Series comparison

-[PULL 00/63] tcg patch queue
+[PULL 00/20] tcg patch queue
-The following changes since commit 13d5f87cc3b94bfccc501142df4a7b12fee3a6e7:
+TCG patch queue, plus one target/sh4 patch that
 Yoshinori Sato asked me to process.
-  Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-axp-20210628' into staging (2021-06-29 10:02:42 +0100)
 r~
 The following changes since commit efbf38d73e5dcc4d5f8b98c6e7a12be1f3b91745:
   Merge tag 'for-upstream' of git://repo.or.cz/qemu/kevin into staging (2022-10-03 15:06:07 -0400)
 are available in the Git repository at:
-  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20210629
+  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20221004
-for you to fetch changes up to c86bd2dc4c1d37653c27293b2dacee6bb46bb995:
+for you to fetch changes up to ab419fd8a035a65942de4e63effcd55ccbf1a9fe:
-  tcg/riscv: Remove MO_BSWAP handling (2021-06-29 10:04:57 -0700)
+  target/sh4: Fix TB_FLAG_UNALIGN (2022-10-04 12:33:05 -0700)
 ----------------------------------------------------------------
-TranslatorOps conversion for target/avr
+Cache CPUClass for use in hot code paths.
-TranslatorOps conversion for target/cris
+Add CPUTLBEntryFull, probe_access_full, tlb_set_page_full.
-TranslatorOps conversion for target/nios2
+Add generic support for TARGET_TB_PCREL.
-Simple vector operations on TCGv_i32
+tcg/ppc: Optimize 26-bit jumps using STQ for POWER 2.07
-Host signal fixes for *BSD
+target/sh4: Fix TB_FLAG_UNALIGN
 Improvements to tcg bswap operations
 ----------------------------------------------------------------
-LIU Zhiwei (5):
+Alex Bennée (3):
-      tcg: Add tcg_gen_vec_add{sub}16_i32
+      cpu: cache CPUClass in CPUState for hot code paths
-      tcg: Add tcg_gen_vec_add{sub}8_i32
+      hw/core/cpu-sysemu: used cached class in cpu_asidx_from_attrs
-      tcg: Add tcg_gen_vec_shl{shr}{sar}16i_i32
+      cputlb: used cached CPUClass in our hot-paths
       tcg: Add tcg_gen_vec_shl{shr}{sar}8i_i32
       tcg: Implement tcg_gen_vec_add{sub}32_tl
-Richard Henderson (57):
+Leandro Lupori (1):
-      target/nios2: Replace DISAS_TB_JUMP with DISAS_NORETURN
+      tcg/ppc: Optimize 26-bit jumps
       target/nios2: Use global cpu_env
       target/nios2: Use global cpu_R
       target/nios2: Add DisasContextBase to DisasContext
       target/nios2: Convert to TranslatorOps
       target/nios2: Remove assignment to env in handle_instruction
       target/nios2: Clean up goto in handle_instruction
       target/nios2: Inline handle_instruction
       target/nios2: Use pc_next for pc + 4
       target/avr: Add DisasContextBase to DisasContext
       target/avr: Change ctx to DisasContext* in gen_intermediate_code
       target/avr: Convert to TranslatorOps
       target/cris: Add DisasContextBase to DisasContext
       target/cris: Remove DISAS_SWI
       target/cris: Replace DISAS_TB_JUMP with DISAS_NORETURN
       target/cris: Mark exceptions as DISAS_NORETURN
       target/cris: Fix use_goto_tb
       target/cris: Convert to TranslatorOps
       target/cris: Mark helper_raise_exception noreturn
       target/cris: Mark static arrays const
       target/cris: Fold unhandled X_FLAG changes into cpustate_changed
       target/cris: Set cpustate_changed for rfe/rfn
       target/cris: Add DISAS_UPDATE_NEXT
       target/cris: Add DISAS_DBRANCH
       target/cris: Use tcg_gen_lookup_and_goto_ptr
       target/cris: Improve JMP_INDIRECT
       target/cris: Remove dc->flagx_known
       target/cris: Do not exit tb for X_FLAG changes
       tcg: Add flags argument to bswap opcodes
       tcg/i386: Support bswap flags
       tcg/aarch64: Merge tcg_out_rev{16,32,64}
       tcg/aarch64: Support bswap flags
       tcg/arm: Support bswap flags
       tcg/ppc: Split out tcg_out_ext{8,16,32}s
       tcg/ppc: Split out tcg_out_sari{32,64}
       tcg/ppc: Split out tcg_out_bswap16
       tcg/ppc: Split out tcg_out_bswap32
       tcg/ppc: Split out tcg_out_bswap64
       tcg/ppc: Support bswap flags
       tcg/ppc: Use power10 byte-reverse instructions
       tcg/s390: Support bswap flags
       tcg/mips: Support bswap flags in tcg_out_bswap16
       tcg/mips: Support bswap flags in tcg_out_bswap32
       tcg/tci: Support bswap flags
       tcg: Handle new bswap flags during optimize
       tcg: Add flags argument to tcg_gen_bswap16_*, tcg_gen_bswap32_i64
       tcg: Make use of bswap flags in tcg_gen_qemu_ld_*
       tcg: Make use of bswap flags in tcg_gen_qemu_st_*
       target/arm: Improve REV32
       target/arm: Improve vector REV
       target/arm: Improve REVSH
       target/i386: Improve bswap translation
       target/sh4: Improve swap.b translation
       target/mips: Fix gen_mxu_s32ldd_s32lddr
       tcg/arm: Unset TCG_TARGET_HAS_MEMORY_BSWAP
       tcg/aarch64: Unset TCG_TARGET_HAS_MEMORY_BSWAP
       tcg/riscv: Remove MO_BSWAP handling
-Warner Losh (1):
+Richard Henderson (16):
-      tcg: Use correct trap number for page faults on *BSD systems
+      accel/tcg: Rename CPUIOTLBEntry to CPUTLBEntryFull
       accel/tcg: Drop addr member from SavedIOTLB
       accel/tcg: Suppress auto-invalidate in probe_access_internal
       accel/tcg: Introduce probe_access_full
       accel/tcg: Introduce tlb_set_page_full
       include/exec: Introduce TARGET_PAGE_ENTRY_EXTRA
       accel/tcg: Remove PageDesc code_bitmap
       accel/tcg: Use bool for page_find_alloc
       accel/tcg: Use DisasContextBase in plugin_gen_tb_start
       accel/tcg: Do not align tb->page_addr[0]
       accel/tcg: Inline tb_flush_jmp_cache
       include/hw/core: Create struct CPUJumpCache
       hw/core: Add CPUClass.get_pc
       accel/tcg: Introduce tb_pc and log_pc
       accel/tcg: Introduce TARGET_TB_PCREL
       target/sh4: Fix TB_FLAG_UNALIGN
- include/tcg/tcg-op-gvec.h       |  43 ++++
+ accel/tcg/internal.h                    |  10 ++
- include/tcg/tcg-op.h            |   8 +-
+ accel/tcg/tb-hash.h                     |   1 +
- include/tcg/tcg-opc.h           |  10 +-
+ accel/tcg/tb-jmp-cache.h                |  65 ++++++++
- include/tcg/tcg.h               |  12 +
+ include/exec/cpu-common.h               |   1 +
- target/cris/helper.h            |   2 +-
+ include/exec/cpu-defs.h                 |  48 ++++--
- tcg/aarch64/tcg-target.h        |   2 +-
+ include/exec/exec-all.h                 |  75 ++++++++-
- tcg/arm/tcg-target.h            |   2 +-
+ include/exec/plugin-gen.h               |   7 +-
- accel/tcg/user-exec.c           |  20 +-
+ include/hw/core/cpu.h                   |  28 ++--
- target/arm/translate-a64.c      |  21 +-
+ include/qemu/typedefs.h                 |   2 +
- target/arm/translate.c          |   4 +-
+ include/tcg/tcg.h                       |   2 +-
- target/avr/translate.c          | 284 ++++++++++++----------
+ target/sh4/cpu.h                        |  56 ++++---
- target/cris/translate.c         | 515 ++++++++++++++++++++--------------------
+ accel/stubs/tcg-stub.c                  |   4 +
- target/i386/tcg/translate.c     |  14 +-
+ accel/tcg/cpu-exec.c                    |  80 +++++-----
- target/mips/tcg/mxu_translate.c |   6 +-
+ accel/tcg/cputlb.c                      | 259 ++++++++++++++++++--------------
- target/nios2/translate.c        | 318 ++++++++++++-------------
+ accel/tcg/plugin-gen.c                  |  22 +--
- target/s390x/translate.c        |   4 +-
+ accel/tcg/translate-all.c               | 214 ++++++++++++--------------
- target/sh4/translate.c          |   3 +-
+ accel/tcg/translator.c                  |   2 +-
- tcg/optimize.c                  |  56 ++++-
+ cpu.c                                   |   9 +-
- tcg/tcg-op-gvec.c               | 122 ++++++++++
+ hw/core/cpu-common.c                    |   3 +-
- tcg/tcg-op.c                    | 143 +++++++----
+ hw/core/cpu-sysemu.c                    |   5 +-
- tcg/tcg.c                       |  28 +++
+ linux-user/sh4/signal.c                 |   6 +-
- tcg/tci.c                       |   3 +-
+ plugins/core.c                          |   2 +-
- target/cris/translate_v10.c.inc |  17 +-
+ target/alpha/cpu.c                      |   9 ++
- tcg/aarch64/tcg-target.c.inc    | 125 ++++------
+ target/arm/cpu.c                        |  17 ++-
- tcg/arm/tcg-target.c.inc        | 295 ++++++++++-------------
+ target/arm/mte_helper.c                 |  14 +-
- tcg/i386/tcg-target.c.inc       |  20 +-
+ target/arm/sve_helper.c                 |   4 +-
- tcg/mips/tcg-target.c.inc       | 102 ++++----
+ target/arm/translate-a64.c              |   2 +-
- tcg/ppc/tcg-target.c.inc        | 230 ++++++++++++------
+ target/avr/cpu.c                        |  10 +-
- tcg/riscv/tcg-target.c.inc      |  64 ++---
+ target/cris/cpu.c                       |   8 +
- tcg/s390/tcg-target.c.inc       |  34 ++-
+ target/hexagon/cpu.c                    |  10 +-
- tcg/tci/tcg-target.c.inc        |  23 +-
+ target/hppa/cpu.c                       |  12 +-
- tcg/README                      |  22 +-
+ target/i386/cpu.c                       |   9 ++
-files changed, 1458 insertions(+), 1094 deletions(-)
+ target/i386/tcg/tcg-cpu.c               |   2 +-
  target/loongarch/cpu.c                  |  11 +-
  target/m68k/cpu.c                       |   8 +
  target/microblaze/cpu.c                 |  10 +-
  target/mips/cpu.c                       |   8 +
  target/mips/tcg/exception.c             |   2 +-
  target/mips/tcg/sysemu/special_helper.c |   2 +-
  target/nios2/cpu.c                      |   9 ++
  target/openrisc/cpu.c                   |  10 +-
  target/ppc/cpu_init.c                   |   8 +
  target/riscv/cpu.c                      |  17 ++-
  target/rx/cpu.c                         |  10 +-
  target/s390x/cpu.c                      |   8 +
  target/s390x/tcg/mem_helper.c           |   4 -
  target/sh4/cpu.c                        |  18 ++-
  target/sh4/helper.c                     |   6 +-
  target/sh4/translate.c                  |  90 +++++------
  target/sparc/cpu.c                      |  10 +-
  target/tricore/cpu.c                    |  11 +-
  target/xtensa/cpu.c                     |   8 +
  tcg/tcg.c                               |   8 +-
  trace/control-target.c                  |   2 +-
  tcg/ppc/tcg-target.c.inc                | 119 +++++++++++----
 files changed, 915 insertions(+), 462 deletions(-)
  create mode 100644 accel/tcg/tb-jmp-cache.h

-[PULL 09/63] target/nios2: Use pc_next for pc + 4
+[PULL 01/20] cpu: cache CPUClass in CPUState for hot code paths
-We have pre-computed the next instruction address into
+From: Alex Bennée <alex.bennee@linaro.org>
 dc->base.pc_next, so we might as well use it.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+The class cast checkers are quite expensive and always on (unlike the
-Suggested-by: Peter Maydell <peter.maydell@linaro.org>
+dynamic case who's checks are gated by CONFIG_QOM_CAST_DEBUG). To
 avoid the overhead of repeatedly checking something which should never
 change we cache the CPUClass reference for use in the hot code paths.
 Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20220811151413.3350684-3-alex.bennee@linaro.org>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Message-Id: <20220923084803.498337-3-clg@kaod.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/nios2/translate.c | 12 ++++++------
+ include/hw/core/cpu.h | 9 +++++++++
-file changed, 6 insertions(+), 6 deletions(-)
+ cpu.c                 | 9 ++++-----
 files changed, 13 insertions(+), 5 deletions(-)
-diff --git a/target/nios2/translate.c b/target/nios2/translate.c
+diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/nios2/translate.c
+--- a/include/hw/core/cpu.h
-+++ b/target/nios2/translate.c
++++ b/include/hw/core/cpu.h
-@@ -XXX,XX +XXX,XX @@ static void jmpi(DisasContext *dc, uint32_t code, uint32_t flags)
+@@ -XXX,XX +XXX,XX @@ typedef int (*WriteCoreDumpFunction)(const void *buf, size_t size,
+  */
- static void call(DisasContext *dc, uint32_t code, uint32_t flags)
+ #define CPU(obj) ((CPUState *)(obj))
 +/*
 + * The class checkers bring in CPU_GET_CLASS() which is potentially
 + * expensive given the eventual call to
 + * object_class_dynamic_cast_assert(). Because of this the CPUState
 + * has a cached value for the class in cs->cc which is set up in
 + * cpu_exec_realizefn() for use in hot code paths.
 + */
  typedef struct CPUClass CPUClass;
  DECLARE_CLASS_CHECKERS(CPUClass, CPU,
                         TYPE_CPU)
@@ -XXX,XX +XXX,XX @@ struct qemu_work_item;
  struct CPUState {
      /*< private >*/
      DeviceState parent_obj;
 +    /* cache to avoid expensive CPU_GET_CLASS */
 +    CPUClass *cc;
      /*< public >*/
      int nr_cores;
 diff --git a/cpu.c b/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/cpu.c
 +++ b/cpu.c
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_cpu_common = {
  void cpu_exec_realizefn(CPUState *cpu, Error **errp)
  {
--    tcg_gen_movi_tl(cpu_R[R_RA], dc->pc + 4);
+-#ifndef CONFIG_USER_ONLY
-+    tcg_gen_movi_tl(cpu_R[R_RA], dc->base.pc_next);
+-    CPUClass *cc = CPU_GET_CLASS(cpu);
-     jmpi(dc, code, flags);
+-#endif
- }
++    /* cache the cpu class for the hotpath */
++    cpu->cc = CPU_GET_CLASS(cpu);
-@@ -XXX,XX +XXX,XX @@ static void br(DisasContext *dc, uint32_t code, uint32_t flags)
- {
+     cpu_list_add(cpu);
-     I_TYPE(instr, code);
+     if (!accel_cpu_realizefn(cpu, errp)) {
+@@ -XXX,XX +XXX,XX @@ void cpu_exec_realizefn(CPUState *cpu, Error **errp)
--    gen_goto_tb(dc, 0, dc->pc + 4 + (instr.imm16.s & -4));
+     if (qdev_get_vmsd(DEVICE(cpu)) == NULL) {
-+    gen_goto_tb(dc, 0, dc->base.pc_next + (instr.imm16.s & -4));
+         vmstate_register(NULL, cpu->cpu_index, &vmstate_cpu_common, cpu);
      dc->base.is_jmp = DISAS_NORETURN;
  }
@@ -XXX,XX +XXX,XX @@ static void gen_bxx(DisasContext *dc, uint32_t code, uint32_t flags)
      TCGLabel *l1 = gen_new_label();
      tcg_gen_brcond_tl(flags, cpu_R[instr.a], cpu_R[instr.b], l1);
 -    gen_goto_tb(dc, 0, dc->pc + 4);
 +    gen_goto_tb(dc, 0, dc->base.pc_next);
      gen_set_label(l1);
 -    gen_goto_tb(dc, 1, dc->pc + 4 + (instr.imm16.s & -4));
 +    gen_goto_tb(dc, 1, dc->base.pc_next + (instr.imm16.s & -4));
      dc->base.is_jmp = DISAS_NORETURN;
  }
@@ -XXX,XX +XXX,XX @@ static void nextpc(DisasContext *dc, uint32_t code, uint32_t flags)
      R_TYPE(instr, code);
      if (likely(instr.c != R_ZERO)) {
 -        tcg_gen_movi_tl(cpu_R[instr.c], dc->pc + 4);
 +        tcg_gen_movi_tl(cpu_R[instr.c], dc->base.pc_next);
      }
- }
+-    if (cc->sysemu_ops->legacy_vmsd != NULL) {
+-        vmstate_register(NULL, cpu->cpu_index, cc->sysemu_ops->legacy_vmsd, cpu);
-@@ -XXX,XX +XXX,XX @@ static void callr(DisasContext *dc, uint32_t code, uint32_t flags)
++    if (cpu->cc->sysemu_ops->legacy_vmsd != NULL) {
-     R_TYPE(instr, code);
++        vmstate_register(NULL, cpu->cpu_index, cpu->cc->sysemu_ops->legacy_vmsd, cpu);
+     }
-     tcg_gen_mov_tl(cpu_R[R_PC], load_gpr(dc, instr.a));
+ #endif /* CONFIG_USER_ONLY */
 -    tcg_gen_movi_tl(cpu_R[R_RA], dc->pc + 4);
 +    tcg_gen_movi_tl(cpu_R[R_RA], dc->base.pc_next);
      dc->base.is_jmp = DISAS_JUMP;
  }
 --
-.25.1
+.34.1

-[PULL 63/63] tcg/riscv: Remove MO_BSWAP handling
+[PULL 02/20] hw/core/cpu-sysemu: used cached class in cpu_asidx_from_attrs
-TCG_TARGET_HAS_MEMORY_BSWAP is already unset for this backend,
+From: Alex Bennée <alex.bennee@linaro.org>
 which means that MO_BSWAP be handled by the middle-end and
 will never be seen by the backend.  Thus the indexes used with
 qemu_{ld,st}_helpers will always be zero.
-Tidy the comments and asserts in tcg_out_qemu_{ld,st}_direct.
+This is a heavily used function so lets avoid the cost of
-It is not that we do not handle bswap "yet", but never will.
+CPU_GET_CLASS. On the romulus-bmc run it has a modest effect:
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+  Before: 36.812 s ±  0.506 s
   After:  35.912 s ±  0.168 s
 Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20220811151413.3350684-4-alex.bennee@linaro.org>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Message-Id: <20220923084803.498337-4-clg@kaod.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/riscv/tcg-target.c.inc | 64 ++++++++++++++++++++------------------
+ hw/core/cpu-sysemu.c | 5 ++---
-file changed, 33 insertions(+), 31 deletions(-)
+file changed, 2 insertions(+), 3 deletions(-)
-diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
+diff --git a/hw/core/cpu-sysemu.c b/hw/core/cpu-sysemu.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/riscv/tcg-target.c.inc
+--- a/hw/core/cpu-sysemu.c
-+++ b/tcg/riscv/tcg-target.c.inc
++++ b/hw/core/cpu-sysemu.c
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_mb(TCGContext *s, TCGArg a0)
+@@ -XXX,XX +XXX,XX @@ hwaddr cpu_get_phys_page_debug(CPUState *cpu, vaddr addr)
- /* helper signature: helper_ret_ld_mmu(CPUState *env, target_ulong addr,
-  *                                     TCGMemOpIdx oi, uintptr_t ra)
+ int cpu_asidx_from_attrs(CPUState *cpu, MemTxAttrs attrs)
   */
 -static void * const qemu_ld_helpers[16] = {
 -    [MO_UB]   = helper_ret_ldub_mmu,
 -    [MO_SB]   = helper_ret_ldsb_mmu,
 -    [MO_LEUW] = helper_le_lduw_mmu,
 -    [MO_LESW] = helper_le_ldsw_mmu,
 -    [MO_LEUL] = helper_le_ldul_mmu,
 +static void * const qemu_ld_helpers[8] = {
 +    [MO_UB] = helper_ret_ldub_mmu,
 +    [MO_SB] = helper_ret_ldsb_mmu,
 +#ifdef HOST_WORDS_BIGENDIAN
 +    [MO_UW] = helper_be_lduw_mmu,
 +    [MO_SW] = helper_be_ldsw_mmu,
 +    [MO_UL] = helper_be_ldul_mmu,
  #if TCG_TARGET_REG_BITS == 64
 -    [MO_LESL] = helper_le_ldsl_mmu,
 +    [MO_SL] = helper_be_ldsl_mmu,
  #endif
 -    [MO_LEQ]  = helper_le_ldq_mmu,
 -    [MO_BEUW] = helper_be_lduw_mmu,
 -    [MO_BESW] = helper_be_ldsw_mmu,
 -    [MO_BEUL] = helper_be_ldul_mmu,
 +    [MO_Q]  = helper_be_ldq_mmu,
 +#else
 +    [MO_UW] = helper_le_lduw_mmu,
 +    [MO_SW] = helper_le_ldsw_mmu,
 +    [MO_UL] = helper_le_ldul_mmu,
  #if TCG_TARGET_REG_BITS == 64
 -    [MO_BESL] = helper_be_ldsl_mmu,
 +    [MO_SL] = helper_le_ldsl_mmu,
 +#endif
 +    [MO_Q]  = helper_le_ldq_mmu,
  #endif
 -    [MO_BEQ]  = helper_be_ldq_mmu,
  };
  /* helper signature: helper_ret_st_mmu(CPUState *env, target_ulong addr,
   *                                     uintxx_t val, TCGMemOpIdx oi,
   *                                     uintptr_t ra)
   */
 -static void * const qemu_st_helpers[16] = {
 -    [MO_UB]   = helper_ret_stb_mmu,
 -    [MO_LEUW] = helper_le_stw_mmu,
 -    [MO_LEUL] = helper_le_stl_mmu,
 -    [MO_LEQ]  = helper_le_stq_mmu,
 -    [MO_BEUW] = helper_be_stw_mmu,
 -    [MO_BEUL] = helper_be_stl_mmu,
 -    [MO_BEQ]  = helper_be_stq_mmu,
 +static void * const qemu_st_helpers[4] = {
 +    [MO_8]   = helper_ret_stb_mmu,
 +#ifdef HOST_WORDS_BIGENDIAN
 +    [MO_16] = helper_be_stw_mmu,
 +    [MO_32] = helper_be_stl_mmu,
 +    [MO_64] = helper_be_stq_mmu,
 +#else
 +    [MO_16] = helper_le_stw_mmu,
 +    [MO_32] = helper_le_stl_mmu,
 +    [MO_64] = helper_le_stq_mmu,
 +#endif
  };
  /* We don't support oversize guests */
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
      tcg_out_movi(s, TCG_TYPE_PTR, a2, oi);
      tcg_out_movi(s, TCG_TYPE_PTR, a3, (tcg_target_long)l->raddr);
 -    tcg_out_call(s, qemu_ld_helpers[opc & (MO_BSWAP | MO_SSIZE)]);
 +    tcg_out_call(s, qemu_ld_helpers[opc & MO_SSIZE]);
      tcg_out_mov(s, (opc & MO_SIZE) == MO_64, l->datalo_reg, a0);
      tcg_out_goto(s, l->raddr);
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
      tcg_out_movi(s, TCG_TYPE_PTR, a3, oi);
      tcg_out_movi(s, TCG_TYPE_PTR, a4, (tcg_target_long)l->raddr);
 -    tcg_out_call(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SSIZE)]);
 +    tcg_out_call(s, qemu_st_helpers[opc & MO_SIZE]);
      tcg_out_goto(s, l->raddr);
      return true;
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
  static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg lo, TCGReg hi,
                                     TCGReg base, MemOp opc, bool is_64)
  {
--    const MemOp bswap = opc & MO_BSWAP;
+-    CPUClass *cc = CPU_GET_CLASS(cpu);
--
+     int ret = 0;
--    /* We don't yet handle byteswapping, assert */
--    g_assert(!bswap);
+-    if (cc->sysemu_ops->asidx_from_attrs) {
-+    /* Byte swapping is left to middle-end expansion. */
+-        ret = cc->sysemu_ops->asidx_from_attrs(cpu, attrs);
-+    tcg_debug_assert((opc & MO_BSWAP) == 0);
++    if (cpu->cc->sysemu_ops->asidx_from_attrs) {
++        ret = cpu->cc->sysemu_ops->asidx_from_attrs(cpu, attrs);
-     switch (opc & (MO_SSIZE)) {
+         assert(ret < cpu->num_ases && ret >= 0);
-     case MO_UB:
+     }
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
+     return ret;
  static void tcg_out_qemu_st_direct(TCGContext *s, TCGReg lo, TCGReg hi,
                                     TCGReg base, MemOp opc)
  {
 -    const MemOp bswap = opc & MO_BSWAP;
 -
 -    /* We don't yet handle byteswapping, assert */
 -    g_assert(!bswap);
 +    /* Byte swapping is left to middle-end expansion. */
 +    tcg_debug_assert((opc & MO_BSWAP) == 0);
      switch (opc & (MO_SSIZE)) {
      case MO_8:
 --
-.25.1
+.34.1

-[PULL 48/63] tcg/mips: Support bswap flags in tcg_out_bswap16
+[PULL 03/20] cputlb: used cached CPUClass in our hot-paths
-Merge tcg_out_bswap16 and tcg_out_bswap16s.  Use the flags
+From: Alex Bennée <alex.bennee@linaro.org>
 in the internal uses for loads and stores.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Before: 35.912 s ±  0.168 s
   After: 35.565 s ±  0.087 s
 Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20220811151413.3350684-5-alex.bennee@linaro.org>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Message-Id: <20220923084803.498337-5-clg@kaod.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/mips/tcg-target.c.inc | 63 +++++++++++++++++++--------------------
+ accel/tcg/cputlb.c | 15 ++++++---------
-file changed, 30 insertions(+), 33 deletions(-)
+file changed, 6 insertions(+), 9 deletions(-)
-diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
+diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/mips/tcg-target.c.inc
+--- a/accel/tcg/cputlb.c
-+++ b/tcg/mips/tcg-target.c.inc
++++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi(TCGContext *s, TCGType type,
+@@ -XXX,XX +XXX,XX @@ void tlb_set_page(CPUState *cpu, target_ulong vaddr,
-     }
+ static void tlb_fill(CPUState *cpu, target_ulong addr, int size,
                       MMUAccessType access_type, int mmu_idx, uintptr_t retaddr)
  {
 -    CPUClass *cc = CPU_GET_CLASS(cpu);
      bool ok;
      /*
       * This is not a probe, so only valid return is success; failure
       * should result in exception + longjmp to the cpu loop.
       */
 -    ok = cc->tcg_ops->tlb_fill(cpu, addr, size,
 -                               access_type, mmu_idx, false, retaddr);
 +    ok = cpu->cc->tcg_ops->tlb_fill(cpu, addr, size,
 +                                    access_type, mmu_idx, false, retaddr);
      assert(ok);
  }
--static inline void tcg_out_bswap16(TCGContext *s, TCGReg ret, TCGReg arg)
+@@ -XXX,XX +XXX,XX @@ static inline void cpu_unaligned_access(CPUState *cpu, vaddr addr,
-+static void tcg_out_bswap16(TCGContext *s, TCGReg ret, TCGReg arg, int flags)
+                                         MMUAccessType access_type,
                                          int mmu_idx, uintptr_t retaddr)
  {
-+    /* ret and arg can't be register tmp0 */
+-    CPUClass *cc = CPU_GET_CLASS(cpu);
 +    tcg_debug_assert(ret != TCG_TMP0);
 +    tcg_debug_assert(arg != TCG_TMP0);
 +
 +    /* With arg = abcd: */
      if (use_mips32r2_instructions) {
 -        tcg_out_opc_reg(s, OPC_WSBH, ret, 0, arg);
 -    } else {
 -        /* ret and arg can't be register at */
 -        if (ret == TCG_TMP0 || arg == TCG_TMP0) {
 -            tcg_abort();
 +        tcg_out_opc_reg(s, OPC_WSBH, ret, 0, arg);                 /* badc */
 +        if (flags & TCG_BSWAP_OS) {
 +            tcg_out_opc_reg(s, OPC_SEH, ret, 0, ret);              /* ssdc */
 +        } else if ((flags & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
 +            tcg_out_opc_imm(s, OPC_ANDI, ret, ret, 0xffff);        /* 00dc */
          }
 -
--        tcg_out_opc_sa(s, OPC_SRL, TCG_TMP0, arg, 8);
+-    cc->tcg_ops->do_unaligned_access(cpu, addr, access_type, mmu_idx, retaddr);
--        tcg_out_opc_sa(s, OPC_SLL, ret, arg, 8);
++    cpu->cc->tcg_ops->do_unaligned_access(cpu, addr, access_type,
--        tcg_out_opc_imm(s, OPC_ANDI, ret, ret, 0xff00);
++                                          mmu_idx, retaddr);
 -        tcg_out_opc_reg(s, OPC_OR, ret, ret, TCG_TMP0);
 +        return;
      }
 -}
 -static inline void tcg_out_bswap16s(TCGContext *s, TCGReg ret, TCGReg arg)
 -{
 -    if (use_mips32r2_instructions) {
 -        tcg_out_opc_reg(s, OPC_WSBH, ret, 0, arg);
 -        tcg_out_opc_reg(s, OPC_SEH, ret, 0, ret);
 +    tcg_out_opc_sa(s, OPC_SRL, TCG_TMP0, arg, 8);                  /* 0abc */
 +    if (!(flags & TCG_BSWAP_IZ)) {
 +        tcg_out_opc_imm(s, OPC_ANDI, TCG_TMP0, TCG_TMP0, 0x00ff);  /* 000c */
 +    }
 +    if (flags & TCG_BSWAP_OS) {
 +        tcg_out_opc_sa(s, OPC_SLL, ret, arg, 24);                  /* d000 */
 +        tcg_out_opc_sa(s, OPC_SRA, ret, ret, 16);                  /* ssd0 */
      } else {
 -        /* ret and arg can't be register at */
 -        if (ret == TCG_TMP0 || arg == TCG_TMP0) {
 -            tcg_abort();
 +        tcg_out_opc_sa(s, OPC_SLL, ret, arg, 8);                   /* bcd0 */
 +        if (flags & TCG_BSWAP_OZ) {
 +            tcg_out_opc_imm(s, OPC_ANDI, ret, ret, 0xff00);        /* 00d0 */
          }
 -
 -        tcg_out_opc_sa(s, OPC_SRL, TCG_TMP0, arg, 8);
 -        tcg_out_opc_sa(s, OPC_SLL, ret, arg, 24);
 -        tcg_out_opc_sa(s, OPC_SRA, ret, ret, 16);
 -        tcg_out_opc_reg(s, OPC_OR, ret, ret, TCG_TMP0);
      }
 +    tcg_out_opc_reg(s, OPC_OR, ret, ret, TCG_TMP0);                /* ssdc */
  }
- static void tcg_out_bswap_subr(TCGContext *s, const tcg_insn_unit *sub)
+ static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg lo, TCGReg hi,
+@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
-         break;
+     if (!tlb_hit_page(tlb_addr, page_addr)) {
-     case MO_UW | MO_BSWAP:
+         if (!victim_tlb_hit(env, mmu_idx, index, elt_ofs, page_addr)) {
-         tcg_out_opc_imm(s, OPC_LHU, TCG_TMP1, base, 0);
+             CPUState *cs = env_cpu(env);
--        tcg_out_bswap16(s, lo, TCG_TMP1);
+-            CPUClass *cc = CPU_GET_CLASS(cs);
-+        tcg_out_bswap16(s, lo, TCG_TMP1, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
-         break;
+-            if (!cc->tcg_ops->tlb_fill(cs, addr, fault_size, access_type,
-     case MO_UW:
+-                                       mmu_idx, nonfault, retaddr)) {
-         tcg_out_opc_imm(s, OPC_LHU, lo, base, 0);
++            if (!cs->cc->tcg_ops->tlb_fill(cs, addr, fault_size, access_type,
-         break;
++                                           mmu_idx, nonfault, retaddr)) {
-     case MO_SW | MO_BSWAP:
+                 /* Non-faulting page table read failed.  */
-         tcg_out_opc_imm(s, OPC_LHU, TCG_TMP1, base, 0);
+                 *phost = NULL;
--        tcg_out_bswap16s(s, lo, TCG_TMP1);
+                 return TLB_INVALID_MASK;
 +        tcg_out_bswap16(s, lo, TCG_TMP1, TCG_BSWAP_IZ | TCG_BSWAP_OS);
          break;
      case MO_SW:
          tcg_out_opc_imm(s, OPC_LH, lo, base, 0);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, TCGReg lo, TCGReg hi,
          break;
      case MO_16 | MO_BSWAP:
 -        tcg_out_opc_imm(s, OPC_ANDI, TCG_TMP1, lo, 0xffff);
 -        tcg_out_bswap16(s, TCG_TMP1, TCG_TMP1);
 +        tcg_out_bswap16(s, TCG_TMP1, lo, 0);
          lo = TCG_TMP1;
          /* FALLTHRU */
      case MO_16:
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_not_i64:
          i1 = OPC_NOR;
          goto do_unary;
 -    case INDEX_op_bswap16_i32:
 -    case INDEX_op_bswap16_i64:
 -        i1 = OPC_WSBH;
 -        goto do_unary;
      case INDEX_op_ext8s_i32:
      case INDEX_op_ext8s_i64:
          i1 = OPC_SEB;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
          tcg_out_opc_reg(s, i1, a0, TCG_REG_ZERO, a1);
          break;
 +    case INDEX_op_bswap16_i32:
 +    case INDEX_op_bswap16_i64:
 +        tcg_out_bswap16(s, a0, a1, a2);
 +        break;
      case INDEX_op_bswap32_i32:
          tcg_out_bswap32(s, a0, a1);
          break;
 --
-.25.1
+.34.1

-[PULL 55/63] target/arm: Improve REV32
+[PULL 04/20] accel/tcg: Rename CPUIOTLBEntry to CPUTLBEntryFull
-For the sf version, we are performing two 32-bit bswaps
+This structure will shortly contain more than just
-in either half of the register.  This is equivalent to
+data for accessing MMIO.  Rename the 'addr' member
-performing one 64-bit bswap followed by a rotate.
+to 'xlat_section' to more clearly indicate its purpose.
-For the non-sf version, we can remove TCG_BSWAP_IZ
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 and the preceding zero-extension.
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/arm/translate-a64.c | 17 ++++-------------
+ include/exec/cpu-defs.h    |  22 ++++----
-file changed, 4 insertions(+), 13 deletions(-)
+ accel/tcg/cputlb.c         | 102 +++++++++++++++++++------------------
  target/arm/mte_helper.c    |  14 ++---
  target/arm/sve_helper.c    |   4 +-
  target/arm/translate-a64.c |   2 +-
 files changed, 73 insertions(+), 71 deletions(-)
+diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/exec/cpu-defs.h
++++ b/include/exec/cpu-defs.h
+@@ -XXX,XX +XXX,XX @@ typedef uint64_t target_ulong;
+ #  endif
+ # endif
++/* Minimalized TLB entry for use by TCG fast path. */
+ typedef struct CPUTLBEntry {
+     /* bit TARGET_LONG_BITS to TARGET_PAGE_BITS : virtual address
+        bit TARGET_PAGE_BITS-1..4  : Nonzero for accesses that should not
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUTLBEntry {
+ QEMU_BUILD_BUG_ON(sizeof(CPUTLBEntry) != (1 << CPU_TLB_ENTRY_BITS));
+-/* The IOTLB is not accessed directly inline by generated TCG code,
+- * so the CPUIOTLBEntry layout is not as critical as that of the
+- * CPUTLBEntry. (This is also why we don't want to combine the two
+- * structs into one.)
++/*
++ * The full TLB entry, which is not accessed by generated TCG code,
++ * so the layout is not as critical as that of CPUTLBEntry. This is
++ * also why we don't want to combine the two structs.
+  */
+-typedef struct CPUIOTLBEntry {
++typedef struct CPUTLBEntryFull {
+     /*
+-     * @addr contains:
++     * @xlat_section contains:
+      *  - in the lower TARGET_PAGE_BITS, a physical section number
+      *  - with the lower TARGET_PAGE_BITS masked off, an offset which
+      *    must be added to the virtual address to obtain:
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUIOTLBEntry {
+      *       number is PHYS_SECTION_NOTDIRTY or PHYS_SECTION_ROM)
+      *     + the offset within the target MemoryRegion (otherwise)
+      */
+-    hwaddr addr;
++    hwaddr xlat_section;
+     MemTxAttrs attrs;
+-} CPUIOTLBEntry;
++} CPUTLBEntryFull;
+ /*
+  * Data elements that are per MMU mode, minus the bits accessed by
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUTLBDesc {
+     size_t vindex;
+     /* The tlb victim table, in two parts.  */
+     CPUTLBEntry vtable[CPU_VTLB_SIZE];
+-    CPUIOTLBEntry viotlb[CPU_VTLB_SIZE];
+-    /* The iotlb.  */
+-    CPUIOTLBEntry *iotlb;
++    CPUTLBEntryFull vfulltlb[CPU_VTLB_SIZE];
++    CPUTLBEntryFull *fulltlb;
+ } CPUTLBDesc;
+ /*
+diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/cputlb.c
++++ b/accel/tcg/cputlb.c
+@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast,
+     }
+     g_free(fast->table);
+-    g_free(desc->iotlb);
++    g_free(desc->fulltlb);
+     tlb_window_reset(desc, now, 0);
+     /* desc->n_used_entries is cleared by the caller */
+     fast->mask = (new_size - 1) << CPU_TLB_ENTRY_BITS;
+     fast->table = g_try_new(CPUTLBEntry, new_size);
+-    desc->iotlb = g_try_new(CPUIOTLBEntry, new_size);
++    desc->fulltlb = g_try_new(CPUTLBEntryFull, new_size);
+     /*
+      * If the allocations fail, try smaller sizes. We just freed some
+@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast,
+      * allocations to fail though, so we progressively reduce the allocation
+      * size, aborting if we cannot even allocate the smallest TLB we support.
+      */
+-    while (fast->table == NULL || desc->iotlb == NULL) {
++    while (fast->table == NULL || desc->fulltlb == NULL) {
+         if (new_size == (1 << CPU_TLB_DYN_MIN_BITS)) {
+             error_report("%s: %s", __func__, strerror(errno));
+             abort();
+@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast,
+         fast->mask = (new_size - 1) << CPU_TLB_ENTRY_BITS;
+         g_free(fast->table);
+-        g_free(desc->iotlb);
++        g_free(desc->fulltlb);
+         fast->table = g_try_new(CPUTLBEntry, new_size);
+-        desc->iotlb = g_try_new(CPUIOTLBEntry, new_size);
++        desc->fulltlb = g_try_new(CPUTLBEntryFull, new_size);
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_init(CPUTLBDesc *desc, CPUTLBDescFast *fast, int64_t now)
+     desc->n_used_entries = 0;
+     fast->mask = (n_entries - 1) << CPU_TLB_ENTRY_BITS;
+     fast->table = g_new(CPUTLBEntry, n_entries);
+-    desc->iotlb = g_new(CPUIOTLBEntry, n_entries);
++    desc->fulltlb = g_new(CPUTLBEntryFull, n_entries);
+     tlb_mmu_flush_locked(desc, fast);
+ }
+@@ -XXX,XX +XXX,XX @@ void tlb_destroy(CPUState *cpu)
+         CPUTLBDescFast *fast = &env_tlb(env)->f[i];
+         g_free(fast->table);
+-        g_free(desc->iotlb);
++        g_free(desc->fulltlb);
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
+         /* Evict the old entry into the victim tlb.  */
+         copy_tlb_helper_locked(tv, te);
+-        desc->viotlb[vidx] = desc->iotlb[index];
++        desc->vfulltlb[vidx] = desc->fulltlb[index];
+         tlb_n_used_entries_dec(env, mmu_idx);
+     }
+@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
+      * subtract here is that of the page base, and not the same as the
+      * vaddr we add back in io_readx()/io_writex()/get_page_addr_code().
+      */
+-    desc->iotlb[index].addr = iotlb - vaddr_page;
+-    desc->iotlb[index].attrs = attrs;
++    desc->fulltlb[index].xlat_section = iotlb - vaddr_page;
++    desc->fulltlb[index].attrs = attrs;
+     /* Now calculate the new entry */
+     tn.addend = addend - vaddr_page;
+@@ -XXX,XX +XXX,XX @@ static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
+     }
+ }
+-static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
++static uint64_t io_readx(CPUArchState *env, CPUTLBEntryFull *full,
+                          int mmu_idx, target_ulong addr, uintptr_t retaddr,
+                          MMUAccessType access_type, MemOp op)
+ {
+@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
+     bool locked = false;
+     MemTxResult r;
+-    section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
++    section = iotlb_to_section(cpu, full->xlat_section, full->attrs);
+     mr = section->mr;
+-    mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
++    mr_offset = (full->xlat_section & TARGET_PAGE_MASK) + addr;
+     cpu->mem_io_pc = retaddr;
+     if (!cpu->can_do_io) {
+         cpu_io_recompile(cpu, retaddr);
+@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
+         qemu_mutex_lock_iothread();
+         locked = true;
+     }
+-    r = memory_region_dispatch_read(mr, mr_offset, &val, op, iotlbentry->attrs);
++    r = memory_region_dispatch_read(mr, mr_offset, &val, op, full->attrs);
+     if (r != MEMTX_OK) {
+         hwaddr physaddr = mr_offset +
+             section->offset_within_address_space -
+             section->offset_within_region;
+         cpu_transaction_failed(cpu, physaddr, addr, memop_size(op), access_type,
+-                               mmu_idx, iotlbentry->attrs, r, retaddr);
++                               mmu_idx, full->attrs, r, retaddr);
+     }
+     if (locked) {
+         qemu_mutex_unlock_iothread();
+@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
+ }
+ /*
+- * Save a potentially trashed IOTLB entry for later lookup by plugin.
+- * This is read by tlb_plugin_lookup if the iotlb entry doesn't match
++ * Save a potentially trashed CPUTLBEntryFull for later lookup by plugin.
++ * This is read by tlb_plugin_lookup if the fulltlb entry doesn't match
+  * because of the side effect of io_writex changing memory layout.
+  */
+ static void save_iotlb_data(CPUState *cs, hwaddr addr,
+@@ -XXX,XX +XXX,XX @@ static void save_iotlb_data(CPUState *cs, hwaddr addr,
+ #endif
+ }
+-static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
++static void io_writex(CPUArchState *env, CPUTLBEntryFull *full,
+                       int mmu_idx, uint64_t val, target_ulong addr,
+                       uintptr_t retaddr, MemOp op)
+ {
+@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
+     bool locked = false;
+     MemTxResult r;
+-    section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
++    section = iotlb_to_section(cpu, full->xlat_section, full->attrs);
+     mr = section->mr;
+-    mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
++    mr_offset = (full->xlat_section & TARGET_PAGE_MASK) + addr;
+     if (!cpu->can_do_io) {
+         cpu_io_recompile(cpu, retaddr);
+     }
+@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
+      * The memory_region_dispatch may trigger a flush/resize
+      * so for plugins we save the iotlb_data just in case.
+      */
+-    save_iotlb_data(cpu, iotlbentry->addr, section, mr_offset);
++    save_iotlb_data(cpu, full->xlat_section, section, mr_offset);
+     if (!qemu_mutex_iothread_locked()) {
+         qemu_mutex_lock_iothread();
+         locked = true;
+     }
+-    r = memory_region_dispatch_write(mr, mr_offset, val, op, iotlbentry->attrs);
++    r = memory_region_dispatch_write(mr, mr_offset, val, op, full->attrs);
+     if (r != MEMTX_OK) {
+         hwaddr physaddr = mr_offset +
+             section->offset_within_address_space -
+             section->offset_within_region;
+         cpu_transaction_failed(cpu, physaddr, addr, memop_size(op),
+-                               MMU_DATA_STORE, mmu_idx, iotlbentry->attrs, r,
++                               MMU_DATA_STORE, mmu_idx, full->attrs, r,
+                                retaddr);
+     }
+     if (locked) {
+@@ -XXX,XX +XXX,XX @@ static bool victim_tlb_hit(CPUArchState *env, size_t mmu_idx, size_t index,
+             copy_tlb_helper_locked(vtlb, &tmptlb);
+             qemu_spin_unlock(&env_tlb(env)->c.lock);
+-            CPUIOTLBEntry tmpio, *io = &env_tlb(env)->d[mmu_idx].iotlb[index];
+-            CPUIOTLBEntry *vio = &env_tlb(env)->d[mmu_idx].viotlb[vidx];
+-            tmpio = *io; *io = *vio; *vio = tmpio;
++            CPUTLBEntryFull *f1 = &env_tlb(env)->d[mmu_idx].fulltlb[index];
++            CPUTLBEntryFull *f2 = &env_tlb(env)->d[mmu_idx].vfulltlb[vidx];
++            CPUTLBEntryFull tmpf;
++            tmpf = *f1; *f1 = *f2; *f2 = tmpf;
+             return true;
+         }
+     }
+@@ -XXX,XX +XXX,XX @@ static bool victim_tlb_hit(CPUArchState *env, size_t mmu_idx, size_t index,
+                  (ADDR) & TARGET_PAGE_MASK)
+ static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
+-                           CPUIOTLBEntry *iotlbentry, uintptr_t retaddr)
++                           CPUTLBEntryFull *full, uintptr_t retaddr)
+ {
+-    ram_addr_t ram_addr = mem_vaddr + iotlbentry->addr;
++    ram_addr_t ram_addr = mem_vaddr + full->xlat_section;
+     trace_memory_notdirty_write_access(mem_vaddr, ram_addr, size);
+@@ -XXX,XX +XXX,XX @@ int probe_access_flags(CPUArchState *env, target_ulong addr,
+     /* Handle clean RAM pages.  */
+     if (unlikely(flags & TLB_NOTDIRTY)) {
+         uintptr_t index = tlb_index(env, mmu_idx, addr);
+-        CPUIOTLBEntry *iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
++        CPUTLBEntryFull *full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
+-        notdirty_write(env_cpu(env), addr, 1, iotlbentry, retaddr);
++        notdirty_write(env_cpu(env), addr, 1, full, retaddr);
+         flags &= ~TLB_NOTDIRTY;
+     }
+@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
+     if (unlikely(flags & (TLB_NOTDIRTY | TLB_WATCHPOINT))) {
+         uintptr_t index = tlb_index(env, mmu_idx, addr);
+-        CPUIOTLBEntry *iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
++        CPUTLBEntryFull *full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
+         /* Handle watchpoints.  */
+         if (flags & TLB_WATCHPOINT) {
+             int wp_access = (access_type == MMU_DATA_STORE
+                              ? BP_MEM_WRITE : BP_MEM_READ);
+             cpu_check_watchpoint(env_cpu(env), addr, size,
+-                                 iotlbentry->attrs, wp_access, retaddr);
++                                 full->attrs, wp_access, retaddr);
+         }
+         /* Handle clean RAM pages.  */
+         if (flags & TLB_NOTDIRTY) {
+-            notdirty_write(env_cpu(env), addr, 1, iotlbentry, retaddr);
++            notdirty_write(env_cpu(env), addr, 1, full, retaddr);
+         }
+     }
+@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
+  * should have just filled the TLB. The one corner case is io_writex
+  * which can cause TLB flushes and potential resizing of the TLBs
+  * losing the information we need. In those cases we need to recover
+- * data from a copy of the iotlbentry. As long as this always occurs
++ * data from a copy of the CPUTLBEntryFull. As long as this always occurs
+  * from the same thread (which a mem callback will be) this is safe.
+  */
+@@ -XXX,XX +XXX,XX @@ bool tlb_plugin_lookup(CPUState *cpu, target_ulong addr, int mmu_idx,
+     if (likely(tlb_hit(tlb_addr, addr))) {
+         /* We must have an iotlb entry for MMIO */
+         if (tlb_addr & TLB_MMIO) {
+-            CPUIOTLBEntry *iotlbentry;
+-            iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
++            CPUTLBEntryFull *full;
++            full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
+             data->is_io = true;
+-            data->v.io.section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
+-            data->v.io.offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
++            data->v.io.section =
++                iotlb_to_section(cpu, full->xlat_section, full->attrs);
++            data->v.io.offset = (full->xlat_section & TARGET_PAGE_MASK) + addr;
+         } else {
+             data->is_io = false;
+             data->v.ram.hostaddr = (void *)((uintptr_t)addr + tlbe->addend);
+@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
+     if (unlikely(tlb_addr & TLB_NOTDIRTY)) {
+         notdirty_write(env_cpu(env), addr, size,
+-                       &env_tlb(env)->d[mmu_idx].iotlb[index], retaddr);
++                       &env_tlb(env)->d[mmu_idx].fulltlb[index], retaddr);
+     }
+     return hostaddr;
+@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, MemOpIdx oi,
+     /* Handle anything that isn't just a straight memory access.  */
+     if (unlikely(tlb_addr & ~TARGET_PAGE_MASK)) {
+-        CPUIOTLBEntry *iotlbentry;
++        CPUTLBEntryFull *full;
+         bool need_swap;
+         /* For anything that is unaligned, recurse through full_load.  */
+@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, MemOpIdx oi,
+             goto do_unaligned_access;
+         }
+-        iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
++        full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
+         /* Handle watchpoints.  */
+         if (unlikely(tlb_addr & TLB_WATCHPOINT)) {
+             /* On watchpoint hit, this will longjmp out.  */
+             cpu_check_watchpoint(env_cpu(env), addr, size,
+-                                 iotlbentry->attrs, BP_MEM_READ, retaddr);
++                                 full->attrs, BP_MEM_READ, retaddr);
+         }
+         need_swap = size > 1 && (tlb_addr & TLB_BSWAP);
+         /* Handle I/O access.  */
+         if (likely(tlb_addr & TLB_MMIO)) {
+-            return io_readx(env, iotlbentry, mmu_idx, addr, retaddr,
++            return io_readx(env, full, mmu_idx, addr, retaddr,
+                             access_type, op ^ (need_swap * MO_BSWAP));
+         }
+@@ -XXX,XX +XXX,XX @@ store_helper_unaligned(CPUArchState *env, target_ulong addr, uint64_t val,
+      */
+     if (unlikely(tlb_addr & TLB_WATCHPOINT)) {
+         cpu_check_watchpoint(env_cpu(env), addr, size - size2,
+-                             env_tlb(env)->d[mmu_idx].iotlb[index].attrs,
++                             env_tlb(env)->d[mmu_idx].fulltlb[index].attrs,
+                              BP_MEM_WRITE, retaddr);
+     }
+     if (unlikely(tlb_addr2 & TLB_WATCHPOINT)) {
+         cpu_check_watchpoint(env_cpu(env), page2, size2,
+-                             env_tlb(env)->d[mmu_idx].iotlb[index2].attrs,
++                             env_tlb(env)->d[mmu_idx].fulltlb[index2].attrs,
+                              BP_MEM_WRITE, retaddr);
+     }
+@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
+     /* Handle anything that isn't just a straight memory access.  */
+     if (unlikely(tlb_addr & ~TARGET_PAGE_MASK)) {
+-        CPUIOTLBEntry *iotlbentry;
++        CPUTLBEntryFull *full;
+         bool need_swap;
+         /* For anything that is unaligned, recurse through byte stores.  */
+@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
+             goto do_unaligned_access;
+         }
+-        iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
++        full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
+         /* Handle watchpoints.  */
+         if (unlikely(tlb_addr & TLB_WATCHPOINT)) {
+             /* On watchpoint hit, this will longjmp out.  */
+             cpu_check_watchpoint(env_cpu(env), addr, size,
+-                                 iotlbentry->attrs, BP_MEM_WRITE, retaddr);
++                                 full->attrs, BP_MEM_WRITE, retaddr);
+         }
+         need_swap = size > 1 && (tlb_addr & TLB_BSWAP);
+         /* Handle I/O access.  */
+         if (tlb_addr & TLB_MMIO) {
+-            io_writex(env, iotlbentry, mmu_idx, val, addr, retaddr,
++            io_writex(env, full, mmu_idx, val, addr, retaddr,
+                       op ^ (need_swap * MO_BSWAP));
+             return;
+         }
+@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
+         /* Handle clean RAM pages.  */
+         if (tlb_addr & TLB_NOTDIRTY) {
+-            notdirty_write(env_cpu(env), addr, size, iotlbentry, retaddr);
++            notdirty_write(env_cpu(env), addr, size, full, retaddr);
+         }
+         haddr = (void *)((uintptr_t)addr + entry->addend);
+diff --git a/target/arm/mte_helper.c b/target/arm/mte_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/mte_helper.c
++++ b/target/arm/mte_helper.c
+@@ -XXX,XX +XXX,XX @@ static uint8_t *allocation_tag_mem(CPUARMState *env, int ptr_mmu_idx,
+     return tags + index;
+ #else
+     uintptr_t index;
+-    CPUIOTLBEntry *iotlbentry;
++    CPUTLBEntryFull *full;
+     int in_page, flags;
+     ram_addr_t ptr_ra;
+     hwaddr ptr_paddr, tag_paddr, xlat;
+@@ -XXX,XX +XXX,XX @@ static uint8_t *allocation_tag_mem(CPUARMState *env, int ptr_mmu_idx,
+     assert(!(flags & TLB_INVALID_MASK));
+     /*
+-     * Find the iotlbentry for ptr.  This *must* be present in the TLB
++     * Find the CPUTLBEntryFull for ptr.  This *must* be present in the TLB
+      * because we just found the mapping.
+      * TODO: Perhaps there should be a cputlb helper that returns a
+      * matching tlb entry + iotlb entry.
+@@ -XXX,XX +XXX,XX @@ static uint8_t *allocation_tag_mem(CPUARMState *env, int ptr_mmu_idx,
+         g_assert(tlb_hit(comparator, ptr));
+     }
+ # endif
+-    iotlbentry = &env_tlb(env)->d[ptr_mmu_idx].iotlb[index];
++    full = &env_tlb(env)->d[ptr_mmu_idx].fulltlb[index];
+     /* If the virtual page MemAttr != Tagged, access unchecked. */
+-    if (!arm_tlb_mte_tagged(&iotlbentry->attrs)) {
++    if (!arm_tlb_mte_tagged(&full->attrs)) {
+         return NULL;
+     }
+@@ -XXX,XX +XXX,XX @@ static uint8_t *allocation_tag_mem(CPUARMState *env, int ptr_mmu_idx,
+         int wp = ptr_access == MMU_DATA_LOAD ? BP_MEM_READ : BP_MEM_WRITE;
+         assert(ra != 0);
+         cpu_check_watchpoint(env_cpu(env), ptr, ptr_size,
+-                             iotlbentry->attrs, wp, ra);
++                             full->attrs, wp, ra);
+     }
+     /*
+@@ -XXX,XX +XXX,XX @@ static uint8_t *allocation_tag_mem(CPUARMState *env, int ptr_mmu_idx,
+     tag_paddr = ptr_paddr >> (LOG2_TAG_GRANULE + 1);
+     /* Look up the address in tag space. */
+-    tag_asi = iotlbentry->attrs.secure ? ARMASIdx_TagS : ARMASIdx_TagNS;
++    tag_asi = full->attrs.secure ? ARMASIdx_TagS : ARMASIdx_TagNS;
+     tag_as = cpu_get_address_space(env_cpu(env), tag_asi);
+     mr = address_space_translate(tag_as, tag_paddr, &xlat, NULL,
+                                  tag_access == MMU_DATA_STORE,
+-                                 iotlbentry->attrs);
++                                 full->attrs);
+     /*
+      * Note that @mr will never be NULL.  If there is nothing in the address
+diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/sve_helper.c
++++ b/target/arm/sve_helper.c
+@@ -XXX,XX +XXX,XX @@ bool sve_probe_page(SVEHostPage *info, bool nofault, CPUARMState *env,
+         g_assert(tlb_hit(comparator, addr));
+ # endif
+-        CPUIOTLBEntry *iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
+-        info->attrs = iotlbentry->attrs;
++        CPUTLBEntryFull *full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
++        info->attrs = full->attrs;
+     }
+ #endif
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void handle_rev32(DisasContext *s, unsigned int sf,
+@@ -XXX,XX +XXX,XX @@ static bool is_guarded_page(CPUARMState *env, DisasContext *s)
-                          unsigned int rn, unsigned int rd)
+      * table entry even for that case.
- {
+      */
-     TCGv_i64 tcg_rd = cpu_reg(s, rd);
+     return (tlb_hit(entry->addr_code, addr) &&
-+    TCGv_i64 tcg_rn = cpu_reg(s, rn);
+-            arm_tlb_bti_gp(&env_tlb(env)->d[mmu_idx].iotlb[index].attrs));
++            arm_tlb_bti_gp(&env_tlb(env)->d[mmu_idx].fulltlb[index].attrs));
-     if (sf) {
+ #endif
--        TCGv_i64 tcg_tmp = tcg_temp_new_i64();
+ }
 -        TCGv_i64 tcg_rn = read_cpu_reg(s, rn, sf);
 -
 -        /* bswap32_i64 requires zero high word */
 -        tcg_gen_ext32u_i64(tcg_tmp, tcg_rn);
 -        tcg_gen_bswap32_i64(tcg_rd, tcg_tmp, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
 -        tcg_gen_shri_i64(tcg_tmp, tcg_rn, 32);
 -        tcg_gen_bswap32_i64(tcg_tmp, tcg_tmp, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
 -        tcg_gen_concat32_i64(tcg_rd, tcg_rd, tcg_tmp);
 -
 -        tcg_temp_free_i64(tcg_tmp);
 +        tcg_gen_bswap64_i64(tcg_rd, tcg_rn);
 +        tcg_gen_rotri_i64(tcg_rd, tcg_rd, 32);
      } else {
 -        tcg_gen_ext32u_i64(tcg_rd, cpu_reg(s, rn));
 -        tcg_gen_bswap32_i64(tcg_rd, tcg_rd, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
 +        tcg_gen_bswap32_i64(tcg_rd, tcg_rn, TCG_BSWAP_OZ);
      }
  }
 --
-.25.1
+.34.1

