the buffer that doesn't cross.
 - * Returns the new base and size of the buffer in *obuf and *osize.
 - */
 -static inline void split_cross_256mb(void **obuf, size_t *osize,
 -                                     void *buf1, size_t size1)
 -{
--    uint8_t regno = tci_read_b(tb_ptr);
+-    void *buf2 = (void *)(((uintptr_t)buf1 + size1) & ~0x0ffffffful);
--    tci_assert(regno < TCG_TARGET_NB_REGS);
+-    size_t size2 = buf1 + size1 - buf2;
 -    return regno;
 -}
 -
--/* Read constant (native size) from bytecode. */
+-    size1 = buf2 - buf1;
--static tcg_target_ulong tci_read_i(const uint8_t **tb_ptr)
+-    if (size1 < size2) {
--{
+-        size1 = size2;
--    tcg_target_ulong value = *(const tcg_target_ulong *)(*tb_ptr);
+-        buf1 = buf2;
--    *tb_ptr += sizeof(value);
+-    }
 -    return value;
 -}
 -
--/* Read unsigned constant (32 bit) from bytecode. */
+-    *obuf = buf1;
--static uint32_t tci_read_i32(const uint8_t **tb_ptr)
+-    *osize = size1;
 -{
 -    uint32_t value = *(const uint32_t *)(*tb_ptr);
 -    *tb_ptr += sizeof(value);
 -    return value;
 -}
 -
 -/* Read signed constant (32 bit) from bytecode. */
 -static int32_t tci_read_s32(const uint8_t **tb_ptr)
 -{
 -    int32_t value = *(const int32_t *)(*tb_ptr);
 -    *tb_ptr += sizeof(value);
 -    return value;
 -}
 -
 -static tcg_target_ulong tci_read_label(const uint8_t **tb_ptr)
 -{
 -    return tci_read_i(tb_ptr);
 -}
 -
  /*
   * Load sets of arguments all at once.  The naming convention is:
   *   tci_args_<arguments>
@@ -XXX,XX +XXX,XX @@ static tcg_target_ulong tci_read_label(const uint8_t **tb_ptr)
   *   s = signed ldst offset
   */
 -static void check_size(const uint8_t *start, const uint8_t **tb_ptr)
 +static void tci_args_l(uint32_t insn, const void *tb_ptr, void **l0)
  {
 -    const uint8_t *old_code_ptr = start - 2;
 -    uint8_t op_size = old_code_ptr[1];
 -    tci_assert(*tb_ptr == old_code_ptr + op_size);
 +    int diff = sextract32(insn, 12, 20);
 +    *l0 = diff ? (void *)tb_ptr + diff : NULL;
  }
 -static void tci_args_l(const uint8_t **tb_ptr, void **l0)
 +static void tci_args_nl(uint32_t insn, const void *tb_ptr,
 +                        uint8_t *n0, void **l1)
  {
 -    const uint8_t *start = *tb_ptr;
 -
 -    *l0 = (void *)tci_read_label(tb_ptr);
 -
 -    check_size(start, tb_ptr);
 +    *n0 = extract32(insn, 8, 4);
 +    *l1 = sextract32(insn, 12, 20) + (void *)tb_ptr;
  }
 -static void tci_args_nll(const uint8_t **tb_ptr, uint8_t *n0,
 -                         void **l1, void **l2)
 +static void tci_args_rl(uint32_t insn, const void *tb_ptr,
 +                        TCGReg *r0, void **l1)
  {
 -    const uint8_t *start = *tb_ptr;
 -
 -    *n0 = tci_read_b(tb_ptr);
 -    *l1 = (void *)tci_read_label(tb_ptr);
 -    *l2 = (void *)tci_read_label(tb_ptr);
 -
 -    check_size(start, tb_ptr);
 +    *r0 = extract32(insn, 8, 4);
 +    *l1 = sextract32(insn, 12, 20) + (void *)tb_ptr;
  }
 -static void tci_args_rl(const uint8_t **tb_ptr, TCGReg *r0, void **l1)
 +static void tci_args_rr(uint32_t insn, TCGReg *r0, TCGReg *r1)
  {
 -    const uint8_t *start = *tb_ptr;
 -
 -    *r0 = tci_read_r(tb_ptr);
 -    *l1 = (void *)tci_read_label(tb_ptr);
 -
 -    check_size(start, tb_ptr);
 +    *r0 = extract32(insn, 8, 4);
 +    *r1 = extract32(insn, 12, 4);
  }
 -static void tci_args_rr(const uint8_t **tb_ptr,
 -                        TCGReg *r0, TCGReg *r1)
 +static void tci_args_ri(uint32_t insn, TCGReg *r0, tcg_target_ulong *i1)
  {
 -    const uint8_t *start = *tb_ptr;
 -
 -    *r0 = tci_read_r(tb_ptr);
 -    *r1 = tci_read_r(tb_ptr);
 -
 -    check_size(start, tb_ptr);
 +    *r0 = extract32(insn, 8, 4);
 +    *i1 = sextract32(insn, 12, 20);
  }
 -static void tci_args_ri(const uint8_t **tb_ptr,
 -                        TCGReg *r0, tcg_target_ulong *i1)
 +static void tci_args_rrm(uint32_t insn, TCGReg *r0,
 +                         TCGReg *r1, TCGMemOpIdx *m2)
  {
 -    const uint8_t *start = *tb_ptr;
 -
 -    *r0 = tci_read_r(tb_ptr);
 -    *i1 = tci_read_i32(tb_ptr);
 -
 -    check_size(start, tb_ptr);
 +    *r0 = extract32(insn, 8, 4);
 +    *r1 = extract32(insn, 12, 4);
 +    *m2 = extract32(insn, 20, 12);
  }
 -#if TCG_TARGET_REG_BITS == 64
 -static void tci_args_rI(const uint8_t **tb_ptr,
 -                        TCGReg *r0, tcg_target_ulong *i1)
 +static void tci_args_rrr(uint32_t insn, TCGReg *r0, TCGReg *r1, TCGReg *r2)
  {
 -    const uint8_t *start = *tb_ptr;
 -
 -    *r0 = tci_read_r(tb_ptr);
 -    *i1 = tci_read_i(tb_ptr);
 -
 -    check_size(start, tb_ptr);
 -}
 -#endif
 -
--static void tci_args_rrm(const uint8_t **tb_ptr,
+ #ifdef USE_STATIC_CODE_GEN_BUFFER
--                         TCGReg *r0, TCGReg *r1, TCGMemOpIdx *m2)
+ static uint8_t static_code_gen_buffer[DEFAULT_CODE_GEN_BUFFER_SIZE]
--{
+     __attribute__((aligned(CODE_GEN_ALIGN)));
--    const uint8_t *start = *tb_ptr;
+@@ -XXX,XX +XXX,XX @@ static int alloc_code_gen_buffer(size_t tb_size, int splitwx, Error **errp)
--
+         size = QEMU_ALIGN_DOWN(tb_size, qemu_real_host_page_size);
--    *r0 = tci_read_r(tb_ptr);
+     }
--    *r1 = tci_read_r(tb_ptr);
--    *m2 = tci_read_i32(tb_ptr);
+-#ifdef __mips__
--
+-    if (cross_256mb(buf, size)) {
--    check_size(start, tb_ptr);
+-        split_cross_256mb(&buf, &size, buf, size);
 +    *r0 = extract32(insn, 8, 4);
 +    *r1 = extract32(insn, 12, 4);
 +    *r2 = extract32(insn, 16, 4);
  }
 -static void tci_args_rrr(const uint8_t **tb_ptr,
 -                         TCGReg *r0, TCGReg *r1, TCGReg *r2)
 +static void tci_args_rrs(uint32_t insn, TCGReg *r0, TCGReg *r1, int32_t *i2)
  {
 -    const uint8_t *start = *tb_ptr;
 -
 -    *r0 = tci_read_r(tb_ptr);
 -    *r1 = tci_read_r(tb_ptr);
 -    *r2 = tci_read_r(tb_ptr);
 -
 -    check_size(start, tb_ptr);
 +    *r0 = extract32(insn, 8, 4);
 +    *r1 = extract32(insn, 12, 4);
 +    *i2 = sextract32(insn, 16, 16);
  }
 -static void tci_args_rrs(const uint8_t **tb_ptr,
 -                         TCGReg *r0, TCGReg *r1, int32_t *i2)
 -{
 -    const uint8_t *start = *tb_ptr;
 -
 -    *r0 = tci_read_r(tb_ptr);
 -    *r1 = tci_read_r(tb_ptr);
 -    *i2 = tci_read_s32(tb_ptr);
 -
 -    check_size(start, tb_ptr);
 -}
 -
 -static void tci_args_rrrc(const uint8_t **tb_ptr,
 +static void tci_args_rrrc(uint32_t insn,
                            TCGReg *r0, TCGReg *r1, TCGReg *r2, TCGCond *c3)
  {
 -    const uint8_t *start = *tb_ptr;
 -
 -    *r0 = tci_read_r(tb_ptr);
 -    *r1 = tci_read_r(tb_ptr);
 -    *r2 = tci_read_r(tb_ptr);
 -    *c3 = tci_read_b(tb_ptr);
 -
 -    check_size(start, tb_ptr);
 +    *r0 = extract32(insn, 8, 4);
 +    *r1 = extract32(insn, 12, 4);
 +    *r2 = extract32(insn, 16, 4);
 +    *c3 = extract32(insn, 20, 4);
  }
 -static void tci_args_rrrm(const uint8_t **tb_ptr,
 +static void tci_args_rrrm(uint32_t insn,
                            TCGReg *r0, TCGReg *r1, TCGReg *r2, TCGMemOpIdx *m3)
  {
 -    const uint8_t *start = *tb_ptr;
 -
 -    *r0 = tci_read_r(tb_ptr);
 -    *r1 = tci_read_r(tb_ptr);
 -    *r2 = tci_read_r(tb_ptr);
 -    *m3 = tci_read_i32(tb_ptr);
 -
 -    check_size(start, tb_ptr);
 +    *r0 = extract32(insn, 8, 4);
 +    *r1 = extract32(insn, 12, 4);
 +    *r2 = extract32(insn, 16, 4);
 +    *m3 = extract32(insn, 20, 12);
  }
 -static void tci_args_rrrbb(const uint8_t **tb_ptr, TCGReg *r0, TCGReg *r1,
 +static void tci_args_rrrbb(uint32_t insn, TCGReg *r0, TCGReg *r1,
                             TCGReg *r2, uint8_t *i3, uint8_t *i4)
  {
 -    const uint8_t *start = *tb_ptr;
 -
 -    *r0 = tci_read_r(tb_ptr);
 -    *r1 = tci_read_r(tb_ptr);
 -    *r2 = tci_read_r(tb_ptr);
 -    *i3 = tci_read_b(tb_ptr);
 -    *i4 = tci_read_b(tb_ptr);
 -
 -    check_size(start, tb_ptr);
 +    *r0 = extract32(insn, 8, 4);
 +    *r1 = extract32(insn, 12, 4);
 +    *r2 = extract32(insn, 16, 4);
 +    *i3 = extract32(insn, 20, 6);
 +    *i4 = extract32(insn, 26, 6);
  }
 -static void tci_args_rrrrm(const uint8_t **tb_ptr, TCGReg *r0, TCGReg *r1,
 -                           TCGReg *r2, TCGReg *r3, TCGMemOpIdx *m4)
 +static void tci_args_rrrrr(uint32_t insn, TCGReg *r0, TCGReg *r1,
 +                           TCGReg *r2, TCGReg *r3, TCGReg *r4)
  {
 -    const uint8_t *start = *tb_ptr;
 -
 -    *r0 = tci_read_r(tb_ptr);
 -    *r1 = tci_read_r(tb_ptr);
 -    *r2 = tci_read_r(tb_ptr);
 -    *r3 = tci_read_r(tb_ptr);
 -    *m4 = tci_read_i32(tb_ptr);
 -
 -    check_size(start, tb_ptr);
 +    *r0 = extract32(insn, 8, 4);
 +    *r1 = extract32(insn, 12, 4);
 +    *r2 = extract32(insn, 16, 4);
 +    *r3 = extract32(insn, 20, 4);
 +    *r4 = extract32(insn, 24, 4);
  }
  #if TCG_TARGET_REG_BITS == 32
 -static void tci_args_rrrr(const uint8_t **tb_ptr,
 +static void tci_args_rrrr(uint32_t insn,
                            TCGReg *r0, TCGReg *r1, TCGReg *r2, TCGReg *r3)
  {
 -    const uint8_t *start = *tb_ptr;
 -
 -    *r0 = tci_read_r(tb_ptr);
 -    *r1 = tci_read_r(tb_ptr);
 -    *r2 = tci_read_r(tb_ptr);
 -    *r3 = tci_read_r(tb_ptr);
 -
 -    check_size(start, tb_ptr);
 +    *r0 = extract32(insn, 8, 4);
 +    *r1 = extract32(insn, 12, 4);
 +    *r2 = extract32(insn, 16, 4);
 +    *r3 = extract32(insn, 20, 4);
  }
 -static void tci_args_rrrrrc(const uint8_t **tb_ptr, TCGReg *r0, TCGReg *r1,
 +static void tci_args_rrrrrc(uint32_t insn, TCGReg *r0, TCGReg *r1,
                              TCGReg *r2, TCGReg *r3, TCGReg *r4, TCGCond *c5)
  {
 -    const uint8_t *start = *tb_ptr;
 -
 -    *r0 = tci_read_r(tb_ptr);
 -    *r1 = tci_read_r(tb_ptr);
 -    *r2 = tci_read_r(tb_ptr);
 -    *r3 = tci_read_r(tb_ptr);
 -    *r4 = tci_read_r(tb_ptr);
 -    *c5 = tci_read_b(tb_ptr);
 -
 -    check_size(start, tb_ptr);
 +    *r0 = extract32(insn, 8, 4);
 +    *r1 = extract32(insn, 12, 4);
 +    *r2 = extract32(insn, 16, 4);
 +    *r3 = extract32(insn, 20, 4);
 +    *r4 = extract32(insn, 24, 4);
 +    *c5 = extract32(insn, 28, 4);
  }
 -static void tci_args_rrrrrr(const uint8_t **tb_ptr, TCGReg *r0, TCGReg *r1,
 +static void tci_args_rrrrrr(uint32_t insn, TCGReg *r0, TCGReg *r1,
                              TCGReg *r2, TCGReg *r3, TCGReg *r4, TCGReg *r5)
  {
 -    const uint8_t *start = *tb_ptr;
 -
 -    *r0 = tci_read_r(tb_ptr);
 -    *r1 = tci_read_r(tb_ptr);
 -    *r2 = tci_read_r(tb_ptr);
 -    *r3 = tci_read_r(tb_ptr);
 -    *r4 = tci_read_r(tb_ptr);
 -    *r5 = tci_read_r(tb_ptr);
 -
 -    check_size(start, tb_ptr);
 +    *r0 = extract32(insn, 8, 4);
 +    *r1 = extract32(insn, 12, 4);
 +    *r2 = extract32(insn, 16, 4);
 +    *r3 = extract32(insn, 20, 4);
 +    *r4 = extract32(insn, 24, 4);
 +    *r5 = extract32(insn, 28, 4);
  }
  #endif
@@ -XXX,XX +XXX,XX @@ static bool tci_compare64(uint64_t u0, uint64_t u1, TCGCond condition)
  uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                                              const void *v_tb_ptr)
  {
 -    const uint8_t *tb_ptr = v_tb_ptr;
 +    const uint32_t *tb_ptr = v_tb_ptr;
      tcg_target_ulong regs[TCG_TARGET_NB_REGS];
      uint64_t stack[(TCG_STATIC_CALL_ARGS_SIZE + TCG_STATIC_FRAME_SIZE)
                     / sizeof(uint64_t)];
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
      tci_assert(tb_ptr);
      for (;;) {
 -        TCGOpcode opc = tb_ptr[0];
 -        TCGReg r0, r1, r2, r3;
 +        uint32_t insn;
 +        TCGOpcode opc;
 +        TCGReg r0, r1, r2, r3, r4;
          tcg_target_ulong t1;
          TCGCond condition;
          target_ulong taddr;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
          uint32_t tmp32;
          uint64_t tmp64;
  #if TCG_TARGET_REG_BITS == 32
 -        TCGReg r4, r5;
 +        TCGReg r5;
          uint64_t T1, T2;
  #endif
          TCGMemOpIdx oi;
          int32_t ofs;
 -        void *ptr, *cif;
 +        void *ptr;
 -        /* Skip opcode and size entry. */
 -        tb_ptr += 2;
 +        insn = *tb_ptr++;
 +        opc = extract32(insn, 0, 8);
          switch (opc) {
          case INDEX_op_call:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                  }
              }
 -            tci_args_nll(&tb_ptr, &len, &ptr, &cif);
 +            tci_args_nl(insn, tb_ptr, &len, &ptr);
              /* Helper functions may need to access the "return address" */
              tci_tb_ptr = (uintptr_t)tb_ptr;
 -            ffi_call(cif, ptr, stack, call_slots);
 +            {
 +                void **pptr = ptr;
 +                ffi_call(pptr[1], pptr[0], stack, call_slots);
 +            }
              /* Any result winds up "left-aligned" in the stack[0] slot. */
              switch (len) {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              break;
          case INDEX_op_br:
 -            tci_args_l(&tb_ptr, &ptr);
 +            tci_args_l(insn, tb_ptr, &ptr);
              tb_ptr = ptr;
              continue;
          case INDEX_op_setcond_i32:
 -            tci_args_rrrc(&tb_ptr, &r0, &r1, &r2, &condition);
 +            tci_args_rrrc(insn, &r0, &r1, &r2, &condition);
              regs[r0] = tci_compare32(regs[r1], regs[r2], condition);
              break;
  #if TCG_TARGET_REG_BITS == 32
          case INDEX_op_setcond2_i32:
 -            tci_args_rrrrrc(&tb_ptr, &r0, &r1, &r2, &r3, &r4, &condition);
 +            tci_args_rrrrrc(insn, &r0, &r1, &r2, &r3, &r4, &condition);
              T1 = tci_uint64(regs[r2], regs[r1]);
              T2 = tci_uint64(regs[r4], regs[r3]);
              regs[r0] = tci_compare64(T1, T2, condition);
              break;
  #elif TCG_TARGET_REG_BITS == 64
          case INDEX_op_setcond_i64:
 -            tci_args_rrrc(&tb_ptr, &r0, &r1, &r2, &condition);
 +            tci_args_rrrc(insn, &r0, &r1, &r2, &condition);
              regs[r0] = tci_compare64(regs[r1], regs[r2], condition);
              break;
  #endif
          CASE_32_64(mov)
 -            tci_args_rr(&tb_ptr, &r0, &r1);
 +            tci_args_rr(insn, &r0, &r1);
              regs[r0] = regs[r1];
              break;
 -        case INDEX_op_tci_movi_i32:
 -            tci_args_ri(&tb_ptr, &r0, &t1);
 +        case INDEX_op_tci_movi:
 +            tci_args_ri(insn, &r0, &t1);
              regs[r0] = t1;
              break;
 +        case INDEX_op_tci_movl:
 +            tci_args_rl(insn, tb_ptr, &r0, &ptr);
 +            regs[r0] = *(tcg_target_ulong *)ptr;
 +            break;
              /* Load/store operations (32 bit). */
          CASE_32_64(ld8u)
 -            tci_args_rrs(&tb_ptr, &r0, &r1, &ofs);
 +            tci_args_rrs(insn, &r0, &r1, &ofs);
              ptr = (void *)(regs[r1] + ofs);
              regs[r0] = *(uint8_t *)ptr;
              break;
          CASE_32_64(ld8s)
 -            tci_args_rrs(&tb_ptr, &r0, &r1, &ofs);
 +            tci_args_rrs(insn, &r0, &r1, &ofs);
              ptr = (void *)(regs[r1] + ofs);
              regs[r0] = *(int8_t *)ptr;
              break;
          CASE_32_64(ld16u)
 -            tci_args_rrs(&tb_ptr, &r0, &r1, &ofs);
 +            tci_args_rrs(insn, &r0, &r1, &ofs);
              ptr = (void *)(regs[r1] + ofs);
              regs[r0] = *(uint16_t *)ptr;
              break;
          CASE_32_64(ld16s)
 -            tci_args_rrs(&tb_ptr, &r0, &r1, &ofs);
 +            tci_args_rrs(insn, &r0, &r1, &ofs);
              ptr = (void *)(regs[r1] + ofs);
              regs[r0] = *(int16_t *)ptr;
              break;
          case INDEX_op_ld_i32:
          CASE_64(ld32u)
 -            tci_args_rrs(&tb_ptr, &r0, &r1, &ofs);
 +            tci_args_rrs(insn, &r0, &r1, &ofs);
              ptr = (void *)(regs[r1] + ofs);
              regs[r0] = *(uint32_t *)ptr;
              break;
          CASE_32_64(st8)
 -            tci_args_rrs(&tb_ptr, &r0, &r1, &ofs);
 +            tci_args_rrs(insn, &r0, &r1, &ofs);
              ptr = (void *)(regs[r1] + ofs);
              *(uint8_t *)ptr = regs[r0];
              break;
          CASE_32_64(st16)
 -            tci_args_rrs(&tb_ptr, &r0, &r1, &ofs);
 +            tci_args_rrs(insn, &r0, &r1, &ofs);
              ptr = (void *)(regs[r1] + ofs);
              *(uint16_t *)ptr = regs[r0];
              break;
          case INDEX_op_st_i32:
          CASE_64(st32)
 -            tci_args_rrs(&tb_ptr, &r0, &r1, &ofs);
 +            tci_args_rrs(insn, &r0, &r1, &ofs);
              ptr = (void *)(regs[r1] + ofs);
              *(uint32_t *)ptr = regs[r0];
              break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              /* Arithmetic operations (mixed 32/64 bit). */
          CASE_32_64(add)
 -            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
 +            tci_args_rrr(insn, &r0, &r1, &r2);
              regs[r0] = regs[r1] + regs[r2];
              break;
          CASE_32_64(sub)
 -            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
 +            tci_args_rrr(insn, &r0, &r1, &r2);
              regs[r0] = regs[r1] - regs[r2];
              break;
          CASE_32_64(mul)
 -            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
 +            tci_args_rrr(insn, &r0, &r1, &r2);
              regs[r0] = regs[r1] * regs[r2];
              break;
          CASE_32_64(and)
 -            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
 +            tci_args_rrr(insn, &r0, &r1, &r2);
              regs[r0] = regs[r1] & regs[r2];
              break;
          CASE_32_64(or)
 -            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
 +            tci_args_rrr(insn, &r0, &r1, &r2);
              regs[r0] = regs[r1] | regs[r2];
              break;
          CASE_32_64(xor)
 -            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
 +            tci_args_rrr(insn, &r0, &r1, &r2);
              regs[r0] = regs[r1] ^ regs[r2];
              break;
              /* Arithmetic operations (32 bit). */
          case INDEX_op_div_i32:
 -            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
 +            tci_args_rrr(insn, &r0, &r1, &r2);
              regs[r0] = (int32_t)regs[r1] / (int32_t)regs[r2];
              break;
          case INDEX_op_divu_i32:
 -            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
 +            tci_args_rrr(insn, &r0, &r1, &r2);
              regs[r0] = (uint32_t)regs[r1] / (uint32_t)regs[r2];
              break;
          case INDEX_op_rem_i32:
 -            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
 +            tci_args_rrr(insn, &r0, &r1, &r2);
              regs[r0] = (int32_t)regs[r1] % (int32_t)regs[r2];
              break;
          case INDEX_op_remu_i32:
 -            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
 +            tci_args_rrr(insn, &r0, &r1, &r2);
              regs[r0] = (uint32_t)regs[r1] % (uint32_t)regs[r2];
              break;
              /* Shift/rotate operations (32 bit). */
          case INDEX_op_shl_i32:
 -            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
 +            tci_args_rrr(insn, &r0, &r1, &r2);
              regs[r0] = (uint32_t)regs[r1] << (regs[r2] & 31);
              break;
          case INDEX_op_shr_i32:
 -            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
 +            tci_args_rrr(insn, &r0, &r1, &r2);
              regs[r0] = (uint32_t)regs[r1] >> (regs[r2] & 31);
              break;
          case INDEX_op_sar_i32:
 -            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
 +            tci_args_rrr(insn, &r0, &r1, &r2);
              regs[r0] = (int32_t)regs[r1] >> (regs[r2] & 31);
              break;
  #if TCG_TARGET_HAS_rot_i32
          case INDEX_op_rotl_i32:
 -            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
 +            tci_args_rrr(insn, &r0, &r1, &r2);
              regs[r0] = rol32(regs[r1], regs[r2] & 31);
              break;
          case INDEX_op_rotr_i32:
 -            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
 +            tci_args_rrr(insn, &r0, &r1, &r2);
              regs[r0] = ror32(regs[r1], regs[r2] & 31);
              break;
  #endif
  #if TCG_TARGET_HAS_deposit_i32
          case INDEX_op_deposit_i32:
 -            tci_args_rrrbb(&tb_ptr, &r0, &r1, &r2, &pos, &len);
 +            tci_args_rrrbb(insn, &r0, &r1, &r2, &pos, &len);
              regs[r0] = deposit32(regs[r1], pos, len, regs[r2]);
              break;
  #endif
          case INDEX_op_brcond_i32:
 -            tci_args_rl(&tb_ptr, &r0, &ptr);
 +            tci_args_rl(insn, tb_ptr, &r0, &ptr);
              if ((uint32_t)regs[r0]) {
                  tb_ptr = ptr;
              }
              break;
  #if TCG_TARGET_REG_BITS == 32
          case INDEX_op_add2_i32:
 -            tci_args_rrrrrr(&tb_ptr, &r0, &r1, &r2, &r3, &r4, &r5);
 +            tci_args_rrrrrr(insn, &r0, &r1, &r2, &r3, &r4, &r5);
              T1 = tci_uint64(regs[r3], regs[r2]);
              T2 = tci_uint64(regs[r5], regs[r4]);
              tci_write_reg64(regs, r1, r0, T1 + T2);
              break;
          case INDEX_op_sub2_i32:
 -            tci_args_rrrrrr(&tb_ptr, &r0, &r1, &r2, &r3, &r4, &r5);
 +            tci_args_rrrrrr(insn, &r0, &r1, &r2, &r3, &r4, &r5);
              T1 = tci_uint64(regs[r3], regs[r2]);
              T2 = tci_uint64(regs[r5], regs[r4]);
              tci_write_reg64(regs, r1, r0, T1 - T2);
              break;
          case INDEX_op_mulu2_i32:
 -            tci_args_rrrr(&tb_ptr, &r0, &r1, &r2, &r3);
 +            tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
              tci_write_reg64(regs, r1, r0, (uint64_t)regs[r2] * regs[r3]);
              break;
  #endif /* TCG_TARGET_REG_BITS == 32 */
  #if TCG_TARGET_HAS_ext8s_i32 || TCG_TARGET_HAS_ext8s_i64
          CASE_32_64(ext8s)
 -            tci_args_rr(&tb_ptr, &r0, &r1);
 +            tci_args_rr(insn, &r0, &r1);
              regs[r0] = (int8_t)regs[r1];
              break;
  #endif
  #if TCG_TARGET_HAS_ext16s_i32 || TCG_TARGET_HAS_ext16s_i64
          CASE_32_64(ext16s)
 -            tci_args_rr(&tb_ptr, &r0, &r1);
 +            tci_args_rr(insn, &r0, &r1);
              regs[r0] = (int16_t)regs[r1];
              break;
  #endif
  #if TCG_TARGET_HAS_ext8u_i32 || TCG_TARGET_HAS_ext8u_i64
          CASE_32_64(ext8u)
 -            tci_args_rr(&tb_ptr, &r0, &r1);
 +            tci_args_rr(insn, &r0, &r1);
              regs[r0] = (uint8_t)regs[r1];
              break;
  #endif
  #if TCG_TARGET_HAS_ext16u_i32 || TCG_TARGET_HAS_ext16u_i64
          CASE_32_64(ext16u)
 -            tci_args_rr(&tb_ptr, &r0, &r1);
 +            tci_args_rr(insn, &r0, &r1);
              regs[r0] = (uint16_t)regs[r1];
              break;
  #endif
  #if TCG_TARGET_HAS_bswap16_i32 || TCG_TARGET_HAS_bswap16_i64
          CASE_32_64(bswap16)
 -            tci_args_rr(&tb_ptr, &r0, &r1);
 +            tci_args_rr(insn, &r0, &r1);
              regs[r0] = bswap16(regs[r1]);
              break;
  #endif
  #if TCG_TARGET_HAS_bswap32_i32 || TCG_TARGET_HAS_bswap32_i64
          CASE_32_64(bswap32)
 -            tci_args_rr(&tb_ptr, &r0, &r1);
 +            tci_args_rr(insn, &r0, &r1);
              regs[r0] = bswap32(regs[r1]);
              break;
  #endif
  #if TCG_TARGET_HAS_not_i32 || TCG_TARGET_HAS_not_i64
          CASE_32_64(not)
 -            tci_args_rr(&tb_ptr, &r0, &r1);
 +            tci_args_rr(insn, &r0, &r1);
              regs[r0] = ~regs[r1];
              break;
  #endif
  #if TCG_TARGET_HAS_neg_i32 || TCG_TARGET_HAS_neg_i64
          CASE_32_64(neg)
 -            tci_args_rr(&tb_ptr, &r0, &r1);
 +            tci_args_rr(insn, &r0, &r1);
              regs[r0] = -regs[r1];
              break;
  #endif
  #if TCG_TARGET_REG_BITS == 64
 -        case INDEX_op_tci_movi_i64:
 -            tci_args_rI(&tb_ptr, &r0, &t1);
 -            regs[r0] = t1;
 -            break;
 -
              /* Load/store operations (64 bit). */
          case INDEX_op_ld32s_i64:
 -            tci_args_rrs(&tb_ptr, &r0, &r1, &ofs);
 +            tci_args_rrs(insn, &r0, &r1, &ofs);
              ptr = (void *)(regs[r1] + ofs);
              regs[r0] = *(int32_t *)ptr;
              break;
          case INDEX_op_ld_i64:
 -            tci_args_rrs(&tb_ptr, &r0, &r1, &ofs);
 +            tci_args_rrs(insn, &r0, &r1, &ofs);
              ptr = (void *)(regs[r1] + ofs);
              regs[r0] = *(uint64_t *)ptr;
              break;
          case INDEX_op_st_i64:
 -            tci_args_rrs(&tb_ptr, &r0, &r1, &ofs);
 +            tci_args_rrs(insn, &r0, &r1, &ofs);
              ptr = (void *)(regs[r1] + ofs);
              *(uint64_t *)ptr = regs[r0];
              break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              /* Arithmetic operations (64 bit). */
          case INDEX_op_div_i64:
 -            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
 +            tci_args_rrr(insn, &r0, &r1, &r2);
              regs[r0] = (int64_t)regs[r1] / (int64_t)regs[r2];
              break;
          case INDEX_op_divu_i64:
 -            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
 +            tci_args_rrr(insn, &r0, &r1, &r2);
              regs[r0] = (uint64_t)regs[r1] / (uint64_t)regs[r2];
              break;
          case INDEX_op_rem_i64:
 -            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
 +            tci_args_rrr(insn, &r0, &r1, &r2);
              regs[r0] = (int64_t)regs[r1] % (int64_t)regs[r2];
              break;
          case INDEX_op_remu_i64:
 -            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
 +            tci_args_rrr(insn, &r0, &r1, &r2);
              regs[r0] = (uint64_t)regs[r1] % (uint64_t)regs[r2];
              break;
              /* Shift/rotate operations (64 bit). */
          case INDEX_op_shl_i64:
 -            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
 +            tci_args_rrr(insn, &r0, &r1, &r2);
              regs[r0] = regs[r1] << (regs[r2] & 63);
              break;
          case INDEX_op_shr_i64:
 -            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
 +            tci_args_rrr(insn, &r0, &r1, &r2);
              regs[r0] = regs[r1] >> (regs[r2] & 63);
              break;
          case INDEX_op_sar_i64:
 -            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
 +            tci_args_rrr(insn, &r0, &r1, &r2);
              regs[r0] = (int64_t)regs[r1] >> (regs[r2] & 63);
              break;
  #if TCG_TARGET_HAS_rot_i64
          case INDEX_op_rotl_i64:
 -            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
 +            tci_args_rrr(insn, &r0, &r1, &r2);
              regs[r0] = rol64(regs[r1], regs[r2] & 63);
              break;
          case INDEX_op_rotr_i64:
 -            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
 +            tci_args_rrr(insn, &r0, &r1, &r2);
              regs[r0] = ror64(regs[r1], regs[r2] & 63);
              break;
  #endif
  #if TCG_TARGET_HAS_deposit_i64
          case INDEX_op_deposit_i64:
 -            tci_args_rrrbb(&tb_ptr, &r0, &r1, &r2, &pos, &len);
 +            tci_args_rrrbb(insn, &r0, &r1, &r2, &pos, &len);
              regs[r0] = deposit64(regs[r1], pos, len, regs[r2]);
              break;
  #endif
          case INDEX_op_brcond_i64:
 -            tci_args_rl(&tb_ptr, &r0, &ptr);
 +            tci_args_rl(insn, tb_ptr, &r0, &ptr);
              if (regs[r0]) {
                  tb_ptr = ptr;
              }
              break;
          case INDEX_op_ext32s_i64:
          case INDEX_op_ext_i32_i64:
 -            tci_args_rr(&tb_ptr, &r0, &r1);
 +            tci_args_rr(insn, &r0, &r1);
              regs[r0] = (int32_t)regs[r1];
              break;
          case INDEX_op_ext32u_i64:
          case INDEX_op_extu_i32_i64:
 -            tci_args_rr(&tb_ptr, &r0, &r1);
 +            tci_args_rr(insn, &r0, &r1);
              regs[r0] = (uint32_t)regs[r1];
              break;
  #if TCG_TARGET_HAS_bswap64_i64
          case INDEX_op_bswap64_i64:
 -            tci_args_rr(&tb_ptr, &r0, &r1);
 +            tci_args_rr(insn, &r0, &r1);
              regs[r0] = bswap64(regs[r1]);
              break;
  #endif
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              /* QEMU specific operations. */
          case INDEX_op_exit_tb:
 -            tci_args_l(&tb_ptr, &ptr);
 +            tci_args_l(insn, tb_ptr, &ptr);
              return (uintptr_t)ptr;
          case INDEX_op_goto_tb:
 -            tci_args_l(&tb_ptr, &ptr);
 +            tci_args_l(insn, tb_ptr, &ptr);
              tb_ptr = *(void **)ptr;
              break;
          case INDEX_op_qemu_ld_i32:
              if (TARGET_LONG_BITS <= TCG_TARGET_REG_BITS) {
 -                tci_args_rrm(&tb_ptr, &r0, &r1, &oi);
 +                tci_args_rrm(insn, &r0, &r1, &oi);
                  taddr = regs[r1];
              } else {
 -                tci_args_rrrm(&tb_ptr, &r0, &r1, &r2, &oi);
 +                tci_args_rrrm(insn, &r0, &r1, &r2, &oi);
                  taddr = tci_uint64(regs[r2], regs[r1]);
              }
              switch (get_memop(oi) & (MO_BSWAP | MO_SSIZE)) {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
          case INDEX_op_qemu_ld_i64:
              if (TCG_TARGET_REG_BITS == 64) {
 -                tci_args_rrm(&tb_ptr, &r0, &r1, &oi);
 +                tci_args_rrm(insn, &r0, &r1, &oi);
                  taddr = regs[r1];
              } else if (TARGET_LONG_BITS <= TCG_TARGET_REG_BITS) {
 -                tci_args_rrrm(&tb_ptr, &r0, &r1, &r2, &oi);
 +                tci_args_rrrm(insn, &r0, &r1, &r2, &oi);
                  taddr = regs[r2];
              } else {
 -                tci_args_rrrrm(&tb_ptr, &r0, &r1, &r2, &r3, &oi);
 +                tci_args_rrrrr(insn, &r0, &r1, &r2, &r3, &r4);
                  taddr = tci_uint64(regs[r3], regs[r2]);
 +                oi = regs[r4];
              }
              switch (get_memop(oi) & (MO_BSWAP | MO_SSIZE)) {
              case MO_UB:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
          case INDEX_op_qemu_st_i32:
              if (TARGET_LONG_BITS <= TCG_TARGET_REG_BITS) {
 -                tci_args_rrm(&tb_ptr, &r0, &r1, &oi);
 +                tci_args_rrm(insn, &r0, &r1, &oi);
                  taddr = regs[r1];
              } else {
 -                tci_args_rrrm(&tb_ptr, &r0, &r1, &r2, &oi);
 +                tci_args_rrrm(insn, &r0, &r1, &r2, &oi);
                  taddr = tci_uint64(regs[r2], regs[r1]);
              }
              tmp32 = regs[r0];
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
          case INDEX_op_qemu_st_i64:
              if (TCG_TARGET_REG_BITS == 64) {
 -                tci_args_rrm(&tb_ptr, &r0, &r1, &oi);
 +                tci_args_rrm(insn, &r0, &r1, &oi);
                  taddr = regs[r1];
                  tmp64 = regs[r0];
              } else {
                  if (TARGET_LONG_BITS <= TCG_TARGET_REG_BITS) {
 -                    tci_args_rrrm(&tb_ptr, &r0, &r1, &r2, &oi);
 +                    tci_args_rrrm(insn, &r0, &r1, &r2, &oi);
                      taddr = regs[r2];
                  } else {
 -                    tci_args_rrrrm(&tb_ptr, &r0, &r1, &r2, &r3, &oi);
 +                    tci_args_rrrrr(insn, &r0, &r1, &r2, &r3, &r4);
                      taddr = tci_uint64(regs[r3], regs[r2]);
 +                    oi = regs[r4];
                  }
                  tmp64 = tci_uint64(regs[r1], regs[r0]);
              }
@@ -XXX,XX +XXX,XX @@ static const char *str_c(TCGCond c)
  /* Disassemble TCI bytecode. */
  int print_insn_tci(bfd_vma addr, disassemble_info *info)
  {
 -    uint8_t buf[256];
 -    int length, status;
 +    const uint32_t *tb_ptr = (const void *)(uintptr_t)addr;
      const TCGOpDef *def;
      const char *op_name;
 +    uint32_t insn;
      TCGOpcode op;
 -    TCGReg r0, r1, r2, r3;
 +    TCGReg r0, r1, r2, r3, r4;
  #if TCG_TARGET_REG_BITS == 32
 -    TCGReg r4, r5;
 +    TCGReg r5;
  #endif
      tcg_target_ulong i1;
      int32_t s2;
      TCGCond c;
      TCGMemOpIdx oi;
      uint8_t pos, len;
 -    void *ptr, *cif;
 -    const uint8_t *tb_ptr;
 +    void *ptr;
 -    status = info->read_memory_func(addr, buf, 2, info);
 -    if (status != 0) {
 -        info->memory_error_func(status, addr, info);
 -        return -1;
 -    }
--    op = buf[0];
--    length = buf[1];
-+    /* TCI is always the host, so we don't need to load indirect. */
-+    insn = *tb_ptr++;
--    if (length < 2) {
--        info->fprintf_func(info->stream, "invalid length %d", length);
--        return 1;
--    }
--
--    status = info->read_memory_func(addr + 2, buf + 2, length - 2, info);
--    if (status != 0) {
--        info->memory_error_func(status, addr + 2, info);
--        return -1;
--    }
-+    info->fprintf_func(info->stream, "%08x  ", insn);
-+    op = extract32(insn, 0, 8);
-     def = &tcg_op_defs[op];
-     op_name = def->name;
--    tb_ptr = buf + 2;
-     switch (op) {
-     case INDEX_op_br:
-     case INDEX_op_exit_tb:
-     case INDEX_op_goto_tb:
--        tci_args_l(&tb_ptr, &ptr);
-+        tci_args_l(insn, tb_ptr, &ptr);
-         info->fprintf_func(info->stream, "%-12s  %p", op_name, ptr);
-         break;
-     case INDEX_op_call:
--        tci_args_nll(&tb_ptr, &len, &ptr, &cif);
--        info->fprintf_func(info->stream, "%-12s  %d, %p, %p",
--                           op_name, len, ptr, cif);
-+        tci_args_nl(insn, tb_ptr, &len, &ptr);
-+        info->fprintf_func(info->stream, "%-12s  %d, %p", op_name, len, ptr);
-         break;
-     case INDEX_op_brcond_i32:
-     case INDEX_op_brcond_i64:
--        tci_args_rl(&tb_ptr, &r0, &ptr);
-+        tci_args_rl(insn, tb_ptr, &r0, &ptr);
-         info->fprintf_func(info->stream, "%-12s  %s, 0, ne, %p",
-                            op_name, str_r(r0), ptr);
-         break;
-     case INDEX_op_setcond_i32:
-     case INDEX_op_setcond_i64:
--        tci_args_rrrc(&tb_ptr, &r0, &r1, &r2, &c);
-+        tci_args_rrrc(insn, &r0, &r1, &r2, &c);
-         info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s",
-                            op_name, str_r(r0), str_r(r1), str_r(r2), str_c(c));
-         break;
--    case INDEX_op_tci_movi_i32:
--        tci_args_ri(&tb_ptr, &r0, &i1);
-+    case INDEX_op_tci_movi:
-+        tci_args_ri(insn, &r0, &i1);
-         info->fprintf_func(info->stream, "%-12s  %s, 0x%" TCG_PRIlx,
-                            op_name, str_r(r0), i1);
-         break;
--#if TCG_TARGET_REG_BITS == 64
--    case INDEX_op_tci_movi_i64:
--        tci_args_rI(&tb_ptr, &r0, &i1);
--        info->fprintf_func(info->stream, "%-12s  %s, 0x%" TCG_PRIlx,
--                           op_name, str_r(r0), i1);
-+    case INDEX_op_tci_movl:
-+        tci_args_rl(insn, tb_ptr, &r0, &ptr);
-+        info->fprintf_func(info->stream, "%-12s  %s, %p",
-+                           op_name, str_r(r0), ptr);
-         break;
--#endif
-     case INDEX_op_ld8u_i32:
-     case INDEX_op_ld8u_i64:
-@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
-     case INDEX_op_st32_i64:
-     case INDEX_op_st_i32:
-     case INDEX_op_st_i64:
--        tci_args_rrs(&tb_ptr, &r0, &r1, &s2);
-+        tci_args_rrs(insn, &r0, &r1, &s2);
-         info->fprintf_func(info->stream, "%-12s  %s, %s, %d",
-                            op_name, str_r(r0), str_r(r1), s2);
-         break;
-@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
-     case INDEX_op_not_i64:
-     case INDEX_op_neg_i32:
-     case INDEX_op_neg_i64:
--        tci_args_rr(&tb_ptr, &r0, &r1);
-+        tci_args_rr(insn, &r0, &r1);
-         info->fprintf_func(info->stream, "%-12s  %s, %s",
-                            op_name, str_r(r0), str_r(r1));
-         break;
-@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
-     case INDEX_op_rotl_i64:
-     case INDEX_op_rotr_i32:
-     case INDEX_op_rotr_i64:
--        tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
-+        tci_args_rrr(insn, &r0, &r1, &r2);
-         info->fprintf_func(info->stream, "%-12s  %s, %s, %s",
-                            op_name, str_r(r0), str_r(r1), str_r(r2));
-         break;
-     case INDEX_op_deposit_i32:
-     case INDEX_op_deposit_i64:
--        tci_args_rrrbb(&tb_ptr, &r0, &r1, &r2, &pos, &len);
-+        tci_args_rrrbb(insn, &r0, &r1, &r2, &pos, &len);
-         info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %d, %d",
-                            op_name, str_r(r0), str_r(r1), str_r(r2), pos, len);
-         break;
- #if TCG_TARGET_REG_BITS == 32
-     case INDEX_op_setcond2_i32:
--        tci_args_rrrrrc(&tb_ptr, &r0, &r1, &r2, &r3, &r4, &c);
-+        tci_args_rrrrrc(insn, &r0, &r1, &r2, &r3, &r4, &c);
-         info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s, %s, %s",
-                            op_name, str_r(r0), str_r(r1), str_r(r2),
-                            str_r(r3), str_r(r4), str_c(c));
-         break;
-     case INDEX_op_mulu2_i32:
--        tci_args_rrrr(&tb_ptr, &r0, &r1, &r2, &r3);
-+        tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
-         info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s",
-                            op_name, str_r(r0), str_r(r1),
-                            str_r(r2), str_r(r3));
-@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
-     case INDEX_op_add2_i32:
-     case INDEX_op_sub2_i32:
--        tci_args_rrrrrr(&tb_ptr, &r0, &r1, &r2, &r3, &r4, &r5);
-+        tci_args_rrrrrr(insn, &r0, &r1, &r2, &r3, &r4, &r5);
-         info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s, %s, %s",
-                            op_name, str_r(r0), str_r(r1), str_r(r2),
-                            str_r(r3), str_r(r4), str_r(r5));
-@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
-         len += DIV_ROUND_UP(TARGET_LONG_BITS, TCG_TARGET_REG_BITS);
-         switch (len) {
-         case 2:
--            tci_args_rrm(&tb_ptr, &r0, &r1, &oi);
-+            tci_args_rrm(insn, &r0, &r1, &oi);
-             info->fprintf_func(info->stream, "%-12s  %s, %s, %x",
-                                op_name, str_r(r0), str_r(r1), oi);
-             break;
-         case 3:
--            tci_args_rrrm(&tb_ptr, &r0, &r1, &r2, &oi);
-+            tci_args_rrrm(insn, &r0, &r1, &r2, &oi);
-             info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %x",
-                                op_name, str_r(r0), str_r(r1), str_r(r2), oi);
-             break;
-         case 4:
--            tci_args_rrrrm(&tb_ptr, &r0, &r1, &r2, &r3, &oi);
--            info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s, %x",
-+            tci_args_rrrrr(insn, &r0, &r1, &r2, &r3, &r4);
-+            info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s, %s",
-                                op_name, str_r(r0), str_r(r1),
--                               str_r(r2), str_r(r3), oi);
-+                               str_r(r2), str_r(r3), str_r(r4));
-             break;
-         default:
-             g_assert_not_reached();
-         }
-         break;
-+    case 0:
-+        /* tcg_out_nop_fill uses zeros */
-+        if (insn == 0) {
-+            info->fprintf_func(info->stream, "align");
-+            break;
-+        }
-+        /* fall through */
-+
-     default:
-         info->fprintf_func(info->stream, "illegal opcode %d", op);
-         break;
-     }
--    return length;
-+    return sizeof(insn);
- }
-diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target.c.inc
-+++ b/tcg/tci/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@
-  * THE SOFTWARE.
-  */
--/* TODO list:
-- * - See TODO comments in code.
-- */
--
--/* Marker for missing code. */
--#define TODO() \
--    do { \
--        fprintf(stderr, "TODO %s:%u: %s()\n", \
--                __FILE__, __LINE__, __func__); \
--        tcg_abort(); \
--    } while (0)
--
--/* Bitfield n...m (in 32 bit value). */
--#define BITS(n, m) (((0xffffffffU << (31 - n)) >> (31 - n + m)) << m)
-+#include "../tcg-pool.c.inc"
- static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
- {
-@@ -XXX,XX +XXX,XX @@ static const char *const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
- static bool patch_reloc(tcg_insn_unit *code_ptr, int type,
-                         intptr_t value, intptr_t addend)
- {
--    /* tcg_out_reloc always uses the same type, addend. */
--    tcg_debug_assert(type == sizeof(tcg_target_long));
-+    intptr_t diff = value - (intptr_t)(code_ptr + 1);
-+
-     tcg_debug_assert(addend == 0);
--    tcg_debug_assert(value != 0);
--    if (TCG_TARGET_REG_BITS == 32) {
--        tcg_patch32(code_ptr, value);
--    } else {
--        tcg_patch64(code_ptr, value);
--    }
--    return true;
--}
--
--/* Write value (native size). */
--static void tcg_out_i(TCGContext *s, tcg_target_ulong v)
--{
--    if (TCG_TARGET_REG_BITS == 32) {
--        tcg_out32(s, v);
--    } else {
--        tcg_out64(s, v);
--    }
--}
--
--/* Write opcode. */
--static void tcg_out_op_t(TCGContext *s, TCGOpcode op)
--{
--    tcg_out8(s, op);
--    tcg_out8(s, 0);
--}
--
--/* Write register. */
--static void tcg_out_r(TCGContext *s, TCGArg t0)
--{
--    tcg_debug_assert(t0 < TCG_TARGET_NB_REGS);
--    tcg_out8(s, t0);
--}
--
--/* Write label. */
--static void tci_out_label(TCGContext *s, TCGLabel *label)
--{
--    if (label->has_value) {
--        tcg_out_i(s, label->u.value);
--        tcg_debug_assert(label->u.value);
--    } else {
--        tcg_out_reloc(s, s->code_ptr, sizeof(tcg_target_ulong), label, 0);
--        s->code_ptr += sizeof(tcg_target_ulong);
-+    tcg_debug_assert(type == 20);
-+
-+    if (diff == sextract32(diff, 0, type)) {
-+        tcg_patch32(code_ptr, deposit32(*code_ptr, 32 - type, type, diff));
-+        return true;
-     }
-+    return false;
- }
- static void stack_bounds_check(TCGReg base, target_long offset)
-@@ -XXX,XX +XXX,XX @@ static void stack_bounds_check(TCGReg base, target_long offset)
- static void tcg_out_op_l(TCGContext *s, TCGOpcode op, TCGLabel *l0)
- {
--    uint8_t *old_code_ptr = s->code_ptr;
-+    tcg_insn_unit insn = 0;
--    tcg_out_op_t(s, op);
--    tci_out_label(s, l0);
--
--    old_code_ptr[1] = s->code_ptr - old_code_ptr;
-+    tcg_out_reloc(s, s->code_ptr, 20, l0, 0);
-+    insn = deposit32(insn, 0, 8, op);
-+    tcg_out32(s, insn);
- }
- static void tcg_out_op_p(TCGContext *s, TCGOpcode op, void *p0)
- {
--    uint8_t *old_code_ptr = s->code_ptr;
-+    tcg_insn_unit insn = 0;
-+    intptr_t diff;
--    tcg_out_op_t(s, op);
--    tcg_out_i(s, (uintptr_t)p0);
--
--    old_code_ptr[1] = s->code_ptr - old_code_ptr;
-+    /* Special case for exit_tb: map null -> 0. */
-+    if (p0 == NULL) {
-+        diff = 0;
-+    } else {
-+        diff = p0 - (void *)(s->code_ptr + 1);
-+        tcg_debug_assert(diff != 0);
-+        if (diff != sextract32(diff, 0, 20)) {
-+            tcg_raise_tb_overflow(s);
-+        }
-+    }
-+    insn = deposit32(insn, 0, 8, op);
-+    insn = deposit32(insn, 12, 20, diff);
-+    tcg_out32(s, insn);
- }
- static void tcg_out_op_v(TCGContext *s, TCGOpcode op)
- {
--    uint8_t *old_code_ptr = s->code_ptr;
--
--    tcg_out_op_t(s, op);
--
--    old_code_ptr[1] = s->code_ptr - old_code_ptr;
-+    tcg_out32(s, (uint8_t)op);
- }
- static void tcg_out_op_ri(TCGContext *s, TCGOpcode op, TCGReg r0, int32_t i1)
- {
--    uint8_t *old_code_ptr = s->code_ptr;
-+    tcg_insn_unit insn = 0;
--    tcg_out_op_t(s, op);
--    tcg_out_r(s, r0);
--    tcg_out32(s, i1);
--
--    old_code_ptr[1] = s->code_ptr - old_code_ptr;
-+    tcg_debug_assert(i1 == sextract32(i1, 0, 20));
-+    insn = deposit32(insn, 0, 8, op);
-+    insn = deposit32(insn, 8, 4, r0);
-+    insn = deposit32(insn, 12, 20, i1);
-+    tcg_out32(s, insn);
- }
--#if TCG_TARGET_REG_BITS == 64
--static void tcg_out_op_rI(TCGContext *s, TCGOpcode op,
--                          TCGReg r0, uint64_t i1)
--{
--    uint8_t *old_code_ptr = s->code_ptr;
--
--    tcg_out_op_t(s, op);
--    tcg_out_r(s, r0);
--    tcg_out64(s, i1);
--
--    old_code_ptr[1] = s->code_ptr - old_code_ptr;
--}
 -#endif
 -
- static void tcg_out_op_rl(TCGContext *s, TCGOpcode op, TCGReg r0, TCGLabel *l1)
+     region.start_aligned = buf;
- {
+     region.total_size = size;
--    uint8_t *old_code_ptr = s->code_ptr;
-+    tcg_insn_unit insn = 0;
+@@ -XXX,XX +XXX,XX @@ static int alloc_code_gen_buffer_anon(size_t size, int prot,
+         return -1;
--    tcg_out_op_t(s, op);
+     }
--    tcg_out_r(s, r0);
--    tci_out_label(s, l1);
+-#ifdef __mips__
 -    if (cross_256mb(buf, size)) {
 -        /*
 -         * Try again, with the original still mapped, to avoid re-acquiring
 -         * the same 256mb crossing.
 -         */
 -        size_t size2;
 -        void *buf2 = mmap(NULL, size, prot, flags, -1, 0);
 -        switch ((int)(buf2 != MAP_FAILED)) {
 -        case 1:
 -            if (!cross_256mb(buf2, size)) {
 -                /* Success!  Use the new buffer.  */
 -                munmap(buf, size);
 -                break;
 -            }
 -            /* Failure.  Work with what we had.  */
 -            munmap(buf2, size);
 -            /* fallthru */
 -        default:
 -            /* Split the original buffer.  Free the smaller half.  */
 -            split_cross_256mb(&buf2, &size2, buf, size);
 -            if (buf == buf2) {
 -                munmap(buf + size2, size - size2);
 -            } else {
 -                munmap(buf, size - size2);
 -            }
 -            size = size2;
 -            break;
 -        }
 -        buf = buf2;
 -    }
 -#endif
 -
--    old_code_ptr[1] = s->code_ptr - old_code_ptr;
+     region.start_aligned = buf;
-+    tcg_out_reloc(s, s->code_ptr, 20, l1, 0);
+     region.total_size = size;
-+    insn = deposit32(insn, 0, 8, op);
+     return prot;
-+    insn = deposit32(insn, 8, 4, r0);
+@@ -XXX,XX +XXX,XX @@ static bool alloc_code_gen_buffer_splitwx_memfd(size_t size, Error **errp)
-+    tcg_out32(s, insn);
+     void *buf_rw = NULL, *buf_rx = MAP_FAILED;
- }
+     int fd = -1;
- static void tcg_out_op_rr(TCGContext *s, TCGOpcode op, TCGReg r0, TCGReg r1)
+-#ifdef __mips__
- {
+-    /* Find space for the RX mapping, vs the 256MiB regions. */
--    uint8_t *old_code_ptr = s->code_ptr;
+-    if (alloc_code_gen_buffer_anon(size, PROT_NONE,
-+    tcg_insn_unit insn = 0;
+-                                   MAP_PRIVATE | MAP_ANONYMOUS |
+-                                   MAP_NORESERVE, errp) < 0) {
--    tcg_out_op_t(s, op);
+-        return false;
--    tcg_out_r(s, r0);
+-    }
--    tcg_out_r(s, r1);
+-    /* The size of the mapping may have been adjusted. */
 -    buf_rx = region.start_aligned;
 -    size = region.total_size;
 -#endif
 -
--    old_code_ptr[1] = s->code_ptr - old_code_ptr;
+     buf_rw = qemu_memfd_alloc("tcg-jit", size, 0, &fd, errp);
-+    insn = deposit32(insn, 0, 8, op);
+     if (buf_rw == NULL) {
-+    insn = deposit32(insn, 8, 4, r0);
+         goto fail;
 +    insn = deposit32(insn, 12, 4, r1);
 +    tcg_out32(s, insn);
  }
  static void tcg_out_op_rrm(TCGContext *s, TCGOpcode op,
                             TCGReg r0, TCGReg r1, TCGArg m2)
  {
 -    uint8_t *old_code_ptr = s->code_ptr;
 +    tcg_insn_unit insn = 0;
 -    tcg_out_op_t(s, op);
 -    tcg_out_r(s, r0);
 -    tcg_out_r(s, r1);
 -    tcg_out32(s, m2);
 -
 -    old_code_ptr[1] = s->code_ptr - old_code_ptr;
 +    tcg_debug_assert(m2 == extract32(m2, 0, 12));
 +    insn = deposit32(insn, 0, 8, op);
 +    insn = deposit32(insn, 8, 4, r0);
 +    insn = deposit32(insn, 12, 4, r1);
 +    insn = deposit32(insn, 20, 12, m2);
 +    tcg_out32(s, insn);
  }
  static void tcg_out_op_rrr(TCGContext *s, TCGOpcode op,
                             TCGReg r0, TCGReg r1, TCGReg r2)
  {
 -    uint8_t *old_code_ptr = s->code_ptr;
 +    tcg_insn_unit insn = 0;
 -    tcg_out_op_t(s, op);
 -    tcg_out_r(s, r0);
 -    tcg_out_r(s, r1);
 -    tcg_out_r(s, r2);
 -
 -    old_code_ptr[1] = s->code_ptr - old_code_ptr;
 +    insn = deposit32(insn, 0, 8, op);
 +    insn = deposit32(insn, 8, 4, r0);
 +    insn = deposit32(insn, 12, 4, r1);
 +    insn = deposit32(insn, 16, 4, r2);
 +    tcg_out32(s, insn);
  }
  static void tcg_out_op_rrs(TCGContext *s, TCGOpcode op,
                             TCGReg r0, TCGReg r1, intptr_t i2)
  {
 -    uint8_t *old_code_ptr = s->code_ptr;
 +    tcg_insn_unit insn = 0;
 -    tcg_out_op_t(s, op);
 -    tcg_out_r(s, r0);
 -    tcg_out_r(s, r1);
 -    tcg_debug_assert(i2 == (int32_t)i2);
 -    tcg_out32(s, i2);
 -
 -    old_code_ptr[1] = s->code_ptr - old_code_ptr;
 +    tcg_debug_assert(i2 == sextract32(i2, 0, 16));
 +    insn = deposit32(insn, 0, 8, op);
 +    insn = deposit32(insn, 8, 4, r0);
 +    insn = deposit32(insn, 12, 4, r1);
 +    insn = deposit32(insn, 16, 16, i2);
 +    tcg_out32(s, insn);
  }
  static void tcg_out_op_rrrc(TCGContext *s, TCGOpcode op,
                              TCGReg r0, TCGReg r1, TCGReg r2, TCGCond c3)
  {
 -    uint8_t *old_code_ptr = s->code_ptr;
 +    tcg_insn_unit insn = 0;
 -    tcg_out_op_t(s, op);
 -    tcg_out_r(s, r0);
 -    tcg_out_r(s, r1);
 -    tcg_out_r(s, r2);
 -    tcg_out8(s, c3);
 -
 -    old_code_ptr[1] = s->code_ptr - old_code_ptr;
 +    insn = deposit32(insn, 0, 8, op);
 +    insn = deposit32(insn, 8, 4, r0);
 +    insn = deposit32(insn, 12, 4, r1);
 +    insn = deposit32(insn, 16, 4, r2);
 +    insn = deposit32(insn, 20, 4, c3);
 +    tcg_out32(s, insn);
  }
  static void tcg_out_op_rrrm(TCGContext *s, TCGOpcode op,
                              TCGReg r0, TCGReg r1, TCGReg r2, TCGArg m3)
  {
 -    uint8_t *old_code_ptr = s->code_ptr;
 +    tcg_insn_unit insn = 0;
 -    tcg_out_op_t(s, op);
 -    tcg_out_r(s, r0);
 -    tcg_out_r(s, r1);
 -    tcg_out_r(s, r2);
 -    tcg_out32(s, m3);
 -
 -    old_code_ptr[1] = s->code_ptr - old_code_ptr;
 +    tcg_debug_assert(m3 == extract32(m3, 0, 12));
 +    insn = deposit32(insn, 0, 8, op);
 +    insn = deposit32(insn, 8, 4, r0);
 +    insn = deposit32(insn, 12, 4, r1);
 +    insn = deposit32(insn, 16, 4, r2);
 +    insn = deposit32(insn, 20, 12, m3);
 +    tcg_out32(s, insn);
  }
  static void tcg_out_op_rrrbb(TCGContext *s, TCGOpcode op, TCGReg r0,
                               TCGReg r1, TCGReg r2, uint8_t b3, uint8_t b4)
  {
 -    uint8_t *old_code_ptr = s->code_ptr;
 +    tcg_insn_unit insn = 0;
 -    tcg_out_op_t(s, op);
 -    tcg_out_r(s, r0);
 -    tcg_out_r(s, r1);
 -    tcg_out_r(s, r2);
 -    tcg_out8(s, b3);
 -    tcg_out8(s, b4);
 -
 -    old_code_ptr[1] = s->code_ptr - old_code_ptr;
 +    tcg_debug_assert(b3 == extract32(b3, 0, 6));
 +    tcg_debug_assert(b4 == extract32(b4, 0, 6));
 +    insn = deposit32(insn, 0, 8, op);
 +    insn = deposit32(insn, 8, 4, r0);
 +    insn = deposit32(insn, 12, 4, r1);
 +    insn = deposit32(insn, 16, 4, r2);
 +    insn = deposit32(insn, 20, 6, b3);
 +    insn = deposit32(insn, 26, 6, b4);
 +    tcg_out32(s, insn);
  }
 -static void tcg_out_op_rrrrm(TCGContext *s, TCGOpcode op, TCGReg r0,
 -                             TCGReg r1, TCGReg r2, TCGReg r3, TCGArg m4)
 +static void tcg_out_op_rrrrr(TCGContext *s, TCGOpcode op, TCGReg r0,
 +                             TCGReg r1, TCGReg r2, TCGReg r3, TCGReg r4)
  {
 -    uint8_t *old_code_ptr = s->code_ptr;
 +    tcg_insn_unit insn = 0;
 -    tcg_out_op_t(s, op);
 -    tcg_out_r(s, r0);
 -    tcg_out_r(s, r1);
 -    tcg_out_r(s, r2);
 -    tcg_out_r(s, r3);
 -    tcg_out32(s, m4);
 -
 -    old_code_ptr[1] = s->code_ptr - old_code_ptr;
 +    insn = deposit32(insn, 0, 8, op);
 +    insn = deposit32(insn, 8, 4, r0);
 +    insn = deposit32(insn, 12, 4, r1);
 +    insn = deposit32(insn, 16, 4, r2);
 +    insn = deposit32(insn, 20, 4, r3);
 +    insn = deposit32(insn, 24, 4, r4);
 +    tcg_out32(s, insn);
  }
  #if TCG_TARGET_REG_BITS == 32
  static void tcg_out_op_rrrr(TCGContext *s, TCGOpcode op,
                              TCGReg r0, TCGReg r1, TCGReg r2, TCGReg r3)
  {
 -    uint8_t *old_code_ptr = s->code_ptr;
 +    tcg_insn_unit insn = 0;
 -    tcg_out_op_t(s, op);
 -    tcg_out_r(s, r0);
 -    tcg_out_r(s, r1);
 -    tcg_out_r(s, r2);
 -    tcg_out_r(s, r3);
 -
 -    old_code_ptr[1] = s->code_ptr - old_code_ptr;
 +    insn = deposit32(insn, 0, 8, op);
 +    insn = deposit32(insn, 8, 4, r0);
 +    insn = deposit32(insn, 12, 4, r1);
 +    insn = deposit32(insn, 16, 4, r2);
 +    insn = deposit32(insn, 20, 4, r3);
 +    tcg_out32(s, insn);
  }
  static void tcg_out_op_rrrrrc(TCGContext *s, TCGOpcode op,
                                TCGReg r0, TCGReg r1, TCGReg r2,
                                TCGReg r3, TCGReg r4, TCGCond c5)
  {
 -    uint8_t *old_code_ptr = s->code_ptr;
 +    tcg_insn_unit insn = 0;
 -    tcg_out_op_t(s, op);
 -    tcg_out_r(s, r0);
 -    tcg_out_r(s, r1);
 -    tcg_out_r(s, r2);
 -    tcg_out_r(s, r3);
 -    tcg_out_r(s, r4);
 -    tcg_out8(s, c5);
 -
 -    old_code_ptr[1] = s->code_ptr - old_code_ptr;
 +    insn = deposit32(insn, 0, 8, op);
 +    insn = deposit32(insn, 8, 4, r0);
 +    insn = deposit32(insn, 12, 4, r1);
 +    insn = deposit32(insn, 16, 4, r2);
 +    insn = deposit32(insn, 20, 4, r3);
 +    insn = deposit32(insn, 24, 4, r4);
 +    insn = deposit32(insn, 28, 4, c5);
 +    tcg_out32(s, insn);
  }
  static void tcg_out_op_rrrrrr(TCGContext *s, TCGOpcode op,
                                TCGReg r0, TCGReg r1, TCGReg r2,
                                TCGReg r3, TCGReg r4, TCGReg r5)
  {
 -    uint8_t *old_code_ptr = s->code_ptr;
 +    tcg_insn_unit insn = 0;
 -    tcg_out_op_t(s, op);
 -    tcg_out_r(s, r0);
 -    tcg_out_r(s, r1);
 -    tcg_out_r(s, r2);
 -    tcg_out_r(s, r3);
 -    tcg_out_r(s, r4);
 -    tcg_out_r(s, r5);
 -
 -    old_code_ptr[1] = s->code_ptr - old_code_ptr;
 +    insn = deposit32(insn, 0, 8, op);
 +    insn = deposit32(insn, 8, 4, r0);
 +    insn = deposit32(insn, 12, 4, r1);
 +    insn = deposit32(insn, 16, 4, r2);
 +    insn = deposit32(insn, 20, 4, r3);
 +    insn = deposit32(insn, 24, 4, r4);
 +    insn = deposit32(insn, 28, 4, r5);
 +    tcg_out32(s, insn);
  }
  #endif
 +static void tcg_out_ldst(TCGContext *s, TCGOpcode op, TCGReg val,
 +                         TCGReg base, intptr_t offset)
 +{
 +    stack_bounds_check(base, offset);
 +    if (offset != sextract32(offset, 0, 16)) {
 +        tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_TMP, offset);
 +        tcg_out_op_rrr(s, (TCG_TARGET_REG_BITS == 32
 +                           ? INDEX_op_add_i32 : INDEX_op_add_i64),
 +                       TCG_REG_TMP, TCG_REG_TMP, base);
 +        base = TCG_REG_TMP;
 +        offset = 0;
 +    }
 +    tcg_out_op_rrs(s, op, val, base, offset);
 +}
 +
  static void tcg_out_ld(TCGContext *s, TCGType type, TCGReg val, TCGReg base,
                         intptr_t offset)
  {
 -    stack_bounds_check(base, offset);
      switch (type) {
      case TCG_TYPE_I32:
 -        tcg_out_op_rrs(s, INDEX_op_ld_i32, val, base, offset);
 +        tcg_out_ldst(s, INDEX_op_ld_i32, val, base, offset);
          break;
  #if TCG_TARGET_REG_BITS == 64
      case TCG_TYPE_I64:
 -        tcg_out_op_rrs(s, INDEX_op_ld_i64, val, base, offset);
 +        tcg_out_ldst(s, INDEX_op_ld_i64, val, base, offset);
          break;
  #endif
      default:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi(TCGContext *s, TCGType type,
  {
      switch (type) {
      case TCG_TYPE_I32:
 -        tcg_out_op_ri(s, INDEX_op_tci_movi_i32, ret, arg);
 -        break;
  #if TCG_TARGET_REG_BITS == 64
 +        arg = (int32_t)arg;
 +        /* fall through */
      case TCG_TYPE_I64:
 -        tcg_out_op_rI(s, INDEX_op_tci_movi_i64, ret, arg);
 -        break;
  #endif
 +        break;
      default:
          g_assert_not_reached();
      }
-+
-+    if (arg == sextract32(arg, 0, 20)) {
+-#ifdef __mips__
-+        tcg_out_op_ri(s, INDEX_op_tci_movi, ret, arg);
+-    void *tmp = mmap(buf_rx, size, PROT_READ | PROT_EXEC,
-+    } else {
+-                     MAP_SHARED | MAP_FIXED, fd, 0);
-+        tcg_insn_unit insn = 0;
+-    if (tmp != buf_rx) {
-+
+-        goto fail_rx;
-+        new_pool_label(s, arg, 20, s->code_ptr, 0);
+-    }
-+        insn = deposit32(insn, 0, 8, INDEX_op_tci_movl);
+-#else
-+        insn = deposit32(insn, 8, 4, ret);
+     buf_rx = mmap(NULL, size, PROT_READ | PROT_EXEC, MAP_SHARED, fd, 0);
-+        tcg_out32(s, insn);
+     if (buf_rx == MAP_FAILED) {
-+    }
+         goto fail_rx;
  }
  static void tcg_out_call(TCGContext *s, const tcg_insn_unit *func,
                           ffi_cif *cif)
  {
 -    uint8_t *old_code_ptr = s->code_ptr;
 +    tcg_insn_unit insn = 0;
      uint8_t which;
      if (cif->rtype == &ffi_type_void) {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_call(TCGContext *s, const tcg_insn_unit *func,
          tcg_debug_assert(cif->rtype->size == 8);
          which = 2;
      }
--    tcg_out_op_t(s, INDEX_op_call);
+-#endif
--    tcg_out8(s, which);
--    tcg_out_i(s, (uintptr_t)func);
+     close(fd);
--    tcg_out_i(s, (uintptr_t)cif);
+     region.start_aligned = buf_rw;
 -
 -    old_code_ptr[1] = s->code_ptr - old_code_ptr;
 +    new_pool_l2(s, 20, s->code_ptr, 0, (uintptr_t)func, (uintptr_t)cif);
 +    insn = deposit32(insn, 0, 8, INDEX_op_call);
 +    insn = deposit32(insn, 8, 4, which);
 +    tcg_out32(s, insn);
  }
  #if TCG_TARGET_REG_BITS == 64
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_st_i32:
      CASE_64(st32)
      CASE_64(st)
 -        stack_bounds_check(args[1], args[2]);
 -        tcg_out_op_rrs(s, opc, args[0], args[1], args[2]);
 +        tcg_out_ldst(s, opc, args[0], args[1], args[2]);
          break;
      CASE_32_64(add)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          } else if (TARGET_LONG_BITS <= TCG_TARGET_REG_BITS) {
              tcg_out_op_rrrm(s, opc, args[0], args[1], args[2], args[3]);
          } else {
 -            tcg_out_op_rrrrm(s, opc, args[0], args[1],
 -                             args[2], args[3], args[4]);
 +            tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_TMP, args[4]);
 +            tcg_out_op_rrrrr(s, opc, args[0], args[1],
 +                             args[2], args[3], TCG_REG_TMP);
          }
          break;
@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
      return ct & TCG_CT_CONST;
  }
 +static void tcg_out_nop_fill(tcg_insn_unit *p, int count)
 +{
 +    memset(p, 0, sizeof(*p) * count);
 +}
 +
  static void tcg_target_init(TCGContext *s)
  {
  #if defined(CONFIG_DEBUG_TCG_INTERPRETER)
 diff --git a/tcg/tci/README b/tcg/tci/README
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/README
 +++ b/tcg/tci/README
@@ -XXX,XX +XXX,XX @@ This is what TCI (Tiny Code Interpreter) does.
  Like each TCG host frontend, TCI implements the code generator in
  tcg-target.c.inc, tcg-target.h. Both files are in directory tcg/tci.
 -The additional file tcg/tci.c adds the interpreter.
 +The additional file tcg/tci.c adds the interpreter and disassembler.
 -The bytecode consists of opcodes (same numeric values as those used by
 -TCG), command length and arguments of variable size and number.
 +The bytecode consists of opcodes (with only a few exceptions, with
 +the same same numeric values and semantics as used by TCG), and up
 +to six arguments packed into a 32-bit integer.  See comments in tci.c
 +for details on the encoding.
 ) Usage
@@ -XXX,XX +XXX,XX @@ suggest using this option. Setting it automatically would need
  additional code in configure which must be fixed when new native TCG
  implementations are added.
 -System emulation should work on any 32 or 64 bit host.
 -User mode emulation might work. Maybe a new linker script (*.ld)
 -is needed. Byte order might be wrong (on big endian hosts)
 -and need fixes in configure.
 -
  For hosts with native TCG, the interpreter TCI can be enabled by
          configure --enable-tcg-interpreter
@@ -XXX,XX +XXX,XX @@ u1 = linux-user-test works
    in the interpreter. These opcodes raise a runtime exception, so it is
    possible to see where code must be added.
 -* The pseudo code is not optimized and still ugly. For hosts with special
 -  alignment requirements, it needs some fixes (maybe aligned bytecode
 -  would also improve speed for hosts which support byte alignment).
 -
 -* A better disassembler for the pseudo code would be nice (a very primitive
 -  disassembler is included in tcg-target.c.inc).
 -
  * It might be useful to have a runtime option which selects the native TCG
    or TCI, so QEMU would have to include two TCGs. Today, selecting TCI
    is a configure option, so you need two compilations of QEMU.
 --
 .25.1