-[PULL 50/63] tcg/tci: Support bswap flags
+[PULL 05/20] accel/tcg: Drop addr member from SavedIOTLB
-The existing interpreter zero-extends, ignoring high bits.
+This field is only written, not read; remove it.
 Simply add a separate sign-extension opcode if required.
 Ensure that the interpreter supports ext16s when bswap16 is enabled.
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c                |  3 ++-
+ include/hw/core/cpu.h | 1 -
- tcg/tci/tcg-target.c.inc | 23 ++++++++++++++++++++---
+ accel/tcg/cputlb.c    | 7 +++----
-files changed, 22 insertions(+), 4 deletions(-)
+files changed, 3 insertions(+), 5 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
+diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/include/hw/core/cpu.h
-+++ b/tcg/tci.c
++++ b/include/hw/core/cpu.h
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+@@ -XXX,XX +XXX,XX @@ struct CPUWatchpoint {
-             regs[r0] = (int8_t)regs[r1];
+  * the memory regions get moved around  by io_writex.
-             break;
+  */
  typedef struct SavedIOTLB {
 -    hwaddr addr;
      MemoryRegionSection *section;
      hwaddr mr_offset;
  } SavedIOTLB;
 diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cputlb.c
 +++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUTLBEntryFull *full,
   * This is read by tlb_plugin_lookup if the fulltlb entry doesn't match
   * because of the side effect of io_writex changing memory layout.
   */
 -static void save_iotlb_data(CPUState *cs, hwaddr addr,
 -                            MemoryRegionSection *section, hwaddr mr_offset)
 +static void save_iotlb_data(CPUState *cs, MemoryRegionSection *section,
 +                            hwaddr mr_offset)
  {
  #ifdef CONFIG_PLUGIN
      SavedIOTLB *saved = &cs->saved_iotlb;
 -    saved->addr = addr;
      saved->section = section;
      saved->mr_offset = mr_offset;
  #endif
--#if TCG_TARGET_HAS_ext16s_i32 || TCG_TARGET_HAS_ext16s_i64
+@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUTLBEntryFull *full,
-+#if TCG_TARGET_HAS_ext16s_i32 || TCG_TARGET_HAS_ext16s_i64 || \
+      * The memory_region_dispatch may trigger a flush/resize
-+    TCG_TARGET_HAS_bswap16_i32 || TCG_TARGET_HAS_bswap16_i64
+      * so for plugins we save the iotlb_data just in case.
-         CASE_32_64(ext16s)
+      */
-             tci_args_rr(insn, &r0, &r1);
+-    save_iotlb_data(cpu, full->xlat_section, section, mr_offset);
-             regs[r0] = (int16_t)regs[r1];
++    save_iotlb_data(cpu, section, mr_offset);
-diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
+     if (!qemu_mutex_iothread_locked()) {
---- a/tcg/tci/tcg-target.c.inc
+         qemu_mutex_lock_iothread();
 +++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
                         const TCGArg args[TCG_MAX_OP_ARGS],
                         const int const_args[TCG_MAX_OP_ARGS])
  {
 +    TCGOpcode exts;
 +
      switch (opc) {
      case INDEX_op_exit_tb:
          tcg_out_op_p(s, opc, (void *)args[0]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      CASE_64(ext32u)      /* Optional (TCG_TARGET_HAS_ext32u_i64). */
      CASE_64(ext_i32)
      CASE_64(extu_i32)
 -    CASE_32_64(bswap16)  /* Optional (TCG_TARGET_HAS_bswap16_*). */
 -    CASE_32_64(bswap32)  /* Optional (TCG_TARGET_HAS_bswap32_*). */
 -    CASE_64(bswap64)     /* Optional (TCG_TARGET_HAS_bswap64_i64). */
      CASE_32_64(ctpop)    /* Optional (TCG_TARGET_HAS_ctpop_*). */
 +    case INDEX_op_bswap32_i32: /* Optional (TCG_TARGET_HAS_bswap32_i32). */
 +    case INDEX_op_bswap64_i64: /* Optional (TCG_TARGET_HAS_bswap64_i64). */
          tcg_out_op_rr(s, opc, args[0], args[1]);
          break;
 +    case INDEX_op_bswap16_i32: /* Optional (TCG_TARGET_HAS_bswap16_i32). */
 +        exts = INDEX_op_ext16s_i32;
 +        goto do_bswap;
 +    case INDEX_op_bswap16_i64: /* Optional (TCG_TARGET_HAS_bswap16_i64). */
 +        exts = INDEX_op_ext16s_i64;
 +        goto do_bswap;
 +    case INDEX_op_bswap32_i64: /* Optional (TCG_TARGET_HAS_bswap32_i64). */
 +        exts = INDEX_op_ext32s_i64;
 +    do_bswap:
 +        /* The base tci bswaps zero-extend, and ignore high bits. */
 +        tcg_out_op_rr(s, opc, args[0], args[1]);
 +        if (args[2] & TCG_BSWAP_OS) {
 +            tcg_out_op_rr(s, exts, args[0], args[0]);
 +        }
 +        break;
 +
      CASE_32_64(add2)
      CASE_32_64(sub2)
          tcg_out_op_rrrrrr(s, opc, args[0], args[1], args[2],
 --
-.25.1
+.34.1

-[PULL 62/63] tcg/aarch64: Unset TCG_TARGET_HAS_MEMORY_BSWAP
+[PULL 06/20] accel/tcg: Suppress auto-invalidate in probe_access_internal
-The memory bswap support in the aarch64 backend merely dates from
+When PAGE_WRITE_INV is set when calling tlb_set_page,
-a time when it was required.  There is nothing special about the
+we immediately set TLB_INVALID_MASK in order to force
-backend support that could not have been provided by the middle-end
+tlb_fill to be called on the next lookup.  Here in
-even prior to the introduction of the bswap flags.
+probe_access_internal, we have just called tlb_fill
 and eliminated true misses, thus the lookup must be valid.
+This allows us to remove a warning comment from s390x.
+There doesn't seem to be a reason to change the code though.
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: David Hildenbrand <david@redhat.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/aarch64/tcg-target.h     |  2 +-
+ accel/tcg/cputlb.c            | 10 +++++++++-
- tcg/aarch64/tcg-target.c.inc | 87 +++++++++++++-----------------------
+ target/s390x/tcg/mem_helper.c |  4 ----
-files changed, 32 insertions(+), 57 deletions(-)
+files changed, 9 insertions(+), 5 deletions(-)
-diff --git a/tcg/aarch64/tcg-target.h b/tcg/aarch64/tcg-target.h
+diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/aarch64/tcg-target.h
+--- a/accel/tcg/cputlb.c
-+++ b/tcg/aarch64/tcg-target.h
++++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@ typedef enum {
+@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
- #define TCG_TARGET_HAS_cmpsel_vec       0
+     }
+     tlb_addr = tlb_read_ofs(entry, elt_ofs);
- #define TCG_TARGET_DEFAULT_MO (0)
--#define TCG_TARGET_HAS_MEMORY_BSWAP     1
++    flags = TLB_FLAGS_MASK;
-+#define TCG_TARGET_HAS_MEMORY_BSWAP     0
+     page_addr = addr & TARGET_PAGE_MASK;
+     if (!tlb_hit_page(tlb_addr, page_addr)) {
- void tb_target_set_jmp_target(uintptr_t, uintptr_t, uintptr_t, uintptr_t);
+         if (!victim_tlb_hit(env, mmu_idx, index, elt_ofs, page_addr)) {
+@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
-diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
              /* TLB resize via tlb_fill may have moved the entry.  */
              entry = tlb_entry(env, mmu_idx, addr);
 +
 +            /*
 +             * With PAGE_WRITE_INV, we set TLB_INVALID_MASK immediately,
 +             * to force the next access through tlb_fill.  We've just
 +             * called tlb_fill, so we know that this entry *is* valid.
 +             */
 +            flags &= ~TLB_INVALID_MASK;
          }
          tlb_addr = tlb_read_ofs(entry, elt_ofs);
      }
 -    flags = tlb_addr & TLB_FLAGS_MASK;
 +    flags &= tlb_addr;
      /* Fold all "mmio-like" bits into TLB_MMIO.  This is not RAM.  */
      if (unlikely(flags & ~(TLB_WATCHPOINT | TLB_NOTDIRTY))) {
 diff --git a/target/s390x/tcg/mem_helper.c b/target/s390x/tcg/mem_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/aarch64/tcg-target.c.inc
+--- a/target/s390x/tcg/mem_helper.c
-+++ b/tcg/aarch64/tcg-target.c.inc
++++ b/target/s390x/tcg/mem_helper.c
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_cltz(TCGContext *s, TCGType ext, TCGReg d,
+@@ -XXX,XX +XXX,XX @@ static int s390_probe_access(CPUArchState *env, target_ulong addr, int size,
- /* helper signature: helper_ret_ld_mmu(CPUState *env, target_ulong addr,
+ #else
-  *                                     TCGMemOpIdx oi, uintptr_t ra)
+     int flags;
-  */
--static void * const qemu_ld_helpers[16] = {
+-    /*
--    [MO_UB]   = helper_ret_ldub_mmu,
+-     * For !CONFIG_USER_ONLY, we cannot rely on TLB_INVALID_MASK or haddr==NULL
--    [MO_LEUW] = helper_le_lduw_mmu,
+-     * to detect if there was an exception during tlb_fill().
--    [MO_LEUL] = helper_le_ldul_mmu,
+-     */
--    [MO_LEQ]  = helper_le_ldq_mmu,
+     env->tlb_fill_exc = 0;
--    [MO_BEUW] = helper_be_lduw_mmu,
+     flags = probe_access_flags(env, addr, access_type, mmu_idx, nonfault, phost,
--    [MO_BEUL] = helper_be_ldul_mmu,
+                                ra);
 -    [MO_BEQ]  = helper_be_ldq_mmu,
 +static void * const qemu_ld_helpers[4] = {
 +    [MO_8]  = helper_ret_ldub_mmu,
 +#ifdef HOST_WORDS_BIGENDIAN
 +    [MO_16] = helper_be_lduw_mmu,
 +    [MO_32] = helper_be_ldul_mmu,
 +    [MO_64] = helper_be_ldq_mmu,
 +#else
 +    [MO_16] = helper_le_lduw_mmu,
 +    [MO_32] = helper_le_ldul_mmu,
 +    [MO_64] = helper_le_ldq_mmu,
 +#endif
  };
  /* helper signature: helper_ret_st_mmu(CPUState *env, target_ulong addr,
   *                                     uintxx_t val, TCGMemOpIdx oi,
   *                                     uintptr_t ra)
   */
 -static void * const qemu_st_helpers[16] = {
 -    [MO_UB]   = helper_ret_stb_mmu,
 -    [MO_LEUW] = helper_le_stw_mmu,
 -    [MO_LEUL] = helper_le_stl_mmu,
 -    [MO_LEQ]  = helper_le_stq_mmu,
 -    [MO_BEUW] = helper_be_stw_mmu,
 -    [MO_BEUL] = helper_be_stl_mmu,
 -    [MO_BEQ]  = helper_be_stq_mmu,
 +static void * const qemu_st_helpers[4] = {
 +    [MO_8]  = helper_ret_stb_mmu,
 +#ifdef HOST_WORDS_BIGENDIAN
 +    [MO_16] = helper_be_stw_mmu,
 +    [MO_32] = helper_be_stl_mmu,
 +    [MO_64] = helper_be_stq_mmu,
 +#else
 +    [MO_16] = helper_le_stw_mmu,
 +    [MO_32] = helper_le_stl_mmu,
 +    [MO_64] = helper_le_stq_mmu,
 +#endif
  };
  static inline void tcg_out_adr(TCGContext *s, TCGReg rd, const void *target)
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
      tcg_out_mov(s, TARGET_LONG_BITS == 64, TCG_REG_X1, lb->addrlo_reg);
      tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_X2, oi);
      tcg_out_adr(s, TCG_REG_X3, lb->raddr);
 -    tcg_out_call(s, qemu_ld_helpers[opc & (MO_BSWAP | MO_SIZE)]);
 +    tcg_out_call(s, qemu_ld_helpers[opc & MO_SIZE]);
      if (opc & MO_SIGN) {
          tcg_out_sxt(s, lb->type, size, lb->datalo_reg, TCG_REG_X0);
      } else {
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
      tcg_out_mov(s, size == MO_64, TCG_REG_X2, lb->datalo_reg);
      tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_X3, oi);
      tcg_out_adr(s, TCG_REG_X4, lb->raddr);
 -    tcg_out_call(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)]);
 +    tcg_out_call(s, qemu_st_helpers[opc & MO_SIZE]);
      tcg_out_goto(s, lb->raddr);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp memop, TCGType ext,
                                     TCGReg data_r, TCGReg addr_r,
                                     TCGType otype, TCGReg off_r)
  {
 -    const MemOp bswap = memop & MO_BSWAP;
 +    /* Byte swapping is left to middle-end expansion. */
 +    tcg_debug_assert((memop & MO_BSWAP) == 0);
      switch (memop & MO_SSIZE) {
      case MO_UB:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp memop, TCGType ext,
          break;
      case MO_UW:
          tcg_out_ldst_r(s, I3312_LDRH, data_r, addr_r, otype, off_r);
 -        if (bswap) {
 -            tcg_out_rev(s, TCG_TYPE_I32, MO_16, data_r, data_r);
 -        }
          break;
      case MO_SW:
 -        if (bswap) {
 -            tcg_out_ldst_r(s, I3312_LDRH, data_r, addr_r, otype, off_r);
 -            tcg_out_rev(s, TCG_TYPE_I32, MO_16, data_r, data_r);
 -            tcg_out_sxt(s, ext, MO_16, data_r, data_r);
 -        } else {
 -            tcg_out_ldst_r(s, (ext ? I3312_LDRSHX : I3312_LDRSHW),
 -                           data_r, addr_r, otype, off_r);
 -        }
 +        tcg_out_ldst_r(s, (ext ? I3312_LDRSHX : I3312_LDRSHW),
 +                       data_r, addr_r, otype, off_r);
          break;
      case MO_UL:
          tcg_out_ldst_r(s, I3312_LDRW, data_r, addr_r, otype, off_r);
 -        if (bswap) {
 -            tcg_out_rev(s, TCG_TYPE_I32, MO_32, data_r, data_r);
 -        }
          break;
      case MO_SL:
 -        if (bswap) {
 -            tcg_out_ldst_r(s, I3312_LDRW, data_r, addr_r, otype, off_r);
 -            tcg_out_rev(s, TCG_TYPE_I32, MO_32, data_r, data_r);
 -            tcg_out_sxt(s, TCG_TYPE_I64, MO_32, data_r, data_r);
 -        } else {
 -            tcg_out_ldst_r(s, I3312_LDRSWX, data_r, addr_r, otype, off_r);
 -        }
 +        tcg_out_ldst_r(s, I3312_LDRSWX, data_r, addr_r, otype, off_r);
          break;
      case MO_Q:
          tcg_out_ldst_r(s, I3312_LDRX, data_r, addr_r, otype, off_r);
 -        if (bswap) {
 -            tcg_out_rev(s, TCG_TYPE_I64, MO_64, data_r, data_r);
 -        }
          break;
      default:
          tcg_abort();
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, MemOp memop,
                                     TCGReg data_r, TCGReg addr_r,
                                     TCGType otype, TCGReg off_r)
  {
 -    const MemOp bswap = memop & MO_BSWAP;
 +    /* Byte swapping is left to middle-end expansion. */
 +    tcg_debug_assert((memop & MO_BSWAP) == 0);
      switch (memop & MO_SIZE) {
      case MO_8:
          tcg_out_ldst_r(s, I3312_STRB, data_r, addr_r, otype, off_r);
          break;
      case MO_16:
 -        if (bswap && data_r != TCG_REG_XZR) {
 -            tcg_out_rev(s, TCG_TYPE_I32, MO_16, TCG_REG_TMP, data_r);
 -            data_r = TCG_REG_TMP;
 -        }
          tcg_out_ldst_r(s, I3312_STRH, data_r, addr_r, otype, off_r);
          break;
      case MO_32:
 -        if (bswap && data_r != TCG_REG_XZR) {
 -            tcg_out_rev(s, TCG_TYPE_I32, MO_32, TCG_REG_TMP, data_r);
 -            data_r = TCG_REG_TMP;
 -        }
          tcg_out_ldst_r(s, I3312_STRW, data_r, addr_r, otype, off_r);
          break;
      case MO_64:
 -        if (bswap && data_r != TCG_REG_XZR) {
 -            tcg_out_rev(s, TCG_TYPE_I64, MO_64, TCG_REG_TMP, data_r);
 -            data_r = TCG_REG_TMP;
 -        }
          tcg_out_ldst_r(s, I3312_STRX, data_r, addr_r, otype, off_r);
          break;
      default:
 --
-.25.1
+.34.1

-[PULL 04/63] target/nios2: Add DisasContextBase to DisasContext
+[PULL 07/20] accel/tcg: Introduce probe_access_full
-Migrate the is_jmp, tb and singlestep_enabled fields from
+Add an interface to return the CPUTLBEntryFull struct
-DisasContext into the base.  Use pc_first instead of tb->pc.
+that goes with the lookup.  The result is not intended
-Increment pc_next prior to decode, leaving the address of
+to be valid across multiple lookups, so the user must
-the current insn in dc->pc.
+use the results immediately.
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/nios2/translate.c | 70 +++++++++++++++++++++-------------------
+ include/exec/exec-all.h | 15 +++++++++++++
-file changed, 36 insertions(+), 34 deletions(-)
+ include/qemu/typedefs.h |  1 +
  accel/tcg/cputlb.c      | 47 +++++++++++++++++++++++++----------------
 files changed, 45 insertions(+), 18 deletions(-)
-diff --git a/target/nios2/translate.c b/target/nios2/translate.c
+diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/nios2/translate.c
+--- a/include/exec/exec-all.h
-+++ b/target/nios2/translate.c
++++ b/include/exec/exec-all.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ int probe_access_flags(CPUArchState *env, target_ulong addr,
                         MMUAccessType access_type, int mmu_idx,
                         bool nonfault, void **phost, uintptr_t retaddr);
 +#ifndef CONFIG_USER_ONLY
 +/**
 + * probe_access_full:
 + * Like probe_access_flags, except also return into @pfull.
 + *
 + * The CPUTLBEntryFull structure returned via @pfull is transient
 + * and must be consumed or copied immediately, before any further
 + * access or changes to TLB @mmu_idx.
 + */
 +int probe_access_full(CPUArchState *env, target_ulong addr,
 +                      MMUAccessType access_type, int mmu_idx,
 +                      bool nonfault, void **phost,
 +                      CPUTLBEntryFull **pfull, uintptr_t retaddr);
 +#endif
 +
  #define CODE_GEN_ALIGN           16 /* must be >= of the size of a icache line */
  /* Estimated block size for TB allocation.  */
 diff --git a/include/qemu/typedefs.h b/include/qemu/typedefs.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/qemu/typedefs.h
 +++ b/include/qemu/typedefs.h
@@ -XXX,XX +XXX,XX @@ typedef struct ConfidentialGuestSupport ConfidentialGuestSupport;
  typedef struct CPUAddressSpace CPUAddressSpace;
  typedef struct CPUArchState CPUArchState;
  typedef struct CPUState CPUState;
 +typedef struct CPUTLBEntryFull CPUTLBEntryFull;
  typedef struct DeviceListener DeviceListener;
  typedef struct DeviceState DeviceState;
  typedef struct DirtyBitmapSnapshot DirtyBitmapSnapshot;
 diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cputlb.c
 +++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
  static int probe_access_internal(CPUArchState *env, target_ulong addr,
                                   int fault_size, MMUAccessType access_type,
                                   int mmu_idx, bool nonfault,
 -                                 void **phost, uintptr_t retaddr)
 +                                 void **phost, CPUTLBEntryFull **pfull,
 +                                 uintptr_t retaddr)
  {
      uintptr_t index = tlb_index(env, mmu_idx, addr);
      CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
                                             mmu_idx, nonfault, retaddr)) {
                  /* Non-faulting page table read failed.  */
                  *phost = NULL;
 +                *pfull = NULL;
                  return TLB_INVALID_MASK;
              }
              /* TLB resize via tlb_fill may have moved the entry.  */
 +            index = tlb_index(env, mmu_idx, addr);
              entry = tlb_entry(env, mmu_idx, addr);
              /*
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
      }
+     flags &= tlb_addr;
- typedef struct DisasContext {
-+    DisasContextBase  base;
++    *pfull = &env_tlb(env)->d[mmu_idx].fulltlb[index];
-     TCGv_i32          zero;
++
--    int               is_jmp;
+     /* Fold all "mmio-like" bits into TLB_MMIO.  This is not RAM.  */
-     target_ulong      pc;
+     if (unlikely(flags & ~(TLB_WATCHPOINT | TLB_NOTDIRTY))) {
--    TranslationBlock *tb;
+         *phost = NULL;
-     int               mem_idx;
+@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
--    bool              singlestep_enabled;
+     return flags;
  } DisasContext;
  static TCGv cpu_R[NUM_CORE_REGS];
@@ -XXX,XX +XXX,XX @@ static void t_gen_helper_raise_exception(DisasContext *dc,
      tcg_gen_movi_tl(cpu_R[R_PC], dc->pc);
      gen_helper_raise_exception(cpu_env, tmp);
      tcg_temp_free_i32(tmp);
 -    dc->is_jmp = DISAS_NORETURN;
 +    dc->base.is_jmp = DISAS_NORETURN;
  }
- static bool use_goto_tb(DisasContext *dc, uint32_t dest)
+-int probe_access_flags(CPUArchState *env, target_ulong addr,
 -                       MMUAccessType access_type, int mmu_idx,
 -                       bool nonfault, void **phost, uintptr_t retaddr)
 +int probe_access_full(CPUArchState *env, target_ulong addr,
 +                      MMUAccessType access_type, int mmu_idx,
 +                      bool nonfault, void **phost, CPUTLBEntryFull **pfull,
 +                      uintptr_t retaddr)
  {
--    if (unlikely(dc->singlestep_enabled)) {
+-    int flags;
-+    if (unlikely(dc->base.singlestep_enabled)) {
+-
-         return false;
+-    flags = probe_access_internal(env, addr, 0, access_type, mmu_idx,
 -                                  nonfault, phost, retaddr);
 +    int flags = probe_access_internal(env, addr, 0, access_type, mmu_idx,
 +                                      nonfault, phost, pfull, retaddr);
      /* Handle clean RAM pages.  */
      if (unlikely(flags & TLB_NOTDIRTY)) {
 -        uintptr_t index = tlb_index(env, mmu_idx, addr);
 -        CPUTLBEntryFull *full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
 -
 -        notdirty_write(env_cpu(env), addr, 1, full, retaddr);
 +        notdirty_write(env_cpu(env), addr, 1, *pfull, retaddr);
          flags &= ~TLB_NOTDIRTY;
      }
- #ifndef CONFIG_USER_ONLY
+     return flags;
--    return (dc->tb->pc & TARGET_PAGE_MASK) == (dest & TARGET_PAGE_MASK);
+ }
-+    return (dc->base.pc_first & TARGET_PAGE_MASK) == (dest & TARGET_PAGE_MASK);
- #else
++int probe_access_flags(CPUArchState *env, target_ulong addr,
-     return true;
++                       MMUAccessType access_type, int mmu_idx,
- #endif
++                       bool nonfault, void **phost, uintptr_t retaddr)
-@@ -XXX,XX +XXX,XX @@ static bool use_goto_tb(DisasContext *dc, uint32_t dest)
++{
++    CPUTLBEntryFull *full;
- static void gen_goto_tb(DisasContext *dc, int n, uint32_t dest)
++
 +    return probe_access_full(env, addr, access_type, mmu_idx,
 +                             nonfault, phost, &full, retaddr);
 +}
 +
  void *probe_access(CPUArchState *env, target_ulong addr, int size,
                     MMUAccessType access_type, int mmu_idx, uintptr_t retaddr)
  {
--    TranslationBlock *tb = dc->tb;
++    CPUTLBEntryFull *full;
-+    const TranslationBlock *tb = dc->base.tb;
+     void *host;
+     int flags;
-     if (use_goto_tb(dc, dest)) {
-         tcg_gen_goto_tb(n);
+     g_assert(-(addr | TARGET_PAGE_MASK) >= size);
-@@ -XXX,XX +XXX,XX @@ static void gen_excp(DisasContext *dc, uint32_t code, uint32_t flags)
+     flags = probe_access_internal(env, addr, size, access_type, mmu_idx,
- static void gen_check_supervisor(DisasContext *dc)
+-                                  false, &host, retaddr);
 +                                  false, &host, &full, retaddr);
      /* Per the interface, size == 0 merely faults the access. */
      if (size == 0) {
@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
      }
      if (unlikely(flags & (TLB_NOTDIRTY | TLB_WATCHPOINT))) {
 -        uintptr_t index = tlb_index(env, mmu_idx, addr);
 -        CPUTLBEntryFull *full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
 -
          /* Handle watchpoints.  */
          if (flags & TLB_WATCHPOINT) {
              int wp_access = (access_type == MMU_DATA_STORE
@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
  void *tlb_vaddr_to_host(CPUArchState *env, abi_ptr addr,
                          MMUAccessType access_type, int mmu_idx)
  {
--    if (dc->tb->flags & CR_STATUS_U) {
++    CPUTLBEntryFull *full;
-+    if (dc->base.tb->flags & CR_STATUS_U) {
+     void *host;
-         /* CPU in user mode, privileged instruction called, stop. */
+     int flags;
-         t_gen_helper_raise_exception(dc, EXCP_SUPERI);
-     }
+     flags = probe_access_internal(env, addr, 0, access_type,
-@@ -XXX,XX +XXX,XX @@ static void jmpi(DisasContext *dc, uint32_t code, uint32_t flags)
+-                                  mmu_idx, true, &host, 0);
 +                                  mmu_idx, true, &host, &full, 0);
      /* No combination of flags are expected by the caller. */
      return flags ? NULL : host;
@@ -XXX,XX +XXX,XX @@ void *tlb_vaddr_to_host(CPUArchState *env, abi_ptr addr,
  tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
                                          void **hostp)
  {
-     J_TYPE(instr, code);
++    CPUTLBEntryFull *full;
-     gen_goto_tb(dc, 0, (dc->pc & 0xF0000000) | (instr.imm26 << 2));
+     void *p;
--    dc->is_jmp = DISAS_NORETURN;
-+    dc->base.is_jmp = DISAS_NORETURN;
+     (void)probe_access_internal(env, addr, 1, MMU_INST_FETCH,
- }
+-                                cpu_mmu_index(env, true), false, &p, 0);
++                                cpu_mmu_index(env, true), false, &p, &full, 0);
- static void call(DisasContext *dc, uint32_t code, uint32_t flags)
+     if (p == NULL) {
-@@ -XXX,XX +XXX,XX @@ static void br(DisasContext *dc, uint32_t code, uint32_t flags)
+         return -1;
      I_TYPE(instr, code);
      gen_goto_tb(dc, 0, dc->pc + 4 + (instr.imm16.s & -4));
 -    dc->is_jmp = DISAS_NORETURN;
 +    dc->base.is_jmp = DISAS_NORETURN;
  }
  static void gen_bxx(DisasContext *dc, uint32_t code, uint32_t flags)
@@ -XXX,XX +XXX,XX @@ static void gen_bxx(DisasContext *dc, uint32_t code, uint32_t flags)
      gen_goto_tb(dc, 0, dc->pc + 4);
      gen_set_label(l1);
      gen_goto_tb(dc, 1, dc->pc + 4 + (instr.imm16.s & -4));
 -    dc->is_jmp = DISAS_NORETURN;
 +    dc->base.is_jmp = DISAS_NORETURN;
  }
  /* Comparison instructions */
@@ -XXX,XX +XXX,XX @@ static void eret(DisasContext *dc, uint32_t code, uint32_t flags)
      tcg_gen_mov_tl(cpu_R[CR_STATUS], cpu_R[CR_ESTATUS]);
      tcg_gen_mov_tl(cpu_R[R_PC], cpu_R[R_EA]);
 -    dc->is_jmp = DISAS_JUMP;
 +    dc->base.is_jmp = DISAS_JUMP;
  }
  /* PC <- ra */
@@ -XXX,XX +XXX,XX @@ static void ret(DisasContext *dc, uint32_t code, uint32_t flags)
  {
      tcg_gen_mov_tl(cpu_R[R_PC], cpu_R[R_RA]);
 -    dc->is_jmp = DISAS_JUMP;
 +    dc->base.is_jmp = DISAS_JUMP;
  }
  /* PC <- ba */
@@ -XXX,XX +XXX,XX @@ static void bret(DisasContext *dc, uint32_t code, uint32_t flags)
  {
      tcg_gen_mov_tl(cpu_R[R_PC], cpu_R[R_BA]);
 -    dc->is_jmp = DISAS_JUMP;
 +    dc->base.is_jmp = DISAS_JUMP;
  }
  /* PC <- rA */
@@ -XXX,XX +XXX,XX @@ static void jmp(DisasContext *dc, uint32_t code, uint32_t flags)
      tcg_gen_mov_tl(cpu_R[R_PC], load_gpr(dc, instr.a));
 -    dc->is_jmp = DISAS_JUMP;
 +    dc->base.is_jmp = DISAS_JUMP;
  }
  /* rC <- PC + 4 */
@@ -XXX,XX +XXX,XX @@ static void callr(DisasContext *dc, uint32_t code, uint32_t flags)
      tcg_gen_mov_tl(cpu_R[R_PC], load_gpr(dc, instr.a));
      tcg_gen_movi_tl(cpu_R[R_RA], dc->pc + 4);
 -    dc->is_jmp = DISAS_JUMP;
 +    dc->base.is_jmp = DISAS_JUMP;
  }
  /* rC <- ctlN */
@@ -XXX,XX +XXX,XX @@ static void wrctl(DisasContext *dc, uint32_t code, uint32_t flags)
      /* If interrupts were enabled using WRCTL, trigger them. */
  #if !defined(CONFIG_USER_ONLY)
      if ((instr.imm5 + CR_BASE) == CR_STATUS) {
 -        if (tb_cflags(dc->tb) & CF_USE_ICOUNT) {
 +        if (tb_cflags(dc->base.tb) & CF_USE_ICOUNT) {
              gen_io_start();
          }
          gen_helper_check_interrupts(cpu_env);
 -        dc->is_jmp = DISAS_UPDATE;
 +        dc->base.is_jmp = DISAS_UPDATE;
      }
  #endif
  }
@@ -XXX,XX +XXX,XX @@ static void gen_exception(DisasContext *dc, uint32_t excp)
      tcg_gen_movi_tl(cpu_R[R_PC], dc->pc);
      gen_helper_raise_exception(cpu_env, tmp);
      tcg_temp_free_i32(tmp);
 -    dc->is_jmp = DISAS_NORETURN;
 +    dc->base.is_jmp = DISAS_NORETURN;
  }
  /* generate intermediate code for basic block 'tb'.  */
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
      int num_insns;
      /* Initialize DC */
 -    dc->is_jmp  = DISAS_NEXT;
 -    dc->pc      = tb->pc;
 -    dc->tb      = tb;
 +
 +    dc->base.tb = tb;
 +    dc->base.singlestep_enabled = cs->singlestep_enabled;
 +    dc->base.is_jmp = DISAS_NEXT;
 +    dc->base.pc_first = tb->pc;
 +    dc->base.pc_next = tb->pc;
 +
      dc->mem_idx = cpu_mmu_index(env, false);
 -    dc->singlestep_enabled = cs->singlestep_enabled;
      /* Set up instruction counts */
      num_insns = 0;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
      gen_tb_start(tb);
      do {
 -        tcg_gen_insn_start(dc->pc);
 +        tcg_gen_insn_start(dc->base.pc_next);
          num_insns++;
 -        if (unlikely(cpu_breakpoint_test(cs, dc->pc, BP_ANY))) {
 +        if (unlikely(cpu_breakpoint_test(cs, dc->base.pc_next, BP_ANY))) {
              gen_exception(dc, EXCP_DEBUG);
              /* The address covered by the breakpoint must be included in
                 [tb->pc, tb->pc + tb->size) in order to for it to be
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
              gen_io_start();
          }
 +        dc->pc = dc->base.pc_next;
 +        dc->base.pc_next += 4;
 +
          /* Decode an instruction */
          handle_instruction(dc, env);
 -        dc->pc += 4;
 -
          /* Translation stops when a conditional branch is encountered.
           * Otherwise the subsequent code could get translated several times.
           * Also stop translation when a page boundary is reached.  This
           * ensures prefetch aborts occur at the right place.  */
 -    } while (!dc->is_jmp &&
 +    } while (!dc->base.is_jmp &&
               !tcg_op_buf_full() &&
               num_insns < max_insns);
      /* Indicate where the next block should start */
 -    switch (dc->is_jmp) {
 +    switch (dc->base.is_jmp) {
      case DISAS_NEXT:
      case DISAS_UPDATE:
          /* Save the current PC back into the CPU register */
 -        tcg_gen_movi_tl(cpu_R[R_PC], dc->pc);
 +        tcg_gen_movi_tl(cpu_R[R_PC], dc->base.pc_next);
          tcg_gen_exit_tb(NULL, 0);
          break;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
      gen_tb_end(tb, num_insns);
      /* Mark instruction starts for the final generated instruction */
 -    tb->size = dc->pc - tb->pc;
 +    tb->size = dc->base.pc_next - dc->base.pc_first;
      tb->icount = num_insns;
  #ifdef DEBUG_DISAS
      if (qemu_loglevel_mask(CPU_LOG_TB_IN_ASM)
 -        && qemu_log_in_addr_range(tb->pc)) {
 +        && qemu_log_in_addr_range(dc->base.pc_first)) {
          FILE *logfile = qemu_log_lock();
 -        qemu_log("IN: %s\n", lookup_symbol(tb->pc));
 -        log_target_disas(cs, tb->pc, dc->pc - tb->pc);
 +        qemu_log("IN: %s\n", lookup_symbol(dc->base.pc_first));
 +        log_target_disas(cs, tb->pc, tb->size);
          qemu_log("\n");
          qemu_log_unlock(logfile);
      }
 --
-.25.1
+.34.1

-[PULL 57/63] target/arm: Improve REVSH
+[PULL 08/20] accel/tcg: Introduce tlb_set_page_full
-The new bswap flags can implement the semantics exactly.
+Now that we have collected all of the page data into
 CPUTLBEntryFull, provide an interface to record that
 all in one go, instead of using 4 arguments.  This interface
 allows CPUTLBEntryFull to be extended without having to
 change the number of arguments.
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/arm/translate.c | 4 +---
+ include/exec/cpu-defs.h | 14 +++++++++++
-file changed, 1 insertion(+), 3 deletions(-)
+ include/exec/exec-all.h | 22 ++++++++++++++++++
  accel/tcg/cputlb.c      | 51 ++++++++++++++++++++++++++---------------
 files changed, 69 insertions(+), 18 deletions(-)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
+diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
+--- a/include/exec/cpu-defs.h
-+++ b/target/arm/translate.c
++++ b/include/exec/cpu-defs.h
-@@ -XXX,XX +XXX,XX @@ void gen_rev16(TCGv_i32 dest, TCGv_i32 var)
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUTLBEntryFull {
- /* Byteswap low halfword and sign extend.  */
+      *     + the offset within the target MemoryRegion (otherwise)
- static void gen_revsh(TCGv_i32 dest, TCGv_i32 var)
+      */
      hwaddr xlat_section;
 +
 +    /*
 +     * @phys_addr contains the physical address in the address space
 +     * given by cpu_asidx_from_attrs(cpu, @attrs).
 +     */
 +    hwaddr phys_addr;
 +
 +    /* @attrs contains the memory transaction attributes for the page. */
      MemTxAttrs attrs;
 +
 +    /* @prot contains the complete protections for the page. */
 +    uint8_t prot;
 +
 +    /* @lg_page_size contains the log2 of the page size. */
 +    uint8_t lg_page_size;
  } CPUTLBEntryFull;
  /*
 diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/exec/exec-all.h
 +++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ void tlb_flush_range_by_mmuidx_all_cpus_synced(CPUState *cpu,
                                                 uint16_t idxmap,
                                                 unsigned bits);
 +/**
 + * tlb_set_page_full:
 + * @cpu: CPU context
 + * @mmu_idx: mmu index of the tlb to modify
 + * @vaddr: virtual address of the entry to add
 + * @full: the details of the tlb entry
 + *
 + * Add an entry to @cpu tlb index @mmu_idx.  All of the fields of
 + * @full must be filled, except for xlat_section, and constitute
 + * the complete description of the translated page.
 + *
 + * This is generally called by the target tlb_fill function after
 + * having performed a successful page table walk to find the physical
 + * address and attributes for the translation.
 + *
 + * At most one entry for a given virtual address is permitted. Only a
 + * single TARGET_PAGE_SIZE region is mapped; @full->lg_page_size is only
 + * used by tlb_flush_page.
 + */
 +void tlb_set_page_full(CPUState *cpu, int mmu_idx, target_ulong vaddr,
 +                       CPUTLBEntryFull *full);
 +
  /**
   * tlb_set_page_with_attrs:
   * @cpu: CPU to add this TLB entry for
 diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cputlb.c
 +++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_add_large_page(CPUArchState *env, int mmu_idx,
      env_tlb(env)->d[mmu_idx].large_page_mask = lp_mask;
  }
 -/* Add a new TLB entry. At most one entry for a given virtual address
 +/*
 + * Add a new TLB entry. At most one entry for a given virtual address
   * is permitted. Only a single TARGET_PAGE_SIZE region is mapped, the
   * supplied size is only used by tlb_flush_page.
   *
   * Called from TCG-generated code, which is under an RCU read-side
   * critical section.
   */
 -void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
 -                             hwaddr paddr, MemTxAttrs attrs, int prot,
 -                             int mmu_idx, target_ulong size)
 +void tlb_set_page_full(CPUState *cpu, int mmu_idx,
 +                       target_ulong vaddr, CPUTLBEntryFull *full)
  {
--    tcg_gen_ext16u_i32(var, var);
+     CPUArchState *env = cpu->env_ptr;
--    tcg_gen_bswap16_i32(var, var, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
+     CPUTLB *tlb = env_tlb(env);
--    tcg_gen_ext16s_i32(dest, var);
+@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
-+    tcg_gen_bswap16_i32(var, var, TCG_BSWAP_OS);
+     CPUTLBEntry *te, tn;
      hwaddr iotlb, xlat, sz, paddr_page;
      target_ulong vaddr_page;
 -    int asidx = cpu_asidx_from_attrs(cpu, attrs);
 -    int wp_flags;
 +    int asidx, wp_flags, prot;
      bool is_ram, is_romd;
      assert_cpu_is_self(cpu);
 -    if (size <= TARGET_PAGE_SIZE) {
 +    if (full->lg_page_size <= TARGET_PAGE_BITS) {
          sz = TARGET_PAGE_SIZE;
      } else {
 -        tlb_add_large_page(env, mmu_idx, vaddr, size);
 -        sz = size;
 +        sz = (hwaddr)1 << full->lg_page_size;
 +        tlb_add_large_page(env, mmu_idx, vaddr, sz);
      }
      vaddr_page = vaddr & TARGET_PAGE_MASK;
 -    paddr_page = paddr & TARGET_PAGE_MASK;
 +    paddr_page = full->phys_addr & TARGET_PAGE_MASK;
 +    prot = full->prot;
 +    asidx = cpu_asidx_from_attrs(cpu, full->attrs);
      section = address_space_translate_for_iotlb(cpu, asidx, paddr_page,
 -                                                &xlat, &sz, attrs, &prot);
 +                                                &xlat, &sz, full->attrs, &prot);
      assert(sz >= TARGET_PAGE_SIZE);
      tlb_debug("vaddr=" TARGET_FMT_lx " paddr=0x" TARGET_FMT_plx
                " prot=%x idx=%d\n",
 -              vaddr, paddr, prot, mmu_idx);
 +              vaddr, full->phys_addr, prot, mmu_idx);
      address = vaddr_page;
 -    if (size < TARGET_PAGE_SIZE) {
 +    if (full->lg_page_size < TARGET_PAGE_BITS) {
          /* Repeat the MMU check and TLB fill on every access.  */
          address |= TLB_INVALID_MASK;
      }
 -    if (attrs.byte_swap) {
 +    if (full->attrs.byte_swap) {
          address |= TLB_BSWAP;
      }
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
       * subtract here is that of the page base, and not the same as the
       * vaddr we add back in io_readx()/io_writex()/get_page_addr_code().
       */
 +    desc->fulltlb[index] = *full;
      desc->fulltlb[index].xlat_section = iotlb - vaddr_page;
 -    desc->fulltlb[index].attrs = attrs;
 +    desc->fulltlb[index].phys_addr = paddr_page;
 +    desc->fulltlb[index].prot = prot;
      /* Now calculate the new entry */
      tn.addend = addend - vaddr_page;
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
      qemu_spin_unlock(&tlb->c.lock);
  }
- /* Dual 16-bit add.  Result placed in t0 and t1 is marked as dead.
+-/* Add a new TLB entry, but without specifying the memory
 - * transaction attributes to be used.
 - */
 +void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
 +                             hwaddr paddr, MemTxAttrs attrs, int prot,
 +                             int mmu_idx, target_ulong size)
 +{
 +    CPUTLBEntryFull full = {
 +        .phys_addr = paddr,
 +        .attrs = attrs,
 +        .prot = prot,
 +        .lg_page_size = ctz64(size)
 +    };
 +
 +    assert(is_power_of_2(size));
 +    tlb_set_page_full(cpu, mmu_idx, vaddr, &full);
 +}
 +
  void tlb_set_page(CPUState *cpu, target_ulong vaddr,
                    hwaddr paddr, int prot,
                    int mmu_idx, target_ulong size)
 --
-.25.1
+.34.1