The following changes since commit 3ccf6cd0e3e1dfd663814640b3b18b55715d7a75:

Merge remote-tracking branch 'remotes/kraxel/tags/audio-20210617-pull-request' into staging (2021-06-18 09:54:42 +0100)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20210619

for you to fetch changes up to 8169ec35eb766a12ad0ae898119060fde148ab61:

util/oslib-win32: Fix fatal assertion in qemu_try_memalign (2021-06-19 11:09:11 -0700)

----------------------------------------------------------------
TCI cleanup and re-encoding
Fixes for #367 and #390.
Move TCGCond to tcg/tcg-cond.h.
Fix for win32 qemu_try_memalign.

----------------------------------------------------------------
Alessandro Di Federico (1):
      tcg: expose TCGCond manipulation routines

Richard Henderson (31):
      tcg: Combine dh_is_64bit and dh_is_signed to dh_typecode
      tcg: Add tcg_call_flags
      accel/tcg/plugin-gen: Drop inline markers
      plugins: Drop tcg_flags from struct qemu_plugin_dyn_cb
      accel/tcg: Add tcg call flags to plugins helpers
      tcg: Store the TCGHelperInfo in the TCGOp for call
      tcg: Add tcg_call_func
      tcg: Build ffi data structures for helpers
      tcg/tci: Improve tcg_target_call_clobber_regs
      tcg/tci: Move call-return regs to end of tcg_target_reg_alloc_order
      tcg/tci: Use ffi for calls
      tcg/tci: Reserve r13 for a temporary
      tcg/tci: Emit setcond before brcond
      tcg/tci: Remove tci_write_reg
      tcg/tci: Change encoding to uint32_t units
      tcg/tci: Implement goto_ptr
      tcg/tci: Implement movcond
      tcg/tci: Implement andc, orc, eqv, nand, nor
      tcg/tci: Implement extract, sextract
      tcg/tci: Implement clz, ctz, ctpop
      tcg/tci: Implement mulu2, muls2
      tcg/tci: Implement add2, sub2
      tcg/tci: Split out tci_qemu_ld, tci_qemu_st
      Revert "tcg/tci: Use exec/cpu_ldst.h interfaces"
      tcg/tci: Remove the qemu_ld/st_type macros
      tcg/tci: Use {set,clear}_helper_retaddr
      tests/tcg: Increase timeout for TCI
      accel/tcg: Probe the proper permissions for atomic ops
      tcg/sparc: Fix temp_allocate_frame vs sparc stack bias
      tcg: Allocate sufficient storage in temp_allocate_frame
      tcg: Restart when exhausting the stack frame

Stefan Weil (1):
      util/oslib-win32: Fix fatal assertion in qemu_try_memalign

We will shortly be interested in distinguishing pointers
from integers in the helper's declaration, as well as a
true void return.  We currently have two parallel 1 bit
fields; merge them and expand to a 3 bit field.

Our current maximum is 7 helper arguments, plus the return
makes 8 * 3 = 24 bits used within the uint32_t typemask.

Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/helper-head.h   | 37 +++++--------------
 include/exec/helper-tcg.h    | 34 ++++++++---------
 target/hppa/helper.h         |  3 --
 target/i386/ops_sse_header.h |  3 --
 target/m68k/helper.h         |  1 -
 target/ppc/helper.h          |  3 --
 tcg/tcg.c                    | 71 +++++++++++++++++++++---------------
 7 files changed, 67 insertions(+), 85 deletions(-)

diff --git a/include/exec/helper-head.h b/include/exec/helper-head.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/helper-head.h
+++ b/include/exec/helper-head.h
@@ -XXX,XX +XXX,XX @@
 #define dh_retvar_ptr tcgv_ptr_temp(retval)
 #define dh_retvar(t) glue(dh_retvar_, dh_alias(t))
 
-#define dh_is_64bit_void 0
-#define dh_is_64bit_noreturn 0
-#define dh_is_64bit_i32 0
-#define dh_is_64bit_i64 1
-#define dh_is_64bit_ptr (sizeof(void *) == 8)
-#define dh_is_64bit_cptr dh_is_64bit_ptr
-#define dh_is_64bit(t) glue(dh_is_64bit_, dh_alias(t))
-
-#define dh_is_signed_void 0
-#define dh_is_signed_noreturn 0
-#define dh_is_signed_i32 0
-#define dh_is_signed_s32 1
-#define dh_is_signed_i64 0
-#define dh_is_signed_s64 1
-#define dh_is_signed_f16 0
-#define dh_is_signed_f32 0
-#define dh_is_signed_f64 0
-#define dh_is_signed_tl  0
-#define dh_is_signed_int 1
-/* ??? This is highly specific to the host cpu.  There are even special
-   extension instructions that may be required, e.g. ia64's addp4.  But
-   for now we don't support any 64-bit targets with 32-bit pointers.  */
-#define dh_is_signed_ptr 0
-#define dh_is_signed_cptr dh_is_signed_ptr
-#define dh_is_signed_env dh_is_signed_ptr
-#define dh_is_signed(t) dh_is_signed_##t
+#define dh_typecode_void 0
+#define dh_typecode_noreturn 0
+#define dh_typecode_i32 2
+#define dh_typecode_s32 3
+#define dh_typecode_i64 4
+#define dh_typecode_s64 5
+#define dh_typecode_ptr 6
+#define dh_typecode(t) glue(dh_typecode_, dh_alias(t))
 
 #define dh_callflag_i32  0
 #define dh_callflag_s32  0
@@ -XXX,XX +XXX,XX @@
 #define dh_callflag_noreturn TCG_CALL_NO_RETURN
 #define dh_callflag(t) glue(dh_callflag_, dh_alias(t))
 
-#define dh_sizemask(t, n) \
-  ((dh_is_64bit(t) << (n*2)) | (dh_is_signed(t) << (n*2+1)))
+#define dh_typemask(t, n)  (dh_typecode(t) << (n * 3))
 
 #define dh_arg(t, n) \
   glue(glue(tcgv_, dh_alias(t)), _temp)(glue(arg, n))
diff --git a/include/exec/helper-tcg.h b/include/exec/helper-tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/helper-tcg.h
+++ b/include/exec/helper-tcg.h
@@ -XXX,XX +XXX,XX @@
 #define DEF_HELPER_FLAGS_0(NAME, FLAGS, ret) \
   { .func = HELPER(NAME), .name = str(NAME), \
     .flags = FLAGS | dh_callflag(ret), \
-    .sizemask = dh_sizemask(ret, 0) },
+    .typemask = dh_typemask(ret, 0) },
 
 #define DEF_HELPER_FLAGS_1(NAME, FLAGS, ret, t1) \
   { .func = HELPER(NAME), .name = str(NAME), \
     .flags = FLAGS | dh_callflag(ret), \
-    .sizemask = dh_sizemask(ret, 0) | dh_sizemask(t1, 1) },
+    .typemask = dh_typemask(ret, 0) | dh_typemask(t1, 1) },
 
 #define DEF_HELPER_FLAGS_2(NAME, FLAGS, ret, t1, t2) \
   { .func = HELPER(NAME), .name = str(NAME), \
     .flags = FLAGS | dh_callflag(ret), \
-    .sizemask = dh_sizemask(ret, 0) | dh_sizemask(t1, 1) \
-    | dh_sizemask(t2, 2) },
+    .typemask = dh_typemask(ret, 0) | dh_typemask(t1, 1) \
+    | dh_typemask(t2, 2) },
 
 #define DEF_HELPER_FLAGS_3(NAME, FLAGS, ret, t1, t2, t3) \
   { .func = HELPER(NAME), .name = str(NAME), \
     .flags = FLAGS | dh_callflag(ret), \
-    .sizemask = dh_sizemask(ret, 0) | dh_sizemask(t1, 1) \
-    | dh_sizemask(t2, 2) | dh_sizemask(t3, 3) },
+    .typemask = dh_typemask(ret, 0) | dh_typemask(t1, 1) \
+    | dh_typemask(t2, 2) | dh_typemask(t3, 3) },
 
 #define DEF_HELPER_FLAGS_4(NAME, FLAGS, ret, t1, t2, t3, t4) \
   { .func = HELPER(NAME), .name = str(NAME), \
     .flags = FLAGS | dh_callflag(ret), \
-    .sizemask = dh_sizemask(ret, 0) | dh_sizemask(t1, 1) \
-    | dh_sizemask(t2, 2) | dh_sizemask(t3, 3) | dh_sizemask(t4, 4) },
+    .typemask = dh_typemask(ret, 0) | dh_typemask(t1, 1) \
+    | dh_typemask(t2, 2) | dh_typemask(t3, 3) | dh_typemask(t4, 4) },
 
 #define DEF_HELPER_FLAGS_5(NAME, FLAGS, ret, t1, t2, t3, t4, t5) \
   { .func = HELPER(NAME), .name = str(NAME), \
     .flags = FLAGS | dh_callflag(ret), \
-    .sizemask = dh_sizemask(ret, 0) | dh_sizemask(t1, 1) \
-    | dh_sizemask(t2, 2) | dh_sizemask(t3, 3) | dh_sizemask(t4, 4) \
-    | dh_sizemask(t5, 5) },
+    .typemask = dh_typemask(ret, 0) | dh_typemask(t1, 1) \
+    | dh_typemask(t2, 2) | dh_typemask(t3, 3) | dh_typemask(t4, 4) \
+    | dh_typemask(t5, 5) },
 
 #define DEF_HELPER_FLAGS_6(NAME, FLAGS, ret, t1, t2, t3, t4, t5, t6) \
   { .func = HELPER(NAME), .name = str(NAME), \
     .flags = FLAGS | dh_callflag(ret), \
-    .sizemask = dh_sizemask(ret, 0) | dh_sizemask(t1, 1) \
-    | dh_sizemask(t2, 2) | dh_sizemask(t3, 3) | dh_sizemask(t4, 4) \
-    | dh_sizemask(t5, 5) | dh_sizemask(t6, 6) },
+    .typemask = dh_typemask(ret, 0) | dh_typemask(t1, 1) \
+    | dh_typemask(t2, 2) | dh_typemask(t3, 3) | dh_typemask(t4, 4) \
+    | dh_typemask(t5, 5) | dh_typemask(t6, 6) },
 
 #define DEF_HELPER_FLAGS_7(NAME, FLAGS, ret, t1, t2, t3, t4, t5, t6, t7) \
   { .func = HELPER(NAME), .name = str(NAME), .flags = FLAGS, \
-    .sizemask = dh_sizemask(ret, 0) | dh_sizemask(t1, 1) \
-    | dh_sizemask(t2, 2) | dh_sizemask(t3, 3) | dh_sizemask(t4, 4) \
-    | dh_sizemask(t5, 5) | dh_sizemask(t6, 6) | dh_sizemask(t7, 7) },
+    .typemask = dh_typemask(ret, 0) | dh_typemask(t1, 1) \
+    | dh_typemask(t2, 2) | dh_typemask(t3, 3) | dh_typemask(t4, 4) \
+    | dh_typemask(t5, 5) | dh_typemask(t6, 6) | dh_typemask(t7, 7) },
 
 #include "helper.h"
 #include "trace/generated-helpers.h"
diff --git a/target/hppa/helper.h b/target/hppa/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/helper.h
+++ b/target/hppa/helper.h
@@ -XXX,XX +XXX,XX @@
 #if TARGET_REGISTER_BITS == 64
 # define dh_alias_tr     i64
-# define dh_is_64bit_tr  1
 #else
 # define dh_alias_tr     i32
-# define dh_is_64bit_tr  0
 #endif
 #define dh_ctype_tr      target_ureg
-#define dh_is_signed_tr  0
 
 DEF_HELPER_2(excp, noreturn, env, int)
 DEF_HELPER_FLAGS_2(tsv, TCG_CALL_NO_WG, void, env, tr)
diff --git a/target/i386/ops_sse_header.h b/target/i386/ops_sse_header.h
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/ops_sse_header.h
+++ b/target/i386/ops_sse_header.h
@@ -XXX,XX +XXX,XX @@
 #define dh_ctype_Reg Reg *
 #define dh_ctype_ZMMReg ZMMReg *
 #define dh_ctype_MMXReg MMXReg *
-#define dh_is_signed_Reg dh_is_signed_ptr
-#define dh_is_signed_ZMMReg dh_is_signed_ptr
-#define dh_is_signed_MMXReg dh_is_signed_ptr
 
 DEF_HELPER_3(glue(psrlw, SUFFIX), void, env, Reg, Reg)
 DEF_HELPER_3(glue(psraw, SUFFIX), void, env, Reg, Reg)
diff --git a/target/m68k/helper.h b/target/m68k/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/helper.h
+++ b/target/m68k/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_4(cas2l_parallel, void, env, i32, i32, i32)
 
 #define dh_alias_fp ptr
 #define dh_ctype_fp FPReg *
-#define dh_is_signed_fp dh_is_signed_ptr
 
 DEF_HELPER_3(exts32, void, env, fp, s32)
 DEF_HELPER_3(extf32, void, env, fp, f32)
diff --git a/target/ppc/helper.h b/target/ppc/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/helper.h
+++ b/target/ppc/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_1(ftsqrt, TCG_CALL_NO_RWG_SE, i32, i64)
 
 #define dh_alias_avr ptr
 #define dh_ctype_avr ppc_avr_t *
-#define dh_is_signed_avr dh_is_signed_ptr
 
 #define dh_alias_vsr ptr
 #define dh_ctype_vsr ppc_vsr_t *
-#define dh_is_signed_vsr dh_is_signed_ptr
 
 DEF_HELPER_3(vavgub, void, avr, avr, avr)
 DEF_HELPER_3(vavguh, void, avr, avr, avr)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(store_601_batu, void, env, i32, tl)
 
 #define dh_alias_fprp ptr
 #define dh_ctype_fprp ppc_fprp_t *
-#define dh_is_signed_fprp dh_is_signed_ptr
 
 DEF_HELPER_4(dadd, void, env, fprp, fprp, fprp)
 DEF_HELPER_4(daddq, void, env, fprp, fprp, fprp)
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ typedef struct TCGHelperInfo {
     void *func;
     const char *name;
     unsigned flags;
-    unsigned sizemask;
+    unsigned typemask;
 } TCGHelperInfo;
 
 #include "exec/helper-proto.h"
@@ -XXX,XX +XXX,XX @@ bool tcg_op_supported(TCGOpcode op)
 void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args)
 {
     int i, real_args, nb_rets, pi;
-    unsigned sizemask, flags;
+    unsigned typemask, flags;
     TCGHelperInfo *info;
     TCGOp *op;
 
     info = g_hash_table_lookup(helper_table, (gpointer)func);
     flags = info->flags;
-    sizemask = info->sizemask;
+    typemask = info->typemask;
 
 #ifdef CONFIG_PLUGIN
     /* detect non-plugin helpers */
@@ -XXX,XX +XXX,XX @@ void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args)
     && !defined(CONFIG_TCG_INTERPRETER)
     /* We have 64-bit values in one register, but need to pass as two
        separate parameters.  Split them.  */
-    int orig_sizemask = sizemask;
+    int orig_typemask = typemask;
     int orig_nargs = nargs;
     TCGv_i64 retl, reth;
     TCGTemp *split_args[MAX_OPC_PARAM];
 
     retl = NULL;
     reth = NULL;
-    if (sizemask != 0) {
-        for (i = real_args = 0; i < nargs; ++i) {
-            int is_64bit = sizemask & (1 << (i+1)*2);
-            if (is_64bit) {
-                TCGv_i64 orig = temp_tcgv_i64(args[i]);
-                TCGv_i32 h = tcg_temp_new_i32();
-                TCGv_i32 l = tcg_temp_new_i32();
-                tcg_gen_extr_i64_i32(l, h, orig);
-                split_args[real_args++] = tcgv_i32_temp(h);
-                split_args[real_args++] = tcgv_i32_temp(l);
-            } else {
-                split_args[real_args++] = args[i];
-            }
+    typemask = 0;
+    for (i = real_args = 0; i < nargs; ++i) {
+        int argtype = extract32(orig_typemask, (i + 1) * 3, 3);
+        bool is_64bit = (argtype & ~1) == dh_typecode_i64;
+
+        if (is_64bit) {
+            TCGv_i64 orig = temp_tcgv_i64(args[i]);
+            TCGv_i32 h = tcg_temp_new_i32();
+            TCGv_i32 l = tcg_temp_new_i32();
+            tcg_gen_extr_i64_i32(l, h, orig);
+            split_args[real_args++] = tcgv_i32_temp(h);
+            typemask |= dh_typecode_i32 << (real_args * 3);
+            split_args[real_args++] = tcgv_i32_temp(l);
+            typemask |= dh_typecode_i32 << (real_args * 3);
+        } else {
+            split_args[real_args++] = args[i];
+            typemask |= argtype << (real_args * 3);
         }
-        nargs = real_args;
-        args = split_args;
-        sizemask = 0;
     }
+    nargs = real_args;
+    args = split_args;
 #elif defined(TCG_TARGET_EXTEND_ARGS) && TCG_TARGET_REG_BITS == 64
     for (i = 0; i < nargs; ++i) {
-        int is_64bit = sizemask & (1 << (i+1)*2);
-        int is_signed = sizemask & (2 << (i+1)*2);
-        if (!is_64bit) {
+        int argtype = extract32(typemask, (i + 1) * 3, 3);
+        bool is_32bit = (argtype & ~1) == dh_typecode_i32;
+        bool is_signed = argtype & 1;
+
+        if (is_32bit) {
             TCGv_i64 temp = tcg_temp_new_i64();
             TCGv_i64 orig = temp_tcgv_i64(args[i]);
             if (is_signed) {
@@ -XXX,XX +XXX,XX @@ void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args)
     if (ret != NULL) {
 #if defined(__sparc__) && !defined(__arch64__) \
     && !defined(CONFIG_TCG_INTERPRETER)
-        if (orig_sizemask & 1) {
+        if ((typemask & 6) == dh_typecode_i64) {
             /* The 32-bit ABI is going to return the 64-bit value in
                the %o0/%o1 register pair.  Prepare for this by using
                two return temporaries, and reassemble below.  */
@@ -XXX,XX +XXX,XX @@ void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args)
             nb_rets = 1;
         }
 #else
-        if (TCG_TARGET_REG_BITS < 64 && (sizemask & 1)) {
+        if (TCG_TARGET_REG_BITS < 64 && (typemask & 6) == dh_typecode_i64) {
 #ifdef HOST_WORDS_BIGENDIAN
             op->args[pi++] = temp_arg(ret + 1);
             op->args[pi++] = temp_arg(ret);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args)
 
     real_args = 0;
     for (i = 0; i < nargs; i++) {
-        int is_64bit = sizemask & (1 << (i+1)*2);
+        int argtype = extract32(typemask, (i + 1) * 3, 3);
+        bool is_64bit = (argtype & ~1) == dh_typecode_i64;
+
         if (TCG_TARGET_REG_BITS < 64 && is_64bit) {
 #ifdef TCG_TARGET_CALL_ALIGN_ARGS
             /* some targets want aligned 64 bit args */
@@ -XXX,XX +XXX,XX @@ void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args)
     && !defined(CONFIG_TCG_INTERPRETER)
     /* Free all of the parts we allocated above.  */
     for (i = real_args = 0; i < orig_nargs; ++i) {
-        int is_64bit = orig_sizemask & (1 << (i+1)*2);
+        int argtype = extract32(orig_typemask, (i + 1) * 3, 3);
+        bool is_64bit = (argtype & ~1) == dh_typecode_i64;
+
         if (is_64bit) {
             tcg_temp_free_internal(args[real_args++]);
             tcg_temp_free_internal(args[real_args++]);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args)
             real_args++;
         }
     }
-    if (orig_sizemask & 1) {
+    if ((orig_typemask & 6) == dh_typecode_i64) {
         /* The 32-bit ABI returned two 32-bit pieces.  Re-assemble them.
            Note that describing these as TCGv_i64 eliminates an unnecessary
            zero-extension that tcg_gen_concat_i32_i64 would create.  */
@@ -XXX,XX +XXX,XX @@ void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args)
     }
 #elif defined(TCG_TARGET_EXTEND_ARGS) && TCG_TARGET_REG_BITS == 64
     for (i = 0; i < nargs; ++i) {
-        int is_64bit = sizemask & (1 << (i+1)*2);
-        if (!is_64bit) {
+        int argtype = extract32(typemask, (i + 1) * 3, 3);
+        bool is_32bit = (argtype & ~1) == dh_typecode_i32;
+
+        if (is_32bit) {
             tcg_temp_free_internal(args[i]);
         }
     }
-- 
2.25.1

We're going to change how to look up the call flags from a TCGop,
so extract it as a helper.

Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-internal.h |  5 +++++
 tcg/optimize.c     |  3 ++-
 tcg/tcg.c          | 14 ++++++--------
 3 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/tcg/tcg-internal.h b/tcg/tcg-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-internal.h
+++ b/tcg/tcg-internal.h
@@ -XXX,XX +XXX,XX @@ bool tcg_region_alloc(TCGContext *s);
 void tcg_region_initial_alloc(TCGContext *s);
 void tcg_region_prologue_set(TCGContext *s);
 
+static inline unsigned tcg_call_flags(TCGOp *op)
+{
+    return op->args[TCGOP_CALLO(op) + TCGOP_CALLI(op) + 1];
+}
+
 #endif /* TCG_INTERNAL_H */
diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "tcg/tcg-op.h"
+#include "tcg-internal.h"
 
 #define CASE_OP_32_64(x)                        \
         glue(glue(case INDEX_op_, x), _i32):    \
@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
             break;
 
         case INDEX_op_call:
-            if (!(op->args[nb_oargs + nb_iargs + 1]
+            if (!(tcg_call_flags(op)
                   & (TCG_CALL_NO_READ_GLOBALS | TCG_CALL_NO_WRITE_GLOBALS))) {
                 for (i = 0; i < nb_globals; i++) {
                     if (test_bit(i, temps_used.l)) {
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static void tcg_dump_ops(TCGContext *s, bool have_prefs)
             nb_cargs = def->nb_cargs;
 
             /* function name, flags, out args */
-            col += qemu_log(" %s %s,$0x%" TCG_PRIlx ",$%d", def->name,
+            col += qemu_log(" %s %s,$0x%x,$%d", def->name,
                             tcg_find_helper(s, op->args[nb_oargs + nb_iargs]),
-                            op->args[nb_oargs + nb_iargs + 1], nb_oargs);
+                            tcg_call_flags(op), nb_oargs);
             for (i = 0; i < nb_oargs; i++) {
                 col += qemu_log(",%s", tcg_get_arg_str(s, buf, sizeof(buf),
                                                        op->args[i]));
@@ -XXX,XX +XXX,XX @@ static void reachable_code_pass(TCGContext *s)
     QTAILQ_FOREACH_SAFE(op, &s->ops, link, op_next) {
         bool remove = dead;
         TCGLabel *label;
-        int call_flags;
 
         switch (op->opc) {
         case INDEX_op_set_label:
@@ -XXX,XX +XXX,XX @@ static void reachable_code_pass(TCGContext *s)
 
         case INDEX_op_call:
             /* Notice noreturn helper calls, raising exceptions.  */
-            call_flags = op->args[TCGOP_CALLO(op) + TCGOP_CALLI(op) + 1];
-            if (call_flags & TCG_CALL_NO_RETURN) {
+            if (tcg_call_flags(op) & TCG_CALL_NO_RETURN) {
                 dead = true;
             }
             break;
@@ -XXX,XX +XXX,XX @@ static void liveness_pass_1(TCGContext *s)
 
                 nb_oargs = TCGOP_CALLO(op);
                 nb_iargs = TCGOP_CALLI(op);
-                call_flags = op->args[nb_oargs + nb_iargs + 1];
+                call_flags = tcg_call_flags(op);
 
                 /* pure functions can be removed if their result is unused */
                 if (call_flags & TCG_CALL_NO_SIDE_EFFECTS) {
@@ -XXX,XX +XXX,XX @@ static bool liveness_pass_2(TCGContext *s)
         if (opc == INDEX_op_call) {
             nb_oargs = TCGOP_CALLO(op);
             nb_iargs = TCGOP_CALLI(op);
-            call_flags = op->args[nb_oargs + nb_iargs + 1];
+            call_flags = tcg_call_flags(op);
         } else {
             nb_iargs = def->nb_iargs;
             nb_oargs = def->nb_oargs;
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_call(TCGContext *s, TCGOp *op)
     TCGRegSet allocated_regs;
 
     func_addr = (tcg_insn_unit *)(intptr_t)op->args[nb_oargs + nb_iargs];
-    flags = op->args[nb_oargs + nb_iargs + 1];
+    flags = tcg_call_flags(op);
 
     nb_regs = ARRAY_SIZE(tcg_target_call_iarg_regs);
     if (nb_regs > nb_iargs) {
-- 
2.25.1

Let the compiler decide on inlining.

diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/plugin-gen.c
+++ b/accel/tcg/plugin-gen.c
@@ -XXX,XX +XXX,XX @@ static void gen_empty_mem_helper(void)
     tcg_temp_free_ptr(ptr);
 }
 
-static inline
-void gen_plugin_cb_start(enum plugin_gen_from from,
-                         enum plugin_gen_cb type, unsigned wr)
+static void gen_plugin_cb_start(enum plugin_gen_from from,
+                                enum plugin_gen_cb type, unsigned wr)
 {
     TCGOp *op;
 
@@ -XXX,XX +XXX,XX @@ static void gen_wrapped(enum plugin_gen_from from,
     tcg_gen_plugin_cb_end();
 }
 
-static inline void plugin_gen_empty_callback(enum plugin_gen_from from)
+static void plugin_gen_empty_callback(enum plugin_gen_from from)
 {
     switch (from) {
     case PLUGIN_GEN_AFTER_INSN:
@@ -XXX,XX +XXX,XX @@ static bool op_rw(const TCGOp *op, const struct qemu_plugin_dyn_cb *cb)
     return !!(cb->rw & (w + 1));
 }
 
-static inline
-void inject_cb_type(const GArray *cbs, TCGOp *begin_op, inject_fn inject,
-                    op_ok_fn ok)
+static void inject_cb_type(const GArray *cbs, TCGOp *begin_op,
+                           inject_fn inject, op_ok_fn ok)
 {
     TCGOp *end_op;
     TCGOp *op;
-- 
2.25.1

As noted by qemu-plugins.h, enum qemu_plugin_cb_flags is
currently unused -- plugins can neither read nor write
guest registers.

Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/plugin-helpers.h |  1 -
 include/qemu/plugin.h      |  1 -
 accel/tcg/plugin-gen.c     |  8 ++++----
 plugins/core.c             | 30 ++++++------------------------
 4 files changed, 10 insertions(+), 30 deletions(-)

diff --git a/accel/tcg/plugin-helpers.h b/accel/tcg/plugin-helpers.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/plugin-helpers.h
+++ b/accel/tcg/plugin-helpers.h
@@ -XXX,XX +XXX,XX @@
 #ifdef CONFIG_PLUGIN
-/* Note: no TCG flags because those are overwritten later */
 DEF_HELPER_2(plugin_vcpu_udata_cb, void, i32, ptr)
 DEF_HELPER_4(plugin_vcpu_mem_cb, void, i32, i32, i64, ptr)
 #endif
diff --git a/include/qemu/plugin.h b/include/qemu/plugin.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/plugin.h
+++ b/include/qemu/plugin.h
@@ -XXX,XX +XXX,XX @@ enum plugin_dyn_cb_subtype {
 struct qemu_plugin_dyn_cb {
     union qemu_plugin_cb_sig f;
     void *userp;
-    unsigned tcg_flags;
     enum plugin_dyn_cb_subtype type;
     /* @rw applies to mem callbacks only (both regular and inline) */
     enum qemu_plugin_mem_rw rw;
diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/plugin-gen.c
+++ b/accel/tcg/plugin-gen.c
@@ -XXX,XX +XXX,XX @@ static TCGOp *copy_st_ptr(TCGOp **begin_op, TCGOp *op)
 }
 
 static TCGOp *copy_call(TCGOp **begin_op, TCGOp *op, void *empty_func,
-                        void *func, unsigned tcg_flags, int *cb_idx)
+                        void *func, int *cb_idx)
 {
     /* copy all ops until the call */
     do {
@@ -XXX,XX +XXX,XX @@ static TCGOp *copy_call(TCGOp **begin_op, TCGOp *op, void *empty_func,
         tcg_debug_assert(i < MAX_OPC_PARAM_ARGS);
     }
     op->args[*cb_idx] = (uintptr_t)func;
-    op->args[*cb_idx + 1] = tcg_flags;
+    op->args[*cb_idx + 1] = (*begin_op)->args[*cb_idx + 1];
 
     return op;
 }
@@ -XXX,XX +XXX,XX @@ static TCGOp *append_udata_cb(const struct qemu_plugin_dyn_cb *cb,
 
     /* call */
     op = copy_call(&begin_op, op, HELPER(plugin_vcpu_udata_cb),
-                   cb->f.vcpu_udata, cb->tcg_flags, cb_idx);
+                   cb->f.vcpu_udata, cb_idx);
 
     return op;
 }
@@ -XXX,XX +XXX,XX @@ static TCGOp *append_mem_cb(const struct qemu_plugin_dyn_cb *cb,
     if (type == PLUGIN_GEN_CB_MEM) {
         /* call */
         op = copy_call(&begin_op, op, HELPER(plugin_vcpu_mem_cb),
-                       cb->f.vcpu_udata, cb->tcg_flags, cb_idx);
+                       cb->f.vcpu_udata, cb_idx);
     }
 
     return op;
diff --git a/plugins/core.c b/plugins/core.c
index XXXXXXX..XXXXXXX 100644
--- a/plugins/core.c
+++ b/plugins/core.c
@@ -XXX,XX +XXX,XX @@ void plugin_register_inline_op(GArray **arr,
     dyn_cb->inline_insn.imm = imm;
 }
 
-static inline uint32_t cb_to_tcg_flags(enum qemu_plugin_cb_flags flags)
-{
-    uint32_t ret;
-
-    switch (flags) {
-    case QEMU_PLUGIN_CB_RW_REGS:
-        ret = 0;
-        break;
-    case QEMU_PLUGIN_CB_R_REGS:
-        ret = TCG_CALL_NO_WG;
-        break;
-    case QEMU_PLUGIN_CB_NO_REGS:
-    default:
-        ret = TCG_CALL_NO_RWG;
-    }
-    return ret;
-}
-
-inline void
-plugin_register_dyn_cb__udata(GArray **arr,
-                              qemu_plugin_vcpu_udata_cb_t cb,
-                              enum qemu_plugin_cb_flags flags, void *udata)
+void plugin_register_dyn_cb__udata(GArray **arr,
+                                   qemu_plugin_vcpu_udata_cb_t cb,
+                                   enum qemu_plugin_cb_flags flags,
+                                   void *udata)
 {
     struct qemu_plugin_dyn_cb *dyn_cb = plugin_get_dyn_cb(arr);
 
     dyn_cb->userp = udata;
-    dyn_cb->tcg_flags = cb_to_tcg_flags(flags);
+    /* Note flags are discarded as unused. */
     dyn_cb->f.vcpu_udata = cb;
     dyn_cb->type = PLUGIN_CB_REGULAR;
 }
@@ -XXX,XX +XXX,XX @@ void plugin_register_vcpu_mem_cb(GArray **arr,
 
     dyn_cb = plugin_get_dyn_cb(arr);
     dyn_cb->userp = udata;
-    dyn_cb->tcg_flags = cb_to_tcg_flags(flags);
+    /* Note flags are discarded as unused. */
     dyn_cb->type = PLUGIN_CB_REGULAR;
     dyn_cb->rw = rw;
     dyn_cb->f.generic = cb;
-- 
2.25.1

This will give us both flags and typemask for use later.

We also fix a dumping bug, wherein calls generated for plugins
fail tcg_find_helper and print (null) instead of either a name
or the raw function pointer.

Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-internal.h | 14 ++++++++++++-
 tcg/tcg.c          | 49 ++++++++++++++++++++--------------------------
 2 files changed, 34 insertions(+), 29 deletions(-)

diff --git a/tcg/tcg-internal.h b/tcg/tcg-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-internal.h
+++ b/tcg/tcg-internal.h
@@ -XXX,XX +XXX,XX @@
 
 #define TCG_HIGHWATER 1024
 
+typedef struct TCGHelperInfo {
+    void *func;
+    const char *name;
+    unsigned flags;
+    unsigned typemask;
+} TCGHelperInfo;
+
 extern TCGContext tcg_init_ctx;
 extern TCGContext **tcg_ctxs;
 extern unsigned int tcg_cur_ctxs;
@@ -XXX,XX +XXX,XX @@ bool tcg_region_alloc(TCGContext *s);
 void tcg_region_initial_alloc(TCGContext *s);
 void tcg_region_prologue_set(TCGContext *s);
 
+static inline const TCGHelperInfo *tcg_call_info(TCGOp *op)
+{
+    return (void *)(uintptr_t)op->args[TCGOP_CALLO(op) + TCGOP_CALLI(op) + 1];
+}
+
 static inline unsigned tcg_call_flags(TCGOp *op)
 {
-    return op->args[TCGOP_CALLO(op) + TCGOP_CALLI(op) + 1];
+    return tcg_call_info(op)->flags;
 }
 
 #endif /* TCG_INTERNAL_H */
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ void tcg_pool_reset(TCGContext *s)
     s->pool_current = NULL;
 }
 
-typedef struct TCGHelperInfo {
-    void *func;
-    const char *name;
-    unsigned flags;
-    unsigned typemask;
-} TCGHelperInfo;
-
 #include "exec/helper-proto.h"
 
 static const TCGHelperInfo all_helpers[] = {
@@ -XXX,XX +XXX,XX @@ bool tcg_op_supported(TCGOpcode op)
 void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args)
 {
     int i, real_args, nb_rets, pi;
-    unsigned typemask, flags;
-    TCGHelperInfo *info;
+    unsigned typemask;
+    const TCGHelperInfo *info;
     TCGOp *op;
 
     info = g_hash_table_lookup(helper_table, (gpointer)func);
-    flags = info->flags;
     typemask = info->typemask;
 
 #ifdef CONFIG_PLUGIN
@@ -XXX,XX +XXX,XX @@ void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args)
         real_args++;
     }
     op->args[pi++] = (uintptr_t)func;
-    op->args[pi++] = flags;
+    op->args[pi++] = (uintptr_t)info;
     TCGOP_CALLI(op) = real_args;
 
     /* Make sure the fields didn't overflow.  */
@@ -XXX,XX +XXX,XX @@ static char *tcg_get_arg_str(TCGContext *s, char *buf,
     return tcg_get_arg_str_ptr(s, buf, buf_size, arg_temp(arg));
 }
 
-/* Find helper name.  */
-static inline const char *tcg_find_helper(TCGContext *s, uintptr_t val)
-{
-    const char *ret = NULL;
-    if (helper_table) {
-        TCGHelperInfo *info = g_hash_table_lookup(helper_table, (gpointer)val);
-        if (info) {
-            ret = info->name;
-        }
-    }
-    return ret;
-}
-
 static const char * const cond_name[] =
 {
     [TCG_COND_NEVER] = "never",
@@ -XXX,XX +XXX,XX @@ static void tcg_dump_ops(TCGContext *s, bool have_prefs)
                 col += qemu_log(" " TARGET_FMT_lx, a);
             }
         } else if (c == INDEX_op_call) {
+            const TCGHelperInfo *info = tcg_call_info(op);
+            void *func;
+
             /* variable number of arguments */
             nb_oargs = TCGOP_CALLO(op);
             nb_iargs = TCGOP_CALLI(op);
             nb_cargs = def->nb_cargs;
 
-            /* function name, flags, out args */
-            col += qemu_log(" %s %s,$0x%x,$%d", def->name,
-                            tcg_find_helper(s, op->args[nb_oargs + nb_iargs]),
-                            tcg_call_flags(op), nb_oargs);
+            col += qemu_log(" %s ", def->name);
+
+            /*
+             * Print the function name from TCGHelperInfo, if available.
+             * Note that plugins have a template function for the info,
+             * but the actual function pointer comes from the plugin.
+             */
+            func = (void *)(uintptr_t)op->args[nb_oargs + nb_iargs];
+            if (func == info->func) {
+                col += qemu_log("%s", info->name);
+            } else {
+                col += qemu_log("plugin(%p)", func);
+            }
+
+            col += qemu_log("$0x%x,$%d", info->flags, nb_oargs);
             for (i = 0; i < nb_oargs; i++) {
                 col += qemu_log(",%s", tcg_get_arg_str(s, buf, sizeof(buf),
                                                        op->args[i]));
-- 
2.25.1

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-internal.h | 5 +++++
 tcg/tcg.c          | 5 ++---
 2 files changed, 7 insertions(+), 3 deletions(-)

Add libffi as a build requirement for TCI.
Add libffi to the dockerfiles to satisfy that requirement.

Construct an ffi_cif structure for each unique typemask.
Record the result in a separate hash table for later lookup;
this allows helper_table to stay const.

Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg.c                                     | 58 +++++++++++++++++++
 tcg/meson.build                               |  8 ++-
 tests/docker/dockerfiles/alpine.docker        |  1 +
 tests/docker/dockerfiles/centos8.docker       |  1 +
 tests/docker/dockerfiles/debian10.docker      |  1 +
 .../dockerfiles/fedora-i386-cross.docker      |  1 +
 .../dockerfiles/fedora-win32-cross.docker     |  1 +
 .../dockerfiles/fedora-win64-cross.docker     |  1 +
 tests/docker/dockerfiles/fedora.docker        |  1 +
 tests/docker/dockerfiles/ubuntu.docker        |  1 +
 tests/docker/dockerfiles/ubuntu1804.docker    |  1 +
 tests/docker/dockerfiles/ubuntu2004.docker    |  1 +
 12 files changed, 75 insertions(+), 1 deletion(-)

diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/log.h"
 #include "tcg-internal.h"
 
+#ifdef CONFIG_TCG_INTERPRETER
+#include <ffi.h>
+#endif
+
 /* Forward declarations for functions declared in tcg-target.c.inc and
    used here. */
 static void tcg_target_init(TCGContext *s);
@@ -XXX,XX +XXX,XX @@ static const TCGHelperInfo all_helpers[] = {
 };
 static GHashTable *helper_table;
 
+#ifdef CONFIG_TCG_INTERPRETER
+static GHashTable *ffi_table;
+
+static ffi_type * const typecode_to_ffi[8] = {
+    [dh_typecode_void] = &ffi_type_void,
+    [dh_typecode_i32]  = &ffi_type_uint32,
+    [dh_typecode_s32]  = &ffi_type_sint32,
+    [dh_typecode_i64]  = &ffi_type_uint64,
+    [dh_typecode_s64]  = &ffi_type_sint64,
+    [dh_typecode_ptr]  = &ffi_type_pointer,
+};
+#endif
+
 static int indirect_reg_alloc_order[ARRAY_SIZE(tcg_target_reg_alloc_order)];
 static void process_op_defs(TCGContext *s);
 static TCGTemp *tcg_global_reg_new_internal(TCGContext *s, TCGType type,
@@ -XXX,XX +XXX,XX @@ static void tcg_context_init(unsigned max_cpus)
                             (gpointer)&all_helpers[i]);
     }
 
+#ifdef CONFIG_TCG_INTERPRETER
+    /* g_direct_hash/equal for direct comparisons on uint32_t.  */
+    ffi_table = g_hash_table_new(NULL, NULL);
+    for (i = 0; i < ARRAY_SIZE(all_helpers); ++i) {
+        struct {
+            ffi_cif cif;
+            ffi_type *args[];
+        } *ca;
+        uint32_t typemask = all_helpers[i].typemask;
+        gpointer hash = (gpointer)(uintptr_t)typemask;
+        ffi_status status;
+        int nargs;
+
+        if (g_hash_table_lookup(ffi_table, hash)) {
+            continue;
+        }
+
+        /* Ignoring the return type, find the last non-zero field. */
+        nargs = 32 - clz32(typemask >> 3);
+        nargs = DIV_ROUND_UP(nargs, 3);
+
+        ca = g_malloc0(sizeof(*ca) + nargs * sizeof(ffi_type *));
+        ca->cif.rtype = typecode_to_ffi[typemask & 7];
+        ca->cif.nargs = nargs;
+
+        if (nargs != 0) {
+            ca->cif.arg_types = ca->args;
+            for (i = 0; i < nargs; ++i) {
+                int typecode = extract32(typemask, (i + 1) * 3, 3);
+                ca->args[i] = typecode_to_ffi[typecode];
+            }
+        }
+
+        status = ffi_prep_cif(&ca->cif, FFI_DEFAULT_ABI, nargs,
+                              ca->cif.rtype, ca->cif.arg_types);
+        assert(status == FFI_OK);
+
+        g_hash_table_insert(ffi_table, hash, (gpointer)&ca->cif);
+    }
+#endif
+
     tcg_target_init(s);
     process_op_defs(s);
 
diff --git a/tcg/meson.build b/tcg/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tcg/meson.build
+++ b/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ tcg_ss.add(files(
   'tcg-op-gvec.c',
   'tcg-op-vec.c',
 ))
-tcg_ss.add(when: 'CONFIG_TCG_INTERPRETER', if_true: files('tci.c'))
+
+if get_option('tcg_interpreter')
+  libffi = dependency('libffi', version: '>=3.0', required: true,
+                      method: 'pkg-config', kwargs: static_kwargs)
+  specific_ss.add(libffi)
+  specific_ss.add(files('tci.c'))
+endif
 
 specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_ss)
diff --git a/tests/docker/dockerfiles/alpine.docker b/tests/docker/dockerfiles/alpine.docker
index XXXXXXX..XXXXXXX 100644
--- a/tests/docker/dockerfiles/alpine.docker
+++ b/tests/docker/dockerfiles/alpine.docker
@@ -XXX,XX +XXX,XX @@ ENV PACKAGES \
 	libaio-dev \
 	libbpf-dev \
 	libcap-ng-dev \
+	libffi-dev \
 	libjpeg-turbo-dev \
 	libnfs-dev \
 	libpng-dev \
diff --git a/tests/docker/dockerfiles/centos8.docker b/tests/docker/dockerfiles/centos8.docker
index XXXXXXX..XXXXXXX 100644
--- a/tests/docker/dockerfiles/centos8.docker
+++ b/tests/docker/dockerfiles/centos8.docker
@@ -XXX,XX +XXX,XX @@ ENV PACKAGES \
     libbpf-devel \
     libepoxy-devel \
     libfdt-devel \
+    libffi-devel \
     libgcrypt-devel \
     lzo-devel \
     make \
diff --git a/tests/docker/dockerfiles/debian10.docker b/tests/docker/dockerfiles/debian10.docker
index XXXXXXX..XXXXXXX 100644
--- a/tests/docker/dockerfiles/debian10.docker
+++ b/tests/docker/dockerfiles/debian10.docker
@@ -XXX,XX +XXX,XX @@ RUN apt update && \
         gdb-multiarch \
         gettext \
         git \
+        libffi-dev \
         libncurses5-dev \
         ninja-build \
         pkg-config \
diff --git a/tests/docker/dockerfiles/fedora-i386-cross.docker b/tests/docker/dockerfiles/fedora-i386-cross.docker
index XXXXXXX..XXXXXXX 100644
--- a/tests/docker/dockerfiles/fedora-i386-cross.docker
+++ b/tests/docker/dockerfiles/fedora-i386-cross.docker
@@ -XXX,XX +XXX,XX @@ ENV PACKAGES \
     findutils \
     gcc \
     git \
+    libffi-devel.i686 \
     libtasn1-devel.i686 \
     libzstd-devel.i686 \
     make \
diff --git a/tests/docker/dockerfiles/fedora-win32-cross.docker b/tests/docker/dockerfiles/fedora-win32-cross.docker
index XXXXXXX..XXXXXXX 100644
--- a/tests/docker/dockerfiles/fedora-win32-cross.docker
+++ b/tests/docker/dockerfiles/fedora-win32-cross.docker
@@ -XXX,XX +XXX,XX @@ ENV PACKAGES \
     mingw32-gmp \
     mingw32-gnutls \
     mingw32-gtk3 \
+    mingw32-libffi \
     mingw32-libjpeg-turbo \
     mingw32-libpng \
     mingw32-libtasn1 \
diff --git a/tests/docker/dockerfiles/fedora-win64-cross.docker b/tests/docker/dockerfiles/fedora-win64-cross.docker
index XXXXXXX..XXXXXXX 100644
--- a/tests/docker/dockerfiles/fedora-win64-cross.docker
+++ b/tests/docker/dockerfiles/fedora-win64-cross.docker
@@ -XXX,XX +XXX,XX @@ ENV PACKAGES \
     mingw64-glib2 \
     mingw64-gmp \
     mingw64-gtk3 \
+    mingw64-libffi \
     mingw64-libjpeg-turbo \
     mingw64-libpng \
     mingw64-libtasn1 \
diff --git a/tests/docker/dockerfiles/fedora.docker b/tests/docker/dockerfiles/fedora.docker
index XXXXXXX..XXXXXXX 100644
--- a/tests/docker/dockerfiles/fedora.docker
+++ b/tests/docker/dockerfiles/fedora.docker
@@ -XXX,XX +XXX,XX @@ ENV PACKAGES \
     libepoxy-devel \
     libfdt-devel \
     libbpf-devel \
+    libffi-devel \
     libiscsi-devel \
     libjpeg-devel \
     libpmem-devel \
diff --git a/tests/docker/dockerfiles/ubuntu.docker b/tests/docker/dockerfiles/ubuntu.docker
index XXXXXXX..XXXXXXX 100644
--- a/tests/docker/dockerfiles/ubuntu.docker
+++ b/tests/docker/dockerfiles/ubuntu.docker
@@ -XXX,XX +XXX,XX @@ ENV PACKAGES \
     libdrm-dev \
     libepoxy-dev \
     libfdt-dev \
+    libffi-dev \
     libgbm-dev \
     libgnutls28-dev \
     libgtk-3-dev \
diff --git a/tests/docker/dockerfiles/ubuntu1804.docker b/tests/docker/dockerfiles/ubuntu1804.docker
index XXXXXXX..XXXXXXX 100644
--- a/tests/docker/dockerfiles/ubuntu1804.docker
+++ b/tests/docker/dockerfiles/ubuntu1804.docker
@@ -XXX,XX +XXX,XX @@ ENV PACKAGES \
     libdrm-dev \
     libepoxy-dev \
     libfdt-dev \
+    libffi-dev \
     libgbm-dev \
     libgtk-3-dev \
     libibverbs-dev \
diff --git a/tests/docker/dockerfiles/ubuntu2004.docker b/tests/docker/dockerfiles/ubuntu2004.docker
index XXXXXXX..XXXXXXX 100644
--- a/tests/docker/dockerfiles/ubuntu2004.docker
+++ b/tests/docker/dockerfiles/ubuntu2004.docker
@@ -XXX,XX +XXX,XX @@ ENV PACKAGES flex bison \
     libdrm-dev \
     libepoxy-dev \
     libfdt-dev \
+    libffi-dev \
     libgbm-dev \
     libgtk-3-dev \
     libibverbs-dev \
-- 
2.25.1

The current setting is much too pessimistic.  Indicating only
the one or two registers that are actually assigned after a
call should avoid unnecessary movement between the register
array and the stack array.

diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_target_init(TCGContext *s)
     tcg_target_available_regs[TCG_TYPE_I32] = BIT(TCG_TARGET_NB_REGS) - 1;
     /* Registers available for 64 bit operations. */
     tcg_target_available_regs[TCG_TYPE_I64] = BIT(TCG_TARGET_NB_REGS) - 1;
-    /* TODO: Which registers should be set here? */
-    tcg_target_call_clobber_regs = BIT(TCG_TARGET_NB_REGS) - 1;
+    /*
+     * The interpreter "registers" are in the local stack frame and
+     * cannot be clobbered by the called helper functions.  However,
+     * the interpreter assumes a 64-bit return value and assigns to
+     * the return value registers.
+     */
+    tcg_target_call_clobber_regs =
+        MAKE_64BIT_MASK(TCG_REG_R0, 64 / TCG_TARGET_REG_BITS);
 
     s->reserved_regs = 0;
     tcg_regset_set_reg(s->reserved_regs, TCG_REG_CALL_STACK);
-- 
2.25.1

This requires adjusting where arguments are stored.
Place them on the stack at left-aligned positions.
Adjust the stack frame to be at entirely positive offsets.

Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg.h        |   1 +
 tcg/tci/tcg-target.h     |   2 +-
 tcg/tcg.c                |  64 +++++++++++++-----
 tcg/tci.c                | 142 ++++++++++++++++++++++-----------------
 tcg/tci/tcg-target.c.inc |  50 +++++++-------
 5 files changed, 153 insertions(+), 106 deletions(-)

diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@
 #define MAX_OPC_PARAM (4 + (MAX_OPC_PARAM_PER_ARG * MAX_OPC_PARAM_ARGS))
 
 #define CPU_TEMP_BUF_NLONGS 128
+#define TCG_STATIC_FRAME_SIZE  (CPU_TEMP_BUF_NLONGS * sizeof(long))
 
 /* Default target word size to pointer size.  */
 #ifndef TCG_TARGET_REG_BITS
diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.h
+++ b/tcg/tci/tcg-target.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
 
 /* Used for function call generation. */
 #define TCG_TARGET_CALL_STACK_OFFSET    0
-#define TCG_TARGET_STACK_ALIGN          16
+#define TCG_TARGET_STACK_ALIGN          8
 
 #define HAVE_TCG_QEMU_TB_EXEC
 
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static void tcg_out_st(TCGContext *s, TCGType type, TCGReg arg, TCGReg arg1,
                        intptr_t arg2);
 static bool tcg_out_sti(TCGContext *s, TCGType type, TCGArg val,
                         TCGReg base, intptr_t ofs);
+#ifdef CONFIG_TCG_INTERPRETER
+static void tcg_out_call(TCGContext *s, const tcg_insn_unit *target,
+                         ffi_cif *cif);
+#else
 static void tcg_out_call(TCGContext *s, const tcg_insn_unit *target);
+#endif
 static bool tcg_target_const_match(int64_t val, TCGType type, int ct);
 #ifdef TCG_TARGET_NEED_LDST_LABELS
 static int tcg_out_ldst_finalize(TCGContext *s);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args)
     for (i = 0; i < nargs; i++) {
         int argtype = extract32(typemask, (i + 1) * 3, 3);
         bool is_64bit = (argtype & ~1) == dh_typecode_i64;
+        bool want_align = false;
+
+#if defined(CONFIG_TCG_INTERPRETER)
+        /*
+         * Align all arguments, so that they land in predictable places
+         * for passing off to ffi_call.
+         */
+        want_align = true;
+#elif defined(TCG_TARGET_CALL_ALIGN_ARGS)
+        /* Some targets want aligned 64 bit args */
+        want_align = is_64bit;
+#endif
+
+        if (TCG_TARGET_REG_BITS < 64 && want_align && (real_args & 1)) {
+            op->args[pi++] = TCG_CALL_DUMMY_ARG;
+            real_args++;
+        }
 
         if (TCG_TARGET_REG_BITS < 64 && is_64bit) {
-#ifdef TCG_TARGET_CALL_ALIGN_ARGS
-            /* some targets want aligned 64 bit args */
-            if (real_args & 1) {
-                op->args[pi++] = TCG_CALL_DUMMY_ARG;
-                real_args++;
-            }
-#endif
-           /* If stack grows up, then we will be placing successive
-              arguments at lower addresses, which means we need to
-              reverse the order compared to how we would normally
-              treat either big or little-endian.  For those arguments
-              that will wind up in registers, this still works for
-              HPPA (the only current STACK_GROWSUP target) since the
-              argument registers are *also* allocated in decreasing
-              order.  If another such target is added, this logic may
-              have to get more complicated to differentiate between
-              stack arguments and register arguments.  */
+            /*
+             * If stack grows up, then we will be placing successive
+             * arguments at lower addresses, which means we need to
+             * reverse the order compared to how we would normally
+             * treat either big or little-endian.  For those arguments
+             * that will wind up in registers, this still works for
+             * HPPA (the only current STACK_GROWSUP target) since the
+             * argument registers are *also* allocated in decreasing
+             * order.  If another such target is added, this logic may
+             * have to get more complicated to differentiate between
+             * stack arguments and register arguments.
+             */
 #if defined(HOST_WORDS_BIGENDIAN) != defined(TCG_TARGET_STACK_GROWSUP)
             op->args[pi++] = temp_arg(args[i] + 1);
             op->args[pi++] = temp_arg(args[i]);
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_call(TCGContext *s, TCGOp *op)
     const int nb_oargs = TCGOP_CALLO(op);
     const int nb_iargs = TCGOP_CALLI(op);
     const TCGLifeData arg_life = op->life;
+    const TCGHelperInfo *info;
     int flags, nb_regs, i;
     TCGReg reg;
     TCGArg arg;
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_call(TCGContext *s, TCGOp *op)
     TCGRegSet allocated_regs;
 
     func_addr = tcg_call_func(op);
-    flags = tcg_call_flags(op);
+    info = tcg_call_info(op);
+    flags = info->flags;
 
     nb_regs = ARRAY_SIZE(tcg_target_call_iarg_regs);
     if (nb_regs > nb_iargs) {
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_call(TCGContext *s, TCGOp *op)
         save_globals(s, allocated_regs);
     }
 
+#ifdef CONFIG_TCG_INTERPRETER
+    {
+        gpointer hash = (gpointer)(uintptr_t)info->typemask;
+        ffi_cif *cif = g_hash_table_lookup(ffi_table, hash);
+        assert(cif != NULL);
+        tcg_out_call(s, func_addr, cif);
+    }
+#else
     tcg_out_call(s, func_addr);
+#endif
 
     /* assign output registers and emit moves if needed */
     for(i = 0; i < nb_oargs; i++) {
diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu-common.h"
+#include "tcg/tcg.h"           /* MAX_OPC_PARAM_IARGS */
+#include "exec/cpu_ldst.h"
+#include "tcg/tcg-op.h"
+#include "qemu/compiler.h"
+#include <ffi.h>
 
-/* Enable TCI assertions only when debugging TCG (and without NDEBUG defined).
- * Without assertions, the interpreter runs much faster. */
+
+/*
+ * Enable TCI assertions only when debugging TCG (and without NDEBUG defined).
+ * Without assertions, the interpreter runs much faster.
+ */
 #if defined(CONFIG_DEBUG_TCG)
 # define tci_assert(cond) assert(cond)
 #else
 # define tci_assert(cond) ((void)(cond))
 #endif
 
-#include "qemu-common.h"
-#include "tcg/tcg.h"           /* MAX_OPC_PARAM_IARGS */
-#include "exec/cpu_ldst.h"
-#include "tcg/tcg-op.h"
-#include "qemu/compiler.h"
-
-#if MAX_OPC_PARAM_IARGS != 6
-# error Fix needed, number of supported input arguments changed!
-#endif
-#if TCG_TARGET_REG_BITS == 32
-typedef uint64_t (*helper_function)(tcg_target_ulong, tcg_target_ulong,
-                                    tcg_target_ulong, tcg_target_ulong,
-                                    tcg_target_ulong, tcg_target_ulong,
-                                    tcg_target_ulong, tcg_target_ulong,
-                                    tcg_target_ulong, tcg_target_ulong,
-                                    tcg_target_ulong, tcg_target_ulong);
-#else
-typedef uint64_t (*helper_function)(tcg_target_ulong, tcg_target_ulong,
-                                    tcg_target_ulong, tcg_target_ulong,
-                                    tcg_target_ulong, tcg_target_ulong);
-#endif
-
 __thread uintptr_t tci_tb_ptr;
 
-static tcg_target_ulong tci_read_reg(const tcg_target_ulong *regs, TCGReg index)
-{
-    tci_assert(index < TCG_TARGET_NB_REGS);
-    return regs[index];
-}
-
 static void
 tci_write_reg(tcg_target_ulong *regs, TCGReg index, tcg_target_ulong value)
 {
@@ -XXX,XX +XXX,XX @@ static tcg_target_ulong tci_read_label(const uint8_t **tb_ptr)
  *   I = immediate (tcg_target_ulong)
  *   l = label or pointer
  *   m = immediate (TCGMemOpIdx)
+ *   n = immediate (call return length)
  *   r = register
  *   s = signed ldst offset
  */
@@ -XXX,XX +XXX,XX @@ static void tci_args_l(const uint8_t **tb_ptr, void **l0)
     check_size(start, tb_ptr);
 }
 
+static void tci_args_nll(const uint8_t **tb_ptr, uint8_t *n0,
+                         void **l1, void **l2)
+{
+    const uint8_t *start = *tb_ptr;
+
+    *n0 = tci_read_b(tb_ptr);
+    *l1 = (void *)tci_read_label(tb_ptr);
+    *l2 = (void *)tci_read_label(tb_ptr);
+
+    check_size(start, tb_ptr);
+}
+
 static void tci_args_rr(const uint8_t **tb_ptr,
                         TCGReg *r0, TCGReg *r1)
 {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 {
     const uint8_t *tb_ptr = v_tb_ptr;
     tcg_target_ulong regs[TCG_TARGET_NB_REGS];
-    long tcg_temps[CPU_TEMP_BUF_NLONGS];
-    uintptr_t sp_value = (uintptr_t)(tcg_temps + CPU_TEMP_BUF_NLONGS);
+    uint64_t stack[(TCG_STATIC_CALL_ARGS_SIZE + TCG_STATIC_FRAME_SIZE)
+                   / sizeof(uint64_t)];
+    void *call_slots[TCG_STATIC_CALL_ARGS_SIZE / sizeof(uint64_t)];
 
     regs[TCG_AREG0] = (tcg_target_ulong)env;
-    regs[TCG_REG_CALL_STACK] = sp_value;
+    regs[TCG_REG_CALL_STACK] = (uintptr_t)stack;
+    /* Other call_slots entries initialized at first use (see below). */
+    call_slots[0] = NULL;
     tci_assert(tb_ptr);
 
     for (;;) {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 #endif
         TCGMemOpIdx oi;
         int32_t ofs;
-        void *ptr;
+        void *ptr, *cif;
 
         /* Skip opcode and size entry. */
         tb_ptr += 2;
 
         switch (opc) {
         case INDEX_op_call:
-            tci_args_l(&tb_ptr, &ptr);
+            /*
+             * Set up the ffi_avalue array once, delayed until now
+             * because many TB's do not make any calls. In tcg_gen_callN,
+             * we arranged for every real argument to be "left-aligned"
+             * in each 64-bit slot.
+             */
+            if (unlikely(call_slots[0] == NULL)) {
+                for (int i = 0; i < ARRAY_SIZE(call_slots); ++i) {
+                    call_slots[i] = &stack[i];
+                }
+            }
+
+            tci_args_nll(&tb_ptr, &len, &ptr, &cif);
+
+            /* Helper functions may need to access the "return address" */
             tci_tb_ptr = (uintptr_t)tb_ptr;
-#if TCG_TARGET_REG_BITS == 32
-            tmp64 = ((helper_function)ptr)(tci_read_reg(regs, TCG_REG_R0),
-                                           tci_read_reg(regs, TCG_REG_R1),
-                                           tci_read_reg(regs, TCG_REG_R2),
-                                           tci_read_reg(regs, TCG_REG_R3),
-                                           tci_read_reg(regs, TCG_REG_R4),
-                                           tci_read_reg(regs, TCG_REG_R5),
-                                           tci_read_reg(regs, TCG_REG_R6),
-                                           tci_read_reg(regs, TCG_REG_R7),
-                                           tci_read_reg(regs, TCG_REG_R8),
-                                           tci_read_reg(regs, TCG_REG_R9),
-                                           tci_read_reg(regs, TCG_REG_R10),
-                                           tci_read_reg(regs, TCG_REG_R11));
-            tci_write_reg(regs, TCG_REG_R0, tmp64);
-            tci_write_reg(regs, TCG_REG_R1, tmp64 >> 32);
-#else
-            tmp64 = ((helper_function)ptr)(tci_read_reg(regs, TCG_REG_R0),
-                                           tci_read_reg(regs, TCG_REG_R1),
-                                           tci_read_reg(regs, TCG_REG_R2),
-                                           tci_read_reg(regs, TCG_REG_R3),
-                                           tci_read_reg(regs, TCG_REG_R4),
-                                           tci_read_reg(regs, TCG_REG_R5));
-            tci_write_reg(regs, TCG_REG_R0, tmp64);
-#endif
+
+            ffi_call(cif, ptr, stack, call_slots);
+
+            /* Any result winds up "left-aligned" in the stack[0] slot. */
+            switch (len) {
+            case 0: /* void */
+                break;
+            case 1: /* uint32_t */
+                /*
+                 * Note that libffi has an odd special case in that it will
+                 * always widen an integral result to ffi_arg.
+                 */
+                if (sizeof(ffi_arg) == 4) {
+                    regs[TCG_REG_R0] = *(uint32_t *)stack;
+                    break;
+                }
+                /* fall through */
+            case 2: /* uint64_t */
+                if (TCG_TARGET_REG_BITS == 32) {
+                    tci_write_reg64(regs, TCG_REG_R1, TCG_REG_R0, stack[0]);
+                } else {
+                    regs[TCG_REG_R0] = stack[0];
+                }
+                break;
+            default:
+                g_assert_not_reached();
+            }
             break;
+
         case INDEX_op_br:
             tci_args_l(&tb_ptr, &ptr);
             tb_ptr = ptr;
@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     TCGCond c;
     TCGMemOpIdx oi;
     uint8_t pos, len;
-    void *ptr;
+    void *ptr, *cif;
     const uint8_t *tb_ptr;
 
     status = info->read_memory_func(addr, buf, 2, info);
@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
 
     switch (op) {
     case INDEX_op_br:
-    case INDEX_op_call:
     case INDEX_op_exit_tb:
     case INDEX_op_goto_tb:
         tci_args_l(&tb_ptr, &ptr);
         info->fprintf_func(info->stream, "%-12s  %p", op_name, ptr);
         break;
 
+    case INDEX_op_call:
+        tci_args_nll(&tb_ptr, &len, &ptr, &cif);
+        info->fprintf_func(info->stream, "%-12s  %d, %p, %p",
+                           op_name, len, ptr, cif);
+        break;
+
     case INDEX_op_brcond_i32:
     case INDEX_op_brcond_i64:
         tci_args_rrcl(&tb_ptr, &r0, &r1, &c, &ptr);
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const int tcg_target_reg_alloc_order[] = {
 # error Fix needed, number of supported input arguments changed!
 #endif
 
-static const int tcg_target_call_iarg_regs[] = {
-    TCG_REG_R0,
-    TCG_REG_R1,
-    TCG_REG_R2,
-    TCG_REG_R3,
-    TCG_REG_R4,
-    TCG_REG_R5,
-#if TCG_TARGET_REG_BITS == 32
-    /* 32 bit hosts need 2 * MAX_OPC_PARAM_IARGS registers. */
-    TCG_REG_R6,
-    TCG_REG_R7,
-    TCG_REG_R8,
-    TCG_REG_R9,
-    TCG_REG_R10,
-    TCG_REG_R11,
-#endif
-};
+/* No call arguments via registers.  All will be stored on the "stack". */
+static const int tcg_target_call_iarg_regs[] = { };
 
 static const int tcg_target_call_oarg_regs[] = {
     TCG_REG_R0,
@@ -XXX,XX +XXX,XX @@ static void tci_out_label(TCGContext *s, TCGLabel *label)
 static void stack_bounds_check(TCGReg base, target_long offset)
 {
     if (base == TCG_REG_CALL_STACK) {
-        tcg_debug_assert(offset < 0);
-        tcg_debug_assert(offset >= -(CPU_TEMP_BUF_NLONGS * sizeof(long)));
+        tcg_debug_assert(offset >= 0);
+        tcg_debug_assert(offset < (TCG_STATIC_CALL_ARGS_SIZE +
+                                   TCG_STATIC_FRAME_SIZE));
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi(TCGContext *s, TCGType type,
     }
 }
 
-static inline void tcg_out_call(TCGContext *s, const tcg_insn_unit *arg)
+static void tcg_out_call(TCGContext *s, const tcg_insn_unit *func,
+                         ffi_cif *cif)
 {
     uint8_t *old_code_ptr = s->code_ptr;
+    uint8_t which;
+
+    if (cif->rtype == &ffi_type_void) {
+        which = 0;
+    } else if (cif->rtype->size == 4) {
+        which = 1;
+    } else {
+        tcg_debug_assert(cif->rtype->size == 8);
+        which = 2;
+    }
     tcg_out_op_t(s, INDEX_op_call);
-    tcg_out_i(s, (uintptr_t)arg);
+    tcg_out8(s, which);
+    tcg_out_i(s, (uintptr_t)func);
+    tcg_out_i(s, (uintptr_t)cif);
+
     old_code_ptr[1] = s->code_ptr - old_code_ptr;
 }
 
@@ -XXX,XX +XXX,XX @@ static void tcg_target_init(TCGContext *s)
     s->reserved_regs = 0;
     tcg_regset_set_reg(s->reserved_regs, TCG_REG_CALL_STACK);
 
-    /* We use negative offsets from "sp" so that we can distinguish
-       stores that might pretend to be call arguments.  */
-    tcg_set_frame(s, TCG_REG_CALL_STACK,
-                  -CPU_TEMP_BUF_NLONGS * sizeof(long),
-                  CPU_TEMP_BUF_NLONGS * sizeof(long));
+    /* The call arguments come first, followed by the temp storage. */
+    tcg_set_frame(s, TCG_REG_CALL_STACK, TCG_STATIC_CALL_ARGS_SIZE,
+                  TCG_STATIC_FRAME_SIZE);
 }
 
 /* Generate global QEMU prologue and epilogue code. */
-- 
2.25.1

We're about to adjust the offset range on host memory ops,
and the format of branches.  Both will require a temporary.

diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.h
+++ b/tcg/tci/tcg-target.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
     TCG_REG_R14,
     TCG_REG_R15,
 
+    TCG_REG_TMP = TCG_REG_R13,
     TCG_AREG0 = TCG_REG_R14,
     TCG_REG_CALL_STACK = TCG_REG_R15,
 } TCGReg;
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_target_init(TCGContext *s)
         MAKE_64BIT_MASK(TCG_REG_R0, 64 / TCG_TARGET_REG_BITS);
 
     s->reserved_regs = 0;
+    tcg_regset_set_reg(s->reserved_regs, TCG_REG_TMP);
     tcg_regset_set_reg(s->reserved_regs, TCG_REG_CALL_STACK);
 
     /* The call arguments come first, followed by the temp storage. */
-- 
2.25.1

The encoding planned for tci does not have enough room for
brcond2, with 4 registers and a condition as input as well
as the label.  Resolve the condition into TCG_REG_TMP, and
relax brcond to one register plus a label, considering the
condition to always be reg != 0.

Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c                | 68 ++++++++++------------------------------
 tcg/tci/tcg-target.c.inc | 52 +++++++++++-------------------
 2 files changed, 35 insertions(+), 85 deletions(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ static void tci_args_nll(const uint8_t **tb_ptr, uint8_t *n0,
     check_size(start, tb_ptr);
 }
 
+static void tci_args_rl(const uint8_t **tb_ptr, TCGReg *r0, void **l1)
+{
+    const uint8_t *start = *tb_ptr;
+
+    *r0 = tci_read_r(tb_ptr);
+    *l1 = (void *)tci_read_label(tb_ptr);
+
+    check_size(start, tb_ptr);
+}
+
 static void tci_args_rr(const uint8_t **tb_ptr,
                         TCGReg *r0, TCGReg *r1)
 {
@@ -XXX,XX +XXX,XX @@ static void tci_args_rrs(const uint8_t **tb_ptr,
     check_size(start, tb_ptr);
 }
 
-static void tci_args_rrcl(const uint8_t **tb_ptr,
-                          TCGReg *r0, TCGReg *r1, TCGCond *c2, void **l3)
-{
-    const uint8_t *start = *tb_ptr;
-
-    *r0 = tci_read_r(tb_ptr);
-    *r1 = tci_read_r(tb_ptr);
-    *c2 = tci_read_b(tb_ptr);
-    *l3 = (void *)tci_read_label(tb_ptr);
-
-    check_size(start, tb_ptr);
-}
-
 static void tci_args_rrrc(const uint8_t **tb_ptr,
                           TCGReg *r0, TCGReg *r1, TCGReg *r2, TCGCond *c3)
 {
@@ -XXX,XX +XXX,XX @@ static void tci_args_rrrr(const uint8_t **tb_ptr,
     check_size(start, tb_ptr);
 }
 
-static void tci_args_rrrrcl(const uint8_t **tb_ptr, TCGReg *r0, TCGReg *r1,
-                            TCGReg *r2, TCGReg *r3, TCGCond *c4, void **l5)
-{
-    const uint8_t *start = *tb_ptr;
-
-    *r0 = tci_read_r(tb_ptr);
-    *r1 = tci_read_r(tb_ptr);
-    *r2 = tci_read_r(tb_ptr);
-    *r3 = tci_read_r(tb_ptr);
-    *c4 = tci_read_b(tb_ptr);
-    *l5 = (void *)tci_read_label(tb_ptr);
-
-    check_size(start, tb_ptr);
-}
-
 static void tci_args_rrrrrc(const uint8_t **tb_ptr, TCGReg *r0, TCGReg *r1,
                             TCGReg *r2, TCGReg *r3, TCGReg *r4, TCGCond *c5)
 {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             break;
 #endif
         case INDEX_op_brcond_i32:
-            tci_args_rrcl(&tb_ptr, &r0, &r1, &condition, &ptr);
-            if (tci_compare32(regs[r0], regs[r1], condition)) {
+            tci_args_rl(&tb_ptr, &r0, &ptr);
+            if ((uint32_t)regs[r0]) {
                 tb_ptr = ptr;
             }
             break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             T2 = tci_uint64(regs[r5], regs[r4]);
             tci_write_reg64(regs, r1, r0, T1 - T2);
             break;
-        case INDEX_op_brcond2_i32:
-            tci_args_rrrrcl(&tb_ptr, &r0, &r1, &r2, &r3, &condition, &ptr);
-            T1 = tci_uint64(regs[r1], regs[r0]);
-            T2 = tci_uint64(regs[r3], regs[r2]);
-            if (tci_compare64(T1, T2, condition)) {
-                tb_ptr = ptr;
-                continue;
-            }
-            break;
         case INDEX_op_mulu2_i32:
             tci_args_rrrr(&tb_ptr, &r0, &r1, &r2, &r3);
             tci_write_reg64(regs, r1, r0, (uint64_t)regs[r2] * regs[r3]);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             break;
 #endif
         case INDEX_op_brcond_i64:
-            tci_args_rrcl(&tb_ptr, &r0, &r1, &condition, &ptr);
-            if (tci_compare64(regs[r0], regs[r1], condition)) {
+            tci_args_rl(&tb_ptr, &r0, &ptr);
+            if (regs[r0]) {
                 tb_ptr = ptr;
             }
             break;
@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
 
     case INDEX_op_brcond_i32:
     case INDEX_op_brcond_i64:
-        tci_args_rrcl(&tb_ptr, &r0, &r1, &c, &ptr);
-        info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %p",
-                           op_name, str_r(r0), str_r(r1), str_c(c), ptr);
+        tci_args_rl(&tb_ptr, &r0, &ptr);
+        info->fprintf_func(info->stream, "%-12s  %s, 0, ne, %p",
+                           op_name, str_r(r0), ptr);
         break;
 
     case INDEX_op_setcond_i32:
@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
                            str_r(r3), str_r(r4), str_c(c));
         break;
 
-    case INDEX_op_brcond2_i32:
-        tci_args_rrrrcl(&tb_ptr, &r0, &r1, &r2, &r3, &c, &ptr);
-        info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s, %s, %p",
-                           op_name, str_r(r0), str_r(r1),
-                           str_r(r2), str_r(r3), str_c(c), ptr);
-        break;
-
     case INDEX_op_mulu2_i32:
         tci_args_rrrr(&tb_ptr, &r0, &r1, &r2, &r3);
         info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s",
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op_rI(TCGContext *s, TCGOpcode op,
 }
 #endif
 
+static void tcg_out_op_rl(TCGContext *s, TCGOpcode op, TCGReg r0, TCGLabel *l1)
+{
+    uint8_t *old_code_ptr = s->code_ptr;
+
+    tcg_out_op_t(s, op);
+    tcg_out_r(s, r0);
+    tci_out_label(s, l1);
+
+    old_code_ptr[1] = s->code_ptr - old_code_ptr;
+}
+
 static void tcg_out_op_rr(TCGContext *s, TCGOpcode op, TCGReg r0, TCGReg r1)
 {
     uint8_t *old_code_ptr = s->code_ptr;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op_rrs(TCGContext *s, TCGOpcode op,
     old_code_ptr[1] = s->code_ptr - old_code_ptr;
 }
 
-static void tcg_out_op_rrcl(TCGContext *s, TCGOpcode op,
-                            TCGReg r0, TCGReg r1, TCGCond c2, TCGLabel *l3)
-{
-    uint8_t *old_code_ptr = s->code_ptr;
-
-    tcg_out_op_t(s, op);
-    tcg_out_r(s, r0);
-    tcg_out_r(s, r1);
-    tcg_out8(s, c2);
-    tci_out_label(s, l3);
-
-    old_code_ptr[1] = s->code_ptr - old_code_ptr;
-}
-
 static void tcg_out_op_rrrc(TCGContext *s, TCGOpcode op,
                             TCGReg r0, TCGReg r1, TCGReg r2, TCGCond c3)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op_rrrr(TCGContext *s, TCGOpcode op,
     old_code_ptr[1] = s->code_ptr - old_code_ptr;
 }
 
-static void tcg_out_op_rrrrcl(TCGContext *s, TCGOpcode op,
-                              TCGReg r0, TCGReg r1, TCGReg r2, TCGReg r3,
-                              TCGCond c4, TCGLabel *l5)
-{
-    uint8_t *old_code_ptr = s->code_ptr;
-
-    tcg_out_op_t(s, op);
-    tcg_out_r(s, r0);
-    tcg_out_r(s, r1);
-    tcg_out_r(s, r2);
-    tcg_out_r(s, r3);
-    tcg_out8(s, c4);
-    tci_out_label(s, l5);
-
-    old_code_ptr[1] = s->code_ptr - old_code_ptr;
-}
-
 static void tcg_out_op_rrrrrc(TCGContext *s, TCGOpcode op,
                               TCGReg r0, TCGReg r1, TCGReg r2,
                               TCGReg r3, TCGReg r4, TCGCond c5)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         break;
 
     CASE_32_64(brcond)
-        tcg_out_op_rrcl(s, opc, args[0], args[1], args[2], arg_label(args[3]));
+        tcg_out_op_rrrc(s, (opc == INDEX_op_brcond_i32
+                            ? INDEX_op_setcond_i32 : INDEX_op_setcond_i64),
+                        TCG_REG_TMP, args[0], args[1], args[2]);
+        tcg_out_op_rl(s, opc, TCG_REG_TMP, arg_label(args[3]));
         break;
 
     CASE_32_64(neg)      /* Optional (TCG_TARGET_HAS_neg_*). */
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
                           args[3], args[4], args[5]);
         break;
     case INDEX_op_brcond2_i32:
-        tcg_out_op_rrrrcl(s, opc, args[0], args[1], args[2],
-                          args[3], args[4], arg_label(args[5]));
+        tcg_out_op_rrrrrc(s, INDEX_op_setcond2_i32, TCG_REG_TMP,
+                          args[0], args[1], args[2], args[3], args[4]);
+        tcg_out_op_rl(s, INDEX_op_brcond_i32, TCG_REG_TMP, arg_label(args[5]));
         break;
     case INDEX_op_mulu2_i32:
         tcg_out_op_rrrr(s, opc, args[0], args[1], args[2], args[3]);
-- 
2.25.1

Inline it into its one caller, tci_write_reg64.
Drop the asserts that are redundant with tcg_read_r.

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@
 
 __thread uintptr_t tci_tb_ptr;
 
-static void
-tci_write_reg(tcg_target_ulong *regs, TCGReg index, tcg_target_ulong value)
-{
-    tci_assert(index < TCG_TARGET_NB_REGS);
-    tci_assert(index != TCG_AREG0);
-    tci_assert(index != TCG_REG_CALL_STACK);
-    regs[index] = value;
-}
-
 static void tci_write_reg64(tcg_target_ulong *regs, uint32_t high_index,
                             uint32_t low_index, uint64_t value)
 {
-    tci_write_reg(regs, low_index, value);
-    tci_write_reg(regs, high_index, value >> 32);
+    regs[low_index] = value;
+    regs[high_index] = value >> 32;
 }
 
 /* Create a 64 bit value from two 32 bit values. */
-- 
2.25.1

This removes all of the problems with unaligned accesses
to the bytecode stream.

With an 8-bit opcode at the bottom, we have 24 bits remaining,
which are generally split into 6 4-bit slots.  This fits well
with the maximum length opcodes, e.g. INDEX_op_add2_i32, which
have 6 register operands.

We have, in previous patches, rearranged things such that there
are no operations with a label which have more than one other
operand.  Which leaves us with a 20-bit field in which to encode
a label, giving us a maximum TB size of 512k -- easily large.

Change the INDEX_op_tci_movi_{i32,i64} opcodes to tci_mov[il].
The former puts the immediate in the upper 20 bits of the insn,
like we do for the label displacement.  The later uses a label
to reference an entry in the constant pool.  Thus, in the worst
case we still have a single memory reference for any constant,
but now the constants are out-of-line of the bytecode and can
be shared between different moves saving space.

Change INDEX_op_call to use a label to reference a pair of
pointers in the constant pool.  This removes the only slightly
dodgy link with the layout of struct TCGHelperInfo.

The re-encode cannot be done in pieces.

Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg-opc.h    |   4 +-
 tcg/tci/tcg-target.h     |   3 +-
 tcg/tci.c                | 539 +++++++++++++++------------------------
 tcg/tci/tcg-target.c.inc | 379 ++++++++++++---------------
 tcg/tci/README           |  20 +-
 5 files changed, 383 insertions(+), 562 deletions(-)

diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -XXX,XX +XXX,XX @@ DEF(last_generic, 0, 0, 0, TCG_OPF_NOT_PRESENT)
 
 #ifdef TCG_TARGET_INTERPRETER
 /* These opcodes are only for use between the tci generator and interpreter. */
-DEF(tci_movi_i32, 1, 0, 1, TCG_OPF_NOT_PRESENT)
-DEF(tci_movi_i64, 1, 0, 1, TCG_OPF_64BIT | TCG_OPF_NOT_PRESENT)
+DEF(tci_movi, 1, 0, 1, TCG_OPF_NOT_PRESENT)
+DEF(tci_movl, 1, 0, 1, TCG_OPF_NOT_PRESENT)
 #endif
 
 #undef TLADDR_ARGS
diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.h
+++ b/tcg/tci/tcg-target.h
@@ -XXX,XX +XXX,XX @@
 #define TCG_TARGET_H
 
 #define TCG_TARGET_INTERPRETER 1
-#define TCG_TARGET_INSN_UNIT_SIZE 1
+#define TCG_TARGET_INSN_UNIT_SIZE 4
 #define TCG_TARGET_TLB_DISPLACEMENT_BITS 32
 #define MAX_CODE_GEN_BUFFER_SIZE  ((size_t)-1)
 
@@ -XXX,XX +XXX,XX @@ typedef enum {
 #define TCG_TARGET_STACK_ALIGN          8
 
 #define HAVE_TCG_QEMU_TB_EXEC
+#define TCG_TARGET_NEED_POOL_LABELS
 
 /* We could notice __i386__ or __s390x__ and reduce the barriers depending
    on the host.  But if you want performance, you use the normal backend.
diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ static uint64_t tci_uint64(uint32_t high, uint32_t low)
     return ((uint64_t)high << 32) + low;
 }
 
-/* Read constant byte from bytecode. */
-static uint8_t tci_read_b(const uint8_t **tb_ptr)
-{
-    return *(tb_ptr[0]++);
-}
-
-/* Read register number from bytecode. */
-static TCGReg tci_read_r(const uint8_t **tb_ptr)
-{
-    uint8_t regno = tci_read_b(tb_ptr);
-    tci_assert(regno < TCG_TARGET_NB_REGS);
-    return regno;
-}
-
-/* Read constant (native size) from bytecode. */
-static tcg_target_ulong tci_read_i(const uint8_t **tb_ptr)
-{
-    tcg_target_ulong value = *(const tcg_target_ulong *)(*tb_ptr);
-    *tb_ptr += sizeof(value);
-    return value;
-}
-
-/* Read unsigned constant (32 bit) from bytecode. */
-static uint32_t tci_read_i32(const uint8_t **tb_ptr)
-{
-    uint32_t value = *(const uint32_t *)(*tb_ptr);
-    *tb_ptr += sizeof(value);
-    return value;
-}
-
-/* Read signed constant (32 bit) from bytecode. */
-static int32_t tci_read_s32(const uint8_t **tb_ptr)
-{
-    int32_t value = *(const int32_t *)(*tb_ptr);
-    *tb_ptr += sizeof(value);
-    return value;
-}
-
-static tcg_target_ulong tci_read_label(const uint8_t **tb_ptr)
-{
-    return tci_read_i(tb_ptr);
-}
-
 /*
  * Load sets of arguments all at once.  The naming convention is:
  *   tci_args_<arguments>
@@ -XXX,XX +XXX,XX @@ static tcg_target_ulong tci_read_label(const uint8_t **tb_ptr)
  *   s = signed ldst offset
  */
 
-static void check_size(const uint8_t *start, const uint8_t **tb_ptr)
+static void tci_args_l(uint32_t insn, const void *tb_ptr, void **l0)
 {
-    const uint8_t *old_code_ptr = start - 2;
-    uint8_t op_size = old_code_ptr[1];
-    tci_assert(*tb_ptr == old_code_ptr + op_size);
+    int diff = sextract32(insn, 12, 20);
+    *l0 = diff ? (void *)tb_ptr + diff : NULL;
 }
 
-static void tci_args_l(const uint8_t **tb_ptr, void **l0)
+static void tci_args_nl(uint32_t insn, const void *tb_ptr,
+                        uint8_t *n0, void **l1)
 {
-    const uint8_t *start = *tb_ptr;
-
-    *l0 = (void *)tci_read_label(tb_ptr);
-
-    check_size(start, tb_ptr);
+    *n0 = extract32(insn, 8, 4);
+    *l1 = sextract32(insn, 12, 20) + (void *)tb_ptr;
 }
 
-static void tci_args_nll(const uint8_t **tb_ptr, uint8_t *n0,
-                         void **l1, void **l2)
+static void tci_args_rl(uint32_t insn, const void *tb_ptr,
+                        TCGReg *r0, void **l1)
 {
-    const uint8_t *start = *tb_ptr;
-
-    *n0 = tci_read_b(tb_ptr);
-    *l1 = (void *)tci_read_label(tb_ptr);
-    *l2 = (void *)tci_read_label(tb_ptr);
-
-    check_size(start, tb_ptr);
+    *r0 = extract32(insn, 8, 4);
+    *l1 = sextract32(insn, 12, 20) + (void *)tb_ptr;
 }
 
-static void tci_args_rl(const uint8_t **tb_ptr, TCGReg *r0, void **l1)
+static void tci_args_rr(uint32_t insn, TCGReg *r0, TCGReg *r1)
 {
-    const uint8_t *start = *tb_ptr;
-
-    *r0 = tci_read_r(tb_ptr);
-    *l1 = (void *)tci_read_label(tb_ptr);
-
-    check_size(start, tb_ptr);
+    *r0 = extract32(insn, 8, 4);
+    *r1 = extract32(insn, 12, 4);
 }
 
-static void tci_args_rr(const uint8_t **tb_ptr,
-                        TCGReg *r0, TCGReg *r1)
+static void tci_args_ri(uint32_t insn, TCGReg *r0, tcg_target_ulong *i1)
 {
-    const uint8_t *start = *tb_ptr;
-
-    *r0 = tci_read_r(tb_ptr);
-    *r1 = tci_read_r(tb_ptr);
-
-    check_size(start, tb_ptr);
+    *r0 = extract32(insn, 8, 4);
+    *i1 = sextract32(insn, 12, 20);
 }
 
-static void tci_args_ri(const uint8_t **tb_ptr,
-                        TCGReg *r0, tcg_target_ulong *i1)
+static void tci_args_rrm(uint32_t insn, TCGReg *r0,
+                         TCGReg *r1, TCGMemOpIdx *m2)
 {
-    const uint8_t *start = *tb_ptr;
-
-    *r0 = tci_read_r(tb_ptr);
-    *i1 = tci_read_i32(tb_ptr);
-
-    check_size(start, tb_ptr);
+    *r0 = extract32(insn, 8, 4);
+    *r1 = extract32(insn, 12, 4);
+    *m2 = extract32(insn, 20, 12);
 }
 
-#if TCG_TARGET_REG_BITS == 64
-static void tci_args_rI(const uint8_t **tb_ptr,
-                        TCGReg *r0, tcg_target_ulong *i1)
+static void tci_args_rrr(uint32_t insn, TCGReg *r0, TCGReg *r1, TCGReg *r2)
 {
-    const uint8_t *start = *tb_ptr;
-
-    *r0 = tci_read_r(tb_ptr);
-    *i1 = tci_read_i(tb_ptr);
-
-    check_size(start, tb_ptr);
-}
-#endif
-
-static void tci_args_rrm(const uint8_t **tb_ptr,
-                         TCGReg *r0, TCGReg *r1, TCGMemOpIdx *m2)
-{
-    const uint8_t *start = *tb_ptr;
-
-    *r0 = tci_read_r(tb_ptr);
-    *r1 = tci_read_r(tb_ptr);
-    *m2 = tci_read_i32(tb_ptr);
-
-    check_size(start, tb_ptr);
+    *r0 = extract32(insn, 8, 4);
+    *r1 = extract32(insn, 12, 4);
+    *r2 = extract32(insn, 16, 4);
 }
 
-static void tci_args_rrr(const uint8_t **tb_ptr,
-                         TCGReg *r0, TCGReg *r1, TCGReg *r2)
+static void tci_args_rrs(uint32_t insn, TCGReg *r0, TCGReg *r1, int32_t *i2)
 {
-    const uint8_t *start = *tb_ptr;
-
-    *r0 = tci_read_r(tb_ptr);
-    *r1 = tci_read_r(tb_ptr);
-    *r2 = tci_read_r(tb_ptr);
-
-    check_size(start, tb_ptr);
+    *r0 = extract32(insn, 8, 4);
+    *r1 = extract32(insn, 12, 4);
+    *i2 = sextract32(insn, 16, 16);
 }
 
-static void tci_args_rrs(const uint8_t **tb_ptr,
-                         TCGReg *r0, TCGReg *r1, int32_t *i2)
-{
-    const uint8_t *start = *tb_ptr;
-
-    *r0 = tci_read_r(tb_ptr);
-    *r1 = tci_read_r(tb_ptr);
-    *i2 = tci_read_s32(tb_ptr);
-
-    check_size(start, tb_ptr);
-}
-
-static void tci_args_rrrc(const uint8_t **tb_ptr,
+static void tci_args_rrrc(uint32_t insn,
                           TCGReg *r0, TCGReg *r1, TCGReg *r2, TCGCond *c3)
 {
-    const uint8_t *start = *tb_ptr;
-
-    *r0 = tci_read_r(tb_ptr);
-    *r1 = tci_read_r(tb_ptr);
-    *r2 = tci_read_r(tb_ptr);
-    *c3 = tci_read_b(tb_ptr);
-
-    check_size(start, tb_ptr);
+    *r0 = extract32(insn, 8, 4);
+    *r1 = extract32(insn, 12, 4);
+    *r2 = extract32(insn, 16, 4);
+    *c3 = extract32(insn, 20, 4);
 }
 
-static void tci_args_rrrm(const uint8_t **tb_ptr,
+static void tci_args_rrrm(uint32_t insn,
                           TCGReg *r0, TCGReg *r1, TCGReg *r2, TCGMemOpIdx *m3)
 {
-    const uint8_t *start = *tb_ptr;
-
-    *r0 = tci_read_r(tb_ptr);
-    *r1 = tci_read_r(tb_ptr);
-    *r2 = tci_read_r(tb_ptr);
-    *m3 = tci_read_i32(tb_ptr);
-
-    check_size(start, tb_ptr);
+    *r0 = extract32(insn, 8, 4);
+    *r1 = extract32(insn, 12, 4);
+    *r2 = extract32(insn, 16, 4);
+    *m3 = extract32(insn, 20, 12);
 }
 
-static void tci_args_rrrbb(const uint8_t **tb_ptr, TCGReg *r0, TCGReg *r1,
+static void tci_args_rrrbb(uint32_t insn, TCGReg *r0, TCGReg *r1,
                            TCGReg *r2, uint8_t *i3, uint8_t *i4)
 {
-    const uint8_t *start = *tb_ptr;
-
-    *r0 = tci_read_r(tb_ptr);
-    *r1 = tci_read_r(tb_ptr);
-    *r2 = tci_read_r(tb_ptr);
-    *i3 = tci_read_b(tb_ptr);
-    *i4 = tci_read_b(tb_ptr);
-
-    check_size(start, tb_ptr);
+    *r0 = extract32(insn, 8, 4);
+    *r1 = extract32(insn, 12, 4);
+    *r2 = extract32(insn, 16, 4);
+    *i3 = extract32(insn, 20, 6);
+    *i4 = extract32(insn, 26, 6);
 }
 
-static void tci_args_rrrrm(const uint8_t **tb_ptr, TCGReg *r0, TCGReg *r1,
-                           TCGReg *r2, TCGReg *r3, TCGMemOpIdx *m4)
+static void tci_args_rrrrr(uint32_t insn, TCGReg *r0, TCGReg *r1,
+                           TCGReg *r2, TCGReg *r3, TCGReg *r4)
 {
-    const uint8_t *start = *tb_ptr;
-
-    *r0 = tci_read_r(tb_ptr);
-    *r1 = tci_read_r(tb_ptr);
-    *r2 = tci_read_r(tb_ptr);
-    *r3 = tci_read_r(tb_ptr);
-    *m4 = tci_read_i32(tb_ptr);
-
-    check_size(start, tb_ptr);
+    *r0 = extract32(insn, 8, 4);
+    *r1 = extract32(insn, 12, 4);
+    *r2 = extract32(insn, 16, 4);
+    *r3 = extract32(insn, 20, 4);
+    *r4 = extract32(insn, 24, 4);
 }
 
 #if TCG_TARGET_REG_BITS == 32
-static void tci_args_rrrr(const uint8_t **tb_ptr,
+static void tci_args_rrrr(uint32_t insn,
                           TCGReg *r0, TCGReg *r1, TCGReg *r2, TCGReg *r3)
 {
-    const uint8_t *start = *tb_ptr;
-
-    *r0 = tci_read_r(tb_ptr);
-    *r1 = tci_read_r(tb_ptr);
-    *r2 = tci_read_r(tb_ptr);
-    *r3 = tci_read_r(tb_ptr);
-
-    check_size(start, tb_ptr);
+    *r0 = extract32(insn, 8, 4);
+    *r1 = extract32(insn, 12, 4);
+    *r2 = extract32(insn, 16, 4);
+    *r3 = extract32(insn, 20, 4);
 }
 
-static void tci_args_rrrrrc(const uint8_t **tb_ptr, TCGReg *r0, TCGReg *r1,
+static void tci_args_rrrrrc(uint32_t insn, TCGReg *r0, TCGReg *r1,
                             TCGReg *r2, TCGReg *r3, TCGReg *r4, TCGCond *c5)
 {
-    const uint8_t *start = *tb_ptr;
-
-    *r0 = tci_read_r(tb_ptr);
-    *r1 = tci_read_r(tb_ptr);
-    *r2 = tci_read_r(tb_ptr);
-    *r3 = tci_read_r(tb_ptr);
-    *r4 = tci_read_r(tb_ptr);
-    *c5 = tci_read_b(tb_ptr);
-
-    check_size(start, tb_ptr);
+    *r0 = extract32(insn, 8, 4);
+    *r1 = extract32(insn, 12, 4);
+    *r2 = extract32(insn, 16, 4);
+    *r3 = extract32(insn, 20, 4);
+    *r4 = extract32(insn, 24, 4);
+    *c5 = extract32(insn, 28, 4);
 }
 
-static void tci_args_rrrrrr(const uint8_t **tb_ptr, TCGReg *r0, TCGReg *r1,
+static void tci_args_rrrrrr(uint32_t insn, TCGReg *r0, TCGReg *r1,
                             TCGReg *r2, TCGReg *r3, TCGReg *r4, TCGReg *r5)
 {
-    const uint8_t *start = *tb_ptr;
-
-    *r0 = tci_read_r(tb_ptr);
-    *r1 = tci_read_r(tb_ptr);
-    *r2 = tci_read_r(tb_ptr);
-    *r3 = tci_read_r(tb_ptr);
-    *r4 = tci_read_r(tb_ptr);
-    *r5 = tci_read_r(tb_ptr);
-
-    check_size(start, tb_ptr);
+    *r0 = extract32(insn, 8, 4);
+    *r1 = extract32(insn, 12, 4);
+    *r2 = extract32(insn, 16, 4);
+    *r3 = extract32(insn, 20, 4);
+    *r4 = extract32(insn, 24, 4);
+    *r5 = extract32(insn, 28, 4);
 }
 #endif
 
@@ -XXX,XX +XXX,XX @@ static bool tci_compare64(uint64_t u0, uint64_t u1, TCGCond condition)
 uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                                             const void *v_tb_ptr)
 {
-    const uint8_t *tb_ptr = v_tb_ptr;
+    const uint32_t *tb_ptr = v_tb_ptr;
     tcg_target_ulong regs[TCG_TARGET_NB_REGS];
     uint64_t stack[(TCG_STATIC_CALL_ARGS_SIZE + TCG_STATIC_FRAME_SIZE)
                    / sizeof(uint64_t)];
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
     tci_assert(tb_ptr);
 
     for (;;) {
-        TCGOpcode opc = tb_ptr[0];
-        TCGReg r0, r1, r2, r3;
+        uint32_t insn;
+        TCGOpcode opc;
+        TCGReg r0, r1, r2, r3, r4;
         tcg_target_ulong t1;
         TCGCond condition;
         target_ulong taddr;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         uint32_t tmp32;
         uint64_t tmp64;
 #if TCG_TARGET_REG_BITS == 32
-        TCGReg r4, r5;
+        TCGReg r5;
         uint64_t T1, T2;
 #endif
         TCGMemOpIdx oi;
         int32_t ofs;
-        void *ptr, *cif;
+        void *ptr;
 
-        /* Skip opcode and size entry. */
-        tb_ptr += 2;
+        insn = *tb_ptr++;
+        opc = extract32(insn, 0, 8);
 
         switch (opc) {
         case INDEX_op_call:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                 }
             }
 
-            tci_args_nll(&tb_ptr, &len, &ptr, &cif);
+            tci_args_nl(insn, tb_ptr, &len, &ptr);
 
             /* Helper functions may need to access the "return address" */
             tci_tb_ptr = (uintptr_t)tb_ptr;
 
-            ffi_call(cif, ptr, stack, call_slots);
+            {
+                void **pptr = ptr;
+                ffi_call(pptr[1], pptr[0], stack, call_slots);
+            }
 
             /* Any result winds up "left-aligned" in the stack[0] slot. */
             switch (len) {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             break;
 
         case INDEX_op_br:
-            tci_args_l(&tb_ptr, &ptr);
+            tci_args_l(insn, tb_ptr, &ptr);
             tb_ptr = ptr;
             continue;
         case INDEX_op_setcond_i32:
-            tci_args_rrrc(&tb_ptr, &r0, &r1, &r2, &condition);
+            tci_args_rrrc(insn, &r0, &r1, &r2, &condition);
             regs[r0] = tci_compare32(regs[r1], regs[r2], condition);
             break;
 #if TCG_TARGET_REG_BITS == 32
         case INDEX_op_setcond2_i32:
-            tci_args_rrrrrc(&tb_ptr, &r0, &r1, &r2, &r3, &r4, &condition);
+            tci_args_rrrrrc(insn, &r0, &r1, &r2, &r3, &r4, &condition);
             T1 = tci_uint64(regs[r2], regs[r1]);
             T2 = tci_uint64(regs[r4], regs[r3]);
             regs[r0] = tci_compare64(T1, T2, condition);
             break;
 #elif TCG_TARGET_REG_BITS == 64
         case INDEX_op_setcond_i64:
-            tci_args_rrrc(&tb_ptr, &r0, &r1, &r2, &condition);
+            tci_args_rrrc(insn, &r0, &r1, &r2, &condition);
             regs[r0] = tci_compare64(regs[r1], regs[r2], condition);
             break;
 #endif
         CASE_32_64(mov)
-            tci_args_rr(&tb_ptr, &r0, &r1);
+            tci_args_rr(insn, &r0, &r1);
             regs[r0] = regs[r1];
             break;
-        case INDEX_op_tci_movi_i32:
-            tci_args_ri(&tb_ptr, &r0, &t1);
+        case INDEX_op_tci_movi:
+            tci_args_ri(insn, &r0, &t1);
             regs[r0] = t1;
             break;
+        case INDEX_op_tci_movl:
+            tci_args_rl(insn, tb_ptr, &r0, &ptr);
+            regs[r0] = *(tcg_target_ulong *)ptr;
+            break;
 
             /* Load/store operations (32 bit). */
 
         CASE_32_64(ld8u)
-            tci_args_rrs(&tb_ptr, &r0, &r1, &ofs);
+            tci_args_rrs(insn, &r0, &r1, &ofs);
             ptr = (void *)(regs[r1] + ofs);
             regs[r0] = *(uint8_t *)ptr;
             break;
         CASE_32_64(ld8s)
-            tci_args_rrs(&tb_ptr, &r0, &r1, &ofs);
+            tci_args_rrs(insn, &r0, &r1, &ofs);
             ptr = (void *)(regs[r1] + ofs);
             regs[r0] = *(int8_t *)ptr;
             break;
         CASE_32_64(ld16u)
-            tci_args_rrs(&tb_ptr, &r0, &r1, &ofs);
+            tci_args_rrs(insn, &r0, &r1, &ofs);
             ptr = (void *)(regs[r1] + ofs);
             regs[r0] = *(uint16_t *)ptr;
             break;
         CASE_32_64(ld16s)
-            tci_args_rrs(&tb_ptr, &r0, &r1, &ofs);
+            tci_args_rrs(insn, &r0, &r1, &ofs);
             ptr = (void *)(regs[r1] + ofs);
             regs[r0] = *(int16_t *)ptr;
             break;
         case INDEX_op_ld_i32:
         CASE_64(ld32u)
-            tci_args_rrs(&tb_ptr, &r0, &r1, &ofs);
+            tci_args_rrs(insn, &r0, &r1, &ofs);
             ptr = (void *)(regs[r1] + ofs);
             regs[r0] = *(uint32_t *)ptr;
             break;
         CASE_32_64(st8)
-            tci_args_rrs(&tb_ptr, &r0, &r1, &ofs);
+            tci_args_rrs(insn, &r0, &r1, &ofs);
             ptr = (void *)(regs[r1] + ofs);
             *(uint8_t *)ptr = regs[r0];
             break;
         CASE_32_64(st16)
-            tci_args_rrs(&tb_ptr, &r0, &r1, &ofs);
+            tci_args_rrs(insn, &r0, &r1, &ofs);
             ptr = (void *)(regs[r1] + ofs);
             *(uint16_t *)ptr = regs[r0];
             break;
         case INDEX_op_st_i32:
         CASE_64(st32)
-            tci_args_rrs(&tb_ptr, &r0, &r1, &ofs);
+            tci_args_rrs(insn, &r0, &r1, &ofs);
             ptr = (void *)(regs[r1] + ofs);
             *(uint32_t *)ptr = regs[r0];
             break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             /* Arithmetic operations (mixed 32/64 bit). */
 
         CASE_32_64(add)
-            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
+            tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] + regs[r2];
             break;
         CASE_32_64(sub)
-            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
+            tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] - regs[r2];
             break;
         CASE_32_64(mul)
-            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
+            tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] * regs[r2];
             break;
         CASE_32_64(and)
-            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
+            tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] & regs[r2];
             break;
         CASE_32_64(or)
-            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
+            tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] | regs[r2];
             break;
         CASE_32_64(xor)
-            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
+            tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] ^ regs[r2];
             break;
 
             /* Arithmetic operations (32 bit). */
 
         case INDEX_op_div_i32:
-            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
+            tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (int32_t)regs[r1] / (int32_t)regs[r2];
             break;
         case INDEX_op_divu_i32:
-            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
+            tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (uint32_t)regs[r1] / (uint32_t)regs[r2];
             break;
         case INDEX_op_rem_i32:
-            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
+            tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (int32_t)regs[r1] % (int32_t)regs[r2];
             break;
         case INDEX_op_remu_i32:
-            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
+            tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (uint32_t)regs[r1] % (uint32_t)regs[r2];
             break;
 
             /* Shift/rotate operations (32 bit). */
 
         case INDEX_op_shl_i32:
-            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
+            tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (uint32_t)regs[r1] << (regs[r2] & 31);
             break;
         case INDEX_op_shr_i32:
-            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
+            tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (uint32_t)regs[r1] >> (regs[r2] & 31);
             break;
         case INDEX_op_sar_i32:
-            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
+            tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (int32_t)regs[r1] >> (regs[r2] & 31);
             break;
 #if TCG_TARGET_HAS_rot_i32
         case INDEX_op_rotl_i32:
-            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
+            tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = rol32(regs[r1], regs[r2] & 31);
             break;
         case INDEX_op_rotr_i32:
-            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
+            tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = ror32(regs[r1], regs[r2] & 31);
             break;
 #endif
 #if TCG_TARGET_HAS_deposit_i32
         case INDEX_op_deposit_i32:
-            tci_args_rrrbb(&tb_ptr, &r0, &r1, &r2, &pos, &len);
+            tci_args_rrrbb(insn, &r0, &r1, &r2, &pos, &len);
             regs[r0] = deposit32(regs[r1], pos, len, regs[r2]);
             break;
 #endif
         case INDEX_op_brcond_i32:
-            tci_args_rl(&tb_ptr, &r0, &ptr);
+            tci_args_rl(insn, tb_ptr, &r0, &ptr);
             if ((uint32_t)regs[r0]) {
                 tb_ptr = ptr;
             }
             break;
 #if TCG_TARGET_REG_BITS == 32
         case INDEX_op_add2_i32:
-            tci_args_rrrrrr(&tb_ptr, &r0, &r1, &r2, &r3, &r4, &r5);
+            tci_args_rrrrrr(insn, &r0, &r1, &r2, &r3, &r4, &r5);
             T1 = tci_uint64(regs[r3], regs[r2]);
             T2 = tci_uint64(regs[r5], regs[r4]);
             tci_write_reg64(regs, r1, r0, T1 + T2);
             break;
         case INDEX_op_sub2_i32:
-            tci_args_rrrrrr(&tb_ptr, &r0, &r1, &r2, &r3, &r4, &r5);
+            tci_args_rrrrrr(insn, &r0, &r1, &r2, &r3, &r4, &r5);
             T1 = tci_uint64(regs[r3], regs[r2]);
             T2 = tci_uint64(regs[r5], regs[r4]);
             tci_write_reg64(regs, r1, r0, T1 - T2);
             break;
         case INDEX_op_mulu2_i32:
-            tci_args_rrrr(&tb_ptr, &r0, &r1, &r2, &r3);
+            tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
             tci_write_reg64(regs, r1, r0, (uint64_t)regs[r2] * regs[r3]);
             break;
 #endif /* TCG_TARGET_REG_BITS == 32 */
 #if TCG_TARGET_HAS_ext8s_i32 || TCG_TARGET_HAS_ext8s_i64
         CASE_32_64(ext8s)
-            tci_args_rr(&tb_ptr, &r0, &r1);
+            tci_args_rr(insn, &r0, &r1);
             regs[r0] = (int8_t)regs[r1];
             break;
 #endif
 #if TCG_TARGET_HAS_ext16s_i32 || TCG_TARGET_HAS_ext16s_i64
         CASE_32_64(ext16s)
-            tci_args_rr(&tb_ptr, &r0, &r1);
+            tci_args_rr(insn, &r0, &r1);
             regs[r0] = (int16_t)regs[r1];
             break;
 #endif
 #if TCG_TARGET_HAS_ext8u_i32 || TCG_TARGET_HAS_ext8u_i64
         CASE_32_64(ext8u)
-            tci_args_rr(&tb_ptr, &r0, &r1);
+            tci_args_rr(insn, &r0, &r1);
             regs[r0] = (uint8_t)regs[r1];
             break;
 #endif
 #if TCG_TARGET_HAS_ext16u_i32 || TCG_TARGET_HAS_ext16u_i64
         CASE_32_64(ext16u)
-            tci_args_rr(&tb_ptr, &r0, &r1);
+            tci_args_rr(insn, &r0, &r1);
             regs[r0] = (uint16_t)regs[r1];
             break;
 #endif
 #if TCG_TARGET_HAS_bswap16_i32 || TCG_TARGET_HAS_bswap16_i64
         CASE_32_64(bswap16)
-            tci_args_rr(&tb_ptr, &r0, &r1);
+            tci_args_rr(insn, &r0, &r1);
             regs[r0] = bswap16(regs[r1]);
             break;
 #endif
 #if TCG_TARGET_HAS_bswap32_i32 || TCG_TARGET_HAS_bswap32_i64
         CASE_32_64(bswap32)
-            tci_args_rr(&tb_ptr, &r0, &r1);
+            tci_args_rr(insn, &r0, &r1);
             regs[r0] = bswap32(regs[r1]);
             break;
 #endif
 #if TCG_TARGET_HAS_not_i32 || TCG_TARGET_HAS_not_i64
         CASE_32_64(not)
-            tci_args_rr(&tb_ptr, &r0, &r1);
+            tci_args_rr(insn, &r0, &r1);
             regs[r0] = ~regs[r1];
             break;
 #endif
 #if TCG_TARGET_HAS_neg_i32 || TCG_TARGET_HAS_neg_i64
         CASE_32_64(neg)
-            tci_args_rr(&tb_ptr, &r0, &r1);
+            tci_args_rr(insn, &r0, &r1);
             regs[r0] = -regs[r1];
             break;
 #endif
 #if TCG_TARGET_REG_BITS == 64
-        case INDEX_op_tci_movi_i64:
-            tci_args_rI(&tb_ptr, &r0, &t1);
-            regs[r0] = t1;
-            break;
-
             /* Load/store operations (64 bit). */
 
         case INDEX_op_ld32s_i64:
-            tci_args_rrs(&tb_ptr, &r0, &r1, &ofs);
+            tci_args_rrs(insn, &r0, &r1, &ofs);
             ptr = (void *)(regs[r1] + ofs);
             regs[r0] = *(int32_t *)ptr;
             break;
         case INDEX_op_ld_i64:
-            tci_args_rrs(&tb_ptr, &r0, &r1, &ofs);
+            tci_args_rrs(insn, &r0, &r1, &ofs);
             ptr = (void *)(regs[r1] + ofs);
             regs[r0] = *(uint64_t *)ptr;
             break;
         case INDEX_op_st_i64:
-            tci_args_rrs(&tb_ptr, &r0, &r1, &ofs);
+            tci_args_rrs(insn, &r0, &r1, &ofs);
             ptr = (void *)(regs[r1] + ofs);
             *(uint64_t *)ptr = regs[r0];
             break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             /* Arithmetic operations (64 bit). */
 
         case INDEX_op_div_i64:
-            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
+            tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (int64_t)regs[r1] / (int64_t)regs[r2];
             break;
         case INDEX_op_divu_i64:
-            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
+            tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (uint64_t)regs[r1] / (uint64_t)regs[r2];
             break;
         case INDEX_op_rem_i64:
-            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
+            tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (int64_t)regs[r1] % (int64_t)regs[r2];
             break;
         case INDEX_op_remu_i64:
-            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
+            tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (uint64_t)regs[r1] % (uint64_t)regs[r2];
             break;
 
             /* Shift/rotate operations (64 bit). */
 
         case INDEX_op_shl_i64:
-            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
+            tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] << (regs[r2] & 63);
             break;
         case INDEX_op_shr_i64:
-            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
+            tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] >> (regs[r2] & 63);
             break;
         case INDEX_op_sar_i64:
-            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
+            tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (int64_t)regs[r1] >> (regs[r2] & 63);
             break;
 #if TCG_TARGET_HAS_rot_i64
         case INDEX_op_rotl_i64:
-            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
+            tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = rol64(regs[r1], regs[r2] & 63);
             break;
         case INDEX_op_rotr_i64:
-            tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
+            tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = ror64(regs[r1], regs[r2] & 63);
             break;
 #endif
 #if TCG_TARGET_HAS_deposit_i64
         case INDEX_op_deposit_i64:
-            tci_args_rrrbb(&tb_ptr, &r0, &r1, &r2, &pos, &len);
+            tci_args_rrrbb(insn, &r0, &r1, &r2, &pos, &len);
             regs[r0] = deposit64(regs[r1], pos, len, regs[r2]);
             break;
 #endif
         case INDEX_op_brcond_i64:
-            tci_args_rl(&tb_ptr, &r0, &ptr);
+            tci_args_rl(insn, tb_ptr, &r0, &ptr);
             if (regs[r0]) {
                 tb_ptr = ptr;
             }
             break;
         case INDEX_op_ext32s_i64:
         case INDEX_op_ext_i32_i64:
-            tci_args_rr(&tb_ptr, &r0, &r1);
+            tci_args_rr(insn, &r0, &r1);
             regs[r0] = (int32_t)regs[r1];
             break;
         case INDEX_op_ext32u_i64:
         case INDEX_op_extu_i32_i64:
-            tci_args_rr(&tb_ptr, &r0, &r1);
+            tci_args_rr(insn, &r0, &r1);
             regs[r0] = (uint32_t)regs[r1];
             break;
 #if TCG_TARGET_HAS_bswap64_i64
         case INDEX_op_bswap64_i64:
-            tci_args_rr(&tb_ptr, &r0, &r1);
+            tci_args_rr(insn, &r0, &r1);
             regs[r0] = bswap64(regs[r1]);
             break;
 #endif
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             /* QEMU specific operations. */
 
         case INDEX_op_exit_tb:
-            tci_args_l(&tb_ptr, &ptr);
+            tci_args_l(insn, tb_ptr, &ptr);
             return (uintptr_t)ptr;
 
         case INDEX_op_goto_tb:
-            tci_args_l(&tb_ptr, &ptr);
+            tci_args_l(insn, tb_ptr, &ptr);
             tb_ptr = *(void **)ptr;
             break;
 
         case INDEX_op_qemu_ld_i32:
             if (TARGET_LONG_BITS <= TCG_TARGET_REG_BITS) {
-                tci_args_rrm(&tb_ptr, &r0, &r1, &oi);
+                tci_args_rrm(insn, &r0, &r1, &oi);
                 taddr = regs[r1];
             } else {
-                tci_args_rrrm(&tb_ptr, &r0, &r1, &r2, &oi);
+                tci_args_rrrm(insn, &r0, &r1, &r2, &oi);
                 taddr = tci_uint64(regs[r2], regs[r1]);
             }
             switch (get_memop(oi) & (MO_BSWAP | MO_SSIZE)) {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
         case INDEX_op_qemu_ld_i64:
             if (TCG_TARGET_REG_BITS == 64) {
-                tci_args_rrm(&tb_ptr, &r0, &r1, &oi);
+                tci_args_rrm(insn, &r0, &r1, &oi);
                 taddr = regs[r1];
             } else if (TARGET_LONG_BITS <= TCG_TARGET_REG_BITS) {
-                tci_args_rrrm(&tb_ptr, &r0, &r1, &r2, &oi);
+                tci_args_rrrm(insn, &r0, &r1, &r2, &oi);
                 taddr = regs[r2];
             } else {
-                tci_args_rrrrm(&tb_ptr, &r0, &r1, &r2, &r3, &oi);
+                tci_args_rrrrr(insn, &r0, &r1, &r2, &r3, &r4);
                 taddr = tci_uint64(regs[r3], regs[r2]);
+                oi = regs[r4];
             }
             switch (get_memop(oi) & (MO_BSWAP | MO_SSIZE)) {
             case MO_UB:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
         case INDEX_op_qemu_st_i32:
             if (TARGET_LONG_BITS <= TCG_TARGET_REG_BITS) {
-                tci_args_rrm(&tb_ptr, &r0, &r1, &oi);
+                tci_args_rrm(insn, &r0, &r1, &oi);
                 taddr = regs[r1];
             } else {
-                tci_args_rrrm(&tb_ptr, &r0, &r1, &r2, &oi);
+                tci_args_rrrm(insn, &r0, &r1, &r2, &oi);
                 taddr = tci_uint64(regs[r2], regs[r1]);
             }
             tmp32 = regs[r0];
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
         case INDEX_op_qemu_st_i64:
             if (TCG_TARGET_REG_BITS == 64) {
-                tci_args_rrm(&tb_ptr, &r0, &r1, &oi);
+                tci_args_rrm(insn, &r0, &r1, &oi);
                 taddr = regs[r1];
                 tmp64 = regs[r0];
             } else {
                 if (TARGET_LONG_BITS <= TCG_TARGET_REG_BITS) {
-                    tci_args_rrrm(&tb_ptr, &r0, &r1, &r2, &oi);
+                    tci_args_rrrm(insn, &r0, &r1, &r2, &oi);
                     taddr = regs[r2];
                 } else {
-                    tci_args_rrrrm(&tb_ptr, &r0, &r1, &r2, &r3, &oi);
+                    tci_args_rrrrr(insn, &r0, &r1, &r2, &r3, &r4);
                     taddr = tci_uint64(regs[r3], regs[r2]);
+                    oi = regs[r4];
                 }
                 tmp64 = tci_uint64(regs[r1], regs[r0]);
             }
@@ -XXX,XX +XXX,XX @@ static const char *str_c(TCGCond c)
 /* Disassemble TCI bytecode. */
 int print_insn_tci(bfd_vma addr, disassemble_info *info)
 {
-    uint8_t buf[256];
-    int length, status;
+    const uint32_t *tb_ptr = (const void *)(uintptr_t)addr;
     const TCGOpDef *def;
     const char *op_name;
+    uint32_t insn;
     TCGOpcode op;
-    TCGReg r0, r1, r2, r3;
+    TCGReg r0, r1, r2, r3, r4;
 #if TCG_TARGET_REG_BITS == 32
-    TCGReg r4, r5;
+    TCGReg r5;
 #endif
     tcg_target_ulong i1;
     int32_t s2;
     TCGCond c;
     TCGMemOpIdx oi;
     uint8_t pos, len;
-    void *ptr, *cif;
-    const uint8_t *tb_ptr;
+    void *ptr;
 
-    status = info->read_memory_func(addr, buf, 2, info);
-    if (status != 0) {
-        info->memory_error_func(status, addr, info);
-        return -1;
-    }
-    op = buf[0];
-    length = buf[1];
+    /* TCI is always the host, so we don't need to load indirect. */
+    insn = *tb_ptr++;
 
-    if (length < 2) {
-        info->fprintf_func(info->stream, "invalid length %d", length);
-        return 1;
-    }
-
-    status = info->read_memory_func(addr + 2, buf + 2, length - 2, info);
-    if (status != 0) {
-        info->memory_error_func(status, addr + 2, info);
-        return -1;
-    }
+    info->fprintf_func(info->stream, "%08x  ", insn);
 
+    op = extract32(insn, 0, 8);
     def = &tcg_op_defs[op];
     op_name = def->name;
-    tb_ptr = buf + 2;
 
     switch (op) {
     case INDEX_op_br:
     case INDEX_op_exit_tb:
     case INDEX_op_goto_tb:
-        tci_args_l(&tb_ptr, &ptr);
+        tci_args_l(insn, tb_ptr, &ptr);
         info->fprintf_func(info->stream, "%-12s  %p", op_name, ptr);
         break;
 
     case INDEX_op_call:
-        tci_args_nll(&tb_ptr, &len, &ptr, &cif);
-        info->fprintf_func(info->stream, "%-12s  %d, %p, %p",
-                           op_name, len, ptr, cif);
+        tci_args_nl(insn, tb_ptr, &len, &ptr);
+        info->fprintf_func(info->stream, "%-12s  %d, %p", op_name, len, ptr);
         break;
 
     case INDEX_op_brcond_i32:
     case INDEX_op_brcond_i64:
-        tci_args_rl(&tb_ptr, &r0, &ptr);
+        tci_args_rl(insn, tb_ptr, &r0, &ptr);
         info->fprintf_func(info->stream, "%-12s  %s, 0, ne, %p",
                            op_name, str_r(r0), ptr);
         break;
 
     case INDEX_op_setcond_i32:
     case INDEX_op_setcond_i64:
-        tci_args_rrrc(&tb_ptr, &r0, &r1, &r2, &c);
+        tci_args_rrrc(insn, &r0, &r1, &r2, &c);
         info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s",
                            op_name, str_r(r0), str_r(r1), str_r(r2), str_c(c));
         break;
 
-    case INDEX_op_tci_movi_i32:
-        tci_args_ri(&tb_ptr, &r0, &i1);
+    case INDEX_op_tci_movi:
+        tci_args_ri(insn, &r0, &i1);
         info->fprintf_func(info->stream, "%-12s  %s, 0x%" TCG_PRIlx,
                            op_name, str_r(r0), i1);
         break;
 
-#if TCG_TARGET_REG_BITS == 64
-    case INDEX_op_tci_movi_i64:
-        tci_args_rI(&tb_ptr, &r0, &i1);
-        info->fprintf_func(info->stream, "%-12s  %s, 0x%" TCG_PRIlx,
-                           op_name, str_r(r0), i1);
+    case INDEX_op_tci_movl:
+        tci_args_rl(insn, tb_ptr, &r0, &ptr);
+        info->fprintf_func(info->stream, "%-12s  %s, %p",
+                           op_name, str_r(r0), ptr);
         break;
-#endif
 
     case INDEX_op_ld8u_i32:
     case INDEX_op_ld8u_i64:
@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_st32_i64:
     case INDEX_op_st_i32:
     case INDEX_op_st_i64:
-        tci_args_rrs(&tb_ptr, &r0, &r1, &s2);
+        tci_args_rrs(insn, &r0, &r1, &s2);
         info->fprintf_func(info->stream, "%-12s  %s, %s, %d",
                            op_name, str_r(r0), str_r(r1), s2);
         break;
@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_not_i64:
     case INDEX_op_neg_i32:
     case INDEX_op_neg_i64:
-        tci_args_rr(&tb_ptr, &r0, &r1);
+        tci_args_rr(insn, &r0, &r1);
         info->fprintf_func(info->stream, "%-12s  %s, %s",
                            op_name, str_r(r0), str_r(r1));
         break;
@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_rotl_i64:
     case INDEX_op_rotr_i32:
     case INDEX_op_rotr_i64:
-        tci_args_rrr(&tb_ptr, &r0, &r1, &r2);
+        tci_args_rrr(insn, &r0, &r1, &r2);
         info->fprintf_func(info->stream, "%-12s  %s, %s, %s",
                            op_name, str_r(r0), str_r(r1), str_r(r2));
         break;
 
     case INDEX_op_deposit_i32:
     case INDEX_op_deposit_i64:
-        tci_args_rrrbb(&tb_ptr, &r0, &r1, &r2, &pos, &len);
+        tci_args_rrrbb(insn, &r0, &r1, &r2, &pos, &len);
         info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %d, %d",
                            op_name, str_r(r0), str_r(r1), str_r(r2), pos, len);
         break;
 
 #if TCG_TARGET_REG_BITS == 32
     case INDEX_op_setcond2_i32:
-        tci_args_rrrrrc(&tb_ptr, &r0, &r1, &r2, &r3, &r4, &c);
+        tci_args_rrrrrc(insn, &r0, &r1, &r2, &r3, &r4, &c);
         info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s, %s, %s",
                            op_name, str_r(r0), str_r(r1), str_r(r2),
                            str_r(r3), str_r(r4), str_c(c));
         break;
 
     case INDEX_op_mulu2_i32:
-        tci_args_rrrr(&tb_ptr, &r0, &r1, &r2, &r3);
+        tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
         info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s",
                            op_name, str_r(r0), str_r(r1),
                            str_r(r2), str_r(r3));
@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
 
     case INDEX_op_add2_i32:
     case INDEX_op_sub2_i32:
-        tci_args_rrrrrr(&tb_ptr, &r0, &r1, &r2, &r3, &r4, &r5);
+        tci_args_rrrrrr(insn, &r0, &r1, &r2, &r3, &r4, &r5);
         info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s, %s, %s",
                            op_name, str_r(r0), str_r(r1), str_r(r2),
                            str_r(r3), str_r(r4), str_r(r5));
@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
         len += DIV_ROUND_UP(TARGET_LONG_BITS, TCG_TARGET_REG_BITS);
         switch (len) {
         case 2:
-            tci_args_rrm(&tb_ptr, &r0, &r1, &oi);
+            tci_args_rrm(insn, &r0, &r1, &oi);
             info->fprintf_func(info->stream, "%-12s  %s, %s, %x",
                                op_name, str_r(r0), str_r(r1), oi);
             break;
         case 3:
-            tci_args_rrrm(&tb_ptr, &r0, &r1, &r2, &oi);
+            tci_args_rrrm(insn, &r0, &r1, &r2, &oi);
             info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %x",
                                op_name, str_r(r0), str_r(r1), str_r(r2), oi);
             break;
         case 4:
-            tci_args_rrrrm(&tb_ptr, &r0, &r1, &r2, &r3, &oi);
-            info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s, %x",
+            tci_args_rrrrr(insn, &r0, &r1, &r2, &r3, &r4);
+            info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s, %s",
                                op_name, str_r(r0), str_r(r1),
-                               str_r(r2), str_r(r3), oi);
+                               str_r(r2), str_r(r3), str_r(r4));
             break;
         default:
             g_assert_not_reached();
         }
         break;
 
+    case 0:
+        /* tcg_out_nop_fill uses zeros */
+        if (insn == 0) {
+            info->fprintf_func(info->stream, "align");
+            break;
+        }
+        /* fall through */
+
     default:
         info->fprintf_func(info->stream, "illegal opcode %d", op);
         break;
     }
 
-    return length;
+    return sizeof(insn);
 }
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@
  * THE SOFTWARE.
  */
 
-/* TODO list:
- * - See TODO comments in code.
- */
-
-/* Marker for missing code. */
-#define TODO() \
-    do { \
-        fprintf(stderr, "TODO %s:%u: %s()\n", \
-                __FILE__, __LINE__, __func__); \
-        tcg_abort(); \
-    } while (0)
-
-/* Bitfield n...m (in 32 bit value). */
-#define BITS(n, m) (((0xffffffffU << (31 - n)) >> (31 - n + m)) << m)
+#include "../tcg-pool.c.inc"
 
 static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
 {
@@ -XXX,XX +XXX,XX @@ static const char *const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
 static bool patch_reloc(tcg_insn_unit *code_ptr, int type,
                         intptr_t value, intptr_t addend)
 {
-    /* tcg_out_reloc always uses the same type, addend. */
-    tcg_debug_assert(type == sizeof(tcg_target_long));
+    intptr_t diff = value - (intptr_t)(code_ptr + 1);
+
     tcg_debug_assert(addend == 0);
-    tcg_debug_assert(value != 0);
-    if (TCG_TARGET_REG_BITS == 32) {
-        tcg_patch32(code_ptr, value);
-    } else {
-        tcg_patch64(code_ptr, value);
-    }
-    return true;
-}
-
-/* Write value (native size). */
-static void tcg_out_i(TCGContext *s, tcg_target_ulong v)
-{
-    if (TCG_TARGET_REG_BITS == 32) {
-        tcg_out32(s, v);
-    } else {
-        tcg_out64(s, v);
-    }
-}
-
-/* Write opcode. */
-static void tcg_out_op_t(TCGContext *s, TCGOpcode op)
-{
-    tcg_out8(s, op);
-    tcg_out8(s, 0);
-}
-
-/* Write register. */
-static void tcg_out_r(TCGContext *s, TCGArg t0)
-{
-    tcg_debug_assert(t0 < TCG_TARGET_NB_REGS);
-    tcg_out8(s, t0);
-}
-
-/* Write label. */
-static void tci_out_label(TCGContext *s, TCGLabel *label)
-{
-    if (label->has_value) {
-        tcg_out_i(s, label->u.value);
-        tcg_debug_assert(label->u.value);
-    } else {
-        tcg_out_reloc(s, s->code_ptr, sizeof(tcg_target_ulong), label, 0);
-        s->code_ptr += sizeof(tcg_target_ulong);
+    tcg_debug_assert(type == 20);
+
+    if (diff == sextract32(diff, 0, type)) {
+        tcg_patch32(code_ptr, deposit32(*code_ptr, 32 - type, type, diff));
+        return true;
     }
+    return false;
 }
 
 static void stack_bounds_check(TCGReg base, target_long offset)
@@ -XXX,XX +XXX,XX @@ static void stack_bounds_check(TCGReg base, target_long offset)
 
 static void tcg_out_op_l(TCGContext *s, TCGOpcode op, TCGLabel *l0)
 {
-    uint8_t *old_code_ptr = s->code_ptr;
+    tcg_insn_unit insn = 0;
 
-    tcg_out_op_t(s, op);
-    tci_out_label(s, l0);
-
-    old_code_ptr[1] = s->code_ptr - old_code_ptr;
+    tcg_out_reloc(s, s->code_ptr, 20, l0, 0);
+    insn = deposit32(insn, 0, 8, op);
+    tcg_out32(s, insn);
 }
 
 static void tcg_out_op_p(TCGContext *s, TCGOpcode op, void *p0)
 {
-    uint8_t *old_code_ptr = s->code_ptr;
+    tcg_insn_unit insn = 0;
+    intptr_t diff;
 