-[PULL 10/63] target/avr: Add DisasContextBase to DisasContext
+[PULL 09/20] include/exec: Introduce TARGET_PAGE_ENTRY_EXTRA
-Migrate the bstate, tb and singlestep_enabled fields
+Allow the target to cache items from the guest page tables.
 from DisasContext into the base.
-Tested-by: Michael Rolnik <mrolnik@gmail.com>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/avr/translate.c | 58 +++++++++++++++++++++---------------------
+ include/exec/cpu-defs.h | 9 +++++++++
-file changed, 29 insertions(+), 29 deletions(-)
+file changed, 9 insertions(+)
-diff --git a/target/avr/translate.c b/target/avr/translate.c
+diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/avr/translate.c
+--- a/include/exec/cpu-defs.h
-+++ b/target/avr/translate.c
++++ b/include/exec/cpu-defs.h
-@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext DisasContext;
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUTLBEntryFull {
- /* This is the state at translation time. */
+     /* @lg_page_size contains the log2 of the page size. */
- struct DisasContext {
+     uint8_t lg_page_size;
--    TranslationBlock *tb;
++
-+    DisasContextBase base;
++    /*
++     * Allow target-specific additions to this structure.
-     CPUAVRState *env;
++     * This may be used to cache items from the guest cpu
-     CPUState *cs;
++     * page tables for later use by the implementation.
-@@ -XXX,XX +XXX,XX @@ struct DisasContext {
++     */
++#ifdef TARGET_PAGE_ENTRY_EXTRA
-     /* Routine used to access memory */
++    TARGET_PAGE_ENTRY_EXTRA
-     int memidx;
++#endif
--    int bstate;
+ } CPUTLBEntryFull;
 -    int singlestep;
      /*
       * some AVR instructions can make the following instruction to be skipped
@@ -XXX,XX +XXX,XX @@ static bool avr_have_feature(DisasContext *ctx, int feature)
  {
      if (!avr_feature(ctx->env, feature)) {
          gen_helper_unsupported(cpu_env);
 -        ctx->bstate = DISAS_NORETURN;
 +        ctx->base.is_jmp = DISAS_NORETURN;
          return false;
      }
      return true;
@@ -XXX,XX +XXX,XX @@ static void gen_jmp_ez(DisasContext *ctx)
  {
      tcg_gen_deposit_tl(cpu_pc, cpu_r[30], cpu_r[31], 8, 8);
      tcg_gen_or_tl(cpu_pc, cpu_pc, cpu_eind);
 -    ctx->bstate = DISAS_LOOKUP;
 +    ctx->base.is_jmp = DISAS_LOOKUP;
  }
  static void gen_jmp_z(DisasContext *ctx)
  {
      tcg_gen_deposit_tl(cpu_pc, cpu_r[30], cpu_r[31], 8, 8);
 -    ctx->bstate = DISAS_LOOKUP;
 +    ctx->base.is_jmp = DISAS_LOOKUP;
  }
  static void gen_push_ret(DisasContext *ctx, int ret)
@@ -XXX,XX +XXX,XX @@ static void gen_pop_ret(DisasContext *ctx, TCGv ret)
  static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
  {
 -    TranslationBlock *tb = ctx->tb;
 +    const TranslationBlock *tb = ctx->base.tb;
 -    if (ctx->singlestep == 0) {
 +    if (!ctx->base.singlestep_enabled) {
          tcg_gen_goto_tb(n);
          tcg_gen_movi_i32(cpu_pc, dest);
          tcg_gen_exit_tb(tb, n);
@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
          gen_helper_debug(cpu_env);
          tcg_gen_exit_tb(NULL, 0);
      }
 -    ctx->bstate = DISAS_NORETURN;
 +    ctx->base.is_jmp = DISAS_NORETURN;
  }
  /*
-@@ -XXX,XX +XXX,XX @@ static bool trans_RET(DisasContext *ctx, arg_RET *a)
- {
-     gen_pop_ret(ctx, cpu_pc);
--    ctx->bstate = DISAS_LOOKUP;
-+    ctx->base.is_jmp = DISAS_LOOKUP;
-     return true;
- }
-@@ -XXX,XX +XXX,XX @@ static bool trans_RETI(DisasContext *ctx, arg_RETI *a)
-     tcg_gen_movi_tl(cpu_If, 1);
-     /* Need to return to main loop to re-evaluate interrupts.  */
--    ctx->bstate = DISAS_EXIT;
-+    ctx->base.is_jmp = DISAS_EXIT;
-     return true;
- }
-@@ -XXX,XX +XXX,XX @@ static bool trans_BRBC(DisasContext *ctx, arg_BRBC *a)
-     gen_goto_tb(ctx, 0, ctx->npc + a->imm);
-     gen_set_label(not_taken);
--    ctx->bstate = DISAS_CHAIN;
-+    ctx->base.is_jmp = DISAS_CHAIN;
-     return true;
- }
-@@ -XXX,XX +XXX,XX @@ static bool trans_BRBS(DisasContext *ctx, arg_BRBS *a)
-     gen_goto_tb(ctx, 0, ctx->npc + a->imm);
-     gen_set_label(not_taken);
--    ctx->bstate = DISAS_CHAIN;
-+    ctx->base.is_jmp = DISAS_CHAIN;
-     return true;
- }
-@@ -XXX,XX +XXX,XX @@ static TCGv gen_get_zaddr(void)
-  */
- static void gen_data_store(DisasContext *ctx, TCGv data, TCGv addr)
- {
--    if (ctx->tb->flags & TB_FLAGS_FULL_ACCESS) {
-+    if (ctx->base.tb->flags & TB_FLAGS_FULL_ACCESS) {
-         gen_helper_fullwr(cpu_env, data, addr);
-     } else {
-         tcg_gen_qemu_st8(data, addr, MMU_DATA_IDX); /* mem[addr] = data */
-@@ -XXX,XX +XXX,XX @@ static void gen_data_store(DisasContext *ctx, TCGv data, TCGv addr)
- static void gen_data_load(DisasContext *ctx, TCGv data, TCGv addr)
- {
--    if (ctx->tb->flags & TB_FLAGS_FULL_ACCESS) {
-+    if (ctx->base.tb->flags & TB_FLAGS_FULL_ACCESS) {
-         gen_helper_fullrd(data, cpu_env, addr);
-     } else {
-         tcg_gen_qemu_ld8u(data, addr, MMU_DATA_IDX); /* data = mem[addr] */
-@@ -XXX,XX +XXX,XX @@ static bool trans_BREAK(DisasContext *ctx, arg_BREAK *a)
- #ifdef BREAKPOINT_ON_BREAK
-     tcg_gen_movi_tl(cpu_pc, ctx->npc - 1);
-     gen_helper_debug(cpu_env);
--    ctx->bstate = DISAS_EXIT;
-+    ctx->base.is_jmp = DISAS_EXIT;
- #else
-     /* NOP */
- #endif
-@@ -XXX,XX +XXX,XX @@ static bool trans_NOP(DisasContext *ctx, arg_NOP *a)
- static bool trans_SLEEP(DisasContext *ctx, arg_SLEEP *a)
- {
-     gen_helper_sleep(cpu_env);
--    ctx->bstate = DISAS_NORETURN;
-+    ctx->base.is_jmp = DISAS_NORETURN;
-     return true;
- }
-@@ -XXX,XX +XXX,XX @@ static void translate(DisasContext *ctx)
-     if (!decode_insn(ctx, opcode)) {
-         gen_helper_unsupported(cpu_env);
--        ctx->bstate = DISAS_NORETURN;
-+        ctx->base.is_jmp = DISAS_NORETURN;
-     }
- }
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
- {
-     CPUAVRState *env = cs->env_ptr;
-     DisasContext ctx = {
--        .tb = tb,
-+        .base.tb = tb,
-+        .base.is_jmp = DISAS_NEXT,
-+        .base.pc_first = tb->pc,
-+        .base.pc_next = tb->pc,
-+        .base.singlestep_enabled = cs->singlestep_enabled,
-         .cs = cs,
-         .env = env,
-         .memidx = 0,
--        .bstate = DISAS_NEXT,
-         .skip_cond = TCG_COND_NEVER,
--        .singlestep = cs->singlestep_enabled,
-     };
-     target_ulong pc_start = tb->pc / 2;
-     int num_insns = 0;
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-          */
-         max_insns = 1;
-     }
--    if (ctx.singlestep) {
-+    if (ctx.base.singlestep_enabled) {
-         max_insns = 1;
-     }
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-          * b main   - sets breakpoint at address 0x00000100 (code)
-          * b *0x100 - sets breakpoint at address 0x00800100 (data)
-          */
--        if (unlikely(!ctx.singlestep &&
-+        if (unlikely(!ctx.base.singlestep_enabled &&
-                 (cpu_breakpoint_test(cs, OFFSET_CODE + ctx.npc * 2, BP_ANY) ||
-                  cpu_breakpoint_test(cs, OFFSET_DATA + ctx.npc * 2, BP_ANY)))) {
-             canonicalize_skip(&ctx);
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-         if (skip_label) {
-             canonicalize_skip(&ctx);
-             gen_set_label(skip_label);
--            if (ctx.bstate == DISAS_NORETURN) {
--                ctx.bstate = DISAS_CHAIN;
-+            if (ctx.base.is_jmp == DISAS_NORETURN) {
-+                ctx.base.is_jmp = DISAS_CHAIN;
-             }
-         }
--    } while (ctx.bstate == DISAS_NEXT
-+    } while (ctx.base.is_jmp == DISAS_NEXT
-              && num_insns < max_insns
-              && (ctx.npc - pc_start) * 2 < TARGET_PAGE_SIZE - 4
-              && !tcg_op_buf_full());
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-     bool nonconst_skip = canonicalize_skip(&ctx);
--    switch (ctx.bstate) {
-+    switch (ctx.base.is_jmp) {
-     case DISAS_NORETURN:
-         assert(!nonconst_skip);
-         break;
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-         tcg_gen_movi_tl(cpu_pc, ctx.npc);
-         /* fall through */
-     case DISAS_LOOKUP:
--        if (!ctx.singlestep) {
-+        if (!ctx.base.singlestep_enabled) {
-             tcg_gen_lookup_and_goto_ptr();
-             break;
-         }
-         /* fall through */
-     case DISAS_EXIT:
--        if (ctx.singlestep) {
-+        if (ctx.base.singlestep_enabled) {
-             gen_helper_debug(cpu_env);
-         } else {
-             tcg_gen_exit_tb(NULL, 0);
 --
-.25.1
+.34.1

-[PULL 39/63] tcg/arm: Support bswap flags
+[PULL 10/20] accel/tcg: Remove PageDesc code_bitmap
-Combine the three bswap16 routines, and differentiate via the flags.
+This bitmap is created and discarded immediately.
-Use the correct flags combination from the load/store routines, and
+We gain nothing by its existence.
 pass along the constant parameter from tcg_out_op.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20220822232338.1727934-2-richard.henderson@linaro.org>
 ---
- tcg/arm/tcg-target.c.inc | 101 ++++++++++++++++++++++++---------------
+ accel/tcg/translate-all.c | 78 ++-------------------------------------
-file changed, 63 insertions(+), 38 deletions(-)
+file changed, 4 insertions(+), 74 deletions(-)
-diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
+diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/arm/tcg-target.c.inc
+--- a/accel/tcg/translate-all.c
-+++ b/tcg/arm/tcg-target.c.inc
++++ b/accel/tcg/translate-all.c
-@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_ext16u(TCGContext *s, int cond,
+@@ -XXX,XX +XXX,XX @@
  #define assert_memory_lock() tcg_debug_assert(have_mmap_lock())
  #endif
 -#define SMC_BITMAP_USE_THRESHOLD 10
 -
  typedef struct PageDesc {
      /* list of TBs intersecting this ram page */
      uintptr_t first_tb;
 -#ifdef CONFIG_SOFTMMU
 -    /* in order to optimize self modifying code, we count the number
 -       of lookups we do to a given page to use a bitmap */
 -    unsigned long *code_bitmap;
 -    unsigned int code_write_count;
 -#else
 +#ifdef CONFIG_USER_ONLY
      unsigned long flags;
      void *target_data;
  #endif
 -#ifndef CONFIG_USER_ONLY
 +#ifdef CONFIG_SOFTMMU
      QemuSpin lock;
  #endif
  } PageDesc;
@@ -XXX,XX +XXX,XX @@ void tb_htable_init(void)
      qht_init(&tb_ctx.htable, tb_cmp, CODE_GEN_HTABLE_SIZE, mode);
  }
 -/* call with @p->lock held */
 -static inline void invalidate_page_bitmap(PageDesc *p)
 -{
 -    assert_page_locked(p);
 -#ifdef CONFIG_SOFTMMU
 -    g_free(p->code_bitmap);
 -    p->code_bitmap = NULL;
 -    p->code_write_count = 0;
 -#endif
 -}
 -
  /* Set to NULL all the 'first_tb' fields in all PageDescs. */
  static void page_flush_tb_1(int level, void **lp)
  {
@@ -XXX,XX +XXX,XX @@ static void page_flush_tb_1(int level, void **lp)
          for (i = 0; i < V_L2_SIZE; ++i) {
              page_lock(&pd[i]);
              pd[i].first_tb = (uintptr_t)NULL;
 -            invalidate_page_bitmap(pd + i);
              page_unlock(&pd[i]);
          }
      } else {
@@ -XXX,XX +XXX,XX @@ static void do_tb_phys_invalidate(TranslationBlock *tb, bool rm_from_page_list)
      if (rm_from_page_list) {
          p = page_find(tb->page_addr[0] >> TARGET_PAGE_BITS);
          tb_page_remove(p, tb);
 -        invalidate_page_bitmap(p);
          if (tb->page_addr[1] != -1) {
              p = page_find(tb->page_addr[1] >> TARGET_PAGE_BITS);
              tb_page_remove(p, tb);
 -            invalidate_page_bitmap(p);
          }
      }
@@ -XXX,XX +XXX,XX @@ void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr)
      }
  }
--static inline void tcg_out_bswap16s(TCGContext *s, int cond, int rd, int rn)
+-#ifdef CONFIG_SOFTMMU
-+static void tcg_out_bswap16(TCGContext *s, int cond, int rd, int rn, int flags)
+-/* call with @p->lock held */
- {
+-static void build_page_bitmap(PageDesc *p)
-     if (use_armv6_instructions) {
+-{
--        /* revsh */
+-    int n, tb_start, tb_end;
--        tcg_out32(s, 0x06ff0fb0 | (cond << 28) | (rd << 12) | rn);
+-    TranslationBlock *tb;
--    } else {
+-
--        tcg_out_dat_reg(s, cond, ARITH_MOV,
+-    assert_page_locked(p);
--                        TCG_REG_TMP, 0, rn, SHIFT_IMM_LSL(24));
+-    p->code_bitmap = bitmap_new(TARGET_PAGE_SIZE);
--        tcg_out_dat_reg(s, cond, ARITH_MOV,
+-
--                        TCG_REG_TMP, 0, TCG_REG_TMP, SHIFT_IMM_ASR(16));
+-    PAGE_FOR_EACH_TB(p, tb, n) {
--        tcg_out_dat_reg(s, cond, ARITH_ORR,
+-        /* NOTE: this is subtle as a TB may span two physical pages */
--                        rd, TCG_REG_TMP, rn, SHIFT_IMM_LSR(8));
+-        if (n == 0) {
 -            /* NOTE: tb_end may be after the end of the page, but
 -               it is not a problem */
 -            tb_start = tb->pc & ~TARGET_PAGE_MASK;
 -            tb_end = tb_start + tb->size;
 -            if (tb_end > TARGET_PAGE_SIZE) {
 -                tb_end = TARGET_PAGE_SIZE;
 -             }
 -        } else {
 -            tb_start = 0;
 -            tb_end = ((tb->pc + tb->size) & ~TARGET_PAGE_MASK);
 -        }
 -        bitmap_set(p->code_bitmap, tb_start, tb_end - tb_start);
 -    }
 -}
-+        if (flags & TCG_BSWAP_OS) {
+-#endif
-+            /* revsh */
+-
-+            tcg_out32(s, 0x06ff0fb0 | (cond << 28) | (rd << 12) | rn);
+ /* add the tb in the target page and protect it if necessary
-+            return;
+  *
-+        }
+  * Called with mmap_lock held for user-mode emulation.
+@@ -XXX,XX +XXX,XX @@ static inline void tb_page_add(PageDesc *p, TranslationBlock *tb,
--static inline void tcg_out_bswap16(TCGContext *s, int cond, int rd, int rn)
+     page_already_protected = p->first_tb != (uintptr_t)NULL;
--{
+ #endif
--    if (use_armv6_instructions) {
+     p->first_tb = (uintptr_t)tb | n;
-         /* rev16 */
+-    invalidate_page_bitmap(p);
-         tcg_out32(s, 0x06bf0fb0 | (cond << 28) | (rd << 12) | rn);
  #if defined(CONFIG_USER_ONLY)
      /* translator_loop() must have made all TB pages non-writable */
@@ -XXX,XX +XXX,XX @@ tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
      /* remove TB from the page(s) if we couldn't insert it */
      if (unlikely(existing_tb)) {
          tb_page_remove(p, tb);
 -        invalidate_page_bitmap(p);
          if (p2) {
              tb_page_remove(p2, tb);
 -            invalidate_page_bitmap(p2);
          }
          tb = existing_tb;
      }
@@ -XXX,XX +XXX,XX @@ tb_invalidate_phys_page_range__locked(struct page_collection *pages,
  #if !defined(CONFIG_USER_ONLY)
      /* if no code remaining, no need to continue to use slow writes */
      if (!p->first_tb) {
 -        invalidate_page_bitmap(p);
          tlb_unprotect_code(start);
      }
  #endif
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_page_fast(struct page_collection *pages,
      }
      assert_page_locked(p);
 -    if (!p->code_bitmap &&
 -        ++p->code_write_count >= SMC_BITMAP_USE_THRESHOLD) {
 -        build_page_bitmap(p);
 -    }
 -    if (p->code_bitmap) {
 -        unsigned int nr;
 -        unsigned long b;
 -
 -        nr = start & ~TARGET_PAGE_MASK;
 -        b = p->code_bitmap[BIT_WORD(nr)] >> (nr & (BITS_PER_LONG - 1));
 -        if (b & ((1 << len) - 1)) {
 -            goto do_invalidate;
 -        }
 -    } else {
--        tcg_out_dat_reg(s, cond, ARITH_MOV,
+-    do_invalidate:
--                        TCG_REG_TMP, 0, rn, SHIFT_IMM_LSL(24));
+-        tb_invalidate_phys_page_range__locked(pages, p, start, start + len,
--        tcg_out_dat_reg(s, cond, ARITH_MOV,
+-                                              retaddr);
--                        TCG_REG_TMP, 0, TCG_REG_TMP, SHIFT_IMM_LSR(16));
+-    }
--        tcg_out_dat_reg(s, cond, ARITH_ORR,
++    tb_invalidate_phys_page_range__locked(pages, p, start, start + len,
--                        rd, TCG_REG_TMP, rn, SHIFT_IMM_LSR(8));
++                                          retaddr);
 +        if ((flags & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
 +            /* uxth */
 +            tcg_out32(s, 0x06ff0070 | (cond << 28) | (rd << 12) | rd);
 +        }
 +        return;
      }
 -}
 -/* swap the two low bytes assuming that the two high input bytes and the
 -   two high output bit can hold any value. */
 -static inline void tcg_out_bswap16st(TCGContext *s, int cond, int rd, int rn)
 -{
 -    if (use_armv6_instructions) {
 -        /* rev16 */
 -        tcg_out32(s, 0x06bf0fb0 | (cond << 28) | (rd << 12) | rn);
 -    } else {
 +    if (flags == 0) {
 +        /*
 +         * For stores, no input or output extension:
 +         *                              rn  = xxAB
 +         * lsr tmp, rn, #8              tmp = 0xxA
 +         * and tmp, tmp, #0xff          tmp = 000A
 +         * orr rd, tmp, rn, lsl #8      rd  = xABA
 +         */
          tcg_out_dat_reg(s, cond, ARITH_MOV,
                          TCG_REG_TMP, 0, rn, SHIFT_IMM_LSR(8));
          tcg_out_dat_imm(s, cond, ARITH_AND, TCG_REG_TMP, TCG_REG_TMP, 0xff);
          tcg_out_dat_reg(s, cond, ARITH_ORR,
                          rd, TCG_REG_TMP, rn, SHIFT_IMM_LSL(8));
 +        return;
      }
 +
 +    /*
 +     * Byte swap, leaving the result at the top of the register.
 +     * We will then shift down, zero or sign-extending.
 +     */
 +    if (flags & TCG_BSWAP_IZ) {
 +        /*
 +         *                              rn  = 00AB
 +         * ror tmp, rn, #8              tmp = B00A
 +         * orr tmp, tmp, tmp, lsl #16   tmp = BA00
 +         */
 +        tcg_out_dat_reg(s, cond, ARITH_MOV,
 +                        TCG_REG_TMP, 0, rn, SHIFT_IMM_ROR(8));
 +        tcg_out_dat_reg(s, cond, ARITH_ORR,
 +                        TCG_REG_TMP, TCG_REG_TMP, TCG_REG_TMP,
 +                        SHIFT_IMM_LSL(16));
 +    } else {
 +        /*
 +         *                              rn  = xxAB
 +         * and tmp, rn, #0xff00         tmp = 00A0
 +         * lsl tmp, tmp, #8             tmp = 0A00
 +         * orr tmp, tmp, rn, lsl #24    tmp = BA00
 +         */
 +        tcg_out_dat_rI(s, cond, ARITH_AND, TCG_REG_TMP, rn, 0xff00, 1);
 +        tcg_out_dat_reg(s, cond, ARITH_MOV,
 +                        TCG_REG_TMP, 0, TCG_REG_TMP, SHIFT_IMM_LSL(8));
 +        tcg_out_dat_reg(s, cond, ARITH_ORR,
 +                        TCG_REG_TMP, TCG_REG_TMP, rn, SHIFT_IMM_LSL(24));
 +    }
 +    tcg_out_dat_reg(s, cond, ARITH_MOV, rd, 0, TCG_REG_TMP,
 +                    (flags & TCG_BSWAP_OS
 +                     ? SHIFT_IMM_ASR(8) : SHIFT_IMM_LSR(8)));
  }
+ #else
- static inline void tcg_out_bswap32(TCGContext *s, int cond, int rd, int rn)
+ /* Called with mmap_lock held. If pc is not 0 then it indicates the
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_qemu_ld_index(TCGContext *s, MemOp opc,
      case MO_UW:
          tcg_out_ld16u_r(s, COND_AL, datalo, addrlo, addend);
          if (bswap) {
 -            tcg_out_bswap16(s, COND_AL, datalo, datalo);
 +            tcg_out_bswap16(s, COND_AL, datalo, datalo,
 +                            TCG_BSWAP_IZ | TCG_BSWAP_OZ);
          }
          break;
      case MO_SW:
          if (bswap) {
              tcg_out_ld16u_r(s, COND_AL, datalo, addrlo, addend);
 -            tcg_out_bswap16s(s, COND_AL, datalo, datalo);
 +            tcg_out_bswap16(s, COND_AL, datalo, datalo,
 +                            TCG_BSWAP_IZ | TCG_BSWAP_OS);
          } else {
              tcg_out_ld16s_r(s, COND_AL, datalo, addrlo, addend);
          }
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_qemu_ld_direct(TCGContext *s, MemOp opc,
      case MO_UW:
          tcg_out_ld16u_8(s, COND_AL, datalo, addrlo, 0);
          if (bswap) {
 -            tcg_out_bswap16(s, COND_AL, datalo, datalo);
 +            tcg_out_bswap16(s, COND_AL, datalo, datalo,
 +                            TCG_BSWAP_IZ | TCG_BSWAP_OZ);
          }
          break;
      case MO_SW:
          if (bswap) {
              tcg_out_ld16u_8(s, COND_AL, datalo, addrlo, 0);
 -            tcg_out_bswap16s(s, COND_AL, datalo, datalo);
 +            tcg_out_bswap16(s, COND_AL, datalo, datalo,
 +                            TCG_BSWAP_IZ | TCG_BSWAP_OS);
          } else {
              tcg_out_ld16s_8(s, COND_AL, datalo, addrlo, 0);
          }
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_qemu_st_index(TCGContext *s, int cond, MemOp opc,
          break;
      case MO_16:
          if (bswap) {
 -            tcg_out_bswap16st(s, cond, TCG_REG_R0, datalo);
 +            tcg_out_bswap16(s, cond, TCG_REG_R0, datalo, 0);
              tcg_out_st16_r(s, cond, TCG_REG_R0, addrlo, addend);
          } else {
              tcg_out_st16_r(s, cond, datalo, addrlo, addend);
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_qemu_st_direct(TCGContext *s, MemOp opc,
          break;
      case MO_16:
          if (bswap) {
 -            tcg_out_bswap16st(s, COND_AL, TCG_REG_R0, datalo);
 +            tcg_out_bswap16(s, COND_AL, TCG_REG_R0, datalo, 0);
              tcg_out_st16_8(s, COND_AL, TCG_REG_R0, addrlo, 0);
          } else {
              tcg_out_st16_8(s, COND_AL, datalo, addrlo, 0);
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
          break;
      case INDEX_op_bswap16_i32:
 -        tcg_out_bswap16(s, COND_AL, args[0], args[1]);
 +        tcg_out_bswap16(s, COND_AL, args[0], args[1], args[2]);
          break;
      case INDEX_op_bswap32_i32:
          tcg_out_bswap32(s, COND_AL, args[0], args[1]);
 --
-.25.1
+.34.1

-[PULL 45/63] tcg/ppc: Support bswap flags
+[PULL 11/20] accel/tcg: Use bool for page_find_alloc
-For INDEX_op_bswap32_i32, pass 0 for flags: input not zero-extended,
+Bool is more appropriate type for the alloc parameter.
 output does not need extension within the host 64-bit register.
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/ppc/tcg-target.c.inc | 22 ++++++++++++++++------
+ accel/tcg/translate-all.c | 14 +++++++-------
-file changed, 16 insertions(+), 6 deletions(-)
+file changed, 7 insertions(+), 7 deletions(-)
-diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
+diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/ppc/tcg-target.c.inc
+--- a/accel/tcg/translate-all.c
-+++ b/tcg/ppc/tcg-target.c.inc
++++ b/accel/tcg/translate-all.c
-@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_sari64(TCGContext *s, TCGReg dst, TCGReg src, int c)
+@@ -XXX,XX +XXX,XX @@ void page_init(void)
-     tcg_out32(s, SRADI | RA(dst) | RS(src) | SH(c & 0x1f) | ((c >> 4) & 2));
+ #endif
  }
--static void tcg_out_bswap16(TCGContext *s, TCGReg dst, TCGReg src)
+-static PageDesc *page_find_alloc(tb_page_addr_t index, int alloc)
-+static void tcg_out_bswap16(TCGContext *s, TCGReg dst, TCGReg src, int flags)
++static PageDesc *page_find_alloc(tb_page_addr_t index, bool alloc)
  {
-     TCGReg tmp = dst == src ? TCG_REG_R0 : dst;
+     PageDesc *pd;
+     void **lp;
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_bswap16(TCGContext *s, TCGReg dst, TCGReg src)
+@@ -XXX,XX +XXX,XX @@ static PageDesc *page_find_alloc(tb_page_addr_t index, int alloc)
-     /* tmp = dep(tmp, rol32(src, 8), 0x0000ff00)    = 000000dc */
-     tcg_out_rlw(s, RLWIMI, tmp, src, 8, 16, 23);
+ static inline PageDesc *page_find(tb_page_addr_t index)
+ {
--    tcg_out_mov(s, TCG_TYPE_REG, dst, tmp);
+-    return page_find_alloc(index, 0);
-+    if (flags & TCG_BSWAP_OS) {
++    return page_find_alloc(index, false);
 +        tcg_out_ext16s(s, dst, tmp);
 +    } else {
 +        tcg_out_mov(s, TCG_TYPE_REG, dst, tmp);
 +    }
  }
--static void tcg_out_bswap32(TCGContext *s, TCGReg dst, TCGReg src)
+ static void page_lock_pair(PageDesc **ret_p1, tb_page_addr_t phys1,
-+static void tcg_out_bswap32(TCGContext *s, TCGReg dst, TCGReg src, int flags)
+-                           PageDesc **ret_p2, tb_page_addr_t phys2, int alloc);
 +                           PageDesc **ret_p2, tb_page_addr_t phys2, bool alloc);
  /* In user-mode page locks aren't used; mmap_lock is enough */
  #ifdef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static inline void page_unlock(PageDesc *pd)
  /* lock the page(s) of a TB in the correct acquisition order */
  static inline void page_lock_tb(const TranslationBlock *tb)
  {
-     TCGReg tmp = dst == src ? TCG_REG_R0 : dst;
+-    page_lock_pair(NULL, tb->page_addr[0], NULL, tb->page_addr[1], 0);
++    page_lock_pair(NULL, tb->page_addr[0], NULL, tb->page_addr[1], false);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_bswap32(TCGContext *s, TCGReg dst, TCGReg src)
      /* tmp = dep(tmp, rol32(src, 24), 0x0000ff00)   = 0000dcba */
      tcg_out_rlw(s, RLWIMI, tmp, src, 24, 16, 23);
 -    tcg_out_mov(s, TCG_TYPE_REG, dst, tmp);
 +    if (flags & TCG_BSWAP_OS) {
 +        tcg_out_ext32s(s, dst, tmp);
 +    } else {
 +        tcg_out_mov(s, TCG_TYPE_REG, dst, tmp);
 +    }
  }
- static void tcg_out_bswap64(TCGContext *s, TCGReg dst, TCGReg src)
+ static inline void page_unlock_tb(const TranslationBlock *tb)
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+@@ -XXX,XX +XXX,XX @@ void page_collection_unlock(struct page_collection *set)
+ #endif /* !CONFIG_USER_ONLY */
-     case INDEX_op_bswap16_i32:
-     case INDEX_op_bswap16_i64:
+ static void page_lock_pair(PageDesc **ret_p1, tb_page_addr_t phys1,
--        tcg_out_bswap16(s, args[0], args[1]);
+-                           PageDesc **ret_p2, tb_page_addr_t phys2, int alloc)
-+        tcg_out_bswap16(s, args[0], args[1], args[2]);
++                           PageDesc **ret_p2, tb_page_addr_t phys2, bool alloc)
-         break;
+ {
-     case INDEX_op_bswap32_i32:
+     PageDesc *p1, *p2;
-+        tcg_out_bswap32(s, args[0], args[1], 0);
+     tb_page_addr_t page1;
-+        break;
+@@ -XXX,XX +XXX,XX @@ tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
-     case INDEX_op_bswap32_i64:
+      * Note that inserting into the hash table first isn't an option, since
--        tcg_out_bswap32(s, args[0], args[1]);
+      * we can only insert TBs that are fully initialized.
-+        tcg_out_bswap32(s, args[0], args[1], args[2]);
+      */
-         break;
+-    page_lock_pair(&p, phys_pc, &p2, phys_page2, 1);
-     case INDEX_op_bswap64_i64:
++    page_lock_pair(&p, phys_pc, &p2, phys_page2, true);
-         tcg_out_bswap64(s, args[0], args[1]);
+     tb_page_add(p, tb, 0, phys_pc & TARGET_PAGE_MASK);
      if (p2) {
          tb_page_add(p2, tb, 1, phys_page2);
@@ -XXX,XX +XXX,XX @@ void page_set_flags(target_ulong start, target_ulong end, int flags)
      for (addr = start, len = end - start;
           len != 0;
           len -= TARGET_PAGE_SIZE, addr += TARGET_PAGE_SIZE) {
 -        PageDesc *p = page_find_alloc(addr >> TARGET_PAGE_BITS, 1);
 +        PageDesc *p = page_find_alloc(addr >> TARGET_PAGE_BITS, true);
          /* If the write protection bit is set, then we invalidate
             the code inside.  */
 --
-.25.1
+.34.1

-[PULL 01/63] target/nios2: Replace DISAS_TB_JUMP with DISAS_NORETURN
+[PULL 12/20] accel/tcg: Use DisasContextBase in plugin_gen_tb_start
-The only semantic of DISAS_TB_JUMP is that we've done goto_tb,
+Use the pc coming from db->pc_first rather than the TB.
 which is the same as DISAS_NORETURN -- we've exited the tb.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Use the cached host_addr rather than re-computing for the
 first page.  We still need a separate lookup for the second
 page because it won't be computed for DisasContextBase until
 the translator actually performs a read from the page.
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/nios2/translate.c | 8 +++-----
+ include/exec/plugin-gen.h |  7 ++++---
-file changed, 3 insertions(+), 5 deletions(-)
+ accel/tcg/plugin-gen.c    | 22 +++++++++++-----------
  accel/tcg/translator.c    |  2 +-
 files changed, 16 insertions(+), 15 deletions(-)
-diff --git a/target/nios2/translate.c b/target/nios2/translate.c
+diff --git a/include/exec/plugin-gen.h b/include/exec/plugin-gen.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/nios2/translate.c
+--- a/include/exec/plugin-gen.h
-+++ b/target/nios2/translate.c
++++ b/include/exec/plugin-gen.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ struct DisasContextBase;
- /* is_jmp field values */
- #define DISAS_JUMP    DISAS_TARGET_0 /* only pc was modified dynamically */
+ #ifdef CONFIG_PLUGIN
- #define DISAS_UPDATE  DISAS_TARGET_1 /* cpu state was modified dynamically */
--#define DISAS_TB_JUMP DISAS_TARGET_2 /* only pc was modified statically */
+-bool plugin_gen_tb_start(CPUState *cpu, const TranslationBlock *tb, bool supress);
++bool plugin_gen_tb_start(CPUState *cpu, const struct DisasContextBase *db,
- #define INSTRUCTION_FLG(func, flags) { (func), (flags) }
++                         bool supress);
- #define INSTRUCTION(func)                  \
+ void plugin_gen_tb_end(CPUState *cpu);
-@@ -XXX,XX +XXX,XX @@ static void jmpi(DisasContext *dc, uint32_t code, uint32_t flags)
+ void plugin_gen_insn_start(CPUState *cpu, const struct DisasContextBase *db);
  void plugin_gen_insn_end(void);
@@ -XXX,XX +XXX,XX @@ static inline void plugin_insn_append(abi_ptr pc, const void *from, size_t size)
  #else /* !CONFIG_PLUGIN */
 -static inline
 -bool plugin_gen_tb_start(CPUState *cpu, const TranslationBlock *tb, bool supress)
 +static inline bool
 +plugin_gen_tb_start(CPUState *cpu, const struct DisasContextBase *db, bool sup)
  {
-     J_TYPE(instr, code);
+     return false;
      gen_goto_tb(dc, 0, (dc->pc & 0xF0000000) | (instr.imm26 << 2));
 -    dc->is_jmp = DISAS_TB_JUMP;
 +    dc->is_jmp = DISAS_NORETURN;
  }
+diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
- static void call(DisasContext *dc, uint32_t code, uint32_t flags)
+index XXXXXXX..XXXXXXX 100644
-@@ -XXX,XX +XXX,XX @@ static void br(DisasContext *dc, uint32_t code, uint32_t flags)
+--- a/accel/tcg/plugin-gen.c
-     I_TYPE(instr, code);
++++ b/accel/tcg/plugin-gen.c
+@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(const struct qemu_plugin_tb *plugin_tb)
-     gen_goto_tb(dc, 0, dc->pc + 4 + (instr.imm16.s & -4));
+     pr_ops();
 -    dc->is_jmp = DISAS_TB_JUMP;
 +    dc->is_jmp = DISAS_NORETURN;
  }
- static void gen_bxx(DisasContext *dc, uint32_t code, uint32_t flags)
+-bool plugin_gen_tb_start(CPUState *cpu, const TranslationBlock *tb, bool mem_only)
-@@ -XXX,XX +XXX,XX @@ static void gen_bxx(DisasContext *dc, uint32_t code, uint32_t flags)
++bool plugin_gen_tb_start(CPUState *cpu, const DisasContextBase *db,
-     gen_goto_tb(dc, 0, dc->pc + 4);
++                         bool mem_only)
-     gen_set_label(l1);
+ {
-     gen_goto_tb(dc, 1, dc->pc + 4 + (instr.imm16.s & -4));
+     bool ret = false;
--    dc->is_jmp = DISAS_TB_JUMP;
-+    dc->is_jmp = DISAS_NORETURN;
+@@ -XXX,XX +XXX,XX @@ bool plugin_gen_tb_start(CPUState *cpu, const TranslationBlock *tb, bool mem_onl
          ret = true;
 -        ptb->vaddr = tb->pc;
 +        ptb->vaddr = db->pc_first;
          ptb->vaddr2 = -1;
 -        get_page_addr_code_hostp(cpu->env_ptr, tb->pc, &ptb->haddr1);
 +        ptb->haddr1 = db->host_addr[0];
          ptb->haddr2 = NULL;
          ptb->mem_only = mem_only;
@@ -XXX,XX +XXX,XX @@ void plugin_gen_insn_start(CPUState *cpu, const DisasContextBase *db)
       * Note that we skip this when haddr1 == NULL, e.g. when we're
       * fetching instructions from a region not backed by RAM.
       */
 -    if (likely(ptb->haddr1 != NULL && ptb->vaddr2 == -1) &&
 -        unlikely((db->pc_next & TARGET_PAGE_MASK) !=
 -                 (db->pc_first & TARGET_PAGE_MASK))) {
 -        get_page_addr_code_hostp(cpu->env_ptr, db->pc_next,
 -                                 &ptb->haddr2);
 -        ptb->vaddr2 = db->pc_next;
 -    }
 -    if (likely(ptb->vaddr2 == -1)) {
 +    if (ptb->haddr1 == NULL) {
 +        pinsn->haddr = NULL;
 +    } else if (is_same_page(db, db->pc_next)) {
          pinsn->haddr = ptb->haddr1 + pinsn->vaddr - ptb->vaddr;
      } else {
 +        if (ptb->vaddr2 == -1) {
 +            ptb->vaddr2 = TARGET_PAGE_ALIGN(db->pc_first);
 +            get_page_addr_code_hostp(cpu->env_ptr, ptb->vaddr2, &ptb->haddr2);
 +        }
          pinsn->haddr = ptb->haddr2 + pinsn->vaddr - ptb->vaddr2;
      }
  }
+diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
- /* Comparison instructions */
+index XXXXXXX..XXXXXXX 100644
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+--- a/accel/tcg/translator.c
-         break;
++++ b/accel/tcg/translator.c
+@@ -XXX,XX +XXX,XX @@ void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
-     case DISAS_NORETURN:
+     ops->tb_start(db, cpu);
--    case DISAS_TB_JUMP:
+     tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
-         /* nothing more to generate */
-         break;
+-    plugin_enabled = plugin_gen_tb_start(cpu, tb, cflags & CF_MEMI_ONLY);
-     }
++    plugin_enabled = plugin_gen_tb_start(cpu, db, cflags & CF_MEMI_ONLY);
      while (true) {
          db->num_insns++;
 --
-.25.1
+.34.1

-[PULL 02/63] target/nios2: Use global cpu_env
+Deleted patch
-We do not need to copy this into DisasContext.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/nios2/translate.c | 10 ++++------
-file changed, 4 insertions(+), 6 deletions(-)
-diff --git a/target/nios2/translate.c b/target/nios2/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/nios2/translate.c
-+++ b/target/nios2/translate.c
-@@ -XXX,XX +XXX,XX @@
-     }
- typedef struct DisasContext {
--    TCGv_ptr          cpu_env;
-     TCGv             *cpu_R;
-     TCGv_i32          zero;
-     int               is_jmp;
-@@ -XXX,XX +XXX,XX @@ static void t_gen_helper_raise_exception(DisasContext *dc,
-     TCGv_i32 tmp = tcg_const_i32(index);
-     tcg_gen_movi_tl(dc->cpu_R[R_PC], dc->pc);
--    gen_helper_raise_exception(dc->cpu_env, tmp);
-+    gen_helper_raise_exception(cpu_env, tmp);
-     tcg_temp_free_i32(tmp);
-     dc->is_jmp = DISAS_NORETURN;
- }
-@@ -XXX,XX +XXX,XX @@ static void rdctl(DisasContext *dc, uint32_t code, uint32_t flags)
-             tcg_gen_mov_tl(dc->cpu_R[instr.c], dc->cpu_R[instr.imm5 + CR_BASE]);
- #ifdef DEBUG_MMU
-             TCGv_i32 tmp = tcg_const_i32(instr.imm5 + CR_BASE);
--            gen_helper_mmu_read_debug(dc->cpu_R[instr.c], dc->cpu_env, tmp);
-+            gen_helper_mmu_read_debug(dc->cpu_R[instr.c], cpu_env, tmp);
-             tcg_temp_free_i32(tmp);
- #endif
-         }
-@@ -XXX,XX +XXX,XX @@ static void wrctl(DisasContext *dc, uint32_t code, uint32_t flags)
-     {
- #if !defined(CONFIG_USER_ONLY)
-         TCGv_i32 tmp = tcg_const_i32(instr.imm5 + CR_BASE);
--        gen_helper_mmu_write(dc->cpu_env, tmp, load_gpr(dc, instr.a));
-+        gen_helper_mmu_write(cpu_env, tmp, load_gpr(dc, instr.a));
-         tcg_temp_free_i32(tmp);
- #endif
-         break;
-@@ -XXX,XX +XXX,XX @@ static void wrctl(DisasContext *dc, uint32_t code, uint32_t flags)
-         if (tb_cflags(dc->tb) & CF_USE_ICOUNT) {
-             gen_io_start();
-         }
--        gen_helper_check_interrupts(dc->cpu_env);
-+        gen_helper_check_interrupts(cpu_env);
-         dc->is_jmp = DISAS_UPDATE;
-     }
- #endif
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-     int num_insns;
-     /* Initialize DC */
--    dc->cpu_env = cpu_env;
-     dc->cpu_R   = cpu_R;
-     dc->is_jmp  = DISAS_NEXT;
-     dc->pc      = tb->pc;
---
-.25.1