-    tcg_out_op_t(s, op);
-    tcg_out_i(s, (uintptr_t)p0);
-
-    old_code_ptr[1] = s->code_ptr - old_code_ptr;
+    /* Special case for exit_tb: map null -> 0. */
+    if (p0 == NULL) {
+        diff = 0;
+    } else {
+        diff = p0 - (void *)(s->code_ptr + 1);
+        tcg_debug_assert(diff != 0);
+        if (diff != sextract32(diff, 0, 20)) {
+            tcg_raise_tb_overflow(s);
+        }
+    }
+    insn = deposit32(insn, 0, 8, op);
+    insn = deposit32(insn, 12, 20, diff);
+    tcg_out32(s, insn);
 }
 
 static void tcg_out_op_v(TCGContext *s, TCGOpcode op)
 {
-    uint8_t *old_code_ptr = s->code_ptr;
-
-    tcg_out_op_t(s, op);
-
-    old_code_ptr[1] = s->code_ptr - old_code_ptr;
+    tcg_out32(s, (uint8_t)op);
 }
 
 static void tcg_out_op_ri(TCGContext *s, TCGOpcode op, TCGReg r0, int32_t i1)
 {
-    uint8_t *old_code_ptr = s->code_ptr;
+    tcg_insn_unit insn = 0;
 
-    tcg_out_op_t(s, op);
-    tcg_out_r(s, r0);
-    tcg_out32(s, i1);
-
-    old_code_ptr[1] = s->code_ptr - old_code_ptr;
+    tcg_debug_assert(i1 == sextract32(i1, 0, 20));
+    insn = deposit32(insn, 0, 8, op);
+    insn = deposit32(insn, 8, 4, r0);
+    insn = deposit32(insn, 12, 20, i1);
+    tcg_out32(s, insn);
 }
 
-#if TCG_TARGET_REG_BITS == 64
-static void tcg_out_op_rI(TCGContext *s, TCGOpcode op,
-                          TCGReg r0, uint64_t i1)
-{
-    uint8_t *old_code_ptr = s->code_ptr;
-
-    tcg_out_op_t(s, op);
-    tcg_out_r(s, r0);
-    tcg_out64(s, i1);
-
-    old_code_ptr[1] = s->code_ptr - old_code_ptr;
-}
-#endif
-
 static void tcg_out_op_rl(TCGContext *s, TCGOpcode op, TCGReg r0, TCGLabel *l1)
 {
-    uint8_t *old_code_ptr = s->code_ptr;
+    tcg_insn_unit insn = 0;
 
-    tcg_out_op_t(s, op);
-    tcg_out_r(s, r0);
-    tci_out_label(s, l1);
-
-    old_code_ptr[1] = s->code_ptr - old_code_ptr;
+    tcg_out_reloc(s, s->code_ptr, 20, l1, 0);
+    insn = deposit32(insn, 0, 8, op);
+    insn = deposit32(insn, 8, 4, r0);
+    tcg_out32(s, insn);
 }
 
 static void tcg_out_op_rr(TCGContext *s, TCGOpcode op, TCGReg r0, TCGReg r1)
 {
-    uint8_t *old_code_ptr = s->code_ptr;
+    tcg_insn_unit insn = 0;
 
-    tcg_out_op_t(s, op);
-    tcg_out_r(s, r0);
-    tcg_out_r(s, r1);
-
-    old_code_ptr[1] = s->code_ptr - old_code_ptr;
+    insn = deposit32(insn, 0, 8, op);
+    insn = deposit32(insn, 8, 4, r0);
+    insn = deposit32(insn, 12, 4, r1);
+    tcg_out32(s, insn);
 }
 
 static void tcg_out_op_rrm(TCGContext *s, TCGOpcode op,
                            TCGReg r0, TCGReg r1, TCGArg m2)
 {
-    uint8_t *old_code_ptr = s->code_ptr;
+    tcg_insn_unit insn = 0;
 
-    tcg_out_op_t(s, op);
-    tcg_out_r(s, r0);
-    tcg_out_r(s, r1);
-    tcg_out32(s, m2);
-
-    old_code_ptr[1] = s->code_ptr - old_code_ptr;
+    tcg_debug_assert(m2 == extract32(m2, 0, 12));
+    insn = deposit32(insn, 0, 8, op);
+    insn = deposit32(insn, 8, 4, r0);
+    insn = deposit32(insn, 12, 4, r1);
+    insn = deposit32(insn, 20, 12, m2);
+    tcg_out32(s, insn);
 }
 
 static void tcg_out_op_rrr(TCGContext *s, TCGOpcode op,
                            TCGReg r0, TCGReg r1, TCGReg r2)
 {
-    uint8_t *old_code_ptr = s->code_ptr;
+    tcg_insn_unit insn = 0;
 
-    tcg_out_op_t(s, op);
-    tcg_out_r(s, r0);
-    tcg_out_r(s, r1);
-    tcg_out_r(s, r2);
-
-    old_code_ptr[1] = s->code_ptr - old_code_ptr;
+    insn = deposit32(insn, 0, 8, op);
+    insn = deposit32(insn, 8, 4, r0);
+    insn = deposit32(insn, 12, 4, r1);
+    insn = deposit32(insn, 16, 4, r2);
+    tcg_out32(s, insn);
 }
 
 static void tcg_out_op_rrs(TCGContext *s, TCGOpcode op,
                            TCGReg r0, TCGReg r1, intptr_t i2)
 {
-    uint8_t *old_code_ptr = s->code_ptr;
+    tcg_insn_unit insn = 0;
 
-    tcg_out_op_t(s, op);
-    tcg_out_r(s, r0);
-    tcg_out_r(s, r1);
-    tcg_debug_assert(i2 == (int32_t)i2);
-    tcg_out32(s, i2);
-
-    old_code_ptr[1] = s->code_ptr - old_code_ptr;
+    tcg_debug_assert(i2 == sextract32(i2, 0, 16));
+    insn = deposit32(insn, 0, 8, op);
+    insn = deposit32(insn, 8, 4, r0);
+    insn = deposit32(insn, 12, 4, r1);
+    insn = deposit32(insn, 16, 16, i2);
+    tcg_out32(s, insn);
 }
 
 static void tcg_out_op_rrrc(TCGContext *s, TCGOpcode op,
                             TCGReg r0, TCGReg r1, TCGReg r2, TCGCond c3)
 {
-    uint8_t *old_code_ptr = s->code_ptr;
+    tcg_insn_unit insn = 0;
 
-    tcg_out_op_t(s, op);
-    tcg_out_r(s, r0);
-    tcg_out_r(s, r1);
-    tcg_out_r(s, r2);
-    tcg_out8(s, c3);
-
-    old_code_ptr[1] = s->code_ptr - old_code_ptr;
+    insn = deposit32(insn, 0, 8, op);
+    insn = deposit32(insn, 8, 4, r0);
+    insn = deposit32(insn, 12, 4, r1);
+    insn = deposit32(insn, 16, 4, r2);
+    insn = deposit32(insn, 20, 4, c3);
+    tcg_out32(s, insn);
 }
 
 static void tcg_out_op_rrrm(TCGContext *s, TCGOpcode op,
                             TCGReg r0, TCGReg r1, TCGReg r2, TCGArg m3)
 {
-    uint8_t *old_code_ptr = s->code_ptr;
+    tcg_insn_unit insn = 0;
 
-    tcg_out_op_t(s, op);
-    tcg_out_r(s, r0);
-    tcg_out_r(s, r1);
-    tcg_out_r(s, r2);
-    tcg_out32(s, m3);
-
-    old_code_ptr[1] = s->code_ptr - old_code_ptr;
+    tcg_debug_assert(m3 == extract32(m3, 0, 12));
+    insn = deposit32(insn, 0, 8, op);
+    insn = deposit32(insn, 8, 4, r0);
+    insn = deposit32(insn, 12, 4, r1);
+    insn = deposit32(insn, 16, 4, r2);
+    insn = deposit32(insn, 20, 12, m3);
+    tcg_out32(s, insn);
 }
 
 static void tcg_out_op_rrrbb(TCGContext *s, TCGOpcode op, TCGReg r0,
                              TCGReg r1, TCGReg r2, uint8_t b3, uint8_t b4)
 {
-    uint8_t *old_code_ptr = s->code_ptr;
+    tcg_insn_unit insn = 0;
 
-    tcg_out_op_t(s, op);
-    tcg_out_r(s, r0);
-    tcg_out_r(s, r1);
-    tcg_out_r(s, r2);
-    tcg_out8(s, b3);
-    tcg_out8(s, b4);
-
-    old_code_ptr[1] = s->code_ptr - old_code_ptr;
+    tcg_debug_assert(b3 == extract32(b3, 0, 6));
+    tcg_debug_assert(b4 == extract32(b4, 0, 6));
+    insn = deposit32(insn, 0, 8, op);
+    insn = deposit32(insn, 8, 4, r0);
+    insn = deposit32(insn, 12, 4, r1);
+    insn = deposit32(insn, 16, 4, r2);
+    insn = deposit32(insn, 20, 6, b3);
+    insn = deposit32(insn, 26, 6, b4);
+    tcg_out32(s, insn);
 }
 
-static void tcg_out_op_rrrrm(TCGContext *s, TCGOpcode op, TCGReg r0,
-                             TCGReg r1, TCGReg r2, TCGReg r3, TCGArg m4)
+static void tcg_out_op_rrrrr(TCGContext *s, TCGOpcode op, TCGReg r0,
+                             TCGReg r1, TCGReg r2, TCGReg r3, TCGReg r4)
 {
-    uint8_t *old_code_ptr = s->code_ptr;
+    tcg_insn_unit insn = 0;
 
-    tcg_out_op_t(s, op);
-    tcg_out_r(s, r0);
-    tcg_out_r(s, r1);
-    tcg_out_r(s, r2);
-    tcg_out_r(s, r3);
-    tcg_out32(s, m4);
-
-    old_code_ptr[1] = s->code_ptr - old_code_ptr;
+    insn = deposit32(insn, 0, 8, op);
+    insn = deposit32(insn, 8, 4, r0);
+    insn = deposit32(insn, 12, 4, r1);
+    insn = deposit32(insn, 16, 4, r2);
+    insn = deposit32(insn, 20, 4, r3);
+    insn = deposit32(insn, 24, 4, r4);
+    tcg_out32(s, insn);
 }
 
 #if TCG_TARGET_REG_BITS == 32
 static void tcg_out_op_rrrr(TCGContext *s, TCGOpcode op,
                             TCGReg r0, TCGReg r1, TCGReg r2, TCGReg r3)
 {
-    uint8_t *old_code_ptr = s->code_ptr;
+    tcg_insn_unit insn = 0;
 
-    tcg_out_op_t(s, op);
-    tcg_out_r(s, r0);
-    tcg_out_r(s, r1);
-    tcg_out_r(s, r2);
-    tcg_out_r(s, r3);
-
-    old_code_ptr[1] = s->code_ptr - old_code_ptr;
+    insn = deposit32(insn, 0, 8, op);
+    insn = deposit32(insn, 8, 4, r0);
+    insn = deposit32(insn, 12, 4, r1);
+    insn = deposit32(insn, 16, 4, r2);
+    insn = deposit32(insn, 20, 4, r3);
+    tcg_out32(s, insn);
 }
 
 static void tcg_out_op_rrrrrc(TCGContext *s, TCGOpcode op,
                               TCGReg r0, TCGReg r1, TCGReg r2,
                               TCGReg r3, TCGReg r4, TCGCond c5)
 {
-    uint8_t *old_code_ptr = s->code_ptr;
+    tcg_insn_unit insn = 0;
 
-    tcg_out_op_t(s, op);
-    tcg_out_r(s, r0);
-    tcg_out_r(s, r1);
-    tcg_out_r(s, r2);
-    tcg_out_r(s, r3);
-    tcg_out_r(s, r4);
-    tcg_out8(s, c5);
-
-    old_code_ptr[1] = s->code_ptr - old_code_ptr;
+    insn = deposit32(insn, 0, 8, op);
+    insn = deposit32(insn, 8, 4, r0);
+    insn = deposit32(insn, 12, 4, r1);
+    insn = deposit32(insn, 16, 4, r2);
+    insn = deposit32(insn, 20, 4, r3);
+    insn = deposit32(insn, 24, 4, r4);
+    insn = deposit32(insn, 28, 4, c5);
+    tcg_out32(s, insn);
 }
 
 static void tcg_out_op_rrrrrr(TCGContext *s, TCGOpcode op,
                               TCGReg r0, TCGReg r1, TCGReg r2,
                               TCGReg r3, TCGReg r4, TCGReg r5)
 {
-    uint8_t *old_code_ptr = s->code_ptr;
+    tcg_insn_unit insn = 0;
 
-    tcg_out_op_t(s, op);
-    tcg_out_r(s, r0);
-    tcg_out_r(s, r1);
-    tcg_out_r(s, r2);
-    tcg_out_r(s, r3);
-    tcg_out_r(s, r4);
-    tcg_out_r(s, r5);
-
-    old_code_ptr[1] = s->code_ptr - old_code_ptr;
+    insn = deposit32(insn, 0, 8, op);
+    insn = deposit32(insn, 8, 4, r0);
+    insn = deposit32(insn, 12, 4, r1);
+    insn = deposit32(insn, 16, 4, r2);
+    insn = deposit32(insn, 20, 4, r3);
+    insn = deposit32(insn, 24, 4, r4);
+    insn = deposit32(insn, 28, 4, r5);
+    tcg_out32(s, insn);
 }
 #endif
 
+static void tcg_out_ldst(TCGContext *s, TCGOpcode op, TCGReg val,
+                         TCGReg base, intptr_t offset)
+{
+    stack_bounds_check(base, offset);
+    if (offset != sextract32(offset, 0, 16)) {
+        tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_TMP, offset);
+        tcg_out_op_rrr(s, (TCG_TARGET_REG_BITS == 32
+                           ? INDEX_op_add_i32 : INDEX_op_add_i64),
+                       TCG_REG_TMP, TCG_REG_TMP, base);
+        base = TCG_REG_TMP;
+        offset = 0;
+    }
+    tcg_out_op_rrs(s, op, val, base, offset);
+}
+
 static void tcg_out_ld(TCGContext *s, TCGType type, TCGReg val, TCGReg base,
                        intptr_t offset)
 {
-    stack_bounds_check(base, offset);
     switch (type) {
     case TCG_TYPE_I32:
-        tcg_out_op_rrs(s, INDEX_op_ld_i32, val, base, offset);
+        tcg_out_ldst(s, INDEX_op_ld_i32, val, base, offset);
         break;
 #if TCG_TARGET_REG_BITS == 64
     case TCG_TYPE_I64:
-        tcg_out_op_rrs(s, INDEX_op_ld_i64, val, base, offset);
+        tcg_out_ldst(s, INDEX_op_ld_i64, val, base, offset);
         break;
 #endif
     default:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi(TCGContext *s, TCGType type,
 {
     switch (type) {
     case TCG_TYPE_I32:
-        tcg_out_op_ri(s, INDEX_op_tci_movi_i32, ret, arg);
-        break;
 #if TCG_TARGET_REG_BITS == 64
+        arg = (int32_t)arg;
+        /* fall through */
     case TCG_TYPE_I64:
-        tcg_out_op_rI(s, INDEX_op_tci_movi_i64, ret, arg);
-        break;
 #endif
+        break;
     default:
         g_assert_not_reached();
     }
+
+    if (arg == sextract32(arg, 0, 20)) {
+        tcg_out_op_ri(s, INDEX_op_tci_movi, ret, arg);
+    } else {
+        tcg_insn_unit insn = 0;
+
+        new_pool_label(s, arg, 20, s->code_ptr, 0);
+        insn = deposit32(insn, 0, 8, INDEX_op_tci_movl);
+        insn = deposit32(insn, 8, 4, ret);
+        tcg_out32(s, insn);
+    }
 }
 
 static void tcg_out_call(TCGContext *s, const tcg_insn_unit *func,
                          ffi_cif *cif)
 {
-    uint8_t *old_code_ptr = s->code_ptr;
+    tcg_insn_unit insn = 0;
     uint8_t which;
 
     if (cif->rtype == &ffi_type_void) {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_call(TCGContext *s, const tcg_insn_unit *func,
         tcg_debug_assert(cif->rtype->size == 8);
         which = 2;
     }
-    tcg_out_op_t(s, INDEX_op_call);
-    tcg_out8(s, which);
-    tcg_out_i(s, (uintptr_t)func);
-    tcg_out_i(s, (uintptr_t)cif);
-
-    old_code_ptr[1] = s->code_ptr - old_code_ptr;
+    new_pool_l2(s, 20, s->code_ptr, 0, (uintptr_t)func, (uintptr_t)cif);
+    insn = deposit32(insn, 0, 8, INDEX_op_call);
+    insn = deposit32(insn, 8, 4, which);
+    tcg_out32(s, insn);
 }
 
 #if TCG_TARGET_REG_BITS == 64
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_st_i32:
     CASE_64(st32)
     CASE_64(st)
-        stack_bounds_check(args[1], args[2]);
-        tcg_out_op_rrs(s, opc, args[0], args[1], args[2]);
+        tcg_out_ldst(s, opc, args[0], args[1], args[2]);
         break;
 
     CASE_32_64(add)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         } else if (TARGET_LONG_BITS <= TCG_TARGET_REG_BITS) {
             tcg_out_op_rrrm(s, opc, args[0], args[1], args[2], args[3]);
         } else {
-            tcg_out_op_rrrrm(s, opc, args[0], args[1],
-                             args[2], args[3], args[4]);
+            tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_TMP, args[4]);
+            tcg_out_op_rrrrr(s, opc, args[0], args[1],
+                             args[2], args[3], TCG_REG_TMP);
         }
         break;
 
@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
     return ct & TCG_CT_CONST;
 }
 
+static void tcg_out_nop_fill(tcg_insn_unit *p, int count)
+{
+    memset(p, 0, sizeof(*p) * count);
+}
+
 static void tcg_target_init(TCGContext *s)
 {
 #if defined(CONFIG_DEBUG_TCG_INTERPRETER)
diff --git a/tcg/tci/README b/tcg/tci/README
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/README
+++ b/tcg/tci/README
@@ -XXX,XX +XXX,XX @@ This is what TCI (Tiny Code Interpreter) does.
 Like each TCG host frontend, TCI implements the code generator in
 tcg-target.c.inc, tcg-target.h. Both files are in directory tcg/tci.
 
-The additional file tcg/tci.c adds the interpreter.
+The additional file tcg/tci.c adds the interpreter and disassembler.
 
-The bytecode consists of opcodes (same numeric values as those used by
-TCG), command length and arguments of variable size and number.
+The bytecode consists of opcodes (with only a few exceptions, with
+the same same numeric values and semantics as used by TCG), and up
+to six arguments packed into a 32-bit integer.  See comments in tci.c
+for details on the encoding.
 
 3) Usage
 
@@ -XXX,XX +XXX,XX @@ suggest using this option. Setting it automatically would need
 additional code in configure which must be fixed when new native TCG
 implementations are added.
 
-System emulation should work on any 32 or 64 bit host.
-User mode emulation might work. Maybe a new linker script (*.ld)
-is needed. Byte order might be wrong (on big endian hosts)
-and need fixes in configure.
-
 For hosts with native TCG, the interpreter TCI can be enabled by
 
         configure --enable-tcg-interpreter
@@ -XXX,XX +XXX,XX @@ u1 = linux-user-test works
   in the interpreter. These opcodes raise a runtime exception, so it is
   possible to see where code must be added.
 
-* The pseudo code is not optimized and still ugly. For hosts with special
-  alignment requirements, it needs some fixes (maybe aligned bytecode
-  would also improve speed for hosts which support byte alignment).
-
-* A better disassembler for the pseudo code would be nice (a very primitive
-  disassembler is included in tcg-target.c.inc).
-
 * It might be useful to have a runtime option which selects the native TCG
   or TCI, so QEMU would have to include two TCGs. Today, selecting TCI
   is a configure option, so you need two compilations of QEMU.
-- 
2.25.1

This operation is critical to staying within the interpretation
loop longer, which avoids the overhead of setup and teardown for
many TBs.

The check in tcg_prologue_init is disabled because TCI does
want to use NULL to indicate exit, as opposed to branching to
a real epilogue.

Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci/tcg-target-con-set.h |  1 +
 tcg/tci/tcg-target.h         |  2 +-
 tcg/tcg.c                    |  8 +++++++-
 tcg/tci.c                    | 19 +++++++++++++++++++
 tcg/tci/tcg-target.c.inc     | 16 ++++++++++++++++
 5 files changed, 44 insertions(+), 2 deletions(-)

diff --git a/tcg/tci/tcg-target-con-set.h b/tcg/tci/tcg-target-con-set.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target-con-set.h
+++ b/tcg/tci/tcg-target-con-set.h
@@ -XXX,XX +XXX,XX @@
  * Each operand should be a sequence of constraint letters as defined by
  * tcg-target-con-str.h; the constraint combination is inclusive or.
  */
+C_O0_I1(r)
 C_O0_I2(r, r)
 C_O0_I3(r, r, r)
 C_O0_I4(r, r, r, r)
diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.h
+++ b/tcg/tci/tcg-target.h
@@ -XXX,XX +XXX,XX @@
 #define TCG_TARGET_HAS_muls2_i32        0
 #define TCG_TARGET_HAS_muluh_i32        0
 #define TCG_TARGET_HAS_mulsh_i32        0
-#define TCG_TARGET_HAS_goto_ptr         0
+#define TCG_TARGET_HAS_goto_ptr         1
 #define TCG_TARGET_HAS_direct_jump      0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ void tcg_prologue_init(TCGContext *s)
     }
 #endif
 
-    /* Assert that goto_ptr is implemented completely.  */
+#ifndef CONFIG_TCG_INTERPRETER
+    /*
+     * Assert that goto_ptr is implemented completely, setting an epilogue.
+     * For tci, we use NULL as the signal to return from the interpreter,
+     * so skip this check.
+     */
     if (TCG_TARGET_HAS_goto_ptr) {
         tcg_debug_assert(tcg_code_gen_epilogue != NULL);
     }
+#endif
 }
 
 void tcg_func_start(TCGContext *s)
diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ static void tci_args_l(uint32_t insn, const void *tb_ptr, void **l0)
     *l0 = diff ? (void *)tb_ptr + diff : NULL;
 }
 
+static void tci_args_r(uint32_t insn, TCGReg *r0)
+{
+    *r0 = extract32(insn, 8, 4);
+}
+
 static void tci_args_nl(uint32_t insn, const void *tb_ptr,
                         uint8_t *n0, void **l1)
 {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tb_ptr = *(void **)ptr;
             break;
 
+        case INDEX_op_goto_ptr:
+            tci_args_r(insn, &r0);
+            ptr = (void *)regs[r0];
+            if (!ptr) {
+                return 0;
+            }
+            tb_ptr = ptr;
+            break;
+
         case INDEX_op_qemu_ld_i32:
             if (TARGET_LONG_BITS <= TCG_TARGET_REG_BITS) {
                 tci_args_rrm(insn, &r0, &r1, &oi);
@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
         info->fprintf_func(info->stream, "%-12s  %p", op_name, ptr);
         break;
 
+    case INDEX_op_goto_ptr:
+        tci_args_r(insn, &r0);
+        info->fprintf_func(info->stream, "%-12s  %s", op_name, str_r(r0));
+        break;
+
     case INDEX_op_call:
         tci_args_nl(insn, tb_ptr, &len, &ptr);
         info->fprintf_func(info->stream, "%-12s  %d, %p", op_name, len, ptr);
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@
 static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
 {
     switch (op) {
+    case INDEX_op_goto_ptr:
+        return C_O0_I1(r);
+
     case INDEX_op_ld8u_i32:
     case INDEX_op_ld8s_i32:
     case INDEX_op_ld16u_i32:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op_p(TCGContext *s, TCGOpcode op, void *p0)
     tcg_out32(s, insn);
 }
 
+static void tcg_out_op_r(TCGContext *s, TCGOpcode op, TCGReg r0)
+{
+    tcg_insn_unit insn = 0;
+
+    insn = deposit32(insn, 0, 8, op);
+    insn = deposit32(insn, 8, 4, r0);
+    tcg_out32(s, insn);
+}
+
 static void tcg_out_op_v(TCGContext *s, TCGOpcode op)
 {
     tcg_out32(s, (uint8_t)op);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         set_jmp_reset_offset(s, args[0]);
         break;
 
+    case INDEX_op_goto_ptr:
+        tcg_out_op_r(s, opc, args[0]);
+        break;
+
     case INDEX_op_br:
         tcg_out_op_l(s, opc, arg_label(args[0]));
         break;
-- 
2.25.1

When this opcode is not available in the backend, tcg middle-end
will expand this as a series of 5 opcodes.  So implementing this
saves bytecode space.

Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci/tcg-target.h     |  4 ++--
 tcg/tci.c                | 16 +++++++++++++++-
 tcg/tci/tcg-target.c.inc | 10 +++++++---
 3 files changed, 24 insertions(+), 6 deletions(-)

diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.h
+++ b/tcg/tci/tcg-target.h
@@ -XXX,XX +XXX,XX @@
 #define TCG_TARGET_HAS_not_i32          1
 #define TCG_TARGET_HAS_orc_i32          0
 #define TCG_TARGET_HAS_rot_i32          1
-#define TCG_TARGET_HAS_movcond_i32      0
+#define TCG_TARGET_HAS_movcond_i32      1
 #define TCG_TARGET_HAS_muls2_i32        0
 #define TCG_TARGET_HAS_muluh_i32        0
 #define TCG_TARGET_HAS_mulsh_i32        0
@@ -XXX,XX +XXX,XX @@
 #define TCG_TARGET_HAS_not_i64          1
 #define TCG_TARGET_HAS_orc_i64          0
 #define TCG_TARGET_HAS_rot_i64          1
-#define TCG_TARGET_HAS_movcond_i64      0
+#define TCG_TARGET_HAS_movcond_i64      1
 #define TCG_TARGET_HAS_muls2_i64        0
 #define TCG_TARGET_HAS_add2_i32         0
 #define TCG_TARGET_HAS_sub2_i32         0
diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ static void tci_args_rrrr(uint32_t insn,
     *r2 = extract32(insn, 16, 4);
     *r3 = extract32(insn, 20, 4);
 }
+#endif
 
 static void tci_args_rrrrrc(uint32_t insn, TCGReg *r0, TCGReg *r1,
                             TCGReg *r2, TCGReg *r3, TCGReg *r4, TCGCond *c5)
@@ -XXX,XX +XXX,XX @@ static void tci_args_rrrrrc(uint32_t insn, TCGReg *r0, TCGReg *r1,
     *c5 = extract32(insn, 28, 4);
 }
 
+#if TCG_TARGET_REG_BITS == 32
 static void tci_args_rrrrrr(uint32_t insn, TCGReg *r0, TCGReg *r1,
                             TCGReg *r2, TCGReg *r3, TCGReg *r4, TCGReg *r5)
 {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrrc(insn, &r0, &r1, &r2, &condition);
             regs[r0] = tci_compare32(regs[r1], regs[r2], condition);
             break;
+        case INDEX_op_movcond_i32:
+            tci_args_rrrrrc(insn, &r0, &r1, &r2, &r3, &r4, &condition);
+            tmp32 = tci_compare32(regs[r1], regs[r2], condition);
+            regs[r0] = regs[tmp32 ? r3 : r4];
+            break;
 #if TCG_TARGET_REG_BITS == 32
         case INDEX_op_setcond2_i32:
             tci_args_rrrrrc(insn, &r0, &r1, &r2, &r3, &r4, &condition);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrrc(insn, &r0, &r1, &r2, &condition);
             regs[r0] = tci_compare64(regs[r1], regs[r2], condition);
             break;
+        case INDEX_op_movcond_i64:
+            tci_args_rrrrrc(insn, &r0, &r1, &r2, &r3, &r4, &condition);
+            tmp32 = tci_compare64(regs[r1], regs[r2], condition);
+            regs[r0] = regs[tmp32 ? r3 : r4];
+            break;
 #endif
         CASE_32_64(mov)
             tci_args_rr(insn, &r0, &r1);
@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
                            op_name, str_r(r0), str_r(r1), str_r(r2), pos, len);
         break;
 
-#if TCG_TARGET_REG_BITS == 32
+    case INDEX_op_movcond_i32:
+    case INDEX_op_movcond_i64:
     case INDEX_op_setcond2_i32:
         tci_args_rrrrrc(insn, &r0, &r1, &r2, &r3, &r4, &c);
         info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s, %s, %s",
@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
                            str_r(r3), str_r(r4), str_c(c));
         break;
 
+#if TCG_TARGET_REG_BITS == 32
     case INDEX_op_mulu2_i32:
         tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
         info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s",
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
         return C_O0_I4(r, r, r, r);
     case INDEX_op_mulu2_i32:
         return C_O2_I2(r, r, r, r);
+#endif
+
+    case INDEX_op_movcond_i32:
+    case INDEX_op_movcond_i64:
     case INDEX_op_setcond2_i32:
         return C_O1_I4(r, r, r, r, r);
-#endif
 
     case INDEX_op_qemu_ld_i32:
         return (TARGET_LONG_BITS <= TCG_TARGET_REG_BITS
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op_rrrr(TCGContext *s, TCGOpcode op,
     insn = deposit32(insn, 20, 4, r3);
     tcg_out32(s, insn);
 }
+#endif
 
 static void tcg_out_op_rrrrrc(TCGContext *s, TCGOpcode op,
                               TCGReg r0, TCGReg r1, TCGReg r2,
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op_rrrrrc(TCGContext *s, TCGOpcode op,
     tcg_out32(s, insn);
 }
 
+#if TCG_TARGET_REG_BITS == 32
 static void tcg_out_op_rrrrrr(TCGContext *s, TCGOpcode op,
                               TCGReg r0, TCGReg r1, TCGReg r2,
                               TCGReg r3, TCGReg r4, TCGReg r5)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_op_rrrc(s, opc, args[0], args[1], args[2], args[3]);
         break;
 
-#if TCG_TARGET_REG_BITS == 32
+    CASE_32_64(movcond)
     case INDEX_op_setcond2_i32:
         tcg_out_op_rrrrrc(s, opc, args[0], args[1], args[2],
                           args[3], args[4], args[5]);
         break;
-#endif
 
     CASE_32_64(ld8u)
     CASE_32_64(ld8s)
-- 
2.25.1

These were already present in tcg-target.c.inc,
but not in the interpreter.

Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci/tcg-target.h | 20 ++++++++++----------
 tcg/tci.c            | 40 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 50 insertions(+), 10 deletions(-)

Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci/tcg-target.h     |  8 ++++----
 tcg/tci.c                | 42 ++++++++++++++++++++++++++++++++++++++++
 tcg/tci/tcg-target.c.inc | 32 ++++++++++++++++++++++++++++++
 3 files changed, 78 insertions(+), 4 deletions(-)

diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.h
+++ b/tcg/tci/tcg-target.h
@@ -XXX,XX +XXX,XX @@
 #define TCG_TARGET_HAS_ext16u_i32       1
 #define TCG_TARGET_HAS_andc_i32         1
 #define TCG_TARGET_HAS_deposit_i32      1
-#define TCG_TARGET_HAS_extract_i32      0
-#define TCG_TARGET_HAS_sextract_i32     0
+#define TCG_TARGET_HAS_extract_i32      1
+#define TCG_TARGET_HAS_sextract_i32     1
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_eqv_i32          1
 #define TCG_TARGET_HAS_nand_i32         1
@@ -XXX,XX +XXX,XX @@
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_deposit_i64      1
-#define TCG_TARGET_HAS_extract_i64      0
-#define TCG_TARGET_HAS_sextract_i64     0
+#define TCG_TARGET_HAS_extract_i64      1
+#define TCG_TARGET_HAS_sextract_i64     1
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_div_i64          1
 #define TCG_TARGET_HAS_rem_i64          1
diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ static void tci_args_rrs(uint32_t insn, TCGReg *r0, TCGReg *r1, int32_t *i2)
     *i2 = sextract32(insn, 16, 16);
 }
 
+static void tci_args_rrbb(uint32_t insn, TCGReg *r0, TCGReg *r1,
+                          uint8_t *i2, uint8_t *i3)
+{
+    *r0 = extract32(insn, 8, 4);
+    *r1 = extract32(insn, 12, 4);
+    *i2 = extract32(insn, 16, 6);
+    *i3 = extract32(insn, 22, 6);
+}
+
 static void tci_args_rrrc(uint32_t insn,
                           TCGReg *r0, TCGReg *r1, TCGReg *r2, TCGCond *c3)
 {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrrbb(insn, &r0, &r1, &r2, &pos, &len);
             regs[r0] = deposit32(regs[r1], pos, len, regs[r2]);
             break;
+#endif
+#if TCG_TARGET_HAS_extract_i32
+        case INDEX_op_extract_i32:
+            tci_args_rrbb(insn, &r0, &r1, &pos, &len);
+            regs[r0] = extract32(regs[r1], pos, len);
+            break;
+#endif
+#if TCG_TARGET_HAS_sextract_i32
+        case INDEX_op_sextract_i32:
+            tci_args_rrbb(insn, &r0, &r1, &pos, &len);
+            regs[r0] = sextract32(regs[r1], pos, len);
+            break;
 #endif
         case INDEX_op_brcond_i32:
             tci_args_rl(insn, tb_ptr, &r0, &ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrrbb(insn, &r0, &r1, &r2, &pos, &len);
             regs[r0] = deposit64(regs[r1], pos, len, regs[r2]);
             break;
+#endif
+#if TCG_TARGET_HAS_extract_i64
+        case INDEX_op_extract_i64:
+            tci_args_rrbb(insn, &r0, &r1, &pos, &len);
+            regs[r0] = extract64(regs[r1], pos, len);
+            break;
+#endif
+#if TCG_TARGET_HAS_sextract_i64
+        case INDEX_op_sextract_i64:
+            tci_args_rrbb(insn, &r0, &r1, &pos, &len);
+            regs[r0] = sextract64(regs[r1], pos, len);
+            break;
 #endif
         case INDEX_op_brcond_i64:
             tci_args_rl(insn, tb_ptr, &r0, &ptr);
@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
                            op_name, str_r(r0), str_r(r1), str_r(r2), pos, len);
         break;
 
+    case INDEX_op_extract_i32:
+    case INDEX_op_extract_i64:
+    case INDEX_op_sextract_i32:
+    case INDEX_op_sextract_i64:
+        tci_args_rrbb(insn, &r0, &r1, &pos, &len);
+        info->fprintf_func(info->stream, "%-12s  %s,%s,%d,%d",
+                           op_name, str_r(r0), str_r(r1), pos, len);
+        break;
+
     case INDEX_op_movcond_i32:
     case INDEX_op_movcond_i64:
     case INDEX_op_setcond2_i32:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_bswap32_i32:
     case INDEX_op_bswap32_i64:
     case INDEX_op_bswap64_i64:
+    case INDEX_op_extract_i32:
+    case INDEX_op_extract_i64:
+    case INDEX_op_sextract_i32:
+    case INDEX_op_sextract_i64:
         return C_O1_I1(r, r);
 
     case INDEX_op_st8_i32:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op_rrs(TCGContext *s, TCGOpcode op,
     tcg_out32(s, insn);
 }
 
+static void tcg_out_op_rrbb(TCGContext *s, TCGOpcode op, TCGReg r0,
+                            TCGReg r1, uint8_t b2, uint8_t b3)
+{
+    tcg_insn_unit insn = 0;
+
+    tcg_debug_assert(b2 == extract32(b2, 0, 6));
+    tcg_debug_assert(b3 == extract32(b3, 0, 6));
+    insn = deposit32(insn, 0, 8, op);
+    insn = deposit32(insn, 8, 4, r0);
+    insn = deposit32(insn, 12, 4, r1);
+    insn = deposit32(insn, 16, 6, b2);
+    insn = deposit32(insn, 22, 6, b3);
+    tcg_out32(s, insn);
+}
+
 static void tcg_out_op_rrrc(TCGContext *s, TCGOpcode op,
                             TCGReg r0, TCGReg r1, TCGReg r2, TCGCond c3)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         }
         break;
 
+    CASE_32_64(extract)  /* Optional (TCG_TARGET_HAS_extract_*). */
+    CASE_32_64(sextract) /* Optional (TCG_TARGET_HAS_sextract_*). */
+        {
+            TCGArg pos = args[2], len = args[3];
+            TCGArg max = tcg_op_defs[opc].flags & TCG_OPF_64BIT ? 64 : 32;
+
+            tcg_debug_assert(pos < max);
+            tcg_debug_assert(pos + len <= max);
+
+            tcg_out_op_rrbb(s, opc, args[0], args[1], pos, len);
+        }
+        break;
+
     CASE_32_64(brcond)
         tcg_out_op_rrrc(s, (opc == INDEX_op_brcond_i32
                             ? INDEX_op_setcond_i32 : INDEX_op_setcond_i64),
-- 
2.25.1

Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci/tcg-target.h     | 12 +++++------
 tcg/tci.c                | 44 ++++++++++++++++++++++++++++++++++++++++
 tcg/tci/tcg-target.c.inc |  9 ++++++++
 3 files changed, 59 insertions(+), 6 deletions(-)

diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.h
+++ b/tcg/tci/tcg-target.h
@@ -XXX,XX +XXX,XX @@
 #define TCG_TARGET_HAS_eqv_i32          1
 #define TCG_TARGET_HAS_nand_i32         1
 #define TCG_TARGET_HAS_nor_i32          1
-#define TCG_TARGET_HAS_clz_i32          0
-#define TCG_TARGET_HAS_ctz_i32          0
-#define TCG_TARGET_HAS_ctpop_i32        0
+#define TCG_TARGET_HAS_clz_i32          1
+#define TCG_TARGET_HAS_ctz_i32          1
+#define TCG_TARGET_HAS_ctpop_i32        1
 #define TCG_TARGET_HAS_neg_i32          1
 #define TCG_TARGET_HAS_not_i32          1
 #define TCG_TARGET_HAS_orc_i32          1
@@ -XXX,XX +XXX,XX @@
 #define TCG_TARGET_HAS_eqv_i64          1
 #define TCG_TARGET_HAS_nand_i64         1
 #define TCG_TARGET_HAS_nor_i64          1
-#define TCG_TARGET_HAS_clz_i64          0
-#define TCG_TARGET_HAS_ctz_i64          0
-#define TCG_TARGET_HAS_ctpop_i64        0
+#define TCG_TARGET_HAS_clz_i64          1
+#define TCG_TARGET_HAS_ctz_i64          1
+#define TCG_TARGET_HAS_ctpop_i64        1
 #define TCG_TARGET_HAS_neg_i64          1
 #define TCG_TARGET_HAS_not_i64          1
 #define TCG_TARGET_HAS_orc_i64          1
diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (uint32_t)regs[r1] % (uint32_t)regs[r2];
             break;
+#if TCG_TARGET_HAS_clz_i32
+        case INDEX_op_clz_i32:
+            tci_args_rrr(insn, &r0, &r1, &r2);
+            tmp32 = regs[r1];
+            regs[r0] = tmp32 ? clz32(tmp32) : regs[r2];
+            break;
+#endif
+#if TCG_TARGET_HAS_ctz_i32
+        case INDEX_op_ctz_i32:
+            tci_args_rrr(insn, &r0, &r1, &r2);
+            tmp32 = regs[r1];
+            regs[r0] = tmp32 ? ctz32(tmp32) : regs[r2];
+            break;
+#endif
+#if TCG_TARGET_HAS_ctpop_i32
+        case INDEX_op_ctpop_i32:
+            tci_args_rr(insn, &r0, &r1);
+            regs[r0] = ctpop32(regs[r1]);
+            break;
+#endif
 
             /* Shift/rotate operations (32 bit). */
 
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (uint64_t)regs[r1] % (uint64_t)regs[r2];
             break;
+#if TCG_TARGET_HAS_clz_i64
+        case INDEX_op_clz_i64:
+            tci_args_rrr(insn, &r0, &r1, &r2);
+            regs[r0] = regs[r1] ? clz64(regs[r1]) : regs[r2];
+            break;
+#endif
+#if TCG_TARGET_HAS_ctz_i64
+        case INDEX_op_ctz_i64:
+            tci_args_rrr(insn, &r0, &r1, &r2);
+            regs[r0] = regs[r1] ? ctz64(regs[r1]) : regs[r2];
+            break;
+#endif
+#if TCG_TARGET_HAS_ctpop_i64
+        case INDEX_op_ctpop_i64:
+            tci_args_rr(insn, &r0, &r1);
+            regs[r0] = ctpop64(regs[r1]);
+            break;
+#endif
 
             /* Shift/rotate operations (64 bit). */
 
@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_not_i64:
     case INDEX_op_neg_i32:
     case INDEX_op_neg_i64:
+    case INDEX_op_ctpop_i32:
+    case INDEX_op_ctpop_i64:
         tci_args_rr(insn, &r0, &r1);
         info->fprintf_func(info->stream, "%-12s  %s, %s",
                            op_name, str_r(r0), str_r(r1));
@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_rotl_i64:
     case INDEX_op_rotr_i32:
     case INDEX_op_rotr_i64:
+    case INDEX_op_clz_i32:
+    case INDEX_op_clz_i64:
+    case INDEX_op_ctz_i32:
+    case INDEX_op_ctz_i64:
         tci_args_rrr(insn, &r0, &r1, &r2);
         info->fprintf_func(info->stream, "%-12s  %s, %s, %s",
                            op_name, str_r(r0), str_r(r1), str_r(r2));
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_extract_i64:
     case INDEX_op_sextract_i32:
     case INDEX_op_sextract_i64:
+    case INDEX_op_ctpop_i32:
+    case INDEX_op_ctpop_i64:
         return C_O1_I1(r, r);
 
     case INDEX_op_st8_i32:
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_setcond_i64:
     case INDEX_op_deposit_i32:
     case INDEX_op_deposit_i64:
+    case INDEX_op_clz_i32:
+    case INDEX_op_clz_i64:
+    case INDEX_op_ctz_i32:
+    case INDEX_op_ctz_i64:
         return C_O1_I2(r, r, r);
 
     case INDEX_op_brcond_i32:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     CASE_32_64(divu)     /* Optional (TCG_TARGET_HAS_div_*). */
     CASE_32_64(rem)      /* Optional (TCG_TARGET_HAS_div_*). */
     CASE_32_64(remu)     /* Optional (TCG_TARGET_HAS_div_*). */
+    CASE_32_64(clz)      /* Optional (TCG_TARGET_HAS_clz_*). */
+    CASE_32_64(ctz)      /* Optional (TCG_TARGET_HAS_ctz_*). */
         tcg_out_op_rrr(s, opc, args[0], args[1], args[2]);
         break;
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     CASE_32_64(bswap16)  /* Optional (TCG_TARGET_HAS_bswap16_*). */
     CASE_32_64(bswap32)  /* Optional (TCG_TARGET_HAS_bswap32_*). */
     CASE_64(bswap64)     /* Optional (TCG_TARGET_HAS_bswap64_i64). */
+    CASE_32_64(ctpop)    /* Optional (TCG_TARGET_HAS_ctpop_*). */
         tcg_out_op_rr(s, opc, args[0], args[1]);
         break;
 
-- 
2.25.1

We already had mulu2_i32 for a 32-bit host; expand this to 64-bit
hosts as well.  The muls2_i32 and the 64-bit opcodes are new.

Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci/tcg-target.h     |  8 ++++----
 tcg/tci.c                | 35 +++++++++++++++++++++++++++++------
 tcg/tci/tcg-target.c.inc | 16 ++++++++++------
 3 files changed, 43 insertions(+), 16 deletions(-)

diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.h
+++ b/tcg/tci/tcg-target.h
@@ -XXX,XX +XXX,XX @@
 #define TCG_TARGET_HAS_orc_i32          1
 #define TCG_TARGET_HAS_rot_i32          1
 #define TCG_TARGET_HAS_movcond_i32      1
-#define TCG_TARGET_HAS_muls2_i32        0
+#define TCG_TARGET_HAS_muls2_i32        1
 #define TCG_TARGET_HAS_muluh_i32        0
 #define TCG_TARGET_HAS_mulsh_i32        0
 #define TCG_TARGET_HAS_goto_ptr         1
@@ -XXX,XX +XXX,XX @@
 #define TCG_TARGET_HAS_orc_i64          1
 #define TCG_TARGET_HAS_rot_i64          1
 #define TCG_TARGET_HAS_movcond_i64      1
-#define TCG_TARGET_HAS_muls2_i64        0
+#define TCG_TARGET_HAS_muls2_i64        1
 #define TCG_TARGET_HAS_add2_i32         0
 #define TCG_TARGET_HAS_sub2_i32         0
-#define TCG_TARGET_HAS_mulu2_i32        0
+#define TCG_TARGET_HAS_mulu2_i32        1
 #define TCG_TARGET_HAS_add2_i64         0
 #define TCG_TARGET_HAS_sub2_i64         0
-#define TCG_TARGET_HAS_mulu2_i64        0
+#define TCG_TARGET_HAS_mulu2_i64        1
 #define TCG_TARGET_HAS_muluh_i64        0
 #define TCG_TARGET_HAS_mulsh_i64        0
 #else
diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ __thread uintptr_t tci_tb_ptr;
 static void tci_write_reg64(tcg_target_ulong *regs, uint32_t high_index,
                             uint32_t low_index, uint64_t value)
 {
-    regs[low_index] = value;
+    regs[low_index] = (uint32_t)value;
     regs[high_index] = value >> 32;
 }
 
@@ -XXX,XX +XXX,XX @@ static void tci_args_rrrrr(uint32_t insn, TCGReg *r0, TCGReg *r1,
     *r4 = extract32(insn, 24, 4);
 }
 
-#if TCG_TARGET_REG_BITS == 32
 static void tci_args_rrrr(uint32_t insn,
                           TCGReg *r0, TCGReg *r1, TCGReg *r2, TCGReg *r3)
 {
@@ -XXX,XX +XXX,XX @@ static void tci_args_rrrr(uint32_t insn,
     *r2 = extract32(insn, 16, 4);
     *r3 = extract32(insn, 20, 4);
 }
-#endif
 
 static void tci_args_rrrrrc(uint32_t insn, TCGReg *r0, TCGReg *r1,
                             TCGReg *r2, TCGReg *r3, TCGReg *r4, TCGCond *c5)
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             T2 = tci_uint64(regs[r5], regs[r4]);
             tci_write_reg64(regs, r1, r0, T1 - T2);
             break;
+#endif /* TCG_TARGET_REG_BITS == 32 */
+#if TCG_TARGET_HAS_mulu2_i32
         case INDEX_op_mulu2_i32:
             tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
-            tci_write_reg64(regs, r1, r0, (uint64_t)regs[r2] * regs[r3]);
+            tmp64 = (uint64_t)(uint32_t)regs[r2] * (uint32_t)regs[r3];
+            tci_write_reg64(regs, r1, r0, tmp64);
             break;
-#endif /* TCG_TARGET_REG_BITS == 32 */
+#endif
+#if TCG_TARGET_HAS_muls2_i32
+        case INDEX_op_muls2_i32:
+            tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
+            tmp64 = (int64_t)(int32_t)regs[r2] * (int32_t)regs[r3];
+            tci_write_reg64(regs, r1, r0, tmp64);
+            break;
+#endif
 #if TCG_TARGET_HAS_ext8s_i32 || TCG_TARGET_HAS_ext8s_i64
         CASE_32_64(ext8s)
             tci_args_rr(insn, &r0, &r1);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             regs[r0] = ctpop64(regs[r1]);
             break;
 #endif
+#if TCG_TARGET_HAS_mulu2_i64
+        case INDEX_op_mulu2_i64:
+            tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
+            mulu64(&regs[r0], &regs[r1], regs[r2], regs[r3]);
+            break;
+#endif
+#if TCG_TARGET_HAS_muls2_i64
+        case INDEX_op_muls2_i64:
+            tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
+            muls64(&regs[r0], &regs[r1], regs[r2], regs[r3]);
+            break;
+#endif
 
             /* Shift/rotate operations (64 bit). */
 
@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
                            str_r(r3), str_r(r4), str_c(c));
         break;
 
-#if TCG_TARGET_REG_BITS == 32
     case INDEX_op_mulu2_i32:
+    case INDEX_op_mulu2_i64:
+    case INDEX_op_muls2_i32:
+    case INDEX_op_muls2_i64:
         tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
         info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s",
                            op_name, str_r(r0), str_r(r1),
                            str_r(r2), str_r(r3));
         break;
 
+#if TCG_TARGET_REG_BITS == 32
     case INDEX_op_add2_i32:
     case INDEX_op_sub2_i32:
         tci_args_rrrrrr(insn, &r0, &r1, &r2, &r3, &r4, &r5);
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
         return C_O2_I4(r, r, r, r, r, r);
     case INDEX_op_brcond2_i32:
         return C_O0_I4(r, r, r, r);
-    case INDEX_op_mulu2_i32:
-        return C_O2_I2(r, r, r, r);
 #endif
 
+    case INDEX_op_mulu2_i32:
+    case INDEX_op_mulu2_i64:
+    case INDEX_op_muls2_i32:
+    case INDEX_op_muls2_i64:
+        return C_O2_I2(r, r, r, r);
+
     case INDEX_op_movcond_i32:
     case INDEX_op_movcond_i64:
     case INDEX_op_setcond2_i32:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op_rrrrr(TCGContext *s, TCGOpcode op, TCGReg r0,
     tcg_out32(s, insn);
 }
 
-#if TCG_TARGET_REG_BITS == 32
 static void tcg_out_op_rrrr(TCGContext *s, TCGOpcode op,
                             TCGReg r0, TCGReg r1, TCGReg r2, TCGReg r3)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op_rrrr(TCGContext *s, TCGOpcode op,
     insn = deposit32(insn, 20, 4, r3);
     tcg_out32(s, insn);
 }
-#endif
 
 static void tcg_out_op_rrrrrc(TCGContext *s, TCGOpcode op,
                               TCGReg r0, TCGReg r1, TCGReg r2,
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
                           args[0], args[1], args[2], args[3], args[4]);
         tcg_out_op_rl(s, INDEX_op_brcond_i32, TCG_REG_TMP, arg_label(args[5]));
         break;
-    case INDEX_op_mulu2_i32:
+#endif
+
+    CASE_32_64(mulu2)
+    CASE_32_64(muls2)
         tcg_out_op_rrrr(s, opc, args[0], args[1], args[2], args[3]);
         break;
-#endif
 
     case INDEX_op_qemu_ld_i32:
     case INDEX_op_qemu_st_i32:
-- 
2.25.1

We already had the 32-bit versions for a 32-bit host; expand this
to 64-bit hosts as well.  The 64-bit opcodes are new.

Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci/tcg-target.h     |  8 ++++----
 tcg/tci.c                | 40 ++++++++++++++++++++++++++--------------
 tcg/tci/tcg-target.c.inc | 15 ++++++++-------
 3 files changed, 38 insertions(+), 25 deletions(-)

diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.h
+++ b/tcg/tci/tcg-target.h
@@ -XXX,XX +XXX,XX @@
 #define TCG_TARGET_HAS_rot_i64          1
 #define TCG_TARGET_HAS_movcond_i64      1
 #define TCG_TARGET_HAS_muls2_i64        1
-#define TCG_TARGET_HAS_add2_i32         0
-#define TCG_TARGET_HAS_sub2_i32         0
+#define TCG_TARGET_HAS_add2_i32         1
+#define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_mulu2_i32        1
-#define TCG_TARGET_HAS_add2_i64         0
-#define TCG_TARGET_HAS_sub2_i64         0
+#define TCG_TARGET_HAS_add2_i64         1
+#define TCG_TARGET_HAS_sub2_i64         1
 #define TCG_TARGET_HAS_mulu2_i64        1
 #define TCG_TARGET_HAS_muluh_i64        0
 #define TCG_TARGET_HAS_mulsh_i64        0
diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ static void tci_args_rrrrrc(uint32_t insn, TCGReg *r0, TCGReg *r1,
     *c5 = extract32(insn, 28, 4);
 }
 
-#if TCG_TARGET_REG_BITS == 32
 static void tci_args_rrrrrr(uint32_t insn, TCGReg *r0, TCGReg *r1,
                             TCGReg *r2, TCGReg *r3, TCGReg *r4, TCGReg *r5)
 {
@@ -XXX,XX +XXX,XX @@ static void tci_args_rrrrrr(uint32_t insn, TCGReg *r0, TCGReg *r1,
     *r4 = extract32(insn, 24, 4);
     *r5 = extract32(insn, 28, 4);
 }
-#endif
 
 static bool tci_compare32(uint32_t u0, uint32_t u1, TCGCond condition)
 {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
     for (;;) {
         uint32_t insn;
         TCGOpcode opc;
-        TCGReg r0, r1, r2, r3, r4;
+        TCGReg r0, r1, r2, r3, r4, r5;
         tcg_target_ulong t1;
         TCGCond condition;
         target_ulong taddr;
         uint8_t pos, len;
         uint32_t tmp32;
         uint64_t tmp64;
-#if TCG_TARGET_REG_BITS == 32
-        TCGReg r5;
         uint64_t T1, T2;
-#endif
         TCGMemOpIdx oi;
         int32_t ofs;
         void *ptr;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                 tb_ptr = ptr;
             }
             break;
-#if TCG_TARGET_REG_BITS == 32
+#if TCG_TARGET_REG_BITS == 32 || TCG_TARGET_HAS_add2_i32
         case INDEX_op_add2_i32:
             tci_args_rrrrrr(insn, &r0, &r1, &r2, &r3, &r4, &r5);
             T1 = tci_uint64(regs[r3], regs[r2]);
             T2 = tci_uint64(regs[r5], regs[r4]);
             tci_write_reg64(regs, r1, r0, T1 + T2);
             break;
+#endif
+#if TCG_TARGET_REG_BITS == 32 || TCG_TARGET_HAS_sub2_i32
         case INDEX_op_sub2_i32:
             tci_args_rrrrrr(insn, &r0, &r1, &r2, &r3, &r4, &r5);
             T1 = tci_uint64(regs[r3], regs[r2]);
             T2 = tci_uint64(regs[r5], regs[r4]);
             tci_write_reg64(regs, r1, r0, T1 - T2);
             break;
-#endif /* TCG_TARGET_REG_BITS == 32 */
+#endif
 #if TCG_TARGET_HAS_mulu2_i32
         case INDEX_op_mulu2_i32:
             tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             muls64(&regs[r0], &regs[r1], regs[r2], regs[r3]);
             break;
 #endif
+#if TCG_TARGET_HAS_add2_i64
+        case INDEX_op_add2_i64:
+            tci_args_rrrrrr(insn, &r0, &r1, &r2, &r3, &r4, &r5);
+            T1 = regs[r2] + regs[r4];
+            T2 = regs[r3] + regs[r5] + (T1 < regs[r2]);
+            regs[r0] = T1;
+            regs[r1] = T2;
+            break;
+#endif
+#if TCG_TARGET_HAS_add2_i64
+        case INDEX_op_sub2_i64:
+            tci_args_rrrrrr(insn, &r0, &r1, &r2, &r3, &r4, &r5);
+            T1 = regs[r2] - regs[r4];
+            T2 = regs[r3] - regs[r5] - (regs[r2] < regs[r4]);
+            regs[r0] = T1;
+            regs[r1] = T2;
+            break;
+#endif
 
             /* Shift/rotate operations (64 bit). */
 
@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     const char *op_name;
     uint32_t insn;
     TCGOpcode op;
-    TCGReg r0, r1, r2, r3, r4;
-#if TCG_TARGET_REG_BITS == 32
-    TCGReg r5;
-#endif
+    TCGReg r0, r1, r2, r3, r4, r5;
     tcg_target_ulong i1;
     int32_t s2;
     TCGCond c;
@@ -XXX,XX +XXX,XX @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
                            str_r(r2), str_r(r3));
         break;
 
-#if TCG_TARGET_REG_BITS == 32
     case INDEX_op_add2_i32:
+    case INDEX_op_add2_i64:
     case INDEX_op_sub2_i32:
+    case INDEX_op_sub2_i64:
         tci_args_rrrrrr(insn, &r0, &r1, &r2, &r3, &r4, &r5);
         info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s, %s, %s",
                            op_name, str_r(r0), str_r(r1), str_r(r2),
                            str_r(r3), str_r(r4), str_r(r5));
         break;
-#endif
 
     case INDEX_op_qemu_ld_i64:
     case INDEX_op_qemu_st_i64:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_brcond_i64:
         return C_O0_I2(r, r);
 
-#if TCG_TARGET_REG_BITS == 32
-    /* TODO: Support R, R, R, R, RI, RI? Will it be faster? */
     case INDEX_op_add2_i32:
+    case INDEX_op_add2_i64:
     case INDEX_op_sub2_i32:
+    case INDEX_op_sub2_i64:
         return C_O2_I4(r, r, r, r, r, r);
+
+#if TCG_TARGET_REG_BITS == 32
     case INDEX_op_brcond2_i32:
         return C_O0_I4(r, r, r, r);
 #endif
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op_rrrrrc(TCGContext *s, TCGOpcode op,
     tcg_out32(s, insn);
 }
 
-#if TCG_TARGET_REG_BITS == 32
 static void tcg_out_op_rrrrrr(TCGContext *s, TCGOpcode op,
                               TCGReg r0, TCGReg r1, TCGReg r2,
                               TCGReg r3, TCGReg r4, TCGReg r5)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op_rrrrrr(TCGContext *s, TCGOpcode op,
     insn = deposit32(insn, 28, 4, r5);
     tcg_out32(s, insn);
 }
-#endif
 
 static void tcg_out_ldst(TCGContext *s, TCGOpcode op, TCGReg val,
                          TCGReg base, intptr_t offset)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_op_rr(s, opc, args[0], args[1]);
         break;
 
-#if TCG_TARGET_REG_BITS == 32
-    case INDEX_op_add2_i32:
-    case INDEX_op_sub2_i32:
+    CASE_32_64(add2)
+    CASE_32_64(sub2)
         tcg_out_op_rrrrrr(s, opc, args[0], args[1], args[2],
                           args[3], args[4], args[5]);
         break;
+
+#if TCG_TARGET_REG_BITS == 32
     case INDEX_op_brcond2_i32:
         tcg_out_op_rrrrrc(s, INDEX_op_setcond2_i32, TCG_REG_TMP,
                           args[0], args[1], args[2], args[3], args[4]);
-- 
2.25.1

We can share this code between 32-bit and 64-bit loads and stores.

Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c | 183 +++++++++++++++++++++---------------------------------
 1 file changed, 71 insertions(+), 112 deletions(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ static bool tci_compare64(uint64_t u0, uint64_t u1, TCGCond condition)
 #define qemu_st_beq(X) \
     cpu_stq_be_mmuidx_ra(env, taddr, X, get_mmuidx(oi), (uintptr_t)tb_ptr)
 
+static uint64_t tci_qemu_ld(CPUArchState *env, target_ulong taddr,
+                            TCGMemOpIdx oi, const void *tb_ptr)
+{
+    MemOp mop = get_memop(oi) & (MO_BSWAP | MO_SSIZE);
+
+    switch (mop) {
+    case MO_UB:
+        return qemu_ld_ub;
+    case MO_SB:
+        return (int8_t)qemu_ld_ub;
+    case MO_LEUW:
+        return qemu_ld_leuw;
+    case MO_LESW:
+        return (int16_t)qemu_ld_leuw;
+    case MO_LEUL:
+        return qemu_ld_leul;
+    case MO_LESL:
+        return (int32_t)qemu_ld_leul;
+    case MO_LEQ:
+        return qemu_ld_leq;
+    case MO_BEUW:
+        return qemu_ld_beuw;
+    case MO_BESW:
+        return (int16_t)qemu_ld_beuw;
+    case MO_BEUL:
+        return qemu_ld_beul;
+    case MO_BESL:
+        return (int32_t)qemu_ld_beul;
+    case MO_BEQ:
+        return qemu_ld_beq;
+    default:
+        g_assert_not_reached();
+    }
+}
+
+static void tci_qemu_st(CPUArchState *env, target_ulong taddr, uint64_t val,
+                        TCGMemOpIdx oi, const void *tb_ptr)
+{
+    MemOp mop = get_memop(oi) & (MO_BSWAP | MO_SSIZE);
+
+    switch (mop) {
+    case MO_UB:
+        qemu_st_b(val);
+        break;
+    case MO_LEUW:
+        qemu_st_lew(val);
+        break;
+    case MO_LEUL:
+        qemu_st_lel(val);
+        break;
+    case MO_LEQ:
+        qemu_st_leq(val);
+        break;
+    case MO_BEUW:
+        qemu_st_bew(val);
+        break;
+    case MO_BEUL:
+        qemu_st_bel(val);
+        break;
+    case MO_BEQ:
+        qemu_st_beq(val);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+}
+
 #if TCG_TARGET_REG_BITS == 64
 # define CASE_32_64(x) \
         case glue(glue(INDEX_op_, x), _i64): \
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                 tci_args_rrrm(insn, &r0, &r1, &r2, &oi);
                 taddr = tci_uint64(regs[r2], regs[r1]);
             }
-            switch (get_memop(oi) & (MO_BSWAP | MO_SSIZE)) {
-            case MO_UB:
-                tmp32 = qemu_ld_ub;
-                break;
-            case MO_SB:
-                tmp32 = (int8_t)qemu_ld_ub;
-                break;
-            case MO_LEUW:
-                tmp32 = qemu_ld_leuw;
-                break;
-            case MO_LESW:
-                tmp32 = (int16_t)qemu_ld_leuw;
-                break;
-            case MO_LEUL:
-                tmp32 = qemu_ld_leul;
-                break;
-            case MO_BEUW:
-                tmp32 = qemu_ld_beuw;
-                break;
-            case MO_BESW:
-                tmp32 = (int16_t)qemu_ld_beuw;
-                break;
-            case MO_BEUL:
-                tmp32 = qemu_ld_beul;
-                break;
-            default:
-                g_assert_not_reached();
-            }
+            tmp32 = tci_qemu_ld(env, taddr, oi, tb_ptr);
             regs[r0] = tmp32;
             break;
 
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                 taddr = tci_uint64(regs[r3], regs[r2]);
                 oi = regs[r4];
             }
-            switch (get_memop(oi) & (MO_BSWAP | MO_SSIZE)) {
-            case MO_UB:
-                tmp64 = qemu_ld_ub;
-                break;
-            case MO_SB:
-                tmp64 = (int8_t)qemu_ld_ub;
-                break;
-            case MO_LEUW:
-                tmp64 = qemu_ld_leuw;
-                break;
-            case MO_LESW:
-                tmp64 = (int16_t)qemu_ld_leuw;
-                break;
-            case MO_LEUL:
-                tmp64 = qemu_ld_leul;
-                break;
-            case MO_LESL:
-                tmp64 = (int32_t)qemu_ld_leul;
-                break;
-            case MO_LEQ:
-                tmp64 = qemu_ld_leq;
-                break;
-            case MO_BEUW:
-                tmp64 = qemu_ld_beuw;
-                break;
-            case MO_BESW:
-                tmp64 = (int16_t)qemu_ld_beuw;
-                break;
-            case MO_BEUL:
-                tmp64 = qemu_ld_beul;
-                break;
-            case MO_BESL:
-                tmp64 = (int32_t)qemu_ld_beul;
-                break;
-            case MO_BEQ:
-                tmp64 = qemu_ld_beq;
-                break;
-            default:
-                g_assert_not_reached();
-            }
+            tmp64 = tci_qemu_ld(env, taddr, oi, tb_ptr);
             if (TCG_TARGET_REG_BITS == 32) {
                 tci_write_reg64(regs, r1, r0, tmp64);
             } else {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                 taddr = tci_uint64(regs[r2], regs[r1]);
             }
             tmp32 = regs[r0];
-            switch (get_memop(oi) & (MO_BSWAP | MO_SIZE)) {
-            case MO_UB:
-                qemu_st_b(tmp32);
-                break;
-            case MO_LEUW:
-                qemu_st_lew(tmp32);
-                break;
-            case MO_LEUL:
-                qemu_st_lel(tmp32);
-                break;
-            case MO_BEUW:
-                qemu_st_bew(tmp32);
-                break;
-            case MO_BEUL:
-                qemu_st_bel(tmp32);
-                break;
-            default:
-                g_assert_not_reached();
-            }
+            tci_qemu_st(env, taddr, tmp32, oi, tb_ptr);
             break;
 
         case INDEX_op_qemu_st_i64:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                 }
                 tmp64 = tci_uint64(regs[r1], regs[r0]);
             }
-            switch (get_memop(oi) & (MO_BSWAP | MO_SIZE)) {
-            case MO_UB:
-                qemu_st_b(tmp64);
-                break;
-            case MO_LEUW:
-                qemu_st_lew(tmp64);
-                break;
-            case MO_LEUL:
-                qemu_st_lel(tmp64);
-                break;
-            case MO_LEQ:
-                qemu_st_leq(tmp64);
-                break;
-            case MO_BEUW:
-                qemu_st_bew(tmp64);
-                break;
-            case MO_BEUL:
-                qemu_st_bel(tmp64);
-                break;
-            case MO_BEQ:
-                qemu_st_beq(tmp64);
-                break;
-            default:
-                g_assert_not_reached();
-            }
+            tci_qemu_st(env, taddr, tmp64, oi, tb_ptr);
             break;
 
         case INDEX_op_mb:
-- 
2.25.1

This reverts commit dc09f047eddec8f4a1991c4f5f4a428d7aa3f2c0.

For tcg, tracepoints are expanded inline in tcg opcodes.
Using a helper which generates a second tracepoint is incorrect.

For system mode, the extraction and re-packing of MemOp and mmu_idx
lost the alignment information from MemOp.  So we were no longer
raising alignment exceptions for !TARGET_ALIGNED_ONLY guests.
This can be seen in tests/tcg/xtensa/test_load_store.S.

For user mode, we must update to the new signature of g2h() so that
the revert compiles.  We can leave set_helper_retaddr for later.

Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c | 73 ++++++++++++++++++++++++++++++++++---------------------
 1 file changed, 45 insertions(+), 28 deletions(-)

These macros are only used in one place.  By expanding,
we get to apply some common-subexpression elimination
and create some local variables.

Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c | 165 +++++++++++++++++++++++++++++++++---------------------
 1 file changed, 100 insertions(+), 65 deletions(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ static bool tci_compare64(uint64_t u0, uint64_t u1, TCGCond condition)
     return result;
 }
 
-#ifdef CONFIG_SOFTMMU
-# define qemu_ld_ub \
-    helper_ret_ldub_mmu(env, taddr, oi, (uintptr_t)tb_ptr)
-# define qemu_ld_leuw \
-    helper_le_lduw_mmu(env, taddr, oi, (uintptr_t)tb_ptr)
-# define qemu_ld_leul \
-    helper_le_ldul_mmu(env, taddr, oi, (uintptr_t)tb_ptr)
-# define qemu_ld_leq \
-    helper_le_ldq_mmu(env, taddr, oi, (uintptr_t)tb_ptr)
-# define qemu_ld_beuw \
-    helper_be_lduw_mmu(env, taddr, oi, (uintptr_t)tb_ptr)
-# define qemu_ld_beul \
-    helper_be_ldul_mmu(env, taddr, oi, (uintptr_t)tb_ptr)
-# define qemu_ld_beq \
-    helper_be_ldq_mmu(env, taddr, oi, (uintptr_t)tb_ptr)
-# define qemu_st_b(X) \
-    helper_ret_stb_mmu(env, taddr, X, oi, (uintptr_t)tb_ptr)
-# define qemu_st_lew(X) \
-    helper_le_stw_mmu(env, taddr, X, oi, (uintptr_t)tb_ptr)
-# define qemu_st_lel(X) \
-    helper_le_stl_mmu(env, taddr, X, oi, (uintptr_t)tb_ptr)
-# define qemu_st_leq(X) \
-    helper_le_stq_mmu(env, taddr, X, oi, (uintptr_t)tb_ptr)
-# define qemu_st_bew(X) \
-    helper_be_stw_mmu(env, taddr, X, oi, (uintptr_t)tb_ptr)
-# define qemu_st_bel(X) \
-    helper_be_stl_mmu(env, taddr, X, oi, (uintptr_t)tb_ptr)
-# define qemu_st_beq(X) \
-    helper_be_stq_mmu(env, taddr, X, oi, (uintptr_t)tb_ptr)
-#else
-# define qemu_ld_ub      ldub_p(g2h(env_cpu(env), taddr))
-# define qemu_ld_leuw    lduw_le_p(g2h(env_cpu(env), taddr))
-# define qemu_ld_leul    (uint32_t)ldl_le_p(g2h(env_cpu(env), taddr))
-# define qemu_ld_leq     ldq_le_p(g2h(env_cpu(env), taddr))
-# define qemu_ld_beuw    lduw_be_p(g2h(env_cpu(env), taddr))
-# define qemu_ld_beul    (uint32_t)ldl_be_p(g2h(env_cpu(env), taddr))
-# define qemu_ld_beq     ldq_be_p(g2h(env_cpu(env), taddr))
-# define qemu_st_b(X)    stb_p(g2h(env_cpu(env), taddr), X)
-# define qemu_st_lew(X)  stw_le_p(g2h(env_cpu(env), taddr), X)
-# define qemu_st_lel(X)  stl_le_p(g2h(env_cpu(env), taddr), X)
-# define qemu_st_leq(X)  stq_le_p(g2h(env_cpu(env), taddr), X)
-# define qemu_st_bew(X)  stw_be_p(g2h(env_cpu(env), taddr), X)
-# define qemu_st_bel(X)  stl_be_p(g2h(env_cpu(env), taddr), X)
-# define qemu_st_beq(X)  stq_be_p(g2h(env_cpu(env), taddr), X)
-#endif
-
 static uint64_t tci_qemu_ld(CPUArchState *env, target_ulong taddr,
                             TCGMemOpIdx oi, const void *tb_ptr)
 {
     MemOp mop = get_memop(oi) & (MO_BSWAP | MO_SSIZE);
 
+#ifdef CONFIG_SOFTMMU
+    uintptr_t ra = (uintptr_t)tb_ptr;
+
     switch (mop) {
     case MO_UB:
-        return qemu_ld_ub;
+        return helper_ret_ldub_mmu(env, taddr, oi, ra);
     case MO_SB:
-        return (int8_t)qemu_ld_ub;
+        return helper_ret_ldsb_mmu(env, taddr, oi, ra);
     case MO_LEUW:
-        return qemu_ld_leuw;
+        return helper_le_lduw_mmu(env, taddr, oi, ra);
     case MO_LESW:
-        return (int16_t)qemu_ld_leuw;
+        return helper_le_ldsw_mmu(env, taddr, oi, ra);
     case MO_LEUL:
-        return qemu_ld_leul;
+        return helper_le_ldul_mmu(env, taddr, oi, ra);
     case MO_LESL:
-        return (int32_t)qemu_ld_leul;
+        return helper_le_ldsl_mmu(env, taddr, oi, ra);
     case MO_LEQ:
-        return qemu_ld_leq;
+        return helper_le_ldq_mmu(env, taddr, oi, ra);
     case MO_BEUW:
-        return qemu_ld_beuw;
+        return helper_be_lduw_mmu(env, taddr, oi, ra);
     case MO_BESW:
-        return (int16_t)qemu_ld_beuw;
+        return helper_be_ldsw_mmu(env, taddr, oi, ra);
     case MO_BEUL:
-        return qemu_ld_beul;
+        return helper_be_ldul_mmu(env, taddr, oi, ra);
     case MO_BESL:
-        return (int32_t)qemu_ld_beul;
+        return helper_be_ldsl_mmu(env, taddr, oi, ra);
     case MO_BEQ:
-        return qemu_ld_beq;
+        return helper_be_ldq_mmu(env, taddr, oi, ra);
     default:
         g_assert_not_reached();
     }
+#else
+    void *haddr = g2h(env_cpu(env), taddr);
+    uint64_t ret;
+
+    switch (mop) {
+    case MO_UB:
+        ret = ldub_p(haddr);
+        break;
+    case MO_SB:
+        ret = ldsb_p(haddr);
+        break;
+    case MO_LEUW:
+        ret = lduw_le_p(haddr);
+        break;
+    case MO_LESW:
+        ret = ldsw_le_p(haddr);
+        break;
+    case MO_LEUL:
+        ret = (uint32_t)ldl_le_p(haddr);
+        break;
+    case MO_LESL:
+        ret = (int32_t)ldl_le_p(haddr);
+        break;
+    case MO_LEQ:
+        ret = ldq_le_p(haddr);
+        break;
+    case MO_BEUW:
+        ret = lduw_be_p(haddr);
+        break;
+    case MO_BESW:
+        ret = ldsw_be_p(haddr);
+        break;
+    case MO_BEUL:
+        ret = (uint32_t)ldl_be_p(haddr);
+        break;
+    case MO_BESL:
+        ret = (int32_t)ldl_be_p(haddr);
+        break;
+    case MO_BEQ:
+        ret = ldq_be_p(haddr);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+    return ret;
+#endif
 }
 
 static void tci_qemu_st(CPUArchState *env, target_ulong taddr, uint64_t val,
@@ -XXX,XX +XXX,XX @@ static void tci_qemu_st(CPUArchState *env, target_ulong taddr, uint64_t val,
 {
     MemOp mop = get_memop(oi) & (MO_BSWAP | MO_SSIZE);
 
+#ifdef CONFIG_SOFTMMU
+    uintptr_t ra = (uintptr_t)tb_ptr;
+
     switch (mop) {
     case MO_UB:
-        qemu_st_b(val);
+        helper_ret_stb_mmu(env, taddr, val, oi, ra);
         break;
     case MO_LEUW:
-        qemu_st_lew(val);
+        helper_le_stw_mmu(env, taddr, val, oi, ra);
         break;
     case MO_LEUL:
-        qemu_st_lel(val);
+        helper_le_stl_mmu(env, taddr, val, oi, ra);
         break;
     case MO_LEQ:
-        qemu_st_leq(val);
+        helper_le_stq_mmu(env, taddr, val, oi, ra);
         break;
     case MO_BEUW:
-        qemu_st_bew(val);
+        helper_be_stw_mmu(env, taddr, val, oi, ra);
         break;
     case MO_BEUL:
-        qemu_st_bel(val);
+        helper_be_stl_mmu(env, taddr, val, oi, ra);
         break;
     case MO_BEQ:
-        qemu_st_beq(val);
+        helper_be_stq_mmu(env, taddr, val, oi, ra);
         break;
     default:
         g_assert_not_reached();
     }
+#else
+    void *haddr = g2h(env_cpu(env), taddr);
+
+    switch (mop) {
+    case MO_UB:
+        stb_p(haddr, val);
+        break;
+    case MO_LEUW:
+        stw_le_p(haddr, val);
+        break;
+    case MO_LEUL:
+        stl_le_p(haddr, val);
+        break;
+    case MO_LEQ:
+        stq_le_p(haddr, val);
+        break;
+    case MO_BEUW:
+        stw_be_p(haddr, val);
+        break;
+    case MO_BEUL:
+        stl_be_p(haddr, val);
+        break;
+    case MO_BEQ:
+        stq_be_p(haddr, val);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+#endif
 }
 
 #if TCG_TARGET_REG_BITS == 64
-- 
2.25.1

Wrap guest memory operations for tci like we do for cpu_ld*_data.

We cannot actually use the cpu_ldst.h interface without duplicating
the memory trace operations performed within, which will already
have been expanded into the tcg opcode stream.

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ static uint64_t tci_qemu_ld(CPUArchState *env, target_ulong taddr,
                             TCGMemOpIdx oi, const void *tb_ptr)
 {
     MemOp mop = get_memop(oi) & (MO_BSWAP | MO_SSIZE);
-
-#ifdef CONFIG_SOFTMMU
     uintptr_t ra = (uintptr_t)tb_ptr;
 
+#ifdef CONFIG_SOFTMMU
     switch (mop) {
     case MO_UB:
         return helper_ret_ldub_mmu(env, taddr, oi, ra);
@@ -XXX,XX +XXX,XX @@ static uint64_t tci_qemu_ld(CPUArchState *env, target_ulong taddr,
     void *haddr = g2h(env_cpu(env), taddr);
     uint64_t ret;
 
+    set_helper_retaddr(ra);
     switch (mop) {
     case MO_UB:
         ret = ldub_p(haddr);
@@ -XXX,XX +XXX,XX @@ static uint64_t tci_qemu_ld(CPUArchState *env, target_ulong taddr,
     default:
         g_assert_not_reached();
     }
+    clear_helper_retaddr();
     return ret;
 #endif
 }
@@ -XXX,XX +XXX,XX @@ static void tci_qemu_st(CPUArchState *env, target_ulong taddr, uint64_t val,
                         TCGMemOpIdx oi, const void *tb_ptr)
 {
     MemOp mop = get_memop(oi) & (MO_BSWAP | MO_SSIZE);
-
-#ifdef CONFIG_SOFTMMU
     uintptr_t ra = (uintptr_t)tb_ptr;
 
+#ifdef CONFIG_SOFTMMU
     switch (mop) {
     case MO_UB:
         helper_ret_stb_mmu(env, taddr, val, oi, ra);
@@ -XXX,XX +XXX,XX @@ static void tci_qemu_st(CPUArchState *env, target_ulong taddr, uint64_t val,
 #else
     void *haddr = g2h(env_cpu(env), taddr);
 
+    set_helper_retaddr(ra);
     switch (mop) {
     case MO_UB:
         stb_p(haddr, val);
@@ -XXX,XX +XXX,XX @@ static void tci_qemu_st(CPUArchState *env, target_ulong taddr, uint64_t val,
     default:
         g_assert_not_reached();
     }
+    clear_helper_retaddr();
 #endif
 }
 
-- 
2.25.1

The longest test at the moment seems to be a (slower)
aarch64 host, for which test-mmap takes 64 seconds.

Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Acked-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 configure                 | 3 +++
 tests/tcg/Makefile.target | 6 ++++--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ fi
 if test "$optreset" = "yes" ; then
   echo "HAVE_OPTRESET=y" >> $config_host_mak
 fi
+if test "$tcg" = "enabled" -a "$tcg_interpreter" = "true" ; then
+  echo "CONFIG_TCG_INTERPRETER=y" >> $config_host_mak
+fi
 if test "$fdatasync" = "yes" ; then
   echo "CONFIG_FDATASYNC=y" >> $config_host_mak
 fi
diff --git a/tests/tcg/Makefile.target b/tests/tcg/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/Makefile.target
+++ b/tests/tcg/Makefile.target
@@ -XXX,XX +XXX,XX @@ LDFLAGS=
 QEMU_OPTS=
 
 
-# If TCG debugging is enabled things are a lot slower
-ifeq ($(CONFIG_DEBUG_TCG),y)
+# If TCG debugging, or TCI is enabled things are a lot slower
+ifneq ($(CONFIG_TCG_INTERPRETER),)
+TIMEOUT=90
+else ifneq ($(CONFIG_DEBUG_TCG),)
 TIMEOUT=60
 else
 TIMEOUT=15
-- 
2.25.1

We had a single ATOMIC_MMU_LOOKUP macro that probed for
read+write on all atomic ops.  This is incorrect for
plain atomic load and atomic store.

For user-only, we rely on the host page permissions.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/390
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/atomic_template.h | 24 +++++-----
 accel/tcg/cputlb.c          | 95 ++++++++++++++++++++++++++-----------
 accel/tcg/user-exec.c       |  8 ++--
 3 files changed, 83 insertions(+), 44 deletions(-)

diff --git a/accel/tcg/atomic_template.h b/accel/tcg/atomic_template.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/atomic_template.h
+++ b/accel/tcg/atomic_template.h
@@ -XXX,XX +XXX,XX @@ ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, target_ulong addr,
                               ABI_TYPE cmpv, ABI_TYPE newv EXTRA_ARGS)
 {
     ATOMIC_MMU_DECLS;
-    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
+    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP_RW;
     DATA_TYPE ret;
     uint16_t info = trace_mem_build_info(SHIFT, false, 0, false,
                                          ATOMIC_MMU_IDX);
@@ -XXX,XX +XXX,XX @@ ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, target_ulong addr,
 ABI_TYPE ATOMIC_NAME(ld)(CPUArchState *env, target_ulong addr EXTRA_ARGS)
 {
     ATOMIC_MMU_DECLS;
-    DATA_TYPE val, *haddr = ATOMIC_MMU_LOOKUP;
+    DATA_TYPE val, *haddr = ATOMIC_MMU_LOOKUP_R;
     uint16_t info = trace_mem_build_info(SHIFT, false, 0, false,
                                          ATOMIC_MMU_IDX);
 
@@ -XXX,XX +XXX,XX @@ void ATOMIC_NAME(st)(CPUArchState *env, target_ulong addr,
                      ABI_TYPE val EXTRA_ARGS)
 {
     ATOMIC_MMU_DECLS;
-    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
+    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP_W;
     uint16_t info = trace_mem_build_info(SHIFT, false, 0, true,
                                          ATOMIC_MMU_IDX);
 
@@ -XXX,XX +XXX,XX @@ ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, target_ulong addr,
                            ABI_TYPE val EXTRA_ARGS)
 {
     ATOMIC_MMU_DECLS;
-    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
+    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP_RW;
     DATA_TYPE ret;
     uint16_t info = trace_mem_build_info(SHIFT, false, 0, false,
                                          ATOMIC_MMU_IDX);
@@ -XXX,XX +XXX,XX @@ ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
                         ABI_TYPE val EXTRA_ARGS)                    \
 {                                                                   \
     ATOMIC_MMU_DECLS;                                               \
-    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;                           \
+    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP_RW;                        \
     DATA_TYPE ret;                                                  \
     uint16_t info = trace_mem_build_info(SHIFT, false, 0, false,    \
                                          ATOMIC_MMU_IDX);           \
@@ -XXX,XX +XXX,XX @@ ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
                         ABI_TYPE xval EXTRA_ARGS)                   \
 {                                                                   \
     ATOMIC_MMU_DECLS;                                               \
-    XDATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;                          \
+    XDATA_TYPE *haddr = ATOMIC_MMU_LOOKUP_RW;                       \
     XDATA_TYPE cmp, old, new, val = xval;                           \
     uint16_t info = trace_mem_build_info(SHIFT, false, 0, false,    \
                                          ATOMIC_MMU_IDX);           \
@@ -XXX,XX +XXX,XX @@ ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, target_ulong addr,
                               ABI_TYPE cmpv, ABI_TYPE newv EXTRA_ARGS)
 {
     ATOMIC_MMU_DECLS;
-    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
+    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP_RW;
     DATA_TYPE ret;
     uint16_t info = trace_mem_build_info(SHIFT, false, MO_BSWAP, false,
                                          ATOMIC_MMU_IDX);
@@ -XXX,XX +XXX,XX @@ ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, target_ulong addr,
 ABI_TYPE ATOMIC_NAME(ld)(CPUArchState *env, target_ulong addr EXTRA_ARGS)
 {
     ATOMIC_MMU_DECLS;
-    DATA_TYPE val, *haddr = ATOMIC_MMU_LOOKUP;
+    DATA_TYPE val, *haddr = ATOMIC_MMU_LOOKUP_R;
     uint16_t info = trace_mem_build_info(SHIFT, false, MO_BSWAP, false,
                                          ATOMIC_MMU_IDX);
 
@@ -XXX,XX +XXX,XX @@ void ATOMIC_NAME(st)(CPUArchState *env, target_ulong addr,
                      ABI_TYPE val EXTRA_ARGS)
 {
     ATOMIC_MMU_DECLS;
-    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
+    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP_W;
     uint16_t info = trace_mem_build_info(SHIFT, false, MO_BSWAP, true,
                                          ATOMIC_MMU_IDX);
 
@@ -XXX,XX +XXX,XX @@ ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, target_ulong addr,
                            ABI_TYPE val EXTRA_ARGS)
 {
     ATOMIC_MMU_DECLS;
-    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
+    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP_RW;
     ABI_TYPE ret;
     uint16_t info = trace_mem_build_info(SHIFT, false, MO_BSWAP, false,
                                          ATOMIC_MMU_IDX);
@@ -XXX,XX +XXX,XX @@ ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
                         ABI_TYPE val EXTRA_ARGS)                    \
 {                                                                   \
     ATOMIC_MMU_DECLS;                                               \
-    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;                           \
+    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP_RW;                        \
     DATA_TYPE ret;                                                  \
     uint16_t info = trace_mem_build_info(SHIFT, false, MO_BSWAP,    \
                                          false, ATOMIC_MMU_IDX);    \
@@ -XXX,XX +XXX,XX @@ ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
                         ABI_TYPE xval EXTRA_ARGS)                   \
 {                                                                   \
     ATOMIC_MMU_DECLS;                                               \
-    XDATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;                          \
+    XDATA_TYPE *haddr = ATOMIC_MMU_LOOKUP_RW;                       \
     XDATA_TYPE ldo, ldn, old, new, val = xval;                      \
     uint16_t info = trace_mem_build_info(SHIFT, false, MO_BSWAP,    \
                                          false, ATOMIC_MMU_IDX);    \
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ bool tlb_plugin_lookup(CPUState *cpu, target_ulong addr, int mmu_idx,
 
 #endif
 
-/* Probe for a read-modify-write atomic operation.  Do not allow unaligned
- * operations, or io operations to proceed.  Return the host address.  */
+/*
+ * Probe for an atomic operation.  Do not allow unaligned operations,
+ * or io operations to proceed.  Return the host address.
+ *
+ * @prot may be PAGE_READ, PAGE_WRITE, or PAGE_READ|PAGE_WRITE.
+ */
 static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
-                               TCGMemOpIdx oi, uintptr_t retaddr)
+                               TCGMemOpIdx oi, int size, int prot,
+                               uintptr_t retaddr)
 {
     size_t mmu_idx = get_mmuidx(oi);
-    uintptr_t index = tlb_index(env, mmu_idx, addr);
-    CPUTLBEntry *tlbe = tlb_entry(env, mmu_idx, addr);
-    target_ulong tlb_addr = tlb_addr_write(tlbe);
     MemOp mop = get_memop(oi);
     int a_bits = get_alignment_bits(mop);
-    int s_bits = mop & MO_SIZE;
+    uintptr_t index;
+    CPUTLBEntry *tlbe;
+    target_ulong tlb_addr;
     void *hostaddr;
 
     /* Adjust the given return address.  */
@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
     }
 
     /* Enforce qemu required alignment.  */
-    if (unlikely(addr & ((1 << s_bits) - 1))) {
+    if (unlikely(addr & (size - 1))) {
         /* We get here if guest alignment was not requested,
            or was not enforced by cpu_unaligned_access above.
            We might widen the access and emulate, but for now
@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
         goto stop_the_world;
     }
 
+    index = tlb_index(env, mmu_idx, addr);
+    tlbe = tlb_entry(env, mmu_idx, addr);
+
     /* Check TLB entry and enforce page permissions.  */
-    if (!tlb_hit(tlb_addr, addr)) {
-        if (!VICTIM_TLB_HIT(addr_write, addr)) {
-            tlb_fill(env_cpu(env), addr, 1 << s_bits, MMU_DATA_STORE,
-                     mmu_idx, retaddr);
-            index = tlb_index(env, mmu_idx, addr);
-            tlbe = tlb_entry(env, mmu_idx, addr);
+    if (prot & PAGE_WRITE) {
+        tlb_addr = tlb_addr_write(tlbe);
+        if (!tlb_hit(tlb_addr, addr)) {
+            if (!VICTIM_TLB_HIT(addr_write, addr)) {
+                tlb_fill(env_cpu(env), addr, size,
+                         MMU_DATA_STORE, mmu_idx, retaddr);
+                index = tlb_index(env, mmu_idx, addr);
+                tlbe = tlb_entry(env, mmu_idx, addr);
+            }
+            tlb_addr = tlb_addr_write(tlbe) & ~TLB_INVALID_MASK;
+        }
+
+        /* Let the guest notice RMW on a write-only page.  */
+        if ((prot & PAGE_READ) &&
+            unlikely(tlbe->addr_read != (tlb_addr & ~TLB_NOTDIRTY))) {
+            tlb_fill(env_cpu(env), addr, size,
+                     MMU_DATA_LOAD, mmu_idx, retaddr);
+            /*
+             * Since we don't support reads and writes to different addresses,
+             * and we do have the proper page loaded for write, this shouldn't
+             * ever return.  But just in case, handle via stop-the-world.
+             */
+            goto stop_the_world;
+        }
+    } else /* if (prot & PAGE_READ) */ {
+        tlb_addr = tlbe->addr_read;
+        if (!tlb_hit(tlb_addr, addr)) {
+            if (!VICTIM_TLB_HIT(addr_write, addr)) {
+                tlb_fill(env_cpu(env), addr, size,
+                         MMU_DATA_LOAD, mmu_idx, retaddr);
+                index = tlb_index(env, mmu_idx, addr);
+                tlbe = tlb_entry(env, mmu_idx, addr);
+            }
+            tlb_addr = tlbe->addr_read & ~TLB_INVALID_MASK;
         }
-        tlb_addr = tlb_addr_write(tlbe) & ~TLB_INVALID_MASK;
     }
 
     /* Notice an IO access or a needs-MMU-lookup access */
@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
         goto stop_the_world;
     }
 
-    /* Let the guest notice RMW on a write-only page.  */
-    if (unlikely(tlbe->addr_read != (tlb_addr & ~TLB_NOTDIRTY))) {
-        tlb_fill(env_cpu(env), addr, 1 << s_bits, MMU_DATA_LOAD,
-                 mmu_idx, retaddr);
-        /* Since we don't support reads and writes to different addresses,
-           and we do have the proper page loaded for write, this shouldn't
-           ever return.  But just in case, handle via stop-the-world.  */
-        goto stop_the_world;
-    }
-
     hostaddr = (void *)((uintptr_t)addr + tlbe->addend);
 
     if (unlikely(tlb_addr & TLB_NOTDIRTY)) {
-        notdirty_write(env_cpu(env), addr, 1 << s_bits,
+        notdirty_write(env_cpu(env), addr, size,
                        &env_tlb(env)->d[mmu_idx].iotlb[index], retaddr);
     }
 
@@ -XXX,XX +XXX,XX @@ void cpu_stq_le_data(CPUArchState *env, target_ulong ptr, uint64_t val)
 #define ATOMIC_NAME(X) \
     HELPER(glue(glue(glue(atomic_ ## X, SUFFIX), END), _mmu))
 #define ATOMIC_MMU_DECLS
-#define ATOMIC_MMU_LOOKUP atomic_mmu_lookup(env, addr, oi, retaddr)
+#define ATOMIC_MMU_LOOKUP_RW \
+    atomic_mmu_lookup(env, addr, oi, DATA_SIZE, PAGE_READ | PAGE_WRITE, retaddr)
+#define ATOMIC_MMU_LOOKUP_R \
+    atomic_mmu_lookup(env, addr, oi, DATA_SIZE, PAGE_READ, retaddr)
+#define ATOMIC_MMU_LOOKUP_W \
+    atomic_mmu_lookup(env, addr, oi, DATA_SIZE, PAGE_WRITE, retaddr)
 #define ATOMIC_MMU_CLEANUP
 #define ATOMIC_MMU_IDX   get_mmuidx(oi)
 
@@ -XXX,XX +XXX,XX @@ void cpu_stq_le_data(CPUArchState *env, target_ulong ptr, uint64_t val)
 
 #undef EXTRA_ARGS
 #undef ATOMIC_NAME
-#undef ATOMIC_MMU_LOOKUP
+#undef ATOMIC_MMU_LOOKUP_RW
+#undef ATOMIC_MMU_LOOKUP_R
+#undef ATOMIC_MMU_LOOKUP_W
+
 #define EXTRA_ARGS         , TCGMemOpIdx oi
 #define ATOMIC_NAME(X)     HELPER(glue(glue(atomic_ ## X, SUFFIX), END))
-#define ATOMIC_MMU_LOOKUP  atomic_mmu_lookup(env, addr, oi, GETPC())
+#define ATOMIC_MMU_LOOKUP_RW \
+    atomic_mmu_lookup(env, addr, oi, DATA_SIZE, PAGE_READ | PAGE_WRITE, GETPC())
+#define ATOMIC_MMU_LOOKUP_R \
+    atomic_mmu_lookup(env, addr, oi, DATA_SIZE, PAGE_READ, GETPC())
+#define ATOMIC_MMU_LOOKUP_W \
+    atomic_mmu_lookup(env, addr, oi, DATA_SIZE, PAGE_WRITE, GETPC())
 
 #define DATA_SIZE 1
 #include "atomic_template.h"
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
 
 /* Macro to call the above, with local variables from the use context.  */
 #define ATOMIC_MMU_DECLS do {} while (0)
-#define ATOMIC_MMU_LOOKUP  atomic_mmu_lookup(env, addr, DATA_SIZE, GETPC())
+#define ATOMIC_MMU_LOOKUP_RW  atomic_mmu_lookup(env, addr, DATA_SIZE, GETPC())
+#define ATOMIC_MMU_LOOKUP_R   ATOMIC_MMU_LOOKUP_RW
+#define ATOMIC_MMU_LOOKUP_W   ATOMIC_MMU_LOOKUP_RW
 #define ATOMIC_MMU_CLEANUP do { clear_helper_retaddr(); } while (0)
 #define ATOMIC_MMU_IDX MMU_USER_IDX
 
@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
 
 #undef EXTRA_ARGS
 #undef ATOMIC_NAME
-#undef ATOMIC_MMU_LOOKUP
+#undef ATOMIC_MMU_LOOKUP_RW
 
 #define EXTRA_ARGS     , TCGMemOpIdx oi, uintptr_t retaddr
 #define ATOMIC_NAME(X) \
     HELPER(glue(glue(glue(atomic_ ## X, SUFFIX), END), _mmu))
-#define ATOMIC_MMU_LOOKUP  atomic_mmu_lookup(env, addr, DATA_SIZE, retaddr)
+#define ATOMIC_MMU_LOOKUP_RW  atomic_mmu_lookup(env, addr, DATA_SIZE, retaddr)
 
 #define DATA_SIZE 16
 #include "atomic_template.h"
-- 
2.25.1

We should not be aligning the offset in temp_allocate_frame,
because the odd offset produces an aligned address in the end.
Instead, pass the logical offset into tcg_set_frame and add
the stack bias last.

Cc: qemu-stable@nongnu.org
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg.c                  |  9 +++------
 tcg/sparc/tcg-target.c.inc | 16 ++++++++++------
 2 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static void check_regs(TCGContext *s)
 
 static void temp_allocate_frame(TCGContext *s, TCGTemp *ts)
 {
-#if !(defined(__sparc__) && TCG_TARGET_REG_BITS == 64)
-    /* Sparc64 stack is accessed with offset of 2047 */
-    s->current_frame_offset = (s->current_frame_offset +
-                               (tcg_target_long)sizeof(tcg_target_long) - 1) &
-        ~(sizeof(tcg_target_long) - 1);
-#endif
     if (s->current_frame_offset + (tcg_target_long)sizeof(tcg_target_long) >
         s->frame_end) {
         tcg_abort();
     }
     ts->mem_offset = s->current_frame_offset;
+#if defined(__sparc__)
+    ts->mem_offset += TCG_TARGET_STACK_BIAS;
+#endif
     ts->mem_base = s->frame_temp;
     ts->mem_allocated = 1;
     s->current_frame_offset += sizeof(tcg_target_long);
diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc/tcg-target.c.inc
+++ b/tcg/sparc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_target_qemu_prologue(TCGContext *s)
 {
     int tmp_buf_size, frame_size;
 
-    /* The TCG temp buffer is at the top of the frame, immediately
-       below the frame pointer.  */
+    /*
+     * The TCG temp buffer is at the top of the frame, immediately
+     * below the frame pointer.  Use the logical (aligned) offset here;
+     * the stack bias is applied in temp_allocate_frame().
+     */
     tmp_buf_size = CPU_TEMP_BUF_NLONGS * (int)sizeof(long);
-    tcg_set_frame(s, TCG_REG_I6, TCG_TARGET_STACK_BIAS - tmp_buf_size,
-                  tmp_buf_size);
+    tcg_set_frame(s, TCG_REG_I6, -tmp_buf_size, tmp_buf_size);
 
-    /* TCG_TARGET_CALL_STACK_OFFSET includes the stack bias, but is
-       otherwise the minimal frame usable by callees.  */
+    /*
+     * TCG_TARGET_CALL_STACK_OFFSET includes the stack bias, but is
+     * otherwise the minimal frame usable by callees.
+     */
     frame_size = TCG_TARGET_CALL_STACK_OFFSET - TCG_TARGET_STACK_BIAS;
     frame_size += TCG_STATIC_CALL_ARGS_SIZE + tmp_buf_size;
     frame_size += TCG_TARGET_STACK_ALIGN - 1;
-- 
2.25.1

This function should have been updated for vector types
when they were introduced.

Fixes: d2fd745fe8b
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/367
Cc: qemu-stable@nongnu.org
Tested-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg.c | 32 +++++++++++++++++++++++++++-----
 1 file changed, 27 insertions(+), 5 deletions(-)

diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static void check_regs(TCGContext *s)
 
 static void temp_allocate_frame(TCGContext *s, TCGTemp *ts)
 {
-    if (s->current_frame_offset + (tcg_target_long)sizeof(tcg_target_long) >
-        s->frame_end) {
-        tcg_abort();
+    size_t size, align;
+    intptr_t off;
+
+    switch (ts->type) {
+    case TCG_TYPE_I32:
+        size = align = 4;
+        break;
+    case TCG_TYPE_I64:
+    case TCG_TYPE_V64:
+        size = align = 8;
+        break;
+    case TCG_TYPE_V128:
+        size = align = 16;
+        break;
+    case TCG_TYPE_V256:
+        /* Note that we do not require aligned storage for V256. */
+        size = 32, align = 16;
+        break;
+    default:
+        g_assert_not_reached();
     }
-    ts->mem_offset = s->current_frame_offset;
+
+    assert(align <= TCG_TARGET_STACK_ALIGN);
+    off = ROUND_UP(s->current_frame_offset, align);
+    assert(off + size <= s->frame_end);
+    s->current_frame_offset = off + size;
+
+    ts->mem_offset = off;
 #if defined(__sparc__)
     ts->mem_offset += TCG_TARGET_STACK_BIAS;
 #endif
     ts->mem_base = s->frame_temp;
     ts->mem_allocated = 1;
-    s->current_frame_offset += sizeof(tcg_target_long);
 }
 
 static void temp_load(TCGContext *, TCGTemp *, TCGRegSet, TCGRegSet, TCGRegSet);
-- 
2.25.1

From: Alessandro Di Federico <ale@rev.ng>

This commit moves into a separate file routines used to manipulate
TCGCond. These will be employed by the idef-parser.