-[PULL 08/63] target/nios2: Inline handle_instruction
+[PULL 13/20] accel/tcg: Do not align tb->page_addr[0]
-Move handle_instruction into nios2_tr_translate_insn
+Let tb->page_addr[0] contain the address of the first byte of the
-as the only caller.
+translated block, rather than the address of the page containing the
 start of the translated block.  We need to recover this value anyway
 at various points, and it is easier to discard a page offset when it
 is not needed, which happens naturally via the existing find_page shift.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/nios2/translate.c | 66 +++++++++++++++++++---------------------
+ accel/tcg/cpu-exec.c      | 16 ++++++++--------
-file changed, 31 insertions(+), 35 deletions(-)
+ accel/tcg/cputlb.c        |  3 ++-
  accel/tcg/translate-all.c |  9 +++++----
 files changed, 15 insertions(+), 13 deletions(-)
-diff --git a/target/nios2/translate.c b/target/nios2/translate.c
+diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/nios2/translate.c
+--- a/accel/tcg/cpu-exec.c
-+++ b/target/nios2/translate.c
++++ b/accel/tcg/cpu-exec.c
-@@ -XXX,XX +XXX,XX @@ illegal_op:
+@@ -XXX,XX +XXX,XX @@ struct tb_desc {
-     t_gen_helper_raise_exception(dc, EXCP_ILLEGAL);
+     target_ulong pc;
      target_ulong cs_base;
      CPUArchState *env;
 -    tb_page_addr_t phys_page1;
 +    tb_page_addr_t page_addr0;
      uint32_t flags;
      uint32_t cflags;
      uint32_t trace_vcpu_dstate;
@@ -XXX,XX +XXX,XX @@ static bool tb_lookup_cmp(const void *p, const void *d)
      const struct tb_desc *desc = d;
      if (tb->pc == desc->pc &&
 -        tb->page_addr[0] == desc->phys_page1 &&
 +        tb->page_addr[0] == desc->page_addr0 &&
          tb->cs_base == desc->cs_base &&
          tb->flags == desc->flags &&
          tb->trace_vcpu_dstate == desc->trace_vcpu_dstate &&
@@ -XXX,XX +XXX,XX @@ static bool tb_lookup_cmp(const void *p, const void *d)
          if (tb->page_addr[1] == -1) {
              return true;
          } else {
 -            tb_page_addr_t phys_page2;
 -            target_ulong virt_page2;
 +            tb_page_addr_t phys_page1;
 +            target_ulong virt_page1;
              /*
               * We know that the first page matched, and an otherwise valid TB
@@ -XXX,XX +XXX,XX @@ static bool tb_lookup_cmp(const void *p, const void *d)
               * is different for the new TB.  Therefore any exception raised
               * here by the faulting lookup is not premature.
               */
 -            virt_page2 = TARGET_PAGE_ALIGN(desc->pc);
 -            phys_page2 = get_page_addr_code(desc->env, virt_page2);
 -            if (tb->page_addr[1] == phys_page2) {
 +            virt_page1 = TARGET_PAGE_ALIGN(desc->pc);
 +            phys_page1 = get_page_addr_code(desc->env, virt_page1);
 +            if (tb->page_addr[1] == phys_page1) {
                  return true;
              }
          }
@@ -XXX,XX +XXX,XX @@ static TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
      if (phys_pc == -1) {
          return NULL;
      }
 -    desc.phys_page1 = phys_pc & TARGET_PAGE_MASK;
 +    desc.page_addr0 = phys_pc;
      h = tb_hash_func(phys_pc, pc, flags, cflags, *cpu->trace_dstate);
      return qht_lookup_custom(&tb_ctx.htable, &desc, h, tb_lookup_cmp);
  }
+diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
--static void handle_instruction(DisasContext *dc, CPUNios2State *env)
+index XXXXXXX..XXXXXXX 100644
--{
+--- a/accel/tcg/cputlb.c
--    uint32_t code;
++++ b/accel/tcg/cputlb.c
--    uint8_t op;
+@@ -XXX,XX +XXX,XX @@ void tlb_flush_page_bits_by_mmuidx_all_cpus_synced(CPUState *src_cpu,
--    const Nios2Instruction *instr;
+    can be detected */
--
+ void tlb_protect_code(ram_addr_t ram_addr)
 -#if defined(CONFIG_USER_ONLY)
 -    /* FIXME: Is this needed ? */
 -    if (dc->pc >= 0x1000 && dc->pc < 0x2000) {
 -        t_gen_helper_raise_exception(dc, 0xaa);
 -        return;
 -    }
 -#endif
 -
 -    code = cpu_ldl_code(env, dc->pc);
 -    op = get_opcode(code);
 -
 -    if (unlikely(op >= ARRAY_SIZE(i_type_instructions))) {
 -        t_gen_helper_raise_exception(dc, EXCP_ILLEGAL);
 -        return;
 -    }
 -
 -    dc->zero = NULL;
 -
 -    instr = &i_type_instructions[op];
 -    instr->handler(dc, code, instr->flags);
 -
 -    if (dc->zero) {
 -        tcg_temp_free(dc->zero);
 -    }
 -}
 -
  static const char * const regnames[] = {
      "zero",       "at",         "r2",         "r3",
      "r4",         "r5",         "r6",         "r7",
@@ -XXX,XX +XXX,XX @@ static void nios2_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
  {
-     DisasContext *dc = container_of(dcbase, DisasContext, base);
+-    cpu_physical_memory_test_and_clear_dirty(ram_addr, TARGET_PAGE_SIZE,
-     CPUNios2State *env = cs->env_ptr;
++    cpu_physical_memory_test_and_clear_dirty(ram_addr & TARGET_PAGE_MASK,
-+    const Nios2Instruction *instr;
++                                             TARGET_PAGE_SIZE,
-+    uint32_t code, pc;
+                                              DIRTY_MEMORY_CODE);
 +    uint8_t op;
 -    dc->pc = dc->base.pc_next;
 -    dc->base.pc_next += 4;
 +    pc = dc->base.pc_next;
 +    dc->pc = pc;
 +    dc->base.pc_next = pc + 4;
      /* Decode an instruction */
 -    handle_instruction(dc, env);
 +
 +#if defined(CONFIG_USER_ONLY)
 +    /* FIXME: Is this needed ? */
 +    if (pc >= 0x1000 && pc < 0x2000) {
 +        t_gen_helper_raise_exception(dc, 0xaa);
 +        return;
 +    }
 +#endif
 +
 +    code = cpu_ldl_code(env, pc);
 +    op = get_opcode(code);
 +
 +    if (unlikely(op >= ARRAY_SIZE(i_type_instructions))) {
 +        t_gen_helper_raise_exception(dc, EXCP_ILLEGAL);
 +        return;
 +    }
 +
 +    dc->zero = NULL;
 +
 +    instr = &i_type_instructions[op];
 +    instr->handler(dc, code, instr->flags);
 +
 +    if (dc->zero) {
 +        tcg_temp_free(dc->zero);
 +    }
  }
- static void nios2_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
+diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translate-all.c
 +++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ static void do_tb_phys_invalidate(TranslationBlock *tb, bool rm_from_page_list)
      qemu_spin_unlock(&tb->jmp_lock);
      /* remove the TB from the hash list */
 -    phys_pc = tb->page_addr[0] + (tb->pc & ~TARGET_PAGE_MASK);
 +    phys_pc = tb->page_addr[0];
      h = tb_hash_func(phys_pc, tb->pc, tb->flags, orig_cflags,
                       tb->trace_vcpu_dstate);
      if (!qht_remove(&tb_ctx.htable, tb, h)) {
@@ -XXX,XX +XXX,XX @@ tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
       * we can only insert TBs that are fully initialized.
       */
      page_lock_pair(&p, phys_pc, &p2, phys_page2, true);
 -    tb_page_add(p, tb, 0, phys_pc & TARGET_PAGE_MASK);
 +    tb_page_add(p, tb, 0, phys_pc);
      if (p2) {
          tb_page_add(p2, tb, 1, phys_page2);
      } else {
@@ -XXX,XX +XXX,XX @@ tb_invalidate_phys_page_range__locked(struct page_collection *pages,
          if (n == 0) {
              /* NOTE: tb_end may be after the end of the page, but
                 it is not a problem */
 -            tb_start = tb->page_addr[0] + (tb->pc & ~TARGET_PAGE_MASK);
 +            tb_start = tb->page_addr[0];
              tb_end = tb_start + tb->size;
          } else {
              tb_start = tb->page_addr[1];
 -            tb_end = tb_start + ((tb->pc + tb->size) & ~TARGET_PAGE_MASK);
 +            tb_end = tb_start + ((tb->page_addr[0] + tb->size)
 +                                 & ~TARGET_PAGE_MASK);
          }
          if (!(tb_end <= start || tb_start >= end)) {
  #ifdef TARGET_HAS_PRECISE_SMC
 --
-.25.1
+.34.1

-[PULL 03/63] target/nios2: Use global cpu_R
+[PULL 14/20] accel/tcg: Inline tb_flush_jmp_cache
-We do not need to copy this into DisasContext.
+This function has two users, who use it incompatibly.
 In tlb_flush_page_by_mmuidx_async_0, when flushing a
 single page, we need to flush exactly two pages.
 In tlb_flush_range_by_mmuidx_async_0, when flushing a
 range of pages, we need to flush N+1 pages.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+This avoids double-flushing of jmp cache pages in a range.
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/nios2/translate.c | 73 +++++++++++++++++++---------------------
+ accel/tcg/cputlb.c | 25 ++++++++++++++-----------
-file changed, 34 insertions(+), 39 deletions(-)
+file changed, 14 insertions(+), 11 deletions(-)
-diff --git a/target/nios2/translate.c b/target/nios2/translate.c
+diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/nios2/translate.c
+--- a/accel/tcg/cputlb.c
-+++ b/target/nios2/translate.c
++++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void tb_jmp_cache_clear_page(CPUState *cpu, target_ulong page_addr)
      }
  typedef struct DisasContext {
 -    TCGv             *cpu_R;
      TCGv_i32          zero;
      int               is_jmp;
      target_ulong      pc;
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
      bool              singlestep_enabled;
  } DisasContext;
 +static TCGv cpu_R[NUM_CORE_REGS];
 +
  typedef struct Nios2Instruction {
      void     (*handler)(DisasContext *dc, uint32_t code, uint32_t flags);
      uint32_t  flags;
@@ -XXX,XX +XXX,XX @@ static TCGv load_zero(DisasContext *dc)
  static TCGv load_gpr(DisasContext *dc, uint8_t reg)
  {
      if (likely(reg != R_ZERO)) {
 -        return dc->cpu_R[reg];
 +        return cpu_R[reg];
      } else {
          return load_zero(dc);
      }
@@ -XXX,XX +XXX,XX @@ static void t_gen_helper_raise_exception(DisasContext *dc,
  {
      TCGv_i32 tmp = tcg_const_i32(index);
 -    tcg_gen_movi_tl(dc->cpu_R[R_PC], dc->pc);
 +    tcg_gen_movi_tl(cpu_R[R_PC], dc->pc);
      gen_helper_raise_exception(cpu_env, tmp);
      tcg_temp_free_i32(tmp);
      dc->is_jmp = DISAS_NORETURN;
@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *dc, int n, uint32_t dest)
      if (use_goto_tb(dc, dest)) {
          tcg_gen_goto_tb(n);
 -        tcg_gen_movi_tl(dc->cpu_R[R_PC], dest);
 +        tcg_gen_movi_tl(cpu_R[R_PC], dest);
          tcg_gen_exit_tb(tb, n);
      } else {
 -        tcg_gen_movi_tl(dc->cpu_R[R_PC], dest);
 +        tcg_gen_movi_tl(cpu_R[R_PC], dest);
          tcg_gen_exit_tb(NULL, 0);
      }
  }
-@@ -XXX,XX +XXX,XX @@ static void jmpi(DisasContext *dc, uint32_t code, uint32_t flags)
+-static void tb_flush_jmp_cache(CPUState *cpu, target_ulong addr)
- static void call(DisasContext *dc, uint32_t code, uint32_t flags)
+-{
- {
+-    /* Discard jump cache entries for any tb which might potentially
--    tcg_gen_movi_tl(dc->cpu_R[R_RA], dc->pc + 4);
+-       overlap the flushed page.  */
-+    tcg_gen_movi_tl(cpu_R[R_RA], dc->pc + 4);
+-    tb_jmp_cache_clear_page(cpu, addr - TARGET_PAGE_SIZE);
-     jmpi(dc, code, flags);
+-    tb_jmp_cache_clear_page(cpu, addr);
 -}
 -
  /**
   * tlb_mmu_resize_locked() - perform TLB resize bookkeeping; resize if necessary
   * @desc: The CPUTLBDesc portion of the TLB
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_page_by_mmuidx_async_0(CPUState *cpu,
      }
      qemu_spin_unlock(&env_tlb(env)->c.lock);
 -    tb_flush_jmp_cache(cpu, addr);
 +    /*
 +     * Discard jump cache entries for any tb which might potentially
 +     * overlap the flushed page, which includes the previous.
 +     */
 +    tb_jmp_cache_clear_page(cpu, addr - TARGET_PAGE_SIZE);
 +    tb_jmp_cache_clear_page(cpu, addr);
  }
-@@ -XXX,XX +XXX,XX @@ static void gen_ldx(DisasContext *dc, uint32_t code, uint32_t flags)
+ /**
-      *          the Nios2 CPU.
+@@ -XXX,XX +XXX,XX @@ static void tlb_flush_range_by_mmuidx_async_0(CPUState *cpu,
-      */
+         return;
      if (likely(instr.b != R_ZERO)) {
 -        data = dc->cpu_R[instr.b];
 +        data = cpu_R[instr.b];
      } else {
          data = tcg_temp_new();
      }
-@@ -XXX,XX +XXX,XX @@ static void gen_bxx(DisasContext *dc, uint32_t code, uint32_t flags)
-     I_TYPE(instr, code);
+-    for (target_ulong i = 0; i < d.len; i += TARGET_PAGE_SIZE) {
+-        tb_flush_jmp_cache(cpu, d.addr + i);
-     TCGLabel *l1 = gen_new_label();
++    /*
--    tcg_gen_brcond_tl(flags, dc->cpu_R[instr.a], dc->cpu_R[instr.b], l1);
++     * Discard jump cache entries for any tb which might potentially
-+    tcg_gen_brcond_tl(flags, cpu_R[instr.a], cpu_R[instr.b], l1);
++     * overlap the flushed pages, which includes the previous.
-     gen_goto_tb(dc, 0, dc->pc + 4);
++     */
-     gen_set_label(l1);
++    d.addr -= TARGET_PAGE_SIZE;
-     gen_goto_tb(dc, 1, dc->pc + 4 + (instr.imm16.s & -4));
++    for (target_ulong i = 0, n = d.len / TARGET_PAGE_SIZE + 1; i < n; i++) {
-@@ -XXX,XX +XXX,XX @@ static void gen_bxx(DisasContext *dc, uint32_t code, uint32_t flags)
++        tb_jmp_cache_clear_page(cpu, d.addr);
- static void (fname)(DisasContext *dc, uint32_t code, uint32_t flags)         \
++        d.addr += TARGET_PAGE_SIZE;
  {                                                                            \
      I_TYPE(instr, (code));                                                   \
 -    tcg_gen_setcondi_tl(flags, (dc)->cpu_R[instr.b], (dc)->cpu_R[instr.a],   \
 -                        (op3));                                              \
 +    tcg_gen_setcondi_tl(flags, cpu_R[instr.b], cpu_R[instr.a], (op3));       \
  }
  gen_i_cmpxx(gen_cmpxxsi, instr.imm16.s)
@@ -XXX,XX +XXX,XX @@ static void (fname)(DisasContext *dc, uint32_t code, uint32_t flags)        \
      if (unlikely(instr.b == R_ZERO)) { /* Store to R_ZERO is ignored */     \
          return;                                                             \
      } else if (instr.a == R_ZERO) { /* MOVxI optimizations */               \
 -        tcg_gen_movi_tl(dc->cpu_R[instr.b], (resimm) ? (op3) : 0);          \
 +        tcg_gen_movi_tl(cpu_R[instr.b], (resimm) ? (op3) : 0);              \
      } else {                                                                \
 -        tcg_gen_##insn##_tl((dc)->cpu_R[instr.b], (dc)->cpu_R[instr.a],     \
 -                            (op3));                                         \
 +        tcg_gen_##insn##_tl(cpu_R[instr.b], cpu_R[instr.a], (op3));         \
      }                                                                       \
  }
@@ -XXX,XX +XXX,XX @@ static const Nios2Instruction i_type_instructions[] = {
   */
  static void eret(DisasContext *dc, uint32_t code, uint32_t flags)
  {
 -    tcg_gen_mov_tl(dc->cpu_R[CR_STATUS], dc->cpu_R[CR_ESTATUS]);
 -    tcg_gen_mov_tl(dc->cpu_R[R_PC], dc->cpu_R[R_EA]);
 +    tcg_gen_mov_tl(cpu_R[CR_STATUS], cpu_R[CR_ESTATUS]);
 +    tcg_gen_mov_tl(cpu_R[R_PC], cpu_R[R_EA]);
      dc->is_jmp = DISAS_JUMP;
  }
@@ -XXX,XX +XXX,XX @@ static void eret(DisasContext *dc, uint32_t code, uint32_t flags)
  /* PC <- ra */
  static void ret(DisasContext *dc, uint32_t code, uint32_t flags)
  {
 -    tcg_gen_mov_tl(dc->cpu_R[R_PC], dc->cpu_R[R_RA]);
 +    tcg_gen_mov_tl(cpu_R[R_PC], cpu_R[R_RA]);
      dc->is_jmp = DISAS_JUMP;
  }
@@ -XXX,XX +XXX,XX @@ static void ret(DisasContext *dc, uint32_t code, uint32_t flags)
  /* PC <- ba */
  static void bret(DisasContext *dc, uint32_t code, uint32_t flags)
  {
 -    tcg_gen_mov_tl(dc->cpu_R[R_PC], dc->cpu_R[R_BA]);
 +    tcg_gen_mov_tl(cpu_R[R_PC], cpu_R[R_BA]);
      dc->is_jmp = DISAS_JUMP;
  }
@@ -XXX,XX +XXX,XX @@ static void jmp(DisasContext *dc, uint32_t code, uint32_t flags)
  {
      R_TYPE(instr, code);
 -    tcg_gen_mov_tl(dc->cpu_R[R_PC], load_gpr(dc, instr.a));
 +    tcg_gen_mov_tl(cpu_R[R_PC], load_gpr(dc, instr.a));
      dc->is_jmp = DISAS_JUMP;
  }
@@ -XXX,XX +XXX,XX @@ static void nextpc(DisasContext *dc, uint32_t code, uint32_t flags)
      R_TYPE(instr, code);
      if (likely(instr.c != R_ZERO)) {
 -        tcg_gen_movi_tl(dc->cpu_R[instr.c], dc->pc + 4);
 +        tcg_gen_movi_tl(cpu_R[instr.c], dc->pc + 4);
      }
  }
-@@ -XXX,XX +XXX,XX @@ static void callr(DisasContext *dc, uint32_t code, uint32_t flags)
- {
-     R_TYPE(instr, code);
--    tcg_gen_mov_tl(dc->cpu_R[R_PC], load_gpr(dc, instr.a));
--    tcg_gen_movi_tl(dc->cpu_R[R_RA], dc->pc + 4);
-+    tcg_gen_mov_tl(cpu_R[R_PC], load_gpr(dc, instr.a));
-+    tcg_gen_movi_tl(cpu_R[R_RA], dc->pc + 4);
-     dc->is_jmp = DISAS_JUMP;
- }
-@@ -XXX,XX +XXX,XX @@ static void rdctl(DisasContext *dc, uint32_t code, uint32_t flags)
-     {
- #if !defined(CONFIG_USER_ONLY)
-         if (likely(instr.c != R_ZERO)) {
--            tcg_gen_mov_tl(dc->cpu_R[instr.c], dc->cpu_R[instr.imm5 + CR_BASE]);
-+            tcg_gen_mov_tl(cpu_R[instr.c], cpu_R[instr.imm5 + CR_BASE]);
- #ifdef DEBUG_MMU
-             TCGv_i32 tmp = tcg_const_i32(instr.imm5 + CR_BASE);
--            gen_helper_mmu_read_debug(dc->cpu_R[instr.c], cpu_env, tmp);
-+            gen_helper_mmu_read_debug(cpu_R[instr.c], cpu_env, tmp);
-             tcg_temp_free_i32(tmp);
- #endif
-         }
-@@ -XXX,XX +XXX,XX @@ static void rdctl(DisasContext *dc, uint32_t code, uint32_t flags)
-     default:
-         if (likely(instr.c != R_ZERO)) {
--            tcg_gen_mov_tl(dc->cpu_R[instr.c], dc->cpu_R[instr.imm5 + CR_BASE]);
-+            tcg_gen_mov_tl(cpu_R[instr.c], cpu_R[instr.imm5 + CR_BASE]);
-         }
-         break;
-     }
-@@ -XXX,XX +XXX,XX @@ static void wrctl(DisasContext *dc, uint32_t code, uint32_t flags)
-     }
-     default:
--        tcg_gen_mov_tl(dc->cpu_R[instr.imm5 + CR_BASE], load_gpr(dc, instr.a));
-+        tcg_gen_mov_tl(cpu_R[instr.imm5 + CR_BASE], load_gpr(dc, instr.a));
-         break;
-     }
-@@ -XXX,XX +XXX,XX @@ static void gen_cmpxx(DisasContext *dc, uint32_t code, uint32_t flags)
- {
-     R_TYPE(instr, code);
-     if (likely(instr.c != R_ZERO)) {
--        tcg_gen_setcond_tl(flags, dc->cpu_R[instr.c], dc->cpu_R[instr.a],
--                           dc->cpu_R[instr.b]);
-+        tcg_gen_setcond_tl(flags, cpu_R[instr.c], cpu_R[instr.a],
-+                           cpu_R[instr.b]);
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static void (fname)(DisasContext *dc, uint32_t code, uint32_t flags)       \
- {                                                                          \
-     R_TYPE(instr, (code));                                                 \
-     if (likely(instr.c != R_ZERO)) {                                       \
--        tcg_gen_##insn((dc)->cpu_R[instr.c], load_gpr((dc), instr.a),      \
--                       (op3));                                             \
-+        tcg_gen_##insn(cpu_R[instr.c], load_gpr((dc), instr.a), (op3));    \
-     }                                                                      \
- }
-@@ -XXX,XX +XXX,XX @@ static void (fname)(DisasContext *dc, uint32_t code, uint32_t flags)   \
-     R_TYPE(instr, (code));                                             \
-     if (likely(instr.c != R_ZERO)) {                                   \
-         TCGv t0 = tcg_temp_new();                                      \
--        tcg_gen_##insn(t0, dc->cpu_R[instr.c],                         \
--                       load_gpr(dc, instr.a), load_gpr(dc, instr.b)); \
-+        tcg_gen_##insn(t0, cpu_R[instr.c],                             \
-+                       load_gpr(dc, instr.a), load_gpr(dc, instr.b));  \
-         tcg_temp_free(t0);                                             \
-     }                                                                  \
- }
-@@ -XXX,XX +XXX,XX @@ static void (fname)(DisasContext *dc, uint32_t code, uint32_t flags)       \
-     if (likely(instr.c != R_ZERO)) {                                       \
-         TCGv t0 = tcg_temp_new();                                          \
-         tcg_gen_andi_tl(t0, load_gpr((dc), instr.b), 31);                  \
--        tcg_gen_##insn((dc)->cpu_R[instr.c], load_gpr((dc), instr.a), t0); \
-+        tcg_gen_##insn(cpu_R[instr.c], load_gpr((dc), instr.a), t0);       \
-         tcg_temp_free(t0);                                                 \
-     }                                                                      \
- }
-@@ -XXX,XX +XXX,XX @@ static void divs(DisasContext *dc, uint32_t code, uint32_t flags)
-     tcg_gen_or_tl(t2, t2, t3);
-     tcg_gen_movi_tl(t3, 0);
-     tcg_gen_movcond_tl(TCG_COND_NE, t1, t2, t3, t2, t1);
--    tcg_gen_div_tl(dc->cpu_R[instr.c], t0, t1);
--    tcg_gen_ext32s_tl(dc->cpu_R[instr.c], dc->cpu_R[instr.c]);
-+    tcg_gen_div_tl(cpu_R[instr.c], t0, t1);
-+    tcg_gen_ext32s_tl(cpu_R[instr.c], cpu_R[instr.c]);
-     tcg_temp_free(t3);
-     tcg_temp_free(t2);
-@@ -XXX,XX +XXX,XX @@ static void divu(DisasContext *dc, uint32_t code, uint32_t flags)
-     tcg_gen_ext32u_tl(t0, load_gpr(dc, instr.a));
-     tcg_gen_ext32u_tl(t1, load_gpr(dc, instr.b));
-     tcg_gen_movcond_tl(TCG_COND_EQ, t1, t1, t2, t3, t1);
--    tcg_gen_divu_tl(dc->cpu_R[instr.c], t0, t1);
--    tcg_gen_ext32s_tl(dc->cpu_R[instr.c], dc->cpu_R[instr.c]);
-+    tcg_gen_divu_tl(cpu_R[instr.c], t0, t1);
-+    tcg_gen_ext32s_tl(cpu_R[instr.c], cpu_R[instr.c]);
-     tcg_temp_free(t3);
-     tcg_temp_free(t2);
-@@ -XXX,XX +XXX,XX @@ static const char * const regnames[] = {
-     "rpc"
- };
--static TCGv cpu_R[NUM_CORE_REGS];
--
- #include "exec/gen-icount.h"
- static void gen_exception(DisasContext *dc, uint32_t excp)
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-     int num_insns;
-     /* Initialize DC */
--    dc->cpu_R   = cpu_R;
-     dc->is_jmp  = DISAS_NEXT;
-     dc->pc      = tb->pc;
-     dc->tb      = tb;
 --
-.25.1
+.34.1

-[PULL 05/63] target/nios2: Convert to TranslatorOps
+Deleted patch
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/nios2/translate.c | 128 ++++++++++++++++++++-------------------
-file changed, 65 insertions(+), 63 deletions(-)
-diff --git a/target/nios2/translate.c b/target/nios2/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/nios2/translate.c
-+++ b/target/nios2/translate.c
-@@ -XXX,XX +XXX,XX @@ static void gen_exception(DisasContext *dc, uint32_t excp)
- }
- /* generate intermediate code for basic block 'tb'.  */
--void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-+static void nios2_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
- {
-+    DisasContext *dc = container_of(dcbase, DisasContext, base);
-     CPUNios2State *env = cs->env_ptr;
--    DisasContext dc1, *dc = &dc1;
--    int num_insns;
--
--    /* Initialize DC */
--
--    dc->base.tb = tb;
--    dc->base.singlestep_enabled = cs->singlestep_enabled;
--    dc->base.is_jmp = DISAS_NEXT;
--    dc->base.pc_first = tb->pc;
--    dc->base.pc_next = tb->pc;
-+    int page_insns;
-     dc->mem_idx = cpu_mmu_index(env, false);
--    /* Set up instruction counts */
--    num_insns = 0;
--    if (max_insns > 1) {
--        int page_insns = (TARGET_PAGE_SIZE - (tb->pc & ~TARGET_PAGE_MASK)) / 4;
--        if (max_insns > page_insns) {
--            max_insns = page_insns;
--        }
--    }
-+    /* Bound the number of insns to execute to those left on the page.  */
-+    page_insns = -(dc->base.pc_first | TARGET_PAGE_MASK) / 4;
-+    dc->base.max_insns = MIN(page_insns, dc->base.max_insns);
-+}
--    gen_tb_start(tb);
--    do {
--        tcg_gen_insn_start(dc->base.pc_next);
--        num_insns++;
-+static void nios2_tr_tb_start(DisasContextBase *db, CPUState *cs)
-+{
-+}
--        if (unlikely(cpu_breakpoint_test(cs, dc->base.pc_next, BP_ANY))) {
--            gen_exception(dc, EXCP_DEBUG);
--            /* The address covered by the breakpoint must be included in
--               [tb->pc, tb->pc + tb->size) in order to for it to be
--               properly cleared -- thus we increment the PC here so that
--               the logic setting tb->size below does the right thing.  */
--            dc->pc += 4;
--            break;
--        }
-+static void nios2_tr_insn_start(DisasContextBase *dcbase, CPUState *cs)
-+{
-+    tcg_gen_insn_start(dcbase->pc_next);
-+}
--        if (num_insns == max_insns && (tb_cflags(tb) & CF_LAST_IO)) {
--            gen_io_start();
--        }
-+static bool nios2_tr_breakpoint_check(DisasContextBase *dcbase, CPUState *cs,
-+                                      const CPUBreakpoint *bp)
-+{
-+    DisasContext *dc = container_of(dcbase, DisasContext, base);
--        dc->pc = dc->base.pc_next;
--        dc->base.pc_next += 4;
-+    gen_exception(dc, EXCP_DEBUG);
-+    /*
-+     * The address covered by the breakpoint must be included in
-+     * [tb->pc, tb->pc + tb->size) in order to for it to be
-+     * properly cleared -- thus we increment the PC here so that
-+     * the logic setting tb->size below does the right thing.
-+     */
-+    dc->base.pc_next += 4;
-+    return true;
-+}
--        /* Decode an instruction */
--        handle_instruction(dc, env);
-+static void nios2_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
-+{
-+    DisasContext *dc = container_of(dcbase, DisasContext, base);
-+    CPUNios2State *env = cs->env_ptr;
--        /* Translation stops when a conditional branch is encountered.
--         * Otherwise the subsequent code could get translated several times.
--         * Also stop translation when a page boundary is reached.  This
--         * ensures prefetch aborts occur at the right place.  */
--    } while (!dc->base.is_jmp &&
--             !tcg_op_buf_full() &&
--             num_insns < max_insns);
-+    dc->pc = dc->base.pc_next;
-+    dc->base.pc_next += 4;
-+
-+    /* Decode an instruction */
-+    handle_instruction(dc, env);
-+}
-+
-+static void nios2_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
-+{
-+    DisasContext *dc = container_of(dcbase, DisasContext, base);
-     /* Indicate where the next block should start */
-     switch (dc->base.is_jmp) {
--    case DISAS_NEXT:
-+    case DISAS_TOO_MANY:
-     case DISAS_UPDATE:
-         /* Save the current PC back into the CPU register */
-         tcg_gen_movi_tl(cpu_R[R_PC], dc->base.pc_next);
-         tcg_gen_exit_tb(NULL, 0);
-         break;
--    default:
-     case DISAS_JUMP:
-         /* The jump will already have updated the PC register */
-         tcg_gen_exit_tb(NULL, 0);
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-     case DISAS_NORETURN:
-         /* nothing more to generate */
-         break;
-+
-+    default:
-+        g_assert_not_reached();
-     }
-+}
--    /* End off the block */
--    gen_tb_end(tb, num_insns);
-+static void nios2_tr_disas_log(const DisasContextBase *dcbase, CPUState *cpu)
-+{
-+    qemu_log("IN: %s\n", lookup_symbol(dcbase->pc_first));
-+    log_target_disas(cpu, dcbase->pc_first, dcbase->tb->size);
-+}
--    /* Mark instruction starts for the final generated instruction */
--    tb->size = dc->base.pc_next - dc->base.pc_first;
--    tb->icount = num_insns;
-+static const TranslatorOps nios2_tr_ops = {
-+    .init_disas_context = nios2_tr_init_disas_context,
-+    .tb_start           = nios2_tr_tb_start,
-+    .insn_start         = nios2_tr_insn_start,
-+    .breakpoint_check   = nios2_tr_breakpoint_check,
-+    .translate_insn     = nios2_tr_translate_insn,
-+    .tb_stop            = nios2_tr_tb_stop,
-+    .disas_log          = nios2_tr_disas_log,
-+};
--#ifdef DEBUG_DISAS
--    if (qemu_loglevel_mask(CPU_LOG_TB_IN_ASM)
--        && qemu_log_in_addr_range(dc->base.pc_first)) {
--        FILE *logfile = qemu_log_lock();
--        qemu_log("IN: %s\n", lookup_symbol(dc->base.pc_first));
--        log_target_disas(cs, tb->pc, tb->size);
--        qemu_log("\n");
--        qemu_log_unlock(logfile);
--    }
--#endif
-+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-+{
-+    DisasContext dc;
-+    translator_loop(&nios2_tr_ops, &dc.base, cs, tb, max_insns);
- }
- void nios2_cpu_dump_state(CPUState *cs, FILE *f, int flags)
---
-.25.1

-[PULL 06/63] target/nios2: Remove assignment to env in handle_instruction
+Deleted patch
-Direct assignments to env during translation do not work.
-As it happens, the only way we can get here is if env->pc
-is already set to dc->pc.  We will trap on the first insn
-we execute anywhere on the page.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/nios2/translate.c | 3 ++-
-file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/target/nios2/translate.c b/target/nios2/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/nios2/translate.c
-+++ b/target/nios2/translate.c
-@@ -XXX,XX +XXX,XX @@ static void handle_instruction(DisasContext *dc, CPUNios2State *env)
-     uint32_t code;
-     uint8_t op;
-     const Nios2Instruction *instr;
-+
- #if defined(CONFIG_USER_ONLY)
-     /* FIXME: Is this needed ? */
-     if (dc->pc >= 0x1000 && dc->pc < 0x2000) {
--        env->regs[R_PC] = dc->pc;
-         t_gen_helper_raise_exception(dc, 0xaa);
-         return;
-     }
- #endif
-+
-     code = cpu_ldl_code(env, dc->pc);
-     op = get_opcode(code);
---
-.25.1

-[PULL 07/63] target/nios2: Clean up goto in handle_instruction
+Deleted patch
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/nios2/translate.c | 8 ++------
-file changed, 2 insertions(+), 6 deletions(-)
-diff --git a/target/nios2/translate.c b/target/nios2/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/nios2/translate.c
-+++ b/target/nios2/translate.c
-@@ -XXX,XX +XXX,XX @@ static void handle_instruction(DisasContext *dc, CPUNios2State *env)
-     op = get_opcode(code);
-     if (unlikely(op >= ARRAY_SIZE(i_type_instructions))) {
--        goto illegal_op;
-+        t_gen_helper_raise_exception(dc, EXCP_ILLEGAL);
-+        return;
-     }
-     dc->zero = NULL;
-@@ -XXX,XX +XXX,XX @@ static void handle_instruction(DisasContext *dc, CPUNios2State *env)
-     if (dc->zero) {
-         tcg_temp_free(dc->zero);
-     }
--
--    return;
--
--illegal_op:
--    t_gen_helper_raise_exception(dc, EXCP_ILLEGAL);
- }
- static const char * const regnames[] = {
---
-.25.1

-[PULL 11/63] target/avr: Change ctx to DisasContext* in gen_intermediate_code
+Deleted patch
-Prepare for receiving it as a pointer input.
-Tested-by: Michael Rolnik <mrolnik@gmail.com>
-Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/avr/translate.c | 84 +++++++++++++++++++++---------------------
-file changed, 43 insertions(+), 41 deletions(-)
-diff --git a/target/avr/translate.c b/target/avr/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/avr/translate.c
-+++ b/target/avr/translate.c
-@@ -XXX,XX +XXX,XX @@ struct DisasContext {
-      * used in the following manner (sketch)
-      *
-      * TCGLabel *skip_label = NULL;
--     * if (ctx.skip_cond != TCG_COND_NEVER) {
-+     * if (ctx->skip_cond != TCG_COND_NEVER) {
-      *     skip_label = gen_new_label();
-      *     tcg_gen_brcond_tl(skip_cond, skip_var0, skip_var1, skip_label);
-      * }
-@@ -XXX,XX +XXX,XX @@ struct DisasContext {
-      *     free_skip_var0 = false;
-      * }
-      *
--     * translate(&ctx);
-+     * translate(ctx);
-      *
-      * if (skip_label) {
-      *     gen_set_label(skip_label);
-@@ -XXX,XX +XXX,XX @@ static bool canonicalize_skip(DisasContext *ctx)
- void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
- {
-     CPUAVRState *env = cs->env_ptr;
--    DisasContext ctx = {
-+    DisasContext ctx1 = {
-         .base.tb = tb,
-         .base.is_jmp = DISAS_NEXT,
-         .base.pc_first = tb->pc,
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-         .memidx = 0,
-         .skip_cond = TCG_COND_NEVER,
-     };
-+    DisasContext *ctx = &ctx1;
-     target_ulong pc_start = tb->pc / 2;
-     int num_insns = 0;
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-          */
-         max_insns = 1;
-     }
--    if (ctx.base.singlestep_enabled) {
-+    if (ctx->base.singlestep_enabled) {
-         max_insns = 1;
-     }
-     gen_tb_start(tb);
--    ctx.npc = pc_start;
-+    ctx->npc = pc_start;
-     if (tb->flags & TB_FLAGS_SKIP) {
--        ctx.skip_cond = TCG_COND_ALWAYS;
--        ctx.skip_var0 = cpu_skip;
-+        ctx->skip_cond = TCG_COND_ALWAYS;
-+        ctx->skip_var0 = cpu_skip;
-     }
-     do {
-         TCGLabel *skip_label = NULL;
-         /* translate current instruction */
--        tcg_gen_insn_start(ctx.npc);
-+        tcg_gen_insn_start(ctx->npc);
-         num_insns++;
-         /*
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-          * b main   - sets breakpoint at address 0x00000100 (code)
-          * b *0x100 - sets breakpoint at address 0x00800100 (data)
-          */
--        if (unlikely(!ctx.base.singlestep_enabled &&
--                (cpu_breakpoint_test(cs, OFFSET_CODE + ctx.npc * 2, BP_ANY) ||
--                 cpu_breakpoint_test(cs, OFFSET_DATA + ctx.npc * 2, BP_ANY)))) {
--            canonicalize_skip(&ctx);
--            tcg_gen_movi_tl(cpu_pc, ctx.npc);
-+        if (unlikely(!ctx->base.singlestep_enabled &&
-+            (cpu_breakpoint_test(cs, OFFSET_CODE + ctx->npc * 2, BP_ANY) ||
-+             cpu_breakpoint_test(cs, OFFSET_DATA + ctx->npc * 2, BP_ANY)))) {
-+            canonicalize_skip(ctx);
-+            tcg_gen_movi_tl(cpu_pc, ctx->npc);
-             gen_helper_debug(cpu_env);
-             goto done_generating;
-         }
-         /* Conditionally skip the next instruction, if indicated.  */
--        if (ctx.skip_cond != TCG_COND_NEVER) {
-+        if (ctx->skip_cond != TCG_COND_NEVER) {
-             skip_label = gen_new_label();
--            if (ctx.skip_var0 == cpu_skip) {
-+            if (ctx->skip_var0 == cpu_skip) {
-                 /*
-                  * Copy cpu_skip so that we may zero it before the branch.
-                  * This ensures that cpu_skip is non-zero after the label
-                  * if and only if the skipped insn itself sets a skip.
-                  */
--                ctx.free_skip_var0 = true;
--                ctx.skip_var0 = tcg_temp_new();
--                tcg_gen_mov_tl(ctx.skip_var0, cpu_skip);
-+                ctx->free_skip_var0 = true;
-+                ctx->skip_var0 = tcg_temp_new();
-+                tcg_gen_mov_tl(ctx->skip_var0, cpu_skip);
-                 tcg_gen_movi_tl(cpu_skip, 0);
-             }
--            if (ctx.skip_var1 == NULL) {
--                tcg_gen_brcondi_tl(ctx.skip_cond, ctx.skip_var0, 0, skip_label);
-+            if (ctx->skip_var1 == NULL) {
-+                tcg_gen_brcondi_tl(ctx->skip_cond, ctx->skip_var0,
-+                                   0, skip_label);
-             } else {
--                tcg_gen_brcond_tl(ctx.skip_cond, ctx.skip_var0,
--                                  ctx.skip_var1, skip_label);
--                ctx.skip_var1 = NULL;
-+                tcg_gen_brcond_tl(ctx->skip_cond, ctx->skip_var0,
-+                                  ctx->skip_var1, skip_label);
-+                ctx->skip_var1 = NULL;
-             }
--            if (ctx.free_skip_var0) {
--                tcg_temp_free(ctx.skip_var0);
--                ctx.free_skip_var0 = false;
-+            if (ctx->free_skip_var0) {
-+                tcg_temp_free(ctx->skip_var0);
-+                ctx->free_skip_var0 = false;
-             }
--            ctx.skip_cond = TCG_COND_NEVER;
--            ctx.skip_var0 = NULL;
-+            ctx->skip_cond = TCG_COND_NEVER;
-+            ctx->skip_var0 = NULL;
-         }
--        translate(&ctx);
-+        translate(ctx);
-         if (skip_label) {
--            canonicalize_skip(&ctx);
-+            canonicalize_skip(ctx);
-             gen_set_label(skip_label);
--            if (ctx.base.is_jmp == DISAS_NORETURN) {
--                ctx.base.is_jmp = DISAS_CHAIN;
-+            if (ctx->base.is_jmp == DISAS_NORETURN) {
-+                ctx->base.is_jmp = DISAS_CHAIN;
-             }
-         }
--    } while (ctx.base.is_jmp == DISAS_NEXT
-+    } while (ctx->base.is_jmp == DISAS_NEXT
-              && num_insns < max_insns
--             && (ctx.npc - pc_start) * 2 < TARGET_PAGE_SIZE - 4
-+             && (ctx->npc - pc_start) * 2 < TARGET_PAGE_SIZE - 4
-              && !tcg_op_buf_full());
-     if (tb->cflags & CF_LAST_IO) {
-         gen_io_end();
-     }
--    bool nonconst_skip = canonicalize_skip(&ctx);
-+    bool nonconst_skip = canonicalize_skip(ctx);
--    switch (ctx.base.is_jmp) {
-+    switch (ctx->base.is_jmp) {
-     case DISAS_NORETURN:
-         assert(!nonconst_skip);
-         break;
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-     case DISAS_CHAIN:
-         if (!nonconst_skip) {
-             /* Note gen_goto_tb checks singlestep.  */
--            gen_goto_tb(&ctx, 1, ctx.npc);
-+            gen_goto_tb(ctx, 1, ctx->npc);
-             break;
-         }
--        tcg_gen_movi_tl(cpu_pc, ctx.npc);
-+        tcg_gen_movi_tl(cpu_pc, ctx->npc);
-         /* fall through */
-     case DISAS_LOOKUP:
--        if (!ctx.base.singlestep_enabled) {
-+        if (!ctx->base.singlestep_enabled) {
-             tcg_gen_lookup_and_goto_ptr();
-             break;
-         }
-         /* fall through */
-     case DISAS_EXIT:
--        if (ctx.base.singlestep_enabled) {
-+        if (ctx->base.singlestep_enabled) {
-             gen_helper_debug(cpu_env);
-         } else {
-             tcg_gen_exit_tb(NULL, 0);
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
- done_generating:
-     gen_tb_end(tb, num_insns);
--    tb->size = (ctx.npc - pc_start) * 2;
-+    tb->size = (ctx->npc - pc_start) * 2;
-     tb->icount = num_insns;
- #ifdef DEBUG_DISAS
---
-.25.1

-[PULL 49/63] tcg/mips: Support bswap flags in tcg_out_bswap32
+[PULL 15/20] include/hw/core: Create struct CPUJumpCache
-Merge tcg_out_bswap32 and tcg_out_bswap32s.
+Wrap the bare TranslationBlock pointer into a structure.
 Use the flags in the internal uses for loads and stores.
-For mips32r2 bswap32 with zero-extension, standardize on
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 WSBH+ROTR+DEXT.  This is the same number of insns as the
 previous DSBH+DSHD+DSRL but fits in better with the flags check.
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/mips/tcg-target.c.inc | 39 ++++++++++++++++-----------------------
+ accel/tcg/tb-hash.h       |  1 +
-file changed, 16 insertions(+), 23 deletions(-)
+ accel/tcg/tb-jmp-cache.h  | 24 ++++++++++++++++++++++++
  include/exec/cpu-common.h |  1 +
  include/hw/core/cpu.h     | 15 +--------------
  include/qemu/typedefs.h   |  1 +
  accel/stubs/tcg-stub.c    |  4 ++++
  accel/tcg/cpu-exec.c      | 10 +++++++---
  accel/tcg/cputlb.c        |  9 +++++----
  accel/tcg/translate-all.c | 28 +++++++++++++++++++++++++---
  hw/core/cpu-common.c      |  3 +--
  plugins/core.c            |  2 +-
  trace/control-target.c    |  2 +-
 files changed, 72 insertions(+), 28 deletions(-)
  create mode 100644 accel/tcg/tb-jmp-cache.h
-diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
+diff --git a/accel/tcg/tb-hash.h b/accel/tcg/tb-hash.h
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/mips/tcg-target.c.inc
+--- a/accel/tcg/tb-hash.h
-+++ b/tcg/mips/tcg-target.c.inc
++++ b/accel/tcg/tb-hash.h
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_bswap_subr(TCGContext *s, const tcg_insn_unit *sub)
+@@ -XXX,XX +XXX,XX @@
-     tcg_debug_assert(ok);
+ #include "exec/cpu-defs.h"
- }
+ #include "exec/exec-all.h"
+ #include "qemu/xxhash.h"
--static void tcg_out_bswap32(TCGContext *s, TCGReg ret, TCGReg arg)
++#include "tb-jmp-cache.h"
-+static void tcg_out_bswap32(TCGContext *s, TCGReg ret, TCGReg arg, int flags)
- {
+ #ifdef CONFIG_SOFTMMU
-     if (use_mips32r2_instructions) {
-         tcg_out_opc_reg(s, OPC_WSBH, ret, 0, arg);
+diff --git a/accel/tcg/tb-jmp-cache.h b/accel/tcg/tb-jmp-cache.h
-         tcg_out_opc_sa(s, OPC_ROTR, ret, ret, 16);
+new file mode 100644
-+        if (flags & TCG_BSWAP_OZ) {
+index XXXXXXX..XXXXXXX
-+            tcg_out_opc_bf(s, OPC_DEXT, ret, ret, 31, 0);
+--- /dev/null
-+        }
++++ b/accel/tcg/tb-jmp-cache.h
-     } else {
+@@ -XXX,XX +XXX,XX @@
--        tcg_out_bswap_subr(s, bswap32_addr);
++/*
--        /* delay slot -- never omit the insn, like tcg_out_mov might.  */
++ * The per-CPU TranslationBlock jump cache.
--        tcg_out_opc_reg(s, OPC_OR, TCG_TMP0, arg, TCG_REG_ZERO);
++ *
--        tcg_out_mov(s, TCG_TYPE_I32, ret, TCG_TMP3);
++ *  Copyright (c) 2003 Fabrice Bellard
 + *
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + */
 +
 +#ifndef ACCEL_TCG_TB_JMP_CACHE_H
 +#define ACCEL_TCG_TB_JMP_CACHE_H
 +
 +#define TB_JMP_CACHE_BITS 12
 +#define TB_JMP_CACHE_SIZE (1 << TB_JMP_CACHE_BITS)
 +
 +/*
 + * Accessed in parallel; all accesses to 'tb' must be atomic.
 + */
 +struct CPUJumpCache {
 +    struct {
 +        TranslationBlock *tb;
 +    } array[TB_JMP_CACHE_SIZE];
 +};
 +
 +#endif /* ACCEL_TCG_TB_JMP_CACHE_H */
 diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/exec/cpu-common.h
 +++ b/include/exec/cpu-common.h
@@ -XXX,XX +XXX,XX @@ void cpu_list_unlock(void);
  unsigned int cpu_list_generation_id_get(void);
  void tcg_flush_softmmu_tlb(CPUState *cs);
 +void tcg_flush_jmp_cache(CPUState *cs);
  void tcg_iommu_init_notifier_list(CPUState *cpu);
  void tcg_iommu_free_notifier_list(CPUState *cpu);
 diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/core/cpu.h
 +++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ struct kvm_run;
  struct hax_vcpu_state;
  struct hvf_vcpu_state;
 -#define TB_JMP_CACHE_BITS 12
 -#define TB_JMP_CACHE_SIZE (1 << TB_JMP_CACHE_BITS)
 -
  /* work queue */
  /* The union type allows passing of 64 bit target pointers on 32 bit
@@ -XXX,XX +XXX,XX @@ struct CPUState {
      CPUArchState *env_ptr;
      IcountDecr *icount_decr_ptr;
 -    /* Accessed in parallel; all accesses must be atomic */
 -    TranslationBlock *tb_jmp_cache[TB_JMP_CACHE_SIZE];
 +    CPUJumpCache *tb_jmp_cache;
      struct GDBRegisterState *gdb_regs;
      int gdb_num_regs;
@@ -XXX,XX +XXX,XX @@ extern CPUTailQ cpus;
  extern __thread CPUState *current_cpu;
 -static inline void cpu_tb_jmp_cache_clear(CPUState *cpu)
 -{
 -    unsigned int i;
 -
 -    for (i = 0; i < TB_JMP_CACHE_SIZE; i++) {
 -        qatomic_set(&cpu->tb_jmp_cache[i], NULL);
 -    }
 -}
 -
--static void tcg_out_bswap32u(TCGContext *s, TCGReg ret, TCGReg arg)
+ /**
--{
+  * qemu_tcg_mttcg_enabled:
--    if (use_mips32r2_instructions) {
+  * Check whether we are running MultiThread TCG or not.
--        tcg_out_opc_reg(s, OPC_DSBH, ret, 0, arg);
+diff --git a/include/qemu/typedefs.h b/include/qemu/typedefs.h
--        tcg_out_opc_reg(s, OPC_DSHD, ret, 0, ret);
+index XXXXXXX..XXXXXXX 100644
--        tcg_out_dsrl(s, ret, ret, 32);
+--- a/include/qemu/typedefs.h
--    } else {
++++ b/include/qemu/typedefs.h
--        tcg_out_bswap_subr(s, bswap32u_addr);
+@@ -XXX,XX +XXX,XX @@ typedef struct CoMutex CoMutex;
-+        if (flags & TCG_BSWAP_OZ) {
+ typedef struct ConfidentialGuestSupport ConfidentialGuestSupport;
-+            tcg_out_bswap_subr(s, bswap32u_addr);
+ typedef struct CPUAddressSpace CPUAddressSpace;
-+        } else {
+ typedef struct CPUArchState CPUArchState;
-+            tcg_out_bswap_subr(s, bswap32_addr);
++typedef struct CPUJumpCache CPUJumpCache;
  typedef struct CPUState CPUState;
  typedef struct CPUTLBEntryFull CPUTLBEntryFull;
  typedef struct DeviceListener DeviceListener;
 diff --git a/accel/stubs/tcg-stub.c b/accel/stubs/tcg-stub.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/stubs/tcg-stub.c
 +++ b/accel/stubs/tcg-stub.c
@@ -XXX,XX +XXX,XX @@ void tlb_set_dirty(CPUState *cpu, target_ulong vaddr)
  {
  }
 +void tcg_flush_jmp_cache(CPUState *cpu)
 +{
 +}
 +
  int probe_access_flags(CPUArchState *env, target_ulong addr,
                         MMUAccessType access_type, int mmu_idx,
                         bool nonfault, void **phost, uintptr_t retaddr)
 diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cpu-exec.c
 +++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/replay.h"
  #include "sysemu/tcg.h"
  #include "exec/helper-proto.h"
 +#include "tb-jmp-cache.h"
  #include "tb-hash.h"
  #include "tb-context.h"
  #include "internal.h"
@@ -XXX,XX +XXX,XX @@ static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
      tcg_debug_assert(!(cflags & CF_INVALID));
      hash = tb_jmp_cache_hash_func(pc);
 -    tb = qatomic_rcu_read(&cpu->tb_jmp_cache[hash]);
 +    tb = qatomic_rcu_read(&cpu->tb_jmp_cache->array[hash].tb);
      if (likely(tb &&
                 tb->pc == pc &&
@@ -XXX,XX +XXX,XX @@ static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
      if (tb == NULL) {
          return NULL;
      }
 -    qatomic_set(&cpu->tb_jmp_cache[hash], tb);
 +    qatomic_set(&cpu->tb_jmp_cache->array[hash].tb, tb);
      return tb;
  }
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
              tb = tb_lookup(cpu, pc, cs_base, flags, cflags);
              if (tb == NULL) {
 +                uint32_t h;
 +
                  mmap_lock();
                  tb = tb_gen_code(cpu, pc, cs_base, flags, cflags);
                  mmap_unlock();
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
                   * We add the TB in the virtual pc hash table
                   * for the fast lookup
                   */
 -                qatomic_set(&cpu->tb_jmp_cache[tb_jmp_cache_hash_func(pc)], tb);
 +                h = tb_jmp_cache_hash_func(pc);
 +                qatomic_set(&cpu->tb_jmp_cache->array[h].tb, tb);
              }
  #ifndef CONFIG_USER_ONLY
 diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cputlb.c
 +++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_window_reset(CPUTLBDesc *desc, int64_t ns,
  static void tb_jmp_cache_clear_page(CPUState *cpu, target_ulong page_addr)
  {
 -    unsigned int i, i0 = tb_jmp_cache_hash_page(page_addr);
 +    int i, i0 = tb_jmp_cache_hash_page(page_addr);
 +    CPUJumpCache *jc = cpu->tb_jmp_cache;
      for (i = 0; i < TB_JMP_PAGE_SIZE; i++) {
 -        qatomic_set(&cpu->tb_jmp_cache[i0 + i], NULL);
 +        qatomic_set(&jc->array[i0 + i].tb, NULL);
      }
  }
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_by_mmuidx_async_work(CPUState *cpu, run_on_cpu_data data)
      qemu_spin_unlock(&env_tlb(env)->c.lock);
 -    cpu_tb_jmp_cache_clear(cpu);
 +    tcg_flush_jmp_cache(cpu);
      if (to_clean == ALL_MMUIDX_BITS) {
          qatomic_set(&env_tlb(env)->c.full_flush_count,
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_range_by_mmuidx_async_0(CPUState *cpu,
       * longer to clear each entry individually than it will to clear it all.
       */
      if (d.len >= (TARGET_PAGE_SIZE * TB_JMP_CACHE_SIZE)) {
 -        cpu_tb_jmp_cache_clear(cpu);
 +        tcg_flush_jmp_cache(cpu);
          return;
      }
 diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translate-all.c
 +++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/tcg.h"
  #include "qapi/error.h"
  #include "hw/core/tcg-cpu-ops.h"
 +#include "tb-jmp-cache.h"
  #include "tb-hash.h"
  #include "tb-context.h"
  #include "internal.h"
@@ -XXX,XX +XXX,XX @@ static void do_tb_flush(CPUState *cpu, run_on_cpu_data tb_flush_count)
      }
      CPU_FOREACH(cpu) {
 -        cpu_tb_jmp_cache_clear(cpu);
 +        tcg_flush_jmp_cache(cpu);
      }
      qht_reset_size(&tb_ctx.htable, CODE_GEN_HTABLE_SIZE);
@@ -XXX,XX +XXX,XX @@ static void do_tb_phys_invalidate(TranslationBlock *tb, bool rm_from_page_list)
      /* remove the TB from the hash list */
      h = tb_jmp_cache_hash_func(tb->pc);
      CPU_FOREACH(cpu) {
 -        if (qatomic_read(&cpu->tb_jmp_cache[h]) == tb) {
 -            qatomic_set(&cpu->tb_jmp_cache[h], NULL);
 +        CPUJumpCache *jc = cpu->tb_jmp_cache;
 +        if (qatomic_read(&jc->array[h].tb) == tb) {
 +            qatomic_set(&jc->array[h].tb, NULL);
          }
      }
@@ -XXX,XX +XXX,XX @@ int page_unprotect(target_ulong address, uintptr_t pc)
  }
  #endif /* CONFIG_USER_ONLY */
 +/*
 + * Called by generic code at e.g. cpu reset after cpu creation,
 + * therefore we must be prepared to allocate the jump cache.
 + */
 +void tcg_flush_jmp_cache(CPUState *cpu)
 +{
 +    CPUJumpCache *jc = cpu->tb_jmp_cache;
 +
 +    if (likely(jc)) {
 +        for (int i = 0; i < TB_JMP_CACHE_SIZE; i++) {
 +            qatomic_set(&jc->array[i].tb, NULL);
 +        }
-         /* delay slot -- never omit the insn, like tcg_out_mov might.  */
++    } else {
-         tcg_out_opc_reg(s, OPC_OR, TCG_TMP0, arg, TCG_REG_ZERO);
++        /* This should happen once during realize, and thus never race. */
-         tcg_out_mov(s, TCG_TYPE_I32, ret, TCG_TMP3);
++        jc = g_new0(CPUJumpCache, 1);
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg lo, TCGReg hi,
++        jc = qatomic_xchg(&cpu->tb_jmp_cache, jc);
-         if (TCG_TARGET_REG_BITS == 64 && is_64) {
++        assert(jc == NULL);
-             if (use_mips32r2_instructions) {
++    }
-                 tcg_out_opc_imm(s, OPC_LWU, lo, base, 0);
++}
--                tcg_out_bswap32u(s, lo, lo);
++
-+                tcg_out_bswap32(s, lo, lo, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
+ /* This is a wrapper for common code that can not use CONFIG_SOFTMMU */
-             } else {
+ void tcg_flush_softmmu_tlb(CPUState *cs)
-                 tcg_out_bswap_subr(s, bswap32u_addr);
+ {
-                 /* delay slot */
+diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg lo, TCGReg hi,
+index XXXXXXX..XXXXXXX 100644
-     case MO_SL | MO_BSWAP:
+--- a/hw/core/cpu-common.c
-         if (use_mips32r2_instructions) {
++++ b/hw/core/cpu-common.c
-             tcg_out_opc_imm(s, OPC_LW, lo, base, 0);
+@@ -XXX,XX +XXX,XX @@ static void cpu_common_reset(DeviceState *dev)
--            tcg_out_bswap32(s, lo, lo);
+     cpu->cflags_next_tb = -1;
-+            tcg_out_bswap32(s, lo, lo, 0);
-         } else {
+     if (tcg_enabled()) {
-             tcg_out_bswap_subr(s, bswap32_addr);
+-        cpu_tb_jmp_cache_clear(cpu);
-             /* delay slot */
+-
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, TCGReg lo, TCGReg hi,
++        tcg_flush_jmp_cache(cpu);
-         break;
+         tcg_flush_softmmu_tlb(cpu);
+     }
-     case MO_32 | MO_BSWAP:
+ }
--        tcg_out_bswap32(s, TCG_TMP3, lo);
+diff --git a/plugins/core.c b/plugins/core.c
-+        tcg_out_bswap32(s, TCG_TMP3, lo, 0);
+index XXXXXXX..XXXXXXX 100644
-         lo = TCG_TMP3;
+--- a/plugins/core.c
-         /* FALLTHRU */
++++ b/plugins/core.c
-     case MO_32:
+@@ -XXX,XX +XXX,XX @@ struct qemu_plugin_ctx *plugin_id_to_ctx_locked(qemu_plugin_id_t id)
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, TCGReg lo, TCGReg hi,
+ static void plugin_cpu_update__async(CPUState *cpu, run_on_cpu_data data)
-             tcg_out_opc_imm(s, OPC_SW, TCG_TMP0, base, 0);
+ {
-             tcg_out_opc_imm(s, OPC_SW, TCG_TMP1, base, 4);
+     bitmap_copy(cpu->plugin_mask, &data.host_ulong, QEMU_PLUGIN_EV_MAX);
-         } else {
+-    cpu_tb_jmp_cache_clear(cpu);
--            tcg_out_bswap32(s, TCG_TMP3, MIPS_BE ? lo : hi);
++    tcg_flush_jmp_cache(cpu);
-+            tcg_out_bswap32(s, TCG_TMP3, MIPS_BE ? lo : hi, 0);
+ }
-             tcg_out_opc_imm(s, OPC_SW, TCG_TMP3, base, 0);
--            tcg_out_bswap32(s, TCG_TMP3, MIPS_BE ? hi : lo);
+ static void plugin_cpu_update__locked(gpointer k, gpointer v, gpointer udata)
-+            tcg_out_bswap32(s, TCG_TMP3, MIPS_BE ? hi : lo, 0);
+diff --git a/trace/control-target.c b/trace/control-target.c
-             tcg_out_opc_imm(s, OPC_SW, TCG_TMP3, base, 4);
+index XXXXXXX..XXXXXXX 100644
-         }
+--- a/trace/control-target.c
-         break;
++++ b/trace/control-target.c
-@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
+@@ -XXX,XX +XXX,XX @@ static void trace_event_synchronize_vcpu_state_dynamic(
-         tcg_out_bswap16(s, a0, a1, a2);
+ {
-         break;
+     bitmap_copy(vcpu->trace_dstate, vcpu->trace_dstate_delayed,
-     case INDEX_op_bswap32_i32:
+                 CPU_TRACE_DSTATE_MAX_EVENTS);
--        tcg_out_bswap32(s, a0, a1);
+-    cpu_tb_jmp_cache_clear(vcpu);
-+        tcg_out_bswap32(s, a0, a1, 0);
++    tcg_flush_jmp_cache(vcpu);
-         break;
+ }
-     case INDEX_op_bswap32_i64:
--        tcg_out_bswap32u(s, a0, a1);
+ void trace_event_set_vcpu_state_dynamic(CPUState *vcpu,
 +        tcg_out_bswap32(s, a0, a1, a2);
          break;
      case INDEX_op_bswap64_i64:
          tcg_out_bswap64(s, a0, a1);
 --
-.25.1
+.34.1