Signed-off-by: Alessandro Di Federico <ale@rev.ng>
Signed-off-by: Paolo Montesel <babush@rev.ng>
Message-Id: <20210619093713.1845446-2-ale.qemu@rev.ng>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg-cond.h | 101 +++++++++++++++++++++++++++++++++++++++++
 include/tcg/tcg.h      |  70 +---------------------------
 2 files changed, 102 insertions(+), 69 deletions(-)
 create mode 100644 include/tcg/tcg-cond.h

diff --git a/include/tcg/tcg-cond.h b/include/tcg/tcg-cond.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/tcg/tcg-cond.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Tiny Code Generator for QEMU
+ *
+ * Copyright (c) 2008 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#ifndef TCG_COND_H
+#define TCG_COND_H
+
+/*
+ * Conditions.  Note that these are laid out for easy manipulation by
+ * the functions below:
+ *    bit 0 is used for inverting;
+ *    bit 1 is signed,
+ *    bit 2 is unsigned,
+ *    bit 3 is used with bit 0 for swapping signed/unsigned.
+ */
+typedef enum {
+    /* non-signed */
+    TCG_COND_NEVER  = 0 | 0 | 0 | 0,
+    TCG_COND_ALWAYS = 0 | 0 | 0 | 1,
+    TCG_COND_EQ     = 8 | 0 | 0 | 0,
+    TCG_COND_NE     = 8 | 0 | 0 | 1,
+    /* signed */
+    TCG_COND_LT     = 0 | 0 | 2 | 0,
+    TCG_COND_GE     = 0 | 0 | 2 | 1,
+    TCG_COND_LE     = 8 | 0 | 2 | 0,
+    TCG_COND_GT     = 8 | 0 | 2 | 1,
+    /* unsigned */
+    TCG_COND_LTU    = 0 | 4 | 0 | 0,
+    TCG_COND_GEU    = 0 | 4 | 0 | 1,
+    TCG_COND_LEU    = 8 | 4 | 0 | 0,
+    TCG_COND_GTU    = 8 | 4 | 0 | 1,
+} TCGCond;
+
+/* Invert the sense of the comparison.  */
+static inline TCGCond tcg_invert_cond(TCGCond c)
+{
+    return (TCGCond)(c ^ 1);
+}
+
+/* Swap the operands in a comparison.  */
+static inline TCGCond tcg_swap_cond(TCGCond c)
+{
+    return c & 6 ? (TCGCond)(c ^ 9) : c;
+}
+
+/* Create an "unsigned" version of a "signed" comparison.  */
+static inline TCGCond tcg_unsigned_cond(TCGCond c)
+{
+    return c & 2 ? (TCGCond)(c ^ 6) : c;
+}
+
+/* Create a "signed" version of an "unsigned" comparison.  */
+static inline TCGCond tcg_signed_cond(TCGCond c)
+{
+    return c & 4 ? (TCGCond)(c ^ 6) : c;
+}
+
+/* Must a comparison be considered unsigned?  */
+static inline bool is_unsigned_cond(TCGCond c)
+{
+    return (c & 4) != 0;
+}
+
+/*
+ * Create a "high" version of a double-word comparison.
+ * This removes equality from a LTE or GTE comparison.
+ */
+static inline TCGCond tcg_high_cond(TCGCond c)
+{
+    switch (c) {
+    case TCG_COND_GE:
+    case TCG_COND_LE:
+    case TCG_COND_GEU:
+    case TCG_COND_LEU:
+        return (TCGCond)(c ^ 8);
+    default:
+        return c;
+    }
+}
+
+#endif /* TCG_COND_H */
diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@
 #include "tcg/tcg-mo.h"
 #include "tcg-target.h"
 #include "qemu/int128.h"
+#include "tcg/tcg-cond.h"
 
 /* XXX: make safe guess about sizes */
 #define MAX_OP_PER_INSTR 266
@@ -XXX,XX +XXX,XX @@ typedef TCGv_ptr TCGv_env;
 /* Used to align parameters.  See the comment before tcgv_i32_temp.  */
 #define TCG_CALL_DUMMY_ARG      ((TCGArg)0)
 
-/* Conditions.  Note that these are laid out for easy manipulation by
-   the functions below:
-     bit 0 is used for inverting;
-     bit 1 is signed,
-     bit 2 is unsigned,
-     bit 3 is used with bit 0 for swapping signed/unsigned.  */
-typedef enum {
-    /* non-signed */
-    TCG_COND_NEVER  = 0 | 0 | 0 | 0,
-    TCG_COND_ALWAYS = 0 | 0 | 0 | 1,
-    TCG_COND_EQ     = 8 | 0 | 0 | 0,
-    TCG_COND_NE     = 8 | 0 | 0 | 1,
-    /* signed */
-    TCG_COND_LT     = 0 | 0 | 2 | 0,
-    TCG_COND_GE     = 0 | 0 | 2 | 1,
-    TCG_COND_LE     = 8 | 0 | 2 | 0,
-    TCG_COND_GT     = 8 | 0 | 2 | 1,
-    /* unsigned */
-    TCG_COND_LTU    = 0 | 4 | 0 | 0,
-    TCG_COND_GEU    = 0 | 4 | 0 | 1,
-    TCG_COND_LEU    = 8 | 4 | 0 | 0,
-    TCG_COND_GTU    = 8 | 4 | 0 | 1,
-} TCGCond;
-
-/* Invert the sense of the comparison.  */
-static inline TCGCond tcg_invert_cond(TCGCond c)
-{
-    return (TCGCond)(c ^ 1);
-}
-
-/* Swap the operands in a comparison.  */
-static inline TCGCond tcg_swap_cond(TCGCond c)
-{
-    return c & 6 ? (TCGCond)(c ^ 9) : c;
-}
-
-/* Create an "unsigned" version of a "signed" comparison.  */
-static inline TCGCond tcg_unsigned_cond(TCGCond c)
-{
-    return c & 2 ? (TCGCond)(c ^ 6) : c;
-}
-
-/* Create a "signed" version of an "unsigned" comparison.  */
-static inline TCGCond tcg_signed_cond(TCGCond c)
-{
-    return c & 4 ? (TCGCond)(c ^ 6) : c;
-}
-
-/* Must a comparison be considered unsigned?  */
-static inline bool is_unsigned_cond(TCGCond c)
-{
-    return (c & 4) != 0;
-}
-
-/* Create a "high" version of a double-word comparison.
-   This removes equality from a LTE or GTE comparison.  */
-static inline TCGCond tcg_high_cond(TCGCond c)
-{
-    switch (c) {
-    case TCG_COND_GE:
-    case TCG_COND_LE:
-    case TCG_COND_GEU:
-    case TCG_COND_LEU:
-        return (TCGCond)(c ^ 8);
-    default:
-        return c;
-    }
-}
-
 typedef enum TCGTempVal {
     TEMP_VAL_DEAD,
     TEMP_VAL_REG,
-- 
2.25.1

From: Stefan Weil <sw@weilnetz.de>

The function is called with alignment == 0 which caused an assertion.
Use the code from oslib-posix.c to fix that regression.

Fixes: ed6f53f9ca9
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20210611105846.347954-1-sw@weilnetz.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 util/oslib-win32.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/util/oslib-win32.c b/util/oslib-win32.c
index XXXXXXX..XXXXXXX 100644
--- a/util/oslib-win32.c
+++ b/util/oslib-win32.c
@@ -XXX,XX +XXX,XX @@ void *qemu_try_memalign(size_t alignment, size_t size)
     void *ptr;
 
     g_assert(size != 0);
-    g_assert(is_power_of_2(alignment));
+    if (alignment < sizeof(void *)) {
+        alignment = sizeof(void *);
+    } else {
+        g_assert(is_power_of_2(alignment));
+    }
     ptr = _aligned_malloc(size, alignment);
     trace_qemu_memalign(alignment, size, ptr);
     return ptr;
-- 
2.25.1

The following changes since commit 57b6f58c1d0df757c9311496c32d502925056894:

Merge remote-tracking branch 'remotes/hreitz/tags/pull-block-2021-09-15' into staging (2021-09-15 18:55:59 +0100)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20210916

for you to fetch changes up to 50febfe212f24a9b91b4224d03f653415fddf8e1:

tcg/mips: Drop special alignment for code_gen_buffer (2021-09-16 09:37:39 -0400)

----------------------------------------------------------------
Restrict cpu_has_work to sysemu, and move to AccelOpsClass.
Move cpu_signal_handler declaration out of target/.
Misc tcg/mips/ cleanups.

----------------------------------------------------------------
Philippe Mathieu-Daudé (30):
      accel/tcg: Restrict cpu_handle_halt() to sysemu
      hw/core: Restrict cpu_has_work() to sysemu
      hw/core: Un-inline cpu_has_work()
      sysemu: Introduce AccelOpsClass::has_work()
      accel/kvm: Implement AccelOpsClass::has_work()
      accel/whpx: Implement AccelOpsClass::has_work()
      accel/tcg: Implement AccelOpsClass::has_work() as stub
      target/alpha: Restrict has_work() handler to sysemu
      target/arm: Restrict has_work() handler to sysemu and TCG
      target/avr: Restrict has_work() handler to sysemu
      target/cris: Restrict has_work() handler to sysemu
      target/hexagon: Remove unused has_work() handler
      target/hppa: Restrict has_work() handler to sysemu
      target/i386: Restrict has_work() handler to sysemu and TCG
      target/m68k: Restrict has_work() handler to sysemu
      target/microblaze: Restrict has_work() handler to sysemu
      target/mips: Restrict has_work() handler to sysemu and TCG
      target/nios2: Restrict has_work() handler to sysemu
      target/openrisc: Restrict has_work() handler to sysemu
      target/ppc: Introduce PowerPCCPUClass::has_work()
      target/ppc: Restrict has_work() handlers to sysemu and TCG
      target/riscv: Restrict has_work() handler to sysemu and TCG
      target/rx: Restrict has_work() handler to sysemu
      target/s390x: Restrict has_work() handler to sysemu and TCG
      target/sh4: Restrict has_work() handler to sysemu
      target/sparc: Remove pointless use of CONFIG_TCG definition
      target/sparc: Restrict has_work() handler to sysemu
      target/tricore: Restrict has_work() handler to sysemu
      target/xtensa: Restrict has_work() handler to sysemu
      accel: Add missing AccelOpsClass::has_work() and drop SysemuCPUOps one

Richard Henderson (5):
      include/exec: Move cpu_signal_handler declaration
      tcg/mips: Drop inline markers
      tcg/mips: Allow JAL to be out of range in tcg_out_bswap_subr
      tcg/mips: Unset TCG_TARGET_HAS_direct_jump
      tcg/mips: Drop special alignment for code_gen_buffer

There is nothing target specific about this.  The implementation
is host specific, but the declaration is 100% common.

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ static inline tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env,
     }
     return addr;
 }
+
+/**
+ * cpu_signal_handler
+ * @signum: host signal number
+ * @pinfo: host siginfo_t
+ * @puc: host ucontext_t
+ *
+ * To be called from the SIGBUS and SIGSEGV signal handler to inform the
+ * virtual cpu of exceptions.  Returns true if the signal was handled by
+ * the virtual CPU.
+ */
+int cpu_signal_handler(int signum, void *pinfo, void *puc);
+
 #else
 static inline void mmap_lock(void) {}
 static inline void mmap_unlock(void) {}
diff --git a/target/alpha/cpu.h b/target/alpha/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/cpu.h
+++ b/target/alpha/cpu.h
@@ -XXX,XX +XXX,XX @@ void alpha_cpu_do_unaligned_access(CPUState *cpu, vaddr addr,
                                    int mmu_idx, uintptr_t retaddr);
 
 #define cpu_list alpha_cpu_list
-#define cpu_signal_handler cpu_alpha_signal_handler
 
 typedef CPUAlphaState CPUArchState;
 typedef AlphaCPU ArchCPU;
@@ -XXX,XX +XXX,XX @@ void alpha_translate_init(void);
 #define CPU_RESOLVING_TYPE TYPE_ALPHA_CPU
 
 void alpha_cpu_list(void);
-/* you can call this signal handler from your SIGBUS and SIGSEGV
-   signal handlers to inform the virtual CPU of exceptions. non zero
-   is returned if the signal was handled by the virtual CPU.  */
-int cpu_alpha_signal_handler(int host_signum, void *pinfo,
-                             void *puc);
 bool alpha_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                         MMUAccessType access_type, int mmu_idx,
                         bool probe, uintptr_t retaddr);
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool is_a64(CPUARMState *env)
     return env->aarch64;
 }
 
-/* you can call this signal handler from your SIGBUS and SIGSEGV
-   signal handlers to inform the virtual CPU of exceptions. non zero
-   is returned if the signal was handled by the virtual CPU.  */
-int cpu_arm_signal_handler(int host_signum, void *pinfo,
-                           void *puc);
-
 /**
  * pmu_op_start/finish
  * @env: CPUARMState
@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);
 #define ARM_CPU_TYPE_NAME(name) (name ARM_CPU_TYPE_SUFFIX)
 #define CPU_RESOLVING_TYPE TYPE_ARM_CPU
 
-#define cpu_signal_handler cpu_arm_signal_handler
 #define cpu_list arm_cpu_list
 
 /* ARM has the following "translation regimes" (as the ARM ARM calls them):
diff --git a/target/avr/cpu.h b/target/avr/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/cpu.h
+++ b/target/avr/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline void set_avr_feature(CPUAVRState *env, int feature)
 }
 
 #define cpu_list avr_cpu_list
-#define cpu_signal_handler cpu_avr_signal_handler
 #define cpu_mmu_index avr_cpu_mmu_index
 
 static inline int avr_cpu_mmu_index(CPUAVRState *env, bool ifetch)
@@ -XXX,XX +XXX,XX @@ void avr_cpu_tcg_init(void);
 
 void avr_cpu_list(void);
 int cpu_avr_exec(CPUState *cpu);
-int cpu_avr_signal_handler(int host_signum, void *pinfo, void *puc);
 int avr_cpu_memory_rw_debug(CPUState *cs, vaddr address, uint8_t *buf,
                             int len, bool is_write);
 
diff --git a/target/cris/cpu.h b/target/cris/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/cpu.h
+++ b/target/cris/cpu.h
@@ -XXX,XX +XXX,XX @@ int crisv10_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
 int cris_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
 int cris_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 
-/* you can call this signal handler from your SIGBUS and SIGSEGV
-   signal handlers to inform the virtual CPU of exceptions. non zero
-   is returned if the signal was handled by the virtual CPU.  */
-int cpu_cris_signal_handler(int host_signum, void *pinfo,
-                           void *puc);
-
 void cris_initialize_tcg(void);
 void cris_initialize_crisv10_tcg(void);
 
@@ -XXX,XX +XXX,XX @@ enum {
 #define CRIS_CPU_TYPE_NAME(name) (name CRIS_CPU_TYPE_SUFFIX)
 #define CPU_RESOLVING_TYPE TYPE_CRIS_CPU
 
-#define cpu_signal_handler cpu_cris_signal_handler
-
 /* MMU modes definitions */
 #define MMU_USER_IDX 1
 static inline int cpu_mmu_index (CPUCRISState *env, bool ifetch)
diff --git a/target/hexagon/cpu.h b/target/hexagon/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/cpu.h
+++ b/target/hexagon/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct HexagonCPU {
 
 #include "cpu_bits.h"
 
-#define cpu_signal_handler cpu_hexagon_signal_handler
-int cpu_hexagon_signal_handler(int host_signum, void *pinfo, void *puc);
-
 static inline void cpu_get_tb_cpu_state(CPUHexagonState *env, target_ulong *pc,
                                         target_ulong *cs_base, uint32_t *flags)
 {
diff --git a/target/hppa/cpu.h b/target/hppa/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/cpu.h
+++ b/target/hppa/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline void cpu_hppa_change_prot_id(CPUHPPAState *env) { }
 void cpu_hppa_change_prot_id(CPUHPPAState *env);
 #endif
 
-#define cpu_signal_handler cpu_hppa_signal_handler
-
-int cpu_hppa_signal_handler(int host_signum, void *pinfo, void *puc);
 hwaddr hppa_cpu_get_phys_page_debug(CPUState *cs, vaddr addr);
 int hppa_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
 int hppa_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -XXX,XX +XXX,XX @@ void cpu_x86_frstor(CPUX86State *s, target_ulong ptr, int data32);
 void cpu_x86_fxsave(CPUX86State *s, target_ulong ptr);
 void cpu_x86_fxrstor(CPUX86State *s, target_ulong ptr);
 
-/* you can call this signal handler from your SIGBUS and SIGSEGV
-   signal handlers to inform the virtual CPU of exceptions. non zero
-   is returned if the signal was handled by the virtual CPU.  */
-int cpu_x86_signal_handler(int host_signum, void *pinfo,
-                           void *puc);
-
 /* cpu.c */
 void x86_cpu_vendor_words2str(char *dst, uint32_t vendor1,
                               uint32_t vendor2, uint32_t vendor3);
@@ -XXX,XX +XXX,XX @@ uint64_t cpu_get_tsc(CPUX86State *env);
 #define TARGET_DEFAULT_CPU_TYPE X86_CPU_TYPE_NAME("qemu32")
 #endif
 
-#define cpu_signal_handler cpu_x86_signal_handler
 #define cpu_list x86_cpu_list
 
 /* MMU modes definitions */
diff --git a/target/m68k/cpu.h b/target/m68k/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/cpu.h
+++ b/target/m68k/cpu.h
@@ -XXX,XX +XXX,XX @@ int m68k_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 
 void m68k_tcg_init(void);
 void m68k_cpu_init_gdb(M68kCPU *cpu);
-/*
- * you can call this signal handler from your SIGBUS and SIGSEGV
- * signal handlers to inform the virtual CPU of exceptions. non zero
- * is returned if the signal was handled by the virtual CPU.
- */
-int cpu_m68k_signal_handler(int host_signum, void *pinfo,
-                           void *puc);
 uint32_t cpu_m68k_get_ccr(CPUM68KState *env);
 void cpu_m68k_set_ccr(CPUM68KState *env, uint32_t);
 void cpu_m68k_set_sr(CPUM68KState *env, uint32_t);
@@ -XXX,XX +XXX,XX @@ enum {
 #define M68K_CPU_TYPE_NAME(model) model M68K_CPU_TYPE_SUFFIX
 #define CPU_RESOLVING_TYPE TYPE_M68K_CPU
 
-#define cpu_signal_handler cpu_m68k_signal_handler
 #define cpu_list m68k_cpu_list
 
 /* MMU modes definitions */
diff --git a/target/microblaze/cpu.h b/target/microblaze/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.h
+++ b/target/microblaze/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline void mb_cpu_write_msr(CPUMBState *env, uint32_t val)
 }
 
 void mb_tcg_init(void);
-/* you can call this signal handler from your SIGBUS and SIGSEGV
-   signal handlers to inform the virtual CPU of exceptions. non zero
-   is returned if the signal was handled by the virtual CPU.  */
-int cpu_mb_signal_handler(int host_signum, void *pinfo,
-                          void *puc);
 
 #define CPU_RESOLVING_TYPE TYPE_MICROBLAZE_CPU
 
-#define cpu_signal_handler cpu_mb_signal_handler
-
 /* MMU modes definitions */
 #define MMU_NOMMU_IDX   0
 #define MMU_KERNEL_IDX  1
diff --git a/target/mips/cpu.h b/target/mips/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/cpu.h
+++ b/target/mips/cpu.h
@@ -XXX,XX +XXX,XX @@ struct MIPSCPU {
 
 void mips_cpu_list(void);
 
-#define cpu_signal_handler cpu_mips_signal_handler
 #define cpu_list mips_cpu_list
 
 extern void cpu_wrdsp(uint32_t rs, uint32_t mask_num, CPUMIPSState *env);
@@ -XXX,XX +XXX,XX @@ enum {
  */
 #define CPU_INTERRUPT_WAKE CPU_INTERRUPT_TGT_INT_0
 
-int cpu_mips_signal_handler(int host_signum, void *pinfo, void *puc);
-
 #define MIPS_CPU_TYPE_SUFFIX "-" TYPE_MIPS_CPU
 #define MIPS_CPU_TYPE_NAME(model) model MIPS_CPU_TYPE_SUFFIX
 #define CPU_RESOLVING_TYPE TYPE_MIPS_CPU
diff --git a/target/mips/internal.h b/target/mips/internal.h
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/internal.h
+++ b/target/mips/internal.h
@@ -XXX,XX +XXX,XX @@ extern const VMStateDescription vmstate_mips_cpu;
 
 #endif /* !CONFIG_USER_ONLY */
 
-#define cpu_signal_handler cpu_mips_signal_handler
-
 static inline bool cpu_mips_hw_interrupts_enabled(CPUMIPSState *env)
 {
     return (env->CP0_Status & (1 << CP0St_IE)) &&
diff --git a/target/nios2/cpu.h b/target/nios2/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/cpu.h
+++ b/target/nios2/cpu.h
@@ -XXX,XX +XXX,XX @@ struct Nios2CPU {
 
 void nios2_tcg_init(void);
 void nios2_cpu_do_interrupt(CPUState *cs);
-int cpu_nios2_signal_handler(int host_signum, void *pinfo, void *puc);
 void dump_mmu(CPUNios2State *env);
 void nios2_cpu_dump_state(CPUState *cpu, FILE *f, int flags);
 hwaddr nios2_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
@@ -XXX,XX +XXX,XX @@ void do_nios2_semihosting(CPUNios2State *env);
 #define CPU_RESOLVING_TYPE TYPE_NIOS2_CPU
 
 #define cpu_gen_code cpu_nios2_gen_code
-#define cpu_signal_handler cpu_nios2_signal_handler
 
 #define CPU_SAVE_VERSION 1
 
diff --git a/target/openrisc/cpu.h b/target/openrisc/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/cpu.h
+++ b/target/openrisc/cpu.h
@@ -XXX,XX +XXX,XX @@ void openrisc_translate_init(void);
 bool openrisc_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                            MMUAccessType access_type, int mmu_idx,
                            bool probe, uintptr_t retaddr);
-int cpu_openrisc_signal_handler(int host_signum, void *pinfo, void *puc);
 int print_insn_or1k(bfd_vma addr, disassemble_info *info);
 
 #define cpu_list cpu_openrisc_list
-#define cpu_signal_handler cpu_openrisc_signal_handler
 
 #ifndef CONFIG_USER_ONLY
 extern const VMStateDescription vmstate_openrisc_cpu;
diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -XXX,XX +XXX,XX @@ extern const VMStateDescription vmstate_ppc_cpu;
 
 /*****************************************************************************/
 void ppc_translate_init(void);
-/*
- * you can call this signal handler from your SIGBUS and SIGSEGV
- * signal handlers to inform the virtual CPU of exceptions. non zero
- * is returned if the signal was handled by the virtual CPU.
- */
-int cpu_ppc_signal_handler(int host_signum, void *pinfo, void *puc);
 bool ppc_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                       MMUAccessType access_type, int mmu_idx,
                       bool probe, uintptr_t retaddr);
@@ -XXX,XX +XXX,XX @@ int ppc_dcr_write(ppc_dcr_t *dcr_env, int dcrn, uint32_t val);
 #define POWERPC_CPU_TYPE_NAME(model) model POWERPC_CPU_TYPE_SUFFIX
 #define CPU_RESOLVING_TYPE TYPE_POWERPC_CPU
 
-#define cpu_signal_handler cpu_ppc_signal_handler
 #define cpu_list ppc_cpu_list
 
 /* MMU modes definitions */
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
 char *riscv_isa_string(RISCVCPU *cpu);
 void riscv_cpu_list(void);
 
-#define cpu_signal_handler riscv_cpu_signal_handler
 #define cpu_list riscv_cpu_list
 #define cpu_mmu_index riscv_cpu_mmu_index
 
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_rdtime_fn(CPURISCVState *env, uint64_t (*fn)(uint32_t),
 void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv);
 
 void riscv_translate_init(void);
-int riscv_cpu_signal_handler(int host_signum, void *pinfo, void *puc);
 void QEMU_NORETURN riscv_raise_exception(CPURISCVState *env,
                                          uint32_t exception, uintptr_t pc);
 
diff --git a/target/rx/cpu.h b/target/rx/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/cpu.h
+++ b/target/rx/cpu.h
@@ -XXX,XX +XXX,XX @@ int rx_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 hwaddr rx_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
 
 void rx_translate_init(void);
-int cpu_rx_signal_handler(int host_signum, void *pinfo,
-                           void *puc);
-
 void rx_cpu_list(void);
 void rx_cpu_unpack_psw(CPURXState *env, uint32_t psw, int rte);
 
-#define cpu_signal_handler cpu_rx_signal_handler
 #define cpu_list rx_cpu_list
 
 #include "exec/cpu-all.h"
diff --git a/target/s390x/cpu.h b/target/s390x/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/cpu.h
+++ b/target/s390x/cpu.h
@@ -XXX,XX +XXX,XX @@ void s390_set_qemu_cpu_model(uint16_t type, uint8_t gen, uint8_t ec_ga,
 #define S390_CPU_TYPE_NAME(name) (name S390_CPU_TYPE_SUFFIX)
 #define CPU_RESOLVING_TYPE TYPE_S390_CPU
 
-/* you can call this signal handler from your SIGBUS and SIGSEGV
-   signal handlers to inform the virtual CPU of exceptions. non zero
-   is returned if the signal was handled by the virtual CPU.  */
-int cpu_s390x_signal_handler(int host_signum, void *pinfo, void *puc);
-#define cpu_signal_handler cpu_s390x_signal_handler
-
-
 /* interrupt.c */
 #define RA_IGNORED                  0
 void s390_program_interrupt(CPUS390XState *env, uint32_t code, uintptr_t ra);
diff --git a/target/sh4/cpu.h b/target/sh4/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.h
+++ b/target/sh4/cpu.h
@@ -XXX,XX +XXX,XX @@ void superh_cpu_do_unaligned_access(CPUState *cpu, vaddr addr,
                                     int mmu_idx, uintptr_t retaddr);
 
 void sh4_translate_init(void);
-int cpu_sh4_signal_handler(int host_signum, void *pinfo,
-                           void *puc);
 bool superh_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                          MMUAccessType access_type, int mmu_idx,
                          bool probe, uintptr_t retaddr);
@@ -XXX,XX +XXX,XX @@ void cpu_load_tlb(CPUSH4State * env);
 #define SUPERH_CPU_TYPE_NAME(model) model SUPERH_CPU_TYPE_SUFFIX
 #define CPU_RESOLVING_TYPE TYPE_SUPERH_CPU
 
-#define cpu_signal_handler cpu_sh4_signal_handler
 #define cpu_list sh4_cpu_list
 
 /* MMU modes definitions */
diff --git a/target/sparc/cpu.h b/target/sparc/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.h
+++ b/target/sparc/cpu.h
@@ -XXX,XX +XXX,XX @@ hwaddr cpu_get_phys_page_nofault(CPUSPARCState *env, target_ulong addr,
                                            int mmu_idx);
 #endif
 #endif
-int cpu_sparc_signal_handler(int host_signum, void *pinfo, void *puc);
 
 #define SPARC_CPU_TYPE_SUFFIX "-" TYPE_SPARC_CPU
 #define SPARC_CPU_TYPE_NAME(model) model SPARC_CPU_TYPE_SUFFIX
 #define CPU_RESOLVING_TYPE TYPE_SPARC_CPU
 
-#define cpu_signal_handler cpu_sparc_signal_handler
 #define cpu_list sparc_cpu_list
 
 /* MMU modes definitions */
diff --git a/target/tricore/cpu.h b/target/tricore/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/cpu.h
+++ b/target/tricore/cpu.h
@@ -XXX,XX +XXX,XX @@ void fpu_set_state(CPUTriCoreState *env);
 
 void tricore_cpu_list(void);
 
-#define cpu_signal_handler cpu_tricore_signal_handler
 #define cpu_list tricore_cpu_list
 
 static inline int cpu_mmu_index(CPUTriCoreState *env, bool ifetch)
@@ -XXX,XX +XXX,XX @@ typedef TriCoreCPU ArchCPU;
 
 void cpu_state_reset(CPUTriCoreState *s);
 void tricore_tcg_init(void);
-int cpu_tricore_signal_handler(int host_signum, void *pinfo, void *puc);
 
 static inline void cpu_get_tb_cpu_state(CPUTriCoreState *env, target_ulong *pc,
                                         target_ulong *cs_base, uint32_t *flags)
diff --git a/target/xtensa/cpu.h b/target/xtensa/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.h
+++ b/target/xtensa/cpu.h
@@ -XXX,XX +XXX,XX @@ void xtensa_cpu_do_unaligned_access(CPUState *cpu, vaddr addr,
                                     MMUAccessType access_type,
                                     int mmu_idx, uintptr_t retaddr);
 
-#define cpu_signal_handler cpu_xtensa_signal_handler
 #define cpu_list xtensa_cpu_list
 
 #define XTENSA_CPU_TYPE_SUFFIX "-" TYPE_XTENSA_CPU
@@ -XXX,XX +XXX,XX @@ void check_interrupts(CPUXtensaState *s);
 void xtensa_irq_init(CPUXtensaState *env);
 qemu_irq *xtensa_get_extints(CPUXtensaState *env);
 qemu_irq xtensa_get_runstall(CPUXtensaState *env);
-int cpu_xtensa_signal_handler(int host_signum, void *pinfo, void *puc);
 void xtensa_cpu_list(void);
 void xtensa_sync_window_from_phys(CPUXtensaState *env);
 void xtensa_sync_phys_from_window(CPUXtensaState *env);
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Commit 372579427a5 ("tcg: enable thread-per-vCPU") added the following
comment describing EXCP_HALTED in qemu_tcg_cpu_thread_fn():

case EXCP_HALTED:
         /* during start-up the vCPU is reset and the thread is
          * kicked several times. If we don't ensure we go back
          * to sleep in the halted state we won't cleanly
          * start-up when the vCPU is enabled.
          *
          * cpu->halted should ensure we sleep in wait_io_event
          */
         g_assert(cpu->halted);
         break;

qemu_wait_io_event() is sysemu-specific, so we can restrict the
cpu_handle_halt() call in cpu_exec() to system emulation.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-2-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline void tb_add_jump(TranslationBlock *tb, int n,
 
 static inline bool cpu_handle_halt(CPUState *cpu)
 {
+#ifndef CONFIG_USER_ONLY
     if (cpu->halted) {
-#if defined(TARGET_I386) && !defined(CONFIG_USER_ONLY)
+#if defined(TARGET_I386)
         if (cpu->interrupt_request & CPU_INTERRUPT_POLL) {
             X86CPU *x86_cpu = X86_CPU(cpu);
             qemu_mutex_lock_iothread();
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_halt(CPUState *cpu)
             cpu_reset_interrupt(cpu, CPU_INTERRUPT_POLL);
             qemu_mutex_unlock_iothread();
         }
-#endif
+#endif /* TARGET_I386 */
         if (!cpu_has_work(cpu)) {
             return true;
         }
 
         cpu->halted = 0;
     }
+#endif /* !CONFIG_USER_ONLY */
 
     return false;
 }
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

cpu_has_work() is only called from system emulation code.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-3-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h | 32 ++++++++++++++++----------------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ enum CPUDumpFlags {
 void cpu_dump_state(CPUState *cpu, FILE *f, int flags);
 
 #ifndef CONFIG_USER_ONLY
+/**
+ * cpu_has_work:
+ * @cpu: The vCPU to check.
+ *
+ * Checks whether the CPU has work to do.
+ *
+ * Returns: %true if the CPU has work, %false otherwise.
+ */
+static inline bool cpu_has_work(CPUState *cpu)
+{
+    CPUClass *cc = CPU_GET_CLASS(cpu);
+
+    g_assert(cc->has_work);
+    return cc->has_work(cpu);
+}
+
 /**
  * cpu_get_phys_page_attrs_debug:
  * @cpu: The CPU to obtain the physical page address for.
@@ -XXX,XX +XXX,XX @@ CPUState *cpu_create(const char *typename);
  */
 const char *parse_cpu_option(const char *cpu_option);
 
-/**
- * cpu_has_work:
- * @cpu: The vCPU to check.
- *
- * Checks whether the CPU has work to do.
- *
- * Returns: %true if the CPU has work, %false otherwise.
- */
-static inline bool cpu_has_work(CPUState *cpu)
-{
-    CPUClass *cc = CPU_GET_CLASS(cpu);
-
-    g_assert(cc->has_work);
-    return cc->has_work(cpu);
-}
-
 /**
  * qemu_cpu_is_self:
  * @cpu: The vCPU to check against.
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We want to make cpu_has_work() per-accelerator. Only declare its
prototype and move its definition to softmmu/cpus.c.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-4-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h | 8 +-------
 softmmu/cpus.c        | 8 ++++++++
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ void cpu_dump_state(CPUState *cpu, FILE *f, int flags);
  *
  * Returns: %true if the CPU has work, %false otherwise.
  */
-static inline bool cpu_has_work(CPUState *cpu)
-{
-    CPUClass *cc = CPU_GET_CLASS(cpu);
-
-    g_assert(cc->has_work);
-    return cc->has_work(cpu);
-}
+bool cpu_has_work(CPUState *cpu);
 
 /**
  * cpu_get_phys_page_attrs_debug:
diff --git a/softmmu/cpus.c b/softmmu/cpus.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/cpus.c
+++ b/softmmu/cpus.c
@@ -XXX,XX +XXX,XX @@ void cpu_interrupt(CPUState *cpu, int mask)
     }
 }
 
+bool cpu_has_work(CPUState *cpu)
+{
+    CPUClass *cc = CPU_GET_CLASS(cpu);
+
+    g_assert(cc->has_work);
+    return cc->has_work(cpu);
+}
+
 static int do_vm_stop(RunState state, bool send_stop)
 {
     int ret = 0;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Introduce an accelerator-specific has_work() handler.
Eventually call it from cpu_has_work().

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-5-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/sysemu/accel-ops.h | 5 +++++
 softmmu/cpus.c             | 3 +++
 2 files changed, 8 insertions(+)

diff --git a/include/sysemu/accel-ops.h b/include/sysemu/accel-ops.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/accel-ops.h
+++ b/include/sysemu/accel-ops.h
@@ -XXX,XX +XXX,XX @@ struct AccelOpsClass {
     void (*create_vcpu_thread)(CPUState *cpu); /* MANDATORY NON-NULL */
     void (*kick_vcpu_thread)(CPUState *cpu);
 
+    /**
+     * @has_work: Callback for checking if there is work to do.
+     */
+    bool (*has_work)(CPUState *cpu);
+
     void (*synchronize_post_reset)(CPUState *cpu);
     void (*synchronize_post_init)(CPUState *cpu);
     void (*synchronize_state)(CPUState *cpu);
diff --git a/softmmu/cpus.c b/softmmu/cpus.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/cpus.c
+++ b/softmmu/cpus.c
@@ -XXX,XX +XXX,XX @@ bool cpu_has_work(CPUState *cpu)
 {
     CPUClass *cc = CPU_GET_CLASS(cpu);
 
+    if (cpus_accel->has_work) {
+        return cpus_accel->has_work(cpu);
+    }
     g_assert(cc->has_work);
     return cc->has_work(cpu);
 }
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Implement KVM has_work() handler in AccelOpsClass and
remove it from cpu_thread_is_idle() since cpu_has_work()
is already called.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-6-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/kvm/kvm-accel-ops.c | 6 ++++++
 softmmu/cpus.c            | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/accel/kvm/kvm-accel-ops.c b/accel/kvm/kvm-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/kvm/kvm-accel-ops.c
+++ b/accel/kvm/kvm-accel-ops.c
@@ -XXX,XX +XXX,XX @@ static void kvm_start_vcpu_thread(CPUState *cpu)
                        cpu, QEMU_THREAD_JOINABLE);
 }
 
+static bool kvm_cpu_has_work(CPUState *cpu)
+{
+    return kvm_halt_in_kernel();
+}
+
 static void kvm_accel_ops_class_init(ObjectClass *oc, void *data)
 {
     AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void kvm_accel_ops_class_init(ObjectClass *oc, void *data)
     ops->synchronize_post_init = kvm_cpu_synchronize_post_init;
     ops->synchronize_state = kvm_cpu_synchronize_state;
     ops->synchronize_pre_loadvm = kvm_cpu_synchronize_pre_loadvm;
+    ops->has_work = kvm_cpu_has_work;
 }
 
 static const TypeInfo kvm_accel_ops_type = {
diff --git a/softmmu/cpus.c b/softmmu/cpus.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/cpus.c
+++ b/softmmu/cpus.c
@@ -XXX,XX +XXX,XX @@ bool cpu_thread_is_idle(CPUState *cpu)
         return true;
     }
     if (!cpu->halted || cpu_has_work(cpu) ||
-        kvm_halt_in_kernel() || whpx_apic_in_platform()) {
+        whpx_apic_in_platform()) {
         return false;
     }
     return true;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Implement WHPX has_work() handler in AccelOpsClass and
remove it from cpu_thread_is_idle() since cpu_has_work()
is already called.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-7-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 softmmu/cpus.c                    | 4 +---
 target/i386/whpx/whpx-accel-ops.c | 6 ++++++
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/softmmu/cpus.c b/softmmu/cpus.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/cpus.c
+++ b/softmmu/cpus.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/replay.h"
 #include "sysemu/runstate.h"
 #include "sysemu/cpu-timers.h"
-#include "sysemu/whpx.h"
 #include "hw/boards.h"
 #include "hw/hw.h"
 #include "trace.h"
@@ -XXX,XX +XXX,XX @@ bool cpu_thread_is_idle(CPUState *cpu)
     if (cpu_is_stopped(cpu)) {
         return true;
     }
-    if (!cpu->halted || cpu_has_work(cpu) ||
-        whpx_apic_in_platform()) {
+    if (!cpu->halted || cpu_has_work(cpu)) {
         return false;
     }
     return true;
diff --git a/target/i386/whpx/whpx-accel-ops.c b/target/i386/whpx/whpx-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/whpx/whpx-accel-ops.c
+++ b/target/i386/whpx/whpx-accel-ops.c
@@ -XXX,XX +XXX,XX @@ static void whpx_kick_vcpu_thread(CPUState *cpu)
     }
 }
 
+static bool whpx_cpu_has_work(CPUState *cpu)
+{
+    return whpx_apic_in_platform();
+}
+
 static void whpx_accel_ops_class_init(ObjectClass *oc, void *data)
 {
     AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void whpx_accel_ops_class_init(ObjectClass *oc, void *data)
     ops->synchronize_post_init = whpx_cpu_synchronize_post_init;
     ops->synchronize_state = whpx_cpu_synchronize_state;
     ops->synchronize_pre_loadvm = whpx_cpu_synchronize_pre_loadvm;
+    ops->has_work = whpx_cpu_has_work;
 }
 
 static const TypeInfo whpx_accel_ops_type = {
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Add TCG target-specific has_work() handler in TCGCPUOps,
and add tcg_cpu_has_work() as AccelOpsClass has_work()
implementation.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-8-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/tcg-cpu-ops.h |  4 ++++
 accel/tcg/tcg-accel-ops.c     | 12 ++++++++++++
 2 files changed, 16 insertions(+)

diff --git a/include/hw/core/tcg-cpu-ops.h b/include/hw/core/tcg-cpu-ops.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/tcg-cpu-ops.h
+++ b/include/hw/core/tcg-cpu-ops.h
@@ -XXX,XX +XXX,XX @@ struct TCGCPUOps {
     void (*do_interrupt)(CPUState *cpu);
 #endif /* !CONFIG_USER_ONLY || !TARGET_I386 */
 #ifdef CONFIG_SOFTMMU
+    /**
+     * @has_work: Callback for checking if there is work to do.
+     */
+    bool (*has_work)(CPUState *cpu);
     /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
     bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
     /**
diff --git a/accel/tcg/tcg-accel-ops.c b/accel/tcg/tcg-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-accel-ops.c
+++ b/accel/tcg/tcg-accel-ops.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/main-loop.h"
 #include "qemu/guest-random.h"
 #include "exec/exec-all.h"
+#include "hw/core/tcg-cpu-ops.h"
 
 #include "tcg-accel-ops.h"
 #include "tcg-accel-ops-mttcg.h"
@@ -XXX,XX +XXX,XX @@ int tcg_cpus_exec(CPUState *cpu)
     return ret;
 }
 
+static bool tcg_cpu_has_work(CPUState *cpu)
+{
+    CPUClass *cc = CPU_GET_CLASS(cpu);
+
+    if (!cc->tcg_ops->has_work) {
+        return false;
+    }
+    return cc->tcg_ops->has_work(cpu);
+}
+
 /* mask must never be zero, except for A20 change call */
 void tcg_handle_interrupt(CPUState *cpu, int mask)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_accel_ops_init(AccelOpsClass *ops)
         ops->kick_vcpu_thread = rr_kick_vcpu_thread;
         ops->handle_interrupt = tcg_handle_interrupt;
     }
+    ops->has_work = tcg_cpu_has_work;
 }
 
 static void tcg_accel_ops_class_init(ObjectClass *oc, void *data)
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-9-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/alpha/cpu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.pc = value;
 }
 
+#if !defined(CONFIG_USER_ONLY)
 static bool alpha_cpu_has_work(CPUState *cs)
 {
     /* Here we are checking to see if the CPU should wake up from HALT.
@@ -XXX,XX +XXX,XX @@ static bool alpha_cpu_has_work(CPUState *cs)
                                     | CPU_INTERRUPT_SMP
                                     | CPU_INTERRUPT_MCHK);
 }
+#endif /* !CONFIG_USER_ONLY */
 
 static void alpha_cpu_disas_set_info(CPUState *cpu, disassemble_info *info)
 {
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps alpha_tcg_ops = {
     .tlb_fill = alpha_cpu_tlb_fill,
 
 #ifndef CONFIG_USER_ONLY
+    .has_work = alpha_cpu_has_work,
     .cpu_exec_interrupt = alpha_cpu_exec_interrupt,
     .do_interrupt = alpha_cpu_do_interrupt,
     .do_transaction_failed = alpha_cpu_do_transaction_failed,
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
                                     &acc->parent_realize);
 
     cc->class_by_name = alpha_cpu_class_by_name;
-    cc->has_work = alpha_cpu_has_work;
     cc->dump_state = alpha_cpu_dump_state;
     cc->set_pc = alpha_cpu_set_pc;
     cc->gdb_read_register = alpha_cpu_gdb_read_register;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to TCG sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-10-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/cpu.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_synchronize_from_tb(CPUState *cs,
         env->regs[15] = tb->pc;
     }
 }
-#endif /* CONFIG_TCG */
 
+#ifndef CONFIG_USER_ONLY
 static bool arm_cpu_has_work(CPUState *cs)
 {
     ARMCPU *cpu = ARM_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool arm_cpu_has_work(CPUState *cs)
          | CPU_INTERRUPT_VFIQ | CPU_INTERRUPT_VIRQ
          | CPU_INTERRUPT_EXITTB);
 }
+#endif /* !CONFIG_USER_ONLY */
+
+#endif /* CONFIG_TCG */
 
 void arm_register_pre_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
                                  void *opaque)
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps arm_tcg_ops = {
     .debug_excp_handler = arm_debug_excp_handler,
 
 #if !defined(CONFIG_USER_ONLY)
+    .has_work = arm_cpu_has_work,
     .cpu_exec_interrupt = arm_cpu_exec_interrupt,
     .do_interrupt = arm_cpu_do_interrupt,
     .do_transaction_failed = arm_cpu_do_transaction_failed,
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     device_class_set_parent_reset(dc, arm_cpu_reset, &acc->parent_reset);
 
     cc->class_by_name = arm_cpu_class_by_name;
-    cc->has_work = arm_cpu_has_work;
     cc->dump_state = arm_cpu_dump_state;
     cc->set_pc = arm_cpu_set_pc;
     cc->gdb_read_register = arm_cpu_gdb_read_register;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-11-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps avr_sysemu_ops = {
 static const struct TCGCPUOps avr_tcg_ops = {
     .initialize = avr_cpu_tcg_init,
     .synchronize_from_tb = avr_cpu_synchronize_from_tb,
+    .has_work = avr_cpu_has_work,
     .cpu_exec_interrupt = avr_cpu_exec_interrupt,
     .tlb_fill = avr_cpu_tlb_fill,
     .do_interrupt = avr_cpu_do_interrupt,
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = avr_cpu_class_by_name;
 
-    cc->has_work = avr_cpu_has_work;
     cc->dump_state = avr_cpu_dump_state;
     cc->set_pc = avr_cpu_set_pc;
     cc->memory_rw_debug = avr_cpu_memory_rw_debug;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-12-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/cris/cpu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/cris/cpu.c b/target/cris/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/cpu.c
+++ b/target/cris/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.pc = value;
 }
 
+#if !defined(CONFIG_USER_ONLY)
 static bool cris_cpu_has_work(CPUState *cs)
 {
     return cs->interrupt_request & (CPU_INTERRUPT_HARD | CPU_INTERRUPT_NMI);
 }
+#endif /* !CONFIG_USER_ONLY */
 
 static void cris_cpu_reset(DeviceState *dev)
 {
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps crisv10_tcg_ops = {
     .tlb_fill = cris_cpu_tlb_fill,
 
 #ifndef CONFIG_USER_ONLY
+    .has_work = cris_cpu_has_work,
     .cpu_exec_interrupt = cris_cpu_exec_interrupt,
     .do_interrupt = crisv10_cpu_do_interrupt,
 #endif /* !CONFIG_USER_ONLY */
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
     device_class_set_parent_reset(dc, cris_cpu_reset, &ccc->parent_reset);
 
     cc->class_by_name = cris_cpu_class_by_name;
-    cc->has_work = cris_cpu_has_work;
     cc->dump_state = cris_cpu_dump_state;
     cc->set_pc = cris_cpu_set_pc;
     cc->gdb_read_register = cris_cpu_gdb_read_register;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

has_work() is sysemu specific, and Hexagon target only provides
a linux-user implementation. Remove the unused hexagon_cpu_has_work().