-[PULL 61/63] tcg/arm: Unset TCG_TARGET_HAS_MEMORY_BSWAP
+[PULL 16/20] hw/core: Add CPUClass.get_pc
-Now that the middle-end can replicate the same tricks as tcg/arm
+Populate this new method for all targets.  Always match
-used for optimizing bswap for signed loads and for stores, do not
+the result that would be given by cpu_get_tb_cpu_state,
-pretend to have these memory ops in the backend.
+as we will want these values to correspond in the logs.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Taylor Simpson <tsimpson@quicinc.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> (target/sparc)
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/arm/tcg-target.h     |   2 +-
+Cc: Eduardo Habkost <eduardo@habkost.net> (supporter:Machine core)
- tcg/arm/tcg-target.c.inc | 214 ++++++++++++++-------------------------
+Cc: Marcel Apfelbaum <marcel.apfelbaum@gmail.com> (supporter:Machine core)
-files changed, 77 insertions(+), 139 deletions(-)
+Cc: "Philippe Mathieu-Daudé" <f4bug@amsat.org> (reviewer:Machine core)
 Cc: Yanan Wang <wangyanan55@huawei.com> (reviewer:Machine core)
 Cc: Michael Rolnik <mrolnik@gmail.com> (maintainer:AVR TCG CPUs)
 Cc: "Edgar E. Iglesias" <edgar.iglesias@gmail.com> (maintainer:CRIS TCG CPUs)
 Cc: Taylor Simpson <tsimpson@quicinc.com> (supporter:Hexagon TCG CPUs)
 Cc: Song Gao <gaosong@loongson.cn> (maintainer:LoongArch TCG CPUs)
 Cc: Xiaojuan Yang <yangxiaojuan@loongson.cn> (maintainer:LoongArch TCG CPUs)
 Cc: Laurent Vivier <laurent@vivier.eu> (maintainer:M68K TCG CPUs)
 Cc: Jiaxun Yang <jiaxun.yang@flygoat.com> (reviewer:MIPS TCG CPUs)
 Cc: Aleksandar Rikalo <aleksandar.rikalo@syrmia.com> (reviewer:MIPS TCG CPUs)
 Cc: Chris Wulff <crwulff@gmail.com> (maintainer:NiosII TCG CPUs)
 Cc: Marek Vasut <marex@denx.de> (maintainer:NiosII TCG CPUs)
 Cc: Stafford Horne <shorne@gmail.com> (odd fixer:OpenRISC TCG CPUs)
 Cc: Yoshinori Sato <ysato@users.sourceforge.jp> (reviewer:RENESAS RX CPUs)
 Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> (maintainer:SPARC TCG CPUs)
 Cc: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> (maintainer:TriCore TCG CPUs)
 Cc: Max Filippov <jcmvbkbc@gmail.com> (maintainer:Xtensa TCG CPUs)
 Cc: qemu-arm@nongnu.org (open list:ARM TCG CPUs)
 Cc: qemu-ppc@nongnu.org (open list:PowerPC TCG CPUs)
 Cc: qemu-riscv@nongnu.org (open list:RISC-V TCG CPUs)
 Cc: qemu-s390x@nongnu.org (open list:S390 TCG CPUs)
 ---
  include/hw/core/cpu.h   |  3 +++
  target/alpha/cpu.c      |  9 +++++++++
  target/arm/cpu.c        | 13 +++++++++++++
  target/avr/cpu.c        |  8 ++++++++
  target/cris/cpu.c       |  8 ++++++++
  target/hexagon/cpu.c    |  8 ++++++++
  target/hppa/cpu.c       |  8 ++++++++
  target/i386/cpu.c       |  9 +++++++++
  target/loongarch/cpu.c  |  9 +++++++++
  target/m68k/cpu.c       |  8 ++++++++
  target/microblaze/cpu.c |  8 ++++++++
  target/mips/cpu.c       |  8 ++++++++
  target/nios2/cpu.c      |  9 +++++++++
  target/openrisc/cpu.c   |  8 ++++++++
  target/ppc/cpu_init.c   |  8 ++++++++
  target/riscv/cpu.c      | 13 +++++++++++++
  target/rx/cpu.c         |  8 ++++++++
  target/s390x/cpu.c      |  8 ++++++++
  target/sh4/cpu.c        |  8 ++++++++
  target/sparc/cpu.c      |  8 ++++++++
  target/tricore/cpu.c    |  9 +++++++++
  target/xtensa/cpu.c     |  8 ++++++++
 files changed, 186 insertions(+)
-diff --git a/tcg/arm/tcg-target.h b/tcg/arm/tcg-target.h
+diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/arm/tcg-target.h
+--- a/include/hw/core/cpu.h
-+++ b/tcg/arm/tcg-target.h
++++ b/include/hw/core/cpu.h
-@@ -XXX,XX +XXX,XX @@ extern bool use_neon_instructions;
+@@ -XXX,XX +XXX,XX @@ struct SysemuCPUOps;
- #define TCG_TARGET_HAS_cmpsel_vec       0
+  *       If the target behaviour here is anything other than "set
+  *       the PC register to the value passed in" then the target must
- #define TCG_TARGET_DEFAULT_MO (0)
+  *       also implement the synchronize_from_tb hook.
--#define TCG_TARGET_HAS_MEMORY_BSWAP     1
++ * @get_pc: Callback for getting the Program Counter register.
-+#define TCG_TARGET_HAS_MEMORY_BSWAP     0
++ *       As above, with the semantics of the target architecture.
+  * @gdb_read_register: Callback for letting GDB read a register.
- /* not defined -- call should be eliminated at compile time */
+  * @gdb_write_register: Callback for letting GDB write a register.
- void tb_target_set_jmp_target(uintptr_t, uintptr_t, uintptr_t, uintptr_t);
+  * @gdb_adjust_breakpoint: Callback for adjusting the address of a
-diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ struct CPUClass {
-index XXXXXXX..XXXXXXX 100644
+     void (*dump_state)(CPUState *cpu, FILE *, int flags);
---- a/tcg/arm/tcg-target.c.inc
+     int64_t (*get_arch_id)(CPUState *cpu);
-+++ b/tcg/arm/tcg-target.c.inc
+     void (*set_pc)(CPUState *cpu, vaddr value);
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_vldst(TCGContext *s, ARMInsn insn,
++    vaddr (*get_pc)(CPUState *cpu);
- /* helper signature: helper_ret_ld_mmu(CPUState *env, target_ulong addr,
+     int (*gdb_read_register)(CPUState *cpu, GByteArray *buf, int reg);
-  *                                     int mmu_idx, uintptr_t ra)
+     int (*gdb_write_register)(CPUState *cpu, uint8_t *buf, int reg);
-  */
+     vaddr (*gdb_adjust_breakpoint)(CPUState *cpu, vaddr addr);
--static void * const qemu_ld_helpers[16] = {
+diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
-+static void * const qemu_ld_helpers[8] = {
+index XXXXXXX..XXXXXXX 100644
-     [MO_UB]   = helper_ret_ldub_mmu,
+--- a/target/alpha/cpu.c
-     [MO_SB]   = helper_ret_ldsb_mmu,
++++ b/target/alpha/cpu.c
--
+@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_set_pc(CPUState *cs, vaddr value)
--    [MO_LEUW] = helper_le_lduw_mmu,
+     cpu->env.pc = value;
--    [MO_LEUL] = helper_le_ldul_mmu,
+ }
--    [MO_LEQ]  = helper_le_ldq_mmu,
--    [MO_LESW] = helper_le_ldsw_mmu,
++static vaddr alpha_cpu_get_pc(CPUState *cs)
--    [MO_LESL] = helper_le_ldul_mmu,
++{
--
++    AlphaCPU *cpu = ALPHA_CPU(cs);
--    [MO_BEUW] = helper_be_lduw_mmu,
++
--    [MO_BEUL] = helper_be_ldul_mmu,
++    return cpu->env.pc;
--    [MO_BEQ]  = helper_be_ldq_mmu,
++}
--    [MO_BESW] = helper_be_ldsw_mmu,
++
--    [MO_BESL] = helper_be_ldul_mmu,
++
-+#ifdef HOST_WORDS_BIGENDIAN
+ static bool alpha_cpu_has_work(CPUState *cs)
-+    [MO_UW] = helper_be_lduw_mmu,
+ {
-+    [MO_UL] = helper_be_ldul_mmu,
+     /* Here we are checking to see if the CPU should wake up from HALT.
-+    [MO_Q]  = helper_be_ldq_mmu,
+@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
-+    [MO_SW] = helper_be_ldsw_mmu,
+     cc->has_work = alpha_cpu_has_work;
-+    [MO_SL] = helper_be_ldul_mmu,
+     cc->dump_state = alpha_cpu_dump_state;
-+#else
+     cc->set_pc = alpha_cpu_set_pc;
-+    [MO_UW] = helper_le_lduw_mmu,
++    cc->get_pc = alpha_cpu_get_pc;
-+    [MO_UL] = helper_le_ldul_mmu,
+     cc->gdb_read_register = alpha_cpu_gdb_read_register;
-+    [MO_Q]  = helper_le_ldq_mmu,
+     cc->gdb_write_register = alpha_cpu_gdb_write_register;
-+    [MO_SW] = helper_le_ldsw_mmu,
+ #ifndef CONFIG_USER_ONLY
-+    [MO_SL] = helper_le_ldul_mmu,
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-+#endif
+index XXXXXXX..XXXXXXX 100644
- };
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
- /* helper signature: helper_ret_st_mmu(CPUState *env, target_ulong addr,
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_set_pc(CPUState *cs, vaddr value)
   *                                     uintxx_t val, int mmu_idx, uintptr_t ra)
   */
 -static void * const qemu_st_helpers[16] = {
 -    [MO_UB]   = helper_ret_stb_mmu,
 -    [MO_LEUW] = helper_le_stw_mmu,
 -    [MO_LEUL] = helper_le_stl_mmu,
 -    [MO_LEQ]  = helper_le_stq_mmu,
 -    [MO_BEUW] = helper_be_stw_mmu,
 -    [MO_BEUL] = helper_be_stl_mmu,
 -    [MO_BEQ]  = helper_be_stq_mmu,
 +static void * const qemu_st_helpers[4] = {
 +    [MO_8]   = helper_ret_stb_mmu,
 +#ifdef HOST_WORDS_BIGENDIAN
 +    [MO_16] = helper_be_stw_mmu,
 +    [MO_32] = helper_be_stl_mmu,
 +    [MO_64] = helper_be_stq_mmu,
 +#else
 +    [MO_16] = helper_le_stw_mmu,
 +    [MO_32] = helper_le_stl_mmu,
 +    [MO_64] = helper_le_stq_mmu,
 +#endif
  };
  /* Helper routines for marshalling helper function arguments into
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
         icache usage.  For pre-armv6, use the signed helpers since we do
         not have a single insn sign-extend.  */
      if (use_armv6_instructions) {
 -        func = qemu_ld_helpers[opc & (MO_BSWAP | MO_SIZE)];
 +        func = qemu_ld_helpers[opc & MO_SIZE];
      } else {
 -        func = qemu_ld_helpers[opc & (MO_BSWAP | MO_SSIZE)];
 +        func = qemu_ld_helpers[opc & MO_SSIZE];
          if (opc & MO_SIGN) {
              opc = MO_UL;
          }
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
      argreg = tcg_out_arg_reg32(s, argreg, TCG_REG_R14);
      /* Tail-call to the helper, which will return to the fast path.  */
 -    tcg_out_goto(s, COND_AL, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)]);
 +    tcg_out_goto(s, COND_AL, qemu_st_helpers[opc & MO_SIZE]);
      return true;
  }
  #endif /* SOFTMMU */
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_qemu_ld_index(TCGContext *s, MemOp opc,
                                           TCGReg datalo, TCGReg datahi,
                                           TCGReg addrlo, TCGReg addend)
  {
 -    MemOp bswap = opc & MO_BSWAP;
 +    /* Byte swapping is left to middle-end expansion. */
 +    tcg_debug_assert((opc & MO_BSWAP) == 0);
      switch (opc & MO_SSIZE) {
      case MO_UB:
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_qemu_ld_index(TCGContext *s, MemOp opc,
          break;
      case MO_UW:
          tcg_out_ld16u_r(s, COND_AL, datalo, addrlo, addend);
 -        if (bswap) {
 -            tcg_out_bswap16(s, COND_AL, datalo, datalo,
 -                            TCG_BSWAP_IZ | TCG_BSWAP_OZ);
 -        }
          break;
      case MO_SW:
 -        if (bswap) {
 -            tcg_out_ld16u_r(s, COND_AL, datalo, addrlo, addend);
 -            tcg_out_bswap16(s, COND_AL, datalo, datalo,
 -                            TCG_BSWAP_IZ | TCG_BSWAP_OS);
 -        } else {
 -            tcg_out_ld16s_r(s, COND_AL, datalo, addrlo, addend);
 -        }
 +        tcg_out_ld16s_r(s, COND_AL, datalo, addrlo, addend);
          break;
      case MO_UL:
 -    default:
          tcg_out_ld32_r(s, COND_AL, datalo, addrlo, addend);
 -        if (bswap) {
 -            tcg_out_bswap32(s, COND_AL, datalo, datalo);
 -        }
          break;
      case MO_Q:
 -        {
 -            TCGReg dl = (bswap ? datahi : datalo);
 -            TCGReg dh = (bswap ? datalo : datahi);
 -
 -            /* Avoid ldrd for user-only emulation, to handle unaligned.  */
 -            if (USING_SOFTMMU && use_armv6_instructions
 -                && (dl & 1) == 0 && dh == dl + 1) {
 -                tcg_out_ldrd_r(s, COND_AL, dl, addrlo, addend);
 -            } else if (dl != addend) {
 -                tcg_out_ld32_rwb(s, COND_AL, dl, addend, addrlo);
 -                tcg_out_ld32_12(s, COND_AL, dh, addend, 4);
 -            } else {
 -                tcg_out_dat_reg(s, COND_AL, ARITH_ADD, TCG_REG_TMP,
 -                                addend, addrlo, SHIFT_IMM_LSL(0));
 -                tcg_out_ld32_12(s, COND_AL, dl, TCG_REG_TMP, 0);
 -                tcg_out_ld32_12(s, COND_AL, dh, TCG_REG_TMP, 4);
 -            }
 -            if (bswap) {
 -                tcg_out_bswap32(s, COND_AL, dl, dl);
 -                tcg_out_bswap32(s, COND_AL, dh, dh);
 -            }
 +        /* Avoid ldrd for user-only emulation, to handle unaligned.  */
 +        if (USING_SOFTMMU && use_armv6_instructions
 +            && (datalo & 1) == 0 && datahi == datalo + 1) {
 +            tcg_out_ldrd_r(s, COND_AL, datalo, addrlo, addend);
 +        } else if (datalo != addend) {
 +            tcg_out_ld32_rwb(s, COND_AL, datalo, addend, addrlo);
 +            tcg_out_ld32_12(s, COND_AL, datahi, addend, 4);
 +        } else {
 +            tcg_out_dat_reg(s, COND_AL, ARITH_ADD, TCG_REG_TMP,
 +                            addend, addrlo, SHIFT_IMM_LSL(0));
 +            tcg_out_ld32_12(s, COND_AL, datalo, TCG_REG_TMP, 0);
 +            tcg_out_ld32_12(s, COND_AL, datahi, TCG_REG_TMP, 4);
          }
          break;
 +    default:
 +        g_assert_not_reached();
      }
  }
-@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_qemu_ld_direct(TCGContext *s, MemOp opc,
++static vaddr arm_cpu_get_pc(CPUState *cs)
-                                           TCGReg datalo, TCGReg datahi,
++{
-                                           TCGReg addrlo)
++    ARMCPU *cpu = ARM_CPU(cs);
- {
++    CPUARMState *env = &cpu->env;
--    MemOp bswap = opc & MO_BSWAP;
++
-+    /* Byte swapping is left to middle-end expansion. */
++    if (is_a64(env)) {
-+    tcg_debug_assert((opc & MO_BSWAP) == 0);
++        return env->pc;
++    } else {
-     switch (opc & MO_SSIZE) {
++        return env->regs[15];
-     case MO_UB:
++    }
-@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_qemu_ld_direct(TCGContext *s, MemOp opc,
++}
-         break;
++
-     case MO_UW:
+ #ifdef CONFIG_TCG
-         tcg_out_ld16u_8(s, COND_AL, datalo, addrlo, 0);
+ void arm_cpu_synchronize_from_tb(CPUState *cs,
--        if (bswap) {
+                                  const TranslationBlock *tb)
--            tcg_out_bswap16(s, COND_AL, datalo, datalo,
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
--                            TCG_BSWAP_IZ | TCG_BSWAP_OZ);
+     cc->has_work = arm_cpu_has_work;
--        }
+     cc->dump_state = arm_cpu_dump_state;
-         break;
+     cc->set_pc = arm_cpu_set_pc;
-     case MO_SW:
++    cc->get_pc = arm_cpu_get_pc;
--        if (bswap) {
+     cc->gdb_read_register = arm_cpu_gdb_read_register;
--            tcg_out_ld16u_8(s, COND_AL, datalo, addrlo, 0);
+     cc->gdb_write_register = arm_cpu_gdb_write_register;
--            tcg_out_bswap16(s, COND_AL, datalo, datalo,
+ #ifndef CONFIG_USER_ONLY
--                            TCG_BSWAP_IZ | TCG_BSWAP_OS);
+diff --git a/target/avr/cpu.c b/target/avr/cpu.c
--        } else {
+index XXXXXXX..XXXXXXX 100644
--            tcg_out_ld16s_8(s, COND_AL, datalo, addrlo, 0);
+--- a/target/avr/cpu.c
--        }
++++ b/target/avr/cpu.c
-+        tcg_out_ld16s_8(s, COND_AL, datalo, addrlo, 0);
+@@ -XXX,XX +XXX,XX @@ static void avr_cpu_set_pc(CPUState *cs, vaddr value)
-         break;
+     cpu->env.pc_w = value / 2; /* internally PC points to words */
-     case MO_UL:
+ }
--    default:
-         tcg_out_ld32_12(s, COND_AL, datalo, addrlo, 0);
++static vaddr avr_cpu_get_pc(CPUState *cs)
--        if (bswap) {
++{
--            tcg_out_bswap32(s, COND_AL, datalo, datalo);
++    AVRCPU *cpu = AVR_CPU(cs);
--        }
++
-         break;
++    return cpu->env.pc_w * 2;
-     case MO_Q:
++}
--        {
++
--            TCGReg dl = (bswap ? datahi : datalo);
+ static bool avr_cpu_has_work(CPUState *cs)
--            TCGReg dh = (bswap ? datalo : datahi);
+ {
--
+     AVRCPU *cpu = AVR_CPU(cs);
--            /* Avoid ldrd for user-only emulation, to handle unaligned.  */
+@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
--            if (USING_SOFTMMU && use_armv6_instructions
+     cc->has_work = avr_cpu_has_work;
--                && (dl & 1) == 0 && dh == dl + 1) {
+     cc->dump_state = avr_cpu_dump_state;
--                tcg_out_ldrd_8(s, COND_AL, dl, addrlo, 0);
+     cc->set_pc = avr_cpu_set_pc;
--            } else if (dl == addrlo) {
++    cc->get_pc = avr_cpu_get_pc;
--                tcg_out_ld32_12(s, COND_AL, dh, addrlo, bswap ? 0 : 4);
+     dc->vmsd = &vms_avr_cpu;
--                tcg_out_ld32_12(s, COND_AL, dl, addrlo, bswap ? 4 : 0);
+     cc->sysemu_ops = &avr_sysemu_ops;
--            } else {
+     cc->disas_set_info = avr_cpu_disas_set_info;
--                tcg_out_ld32_12(s, COND_AL, dl, addrlo, bswap ? 4 : 0);
+diff --git a/target/cris/cpu.c b/target/cris/cpu.c
--                tcg_out_ld32_12(s, COND_AL, dh, addrlo, bswap ? 0 : 4);
+index XXXXXXX..XXXXXXX 100644
--            }
+--- a/target/cris/cpu.c
--            if (bswap) {
++++ b/target/cris/cpu.c
--                tcg_out_bswap32(s, COND_AL, dl, dl);
+@@ -XXX,XX +XXX,XX @@ static void cris_cpu_set_pc(CPUState *cs, vaddr value)
--                tcg_out_bswap32(s, COND_AL, dh, dh);
+     cpu->env.pc = value;
--            }
+ }
-+        /* Avoid ldrd for user-only emulation, to handle unaligned.  */
-+        if (USING_SOFTMMU && use_armv6_instructions
++static vaddr cris_cpu_get_pc(CPUState *cs)
-+            && (datalo & 1) == 0 && datahi == datalo + 1) {
++{
-+            tcg_out_ldrd_8(s, COND_AL, datalo, addrlo, 0);
++    CRISCPU *cpu = CRIS_CPU(cs);
-+        } else if (datalo == addrlo) {
++
-+            tcg_out_ld32_12(s, COND_AL, datahi, addrlo, 4);
++    return cpu->env.pc;
-+            tcg_out_ld32_12(s, COND_AL, datalo, addrlo, 0);
++}
-+        } else {
++
-+            tcg_out_ld32_12(s, COND_AL, datalo, addrlo, 0);
+ static bool cris_cpu_has_work(CPUState *cs)
-+            tcg_out_ld32_12(s, COND_AL, datahi, addrlo, 4);
+ {
-         }
+     return cs->interrupt_request & (CPU_INTERRUPT_HARD | CPU_INTERRUPT_NMI);
-         break;
+@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
-+    default:
+     cc->has_work = cris_cpu_has_work;
-+        g_assert_not_reached();
+     cc->dump_state = cris_cpu_dump_state;
      cc->set_pc = cris_cpu_set_pc;
 +    cc->get_pc = cris_cpu_get_pc;
      cc->gdb_read_register = cris_cpu_gdb_read_register;
      cc->gdb_write_register = cris_cpu_gdb_write_register;
  #ifndef CONFIG_USER_ONLY
 diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hexagon/cpu.c
 +++ b/target/hexagon/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hexagon_cpu_set_pc(CPUState *cs, vaddr value)
      env->gpr[HEX_REG_PC] = value;
  }
 +static vaddr hexagon_cpu_get_pc(CPUState *cs)
 +{
 +    HexagonCPU *cpu = HEXAGON_CPU(cs);
 +    CPUHexagonState *env = &cpu->env;
 +    return env->gpr[HEX_REG_PC];
 +}
 +
  static void hexagon_cpu_synchronize_from_tb(CPUState *cs,
                                              const TranslationBlock *tb)
  {
@@ -XXX,XX +XXX,XX @@ static void hexagon_cpu_class_init(ObjectClass *c, void *data)
      cc->has_work = hexagon_cpu_has_work;
      cc->dump_state = hexagon_dump_state;
      cc->set_pc = hexagon_cpu_set_pc;
 +    cc->get_pc = hexagon_cpu_get_pc;
      cc->gdb_read_register = hexagon_gdb_read_register;
      cc->gdb_write_register = hexagon_gdb_write_register;
      cc->gdb_num_core_regs = TOTAL_PER_THREAD_REGS + NUM_VREGS + NUM_QREGS;
 diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hppa/cpu.c
 +++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_set_pc(CPUState *cs, vaddr value)
      cpu->env.iaoq_b = value + 4;
  }
 +static vaddr hppa_cpu_get_pc(CPUState *cs)
 +{
 +    HPPACPU *cpu = HPPA_CPU(cs);
 +
 +    return cpu->env.iaoq_f;
 +}
 +
  static void hppa_cpu_synchronize_from_tb(CPUState *cs,
                                           const TranslationBlock *tb)
  {
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
      cc->has_work = hppa_cpu_has_work;
      cc->dump_state = hppa_cpu_dump_state;
      cc->set_pc = hppa_cpu_set_pc;
 +    cc->get_pc = hppa_cpu_get_pc;
      cc->gdb_read_register = hppa_cpu_gdb_read_register;
      cc->gdb_write_register = hppa_cpu_gdb_write_register;
  #ifndef CONFIG_USER_ONLY
 diff --git a/target/i386/cpu.c b/target/i386/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/cpu.c
 +++ b/target/i386/cpu.c
@@ -XXX,XX +XXX,XX @@ static void x86_cpu_set_pc(CPUState *cs, vaddr value)
      cpu->env.eip = value;
  }
 +static vaddr x86_cpu_get_pc(CPUState *cs)
 +{
 +    X86CPU *cpu = X86_CPU(cs);
 +
 +    /* Match cpu_get_tb_cpu_state. */
 +    return cpu->env.eip + cpu->env.segs[R_CS].base;
 +}
 +
  int x86_cpu_pending_interrupt(CPUState *cs, int interrupt_request)
  {
      X86CPU *cpu = X86_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static void x86_cpu_common_class_init(ObjectClass *oc, void *data)
      cc->has_work = x86_cpu_has_work;
      cc->dump_state = x86_cpu_dump_state;
      cc->set_pc = x86_cpu_set_pc;
 +    cc->get_pc = x86_cpu_get_pc;
      cc->gdb_read_register = x86_cpu_gdb_read_register;
      cc->gdb_write_register = x86_cpu_gdb_write_register;
      cc->get_arch_id = x86_cpu_get_arch_id;
 diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/loongarch/cpu.c
 +++ b/target/loongarch/cpu.c
@@ -XXX,XX +XXX,XX @@ static void loongarch_cpu_set_pc(CPUState *cs, vaddr value)
      env->pc = value;
  }
 +static vaddr loongarch_cpu_get_pc(CPUState *cs)
 +{
 +    LoongArchCPU *cpu = LOONGARCH_CPU(cs);
 +    CPULoongArchState *env = &cpu->env;
 +
 +    return env->pc;
 +}
 +
  #ifndef CONFIG_USER_ONLY
  #include "hw/loongarch/virt.h"
@@ -XXX,XX +XXX,XX @@ static void loongarch_cpu_class_init(ObjectClass *c, void *data)
      cc->has_work = loongarch_cpu_has_work;
      cc->dump_state = loongarch_cpu_dump_state;
      cc->set_pc = loongarch_cpu_set_pc;
 +    cc->get_pc = loongarch_cpu_get_pc;
  #ifndef CONFIG_USER_ONLY
      dc->vmsd = &vmstate_loongarch_cpu;
      cc->sysemu_ops = &loongarch_sysemu_ops;
 diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/m68k/cpu.c
 +++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_set_pc(CPUState *cs, vaddr value)
      cpu->env.pc = value;
  }
 +static vaddr m68k_cpu_get_pc(CPUState *cs)
 +{
 +    M68kCPU *cpu = M68K_CPU(cs);
 +
 +    return cpu->env.pc;
 +}
 +
  static bool m68k_cpu_has_work(CPUState *cs)
  {
      return cs->interrupt_request & CPU_INTERRUPT_HARD;
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
      cc->has_work = m68k_cpu_has_work;
      cc->dump_state = m68k_cpu_dump_state;
      cc->set_pc = m68k_cpu_set_pc;
 +    cc->get_pc = m68k_cpu_get_pc;
      cc->gdb_read_register = m68k_cpu_gdb_read_register;
      cc->gdb_write_register = m68k_cpu_gdb_write_register;
  #if defined(CONFIG_SOFTMMU)
 diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/microblaze/cpu.c
 +++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_set_pc(CPUState *cs, vaddr value)
      cpu->env.iflags = 0;
  }
 +static vaddr mb_cpu_get_pc(CPUState *cs)
 +{
 +    MicroBlazeCPU *cpu = MICROBLAZE_CPU(cs);
 +
 +    return cpu->env.pc;
 +}
 +
  static void mb_cpu_synchronize_from_tb(CPUState *cs,
                                         const TranslationBlock *tb)
  {
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
      cc->dump_state = mb_cpu_dump_state;
      cc->set_pc = mb_cpu_set_pc;
 +    cc->get_pc = mb_cpu_get_pc;
      cc->gdb_read_register = mb_cpu_gdb_read_register;
      cc->gdb_write_register = mb_cpu_gdb_write_register;
 diff --git a/target/mips/cpu.c b/target/mips/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/cpu.c
 +++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_set_pc(CPUState *cs, vaddr value)
      mips_env_set_pc(&cpu->env, value);
  }
 +static vaddr mips_cpu_get_pc(CPUState *cs)
 +{
 +    MIPSCPU *cpu = MIPS_CPU(cs);
 +
 +    return cpu->env.active_tc.PC;
 +}
 +
  static bool mips_cpu_has_work(CPUState *cs)
  {
      MIPSCPU *cpu = MIPS_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
      cc->has_work = mips_cpu_has_work;
      cc->dump_state = mips_cpu_dump_state;
      cc->set_pc = mips_cpu_set_pc;
 +    cc->get_pc = mips_cpu_get_pc;
      cc->gdb_read_register = mips_cpu_gdb_read_register;
      cc->gdb_write_register = mips_cpu_gdb_write_register;
  #ifndef CONFIG_USER_ONLY
 diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/nios2/cpu.c
 +++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_set_pc(CPUState *cs, vaddr value)
      env->pc = value;
  }
 +static vaddr nios2_cpu_get_pc(CPUState *cs)
 +{
 +    Nios2CPU *cpu = NIOS2_CPU(cs);
 +    CPUNios2State *env = &cpu->env;
 +
 +    return env->pc;
 +}
 +
  static bool nios2_cpu_has_work(CPUState *cs)
  {
      return cs->interrupt_request & CPU_INTERRUPT_HARD;
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
      cc->has_work = nios2_cpu_has_work;
      cc->dump_state = nios2_cpu_dump_state;
      cc->set_pc = nios2_cpu_set_pc;
 +    cc->get_pc = nios2_cpu_get_pc;
      cc->disas_set_info = nios2_cpu_disas_set_info;
  #ifndef CONFIG_USER_ONLY
      cc->sysemu_ops = &nios2_sysemu_ops;
 diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/openrisc/cpu.c
 +++ b/target/openrisc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_set_pc(CPUState *cs, vaddr value)
      cpu->env.dflag = 0;
  }
 +static vaddr openrisc_cpu_get_pc(CPUState *cs)
 +{
 +    OpenRISCCPU *cpu = OPENRISC_CPU(cs);
 +
 +    return cpu->env.pc;
 +}
 +
  static void openrisc_cpu_synchronize_from_tb(CPUState *cs,
                                               const TranslationBlock *tb)
  {
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
      cc->has_work = openrisc_cpu_has_work;
      cc->dump_state = openrisc_cpu_dump_state;
      cc->set_pc = openrisc_cpu_set_pc;
 +    cc->get_pc = openrisc_cpu_get_pc;
      cc->gdb_read_register = openrisc_cpu_gdb_read_register;
      cc->gdb_write_register = openrisc_cpu_gdb_write_register;
  #ifndef CONFIG_USER_ONLY
 diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/ppc/cpu_init.c
 +++ b/target/ppc/cpu_init.c
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_set_pc(CPUState *cs, vaddr value)
      cpu->env.nip = value;
  }
 +static vaddr ppc_cpu_get_pc(CPUState *cs)
 +{
 +    PowerPCCPU *cpu = POWERPC_CPU(cs);
 +
 +    return cpu->env.nip;
 +}
 +
  static bool ppc_cpu_has_work(CPUState *cs)
  {
      PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
      cc->has_work = ppc_cpu_has_work;
      cc->dump_state = ppc_cpu_dump_state;
      cc->set_pc = ppc_cpu_set_pc;
 +    cc->get_pc = ppc_cpu_get_pc;
      cc->gdb_read_register = ppc_cpu_gdb_read_register;
      cc->gdb_write_register = ppc_cpu_gdb_write_register;
  #ifndef CONFIG_USER_ONLY
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_set_pc(CPUState *cs, vaddr value)
      }
  }
-@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_qemu_st_index(TCGContext *s, int cond, MemOp opc,
++static vaddr riscv_cpu_get_pc(CPUState *cs)
-                                          TCGReg datalo, TCGReg datahi,
++{
-                                          TCGReg addrlo, TCGReg addend)
++    RISCVCPU *cpu = RISCV_CPU(cs);
- {
++    CPURISCVState *env = &cpu->env;
--    MemOp bswap = opc & MO_BSWAP;
++
-+    /* Byte swapping is left to middle-end expansion. */
++    /* Match cpu_get_tb_cpu_state. */
-+    tcg_debug_assert((opc & MO_BSWAP) == 0);
++    if (env->xl == MXL_RV32) {
++        return env->pc & UINT32_MAX;
-     switch (opc & MO_SIZE) {
++    }
-     case MO_8:
++    return env->pc;
-         tcg_out_st8_r(s, cond, datalo, addrlo, addend);
++}
-         break;
++
-     case MO_16:
+ static void riscv_cpu_synchronize_from_tb(CPUState *cs,
--        if (bswap) {
+                                           const TranslationBlock *tb)
--            tcg_out_bswap16(s, cond, TCG_REG_R0, datalo, 0);
+ {
--            tcg_out_st16_r(s, cond, TCG_REG_R0, addrlo, addend);
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
--        } else {
+     cc->has_work = riscv_cpu_has_work;
--            tcg_out_st16_r(s, cond, datalo, addrlo, addend);
+     cc->dump_state = riscv_cpu_dump_state;
--        }
+     cc->set_pc = riscv_cpu_set_pc;
-+        tcg_out_st16_r(s, cond, datalo, addrlo, addend);
++    cc->get_pc = riscv_cpu_get_pc;
-         break;
+     cc->gdb_read_register = riscv_cpu_gdb_read_register;
-     case MO_32:
+     cc->gdb_write_register = riscv_cpu_gdb_write_register;
--    default:
+     cc->gdb_num_core_regs = 33;
--        if (bswap) {
+diff --git a/target/rx/cpu.c b/target/rx/cpu.c
--            tcg_out_bswap32(s, cond, TCG_REG_R0, datalo);
+index XXXXXXX..XXXXXXX 100644
--            tcg_out_st32_r(s, cond, TCG_REG_R0, addrlo, addend);
+--- a/target/rx/cpu.c
--        } else {
++++ b/target/rx/cpu.c
--            tcg_out_st32_r(s, cond, datalo, addrlo, addend);
+@@ -XXX,XX +XXX,XX @@ static void rx_cpu_set_pc(CPUState *cs, vaddr value)
--        }
+     cpu->env.pc = value;
-+        tcg_out_st32_r(s, cond, datalo, addrlo, addend);
+ }
-         break;
-     case MO_64:
++static vaddr rx_cpu_get_pc(CPUState *cs)
-         /* Avoid strd for user-only emulation, to handle unaligned.  */
++{
--        if (bswap) {
++    RXCPU *cpu = RX_CPU(cs);
--            tcg_out_bswap32(s, cond, TCG_REG_R0, datahi);
++
--            tcg_out_st32_rwb(s, cond, TCG_REG_R0, addend, addrlo);
++    return cpu->env.pc;
--            tcg_out_bswap32(s, cond, TCG_REG_R0, datalo);
++}
--            tcg_out_st32_12(s, cond, TCG_REG_R0, addend, 4);
++
--        } else if (USING_SOFTMMU && use_armv6_instructions
+ static void rx_cpu_synchronize_from_tb(CPUState *cs,
--                   && (datalo & 1) == 0 && datahi == datalo + 1) {
+                                        const TranslationBlock *tb)
-+        if (USING_SOFTMMU && use_armv6_instructions
+ {
-+            && (datalo & 1) == 0 && datahi == datalo + 1) {
+@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
-             tcg_out_strd_r(s, cond, datalo, addrlo, addend);
+     cc->has_work = rx_cpu_has_work;
-         } else {
+     cc->dump_state = rx_cpu_dump_state;
-             tcg_out_st32_rwb(s, cond, datalo, addend, addrlo);
+     cc->set_pc = rx_cpu_set_pc;
-             tcg_out_st32_12(s, cond, datahi, addend, 4);
++    cc->get_pc = rx_cpu_get_pc;
-         }
-         break;
+ #ifndef CONFIG_USER_ONLY
-+    default:
+     cc->sysemu_ops = &rx_sysemu_ops;
-+        g_assert_not_reached();
+diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
-     }
+index XXXXXXX..XXXXXXX 100644
- }
+--- a/target/s390x/cpu.c
++++ b/target/s390x/cpu.c
-@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_qemu_st_direct(TCGContext *s, MemOp opc,
+@@ -XXX,XX +XXX,XX @@ static void s390_cpu_set_pc(CPUState *cs, vaddr value)
-                                           TCGReg datalo, TCGReg datahi,
+     cpu->env.psw.addr = value;
-                                           TCGReg addrlo)
+ }
- {
--    MemOp bswap = opc & MO_BSWAP;
++static vaddr s390_cpu_get_pc(CPUState *cs)
-+    /* Byte swapping is left to middle-end expansion. */
++{
-+    tcg_debug_assert((opc & MO_BSWAP) == 0);
++    S390CPU *cpu = S390_CPU(cs);
++
-     switch (opc & MO_SIZE) {
++    return cpu->env.psw.addr;
-     case MO_8:
++}
-         tcg_out_st8_12(s, COND_AL, datalo, addrlo, 0);
++
-         break;
+ static bool s390_cpu_has_work(CPUState *cs)
-     case MO_16:
+ {
--        if (bswap) {
+     S390CPU *cpu = S390_CPU(cs);
--            tcg_out_bswap16(s, COND_AL, TCG_REG_R0, datalo, 0);
+@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
--            tcg_out_st16_8(s, COND_AL, TCG_REG_R0, addrlo, 0);
+     cc->has_work = s390_cpu_has_work;
--        } else {
+     cc->dump_state = s390_cpu_dump_state;
--            tcg_out_st16_8(s, COND_AL, datalo, addrlo, 0);
+     cc->set_pc = s390_cpu_set_pc;
--        }
++    cc->get_pc = s390_cpu_get_pc;
-+        tcg_out_st16_8(s, COND_AL, datalo, addrlo, 0);
+     cc->gdb_read_register = s390_cpu_gdb_read_register;
-         break;
+     cc->gdb_write_register = s390_cpu_gdb_write_register;
-     case MO_32:
+ #ifndef CONFIG_USER_ONLY
--    default:
+diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
--        if (bswap) {
+index XXXXXXX..XXXXXXX 100644
--            tcg_out_bswap32(s, COND_AL, TCG_REG_R0, datalo);
+--- a/target/sh4/cpu.c
--            tcg_out_st32_12(s, COND_AL, TCG_REG_R0, addrlo, 0);
++++ b/target/sh4/cpu.c
--        } else {
+@@ -XXX,XX +XXX,XX @@ static void superh_cpu_set_pc(CPUState *cs, vaddr value)
--            tcg_out_st32_12(s, COND_AL, datalo, addrlo, 0);
+     cpu->env.pc = value;
--        }
+ }
-+        tcg_out_st32_12(s, COND_AL, datalo, addrlo, 0);
-         break;
++static vaddr superh_cpu_get_pc(CPUState *cs)
-     case MO_64:
++{
-         /* Avoid strd for user-only emulation, to handle unaligned.  */
++    SuperHCPU *cpu = SUPERH_CPU(cs);
--        if (bswap) {
++
--            tcg_out_bswap32(s, COND_AL, TCG_REG_R0, datahi);
++    return cpu->env.pc;
--            tcg_out_st32_12(s, COND_AL, TCG_REG_R0, addrlo, 0);
++}
--            tcg_out_bswap32(s, COND_AL, TCG_REG_R0, datalo);
++
--            tcg_out_st32_12(s, COND_AL, TCG_REG_R0, addrlo, 4);
+ static void superh_cpu_synchronize_from_tb(CPUState *cs,
--        } else if (USING_SOFTMMU && use_armv6_instructions
+                                            const TranslationBlock *tb)
--                   && (datalo & 1) == 0 && datahi == datalo + 1) {
+ {
-+        if (USING_SOFTMMU && use_armv6_instructions
+@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
-+            && (datalo & 1) == 0 && datahi == datalo + 1) {
+     cc->has_work = superh_cpu_has_work;
-             tcg_out_strd_8(s, COND_AL, datalo, addrlo, 0);
+     cc->dump_state = superh_cpu_dump_state;
-         } else {
+     cc->set_pc = superh_cpu_set_pc;
-             tcg_out_st32_12(s, COND_AL, datalo, addrlo, 0);
++    cc->get_pc = superh_cpu_get_pc;
-             tcg_out_st32_12(s, COND_AL, datahi, addrlo, 4);
+     cc->gdb_read_register = superh_cpu_gdb_read_register;
-         }
+     cc->gdb_write_register = superh_cpu_gdb_write_register;
-         break;
+ #ifndef CONFIG_USER_ONLY
-+    default:
+diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
-+        g_assert_not_reached();
+index XXXXXXX..XXXXXXX 100644
-     }
+--- a/target/sparc/cpu.c
- }
++++ b/target/sparc/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_set_pc(CPUState *cs, vaddr value)
      cpu->env.npc = value + 4;
  }
 +static vaddr sparc_cpu_get_pc(CPUState *cs)
 +{
 +    SPARCCPU *cpu = SPARC_CPU(cs);
 +
 +    return cpu->env.pc;
 +}
 +
  static void sparc_cpu_synchronize_from_tb(CPUState *cs,
                                            const TranslationBlock *tb)
  {
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
      cc->memory_rw_debug = sparc_cpu_memory_rw_debug;
  #endif
      cc->set_pc = sparc_cpu_set_pc;
 +    cc->get_pc = sparc_cpu_get_pc;
      cc->gdb_read_register = sparc_cpu_gdb_read_register;
      cc->gdb_write_register = sparc_cpu_gdb_write_register;
  #ifndef CONFIG_USER_ONLY
 diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tricore/cpu.c
 +++ b/target/tricore/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_set_pc(CPUState *cs, vaddr value)
      env->PC = value & ~(target_ulong)1;
  }
 +static vaddr tricore_cpu_get_pc(CPUState *cs)
 +{
 +    TriCoreCPU *cpu = TRICORE_CPU(cs);
 +    CPUTriCoreState *env = &cpu->env;
 +
 +    return env->PC;
 +}
 +
  static void tricore_cpu_synchronize_from_tb(CPUState *cs,
                                              const TranslationBlock *tb)
  {
@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_class_init(ObjectClass *c, void *data)
      cc->dump_state = tricore_cpu_dump_state;
      cc->set_pc = tricore_cpu_set_pc;
 +    cc->get_pc = tricore_cpu_get_pc;
      cc->sysemu_ops = &tricore_sysemu_ops;
      cc->tcg_ops = &tricore_tcg_ops;
  }
 diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/xtensa/cpu.c
 +++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_set_pc(CPUState *cs, vaddr value)
      cpu->env.pc = value;
  }
 +static vaddr xtensa_cpu_get_pc(CPUState *cs)
 +{
 +    XtensaCPU *cpu = XTENSA_CPU(cs);
 +
 +    return cpu->env.pc;
 +}
 +
  static bool xtensa_cpu_has_work(CPUState *cs)
  {
  #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
      cc->has_work = xtensa_cpu_has_work;
      cc->dump_state = xtensa_cpu_dump_state;
      cc->set_pc = xtensa_cpu_set_pc;
 +    cc->get_pc = xtensa_cpu_get_pc;
      cc->gdb_read_register = xtensa_cpu_gdb_read_register;
      cc->gdb_write_register = xtensa_cpu_gdb_write_register;
      cc->gdb_stop_before_watchpoint = true;
 --
-.25.1
+.34.1

-[PULL 35/63] tcg: Add flags argument to bswap opcodes
+[PULL 17/20] accel/tcg: Introduce tb_pc and log_pc
-This will eventually simplify front-end usage, and will allow
+The availability of tb->pc will shortly be conditional.
-backends to unset TCG_TARGET_HAS_MEMORY_BSWAP without loss of
+Introduce accessor functions to minimize ifdefs.
 optimization.
-The argument is added during expansion, not currently exposed to the
+Pass around a known pc to places like tcg_gen_code,
-front end translators.  The backends currently only support a flags
+where the caller must already have the value.
 value of either TCG_BSWAP_IZ, or (TCG_BSWAP_IZ | TCG_BSWAP_OZ),
 since they all require zero top bytes and leave them that way.
 At the existing call sites we pass in (TCG_BSWAP_IZ | TCG_BSWAP_OZ),
 except for the flags-ignored cases of a 32-bit swap of a 32-bit
 value and or a 64-bit swap of a 64-bit value, where we pass 0.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/tcg/tcg-opc.h | 10 +++++-----
+ accel/tcg/internal.h                    |  6 ++++
- include/tcg/tcg.h     | 12 ++++++++++++
+ include/exec/exec-all.h                 |  6 ++++
- tcg/tcg-op.c          | 13 ++++++++-----
+ include/tcg/tcg.h                       |  2 +-
- tcg/tcg.c             | 28 ++++++++++++++++++++++++++++
+ accel/tcg/cpu-exec.c                    | 46 ++++++++++++++-----------
- tcg/README            | 22 ++++++++++++++--------
+ accel/tcg/translate-all.c               | 37 +++++++++++---------
-files changed, 67 insertions(+), 18 deletions(-)
+ target/arm/cpu.c                        |  4 +--
  target/avr/cpu.c                        |  2 +-
  target/hexagon/cpu.c                    |  2 +-
  target/hppa/cpu.c                       |  4 +--
  target/i386/tcg/tcg-cpu.c               |  2 +-
  target/loongarch/cpu.c                  |  2 +-
  target/microblaze/cpu.c                 |  2 +-
  target/mips/tcg/exception.c             |  2 +-
  target/mips/tcg/sysemu/special_helper.c |  2 +-
  target/openrisc/cpu.c                   |  2 +-
  target/riscv/cpu.c                      |  4 +--
  target/rx/cpu.c                         |  2 +-
  target/sh4/cpu.c                        |  4 +--
  target/sparc/cpu.c                      |  2 +-
  target/tricore/cpu.c                    |  2 +-
  tcg/tcg.c                               |  8 ++---
 files changed, 82 insertions(+), 61 deletions(-)
-diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
+diff --git a/accel/tcg/internal.h b/accel/tcg/internal.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/tcg/tcg-opc.h
+--- a/accel/tcg/internal.h
-+++ b/include/tcg/tcg-opc.h
++++ b/accel/tcg/internal.h
-@@ -XXX,XX +XXX,XX @@ DEF(ext8s_i32, 1, 1, 0, IMPL(TCG_TARGET_HAS_ext8s_i32))
+@@ -XXX,XX +XXX,XX @@ G_NORETURN void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr);
- DEF(ext16s_i32, 1, 1, 0, IMPL(TCG_TARGET_HAS_ext16s_i32))
+ void page_init(void);
- DEF(ext8u_i32, 1, 1, 0, IMPL(TCG_TARGET_HAS_ext8u_i32))
+ void tb_htable_init(void);
- DEF(ext16u_i32, 1, 1, 0, IMPL(TCG_TARGET_HAS_ext16u_i32))
--DEF(bswap16_i32, 1, 1, 0, IMPL(TCG_TARGET_HAS_bswap16_i32))
++/* Return the current PC from CPU, which may be cached in TB. */
--DEF(bswap32_i32, 1, 1, 0, IMPL(TCG_TARGET_HAS_bswap32_i32))
++static inline target_ulong log_pc(CPUState *cpu, const TranslationBlock *tb)
-+DEF(bswap16_i32, 1, 1, 1, IMPL(TCG_TARGET_HAS_bswap16_i32))
++{
-+DEF(bswap32_i32, 1, 1, 1, IMPL(TCG_TARGET_HAS_bswap32_i32))
++    return tb_pc(tb);
- DEF(not_i32, 1, 1, 0, IMPL(TCG_TARGET_HAS_not_i32))
++}
- DEF(neg_i32, 1, 1, 0, IMPL(TCG_TARGET_HAS_neg_i32))
++
- DEF(andc_i32, 1, 2, 0, IMPL(TCG_TARGET_HAS_andc_i32))
+ #endif /* ACCEL_TCG_INTERNAL_H */
-@@ -XXX,XX +XXX,XX @@ DEF(ext32s_i64, 1, 1, 0, IMPL64 | IMPL(TCG_TARGET_HAS_ext32s_i64))
+diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
- DEF(ext8u_i64, 1, 1, 0, IMPL64 | IMPL(TCG_TARGET_HAS_ext8u_i64))
+index XXXXXXX..XXXXXXX 100644
- DEF(ext16u_i64, 1, 1, 0, IMPL64 | IMPL(TCG_TARGET_HAS_ext16u_i64))
+--- a/include/exec/exec-all.h
- DEF(ext32u_i64, 1, 1, 0, IMPL64 | IMPL(TCG_TARGET_HAS_ext32u_i64))
++++ b/include/exec/exec-all.h
--DEF(bswap16_i64, 1, 1, 0, IMPL64 | IMPL(TCG_TARGET_HAS_bswap16_i64))
+@@ -XXX,XX +XXX,XX @@ struct TranslationBlock {
--DEF(bswap32_i64, 1, 1, 0, IMPL64 | IMPL(TCG_TARGET_HAS_bswap32_i64))
+     uintptr_t jmp_dest[2];
--DEF(bswap64_i64, 1, 1, 0, IMPL64 | IMPL(TCG_TARGET_HAS_bswap64_i64))
+ };
-+DEF(bswap16_i64, 1, 1, 1, IMPL64 | IMPL(TCG_TARGET_HAS_bswap16_i64))
-+DEF(bswap32_i64, 1, 1, 1, IMPL64 | IMPL(TCG_TARGET_HAS_bswap32_i64))
++/* Hide the read to avoid ifdefs for TARGET_TB_PCREL. */
-+DEF(bswap64_i64, 1, 1, 1, IMPL64 | IMPL(TCG_TARGET_HAS_bswap64_i64))
++static inline target_ulong tb_pc(const TranslationBlock *tb)
- DEF(not_i64, 1, 1, 0, IMPL64 | IMPL(TCG_TARGET_HAS_not_i64))
++{
- DEF(neg_i64, 1, 1, 0, IMPL64 | IMPL(TCG_TARGET_HAS_neg_i64))
++    return tb->pc;
- DEF(andc_i64, 1, 2, 0, IMPL64 | IMPL(TCG_TARGET_HAS_andc_i64))
++}
 +
  /* Hide the qatomic_read to make code a little easier on the eyes */
  static inline uint32_t tb_cflags(const TranslationBlock *tb)
  {
 diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/tcg/tcg.h
 +++ b/include/tcg/tcg.h
-@@ -XXX,XX +XXX,XX @@ typedef TCGv_ptr TCGv_env;
+@@ -XXX,XX +XXX,XX @@ void tcg_register_thread(void);
- /* Used to align parameters.  See the comment before tcgv_i32_temp.  */
+ void tcg_prologue_init(TCGContext *s);
- #define TCG_CALL_DUMMY_ARG      ((TCGArg)0)
+ void tcg_func_start(TCGContext *s);
-+/*
+-int tcg_gen_code(TCGContext *s, TranslationBlock *tb);
-+ * Flags for the bswap opcodes.
++int tcg_gen_code(TCGContext *s, TranslationBlock *tb, target_ulong pc_start);
-+ * If IZ, the input is zero-extended, otherwise unknown.
-+ * If OZ or OS, the output is zero- or sign-extended respectively,
+ void tcg_set_frame(TCGContext *s, TCGReg reg, intptr_t start, intptr_t size);
-+ * otherwise the high bits are undefined.
-+ */
+diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
-+enum {
+index XXXXXXX..XXXXXXX 100644
-+    TCG_BSWAP_IZ = 1,
+--- a/accel/tcg/cpu-exec.c
-+    TCG_BSWAP_OZ = 2,
++++ b/accel/tcg/cpu-exec.c
-+    TCG_BSWAP_OS = 4,
+@@ -XXX,XX +XXX,XX @@ static bool tb_lookup_cmp(const void *p, const void *d)
-+};
+     const TranslationBlock *tb = p;
      const struct tb_desc *desc = d;
 -    if (tb->pc == desc->pc &&
 +    if (tb_pc(tb) == desc->pc &&
          tb->page_addr[0] == desc->page_addr0 &&
          tb->cs_base == desc->cs_base &&
          tb->flags == desc->flags &&
@@ -XXX,XX +XXX,XX @@ static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
      return tb;
  }
 -static inline void log_cpu_exec(target_ulong pc, CPUState *cpu,
 -                                const TranslationBlock *tb)
 +static void log_cpu_exec(target_ulong pc, CPUState *cpu,
 +                         const TranslationBlock *tb)
  {
 -    if (unlikely(qemu_loglevel_mask(CPU_LOG_TB_CPU | CPU_LOG_EXEC))
 -        && qemu_log_in_addr_range(pc)) {
 -
 +    if (qemu_log_in_addr_range(pc)) {
          qemu_log_mask(CPU_LOG_EXEC,
                        "Trace %d: %p [" TARGET_FMT_lx
                        "/" TARGET_FMT_lx "/%08x/%08x] %s\n",
@@ -XXX,XX +XXX,XX @@ const void *HELPER(lookup_tb_ptr)(CPUArchState *env)
          return tcg_code_gen_epilogue;
      }
 -    log_cpu_exec(pc, cpu, tb);
 +    if (qemu_loglevel_mask(CPU_LOG_TB_CPU | CPU_LOG_EXEC)) {
 +        log_cpu_exec(pc, cpu, tb);
 +    }
      return tb->tc.ptr;
  }
@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
      TranslationBlock *last_tb;
      const void *tb_ptr = itb->tc.ptr;
 -    log_cpu_exec(itb->pc, cpu, itb);
 +    if (qemu_loglevel_mask(CPU_LOG_TB_CPU | CPU_LOG_EXEC)) {
 +        log_cpu_exec(log_pc(cpu, itb), cpu, itb);
 +    }
      qemu_thread_jit_execute();
      ret = tcg_qemu_tb_exec(env, tb_ptr);
@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
           * of the start of the TB.
           */
          CPUClass *cc = CPU_GET_CLASS(cpu);
 -        qemu_log_mask_and_addr(CPU_LOG_EXEC, last_tb->pc,
 -                               "Stopped execution of TB chain before %p ["
 -                               TARGET_FMT_lx "] %s\n",
 -                               last_tb->tc.ptr, last_tb->pc,
 -                               lookup_symbol(last_tb->pc));
 +
- typedef enum TCGTempVal {
+         if (cc->tcg_ops->synchronize_from_tb) {
-     TEMP_VAL_DEAD,
+             cc->tcg_ops->synchronize_from_tb(cpu, last_tb);
-     TEMP_VAL_REG,
+         } else {
-diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
+             assert(cc->set_pc);
-index XXXXXXX..XXXXXXX 100644
+-            cc->set_pc(cpu, last_tb->pc);
---- a/tcg/tcg-op.c
++            cc->set_pc(cpu, tb_pc(last_tb));
-+++ b/tcg/tcg-op.c
++        }
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_ext16u_i32(TCGv_i32 ret, TCGv_i32 arg)
++        if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
- void tcg_gen_bswap16_i32(TCGv_i32 ret, TCGv_i32 arg)
++            target_ulong pc = log_pc(cpu, last_tb);
- {
++            if (qemu_log_in_addr_range(pc)) {
-     if (TCG_TARGET_HAS_bswap16_i32) {
++                qemu_log("Stopped execution of TB chain before %p ["
--        tcg_gen_op2_i32(INDEX_op_bswap16_i32, ret, arg);
++                         TARGET_FMT_lx "] %s\n",
-+        tcg_gen_op3i_i32(INDEX_op_bswap16_i32, ret, arg,
++                         last_tb->tc.ptr, pc, lookup_symbol(pc));
-+                         TCG_BSWAP_IZ | TCG_BSWAP_OZ);
++            }
          }
      }
@@ -XXX,XX +XXX,XX @@ static inline void tb_add_jump(TranslationBlock *tb, int n,
      qemu_spin_unlock(&tb_next->jmp_lock);
 -    qemu_log_mask_and_addr(CPU_LOG_EXEC, tb->pc,
 -                           "Linking TBs %p [" TARGET_FMT_lx
 -                           "] index %d -> %p [" TARGET_FMT_lx "]\n",
 -                           tb->tc.ptr, tb->pc, n,
 -                           tb_next->tc.ptr, tb_next->pc);
 +    qemu_log_mask(CPU_LOG_EXEC, "Linking TBs %p index %d -> %p\n",
 +                  tb->tc.ptr, n, tb_next->tc.ptr);
      return;
   out_unlock_next:
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
  }
  static inline void cpu_loop_exec_tb(CPUState *cpu, TranslationBlock *tb,
 +                                    target_ulong pc,
                                      TranslationBlock **last_tb, int *tb_exit)
  {
      int32_t insns_left;
 -    trace_exec_tb(tb, tb->pc);
 +    trace_exec_tb(tb, pc);
      tb = cpu_tb_exec(cpu, tb, tb_exit);
      if (*tb_exit != TB_EXIT_REQUESTED) {
          *last_tb = tb;
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
                  tb_add_jump(last_tb, tb_exit, tb);
              }
 -            cpu_loop_exec_tb(cpu, tb, &last_tb, &tb_exit);
 +            cpu_loop_exec_tb(cpu, tb, pc, &last_tb, &tb_exit);
              /* Try to align the host and virtual clocks
                 if the guest is in advance */
 diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translate-all.c
 +++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ static int encode_search(TranslationBlock *tb, uint8_t *block)
          for (j = 0; j < TARGET_INSN_START_WORDS; ++j) {
              if (i == 0) {
 -                prev = (j == 0 ? tb->pc : 0);
 +                prev = (j == 0 ? tb_pc(tb) : 0);
              } else {
                  prev = tcg_ctx->gen_insn_data[i - 1][j];
              }
@@ -XXX,XX +XXX,XX @@ static int encode_search(TranslationBlock *tb, uint8_t *block)
  static int cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
                                       uintptr_t searched_pc, bool reset_icount)
  {
 -    target_ulong data[TARGET_INSN_START_WORDS] = { tb->pc };
 +    target_ulong data[TARGET_INSN_START_WORDS] = { tb_pc(tb) };
      uintptr_t host_pc = (uintptr_t)tb->tc.ptr;
      CPUArchState *env = cpu->env_ptr;
      const uint8_t *p = tb->tc.ptr + tb->tc.size;
@@ -XXX,XX +XXX,XX @@ static bool tb_cmp(const void *ap, const void *bp)
      const TranslationBlock *a = ap;
      const TranslationBlock *b = bp;
 -    return a->pc == b->pc &&
 +    return tb_pc(a) == tb_pc(b) &&
          a->cs_base == b->cs_base &&
          a->flags == b->flags &&
          (tb_cflags(a) & ~CF_INVALID) == (tb_cflags(b) & ~CF_INVALID) &&
@@ -XXX,XX +XXX,XX @@ static void do_tb_invalidate_check(void *p, uint32_t hash, void *userp)
      TranslationBlock *tb = p;
      target_ulong addr = *(target_ulong *)userp;
 -    if (!(addr + TARGET_PAGE_SIZE <= tb->pc || addr >= tb->pc + tb->size)) {
 +    if (!(addr + TARGET_PAGE_SIZE <= tb_pc(tb) ||
 +          addr >= tb_pc(tb) + tb->size)) {
          printf("ERROR invalidate: address=" TARGET_FMT_lx
 -               " PC=%08lx size=%04x\n", addr, (long)tb->pc, tb->size);
 +               " PC=%08lx size=%04x\n", addr, (long)tb_pc(tb), tb->size);
      }
  }
@@ -XXX,XX +XXX,XX @@ static void do_tb_page_check(void *p, uint32_t hash, void *userp)
      TranslationBlock *tb = p;
      int flags1, flags2;
 -    flags1 = page_get_flags(tb->pc);
 -    flags2 = page_get_flags(tb->pc + tb->size - 1);
 +    flags1 = page_get_flags(tb_pc(tb));
 +    flags2 = page_get_flags(tb_pc(tb) + tb->size - 1);
      if ((flags1 & PAGE_WRITE) || (flags2 & PAGE_WRITE)) {
          printf("ERROR page flags: PC=%08lx size=%04x f1=%x f2=%x\n",
 -               (long)tb->pc, tb->size, flags1, flags2);
 +               (long)tb_pc(tb), tb->size, flags1, flags2);
      }
  }
@@ -XXX,XX +XXX,XX @@ static void do_tb_phys_invalidate(TranslationBlock *tb, bool rm_from_page_list)
      /* remove the TB from the hash list */
      phys_pc = tb->page_addr[0];
 -    h = tb_hash_func(phys_pc, tb->pc, tb->flags, orig_cflags,
 +    h = tb_hash_func(phys_pc, tb_pc(tb), tb->flags, orig_cflags,
                       tb->trace_vcpu_dstate);
      if (!qht_remove(&tb_ctx.htable, tb, h)) {
          return;
@@ -XXX,XX +XXX,XX @@ tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
      }
      /* add in the hash table */
 -    h = tb_hash_func(phys_pc, tb->pc, tb->flags, tb->cflags,
 +    h = tb_hash_func(phys_pc, tb_pc(tb), tb->flags, tb->cflags,
                       tb->trace_vcpu_dstate);
      qht_insert(&tb_ctx.htable, tb, h, &existing_tb);
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
      tcg_ctx->cpu = NULL;
      max_insns = tb->icount;
 -    trace_translate_block(tb, tb->pc, tb->tc.ptr);
 +    trace_translate_block(tb, pc, tb->tc.ptr);
      /* generate machine code */
      tb->jmp_reset_offset[0] = TB_JMP_RESET_OFFSET_INVALID;
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
      ti = profile_getclock();
  #endif
 -    gen_code_size = tcg_gen_code(tcg_ctx, tb);
 +    gen_code_size = tcg_gen_code(tcg_ctx, tb, pc);
      if (unlikely(gen_code_size < 0)) {
   error_return:
          switch (gen_code_size) {
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
  #ifdef DEBUG_DISAS
      if (qemu_loglevel_mask(CPU_LOG_TB_OUT_ASM) &&
 -        qemu_log_in_addr_range(tb->pc)) {
 +        qemu_log_in_addr_range(pc)) {
          FILE *logfile = qemu_log_trylock();
          if (logfile) {
              int code_size, data_size;
@@ -XXX,XX +XXX,XX @@ void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr)
       */
      cpu->cflags_next_tb = curr_cflags(cpu) | CF_MEMI_ONLY | CF_LAST_IO | n;
 -    qemu_log_mask_and_addr(CPU_LOG_EXEC, tb->pc,
 -                           "cpu_io_recompile: rewound execution of TB to "
 -                           TARGET_FMT_lx "\n", tb->pc);
 +    if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
 +        target_ulong pc = log_pc(cpu, tb);
 +        if (qemu_log_in_addr_range(pc)) {
 +            qemu_log("cpu_io_recompile: rewound execution of TB to "
 +                     TARGET_FMT_lx "\n", pc);
 +        }
 +    }
      cpu_loop_exit_noexc(cpu);
  }
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_synchronize_from_tb(CPUState *cs,
       * never possible for an AArch64 TB to chain to an AArch32 TB.
       */
      if (is_a64(env)) {
 -        env->pc = tb->pc;
 +        env->pc = tb_pc(tb);
      } else {
-         TCGv_i32 t0 = tcg_temp_new_i32();
+-        env->regs[15] = tb->pc;
++        env->regs[15] = tb_pc(tb);
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_bswap16_i32(TCGv_i32 ret, TCGv_i32 arg)
+     }
- void tcg_gen_bswap32_i32(TCGv_i32 ret, TCGv_i32 arg)
+ }
- {
+ #endif /* CONFIG_TCG */
-     if (TCG_TARGET_HAS_bswap32_i32) {
+diff --git a/target/avr/cpu.c b/target/avr/cpu.c
--        tcg_gen_op2_i32(INDEX_op_bswap32_i32, ret, arg);
+index XXXXXXX..XXXXXXX 100644
-+        tcg_gen_op3i_i32(INDEX_op_bswap32_i32, ret, arg, 0);
+--- a/target/avr/cpu.c
 +++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_synchronize_from_tb(CPUState *cs,
      AVRCPU *cpu = AVR_CPU(cs);
      CPUAVRState *env = &cpu->env;
 -    env->pc_w = tb->pc / 2; /* internally PC points to words */
 +    env->pc_w = tb_pc(tb) / 2; /* internally PC points to words */
  }
  static void avr_cpu_reset(DeviceState *ds)
 diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hexagon/cpu.c
 +++ b/target/hexagon/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hexagon_cpu_synchronize_from_tb(CPUState *cs,
  {
      HexagonCPU *cpu = HEXAGON_CPU(cs);
      CPUHexagonState *env = &cpu->env;
 -    env->gpr[HEX_REG_PC] = tb->pc;
 +    env->gpr[HEX_REG_PC] = tb_pc(tb);
  }
  static bool hexagon_cpu_has_work(CPUState *cs)
 diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hppa/cpu.c
 +++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_synchronize_from_tb(CPUState *cs,
      HPPACPU *cpu = HPPA_CPU(cs);
  #ifdef CONFIG_USER_ONLY
 -    cpu->env.iaoq_f = tb->pc;
 +    cpu->env.iaoq_f = tb_pc(tb);
      cpu->env.iaoq_b = tb->cs_base;
  #else
      /* Recover the IAOQ values from the GVA + PRIV.  */
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_synchronize_from_tb(CPUState *cs,
      int32_t diff = cs_base;
      cpu->env.iasq_f = iasq_f;
 -    cpu->env.iaoq_f = (tb->pc & ~iasq_f) + priv;
 +    cpu->env.iaoq_f = (tb_pc(tb) & ~iasq_f) + priv;
      if (diff) {
          cpu->env.iaoq_b = cpu->env.iaoq_f + diff;
      }
 diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/tcg-cpu.c
 +++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void x86_cpu_synchronize_from_tb(CPUState *cs,
  {
      X86CPU *cpu = X86_CPU(cs);
 -    cpu->env.eip = tb->pc - tb->cs_base;
 +    cpu->env.eip = tb_pc(tb) - tb->cs_base;
  }
  #ifndef CONFIG_USER_ONLY
 diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/loongarch/cpu.c
 +++ b/target/loongarch/cpu.c
@@ -XXX,XX +XXX,XX @@ static void loongarch_cpu_synchronize_from_tb(CPUState *cs,
      LoongArchCPU *cpu = LOONGARCH_CPU(cs);
      CPULoongArchState *env = &cpu->env;
 -    env->pc = tb->pc;
 +    env->pc = tb_pc(tb);
  }
  #endif /* CONFIG_TCG */
 diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/microblaze/cpu.c
 +++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_synchronize_from_tb(CPUState *cs,
  {
      MicroBlazeCPU *cpu = MICROBLAZE_CPU(cs);
 -    cpu->env.pc = tb->pc;
 +    cpu->env.pc = tb_pc(tb);
      cpu->env.iflags = tb->flags & IFLAGS_TB_MASK;
  }
 diff --git a/target/mips/tcg/exception.c b/target/mips/tcg/exception.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/tcg/exception.c
 +++ b/target/mips/tcg/exception.c
@@ -XXX,XX +XXX,XX @@ void mips_cpu_synchronize_from_tb(CPUState *cs, const TranslationBlock *tb)
      MIPSCPU *cpu = MIPS_CPU(cs);
      CPUMIPSState *env = &cpu->env;
 -    env->active_tc.PC = tb->pc;
 +    env->active_tc.PC = tb_pc(tb);
      env->hflags &= ~MIPS_HFLAG_BMASK;
      env->hflags |= tb->flags & MIPS_HFLAG_BMASK;
  }
 diff --git a/target/mips/tcg/sysemu/special_helper.c b/target/mips/tcg/sysemu/special_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/tcg/sysemu/special_helper.c
 +++ b/target/mips/tcg/sysemu/special_helper.c
@@ -XXX,XX +XXX,XX @@ bool mips_io_recompile_replay_branch(CPUState *cs, const TranslationBlock *tb)
      CPUMIPSState *env = &cpu->env;
      if ((env->hflags & MIPS_HFLAG_BMASK) != 0
 -        && env->active_tc.PC != tb->pc) {
 +        && env->active_tc.PC != tb_pc(tb)) {
          env->active_tc.PC -= (env->hflags & MIPS_HFLAG_B16 ? 2 : 4);
          env->hflags &= ~MIPS_HFLAG_BMASK;
          return true;
 diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/openrisc/cpu.c
 +++ b/target/openrisc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_synchronize_from_tb(CPUState *cs,
  {
      OpenRISCCPU *cpu = OPENRISC_CPU(cs);
 -    cpu->env.pc = tb->pc;
 +    cpu->env.pc = tb_pc(tb);
  }
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_synchronize_from_tb(CPUState *cs,
      RISCVMXL xl = FIELD_EX32(tb->flags, TB_FLAGS, XL);
      if (xl == MXL_RV32) {
 -        env->pc = (int32_t)tb->pc;
 +        env->pc = (int32_t)tb_pc(tb);
      } else {
-         TCGv_i32 t0 = tcg_temp_new_i32();
+-        env->pc = tb->pc;
-         TCGv_i32 t1 = tcg_temp_new_i32();
++        env->pc = tb_pc(tb);
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_bswap16_i64(TCGv_i64 ret, TCGv_i64 arg)
+     }
-         tcg_gen_bswap16_i32(TCGV_LOW(ret), TCGV_LOW(arg));
+ }
-         tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
-     } else if (TCG_TARGET_HAS_bswap16_i64) {
+diff --git a/target/rx/cpu.c b/target/rx/cpu.c
--        tcg_gen_op2_i64(INDEX_op_bswap16_i64, ret, arg);
+index XXXXXXX..XXXXXXX 100644
-+        tcg_gen_op3i_i64(INDEX_op_bswap16_i64, ret, arg,
+--- a/target/rx/cpu.c
-+                         TCG_BSWAP_IZ | TCG_BSWAP_OZ);
++++ b/target/rx/cpu.c
-     } else {
+@@ -XXX,XX +XXX,XX @@ static void rx_cpu_synchronize_from_tb(CPUState *cs,
-         TCGv_i64 t0 = tcg_temp_new_i64();
+ {
+     RXCPU *cpu = RX_CPU(cs);
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_bswap32_i64(TCGv_i64 ret, TCGv_i64 arg)
-         tcg_gen_bswap32_i32(TCGV_LOW(ret), TCGV_LOW(arg));
+-    cpu->env.pc = tb->pc;
-         tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
++    cpu->env.pc = tb_pc(tb);
-     } else if (TCG_TARGET_HAS_bswap32_i64) {
+ }
--        tcg_gen_op2_i64(INDEX_op_bswap32_i64, ret, arg);
-+        tcg_gen_op3i_i64(INDEX_op_bswap32_i64, ret, arg,
+ static bool rx_cpu_has_work(CPUState *cs)
-+                         TCG_BSWAP_IZ | TCG_BSWAP_OZ);
+diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
-     } else {
+index XXXXXXX..XXXXXXX 100644
-         TCGv_i64 t0 = tcg_temp_new_i64();
+--- a/target/sh4/cpu.c
-         TCGv_i64 t1 = tcg_temp_new_i64();
++++ b/target/sh4/cpu.c
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_bswap64_i64(TCGv_i64 ret, TCGv_i64 arg)
+@@ -XXX,XX +XXX,XX @@ static void superh_cpu_synchronize_from_tb(CPUState *cs,
-         tcg_temp_free_i32(t0);
+ {
-         tcg_temp_free_i32(t1);
+     SuperHCPU *cpu = SUPERH_CPU(cs);
-     } else if (TCG_TARGET_HAS_bswap64_i64) {
--        tcg_gen_op2_i64(INDEX_op_bswap64_i64, ret, arg);
+-    cpu->env.pc = tb->pc;
-+        tcg_gen_op3i_i64(INDEX_op_bswap64_i64, ret, arg, 0);
++    cpu->env.pc = tb_pc(tb);
-     } else {
+     cpu->env.flags = tb->flags & TB_FLAG_ENVFLAGS_MASK;
-         TCGv_i64 t0 = tcg_temp_new_i64();
+ }
-         TCGv_i64 t1 = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static bool superh_io_recompile_replay_branch(CPUState *cs,
      CPUSH4State *env = &cpu->env;
      if ((env->flags & ((DELAY_SLOT | DELAY_SLOT_CONDITIONAL))) != 0
 -        && env->pc != tb->pc) {
 +        && env->pc != tb_pc(tb)) {
          env->pc -= 2;
          env->flags &= ~(DELAY_SLOT | DELAY_SLOT_CONDITIONAL);
          return true;
 diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sparc/cpu.c
 +++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_synchronize_from_tb(CPUState *cs,
  {
      SPARCCPU *cpu = SPARC_CPU(cs);
 -    cpu->env.pc = tb->pc;
 +    cpu->env.pc = tb_pc(tb);
      cpu->env.npc = tb->cs_base;
  }
 diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tricore/cpu.c
 +++ b/target/tricore/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_synchronize_from_tb(CPUState *cs,
      TriCoreCPU *cpu = TRICORE_CPU(cs);
      CPUTriCoreState *env = &cpu->env;
 -    env->PC = tb->pc;
 +    env->PC = tb_pc(tb);
  }
  static void tricore_cpu_reset(DeviceState *dev)
 diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg.c
 +++ b/tcg/tcg.c
-@@ -XXX,XX +XXX,XX @@ static const char * const alignment_name[(MO_AMASK >> MO_ASHIFT) + 1] = {
+@@ -XXX,XX +XXX,XX @@ int64_t tcg_cpu_exec_time(void)
-     [MO_ALIGN_64 >> MO_ASHIFT] = "al64+",
+ #endif
- };
-+static const char bswap_flag_name[][6] = {
+-int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
-+    [TCG_BSWAP_IZ] = "iz",
++int tcg_gen_code(TCGContext *s, TranslationBlock *tb, target_ulong pc_start)
-+    [TCG_BSWAP_OZ] = "oz",
+ {
-+    [TCG_BSWAP_OS] = "os",
+ #ifdef CONFIG_PROFILER
-+    [TCG_BSWAP_IZ | TCG_BSWAP_OZ] = "iz,oz",
+     TCGProfile *prof = &s->prof;
-+    [TCG_BSWAP_IZ | TCG_BSWAP_OS] = "iz,os",
+@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
-+};
-+
+ #ifdef DEBUG_DISAS
- static inline bool tcg_regset_single(TCGRegSet d)
+     if (unlikely(qemu_loglevel_mask(CPU_LOG_TB_OP)
- {
+-                 && qemu_log_in_addr_range(tb->pc))) {
-     return (d & (d - 1)) == 0;
++                 && qemu_log_in_addr_range(pc_start))) {
-@@ -XXX,XX +XXX,XX @@ static void tcg_dump_ops(TCGContext *s, bool have_prefs)
+         FILE *logfile = qemu_log_trylock();
-                     i = 1;
+         if (logfile) {
-                 }
+             fprintf(logfile, "OP:\n");
-                 break;
+@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
-+            case INDEX_op_bswap16_i32:
+     if (s->nb_indirects > 0) {
-+            case INDEX_op_bswap16_i64:
+ #ifdef DEBUG_DISAS
-+            case INDEX_op_bswap32_i32:
+         if (unlikely(qemu_loglevel_mask(CPU_LOG_TB_OP_IND)
-+            case INDEX_op_bswap32_i64:
+-                     && qemu_log_in_addr_range(tb->pc))) {
-+            case INDEX_op_bswap64_i64:
++                     && qemu_log_in_addr_range(pc_start))) {
-+                {
+             FILE *logfile = qemu_log_trylock();
-+                    TCGArg flags = op->args[k];
+             if (logfile) {
-+                    const char *name = NULL;
+                 fprintf(logfile, "OP before indirect lowering:\n");
-+
+@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
-+                    if (flags < ARRAY_SIZE(bswap_flag_name)) {
-+                        name = bswap_flag_name[flags];
+ #ifdef DEBUG_DISAS
-+                    }
+     if (unlikely(qemu_loglevel_mask(CPU_LOG_TB_OP_OPT)
-+                    if (name) {
+-                 && qemu_log_in_addr_range(tb->pc))) {
-+                        col += qemu_log(",%s", name);
++                 && qemu_log_in_addr_range(pc_start))) {
-+                    } else {
+         FILE *logfile = qemu_log_trylock();
-+                        col += qemu_log(",$0x%" TCG_PRIlx, flags);
+         if (logfile) {
-+                    }
+             fprintf(logfile, "OP after optimization and liveness analysis:\n");
 +                    i = k = 1;
 +                }
 +                break;
              default:
                  i = 0;
                  break;
 diff --git a/tcg/README b/tcg/README
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/README
 +++ b/tcg/README
@@ -XXX,XX +XXX,XX @@ ext32u_i64 t0, t1
 , 16 or 32 bit sign/zero extension (both operands must have the same type)
 -* bswap16_i32/i64 t0, t1
 +* bswap16_i32/i64 t0, t1, flags
 -16 bit byte swap on a 32/64 bit value. It assumes that the two/six high order
 -bytes are set to zero.
 +16 bit byte swap on the low bits of a 32/64 bit input.
 +If flags & TCG_BSWAP_IZ, then t1 is known to be zero-extended from bit 15.
 +If flags & TCG_BSWAP_OZ, then t0 will be zero-extended from bit 15.
 +If flags & TCG_BSWAP_OS, then t0 will be sign-extended from bit 15.
 +If neither TCG_BSWAP_OZ nor TCG_BSWAP_OS are set, then the bits of
 +t0 above bit 15 may contain any value.
 -* bswap32_i32/i64 t0, t1
 +* bswap32_i64 t0, t1, flags
 -32 bit byte swap on a 32/64 bit value. With a 64 bit value, it assumes that
 -the four high order bytes are set to zero.
 +32 bit byte swap on a 64-bit value.  The flags are the same as for bswap16,
 +except they apply from bit 31 instead of bit 15.
 -* bswap64_i64 t0, t1
 +* bswap32_i32 t0, t1, flags
 +* bswap64_i64 t0, t1, flags
 -64 bit byte swap
 +32/64 bit byte swap.  The flags are ignored, but still present
 +for consistency with the other bswap opcodes.
  * discard_i32/i64 t0
 --
-.25.1
+.34.1