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-13-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/hexagon/cpu.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/cpu.c
+++ b/target/hexagon/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hexagon_cpu_synchronize_from_tb(CPUState *cs,
     env->gpr[HEX_REG_PC] = tb->pc;
 }
 
-static bool hexagon_cpu_has_work(CPUState *cs)
-{
-    return true;
-}
-
 void restore_state_to_opc(CPUHexagonState *env, TranslationBlock *tb,
                           target_ulong *data)
 {
@@ -XXX,XX +XXX,XX @@ static void hexagon_cpu_class_init(ObjectClass *c, void *data)
     device_class_set_parent_reset(dc, hexagon_cpu_reset, &mcc->parent_reset);
 
     cc->class_by_name = hexagon_cpu_class_by_name;
-    cc->has_work = hexagon_cpu_has_work;
     cc->dump_state = hexagon_dump_state;
     cc->set_pc = hexagon_cpu_set_pc;
     cc->gdb_read_register = hexagon_gdb_read_register;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-14-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/hppa/cpu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_synchronize_from_tb(CPUState *cs,
     cpu->env.psw_n = (tb->flags & PSW_N) != 0;
 }
 
+#if !defined(CONFIG_USER_ONLY)
 static bool hppa_cpu_has_work(CPUState *cs)
 {
     return cs->interrupt_request & CPU_INTERRUPT_HARD;
 }
+#endif /* !CONFIG_USER_ONLY */
 
 static void hppa_cpu_disas_set_info(CPUState *cs, disassemble_info *info)
 {
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps hppa_tcg_ops = {
     .tlb_fill = hppa_cpu_tlb_fill,
 
 #ifndef CONFIG_USER_ONLY
+    .has_work = hppa_cpu_has_work,
     .cpu_exec_interrupt = hppa_cpu_exec_interrupt,
     .do_interrupt = hppa_cpu_do_interrupt,
     .do_unaligned_access = hppa_cpu_do_unaligned_access,
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
                                     &acc->parent_realize);
 
     cc->class_by_name = hppa_cpu_class_by_name;
-    cc->has_work = hppa_cpu_has_work;
     cc->dump_state = hppa_cpu_dump_state;
     cc->set_pc = hppa_cpu_set_pc;
     cc->gdb_read_register = hppa_cpu_gdb_read_register;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to TCG sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-15-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/i386/cpu.c         | 6 ------
 target/i386/tcg/tcg-cpu.c | 8 +++++++-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -XXX,XX +XXX,XX @@ int x86_cpu_pending_interrupt(CPUState *cs, int interrupt_request)
     return 0;
 }
 
-static bool x86_cpu_has_work(CPUState *cs)
-{
-    return x86_cpu_pending_interrupt(cs, cs->interrupt_request) != 0;
-}
-
 static void x86_disas_set_info(CPUState *cs, disassemble_info *info)
 {
     X86CPU *cpu = X86_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static void x86_cpu_common_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = x86_cpu_class_by_name;
     cc->parse_features = x86_cpu_parse_featurestr;
-    cc->has_work = x86_cpu_has_work;
     cc->dump_state = x86_cpu_dump_state;
     cc->set_pc = x86_cpu_set_pc;
     cc->gdb_read_register = x86_cpu_gdb_read_register;
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void x86_cpu_synchronize_from_tb(CPUState *cs,
 }
 
 #ifndef CONFIG_USER_ONLY
+static bool x86_cpu_has_work(CPUState *cs)
+{
+    return x86_cpu_pending_interrupt(cs, cs->interrupt_request) != 0;
+}
+
 static bool x86_debug_check_breakpoint(CPUState *cs)
 {
     X86CPU *cpu = X86_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool x86_debug_check_breakpoint(CPUState *cs)
     /* RF disables all architectural breakpoints. */
     return !(env->eflags & RF_MASK);
 }
-#endif
+#endif /* CONFIG_USER_ONLY */
 
 #include "hw/core/tcg-cpu-ops.h"
 
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps x86_tcg_ops = {
 #ifdef CONFIG_USER_ONLY
     .fake_user_interrupt = x86_cpu_do_interrupt,
 #else
+    .has_work = x86_cpu_has_work,
     .do_interrupt = x86_cpu_do_interrupt,
     .cpu_exec_interrupt = x86_cpu_exec_interrupt,
     .debug_excp_handler = breakpoint_handler,
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-16-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/m68k/cpu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.pc = value;
 }
 
+#if !defined(CONFIG_USER_ONLY)
 static bool m68k_cpu_has_work(CPUState *cs)
 {
     return cs->interrupt_request & CPU_INTERRUPT_HARD;
 }
+#endif /* !CONFIG_USER_ONLY */
 
 static void m68k_set_feature(CPUM68KState *env, int feature)
 {
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps m68k_tcg_ops = {
     .tlb_fill = m68k_cpu_tlb_fill,
 
 #ifndef CONFIG_USER_ONLY
+    .has_work = m68k_cpu_has_work,
     .cpu_exec_interrupt = m68k_cpu_exec_interrupt,
     .do_interrupt = m68k_cpu_do_interrupt,
     .do_transaction_failed = m68k_cpu_transaction_failed,
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
     device_class_set_parent_reset(dc, m68k_cpu_reset, &mcc->parent_reset);
 
     cc->class_by_name = m68k_cpu_class_by_name;
-    cc->has_work = m68k_cpu_has_work;
     cc->dump_state = m68k_cpu_dump_state;
     cc->set_pc = m68k_cpu_set_pc;
     cc->gdb_read_register = m68k_cpu_gdb_read_register;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-17-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/microblaze/cpu.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_synchronize_from_tb(CPUState *cs,
     cpu->env.iflags = tb->flags & IFLAGS_TB_MASK;
 }
 
+#ifndef CONFIG_USER_ONLY
+
 static bool mb_cpu_has_work(CPUState *cs)
 {
     return cs->interrupt_request & (CPU_INTERRUPT_HARD | CPU_INTERRUPT_NMI);
 }
 
-#ifndef CONFIG_USER_ONLY
 static void mb_cpu_ns_axi_dp(void *opaque, int irq, int level)
 {
     MicroBlazeCPU *cpu = opaque;
@@ -XXX,XX +XXX,XX @@ static void microblaze_cpu_set_irq(void *opaque, int irq, int level)
         cpu_reset_interrupt(cs, type);
     }
 }
-#endif
+#endif /* !CONFIG_USER_ONLY */
 
 static void mb_cpu_reset(DeviceState *dev)
 {
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps mb_tcg_ops = {
     .tlb_fill = mb_cpu_tlb_fill,
 
 #ifndef CONFIG_USER_ONLY
+    .has_work = mb_cpu_has_work,
     .cpu_exec_interrupt = mb_cpu_exec_interrupt,
     .do_interrupt = mb_cpu_do_interrupt,
     .do_transaction_failed = mb_cpu_transaction_failed,
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     device_class_set_parent_reset(dc, mb_cpu_reset, &mcc->parent_reset);
 
     cc->class_by_name = mb_cpu_class_by_name;
-    cc->has_work = mb_cpu_has_work;
-
     cc->dump_state = mb_cpu_dump_state;
     cc->set_pc = mb_cpu_set_pc;
     cc->gdb_read_register = mb_cpu_gdb_read_register;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to TCG sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-18-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/mips/cpu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_set_pc(CPUState *cs, vaddr value)
     mips_env_set_pc(&cpu->env, value);
 }
 
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
 static bool mips_cpu_has_work(CPUState *cs)
 {
     MIPSCPU *cpu = MIPS_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool mips_cpu_has_work(CPUState *cs)
     }
     return has_work;
 }
+#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 
 #include "cpu-defs.c.inc"
 
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps mips_tcg_ops = {
     .tlb_fill = mips_cpu_tlb_fill,
 
 #if !defined(CONFIG_USER_ONLY)
+    .has_work = mips_cpu_has_work,
     .cpu_exec_interrupt = mips_cpu_exec_interrupt,
     .do_interrupt = mips_cpu_do_interrupt,
     .do_transaction_failed = mips_cpu_do_transaction_failed,
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     device_class_set_props(dc, mips_cpu_properties);
 
     cc->class_by_name = mips_cpu_class_by_name;
-    cc->has_work = mips_cpu_has_work;
     cc->dump_state = mips_cpu_dump_state;
     cc->set_pc = mips_cpu_set_pc;
     cc->gdb_read_register = mips_cpu_gdb_read_register;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-19-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/nios2/cpu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/cpu.c
+++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_set_pc(CPUState *cs, vaddr value)
     env->regs[R_PC] = value;
 }
 
+#if !defined(CONFIG_USER_ONLY)
 static bool nios2_cpu_has_work(CPUState *cs)
 {
     return cs->interrupt_request & (CPU_INTERRUPT_HARD | CPU_INTERRUPT_NMI);
 }
+#endif /* !CONFIG_USER_ONLY */
 
 static void nios2_cpu_reset(DeviceState *dev)
 {
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps nios2_tcg_ops = {
     .tlb_fill = nios2_cpu_tlb_fill,
 
 #ifndef CONFIG_USER_ONLY
+    .has_work = nios2_cpu_has_work,
     .cpu_exec_interrupt = nios2_cpu_exec_interrupt,
     .do_interrupt = nios2_cpu_do_interrupt,
     .do_unaligned_access = nios2_cpu_do_unaligned_access,
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
     device_class_set_parent_reset(dc, nios2_cpu_reset, &ncc->parent_reset);
 
     cc->class_by_name = nios2_cpu_class_by_name;
-    cc->has_work = nios2_cpu_has_work;
     cc->dump_state = nios2_cpu_dump_state;
     cc->set_pc = nios2_cpu_set_pc;
     cc->disas_set_info = nios2_cpu_disas_set_info;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-20-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/openrisc/cpu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.dflag = 0;
 }
 
+#if !defined(CONFIG_USER_ONLY)
 static bool openrisc_cpu_has_work(CPUState *cs)
 {
     return cs->interrupt_request & (CPU_INTERRUPT_HARD |
                                     CPU_INTERRUPT_TIMER);
 }
+#endif /* !CONFIG_USER_ONLY */
 
 static void openrisc_disas_set_info(CPUState *cpu, disassemble_info *info)
 {
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps openrisc_tcg_ops = {
     .tlb_fill = openrisc_cpu_tlb_fill,
 
 #ifndef CONFIG_USER_ONLY
+    .has_work = openrisc_cpu_has_work,
     .cpu_exec_interrupt = openrisc_cpu_exec_interrupt,
     .do_interrupt = openrisc_cpu_do_interrupt,
 #endif /* !CONFIG_USER_ONLY */
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
     device_class_set_parent_reset(dc, openrisc_cpu_reset, &occ->parent_reset);
 
     cc->class_by_name = openrisc_cpu_class_by_name;
-    cc->has_work = openrisc_cpu_has_work;
     cc->dump_state = openrisc_cpu_dump_state;
     cc->set_pc = openrisc_cpu_set_pc;
     cc->gdb_read_register = openrisc_cpu_gdb_read_register;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We're moving the hook from CPUState to TCGCPUOps. TCGCPUOps is
a const structure, so to avoid creating multiple versions of
the same structure, simply changing the has_work() handler,
introduce yet another indirection with a has_work() handler in
PowerPCCPUClass, and ppc_cpu_has_work() method which dispatch
to it.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-21-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/ppc/cpu-qom.h  |  1 +
 target/ppc/cpu_init.c | 23 ++++++++++++++---------
 2 files changed, 15 insertions(+), 9 deletions(-)

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict PowerPCCPUClass::has_work() and ppc_cpu_has_work()
- SysemuCPUOps::has_work() implementation - to TCG sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-22-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/ppc/cpu-qom.h  |  4 +++-
 target/ppc/cpu_init.c | 24 ++++++++++++++++++------
 2 files changed, 21 insertions(+), 7 deletions(-)

diff --git a/target/ppc/cpu-qom.h b/target/ppc/cpu-qom.h
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/cpu-qom.h
+++ b/target/ppc/cpu-qom.h
@@ -XXX,XX +XXX,XX @@ struct PowerPCCPUClass {
     uint32_t flags;
     int bfd_mach;
     uint32_t l1_dcache_size, l1_icache_size;
-    bool (*has_work)(CPUState *cpu);
 #ifndef CONFIG_USER_ONLY
+#ifdef CONFIG_TCG
+    bool (*has_work)(CPUState *cpu);
+#endif /* CONFIG_TCG */
     unsigned int gdb_num_sprs;
     const char *gdb_spr_xml;
 #endif
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -XXX,XX +XXX,XX @@ static bool ppc_pvr_match_power7(PowerPCCPUClass *pcc, uint32_t pvr)
     return false;
 }
 
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
 static bool cpu_has_work_POWER7(CPUState *cs)
 {
     PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool cpu_has_work_POWER7(CPUState *cs)
         return msr_ee && (cs->interrupt_request & CPU_INTERRUPT_HARD);
     }
 }
+#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 
 POWERPC_FAMILY(POWER7)(ObjectClass *oc, void *data)
 {
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER7)(ObjectClass *oc, void *data)
     pcc->pcr_supported = PCR_COMPAT_2_06 | PCR_COMPAT_2_05;
     pcc->init_proc = init_proc_POWER7;
     pcc->check_pow = check_pow_nocheck;
-    pcc->has_work = cpu_has_work_POWER7;
     pcc->insns_flags = PPC_INSNS_BASE | PPC_ISEL | PPC_STRING | PPC_MFTB |
                        PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
                        PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER7)(ObjectClass *oc, void *data)
     pcc->lpcr_pm = LPCR_P7_PECE0 | LPCR_P7_PECE1 | LPCR_P7_PECE2;
     pcc->mmu_model = POWERPC_MMU_2_06;
 #if defined(CONFIG_SOFTMMU)
+    pcc->has_work = cpu_has_work_POWER7;
     pcc->hash64_opts = &ppc_hash64_opts_POWER7;
     pcc->lrg_decr_bits = 32;
 #endif
@@ -XXX,XX +XXX,XX @@ static bool ppc_pvr_match_power8(PowerPCCPUClass *pcc, uint32_t pvr)
     return false;
 }
 
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
 static bool cpu_has_work_POWER8(CPUState *cs)
 {
     PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool cpu_has_work_POWER8(CPUState *cs)
         return msr_ee && (cs->interrupt_request & CPU_INTERRUPT_HARD);
     }
 }
+#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 
 POWERPC_FAMILY(POWER8)(ObjectClass *oc, void *data)
 {
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER8)(ObjectClass *oc, void *data)
     pcc->pcr_supported = PCR_COMPAT_2_07 | PCR_COMPAT_2_06 | PCR_COMPAT_2_05;
     pcc->init_proc = init_proc_POWER8;
     pcc->check_pow = check_pow_nocheck;
-    pcc->has_work = cpu_has_work_POWER8;
     pcc->insns_flags = PPC_INSNS_BASE | PPC_ISEL | PPC_STRING | PPC_MFTB |
                        PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
                        PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER8)(ObjectClass *oc, void *data)
                    LPCR_P8_PECE3 | LPCR_P8_PECE4;
     pcc->mmu_model = POWERPC_MMU_2_07;
 #if defined(CONFIG_SOFTMMU)
+    pcc->has_work = cpu_has_work_POWER8;
     pcc->hash64_opts = &ppc_hash64_opts_POWER7;
     pcc->lrg_decr_bits = 32;
     pcc->n_host_threads = 8;
@@ -XXX,XX +XXX,XX @@ static bool ppc_pvr_match_power9(PowerPCCPUClass *pcc, uint32_t pvr)
     return false;
 }
 
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
 static bool cpu_has_work_POWER9(CPUState *cs)
 {
     PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool cpu_has_work_POWER9(CPUState *cs)
         return msr_ee && (cs->interrupt_request & CPU_INTERRUPT_HARD);
     }
 }
+#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 
 POWERPC_FAMILY(POWER9)(ObjectClass *oc, void *data)
 {
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER9)(ObjectClass *oc, void *data)
                          PCR_COMPAT_2_05;
     pcc->init_proc = init_proc_POWER9;
     pcc->check_pow = check_pow_nocheck;
-    pcc->has_work = cpu_has_work_POWER9;
     pcc->insns_flags = PPC_INSNS_BASE | PPC_ISEL | PPC_STRING | PPC_MFTB |
                        PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
                        PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER9)(ObjectClass *oc, void *data)
     pcc->lpcr_pm = LPCR_PDEE | LPCR_HDEE | LPCR_EEE | LPCR_DEE | LPCR_OEE;
     pcc->mmu_model = POWERPC_MMU_3_00;
 #if defined(CONFIG_SOFTMMU)
+    pcc->has_work = cpu_has_work_POWER9;
     /* segment page size remain the same */
     pcc->hash64_opts = &ppc_hash64_opts_POWER7;
     pcc->radix_page_info = &POWER9_radix_page_info;
@@ -XXX,XX +XXX,XX @@ static bool ppc_pvr_match_power10(PowerPCCPUClass *pcc, uint32_t pvr)
     return false;
 }
 
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
 static bool cpu_has_work_POWER10(CPUState *cs)
 {
     PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool cpu_has_work_POWER10(CPUState *cs)
         return msr_ee && (cs->interrupt_request & CPU_INTERRUPT_HARD);
     }
 }
+#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 
 POWERPC_FAMILY(POWER10)(ObjectClass *oc, void *data)
 {
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER10)(ObjectClass *oc, void *data)
                          PCR_COMPAT_2_06 | PCR_COMPAT_2_05;
     pcc->init_proc = init_proc_POWER10;
     pcc->check_pow = check_pow_nocheck;
-    pcc->has_work = cpu_has_work_POWER10;
     pcc->insns_flags = PPC_INSNS_BASE | PPC_ISEL | PPC_STRING | PPC_MFTB |
                        PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
                        PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER10)(ObjectClass *oc, void *data)
     pcc->lpcr_pm = LPCR_PDEE | LPCR_HDEE | LPCR_EEE | LPCR_DEE | LPCR_OEE;
     pcc->mmu_model = POWERPC_MMU_3_00;
 #if defined(CONFIG_SOFTMMU)
+    pcc->has_work = cpu_has_work_POWER10;
     /* segment page size remain the same */
     pcc->hash64_opts = &ppc_hash64_opts_POWER7;
     pcc->radix_page_info = &POWER10_radix_page_info;
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.nip = value;
 }
 
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
 static bool cpu_has_work_default(CPUState *cs)
 {
     PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool ppc_cpu_has_work(CPUState *cs)
 
     return pcc->has_work(cs);
 }
+#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 
 static void ppc_cpu_reset(DeviceState *dev)
 {
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps ppc_tcg_ops = {
   .tlb_fill = ppc_cpu_tlb_fill,
 
 #ifndef CONFIG_USER_ONLY
+  .has_work = ppc_cpu_has_work,
   .cpu_exec_interrupt = ppc_cpu_exec_interrupt,
   .do_interrupt = ppc_cpu_do_interrupt,
   .cpu_exec_enter = ppc_cpu_exec_enter,
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
     device_class_set_parent_unrealize(dc, ppc_cpu_unrealize,
                                       &pcc->parent_unrealize);
     pcc->pvr_match = ppc_pvr_match_default;
-    pcc->has_work = cpu_has_work_default;
     device_class_set_props(dc, ppc_cpu_properties);
 
     device_class_set_parent_reset(dc, ppc_cpu_reset, &pcc->parent_reset);
 
     cc->class_by_name = ppc_cpu_class_by_name;
-    cc->has_work = ppc_cpu_has_work;
     cc->dump_state = ppc_cpu_dump_state;
     cc->set_pc = ppc_cpu_set_pc;
     cc->gdb_read_register = ppc_cpu_gdb_read_register;
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
 
 #ifdef CONFIG_TCG
     cc->tcg_ops = &ppc_tcg_ops;
+#ifndef CONFIG_USER_ONLY
+    pcc->has_work = cpu_has_work_default;
+#endif
 #endif /* CONFIG_TCG */
 }
 
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to TCG sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-23-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/riscv/cpu.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_synchronize_from_tb(CPUState *cs,
     env->pc = tb->pc;
 }
 
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
 static bool riscv_cpu_has_work(CPUState *cs)
 {
-#ifndef CONFIG_USER_ONLY
     RISCVCPU *cpu = RISCV_CPU(cs);
     CPURISCVState *env = &cpu->env;
     /*
@@ -XXX,XX +XXX,XX @@ static bool riscv_cpu_has_work(CPUState *cs)
      * mode and delegation registers, but respect individual enables
      */
     return (env->mip & env->mie) != 0;
-#else
-    return true;
-#endif
 }
+#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 
 void restore_state_to_opc(CPURISCVState *env, TranslationBlock *tb,
                           target_ulong *data)
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps riscv_tcg_ops = {
     .tlb_fill = riscv_cpu_tlb_fill,
 
 #ifndef CONFIG_USER_ONLY
+    .has_work = riscv_cpu_has_work,
     .cpu_exec_interrupt = riscv_cpu_exec_interrupt,
     .do_interrupt = riscv_cpu_do_interrupt,
     .do_transaction_failed = riscv_cpu_do_transaction_failed,
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     device_class_set_parent_reset(dc, riscv_cpu_reset, &mcc->parent_reset);
 
     cc->class_by_name = riscv_cpu_class_by_name;
-    cc->has_work = riscv_cpu_has_work;
     cc->dump_state = riscv_cpu_dump_state;
     cc->set_pc = riscv_cpu_set_pc;
     cc->gdb_read_register = riscv_cpu_gdb_read_register;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-24-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/rx/cpu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_synchronize_from_tb(CPUState *cs,
     cpu->env.pc = tb->pc;
 }
 
+#if !defined(CONFIG_USER_ONLY)
 static bool rx_cpu_has_work(CPUState *cs)
 {
     return cs->interrupt_request &
         (CPU_INTERRUPT_HARD | CPU_INTERRUPT_FIR);
 }
+#endif /* !CONFIG_USER_ONLY */
 
 static void rx_cpu_reset(DeviceState *dev)
 {
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps rx_tcg_ops = {
     .tlb_fill = rx_cpu_tlb_fill,
 
 #ifndef CONFIG_USER_ONLY
+    .has_work = rx_cpu_has_work,
     .cpu_exec_interrupt = rx_cpu_exec_interrupt,
     .do_interrupt = rx_cpu_do_interrupt,
 #endif /* !CONFIG_USER_ONLY */
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
                                   &rcc->parent_reset);
 
     cc->class_by_name = rx_cpu_class_by_name;
-    cc->has_work = rx_cpu_has_work;
     cc->dump_state = rx_cpu_dump_state;
     cc->set_pc = rx_cpu_set_pc;
 
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to TCG sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-25-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/s390x/cpu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.psw.addr = value;
 }
 
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
 static bool s390_cpu_has_work(CPUState *cs)
 {
     S390CPU *cpu = S390_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool s390_cpu_has_work(CPUState *cs)
 
     return s390_cpu_has_int(cpu);
 }
+#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 
 /* S390CPUClass::reset() */
 static void s390_cpu_reset(CPUState *s, cpu_reset_type type)
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps s390_tcg_ops = {
     .tlb_fill = s390_cpu_tlb_fill,
 
 #if !defined(CONFIG_USER_ONLY)
+    .has_work = s390_cpu_has_work,
     .cpu_exec_interrupt = s390_cpu_exec_interrupt,
     .do_interrupt = s390_cpu_do_interrupt,
     .debug_excp_handler = s390x_cpu_debug_excp_handler,
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
 
     scc->reset = s390_cpu_reset;
     cc->class_by_name = s390_cpu_class_by_name,
-    cc->has_work = s390_cpu_has_work;
     cc->dump_state = s390_cpu_dump_state;
     cc->set_pc = s390_cpu_set_pc;
     cc->gdb_read_register = s390_cpu_gdb_read_register;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-26-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/sh4/cpu.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static bool superh_io_recompile_replay_branch(CPUState *cs,
     }
     return false;
 }
-#endif
 
 static bool superh_cpu_has_work(CPUState *cs)
 {
     return cs->interrupt_request & CPU_INTERRUPT_HARD;
 }
 
+#endif /* !CONFIG_USER_ONLY */
+
 static void superh_cpu_reset(DeviceState *dev)
 {
     CPUState *s = CPU(dev);
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps superh_tcg_ops = {
     .tlb_fill = superh_cpu_tlb_fill,
 
 #ifndef CONFIG_USER_ONLY
+    .has_work = superh_cpu_has_work,
     .cpu_exec_interrupt = superh_cpu_exec_interrupt,
     .do_interrupt = superh_cpu_do_interrupt,
     .do_unaligned_access = superh_cpu_do_unaligned_access,
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
     device_class_set_parent_reset(dc, superh_cpu_reset, &scc->parent_reset);
 
     cc->class_by_name = superh_cpu_class_by_name;
-    cc->has_work = superh_cpu_has_work;
     cc->dump_state = superh_cpu_dump_state;
     cc->set_pc = superh_cpu_set_pc;
     cc->gdb_read_register = superh_cpu_gdb_read_register;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The SPARC target only support TCG acceleration. Remove the CONFIG_TCG
definition introduced by mistake in commit 78271684719 ("cpu: tcg_ops:
move to tcg-cpu-ops.h, keep a pointer in CPUClass").

Reported-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-27-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/sparc/cpu.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps sparc_sysemu_ops = {
 };
 #endif
 
-#ifdef CONFIG_TCG
 #include "hw/core/tcg-cpu-ops.h"
 
 static const struct TCGCPUOps sparc_tcg_ops = {
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps sparc_tcg_ops = {
     .do_unaligned_access = sparc_cpu_do_unaligned_access,
 #endif /* !CONFIG_USER_ONLY */
 };
-#endif /* CONFIG_TCG */
 
 static void sparc_cpu_class_init(ObjectClass *oc, void *data)
 {
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-28-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/sparc/cpu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_synchronize_from_tb(CPUState *cs,
     cpu->env.npc = tb->cs_base;
 }
 
+#if !defined(CONFIG_USER_ONLY)
 static bool sparc_cpu_has_work(CPUState *cs)
 {
     SPARCCPU *cpu = SPARC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool sparc_cpu_has_work(CPUState *cs)
     return (cs->interrupt_request & CPU_INTERRUPT_HARD) &&
            cpu_interrupts_enabled(env);
 }
+#endif /* !CONFIG_USER_ONLY */
 
 static char *sparc_cpu_type_name(const char *cpu_model)
 {
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps sparc_tcg_ops = {
     .tlb_fill = sparc_cpu_tlb_fill,
 
 #ifndef CONFIG_USER_ONLY
+    .has_work = sparc_cpu_has_work,
     .cpu_exec_interrupt = sparc_cpu_exec_interrupt,
     .do_interrupt = sparc_cpu_do_interrupt,
     .do_transaction_failed = sparc_cpu_do_transaction_failed,
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = sparc_cpu_class_by_name;
     cc->parse_features = sparc_cpu_parse_features;
-    cc->has_work = sparc_cpu_has_work;
     cc->dump_state = sparc_cpu_dump_state;
 #if !defined(TARGET_SPARC64) && !defined(CONFIG_USER_ONLY)
     cc->memory_rw_debug = sparc_cpu_memory_rw_debug;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-29-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/tricore/cpu.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_reset(DeviceState *dev)
     cpu_state_reset(env);
 }
 
+#if !defined(CONFIG_USER_ONLY)
 static bool tricore_cpu_has_work(CPUState *cs)
 {
     return true;
 }
+#endif /* !CONFIG_USER_ONLY */
 
 static void tricore_cpu_realizefn(DeviceState *dev, Error **errp)
 {
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps tricore_tcg_ops = {
     .initialize = tricore_tcg_init,
     .synchronize_from_tb = tricore_cpu_synchronize_from_tb,
     .tlb_fill = tricore_cpu_tlb_fill,
+#if !defined(CONFIG_USER_ONLY)
+    .has_work = tricore_cpu_has_work,
+#endif
 };
 
 static void tricore_cpu_class_init(ObjectClass *c, void *data)
@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_class_init(ObjectClass *c, void *data)
 
     device_class_set_parent_reset(dc, tricore_cpu_reset, &mcc->parent_reset);
     cc->class_by_name = tricore_cpu_class_by_name;
-    cc->has_work = tricore_cpu_has_work;
 
     cc->gdb_read_register = tricore_cpu_gdb_read_register;
     cc->gdb_write_register = tricore_cpu_gdb_write_register;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-30-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/xtensa/cpu.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.pc = value;
 }
 
+#ifndef CONFIG_USER_ONLY
+
 static bool xtensa_cpu_has_work(CPUState *cs)
 {
-#ifndef CONFIG_USER_ONLY
     XtensaCPU *cpu = XTENSA_CPU(cs);
 
     return !cpu->env.runstall && cpu->env.pending_irq_level;
-#else
-    return true;
-#endif
 }
 
-#ifdef CONFIG_USER_ONLY
+#else /* CONFIG_USER_ONLY*/
+
 static bool abi_call0;
 
 void xtensa_set_abi_call0(void)
@@ -XXX,XX +XXX,XX @@ bool xtensa_abi_call0(void)
 {
     return abi_call0;
 }
-#endif
+
+#endif /* CONFIG_USER_ONLY */
 
 static void xtensa_cpu_reset(DeviceState *dev)
 {
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps xtensa_tcg_ops = {
     .debug_excp_handler = xtensa_breakpoint_handler,
 
 #ifndef CONFIG_USER_ONLY
+    .has_work = xtensa_cpu_has_work,
     .cpu_exec_interrupt = xtensa_cpu_exec_interrupt,
     .do_interrupt = xtensa_cpu_do_interrupt,
     .do_transaction_failed = xtensa_cpu_do_transaction_failed,
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
     device_class_set_parent_reset(dc, xtensa_cpu_reset, &xcc->parent_reset);
 
     cc->class_by_name = xtensa_cpu_class_by_name;
-    cc->has_work = xtensa_cpu_has_work;
     cc->dump_state = xtensa_cpu_dump_state;
     cc->set_pc = xtensa_cpu_set_pc;
     cc->gdb_read_register = xtensa_cpu_gdb_read_register;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

cpu_common_has_work() is the default has_work() implementation
and returns 'false'.

Explicit it for the QTest / HAX / HVF / NVMM / Xen accelerators
and remove cpu_common_has_work().

Since there are no more implementations of SysemuCPUOps::has_work,
remove it along with the assertion in cpu_has_work().

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Paul Durrant <paul@xen.org>
Message-Id: <20210912172731.789788-31-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h             | 2 --
 accel/hvf/hvf-accel-ops.c         | 6 ++++++
 accel/qtest/qtest.c               | 6 ++++++
 accel/xen/xen-all.c               | 6 ++++++
 hw/core/cpu-common.c              | 6 ------
 softmmu/cpus.c                    | 9 ++-------
 target/i386/hax/hax-accel-ops.c   | 6 ++++++
 target/i386/nvmm/nvmm-accel-ops.c | 6 ++++++
 8 files changed, 32 insertions(+), 15 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ struct SysemuCPUOps;
  * instantiatable CPU type.
  * @parse_features: Callback to parse command line arguments.
  * @reset_dump_flags: #CPUDumpFlags to use for reset logging.
- * @has_work: Callback for checking if there is work to do.
  * @memory_rw_debug: Callback for GDB memory access.
  * @dump_state: Callback for dumping state.
  * @get_arch_id: Callback for getting architecture-dependent CPU ID.
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     void (*parse_features)(const char *typename, char *str, Error **errp);
 
     int reset_dump_flags;
-    bool (*has_work)(CPUState *cpu);
     int (*memory_rw_debug)(CPUState *cpu, vaddr addr,
                            uint8_t *buf, int len, bool is_write);
     void (*dump_state)(CPUState *cpu, FILE *, int flags);
diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -XXX,XX +XXX,XX @@ static void hvf_start_vcpu_thread(CPUState *cpu)
                        cpu, QEMU_THREAD_JOINABLE);
 }
 
+static bool hvf_cpu_has_work(CPUState *cpu)
+{
+    return false;
+}
+
 static void hvf_accel_ops_class_init(ObjectClass *oc, void *data)
 {
     AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void hvf_accel_ops_class_init(ObjectClass *oc, void *data)
     ops->synchronize_post_init = hvf_cpu_synchronize_post_init;
     ops->synchronize_state = hvf_cpu_synchronize_state;
     ops->synchronize_pre_loadvm = hvf_cpu_synchronize_pre_loadvm;
+    ops->has_work = hvf_cpu_has_work;
 };
 static const TypeInfo hvf_accel_ops_type = {
     .name = ACCEL_OPS_NAME("hvf"),
diff --git a/accel/qtest/qtest.c b/accel/qtest/qtest.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/qtest/qtest.c
+++ b/accel/qtest/qtest.c
@@ -XXX,XX +XXX,XX @@ static const TypeInfo qtest_accel_type = {
 };
 module_obj(TYPE_QTEST_ACCEL);
 
+static bool qtest_cpu_has_work(CPUState *cpu)
+{
+    return false;
+}
+
 static void qtest_accel_ops_class_init(ObjectClass *oc, void *data)
 {
     AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 
     ops->create_vcpu_thread = dummy_start_vcpu_thread;
     ops->get_virtual_clock = qtest_get_virtual_clock;
+    ops->has_work = qtest_cpu_has_work;
 };
 
 static const TypeInfo qtest_accel_ops_type = {
diff --git a/accel/xen/xen-all.c b/accel/xen/xen-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/xen/xen-all.c
+++ b/accel/xen/xen-all.c
@@ -XXX,XX +XXX,XX @@ static const TypeInfo xen_accel_type = {
     .class_init = xen_accel_class_init,
 };
 
+static bool xen_cpu_has_work(CPUState *cpu)
+{
+    return false;
+}
+
 static void xen_accel_ops_class_init(ObjectClass *oc, void *data)
 {
     AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 
     ops->create_vcpu_thread = dummy_start_vcpu_thread;
+    ops->has_work = xen_cpu_has_work;
 }
 
 static const TypeInfo xen_accel_ops_type = {
diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/cpu-common.c
+++ b/hw/core/cpu-common.c
@@ -XXX,XX +XXX,XX @@ static void cpu_common_reset(DeviceState *dev)
     }
 }
 
-static bool cpu_common_has_work(CPUState *cs)
-{
-    return false;
-}
-
 ObjectClass *cpu_class_by_name(const char *typename, const char *cpu_model)
 {
     CPUClass *cc = CPU_CLASS(object_class_by_name(typename));
@@ -XXX,XX +XXX,XX @@ static void cpu_class_init(ObjectClass *klass, void *data)
 
     k->parse_features = cpu_common_parse_features;
     k->get_arch_id = cpu_common_get_arch_id;
-    k->has_work = cpu_common_has_work;
     k->gdb_read_register = cpu_common_gdb_read_register;
     k->gdb_write_register = cpu_common_gdb_write_register;
     set_bit(DEVICE_CATEGORY_CPU, dc->categories);
diff --git a/softmmu/cpus.c b/softmmu/cpus.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/cpus.c
+++ b/softmmu/cpus.c
@@ -XXX,XX +XXX,XX @@ void cpu_interrupt(CPUState *cpu, int mask)
 
 bool cpu_has_work(CPUState *cpu)
 {
-    CPUClass *cc = CPU_GET_CLASS(cpu);
-
-    if (cpus_accel->has_work) {
-        return cpus_accel->has_work(cpu);
-    }
-    g_assert(cc->has_work);
-    return cc->has_work(cpu);
+    g_assert(cpus_accel->has_work);
+    return cpus_accel->has_work(cpu);
 }
 
 static int do_vm_stop(RunState state, bool send_stop)
diff --git a/target/i386/hax/hax-accel-ops.c b/target/i386/hax/hax-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hax/hax-accel-ops.c
+++ b/target/i386/hax/hax-accel-ops.c
@@ -XXX,XX +XXX,XX @@ static void hax_start_vcpu_thread(CPUState *cpu)
 #endif
 }
 
+static bool hax_cpu_has_work(CPUState *cpu)
+{
+    return false;
+}
+
 static void hax_accel_ops_class_init(ObjectClass *oc, void *data)
 {
     AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void hax_accel_ops_class_init(ObjectClass *oc, void *data)
     ops->synchronize_post_init = hax_cpu_synchronize_post_init;
     ops->synchronize_state = hax_cpu_synchronize_state;
     ops->synchronize_pre_loadvm = hax_cpu_synchronize_pre_loadvm;
+    ops->has_work = hax_cpu_has_work;
 }
 
 static const TypeInfo hax_accel_ops_type = {
diff --git a/target/i386/nvmm/nvmm-accel-ops.c b/target/i386/nvmm/nvmm-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/nvmm/nvmm-accel-ops.c
+++ b/target/i386/nvmm/nvmm-accel-ops.c
@@ -XXX,XX +XXX,XX @@ static void nvmm_kick_vcpu_thread(CPUState *cpu)
     cpus_kick_thread(cpu);
 }
 
+static bool nvmm_cpu_has_work(CPUState *cpu)
+{
+    return false;
+}
+
 static void nvmm_accel_ops_class_init(ObjectClass *oc, void *data)
 {
     AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void nvmm_accel_ops_class_init(ObjectClass *oc, void *data)
     ops->synchronize_post_init = nvmm_cpu_synchronize_post_init;
     ops->synchronize_state = nvmm_cpu_synchronize_state;
     ops->synchronize_pre_loadvm = nvmm_cpu_synchronize_pre_loadvm;
+    ops->has_work = nvmm_cpu_has_work;
 }
 
 static const TypeInfo nvmm_accel_ops_type = {
-- 
2.25.1

Let the compiler decide about inlining.
Remove tcg_out_ext8s and tcg_out_ext16s as unused.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/mips/tcg-target.c.inc | 76 ++++++++++++++-------------------------
 1 file changed, 27 insertions(+), 49 deletions(-)

diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool patch_reloc(tcg_insn_unit *code_ptr, int type,
 #endif
 
 
-static inline bool is_p2m1(tcg_target_long val)
+static bool is_p2m1(tcg_target_long val)
 {
     return val && ((val + 1) & val) == 0;
 }
@@ -XXX,XX +XXX,XX @@ typedef enum {
 /*
  * Type reg
  */
-static inline void tcg_out_opc_reg(TCGContext *s, MIPSInsn opc,
-                                   TCGReg rd, TCGReg rs, TCGReg rt)
+static void tcg_out_opc_reg(TCGContext *s, MIPSInsn opc,
+                            TCGReg rd, TCGReg rs, TCGReg rt)
 {
     int32_t inst;
 
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_opc_reg(TCGContext *s, MIPSInsn opc,
 /*
  * Type immediate
  */
-static inline void tcg_out_opc_imm(TCGContext *s, MIPSInsn opc,
-                                   TCGReg rt, TCGReg rs, TCGArg imm)
+static void tcg_out_opc_imm(TCGContext *s, MIPSInsn opc,
+                            TCGReg rt, TCGReg rs, TCGArg imm)
 {
     int32_t inst;
 
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_opc_imm(TCGContext *s, MIPSInsn opc,
 /*
  * Type bitfield
  */
-static inline void tcg_out_opc_bf(TCGContext *s, MIPSInsn opc, TCGReg rt,
-                                  TCGReg rs, int msb, int lsb)
+static void tcg_out_opc_bf(TCGContext *s, MIPSInsn opc, TCGReg rt,
+                           TCGReg rs, int msb, int lsb)
 {
     int32_t inst;
 
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_opc_bf(TCGContext *s, MIPSInsn opc, TCGReg rt,
     tcg_out32(s, inst);
 }
 
-static inline void tcg_out_opc_bf64(TCGContext *s, MIPSInsn opc, MIPSInsn opm,
-                                    MIPSInsn oph, TCGReg rt, TCGReg rs,
+static void tcg_out_opc_bf64(TCGContext *s, MIPSInsn opc, MIPSInsn opm,
+                             MIPSInsn oph, TCGReg rt, TCGReg rs,
                                     int msb, int lsb)
 {
     if (lsb >= 32) {
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_opc_bf64(TCGContext *s, MIPSInsn opc, MIPSInsn opm,
 /*
  * Type branch
  */
-static inline void tcg_out_opc_br(TCGContext *s, MIPSInsn opc,
-                                  TCGReg rt, TCGReg rs)
+static void tcg_out_opc_br(TCGContext *s, MIPSInsn opc, TCGReg rt, TCGReg rs)
 {
     tcg_out_opc_imm(s, opc, rt, rs, 0);
 }
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_opc_br(TCGContext *s, MIPSInsn opc,
 /*
  * Type sa
  */
-static inline void tcg_out_opc_sa(TCGContext *s, MIPSInsn opc,
-                                  TCGReg rd, TCGReg rt, TCGArg sa)
+static void tcg_out_opc_sa(TCGContext *s, MIPSInsn opc,
+                           TCGReg rd, TCGReg rt, TCGArg sa)
 {
     int32_t inst;
 
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_opc_jmp(TCGContext *s, MIPSInsn opc, const void *target)
     return true;
 }
 
-static inline void tcg_out_nop(TCGContext *s)
+static void tcg_out_nop(TCGContext *s)
 {
     tcg_out32(s, 0);
 }
 
-static inline void tcg_out_dsll(TCGContext *s, TCGReg rd, TCGReg rt, TCGArg sa)
+static void tcg_out_dsll(TCGContext *s, TCGReg rd, TCGReg rt, TCGArg sa)
 {
     tcg_out_opc_sa64(s, OPC_DSLL, OPC_DSLL32, rd, rt, sa);
 }
 
-static inline void tcg_out_dsrl(TCGContext *s, TCGReg rd, TCGReg rt, TCGArg sa)
+static void tcg_out_dsrl(TCGContext *s, TCGReg rd, TCGReg rt, TCGArg sa)
 {
     tcg_out_opc_sa64(s, OPC_DSRL, OPC_DSRL32, rd, rt, sa);
 }
 
-static inline void tcg_out_dsra(TCGContext *s, TCGReg rd, TCGReg rt, TCGArg sa)
+static void tcg_out_dsra(TCGContext *s, TCGReg rd, TCGReg rt, TCGArg sa)
 {
     tcg_out_opc_sa64(s, OPC_DSRA, OPC_DSRA32, rd, rt, sa);
 }
 
-static inline bool tcg_out_mov(TCGContext *s, TCGType type,
-                               TCGReg ret, TCGReg arg)
+static bool tcg_out_mov(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg)
 {
     /* Simple reg-reg move, optimising out the 'do nothing' case */
     if (ret != arg) {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_bswap64(TCGContext *s, TCGReg ret, TCGReg arg)
     }
 }
 
-static inline void tcg_out_ext8s(TCGContext *s, TCGReg ret, TCGReg arg)
-{
-    if (use_mips32r2_instructions) {
-        tcg_out_opc_reg(s, OPC_SEB, ret, 0, arg);
-    } else {
-        tcg_out_opc_sa(s, OPC_SLL, ret, arg, 24);
-        tcg_out_opc_sa(s, OPC_SRA, ret, ret, 24);
-    }
-}
-
-static inline void tcg_out_ext16s(TCGContext *s, TCGReg ret, TCGReg arg)
-{
-    if (use_mips32r2_instructions) {
-        tcg_out_opc_reg(s, OPC_SEH, ret, 0, arg);
-    } else {
-        tcg_out_opc_sa(s, OPC_SLL, ret, arg, 16);
-        tcg_out_opc_sa(s, OPC_SRA, ret, ret, 16);
-    }
-}
-
-static inline void tcg_out_ext32u(TCGContext *s, TCGReg ret, TCGReg arg)
+static void tcg_out_ext32u(TCGContext *s, TCGReg ret, TCGReg arg)
 {
     if (use_mips32r2_instructions) {
         tcg_out_opc_bf(s, OPC_DEXT, ret, arg, 31, 0);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ldst(TCGContext *s, MIPSInsn opc, TCGReg data,
     tcg_out_opc_imm(s, opc, data, addr, lo);
 }
 
-static inline void tcg_out_ld(TCGContext *s, TCGType type, TCGReg arg,
-                              TCGReg arg1, intptr_t arg2)
+static void tcg_out_ld(TCGContext *s, TCGType type, TCGReg arg,
+                       TCGReg arg1, intptr_t arg2)
 {
     MIPSInsn opc = OPC_LD;
     if (TCG_TARGET_REG_BITS == 32 || type == TCG_TYPE_I32) {
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_ld(TCGContext *s, TCGType type, TCGReg arg,
     tcg_out_ldst(s, opc, arg, arg1, arg2);
 }
 
-static inline void tcg_out_st(TCGContext *s, TCGType type, TCGReg arg,
-                              TCGReg arg1, intptr_t arg2)
+static void tcg_out_st(TCGContext *s, TCGType type, TCGReg arg,
+                       TCGReg arg1, intptr_t arg2)
 {
     MIPSInsn opc = OPC_SD;
     if (TCG_TARGET_REG_BITS == 32 || type == TCG_TYPE_I32) {
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_st(TCGContext *s, TCGType type, TCGReg arg,
     tcg_out_ldst(s, opc, arg, arg1, arg2);
 }
 
-static inline bool tcg_out_sti(TCGContext *s, TCGType type, TCGArg val,
-                               TCGReg base, intptr_t ofs)
+static bool tcg_out_sti(TCGContext *s, TCGType type, TCGArg val,
+                        TCGReg base, intptr_t ofs)
 {
     if (val == 0) {
         tcg_out_st(s, type, TCG_REG_ZERO, base, ofs);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_clz(TCGContext *s, MIPSInsn opcv2, MIPSInsn opcv6,
     }
 }
 
-static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
-                              const TCGArg args[TCG_MAX_OP_ARGS],
-                              const int const_args[TCG_MAX_OP_ARGS])
+static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+                       const TCGArg args[TCG_MAX_OP_ARGS],
+                       const int const_args[TCG_MAX_OP_ARGS])
 {
     MIPSInsn i1, i2;
     TCGArg a0, a1, a2;
-- 
2.25.1

Weaning off of unique alignment requirements, so allow JAL
to not reach the target.  TCG_TMP1 is always available for
use as a scratch because it is clobbered by the subroutine
being called.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/mips/tcg-target.c.inc | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_bswap16(TCGContext *s, TCGReg ret, TCGReg arg, int flags)
 
 static void tcg_out_bswap_subr(TCGContext *s, const tcg_insn_unit *sub)
 {
-    bool ok = tcg_out_opc_jmp(s, OPC_JAL, sub);
-    tcg_debug_assert(ok);
+    if (!tcg_out_opc_jmp(s, OPC_JAL, sub)) {
+        tcg_out_movi(s, TCG_TYPE_PTR, TCG_TMP1, (uintptr_t)sub);
+        tcg_out_opc_reg(s, OPC_JALR, TCG_REG_RA, TCG_TMP1, 0);
+    }
 }
 
 static void tcg_out_bswap32(TCGContext *s, TCGReg ret, TCGReg arg, int flags)
-- 
2.25.1

Only use indirect jumps.  Finish weaning away from the
unique alignment requirements for code_gen_buffer.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/mips/tcg-target.h     | 12 +++++-------
 tcg/mips/tcg-target.c.inc | 23 +++++------------------
 2 files changed, 10 insertions(+), 25 deletions(-)

diff --git a/tcg/mips/tcg-target.h b/tcg/mips/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.h
+++ b/tcg/mips/tcg-target.h
@@ -XXX,XX +XXX,XX @@
 #define TCG_TARGET_TLB_DISPLACEMENT_BITS 16
 #define TCG_TARGET_NB_REGS 32
 
-/*
- * We have a 256MB branch region, but leave room to make sure the
- * main executable is also within that region.
- */
-#define MAX_CODE_GEN_BUFFER_SIZE  (128 * MiB)
+#define MAX_CODE_GEN_BUFFER_SIZE  ((size_t)-1)
 
 typedef enum {
     TCG_REG_ZERO = 0,
@@ -XXX,XX +XXX,XX @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_muluh_i32        1
 #define TCG_TARGET_HAS_mulsh_i32        1
 #define TCG_TARGET_HAS_bswap32_i32      1
-#define TCG_TARGET_HAS_direct_jump      1
+#define TCG_TARGET_HAS_direct_jump      0
 
 #if TCG_TARGET_REG_BITS == 64
 #define TCG_TARGET_HAS_add2_i32         0
@@ -XXX,XX +XXX,XX @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_DEFAULT_MO (0)
 #define TCG_TARGET_HAS_MEMORY_BSWAP     1
 
-void tb_target_set_jmp_target(uintptr_t, uintptr_t, uintptr_t, uintptr_t);
+/* not defined -- call should be eliminated at compile time */
+void tb_target_set_jmp_target(uintptr_t, uintptr_t, uintptr_t, uintptr_t)
+    QEMU_ERROR("code path is reachable");
 
 #ifdef CONFIG_SOFTMMU
 #define TCG_TARGET_NEED_LDST_LABELS
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         }
         break;
     case INDEX_op_goto_tb:
-        if (s->tb_jmp_insn_offset) {
-            /* direct jump method */
-            s->tb_jmp_insn_offset[a0] = tcg_current_code_size(s);
-            /* Avoid clobbering the address during retranslation.  */
-            tcg_out32(s, OPC_J | (*(uint32_t *)s->code_ptr & 0x3ffffff));
-        } else {
-            /* indirect jump method */
-            tcg_out_ld(s, TCG_TYPE_PTR, TCG_TMP0, TCG_REG_ZERO,
-                       (uintptr_t)(s->tb_jmp_target_addr + a0));
-            tcg_out_opc_reg(s, OPC_JR, 0, TCG_TMP0, 0);
-        }
+        /* indirect jump method */
+        tcg_debug_assert(s->tb_jmp_insn_offset == 0);
+        tcg_out_ld(s, TCG_TYPE_PTR, TCG_TMP0, TCG_REG_ZERO,
+                   (uintptr_t)(s->tb_jmp_target_addr + a0));
+        tcg_out_opc_reg(s, OPC_JR, 0, TCG_TMP0, 0);
         tcg_out_nop(s);
         set_jmp_reset_offset(s, a0);
         break;
@@ -XXX,XX +XXX,XX @@ static void tcg_target_init(TCGContext *s)
     tcg_regset_set_reg(s->reserved_regs, TCG_REG_GP);   /* global pointer */
 }
 
-void tb_target_set_jmp_target(uintptr_t tc_ptr, uintptr_t jmp_rx,
-                              uintptr_t jmp_rw, uintptr_t addr)
-{
-    qatomic_set((uint32_t *)jmp_rw, deposit32(OPC_J, 0, 26, addr >> 2));
-    flush_idcache_range(jmp_rx, jmp_rw, 4);
-}
-
 typedef struct {
     DebugFrameHeader h;
     uint8_t fde_def_cfa[4];
-- 
2.25.1

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/region.c | 91 ----------------------------------------------------
 1 file changed, 91 deletions(-)

diff --git a/tcg/region.c b/tcg/region.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/region.c
+++ b/tcg/region.c
@@ -XXX,XX +XXX,XX @@ static size_t tcg_n_regions(size_t tb_size, unsigned max_cpus)
   (DEFAULT_CODE_GEN_BUFFER_SIZE_1 < MAX_CODE_GEN_BUFFER_SIZE \
    ? DEFAULT_CODE_GEN_BUFFER_SIZE_1 : MAX_CODE_GEN_BUFFER_SIZE)
 
-#ifdef __mips__
-/*
- * In order to use J and JAL within the code_gen_buffer, we require
- * that the buffer not cross a 256MB boundary.
- */
-static inline bool cross_256mb(void *addr, size_t size)
-{
-    return ((uintptr_t)addr ^ ((uintptr_t)addr + size)) & ~0x0ffffffful;
-}
-
-/*
- * We weren't able to allocate a buffer without crossing that boundary,
- * so make do with the larger portion of the buffer that doesn't cross.
- * Returns the new base and size of the buffer in *obuf and *osize.
- */
-static inline void split_cross_256mb(void **obuf, size_t *osize,
-                                     void *buf1, size_t size1)
-{
-    void *buf2 = (void *)(((uintptr_t)buf1 + size1) & ~0x0ffffffful);
-    size_t size2 = buf1 + size1 - buf2;
-
-    size1 = buf2 - buf1;
-    if (size1 < size2) {
-        size1 = size2;
-        buf1 = buf2;
-    }
-
-    *obuf = buf1;
-    *osize = size1;
-}
-#endif
-
 #ifdef USE_STATIC_CODE_GEN_BUFFER
 static uint8_t static_code_gen_buffer[DEFAULT_CODE_GEN_BUFFER_SIZE]
     __attribute__((aligned(CODE_GEN_ALIGN)));
@@ -XXX,XX +XXX,XX @@ static int alloc_code_gen_buffer(size_t tb_size, int splitwx, Error **errp)
         size = QEMU_ALIGN_DOWN(tb_size, qemu_real_host_page_size);
     }
 
-#ifdef __mips__
-    if (cross_256mb(buf, size)) {
-        split_cross_256mb(&buf, &size, buf, size);
-    }
-#endif
-
     region.start_aligned = buf;
     region.total_size = size;
 
@@ -XXX,XX +XXX,XX @@ static int alloc_code_gen_buffer_anon(size_t size, int prot,
         return -1;
     }
 
-#ifdef __mips__
-    if (cross_256mb(buf, size)) {
-        /*
-         * Try again, with the original still mapped, to avoid re-acquiring
-         * the same 256mb crossing.
-         */
-        size_t size2;
-        void *buf2 = mmap(NULL, size, prot, flags, -1, 0);
-        switch ((int)(buf2 != MAP_FAILED)) {
-        case 1:
-            if (!cross_256mb(buf2, size)) {
-                /* Success!  Use the new buffer.  */
-                munmap(buf, size);
-                break;
-            }
-            /* Failure.  Work with what we had.  */
-            munmap(buf2, size);
-            /* fallthru */
-        default:
-            /* Split the original buffer.  Free the smaller half.  */
-            split_cross_256mb(&buf2, &size2, buf, size);
-            if (buf == buf2) {
-                munmap(buf + size2, size - size2);
-            } else {
-                munmap(buf, size - size2);
-            }
-            size = size2;
-            break;
-        }
-        buf = buf2;
-    }
-#endif
-
     region.start_aligned = buf;
     region.total_size = size;
     return prot;
@@ -XXX,XX +XXX,XX @@ static bool alloc_code_gen_buffer_splitwx_memfd(size_t size, Error **errp)
     void *buf_rw = NULL, *buf_rx = MAP_FAILED;
     int fd = -1;
 
-#ifdef __mips__
-    /* Find space for the RX mapping, vs the 256MiB regions. */
-    if (alloc_code_gen_buffer_anon(size, PROT_NONE,
-                                   MAP_PRIVATE | MAP_ANONYMOUS |
-                                   MAP_NORESERVE, errp) < 0) {
-        return false;
-    }
-    /* The size of the mapping may have been adjusted. */
-    buf_rx = region.start_aligned;
-    size = region.total_size;
-#endif
-
     buf_rw = qemu_memfd_alloc("tcg-jit", size, 0, &fd, errp);
     if (buf_rw == NULL) {
         goto fail;
     }
 
-#ifdef __mips__
-    void *tmp = mmap(buf_rx, size, PROT_READ | PROT_EXEC,
-                     MAP_SHARED | MAP_FIXED, fd, 0);
-    if (tmp != buf_rx) {
-        goto fail_rx;
-    }
-#else
     buf_rx = mmap(NULL, size, PROT_READ | PROT_EXEC, MAP_SHARED, fd, 0);
     if (buf_rx == MAP_FAILED) {
         goto fail_rx;
     }
-#endif
 
     close(fd);
     region.start_aligned = buf_rw;
-- 
2.25.1