-[PULL 12/63] target/avr: Convert to TranslatorOps
+[PULL 18/20] accel/tcg: Introduce TARGET_TB_PCREL
-Tested-by: Michael Rolnik <mrolnik@gmail.com>
+Prepare for targets to be able to produce TBs that can
-Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
+run in more than one virtual context.
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/avr/translate.c | 234 ++++++++++++++++++++++-------------------
+ accel/tcg/internal.h      |  4 +++
-file changed, 128 insertions(+), 106 deletions(-)
+ accel/tcg/tb-jmp-cache.h  | 41 +++++++++++++++++++++++++
  include/exec/cpu-defs.h   |  3 ++
  include/exec/exec-all.h   | 32 ++++++++++++++++++--
  accel/tcg/cpu-exec.c      | 16 ++++++----
  accel/tcg/translate-all.c | 64 ++++++++++++++++++++++++++-------------
 files changed, 131 insertions(+), 29 deletions(-)
-diff --git a/target/avr/translate.c b/target/avr/translate.c
+diff --git a/accel/tcg/internal.h b/accel/tcg/internal.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/avr/translate.c
+--- a/accel/tcg/internal.h
-+++ b/target/avr/translate.c
++++ b/accel/tcg/internal.h
-@@ -XXX,XX +XXX,XX @@ static bool canonicalize_skip(DisasContext *ctx)
+@@ -XXX,XX +XXX,XX @@ void tb_htable_init(void);
-     return true;
+ /* Return the current PC from CPU, which may be cached in TB. */
- }
+ static inline target_ulong log_pc(CPUState *cpu, const TranslationBlock *tb)
+ {
--void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
++#if TARGET_TB_PCREL
-+static void gen_breakpoint(DisasContext *ctx)
++    return cpu->cc->get_pc(cpu);
- {
++#else
-+    canonicalize_skip(ctx);
+     return tb_pc(tb);
-+    tcg_gen_movi_tl(cpu_pc, ctx->npc);
++#endif
-+    gen_helper_debug(cpu_env);
+ }
-+    ctx->base.is_jmp = DISAS_NORETURN;
  #endif /* ACCEL_TCG_INTERNAL_H */
 diff --git a/accel/tcg/tb-jmp-cache.h b/accel/tcg/tb-jmp-cache.h
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/tb-jmp-cache.h
 +++ b/accel/tcg/tb-jmp-cache.h
@@ -XXX,XX +XXX,XX @@
  /*
   * Accessed in parallel; all accesses to 'tb' must be atomic.
 + * For TARGET_TB_PCREL, accesses to 'pc' must be protected by
 + * a load_acquire/store_release to 'tb'.
   */
  struct CPUJumpCache {
      struct {
          TranslationBlock *tb;
 +#if TARGET_TB_PCREL
 +        target_ulong pc;
 +#endif
      } array[TB_JMP_CACHE_SIZE];
  };
 +static inline TranslationBlock *
 +tb_jmp_cache_get_tb(CPUJumpCache *jc, uint32_t hash)
 +{
 +#if TARGET_TB_PCREL
 +    /* Use acquire to ensure current load of pc from jc. */
 +    return qatomic_load_acquire(&jc->array[hash].tb);
 +#else
 +    /* Use rcu_read to ensure current load of pc from *tb. */
 +    return qatomic_rcu_read(&jc->array[hash].tb);
 +#endif
 +}
 +
-+static void avr_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
++static inline target_ulong
 +tb_jmp_cache_get_pc(CPUJumpCache *jc, uint32_t hash, TranslationBlock *tb)
 +{
-+    DisasContext *ctx = container_of(dcbase, DisasContext, base);
++#if TARGET_TB_PCREL
-     CPUAVRState *env = cs->env_ptr;
++    return jc->array[hash].pc;
--    DisasContext ctx1 = {
++#else
--        .base.tb = tb,
++    return tb_pc(tb);
--        .base.is_jmp = DISAS_NEXT,
++#endif
--        .base.pc_first = tb->pc,
++}
--        .base.pc_next = tb->pc,
++
--        .base.singlestep_enabled = cs->singlestep_enabled,
++static inline void
--        .cs = cs,
++tb_jmp_cache_set(CPUJumpCache *jc, uint32_t hash,
--        .env = env,
++                 TranslationBlock *tb, target_ulong pc)
--        .memidx = 0,
++{
--        .skip_cond = TCG_COND_NEVER,
++#if TARGET_TB_PCREL
--    };
++    jc->array[hash].pc = pc;
--    DisasContext *ctx = &ctx1;
++    /* Use store_release on tb to ensure pc is written first. */
--    target_ulong pc_start = tb->pc / 2;
++    qatomic_store_release(&jc->array[hash].tb, tb);
--    int num_insns = 0;
++#else
-+    uint32_t tb_flags = ctx->base.tb->flags;
++    /* Use the pc value already stored in tb->pc. */
++    qatomic_set(&jc->array[hash].tb, tb);
--    if (tb->flags & TB_FLAGS_FULL_ACCESS) {
++#endif
--        /*
++}
--         * This flag is set by ST/LD instruction we will regenerate it ONLY
++
--         * with mem/cpu memory access instead of mem access
+ #endif /* ACCEL_TCG_TB_JMP_CACHE_H */
--         */
+diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
--        max_insns = 1;
+index XXXXXXX..XXXXXXX 100644
--    }
+--- a/include/exec/cpu-defs.h
--    if (ctx->base.singlestep_enabled) {
++++ b/include/exec/cpu-defs.h
--        max_insns = 1;
+@@ -XXX,XX +XXX,XX @@
--    }
+ #  error TARGET_PAGE_BITS must be defined in cpu-param.h
-+    ctx->cs = cs;
+ # endif
-+    ctx->env = env;
+ #endif
-+    ctx->npc = ctx->base.pc_first / 2;
++#ifndef TARGET_TB_PCREL
++# define TARGET_TB_PCREL 0
--    gen_tb_start(tb);
++#endif
--
--    ctx->npc = pc_start;
+ #define TARGET_LONG_SIZE (TARGET_LONG_BITS / 8)
--    if (tb->flags & TB_FLAGS_SKIP) {
-+    ctx->skip_cond = TCG_COND_NEVER;
+diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
-+    if (tb_flags & TB_FLAGS_SKIP) {
+index XXXXXXX..XXXXXXX 100644
-         ctx->skip_cond = TCG_COND_ALWAYS;
+--- a/include/exec/exec-all.h
-         ctx->skip_var0 = cpu_skip;
++++ b/include/exec/exec-all.h
-     }
+@@ -XXX,XX +XXX,XX @@ struct tb_tc {
+ };
--    do {
--        TCGLabel *skip_label = NULL;
+ struct TranslationBlock {
--
+-    target_ulong pc;   /* simulated PC corresponding to this block (EIP + CS base) */
--        /* translate current instruction */
+-    target_ulong cs_base; /* CS base for this block */
--        tcg_gen_insn_start(ctx->npc);
++#if !TARGET_TB_PCREL
--        num_insns++;
++    /*
--
++     * Guest PC corresponding to this block.  This must be the true
-+    if (tb_flags & TB_FLAGS_FULL_ACCESS) {
++     * virtual address.  Therefore e.g. x86 stores EIP + CS_BASE, and
-         /*
++     * targets like Arm, MIPS, HP-PA, which reuse low bits for ISA or
--         * this is due to some strange GDB behavior
++     * privilege, must store those bits elsewhere.
--         * let's assume main has address 0x100
++     *
--         * b main   - sets breakpoint at address 0x00000100 (code)
++     * If TARGET_TB_PCREL, the opcodes for the TranslationBlock are
--         * b *0x100 - sets breakpoint at address 0x00800100 (data)
++     * written such that the TB is associated only with the physical
-+         * This flag is set by ST/LD instruction we will regenerate it ONLY
++     * page and may be run in any virtual address context.  In this case,
-+         * with mem/cpu memory access instead of mem access
++     * PC must always be taken from ENV in a target-specific manner.
-          */
++     * Unwind information is taken as offsets from the page, to be
--        if (unlikely(!ctx->base.singlestep_enabled &&
++     * deposited into the "current" PC.
--            (cpu_breakpoint_test(cs, OFFSET_CODE + ctx->npc * 2, BP_ANY) ||
++     */
--             cpu_breakpoint_test(cs, OFFSET_DATA + ctx->npc * 2, BP_ANY)))) {
++    target_ulong pc;
--            canonicalize_skip(ctx);
++#endif
--            tcg_gen_movi_tl(cpu_pc, ctx->npc);
++
--            gen_helper_debug(cpu_env);
++    /*
--            goto done_generating;
++     * Target-specific data associated with the TranslationBlock, e.g.:
--        }
++     * x86: the original user, the Code Segment virtual base,
-+        ctx->base.max_insns = 1;
++     * arm: an extension of tb->flags,
 +     * s390x: instruction data for EXECUTE,
 +     * sparc: the next pc of the instruction queue (for delay slots).
 +     */
 +    target_ulong cs_base;
 +
      uint32_t flags; /* flags defining in which context the code was generated */
      uint32_t cflags;    /* compile flags */
@@ -XXX,XX +XXX,XX @@ struct TranslationBlock {
  /* Hide the read to avoid ifdefs for TARGET_TB_PCREL. */
  static inline target_ulong tb_pc(const TranslationBlock *tb)
  {
 +#if TARGET_TB_PCREL
 +    qemu_build_not_reached();
 +#else
      return tb->pc;
 +#endif
  }
  /* Hide the qatomic_read to make code a little easier on the eyes */
 diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cpu-exec.c
 +++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static bool tb_lookup_cmp(const void *p, const void *d)
      const TranslationBlock *tb = p;
      const struct tb_desc *desc = d;
 -    if (tb_pc(tb) == desc->pc &&
 +    if ((TARGET_TB_PCREL || tb_pc(tb) == desc->pc) &&
          tb->page_addr[0] == desc->page_addr0 &&
          tb->cs_base == desc->cs_base &&
          tb->flags == desc->flags &&
@@ -XXX,XX +XXX,XX @@ static TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
          return NULL;
      }
      desc.page_addr0 = phys_pc;
 -    h = tb_hash_func(phys_pc, pc, flags, cflags, *cpu->trace_dstate);
 +    h = tb_hash_func(phys_pc, (TARGET_TB_PCREL ? 0 : pc),
 +                     flags, cflags, *cpu->trace_dstate);
      return qht_lookup_custom(&tb_ctx.htable, &desc, h, tb_lookup_cmp);
  }
@@ -XXX,XX +XXX,XX @@ static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
                                            uint32_t flags, uint32_t cflags)
  {
      TranslationBlock *tb;
 +    CPUJumpCache *jc;
      uint32_t hash;
      /* we should never be trying to look up an INVALID tb */
      tcg_debug_assert(!(cflags & CF_INVALID));
      hash = tb_jmp_cache_hash_func(pc);
 -    tb = qatomic_rcu_read(&cpu->tb_jmp_cache->array[hash].tb);
 +    jc = cpu->tb_jmp_cache;
 +    tb = tb_jmp_cache_get_tb(jc, hash);
      if (likely(tb &&
 -               tb->pc == pc &&
 +               tb_jmp_cache_get_pc(jc, hash, tb) == pc &&
                 tb->cs_base == cs_base &&
                 tb->flags == flags &&
                 tb->trace_vcpu_dstate == *cpu->trace_dstate &&
@@ -XXX,XX +XXX,XX @@ static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
      if (tb == NULL) {
          return NULL;
      }
 -    qatomic_set(&cpu->tb_jmp_cache->array[hash].tb, tb);
 +    tb_jmp_cache_set(jc, hash, tb, pc);
      return tb;
  }
@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
          if (cc->tcg_ops->synchronize_from_tb) {
              cc->tcg_ops->synchronize_from_tb(cpu, last_tb);
          } else {
 +            assert(!TARGET_TB_PCREL);
              assert(cc->set_pc);
              cc->set_pc(cpu, tb_pc(last_tb));
          }
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
                   * for the fast lookup
                   */
                  h = tb_jmp_cache_hash_func(pc);
 -                qatomic_set(&cpu->tb_jmp_cache->array[h].tb, tb);
 +                tb_jmp_cache_set(cpu->tb_jmp_cache, h, tb, pc);
              }
  #ifndef CONFIG_USER_ONLY
 diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translate-all.c
 +++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ static int encode_search(TranslationBlock *tb, uint8_t *block)
          for (j = 0; j < TARGET_INSN_START_WORDS; ++j) {
              if (i == 0) {
 -                prev = (j == 0 ? tb_pc(tb) : 0);
 +                prev = (!TARGET_TB_PCREL && j == 0 ? tb_pc(tb) : 0);
              } else {
                  prev = tcg_ctx->gen_insn_data[i - 1][j];
              }
@@ -XXX,XX +XXX,XX @@ static int encode_search(TranslationBlock *tb, uint8_t *block)
  static int cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
                                       uintptr_t searched_pc, bool reset_icount)
  {
 -    target_ulong data[TARGET_INSN_START_WORDS] = { tb_pc(tb) };
 +    target_ulong data[TARGET_INSN_START_WORDS];
      uintptr_t host_pc = (uintptr_t)tb->tc.ptr;
      CPUArchState *env = cpu->env_ptr;
      const uint8_t *p = tb->tc.ptr + tb->tc.size;
@@ -XXX,XX +XXX,XX @@ static int cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
          return -1;
      }
 +    memset(data, 0, sizeof(data));
 +    if (!TARGET_TB_PCREL) {
 +        data[0] = tb_pc(tb);
 +    }
-+}
++
+     /* Reconstruct the stored insn data while looking for the point at
--        /* Conditionally skip the next instruction, if indicated.  */
+        which the end of the insn exceeds the searched_pc.  */
--        if (ctx->skip_cond != TCG_COND_NEVER) {
+     for (i = 0; i < num_insns; ++i) {
--            skip_label = gen_new_label();
+@@ -XXX,XX +XXX,XX @@ static bool tb_cmp(const void *ap, const void *bp)
--            if (ctx->skip_var0 == cpu_skip) {
+     const TranslationBlock *a = ap;
--                /*
+     const TranslationBlock *b = bp;
--                 * Copy cpu_skip so that we may zero it before the branch.
--                 * This ensures that cpu_skip is non-zero after the label
+-    return tb_pc(a) == tb_pc(b) &&
--                 * if and only if the skipped insn itself sets a skip.
+-        a->cs_base == b->cs_base &&
--                 */
+-        a->flags == b->flags &&
--                ctx->free_skip_var0 = true;
+-        (tb_cflags(a) & ~CF_INVALID) == (tb_cflags(b) & ~CF_INVALID) &&
--                ctx->skip_var0 = tcg_temp_new();
+-        a->trace_vcpu_dstate == b->trace_vcpu_dstate &&
--                tcg_gen_mov_tl(ctx->skip_var0, cpu_skip);
+-        a->page_addr[0] == b->page_addr[0] &&
--                tcg_gen_movi_tl(cpu_skip, 0);
+-        a->page_addr[1] == b->page_addr[1];
--            }
++    return ((TARGET_TB_PCREL || tb_pc(a) == tb_pc(b)) &&
--            if (ctx->skip_var1 == NULL) {
++            a->cs_base == b->cs_base &&
--                tcg_gen_brcondi_tl(ctx->skip_cond, ctx->skip_var0,
++            a->flags == b->flags &&
--                                   0, skip_label);
++            (tb_cflags(a) & ~CF_INVALID) == (tb_cflags(b) & ~CF_INVALID) &&
--            } else {
++            a->trace_vcpu_dstate == b->trace_vcpu_dstate &&
--                tcg_gen_brcond_tl(ctx->skip_cond, ctx->skip_var0,
++            a->page_addr[0] == b->page_addr[0] &&
--                                  ctx->skip_var1, skip_label);
++            a->page_addr[1] == b->page_addr[1]);
--                ctx->skip_var1 = NULL;
+ }
--            }
--            if (ctx->free_skip_var0) {
+ void tb_htable_init(void)
--                tcg_temp_free(ctx->skip_var0);
+@@ -XXX,XX +XXX,XX @@ static inline void tb_jmp_unlink(TranslationBlock *dest)
--                ctx->free_skip_var0 = false;
+     qemu_spin_unlock(&dest->jmp_lock);
--            }
+ }
--            ctx->skip_cond = TCG_COND_NEVER;
--            ctx->skip_var0 = NULL;
++static void tb_jmp_cache_inval_tb(TranslationBlock *tb)
 -        }
 +static void avr_tr_tb_start(DisasContextBase *db, CPUState *cs)
 +{
-+}
++    CPUState *cpu;
++
--        translate(ctx);
++    if (TARGET_TB_PCREL) {
-+static void avr_tr_insn_start(DisasContextBase *dcbase, CPUState *cs)
++        /* A TB may be at any virtual address */
-+{
++        CPU_FOREACH(cpu) {
-+    DisasContext *ctx = container_of(dcbase, DisasContext, base);
++            tcg_flush_jmp_cache(cpu);
 -        if (skip_label) {
 -            canonicalize_skip(ctx);
 -            gen_set_label(skip_label);
 -            if (ctx->base.is_jmp == DISAS_NORETURN) {
 -                ctx->base.is_jmp = DISAS_CHAIN;
 -            }
 -        }
 -    } while (ctx->base.is_jmp == DISAS_NEXT
 -             && num_insns < max_insns
 -             && (ctx->npc - pc_start) * 2 < TARGET_PAGE_SIZE - 4
 -             && !tcg_op_buf_full());
 +    tcg_gen_insn_start(ctx->npc);
 +}
 -    if (tb->cflags & CF_LAST_IO) {
 -        gen_io_end();
 +static bool avr_tr_breakpoint_check(DisasContextBase *dcbase, CPUState *cs,
 +                                    const CPUBreakpoint *bp)
 +{
 +    DisasContext *ctx = container_of(dcbase, DisasContext, base);
 +
 +    gen_breakpoint(ctx);
 +    return true;
 +}
 +
 +static void avr_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
 +{
 +    DisasContext *ctx = container_of(dcbase, DisasContext, base);
 +    TCGLabel *skip_label = NULL;
 +
 +    /*
 +     * This is due to some strange GDB behavior
 +     * Let's assume main has address 0x100:
 +     * b main   - sets breakpoint at address 0x00000100 (code)
 +     * b *0x100 - sets breakpoint at address 0x00800100 (data)
 +     *
 +     * The translator driver has already taken care of the code pointer.
 +     */
 +    if (!ctx->base.singlestep_enabled &&
 +        cpu_breakpoint_test(cs, OFFSET_DATA + ctx->base.pc_next, BP_ANY)) {
 +        gen_breakpoint(ctx);
 +        return;
      }
 +    /* Conditionally skip the next instruction, if indicated.  */
 +    if (ctx->skip_cond != TCG_COND_NEVER) {
 +        skip_label = gen_new_label();
 +        if (ctx->skip_var0 == cpu_skip) {
 +            /*
 +             * Copy cpu_skip so that we may zero it before the branch.
 +             * This ensures that cpu_skip is non-zero after the label
 +             * if and only if the skipped insn itself sets a skip.
 +             */
 +            ctx->free_skip_var0 = true;
 +            ctx->skip_var0 = tcg_temp_new();
 +            tcg_gen_mov_tl(ctx->skip_var0, cpu_skip);
 +            tcg_gen_movi_tl(cpu_skip, 0);
 +        }
-+        if (ctx->skip_var1 == NULL) {
++    } else {
-+            tcg_gen_brcondi_tl(ctx->skip_cond, ctx->skip_var0, 0, skip_label);
++        uint32_t h = tb_jmp_cache_hash_func(tb_pc(tb));
-+        } else {
++
-+            tcg_gen_brcond_tl(ctx->skip_cond, ctx->skip_var0,
++        CPU_FOREACH(cpu) {
-+                              ctx->skip_var1, skip_label);
++            CPUJumpCache *jc = cpu->tb_jmp_cache;
-+            ctx->skip_var1 = NULL;
++
-+        }
++            if (qatomic_read(&jc->array[h].tb) == tb) {
-+        if (ctx->free_skip_var0) {
++                qatomic_set(&jc->array[h].tb, NULL);
-+            tcg_temp_free(ctx->skip_var0);
++            }
 +            ctx->free_skip_var0 = false;
 +        }
 +        ctx->skip_cond = TCG_COND_NEVER;
 +        ctx->skip_var0 = NULL;
 +    }
 +
 +    translate(ctx);
 +
 +    ctx->base.pc_next = ctx->npc * 2;
 +
 +    if (skip_label) {
 +        canonicalize_skip(ctx);
 +        gen_set_label(skip_label);
 +        if (ctx->base.is_jmp == DISAS_NORETURN) {
 +            ctx->base.is_jmp = DISAS_CHAIN;
 +        }
 +    }
 +
 +    if (ctx->base.is_jmp == DISAS_NEXT) {
 +        target_ulong page_first = ctx->base.pc_first & TARGET_PAGE_MASK;
 +
 +        if ((ctx->base.pc_next - page_first) >= TARGET_PAGE_SIZE - 4) {
 +            ctx->base.is_jmp = DISAS_TOO_MANY;
 +        }
 +    }
 +}
 +
-+static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
+ /*
-+{
+  * In user-mode, call with mmap_lock held.
-+    DisasContext *ctx = container_of(dcbase, DisasContext, base);
+  * In !user-mode, if @rm_from_page_list is set, call with the TB's pages'
-     bool nonconst_skip = canonicalize_skip(ctx);
+@@ -XXX,XX +XXX,XX @@ static inline void tb_jmp_unlink(TranslationBlock *dest)
+  */
-     switch (ctx->base.is_jmp) {
+ static void do_tb_phys_invalidate(TranslationBlock *tb, bool rm_from_page_list)
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+ {
-     default:
+-    CPUState *cpu;
-         g_assert_not_reached();
+     PageDesc *p;
-     }
+     uint32_t h;
-+}
+     tb_page_addr_t phys_pc;
+@@ -XXX,XX +XXX,XX @@ static void do_tb_phys_invalidate(TranslationBlock *tb, bool rm_from_page_list)
--done_generating:
--    gen_tb_end(tb, num_insns);
+     /* remove the TB from the hash list */
-+static void avr_tr_disas_log(const DisasContextBase *dcbase, CPUState *cs)
+     phys_pc = tb->page_addr[0];
-+{
+-    h = tb_hash_func(phys_pc, tb_pc(tb), tb->flags, orig_cflags,
-+    qemu_log("IN: %s\n", lookup_symbol(dcbase->pc_first));
+-                     tb->trace_vcpu_dstate);
-+    log_target_disas(cs, dcbase->pc_first, dcbase->tb->size);
++    h = tb_hash_func(phys_pc, (TARGET_TB_PCREL ? 0 : tb_pc(tb)),
-+}
++                     tb->flags, orig_cflags, tb->trace_vcpu_dstate);
+     if (!qht_remove(&tb_ctx.htable, tb, h)) {
--    tb->size = (ctx->npc - pc_start) * 2;
+         return;
--    tb->icount = num_insns;
+     }
-+static const TranslatorOps avr_tr_ops = {
+@@ -XXX,XX +XXX,XX @@ static void do_tb_phys_invalidate(TranslationBlock *tb, bool rm_from_page_list)
-+    .init_disas_context = avr_tr_init_disas_context,
+     }
-+    .tb_start           = avr_tr_tb_start,
-+    .insn_start         = avr_tr_insn_start,
+     /* remove the TB from the hash list */
-+    .breakpoint_check   = avr_tr_breakpoint_check,
+-    h = tb_jmp_cache_hash_func(tb->pc);
-+    .translate_insn     = avr_tr_translate_insn,
+-    CPU_FOREACH(cpu) {
-+    .tb_stop            = avr_tr_tb_stop,
+-        CPUJumpCache *jc = cpu->tb_jmp_cache;
-+    .disas_log          = avr_tr_disas_log,
+-        if (qatomic_read(&jc->array[h].tb) == tb) {
-+};
+-            qatomic_set(&jc->array[h].tb, NULL);
+-        }
 -#ifdef DEBUG_DISAS
 -    if (qemu_loglevel_mask(CPU_LOG_TB_IN_ASM)
 -        && qemu_log_in_addr_range(tb->pc)) {
 -        FILE *fd;
 -        fd = qemu_log_lock();
 -        qemu_log("IN: %s\n", lookup_symbol(tb->pc));
 -        log_target_disas(cs, tb->pc, tb->size);
 -        qemu_log("\n");
 -        qemu_log_unlock(fd);
 -    }
--#endif
++    tb_jmp_cache_inval_tb(tb);
-+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-+{
+     /* suppress this TB from the two jump lists */
-+    DisasContext dc = { };
+     tb_remove_from_jmp_list(tb, 0);
-+    translator_loop(&avr_tr_ops, &dc.base, cs, tb, max_insns);
+@@ -XXX,XX +XXX,XX @@ tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
- }
+     }
- void restore_state_to_opc(CPUAVRState *env, TranslationBlock *tb,
+     /* add in the hash table */
 -    h = tb_hash_func(phys_pc, tb_pc(tb), tb->flags, tb->cflags,
 -                     tb->trace_vcpu_dstate);
 +    h = tb_hash_func(phys_pc, (TARGET_TB_PCREL ? 0 : tb_pc(tb)),
 +                     tb->flags, tb->cflags, tb->trace_vcpu_dstate);
      qht_insert(&tb_ctx.htable, tb, h, &existing_tb);
      /* remove TB from the page(s) if we couldn't insert it */
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
      gen_code_buf = tcg_ctx->code_gen_ptr;
      tb->tc.ptr = tcg_splitwx_to_rx(gen_code_buf);
 +#if !TARGET_TB_PCREL
      tb->pc = pc;
 +#endif
      tb->cs_base = cs_base;
      tb->flags = flags;
      tb->cflags = cflags;
 --
-.25.1
+.34.1

-[PULL 13/63] target/cris: Add DisasContextBase to DisasContext
+Deleted patch
-Migrate the is_jmp, tb and singlestep_enabled fields
-from DisasContext into the base.
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/cris/translate.c         | 49 +++++++++++++++++----------------
- target/cris/translate_v10.c.inc |  4 +--
-files changed, 27 insertions(+), 26 deletions(-)
-diff --git a/target/cris/translate.c b/target/cris/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/cris/translate.c
-+++ b/target/cris/translate.c
-@@ -XXX,XX +XXX,XX @@ static TCGv env_pc;
- /* This is the state at translation time.  */
- typedef struct DisasContext {
-+    DisasContextBase base;
-+
-     CRISCPU *cpu;
-     target_ulong pc, ppc;
-@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
-     int clear_locked_irq; /* Clear the irq lockout.  */
-     int cpustate_changed;
-     unsigned int tb_flags; /* tb dependent flags.  */
--    int is_jmp;
- #define JMP_NOJMP     0
- #define JMP_DIRECT    1
-@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
-     uint32_t jmp_pc;
-     int delayed_branch;
--
--    TranslationBlock *tb;
--    int singlestep_enabled;
- } DisasContext;
- static void gen_BUG(DisasContext *dc, const char *file, int line)
-@@ -XXX,XX +XXX,XX @@ static void t_gen_cc_jmp(TCGv pc_true, TCGv pc_false)
- static inline bool use_goto_tb(DisasContext *dc, target_ulong dest)
- {
- #ifndef CONFIG_USER_ONLY
--    return (dc->tb->pc & TARGET_PAGE_MASK) == (dest & TARGET_PAGE_MASK) ||
-+    return (dc->base.pc_first & TARGET_PAGE_MASK) == (dest & TARGET_PAGE_MASK) ||
-            (dc->ppc & TARGET_PAGE_MASK) == (dest & TARGET_PAGE_MASK);
- #else
-     return true;
-@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *dc, int n, target_ulong dest)
-     if (use_goto_tb(dc, dest)) {
-         tcg_gen_goto_tb(n);
-         tcg_gen_movi_tl(env_pc, dest);
--        tcg_gen_exit_tb(dc->tb, n);
-+        tcg_gen_exit_tb(dc->base.tb, n);
-     } else {
-         tcg_gen_movi_tl(env_pc, dest);
-         tcg_gen_exit_tb(NULL, 0);
-@@ -XXX,XX +XXX,XX @@ static int dec_setclrf(CPUCRISState *env, DisasContext *dc)
-     /* Break the TB if any of the SPI flag changes.  */
-     if (flags & (P_FLAG | S_FLAG)) {
-         tcg_gen_movi_tl(env_pc, dc->pc + 2);
--        dc->is_jmp = DISAS_UPDATE;
-+        dc->base.is_jmp = DISAS_UPDATE;
-         dc->cpustate_changed = 1;
-     }
-     /* For the I flag, only act on posedge.  */
-     if ((flags & I_FLAG)) {
-         tcg_gen_movi_tl(env_pc, dc->pc + 2);
--        dc->is_jmp = DISAS_UPDATE;
-+        dc->base.is_jmp = DISAS_UPDATE;
-         dc->cpustate_changed = 1;
-     }
-@@ -XXX,XX +XXX,XX @@ static int dec_rfe_etc(CPUCRISState *env, DisasContext *dc)
-         LOG_DIS("rfe\n");
-         cris_evaluate_flags(dc);
-         gen_helper_rfe(cpu_env);
--        dc->is_jmp = DISAS_UPDATE;
-+        dc->base.is_jmp = DISAS_UPDATE;
-         break;
-     case 5:
-         /* rfn.  */
-         LOG_DIS("rfn\n");
-         cris_evaluate_flags(dc);
-         gen_helper_rfn(cpu_env);
--        dc->is_jmp = DISAS_UPDATE;
-+        dc->base.is_jmp = DISAS_UPDATE;
-         break;
-     case 6:
-         LOG_DIS("break %d\n", dc->op1);
-@@ -XXX,XX +XXX,XX @@ static int dec_rfe_etc(CPUCRISState *env, DisasContext *dc)
-         /* Breaks start at 16 in the exception vector.  */
-         t_gen_movi_env_TN(trap_vector, dc->op1 + 16);
-         t_gen_raise_exception(EXCP_BREAK);
--        dc->is_jmp = DISAS_UPDATE;
-+        dc->base.is_jmp = DISAS_UPDATE;
-         break;
-     default:
-         printf("op2=%x\n", dc->op2);
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-      * delayslot, like in real hw.
-      */
-     pc_start = tb->pc & ~1;
--    dc->cpu = env_archcpu(env);
--    dc->tb = tb;
--    dc->is_jmp = DISAS_NEXT;
-+    dc->base.tb = tb;
-+    dc->base.pc_first = pc_start;
-+    dc->base.pc_next = pc_start;
-+    dc->base.is_jmp = DISAS_NEXT;
-+    dc->base.singlestep_enabled = cs->singlestep_enabled;
-+
-+    dc->cpu = env_archcpu(env);
-     dc->ppc = pc_start;
-     dc->pc = pc_start;
--    dc->singlestep_enabled = cs->singlestep_enabled;
-     dc->flags_uptodate = 1;
-     dc->flagx_known = 1;
-     dc->flags_x = tb->flags & X_FLAG;
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-             cris_evaluate_flags(dc);
-             tcg_gen_movi_tl(env_pc, dc->pc);
-             t_gen_raise_exception(EXCP_DEBUG);
--            dc->is_jmp = DISAS_UPDATE;
-+            dc->base.is_jmp = DISAS_UPDATE;
-             /* The address covered by the breakpoint must be included in
-                [tb->pc, tb->pc + tb->size) in order to for it to be
-                properly cleared -- thus we increment the PC here so that
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-                     gen_goto_tb(dc, 1, dc->jmp_pc);
-                     gen_set_label(l1);
-                     gen_goto_tb(dc, 0, dc->pc);
--                    dc->is_jmp = DISAS_TB_JUMP;
-+                    dc->base.is_jmp = DISAS_TB_JUMP;
-                     dc->jmp = JMP_NOJMP;
-                 } else if (dc->jmp == JMP_DIRECT) {
-                     cris_evaluate_flags(dc);
-                     gen_goto_tb(dc, 0, dc->jmp_pc);
--                    dc->is_jmp = DISAS_TB_JUMP;
-+                    dc->base.is_jmp = DISAS_TB_JUMP;
-                     dc->jmp = JMP_NOJMP;
-                 } else {
-                     TCGv c = tcg_const_tl(dc->pc);
-                     t_gen_cc_jmp(env_btarget, c);
-                     tcg_temp_free(c);
--                    dc->is_jmp = DISAS_JUMP;
-+                    dc->base.is_jmp = DISAS_JUMP;
-                 }
-                 break;
-             }
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-         if (!(tb->pc & 1) && cs->singlestep_enabled) {
-             break;
-         }
--    } while (!dc->is_jmp && !dc->cpustate_changed
-+    } while (!dc->base.is_jmp && !dc->cpustate_changed
-             && !tcg_op_buf_full()
-             && !singlestep
-             && (dc->pc - page_start < TARGET_PAGE_SIZE)
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-     npc = dc->pc;
-     /* Force an update if the per-tb cpu state has changed.  */
--    if (dc->is_jmp == DISAS_NEXT
-+    if (dc->base.is_jmp == DISAS_NEXT
-         && (dc->cpustate_changed || !dc->flagx_known
-         || (dc->flags_x != (tb->flags & X_FLAG)))) {
--        dc->is_jmp = DISAS_UPDATE;
-+        dc->base.is_jmp = DISAS_UPDATE;
-         tcg_gen_movi_tl(env_pc, npc);
-     }
-     /* Broken branch+delayslot sequence.  */
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-     cris_evaluate_flags(dc);
-     if (unlikely(cs->singlestep_enabled)) {
--        if (dc->is_jmp == DISAS_NEXT) {
-+        if (dc->base.is_jmp == DISAS_NEXT) {
-             tcg_gen_movi_tl(env_pc, npc);
-         }
-         t_gen_raise_exception(EXCP_DEBUG);
-     } else {
--        switch (dc->is_jmp) {
-+        switch (dc->base.is_jmp) {
-         case DISAS_NEXT:
-             gen_goto_tb(dc, 1, npc);
-             break;
-diff --git a/target/cris/translate_v10.c.inc b/target/cris/translate_v10.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/cris/translate_v10.c.inc
-+++ b/target/cris/translate_v10.c.inc
-@@ -XXX,XX +XXX,XX @@ static unsigned int dec10_ind(CPUCRISState *env, DisasContext *dc)
-                     t_gen_mov_env_TN(trap_vector, c);
-                     tcg_temp_free(c);
-                     t_gen_raise_exception(EXCP_BREAK);
--                    dc->is_jmp = DISAS_UPDATE;
-+                    dc->base.is_jmp = DISAS_UPDATE;
-                     return insn_len;
-                 }
-                 LOG_DIS("%d: jump.%d %d r%d r%d\n", __LINE__, size,
-@@ -XXX,XX +XXX,XX @@ static unsigned int crisv10_decoder(CPUCRISState *env, DisasContext *dc)
-     if (dc->clear_prefix && dc->tb_flags & PFIX_FLAG) {
-         dc->tb_flags &= ~PFIX_FLAG;
-         tcg_gen_andi_tl(cpu_PR[PR_CCS], cpu_PR[PR_CCS], ~PFIX_FLAG);
--        if (dc->tb_flags != dc->tb->flags) {
-+        if (dc->tb_flags != dc->base.tb->flags) {
-             dc->cpustate_changed = 1;
-         }
-     }
---
-.25.1

-[PULL 14/63] target/cris: Remove DISAS_SWI
+Deleted patch
-This value is unused.
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/cris/translate.c | 2 --
-file changed, 2 deletions(-)
-diff --git a/target/cris/translate.c b/target/cris/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/cris/translate.c
-+++ b/target/cris/translate.c
-@@ -XXX,XX +XXX,XX @@
- #define DISAS_JUMP    DISAS_TARGET_0 /* only pc was modified dynamically */
- #define DISAS_UPDATE  DISAS_TARGET_1 /* cpu state was modified dynamically */
- #define DISAS_TB_JUMP DISAS_TARGET_2 /* only pc was modified statically */
--#define DISAS_SWI     DISAS_TARGET_3
- /* Used by the decoder.  */
- #define EXTRACT_FIELD(src, start, end) \
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-                    to find the next TB */
-             tcg_gen_exit_tb(NULL, 0);
-             break;
--        case DISAS_SWI:
-         case DISAS_TB_JUMP:
-             /* nothing more to generate */
-             break;
---
-.25.1

-[PULL 15/63] target/cris: Replace DISAS_TB_JUMP with DISAS_NORETURN
+Deleted patch
-The only semantic of DISAS_TB_JUMP is that we've done goto_tb,
-which is the same as DISAS_NORETURN -- we've exited the tb.
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/cris/translate.c | 7 +++----
-file changed, 3 insertions(+), 4 deletions(-)
-diff --git a/target/cris/translate.c b/target/cris/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/cris/translate.c
-+++ b/target/cris/translate.c
-@@ -XXX,XX +XXX,XX @@
- /* is_jmp field values */
- #define DISAS_JUMP    DISAS_TARGET_0 /* only pc was modified dynamically */
- #define DISAS_UPDATE  DISAS_TARGET_1 /* cpu state was modified dynamically */
--#define DISAS_TB_JUMP DISAS_TARGET_2 /* only pc was modified statically */
- /* Used by the decoder.  */
- #define EXTRACT_FIELD(src, start, end) \
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-                     gen_goto_tb(dc, 1, dc->jmp_pc);
-                     gen_set_label(l1);
-                     gen_goto_tb(dc, 0, dc->pc);
--                    dc->base.is_jmp = DISAS_TB_JUMP;
-+                    dc->base.is_jmp = DISAS_NORETURN;
-                     dc->jmp = JMP_NOJMP;
-                 } else if (dc->jmp == JMP_DIRECT) {
-                     cris_evaluate_flags(dc);
-                     gen_goto_tb(dc, 0, dc->jmp_pc);
--                    dc->base.is_jmp = DISAS_TB_JUMP;
-+                    dc->base.is_jmp = DISAS_NORETURN;
-                     dc->jmp = JMP_NOJMP;
-                 } else {
-                     TCGv c = tcg_const_tl(dc->pc);
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-                    to find the next TB */
-             tcg_gen_exit_tb(NULL, 0);
-             break;
--        case DISAS_TB_JUMP:
-+        case DISAS_NORETURN:
-             /* nothing more to generate */
-             break;
-         }
---
-.25.1

-[PULL 16/63] target/cris: Mark exceptions as DISAS_NORETURN
+Deleted patch
-After we've raised the exception, we have left the TB.
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/cris/translate.c         | 5 +++--
- target/cris/translate_v10.c.inc | 3 ++-
-files changed, 5 insertions(+), 3 deletions(-)
-diff --git a/target/cris/translate.c b/target/cris/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/cris/translate.c
-+++ b/target/cris/translate.c
-@@ -XXX,XX +XXX,XX @@ static int dec_rfe_etc(CPUCRISState *env, DisasContext *dc)
-                        -offsetof(CRISCPU, env) + offsetof(CPUState, halted));
-         tcg_gen_movi_tl(env_pc, dc->pc + 2);
-         t_gen_raise_exception(EXCP_HLT);
-+        dc->base.is_jmp = DISAS_NORETURN;
-         return 2;
-     }
-@@ -XXX,XX +XXX,XX @@ static int dec_rfe_etc(CPUCRISState *env, DisasContext *dc)
-         /* Breaks start at 16 in the exception vector.  */
-         t_gen_movi_env_TN(trap_vector, dc->op1 + 16);
-         t_gen_raise_exception(EXCP_BREAK);
--        dc->base.is_jmp = DISAS_UPDATE;
-+        dc->base.is_jmp = DISAS_NORETURN;
-         break;
-     default:
-         printf("op2=%x\n", dc->op2);
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-             cris_evaluate_flags(dc);
-             tcg_gen_movi_tl(env_pc, dc->pc);
-             t_gen_raise_exception(EXCP_DEBUG);
--            dc->base.is_jmp = DISAS_UPDATE;
-+            dc->base.is_jmp = DISAS_NORETURN;
-             /* The address covered by the breakpoint must be included in
-                [tb->pc, tb->pc + tb->size) in order to for it to be
-                properly cleared -- thus we increment the PC here so that
-diff --git a/target/cris/translate_v10.c.inc b/target/cris/translate_v10.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/cris/translate_v10.c.inc
-+++ b/target/cris/translate_v10.c.inc
-@@ -XXX,XX +XXX,XX @@ static inline void cris_illegal_insn(DisasContext *dc)
- {
-     qemu_log_mask(LOG_GUEST_ERROR, "illegal insn at pc=%x\n", dc->pc);
-     t_gen_raise_exception(EXCP_BREAK);
-+    dc->base.is_jmp = DISAS_NORETURN;
- }
- static void gen_store_v10_conditional(DisasContext *dc, TCGv addr, TCGv val,
-@@ -XXX,XX +XXX,XX @@ static unsigned int dec10_ind(CPUCRISState *env, DisasContext *dc)
-                     t_gen_mov_env_TN(trap_vector, c);
-                     tcg_temp_free(c);
-                     t_gen_raise_exception(EXCP_BREAK);
--                    dc->base.is_jmp = DISAS_UPDATE;
-+                    dc->base.is_jmp = DISAS_NORETURN;
-                     return insn_len;
-                 }
-                 LOG_DIS("%d: jump.%d %d r%d r%d\n", __LINE__, size,
---
-.25.1

-[PULL 17/63] target/cris: Fix use_goto_tb
+Deleted patch
-Do not skip the page check for user-only -- mmap/mprotect can
-still change page mappings.  Only check dc->base.pc_first, not
-dc->ppc -- the start page is the only one that's relevant.
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/cris/translate.c | 9 ++-------
-file changed, 2 insertions(+), 7 deletions(-)
-diff --git a/target/cris/translate.c b/target/cris/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/cris/translate.c
-+++ b/target/cris/translate.c
-@@ -XXX,XX +XXX,XX @@ static void t_gen_cc_jmp(TCGv pc_true, TCGv pc_false)
-     gen_set_label(l1);
- }
--static inline bool use_goto_tb(DisasContext *dc, target_ulong dest)
-+static bool use_goto_tb(DisasContext *dc, target_ulong dest)
- {
--#ifndef CONFIG_USER_ONLY
--    return (dc->base.pc_first & TARGET_PAGE_MASK) == (dest & TARGET_PAGE_MASK) ||
--           (dc->ppc & TARGET_PAGE_MASK) == (dest & TARGET_PAGE_MASK);
--#else
--    return true;
--#endif
-+    return ((dest ^ dc->base.pc_first) & TARGET_PAGE_MASK) == 0;
- }
- static void gen_goto_tb(DisasContext *dc, int n, target_ulong dest)
---
-.25.1

-[PULL 18/63] target/cris: Convert to TranslatorOps
+Deleted patch
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/cris/translate.c | 317 ++++++++++++++++++++++------------------
-file changed, 174 insertions(+), 143 deletions(-)
-diff --git a/target/cris/translate.c b/target/cris/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/cris/translate.c
-+++ b/target/cris/translate.c
-@@ -XXX,XX +XXX,XX @@ static unsigned int crisv32_decoder(CPUCRISState *env, DisasContext *dc)
-  *
-  */
--/* generate intermediate code for basic block 'tb'.  */
--void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-+static void cris_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
- {
-+    DisasContext *dc = container_of(dcbase, DisasContext, base);
-     CPUCRISState *env = cs->env_ptr;
-+    uint32_t tb_flags = dc->base.tb->flags;
-     uint32_t pc_start;
--    unsigned int insn_len;
--    struct DisasContext ctx;
--    struct DisasContext *dc = &ctx;
--    uint32_t page_start;
--    target_ulong npc;
--    int num_insns;
-     if (env->pregs[PR_VR] == 32) {
-         dc->decoder = crisv32_decoder;
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-         dc->clear_locked_irq = 1;
-     }
--    /* Odd PC indicates that branch is rexecuting due to exception in the
-+    /*
-+     * Odd PC indicates that branch is rexecuting due to exception in the
-      * delayslot, like in real hw.
-      */
--    pc_start = tb->pc & ~1;
--
--    dc->base.tb = tb;
-+    pc_start = dc->base.pc_first & ~1;
-     dc->base.pc_first = pc_start;
-     dc->base.pc_next = pc_start;
--    dc->base.is_jmp = DISAS_NEXT;
--    dc->base.singlestep_enabled = cs->singlestep_enabled;
-     dc->cpu = env_archcpu(env);
-     dc->ppc = pc_start;
-     dc->pc = pc_start;
-     dc->flags_uptodate = 1;
-     dc->flagx_known = 1;
--    dc->flags_x = tb->flags & X_FLAG;
-+    dc->flags_x = tb_flags & X_FLAG;
-     dc->cc_x_uptodate = 0;
-     dc->cc_mask = 0;
-     dc->update_cc = 0;
-     dc->clear_prefix = 0;
-+    dc->cpustate_changed = 0;
-     cris_update_cc_op(dc, CC_OP_FLAGS, 4);
-     dc->cc_size_uptodate = -1;
-     /* Decode TB flags.  */
--    dc->tb_flags = tb->flags & (S_FLAG | P_FLAG | U_FLAG \
--            | X_FLAG | PFIX_FLAG);
--    dc->delayed_branch = !!(tb->flags & 7);
-+    dc->tb_flags = tb_flags & (S_FLAG | P_FLAG | U_FLAG | X_FLAG | PFIX_FLAG);
-+    dc->delayed_branch = !!(tb_flags & 7);
-     if (dc->delayed_branch) {
-         dc->jmp = JMP_INDIRECT;
-     } else {
-         dc->jmp = JMP_NOJMP;
-     }
-+}
--    dc->cpustate_changed = 0;
-+static void cris_tr_tb_start(DisasContextBase *db, CPUState *cpu)
-+{
-+}
--    page_start = pc_start & TARGET_PAGE_MASK;
--    num_insns = 0;
-+static void cris_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu)
-+{
-+    DisasContext *dc = container_of(dcbase, DisasContext, base);
--    gen_tb_start(tb);
--    do {
--        tcg_gen_insn_start(dc->delayed_branch == 1
--                           ? dc->ppc | 1 : dc->pc);
--        num_insns++;
-+    tcg_gen_insn_start(dc->delayed_branch == 1 ? dc->ppc | 1 : dc->pc);
-+}
--        if (unlikely(cpu_breakpoint_test(cs, dc->pc, BP_ANY))) {
-+static bool cris_tr_breakpoint_check(DisasContextBase *dcbase, CPUState *cpu,
-+                                     const CPUBreakpoint *bp)
-+{
-+    DisasContext *dc = container_of(dcbase, DisasContext, base);
-+
-+    cris_evaluate_flags(dc);
-+    tcg_gen_movi_tl(env_pc, dc->pc);
-+    t_gen_raise_exception(EXCP_DEBUG);
-+    dc->base.is_jmp = DISAS_NORETURN;
-+    /*
-+     * The address covered by the breakpoint must be included in
-+     * [tb->pc, tb->pc + tb->size) in order to for it to be
-+     * properly cleared -- thus we increment the PC here so that
-+     * the logic setting tb->size below does the right thing.
-+     */
-+    dc->pc += 2;
-+    return true;
-+}
-+
-+static void cris_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
-+{
-+    DisasContext *dc = container_of(dcbase, DisasContext, base);
-+    CPUCRISState *env = cs->env_ptr;
-+    unsigned int insn_len;
-+
-+    /* Pretty disas.  */
-+    LOG_DIS("%8.8x:\t", dc->pc);
-+
-+    dc->clear_x = 1;
-+
-+    insn_len = dc->decoder(env, dc);
-+    dc->ppc = dc->pc;
-+    dc->pc += insn_len;
-+    dc->base.pc_next += insn_len;
-+
-+    if (dc->base.is_jmp == DISAS_NORETURN) {
-+        return;
-+    }
-+
-+    if (dc->clear_x) {
-+        cris_clear_x_flag(dc);
-+    }
-+
-+    /*
-+     * Check for delayed branches here.  If we do it before
-+     * actually generating any host code, the simulator will just
-+     * loop doing nothing for on this program location.
-+     */
-+    if (dc->delayed_branch && --dc->delayed_branch == 0) {
-+        if (dc->base.tb->flags & 7) {
-+            t_gen_movi_env_TN(dslot, 0);
-+        }
-+
-+        if (dc->cpustate_changed
-+            || !dc->flagx_known
-+            || (dc->flags_x != (dc->base.tb->flags & X_FLAG))) {
-+            cris_store_direct_jmp(dc);
-+        }
-+
-+        if (dc->clear_locked_irq) {
-+            dc->clear_locked_irq = 0;
-+            t_gen_movi_env_TN(locked_irq, 0);
-+        }
-+
-+        if (dc->jmp == JMP_DIRECT_CC) {
-+            TCGLabel *l1 = gen_new_label();
-             cris_evaluate_flags(dc);
--            tcg_gen_movi_tl(env_pc, dc->pc);
--            t_gen_raise_exception(EXCP_DEBUG);
-+
-+            /* Conditional jmp.  */
-+            tcg_gen_brcondi_tl(TCG_COND_EQ, env_btaken, 0, l1);
-+            gen_goto_tb(dc, 1, dc->jmp_pc);
-+            gen_set_label(l1);
-+            gen_goto_tb(dc, 0, dc->pc);
-             dc->base.is_jmp = DISAS_NORETURN;
--            /* The address covered by the breakpoint must be included in
--               [tb->pc, tb->pc + tb->size) in order to for it to be
--               properly cleared -- thus we increment the PC here so that
--               the logic setting tb->size below does the right thing.  */
--            dc->pc += 2;
--            break;
-+            dc->jmp = JMP_NOJMP;
-+        } else if (dc->jmp == JMP_DIRECT) {
-+            cris_evaluate_flags(dc);
-+            gen_goto_tb(dc, 0, dc->jmp_pc);
-+            dc->base.is_jmp = DISAS_NORETURN;
-+            dc->jmp = JMP_NOJMP;
-+        } else {
-+            TCGv c = tcg_const_tl(dc->pc);
-+            t_gen_cc_jmp(env_btarget, c);
-+            tcg_temp_free(c);
-+            dc->base.is_jmp = DISAS_JUMP;
-         }
-+    }
--        /* Pretty disas.  */
--        LOG_DIS("%8.8x:\t", dc->pc);
-+    /* Force an update if the per-tb cpu state has changed.  */
-+    if (dc->base.is_jmp == DISAS_NEXT
-+        && (dc->cpustate_changed
-+            || !dc->flagx_known
-+            || (dc->flags_x != (dc->base.tb->flags & X_FLAG)))) {
-+        dc->base.is_jmp = DISAS_UPDATE;
-+        tcg_gen_movi_tl(env_pc, dc->pc);
-+    }
--        if (num_insns == max_insns && (tb_cflags(tb) & CF_LAST_IO)) {
--            gen_io_start();
--        }
--        dc->clear_x = 1;
-+    /*
-+     * FIXME: Only the first insn in the TB should cross a page boundary.
-+     * If we can detect the length of the next insn easily, we should.
-+     * In the meantime, simply stop when we do cross.
-+     */
-+    if (dc->base.is_jmp == DISAS_NEXT
-+        && ((dc->pc ^ dc->base.pc_first) & TARGET_PAGE_MASK) != 0) {
-+        dc->base.is_jmp = DISAS_TOO_MANY;
-+    }
-+}
--        insn_len = dc->decoder(env, dc);
--        dc->ppc = dc->pc;
--        dc->pc += insn_len;
--        if (dc->clear_x) {
--            cris_clear_x_flag(dc);
--        }
-+static void cris_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
-+{
-+    DisasContext *dc = container_of(dcbase, DisasContext, base);
-+    DisasJumpType is_jmp = dc->base.is_jmp;
-+    target_ulong npc = dc->pc;
--        /* Check for delayed branches here. If we do it before
--           actually generating any host code, the simulator will just
--           loop doing nothing for on this program location.  */
--        if (dc->delayed_branch) {
--            dc->delayed_branch--;
--            if (dc->delayed_branch == 0) {
--                if (tb->flags & 7) {
--                    t_gen_movi_env_TN(dslot, 0);
--                }
--                if (dc->cpustate_changed || !dc->flagx_known
--                    || (dc->flags_x != (tb->flags & X_FLAG))) {
--                    cris_store_direct_jmp(dc);
--                }
--
--                if (dc->clear_locked_irq) {
--                    dc->clear_locked_irq = 0;
--                    t_gen_movi_env_TN(locked_irq, 0);
--                }
--
--                if (dc->jmp == JMP_DIRECT_CC) {
--                    TCGLabel *l1 = gen_new_label();
--                    cris_evaluate_flags(dc);
--
--                    /* Conditional jmp.  */
--                    tcg_gen_brcondi_tl(TCG_COND_EQ,
--                               env_btaken, 0, l1);
--                    gen_goto_tb(dc, 1, dc->jmp_pc);
--                    gen_set_label(l1);
--                    gen_goto_tb(dc, 0, dc->pc);
--                    dc->base.is_jmp = DISAS_NORETURN;
--                    dc->jmp = JMP_NOJMP;
--                } else if (dc->jmp == JMP_DIRECT) {
--                    cris_evaluate_flags(dc);
--                    gen_goto_tb(dc, 0, dc->jmp_pc);
--                    dc->base.is_jmp = DISAS_NORETURN;
--                    dc->jmp = JMP_NOJMP;
--                } else {
--                    TCGv c = tcg_const_tl(dc->pc);
--                    t_gen_cc_jmp(env_btarget, c);
--                    tcg_temp_free(c);
--                    dc->base.is_jmp = DISAS_JUMP;
--                }
--                break;
--            }
--        }
--
--        /* If we are rexecuting a branch due to exceptions on
--           delay slots don't break.  */
--        if (!(tb->pc & 1) && cs->singlestep_enabled) {
--            break;
--        }
--    } while (!dc->base.is_jmp && !dc->cpustate_changed
--            && !tcg_op_buf_full()
--            && !singlestep
--            && (dc->pc - page_start < TARGET_PAGE_SIZE)
--            && num_insns < max_insns);
-+    if (is_jmp == DISAS_NORETURN) {
-+        /* If we have a broken branch+delayslot sequence, it's too late. */
-+        assert(dc->delayed_branch != 1);
-+        return;
-+    }
-     if (dc->clear_locked_irq) {
-         t_gen_movi_env_TN(locked_irq, 0);
-     }
--    npc = dc->pc;
--
--    /* Force an update if the per-tb cpu state has changed.  */
--    if (dc->base.is_jmp == DISAS_NEXT
--        && (dc->cpustate_changed || !dc->flagx_known
--        || (dc->flags_x != (tb->flags & X_FLAG)))) {
--        dc->base.is_jmp = DISAS_UPDATE;
--        tcg_gen_movi_tl(env_pc, npc);
--    }
-     /* Broken branch+delayslot sequence.  */
-     if (dc->delayed_branch == 1) {
-         /* Set env->dslot to the size of the branch insn.  */
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-     cris_evaluate_flags(dc);
--    if (unlikely(cs->singlestep_enabled)) {
--        if (dc->base.is_jmp == DISAS_NEXT) {
-+    if (unlikely(dc->base.singlestep_enabled)) {
-+        switch (is_jmp) {
-+        case DISAS_TOO_MANY:
-             tcg_gen_movi_tl(env_pc, npc);
--        }
--        t_gen_raise_exception(EXCP_DEBUG);
--    } else {
--        switch (dc->base.is_jmp) {
--        case DISAS_NEXT:
--            gen_goto_tb(dc, 1, npc);
--            break;
--        default:
-+            /* fall through */
-         case DISAS_JUMP:
-         case DISAS_UPDATE:
--            /* indicate that the hash table must be used
--                   to find the next TB */
--            tcg_gen_exit_tb(NULL, 0);
--            break;
--        case DISAS_NORETURN:
--            /* nothing more to generate */
-+            t_gen_raise_exception(EXCP_DEBUG);
-+            return;
-+        default:
-             break;
-         }
-+        g_assert_not_reached();
-     }
--    gen_tb_end(tb, num_insns);
--    tb->size = dc->pc - pc_start;
--    tb->icount = num_insns;
--
--#ifdef DEBUG_DISAS
--#if !DISAS_CRIS
--    if (qemu_loglevel_mask(CPU_LOG_TB_IN_ASM)
--        && qemu_log_in_addr_range(pc_start)) {
--        FILE *logfile = qemu_log_lock();
--        qemu_log("--------------\n");
--        qemu_log("IN: %s\n", lookup_symbol(pc_start));
--        log_target_disas(cs, pc_start, dc->pc - pc_start);
--        qemu_log_unlock(logfile);
-+    switch (is_jmp) {
-+    case DISAS_TOO_MANY:
-+        gen_goto_tb(dc, 0, npc);
-+        break;
-+    case DISAS_JUMP:
-+    case DISAS_UPDATE:
-+        /* Indicate that interupts must be re-evaluated before the next TB. */
-+        tcg_gen_exit_tb(NULL, 0);
-+        break;
-+    default:
-+        g_assert_not_reached();
-     }
--#endif
--#endif
-+}
-+
-+static void cris_tr_disas_log(const DisasContextBase *dcbase, CPUState *cpu)
-+{
-+    if (!DISAS_CRIS) {
-+        qemu_log("IN: %s\n", lookup_symbol(dcbase->pc_first));
-+        log_target_disas(cpu, dcbase->pc_first, dcbase->tb->size);
-+    }
-+}
-+
-+static const TranslatorOps cris_tr_ops = {
-+    .init_disas_context = cris_tr_init_disas_context,
-+    .tb_start           = cris_tr_tb_start,
-+    .insn_start         = cris_tr_insn_start,
-+    .breakpoint_check   = cris_tr_breakpoint_check,
-+    .translate_insn     = cris_tr_translate_insn,
-+    .tb_stop            = cris_tr_tb_stop,
-+    .disas_log          = cris_tr_disas_log,
-+};
-+
-+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-+{
-+    DisasContext dc;
-+    translator_loop(&cris_tr_ops, &dc.base, cs, tb, max_insns);
- }
- void cris_cpu_dump_state(CPUState *cs, FILE *f, int flags)
---
-.25.1

-[PULL 19/63] target/cris: Mark helper_raise_exception noreturn
+Deleted patch
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/cris/helper.h | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/cris/helper.h b/target/cris/helper.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/cris/helper.h
-+++ b/target/cris/helper.h
-@@ -XXX,XX +XXX,XX @@
--DEF_HELPER_2(raise_exception, void, env, i32)
-+DEF_HELPER_2(raise_exception, noreturn, env, i32)
- DEF_HELPER_2(tlb_flush_pid, void, env, i32)
- DEF_HELPER_2(spc_write, void, env, i32)
- DEF_HELPER_1(rfe, void, env)
---
-.25.1

-[PULL 20/63] target/cris: Mark static arrays const
+Deleted patch
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/cris/translate.c         | 19 ++++++++++---------
- target/cris/translate_v10.c.inc |  6 +++---
-files changed, 13 insertions(+), 12 deletions(-)
-diff --git a/target/cris/translate.c b/target/cris/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/cris/translate.c
-+++ b/target/cris/translate.c
-@@ -XXX,XX +XXX,XX @@ static void gen_BUG(DisasContext *dc, const char *file, int line)
-     cpu_abort(CPU(dc->cpu), "%s:%d pc=%x\n", file, line, dc->pc);
- }
--static const char *regnames_v32[] =
-+static const char * const regnames_v32[] =
- {
-     "$r0", "$r1", "$r2", "$r3",
-     "$r4", "$r5", "$r6", "$r7",
-     "$r8", "$r9", "$r10", "$r11",
-     "$r12", "$r13", "$sp", "$acr",
- };
--static const char *pregnames_v32[] =
-+
-+static const char * const pregnames_v32[] =
- {
-     "$bz", "$vr", "$pid", "$srs",
-     "$wz", "$exs", "$eda", "$mof",
-@@ -XXX,XX +XXX,XX @@ static const char *pregnames_v32[] =
- };
- /* We need this table to handle preg-moves with implicit width.  */
--static int preg_sizes[] = {
-+static const int preg_sizes[] = {
-, /* bz.  */
-, /* vr.  */
-, /* pid.  */
-@@ -XXX,XX +XXX,XX @@ static inline void t_gen_swapw(TCGv d, TCGv s)
-    ((T0 >> 5) & 0x02020202) |
-    ((T0 >> 7) & 0x01010101));
-  */
--static inline void t_gen_swapr(TCGv d, TCGv s)
-+static void t_gen_swapr(TCGv d, TCGv s)
- {
--    struct {
-+    static const struct {
-         int shift; /* LSL when positive, LSR when negative.  */
-         uint32_t mask;
-     } bitrev[] = {
-@@ -XXX,XX +XXX,XX @@ static int dec_prep_alu_m(CPUCRISState *env, DisasContext *dc,
- #if DISAS_CRIS
- static const char *cc_name(int cc)
- {
--    static const char *cc_names[16] = {
-+    static const char * const cc_names[16] = {
-         "cc", "cs", "ne", "eq", "vc", "vs", "pl", "mi",
-         "ls", "hi", "ge", "lt", "gt", "le", "a", "p"
-     };
-@@ -XXX,XX +XXX,XX @@ static int dec_null(CPUCRISState *env, DisasContext *dc)
-     return 2;
- }
--static struct decoder_info {
-+static const struct decoder_info {
-     struct {
-         uint32_t bits;
-         uint32_t mask;
-@@ -XXX,XX +XXX,XX @@ void cris_cpu_dump_state(CPUState *cs, FILE *f, int flags)
- {
-     CRISCPU *cpu = CRIS_CPU(cs);
-     CPUCRISState *env = &cpu->env;
--    const char **regnames;
--    const char **pregnames;
-+    const char * const *regnames;
-+    const char * const *pregnames;
-     int i;
-     if (!env) {
-diff --git a/target/cris/translate_v10.c.inc b/target/cris/translate_v10.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/cris/translate_v10.c.inc
-+++ b/target/cris/translate_v10.c.inc
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
- #include "crisv10-decode.h"
--static const char *regnames_v10[] =
-+static const char * const regnames_v10[] =
- {
-     "$r0", "$r1", "$r2", "$r3",
-     "$r4", "$r5", "$r6", "$r7",
-@@ -XXX,XX +XXX,XX @@ static const char *regnames_v10[] =
-     "$r12", "$r13", "$sp", "$pc",
- };
--static const char *pregnames_v10[] =
-+static const char * const pregnames_v10[] =
- {
-     "$bz", "$vr", "$p2", "$p3",
-     "$wz", "$ccr", "$p6-prefix", "$mof",
-@@ -XXX,XX +XXX,XX @@ static const char *pregnames_v10[] =
- };
- /* We need this table to handle preg-moves with implicit width.  */
--static int preg_sizes_v10[] = {
-+static const int preg_sizes_v10[] = {
-, /* bz.  */
-, /* vr.  */
-, /* pid. */
---
-.25.1

-[PULL 21/63] target/cris: Fold unhandled X_FLAG changes into cpustate_changed
+Deleted patch
-We really do this already, by including them into the same test.
-This just hoists the expression up a bit.
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/cris/translate.c | 13 ++++++-------
-file changed, 6 insertions(+), 7 deletions(-)
-diff --git a/target/cris/translate.c b/target/cris/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/cris/translate.c
-+++ b/target/cris/translate.c
-@@ -XXX,XX +XXX,XX @@ static void cris_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
-         cris_clear_x_flag(dc);
-     }
-+    /* Fold unhandled changes to X_FLAG into cpustate_changed. */
-+    dc->cpustate_changed |= !dc->flagx_known;
-+    dc->cpustate_changed |= dc->flags_x != (dc->base.tb->flags & X_FLAG);
-+
-     /*
-      * Check for delayed branches here.  If we do it before
-      * actually generating any host code, the simulator will just
-@@ -XXX,XX +XXX,XX @@ static void cris_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
-             t_gen_movi_env_TN(dslot, 0);
-         }
--        if (dc->cpustate_changed
--            || !dc->flagx_known
--            || (dc->flags_x != (dc->base.tb->flags & X_FLAG))) {
-+        if (dc->cpustate_changed) {
-             cris_store_direct_jmp(dc);
-         }
-@@ -XXX,XX +XXX,XX @@ static void cris_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
-     }
-     /* Force an update if the per-tb cpu state has changed.  */
--    if (dc->base.is_jmp == DISAS_NEXT
--        && (dc->cpustate_changed
--            || !dc->flagx_known
--            || (dc->flags_x != (dc->base.tb->flags & X_FLAG)))) {
-+    if (dc->base.is_jmp == DISAS_NEXT && dc->cpustate_changed) {
-         dc->base.is_jmp = DISAS_UPDATE;
-         tcg_gen_movi_tl(env_pc, dc->pc);
-     }
---
-.25.1

-[PULL 22/63] target/cris: Set cpustate_changed for rfe/rfn
+Deleted patch
-These insns set DISAS_UPDATE without cpustate_changed,
-which isn't quite right.
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/cris/translate.c | 2 ++
-file changed, 2 insertions(+)
-diff --git a/target/cris/translate.c b/target/cris/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/cris/translate.c
-+++ b/target/cris/translate.c
-@@ -XXX,XX +XXX,XX @@ static int dec_rfe_etc(CPUCRISState *env, DisasContext *dc)
-         cris_evaluate_flags(dc);
-         gen_helper_rfe(cpu_env);
-         dc->base.is_jmp = DISAS_UPDATE;
-+        dc->cpustate_changed = true;
-         break;
-     case 5:
-         /* rfn.  */
-@@ -XXX,XX +XXX,XX @@ static int dec_rfe_etc(CPUCRISState *env, DisasContext *dc)
-         cris_evaluate_flags(dc);
-         gen_helper_rfn(cpu_env);
-         dc->base.is_jmp = DISAS_UPDATE;
-+        dc->cpustate_changed = true;
-         break;
-     case 6:
-         LOG_DIS("break %d\n", dc->op1);
---
-.25.1

-[PULL 23/63] target/cris: Add DISAS_UPDATE_NEXT
+Deleted patch
-Move this pc update into tb_stop.
-We will be able to re-use this code shortly.
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/cris/translate.c | 20 +++++++++++++++-----
-file changed, 15 insertions(+), 5 deletions(-)
-diff --git a/target/cris/translate.c b/target/cris/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/cris/translate.c
-+++ b/target/cris/translate.c
-@@ -XXX,XX +XXX,XX @@
- #define BUG() (gen_BUG(dc, __FILE__, __LINE__))
- #define BUG_ON(x) ({if (x) BUG();})
--/* is_jmp field values */
--#define DISAS_JUMP    DISAS_TARGET_0 /* only pc was modified dynamically */
--#define DISAS_UPDATE  DISAS_TARGET_1 /* cpu state was modified dynamically */
-+/*
-+ * Target-specific is_jmp field values
-+ */
-+/* Only pc was modified dynamically */
-+#define DISAS_JUMP          DISAS_TARGET_0
-+/* Cpu state was modified dynamically, including pc */
-+#define DISAS_UPDATE        DISAS_TARGET_1
-+/* Cpu state was modified dynamically, excluding pc -- use npc */
-+#define DISAS_UPDATE_NEXT   DISAS_TARGET_2
- /* Used by the decoder.  */
- #define EXTRACT_FIELD(src, start, end) \
-@@ -XXX,XX +XXX,XX @@ static void cris_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
-     /* Force an update if the per-tb cpu state has changed.  */
-     if (dc->base.is_jmp == DISAS_NEXT && dc->cpustate_changed) {
--        dc->base.is_jmp = DISAS_UPDATE;
--        tcg_gen_movi_tl(env_pc, dc->pc);
-+        dc->base.is_jmp = DISAS_UPDATE_NEXT;
-+        return;
-     }
-     /*
-@@ -XXX,XX +XXX,XX @@ static void cris_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
-     if (unlikely(dc->base.singlestep_enabled)) {
-         switch (is_jmp) {
-         case DISAS_TOO_MANY:
-+        case DISAS_UPDATE_NEXT:
-             tcg_gen_movi_tl(env_pc, npc);
-             /* fall through */
-         case DISAS_JUMP:
-@@ -XXX,XX +XXX,XX @@ static void cris_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
-     case DISAS_TOO_MANY:
-         gen_goto_tb(dc, 0, npc);
-         break;
-+    case DISAS_UPDATE_NEXT:
-+        tcg_gen_movi_tl(env_pc, npc);
-+        /* fall through */
-     case DISAS_JUMP:
-     case DISAS_UPDATE:
-         /* Indicate that interupts must be re-evaluated before the next TB. */
---
-.25.1

-[PULL 24/63] target/cris: Add DISAS_DBRANCH
+Deleted patch
-Move delayed branch handling to tb_stop, where we can re-use other
-end-of-tb code, e.g. the evaluation of flags.  Honor single stepping.
-Validate that we aren't losing state by overwriting is_jmp.
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/cris/translate.c | 96 ++++++++++++++++++++++++-----------------
-file changed, 56 insertions(+), 40 deletions(-)
-diff --git a/target/cris/translate.c b/target/cris/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/cris/translate.c
-+++ b/target/cris/translate.c
-@@ -XXX,XX +XXX,XX @@
- #define DISAS_UPDATE        DISAS_TARGET_1
- /* Cpu state was modified dynamically, excluding pc -- use npc */
- #define DISAS_UPDATE_NEXT   DISAS_TARGET_2
-+/* PC update for delayed branch, see cpustate_changed otherwise */
-+#define DISAS_DBRANCH       DISAS_TARGET_3
- /* Used by the decoder.  */
- #define EXTRACT_FIELD(src, start, end) \
-@@ -XXX,XX +XXX,XX @@ static void cris_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
-     dc->cpustate_changed |= dc->flags_x != (dc->base.tb->flags & X_FLAG);
-     /*
--     * Check for delayed branches here.  If we do it before
--     * actually generating any host code, the simulator will just
--     * loop doing nothing for on this program location.
-+     * All branches are delayed branches, handled immediately below.
-+     * We don't expect to see odd combinations of exit conditions.
-      */
-+    assert(dc->base.is_jmp == DISAS_NEXT || dc->cpustate_changed);
-+
-     if (dc->delayed_branch && --dc->delayed_branch == 0) {
--        if (dc->base.tb->flags & 7) {
--            t_gen_movi_env_TN(dslot, 0);
--        }
-+        dc->base.is_jmp = DISAS_DBRANCH;
-+        return;
-+    }
--        if (dc->cpustate_changed) {
--            cris_store_direct_jmp(dc);
--        }
--
--        if (dc->clear_locked_irq) {
--            dc->clear_locked_irq = 0;
--            t_gen_movi_env_TN(locked_irq, 0);
--        }
--
--        if (dc->jmp == JMP_DIRECT_CC) {
--            TCGLabel *l1 = gen_new_label();
--            cris_evaluate_flags(dc);
--
--            /* Conditional jmp.  */
--            tcg_gen_brcondi_tl(TCG_COND_EQ, env_btaken, 0, l1);
--            gen_goto_tb(dc, 1, dc->jmp_pc);
--            gen_set_label(l1);
--            gen_goto_tb(dc, 0, dc->pc);
--            dc->base.is_jmp = DISAS_NORETURN;
--            dc->jmp = JMP_NOJMP;
--        } else if (dc->jmp == JMP_DIRECT) {
--            cris_evaluate_flags(dc);
--            gen_goto_tb(dc, 0, dc->jmp_pc);
--            dc->base.is_jmp = DISAS_NORETURN;
--            dc->jmp = JMP_NOJMP;
--        } else {
--            TCGv c = tcg_const_tl(dc->pc);
--            t_gen_cc_jmp(env_btarget, c);
--            tcg_temp_free(c);
--            dc->base.is_jmp = DISAS_JUMP;
--        }
-+    if (dc->base.is_jmp != DISAS_NEXT) {
-+        return;
-     }
-     /* Force an update if the per-tb cpu state has changed.  */
--    if (dc->base.is_jmp == DISAS_NEXT && dc->cpustate_changed) {
-+    if (dc->cpustate_changed) {
-         dc->base.is_jmp = DISAS_UPDATE_NEXT;
-         return;
-     }
-@@ -XXX,XX +XXX,XX @@ static void cris_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
-      * If we can detect the length of the next insn easily, we should.
-      * In the meantime, simply stop when we do cross.
-      */
--    if (dc->base.is_jmp == DISAS_NEXT
--        && ((dc->pc ^ dc->base.pc_first) & TARGET_PAGE_MASK) != 0) {
-+    if ((dc->pc ^ dc->base.pc_first) & TARGET_PAGE_MASK) {
-         dc->base.is_jmp = DISAS_TOO_MANY;
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static void cris_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
-     cris_evaluate_flags(dc);
-+    /* Evaluate delayed branch destination and fold to another is_jmp case. */
-+    if (is_jmp == DISAS_DBRANCH) {
-+        if (dc->base.tb->flags & 7) {
-+            t_gen_movi_env_TN(dslot, 0);
-+        }
-+
-+        switch (dc->jmp) {
-+        case JMP_DIRECT:
-+            npc = dc->jmp_pc;
-+            is_jmp = dc->cpustate_changed ? DISAS_UPDATE_NEXT : DISAS_TOO_MANY;
-+            break;
-+
-+        case JMP_DIRECT_CC:
-+            /*
-+             * Use a conditional branch if either taken or not-taken path
-+             * can use goto_tb.  If neither can, then treat it as indirect.
-+             */
-+            if (likely(!dc->base.singlestep_enabled)
-+                && likely(!dc->cpustate_changed)
-+                && (use_goto_tb(dc, dc->jmp_pc) || use_goto_tb(dc, npc))) {
-+                TCGLabel *not_taken = gen_new_label();
-+
-+                tcg_gen_brcondi_tl(TCG_COND_EQ, env_btaken, 0, not_taken);
-+                gen_goto_tb(dc, 1, dc->jmp_pc);
-+                gen_set_label(not_taken);
-+
-+                /* not-taken case handled below. */
-+                is_jmp = DISAS_TOO_MANY;
-+                break;
-+            }
-+            tcg_gen_movi_tl(env_btarget, dc->jmp_pc);
-+            /* fall through */
-+
-+        case JMP_INDIRECT:
-+            t_gen_cc_jmp(env_btarget, tcg_constant_tl(npc));
-+            is_jmp = dc->cpustate_changed ? DISAS_UPDATE : DISAS_JUMP;
-+            break;
-+
-+        default:
-+            g_assert_not_reached();
-+        }
-+    }
-+
-     if (unlikely(dc->base.singlestep_enabled)) {
-         switch (is_jmp) {
-         case DISAS_TOO_MANY:
---
-.25.1

-[PULL 25/63] target/cris: Use tcg_gen_lookup_and_goto_ptr
+Deleted patch
-We can use this in gen_goto_tb and for DISAS_JUMP
-to indirectly chain to the next TB.
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/cris/translate.c | 4 +++-
-file changed, 3 insertions(+), 1 deletion(-)
-diff --git a/target/cris/translate.c b/target/cris/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/cris/translate.c
-+++ b/target/cris/translate.c
-@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *dc, int n, target_ulong dest)
-         tcg_gen_exit_tb(dc->base.tb, n);
-     } else {
-         tcg_gen_movi_tl(env_pc, dest);
--        tcg_gen_exit_tb(NULL, 0);
-+        tcg_gen_lookup_and_goto_ptr();
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static void cris_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
-         tcg_gen_movi_tl(env_pc, npc);
-         /* fall through */
-     case DISAS_JUMP:
-+        tcg_gen_lookup_and_goto_ptr();
-+        break;
-     case DISAS_UPDATE:
-         /* Indicate that interupts must be re-evaluated before the next TB. */
-         tcg_gen_exit_tb(NULL, 0);
---
-.25.1

-[PULL 26/63] target/cris: Improve JMP_INDIRECT
+Deleted patch
-Use movcond instead of brcond to set env_pc.
-Discard the btarget and btaken variables to improve
-register allocation and avoid unnecessary writeback.
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/cris/translate.c | 22 ++++++++++------------
-file changed, 10 insertions(+), 12 deletions(-)
-diff --git a/target/cris/translate.c b/target/cris/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/cris/translate.c
-+++ b/target/cris/translate.c
-@@ -XXX,XX +XXX,XX @@ static void t_gen_swapr(TCGv d, TCGv s)
-     tcg_temp_free(org_s);
- }
--static void t_gen_cc_jmp(TCGv pc_true, TCGv pc_false)
--{
--    TCGLabel *l1 = gen_new_label();
--
--    /* Conditional jmp.  */
--    tcg_gen_mov_tl(env_pc, pc_false);
--    tcg_gen_brcondi_tl(TCG_COND_EQ, env_btaken, 0, l1);
--    tcg_gen_mov_tl(env_pc, pc_true);
--    gen_set_label(l1);
--}
--
- static bool use_goto_tb(DisasContext *dc, target_ulong dest)
- {
-     return ((dest ^ dc->base.pc_first) & TARGET_PAGE_MASK) == 0;
-@@ -XXX,XX +XXX,XX @@ static void cris_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
-             /* fall through */
-         case JMP_INDIRECT:
--            t_gen_cc_jmp(env_btarget, tcg_constant_tl(npc));
-+            tcg_gen_movcond_tl(TCG_COND_NE, env_pc,
-+                               env_btaken, tcg_constant_tl(0),
-+                               env_btarget, tcg_constant_tl(npc));
-             is_jmp = dc->cpustate_changed ? DISAS_UPDATE : DISAS_JUMP;
-+
-+            /*
-+             * We have now consumed btaken and btarget.  Hint to the
-+             * tcg compiler that the writeback to env may be dropped.
-+             */
-+            tcg_gen_discard_tl(env_btaken);
-+            tcg_gen_discard_tl(env_btarget);
-             break;
-         default:
---
-.25.1

-[PULL 27/63] target/cris: Remove dc->flagx_known
+Deleted patch
-Ever since 2a44f7f17364, flagx_known is always true.
-Fold away all of the tests against the flag.
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/cris/translate.c         | 99 ++++++++-------------------------
- target/cris/translate_v10.c.inc |  6 +-
-files changed, 24 insertions(+), 81 deletions(-)
-diff --git a/target/cris/translate.c b/target/cris/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/cris/translate.c
-+++ b/target/cris/translate.c
-@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
-     int cc_x_uptodate;  /* 1 - ccs, 2 - known | X_FLAG. 0 not up-to-date.  */
-     int flags_uptodate; /* Whether or not $ccs is up-to-date.  */
--    int flagx_known; /* Whether or not flags_x has the x flag known at
--                translation time.  */
-     int flags_x;
-     int clear_x; /* Clear x after this insn?  */
-@@ -XXX,XX +XXX,XX @@ static inline void t_gen_add_flag(TCGv d, int flag)
- static inline void t_gen_addx_carry(DisasContext *dc, TCGv d)
- {
--    if (dc->flagx_known) {
--        if (dc->flags_x) {
--            TCGv c;
--
--            c = tcg_temp_new();
--            t_gen_mov_TN_preg(c, PR_CCS);
--            /* C flag is already at bit 0.  */
--            tcg_gen_andi_tl(c, c, C_FLAG);
--            tcg_gen_add_tl(d, d, c);
--            tcg_temp_free(c);
--        }
--    } else {
--        TCGv x, c;
-+    if (dc->flags_x) {
-+        TCGv c = tcg_temp_new();
--        x = tcg_temp_new();
--        c = tcg_temp_new();
--        t_gen_mov_TN_preg(x, PR_CCS);
--        tcg_gen_mov_tl(c, x);
--
--        /* Propagate carry into d if X is set. Branch free.  */
-+        t_gen_mov_TN_preg(c, PR_CCS);
-+        /* C flag is already at bit 0.  */
-         tcg_gen_andi_tl(c, c, C_FLAG);
--        tcg_gen_andi_tl(x, x, X_FLAG);
--        tcg_gen_shri_tl(x, x, 4);
--
--        tcg_gen_and_tl(x, x, c);
--        tcg_gen_add_tl(d, d, x);
--        tcg_temp_free(x);
-+        tcg_gen_add_tl(d, d, c);
-         tcg_temp_free(c);
-     }
- }
- static inline void t_gen_subx_carry(DisasContext *dc, TCGv d)
- {
--    if (dc->flagx_known) {
--        if (dc->flags_x) {
--            TCGv c;
--
--            c = tcg_temp_new();
--            t_gen_mov_TN_preg(c, PR_CCS);
--            /* C flag is already at bit 0.  */
--            tcg_gen_andi_tl(c, c, C_FLAG);
--            tcg_gen_sub_tl(d, d, c);
--            tcg_temp_free(c);
--        }
--    } else {
--        TCGv x, c;
-+    if (dc->flags_x) {
-+        TCGv c = tcg_temp_new();
--        x = tcg_temp_new();
--        c = tcg_temp_new();
--        t_gen_mov_TN_preg(x, PR_CCS);
--        tcg_gen_mov_tl(c, x);
--
--        /* Propagate carry into d if X is set. Branch free.  */
-+        t_gen_mov_TN_preg(c, PR_CCS);
-+        /* C flag is already at bit 0.  */
-         tcg_gen_andi_tl(c, c, C_FLAG);
--        tcg_gen_andi_tl(x, x, X_FLAG);
--        tcg_gen_shri_tl(x, x, 4);
--
--        tcg_gen_and_tl(x, x, c);
--        tcg_gen_sub_tl(d, d, x);
--        tcg_temp_free(x);
-+        tcg_gen_sub_tl(d, d, c);
-         tcg_temp_free(c);
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *dc, int n, target_ulong dest)
- static inline void cris_clear_x_flag(DisasContext *dc)
- {
--    if (dc->flagx_known && dc->flags_x) {
-+    if (dc->flags_x) {
-         dc->flags_uptodate = 0;
-     }
--
--    dc->flagx_known = 1;
-     dc->flags_x = 0;
- }
-@@ -XXX,XX +XXX,XX @@ static void cris_evaluate_flags(DisasContext *dc)
-         break;
-     }
--    if (dc->flagx_known) {
--        if (dc->flags_x) {
--            tcg_gen_ori_tl(cpu_PR[PR_CCS], cpu_PR[PR_CCS], X_FLAG);
--        } else if (dc->cc_op == CC_OP_FLAGS) {
--            tcg_gen_andi_tl(cpu_PR[PR_CCS], cpu_PR[PR_CCS], ~X_FLAG);
--        }
-+    if (dc->flags_x) {
-+        tcg_gen_ori_tl(cpu_PR[PR_CCS], cpu_PR[PR_CCS], X_FLAG);
-+    } else if (dc->cc_op == CC_OP_FLAGS) {
-+        tcg_gen_andi_tl(cpu_PR[PR_CCS], cpu_PR[PR_CCS], ~X_FLAG);
-     }
-     dc->flags_uptodate = 1;
- }
-@@ -XXX,XX +XXX,XX @@ static void cris_update_cc_op(DisasContext *dc, int op, int size)
- static inline void cris_update_cc_x(DisasContext *dc)
- {
-     /* Save the x flag state at the time of the cc snapshot.  */
--    if (dc->flagx_known) {
--        if (dc->cc_x_uptodate == (2 | dc->flags_x)) {
--            return;
--        }
--        tcg_gen_movi_tl(cc_x, dc->flags_x);
--        dc->cc_x_uptodate = 2 | dc->flags_x;
--    } else {
--        tcg_gen_andi_tl(cc_x, cpu_PR[PR_CCS], X_FLAG);
--        dc->cc_x_uptodate = 1;
-+    if (dc->cc_x_uptodate == (2 | dc->flags_x)) {
-+        return;
-     }
-+    tcg_gen_movi_tl(cc_x, dc->flags_x);
-+    dc->cc_x_uptodate = 2 | dc->flags_x;
- }
- /* Update cc prior to executing ALU op. Needs source operands untouched.  */
-@@ -XXX,XX +XXX,XX @@ static void gen_store (DisasContext *dc, TCGv addr, TCGv val,
-     /* Conditional writes. We only support the kind were X and P are known
-        at translation time.  */
--    if (dc->flagx_known && dc->flags_x && (dc->tb_flags & P_FLAG)) {
-+    if (dc->flags_x && (dc->tb_flags & P_FLAG)) {
-         dc->postinc = 0;
-         cris_evaluate_flags(dc);
-         tcg_gen_ori_tl(cpu_PR[PR_CCS], cpu_PR[PR_CCS], C_FLAG);
-@@ -XXX,XX +XXX,XX @@ static void gen_store (DisasContext *dc, TCGv addr, TCGv val,
-     tcg_gen_qemu_st_tl(val, addr, mem_index, MO_TE + ctz32(size));
--    if (dc->flagx_known && dc->flags_x) {
-+    if (dc->flags_x) {
-         cris_evaluate_flags(dc);
-         tcg_gen_andi_tl(cpu_PR[PR_CCS], cpu_PR[PR_CCS], ~C_FLAG);
-     }
-@@ -XXX,XX +XXX,XX @@ static int dec_addc_r(CPUCRISState *env, DisasContext *dc)
-     LOG_DIS("addc $r%u, $r%u\n",
-             dc->op1, dc->op2);
-     cris_evaluate_flags(dc);
-+
-     /* Set for this insn.  */
--    dc->flagx_known = 1;
-     dc->flags_x = X_FLAG;
-     cris_cc_mask(dc, CC_MASK_NZVC);
-@@ -XXX,XX +XXX,XX @@ static int dec_setclrf(CPUCRISState *env, DisasContext *dc)
-     }
-     if (flags & X_FLAG) {
--        dc->flagx_known = 1;
-         if (set) {
-             dc->flags_x = X_FLAG;
-         } else {
-@@ -XXX,XX +XXX,XX @@ static int dec_addc_mr(CPUCRISState *env, DisasContext *dc)
-     cris_evaluate_flags(dc);
-     /* Set for this insn.  */
--    dc->flagx_known = 1;
-     dc->flags_x = X_FLAG;
-     cris_alu_m_alloc_temps(t);
-@@ -XXX,XX +XXX,XX @@ static void cris_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
-     dc->ppc = pc_start;
-     dc->pc = pc_start;
-     dc->flags_uptodate = 1;
--    dc->flagx_known = 1;
-     dc->flags_x = tb_flags & X_FLAG;
-     dc->cc_x_uptodate = 0;
-     dc->cc_mask = 0;
-@@ -XXX,XX +XXX,XX @@ static void cris_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
-     }
-     /* Fold unhandled changes to X_FLAG into cpustate_changed. */
--    dc->cpustate_changed |= !dc->flagx_known;
-     dc->cpustate_changed |= dc->flags_x != (dc->base.tb->flags & X_FLAG);
-     /*
-diff --git a/target/cris/translate_v10.c.inc b/target/cris/translate_v10.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/cris/translate_v10.c.inc
-+++ b/target/cris/translate_v10.c.inc
-@@ -XXX,XX +XXX,XX @@ static void gen_store_v10(DisasContext *dc, TCGv addr, TCGv val,
-         cris_store_direct_jmp(dc);
-     }
--    /* Conditional writes. We only support the kind were X is known
--       at translation time.  */
--    if (dc->flagx_known && dc->flags_x) {
-+    /* Conditional writes. */
-+    if (dc->flags_x) {
-         gen_store_v10_conditional(dc, addr, val, size, mem_index);
-         return;
-     }
-@@ -XXX,XX +XXX,XX @@ static unsigned int dec10_setclrf(DisasContext *dc)
-     if (flags & X_FLAG) {
--        dc->flagx_known = 1;
-         if (set)
-             dc->flags_x = X_FLAG;
-         else
---
-.25.1

-[PULL 28/63] target/cris: Do not exit tb for X_FLAG changes
+Deleted patch
-We always know the exact value of X, that's all that matters.
-This avoids splitting the TB e.g. between "ax" and "addq".
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/cris/translate.c | 3 ---
-file changed, 3 deletions(-)
-diff --git a/target/cris/translate.c b/target/cris/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/cris/translate.c
-+++ b/target/cris/translate.c
-@@ -XXX,XX +XXX,XX @@ static void cris_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
-         cris_clear_x_flag(dc);
-     }
--    /* Fold unhandled changes to X_FLAG into cpustate_changed. */
--    dc->cpustate_changed |= dc->flags_x != (dc->base.tb->flags & X_FLAG);
--
-     /*
-      * All branches are delayed branches, handled immediately below.
-      * We don't expect to see odd combinations of exit conditions.
---
-.25.1

-[PULL 29/63] tcg: Add tcg_gen_vec_add{sub}16_i32
+Deleted patch
-From: LIU Zhiwei <zhiwei_liu@c-sky.com>
-Implement tcg_gen_vec_add{sub}16_tl by adding corresponding i32 OP.
-Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
-Message-Id: <20210624105023.3852-2-zhiwei_liu@c-sky.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/tcg/tcg-op-gvec.h | 13 +++++++++++++
- tcg/tcg-op-gvec.c         | 28 ++++++++++++++++++++++++++++
-files changed, 41 insertions(+)
-diff --git a/include/tcg/tcg-op-gvec.h b/include/tcg/tcg-op-gvec.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/tcg/tcg-op-gvec.h
-+++ b/include/tcg/tcg-op-gvec.h
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_vec_sar16i_i64(TCGv_i64 d, TCGv_i64 a, int64_t);
- void tcg_gen_vec_rotl8i_i64(TCGv_i64 d, TCGv_i64 a, int64_t c);
- void tcg_gen_vec_rotl16i_i64(TCGv_i64 d, TCGv_i64 a, int64_t c);
-+/* 32-bit vector operations. */
-+void tcg_gen_vec_add16_i32(TCGv_i32 d, TCGv_i32 a, TCGv_i32 b);
-+
-+void tcg_gen_vec_sub16_i32(TCGv_i32 d, TCGv_i32 a, TCGv_i32 b);
-+
-+#if TARGET_LONG_BITS == 64
-+#define tcg_gen_vec_add16_tl tcg_gen_vec_add16_i64
-+#define tcg_gen_vec_sub16_tl tcg_gen_vec_sub16_i64
-+#else
-+#define tcg_gen_vec_add16_tl tcg_gen_vec_add16_i32
-+#define tcg_gen_vec_sub16_tl tcg_gen_vec_sub16_i32
-+#endif
-+
- #endif
-diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-op-gvec.c
-+++ b/tcg/tcg-op-gvec.c
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_vec_add16_i64(TCGv_i64 d, TCGv_i64 a, TCGv_i64 b)
-     gen_addv_mask(d, a, b, m);
- }
-+void tcg_gen_vec_add16_i32(TCGv_i32 d, TCGv_i32 a, TCGv_i32 b)
-+{
-+    TCGv_i32 t1 = tcg_temp_new_i32();
-+    TCGv_i32 t2 = tcg_temp_new_i32();
-+
-+    tcg_gen_andi_i32(t1, a, ~0xffff);
-+    tcg_gen_add_i32(t2, a, b);
-+    tcg_gen_add_i32(t1, t1, b);
-+    tcg_gen_deposit_i32(d, t1, t2, 0, 16);
-+
-+    tcg_temp_free_i32(t1);
-+    tcg_temp_free_i32(t2);
-+}
-+
- void tcg_gen_vec_add32_i64(TCGv_i64 d, TCGv_i64 a, TCGv_i64 b)
- {
-     TCGv_i64 t1 = tcg_temp_new_i64();
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_vec_sub16_i64(TCGv_i64 d, TCGv_i64 a, TCGv_i64 b)
-     gen_subv_mask(d, a, b, m);
- }
-+void tcg_gen_vec_sub16_i32(TCGv_i32 d, TCGv_i32 a, TCGv_i32 b)
-+{
-+    TCGv_i32 t1 = tcg_temp_new_i32();
-+    TCGv_i32 t2 = tcg_temp_new_i32();
-+
-+    tcg_gen_andi_i32(t1, b, ~0xffff);
-+    tcg_gen_sub_i32(t2, a, b);
-+    tcg_gen_sub_i32(t1, a, t1);
-+    tcg_gen_deposit_i32(d, t1, t2, 0, 16);
-+
-+    tcg_temp_free_i32(t1);
-+    tcg_temp_free_i32(t2);
-+}
-+
- void tcg_gen_vec_sub32_i64(TCGv_i64 d, TCGv_i64 a, TCGv_i64 b)
- {
-     TCGv_i64 t1 = tcg_temp_new_i64();
---
-.25.1

-[PULL 30/63] tcg: Add tcg_gen_vec_add{sub}8_i32
+Deleted patch
-From: LIU Zhiwei <zhiwei_liu@c-sky.com>
-Implement tcg_gen_vec_add{sub}8_tl by adding corresponging i32 OP.
-Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
-Message-Id: <20210624105023.3852-3-zhiwei_liu@c-sky.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/tcg/tcg-op-gvec.h |  6 ++++++
- tcg/tcg-op-gvec.c         | 38 ++++++++++++++++++++++++++++++++++++++
-files changed, 44 insertions(+)
-diff --git a/include/tcg/tcg-op-gvec.h b/include/tcg/tcg-op-gvec.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/tcg/tcg-op-gvec.h
-+++ b/include/tcg/tcg-op-gvec.h
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_vec_rotl8i_i64(TCGv_i64 d, TCGv_i64 a, int64_t c);
- void tcg_gen_vec_rotl16i_i64(TCGv_i64 d, TCGv_i64 a, int64_t c);
- /* 32-bit vector operations. */
-+void tcg_gen_vec_add8_i32(TCGv_i32 d, TCGv_i32 a, TCGv_i32 b);
- void tcg_gen_vec_add16_i32(TCGv_i32 d, TCGv_i32 a, TCGv_i32 b);
-+void tcg_gen_vec_sub8_i32(TCGv_i32 d, TCGv_i32 a, TCGv_i32 b);
- void tcg_gen_vec_sub16_i32(TCGv_i32 d, TCGv_i32 a, TCGv_i32 b);
- #if TARGET_LONG_BITS == 64
-+#define tcg_gen_vec_add8_tl  tcg_gen_vec_add8_i64
-+#define tcg_gen_vec_sub8_tl  tcg_gen_vec_sub8_i64
- #define tcg_gen_vec_add16_tl tcg_gen_vec_add16_i64
- #define tcg_gen_vec_sub16_tl tcg_gen_vec_sub16_i64
- #else
-+#define tcg_gen_vec_add8_tl  tcg_gen_vec_add8_i32
-+#define tcg_gen_vec_sub8_tl  tcg_gen_vec_sub8_i32
- #define tcg_gen_vec_add16_tl tcg_gen_vec_add16_i32
- #define tcg_gen_vec_sub16_tl tcg_gen_vec_sub16_i32
- #endif
-diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-op-gvec.c
-+++ b/tcg/tcg-op-gvec.c
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_vec_add8_i64(TCGv_i64 d, TCGv_i64 a, TCGv_i64 b)
-     gen_addv_mask(d, a, b, m);
- }
-+void tcg_gen_vec_add8_i32(TCGv_i32 d, TCGv_i32 a, TCGv_i32 b)
-+{
-+    TCGv_i32 m = tcg_constant_i32((int32_t)dup_const(MO_8, 0x80));
-+    TCGv_i32 t1 = tcg_temp_new_i32();
-+    TCGv_i32 t2 = tcg_temp_new_i32();
-+    TCGv_i32 t3 = tcg_temp_new_i32();
-+
-+    tcg_gen_andc_i32(t1, a, m);
-+    tcg_gen_andc_i32(t2, b, m);
-+    tcg_gen_xor_i32(t3, a, b);
-+    tcg_gen_add_i32(d, t1, t2);
-+    tcg_gen_and_i32(t3, t3, m);
-+    tcg_gen_xor_i32(d, d, t3);
-+
-+    tcg_temp_free_i32(t1);
-+    tcg_temp_free_i32(t2);
-+    tcg_temp_free_i32(t3);
-+}
-+
- void tcg_gen_vec_add16_i64(TCGv_i64 d, TCGv_i64 a, TCGv_i64 b)
- {
-     TCGv_i64 m = tcg_constant_i64(dup_const(MO_16, 0x8000));
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_vec_sub8_i64(TCGv_i64 d, TCGv_i64 a, TCGv_i64 b)
-     gen_subv_mask(d, a, b, m);
- }
-+void tcg_gen_vec_sub8_i32(TCGv_i32 d, TCGv_i32 a, TCGv_i32 b)
-+{
-+    TCGv_i32 m = tcg_constant_i32((int32_t)dup_const(MO_8, 0x80));
-+    TCGv_i32 t1 = tcg_temp_new_i32();
-+    TCGv_i32 t2 = tcg_temp_new_i32();
-+    TCGv_i32 t3 = tcg_temp_new_i32();
-+
-+    tcg_gen_or_i32(t1, a, m);
-+    tcg_gen_andc_i32(t2, b, m);
-+    tcg_gen_eqv_i32(t3, a, b);
-+    tcg_gen_sub_i32(d, t1, t2);
-+    tcg_gen_and_i32(t3, t3, m);
-+    tcg_gen_xor_i32(d, d, t3);
-+
-+    tcg_temp_free_i32(t1);
-+    tcg_temp_free_i32(t2);
-+    tcg_temp_free_i32(t3);
-+}
-+
- void tcg_gen_vec_sub16_i64(TCGv_i64 d, TCGv_i64 a, TCGv_i64 b)
- {
-     TCGv_i64 m = tcg_constant_i64(dup_const(MO_16, 0x8000));
---
-.25.1

-[PULL 31/63] tcg: Add tcg_gen_vec_shl{shr}{sar}16i_i32
+Deleted patch
-From: LIU Zhiwei <zhiwei_liu@c-sky.com>
-Implement tcg_gen_vec_shl{shr}{sar}16i_tl by adding corresponging i32 OP.
-Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
-Message-Id: <20210624105023.3852-4-zhiwei_liu@c-sky.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/tcg/tcg-op-gvec.h | 10 ++++++++++
- tcg/tcg-op-gvec.c         | 28 ++++++++++++++++++++++++++++
-files changed, 38 insertions(+)
-diff --git a/include/tcg/tcg-op-gvec.h b/include/tcg/tcg-op-gvec.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/tcg/tcg-op-gvec.h
-+++ b/include/tcg/tcg-op-gvec.h
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_vec_add16_i32(TCGv_i32 d, TCGv_i32 a, TCGv_i32 b);
- void tcg_gen_vec_sub8_i32(TCGv_i32 d, TCGv_i32 a, TCGv_i32 b);
- void tcg_gen_vec_sub16_i32(TCGv_i32 d, TCGv_i32 a, TCGv_i32 b);
-+void tcg_gen_vec_shl16i_i32(TCGv_i32 d, TCGv_i32 a, int32_t);
-+void tcg_gen_vec_shr16i_i32(TCGv_i32 d, TCGv_i32 a, int32_t);
-+void tcg_gen_vec_sar16i_i32(TCGv_i32 d, TCGv_i32 a, int32_t);
-+
- #if TARGET_LONG_BITS == 64
- #define tcg_gen_vec_add8_tl  tcg_gen_vec_add8_i64
- #define tcg_gen_vec_sub8_tl  tcg_gen_vec_sub8_i64
- #define tcg_gen_vec_add16_tl tcg_gen_vec_add16_i64
- #define tcg_gen_vec_sub16_tl tcg_gen_vec_sub16_i64
-+#define tcg_gen_vec_shl16i_tl tcg_gen_vec_shl16i_i64
-+#define tcg_gen_vec_shr16i_tl tcg_gen_vec_shr16i_i64
-+#define tcg_gen_vec_sar16i_tl tcg_gen_vec_sar16i_i64
- #else
- #define tcg_gen_vec_add8_tl  tcg_gen_vec_add8_i32
- #define tcg_gen_vec_sub8_tl  tcg_gen_vec_sub8_i32
- #define tcg_gen_vec_add16_tl tcg_gen_vec_add16_i32
- #define tcg_gen_vec_sub16_tl tcg_gen_vec_sub16_i32
-+#define tcg_gen_vec_shl16i_tl tcg_gen_vec_shl16i_i32
-+#define tcg_gen_vec_shr16i_tl tcg_gen_vec_shr16i_i32
-+#define tcg_gen_vec_sar16i_tl tcg_gen_vec_sar16i_i32
- #endif
- #endif
-diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-op-gvec.c
-+++ b/tcg/tcg-op-gvec.c
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_vec_shl16i_i64(TCGv_i64 d, TCGv_i64 a, int64_t c)
-     tcg_gen_andi_i64(d, d, mask);
- }
-+void tcg_gen_vec_shl16i_i32(TCGv_i32 d, TCGv_i32 a, int32_t c)
-+{
-+    uint32_t mask = dup_const(MO_16, 0xffff << c);
-+    tcg_gen_shli_i32(d, a, c);
-+    tcg_gen_andi_i32(d, d, mask);
-+}
-+
- void tcg_gen_gvec_shli(unsigned vece, uint32_t dofs, uint32_t aofs,
-                        int64_t shift, uint32_t oprsz, uint32_t maxsz)
- {
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_vec_shr16i_i64(TCGv_i64 d, TCGv_i64 a, int64_t c)
-     tcg_gen_andi_i64(d, d, mask);
- }
-+void tcg_gen_vec_shr16i_i32(TCGv_i32 d, TCGv_i32 a, int32_t c)
-+{
-+    uint32_t mask = dup_const(MO_16, 0xffff >> c);
-+    tcg_gen_shri_i32(d, a, c);
-+    tcg_gen_andi_i32(d, d, mask);
-+}
-+
- void tcg_gen_gvec_shri(unsigned vece, uint32_t dofs, uint32_t aofs,
-                        int64_t shift, uint32_t oprsz, uint32_t maxsz)
- {
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_vec_sar16i_i64(TCGv_i64 d, TCGv_i64 a, int64_t c)
-     tcg_temp_free_i64(s);
- }
-+void tcg_gen_vec_sar16i_i32(TCGv_i32 d, TCGv_i32 a, int32_t c)
-+{
-+    uint32_t s_mask = dup_const(MO_16, 0x8000 >> c);
-+    uint32_t c_mask = dup_const(MO_16, 0xffff >> c);
-+    TCGv_i32 s = tcg_temp_new_i32();
-+
-+    tcg_gen_shri_i32(d, a, c);
-+    tcg_gen_andi_i32(s, d, s_mask);  /* isolate (shifted) sign bit */
-+    tcg_gen_andi_i32(d, d, c_mask);  /* clear out bits above sign  */
-+    tcg_gen_muli_i32(s, s, (2 << c) - 2); /* replicate isolated signs */
-+    tcg_gen_or_i32(d, d, s);         /* include sign extension */
-+    tcg_temp_free_i32(s);
-+}
-+
- void tcg_gen_gvec_sari(unsigned vece, uint32_t dofs, uint32_t aofs,
-                        int64_t shift, uint32_t oprsz, uint32_t maxsz)
- {
---
-.25.1

-[PULL 32/63] tcg: Add tcg_gen_vec_shl{shr}{sar}8i_i32
+Deleted patch
-From: LIU Zhiwei <zhiwei_liu@c-sky.com>
-Implement tcg_gen_vec_shl{shr}{sar}8i_tl by adding corresponging i32 OP.
-Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
-Message-Id: <20210624105023.3852-5-zhiwei_liu@c-sky.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/tcg/tcg-op-gvec.h | 10 ++++++++++
- tcg/tcg-op-gvec.c         | 28 ++++++++++++++++++++++++++++
-files changed, 38 insertions(+)
-diff --git a/include/tcg/tcg-op-gvec.h b/include/tcg/tcg-op-gvec.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/tcg/tcg-op-gvec.h
-+++ b/include/tcg/tcg-op-gvec.h
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_vec_add16_i32(TCGv_i32 d, TCGv_i32 a, TCGv_i32 b);
- void tcg_gen_vec_sub8_i32(TCGv_i32 d, TCGv_i32 a, TCGv_i32 b);
- void tcg_gen_vec_sub16_i32(TCGv_i32 d, TCGv_i32 a, TCGv_i32 b);
-+void tcg_gen_vec_shl8i_i32(TCGv_i32 d, TCGv_i32 a, int32_t);
- void tcg_gen_vec_shl16i_i32(TCGv_i32 d, TCGv_i32 a, int32_t);
-+void tcg_gen_vec_shr8i_i32(TCGv_i32 d, TCGv_i32 a, int32_t);
- void tcg_gen_vec_shr16i_i32(TCGv_i32 d, TCGv_i32 a, int32_t);
-+void tcg_gen_vec_sar8i_i32(TCGv_i32 d, TCGv_i32 a, int32_t);
- void tcg_gen_vec_sar16i_i32(TCGv_i32 d, TCGv_i32 a, int32_t);
- #if TARGET_LONG_BITS == 64
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_vec_sar16i_i32(TCGv_i32 d, TCGv_i32 a, int32_t);
- #define tcg_gen_vec_sub8_tl  tcg_gen_vec_sub8_i64
- #define tcg_gen_vec_add16_tl tcg_gen_vec_add16_i64
- #define tcg_gen_vec_sub16_tl tcg_gen_vec_sub16_i64
-+#define tcg_gen_vec_shl8i_tl tcg_gen_vec_shl8i_i64
-+#define tcg_gen_vec_shr8i_tl tcg_gen_vec_shr8i_i64
-+#define tcg_gen_vec_sar8i_tl tcg_gen_vec_sar8i_i64
- #define tcg_gen_vec_shl16i_tl tcg_gen_vec_shl16i_i64
- #define tcg_gen_vec_shr16i_tl tcg_gen_vec_shr16i_i64
- #define tcg_gen_vec_sar16i_tl tcg_gen_vec_sar16i_i64
-+
- #else
- #define tcg_gen_vec_add8_tl  tcg_gen_vec_add8_i32
- #define tcg_gen_vec_sub8_tl  tcg_gen_vec_sub8_i32
- #define tcg_gen_vec_add16_tl tcg_gen_vec_add16_i32
- #define tcg_gen_vec_sub16_tl tcg_gen_vec_sub16_i32
-+#define tcg_gen_vec_shl8i_tl tcg_gen_vec_shl8i_i32
-+#define tcg_gen_vec_shr8i_tl tcg_gen_vec_shr8i_i32
-+#define tcg_gen_vec_sar8i_tl tcg_gen_vec_sar8i_i32
- #define tcg_gen_vec_shl16i_tl tcg_gen_vec_shl16i_i32
- #define tcg_gen_vec_shr16i_tl tcg_gen_vec_shr16i_i32
- #define tcg_gen_vec_sar16i_tl tcg_gen_vec_sar16i_i32
-diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-op-gvec.c
-+++ b/tcg/tcg-op-gvec.c
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_vec_shl16i_i64(TCGv_i64 d, TCGv_i64 a, int64_t c)
-     tcg_gen_andi_i64(d, d, mask);
- }
-+void tcg_gen_vec_shl8i_i32(TCGv_i32 d, TCGv_i32 a, int32_t c)
-+{
-+    uint32_t mask = dup_const(MO_8, 0xff << c);
-+    tcg_gen_shli_i32(d, a, c);
-+    tcg_gen_andi_i32(d, d, mask);
-+}
-+
- void tcg_gen_vec_shl16i_i32(TCGv_i32 d, TCGv_i32 a, int32_t c)
- {
-     uint32_t mask = dup_const(MO_16, 0xffff << c);
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_vec_shr16i_i64(TCGv_i64 d, TCGv_i64 a, int64_t c)
-     tcg_gen_andi_i64(d, d, mask);
- }
-+void tcg_gen_vec_shr8i_i32(TCGv_i32 d, TCGv_i32 a, int32_t c)
-+{
-+    uint32_t mask = dup_const(MO_8, 0xff >> c);
-+    tcg_gen_shri_i32(d, a, c);
-+    tcg_gen_andi_i32(d, d, mask);
-+}
-+
- void tcg_gen_vec_shr16i_i32(TCGv_i32 d, TCGv_i32 a, int32_t c)
- {
-     uint32_t mask = dup_const(MO_16, 0xffff >> c);
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_vec_sar16i_i64(TCGv_i64 d, TCGv_i64 a, int64_t c)
-     tcg_temp_free_i64(s);
- }
-+void tcg_gen_vec_sar8i_i32(TCGv_i32 d, TCGv_i32 a, int32_t c)
-+{
-+    uint32_t s_mask = dup_const(MO_8, 0x80 >> c);
-+    uint32_t c_mask = dup_const(MO_8, 0xff >> c);
-+    TCGv_i32 s = tcg_temp_new_i32();
-+
-+    tcg_gen_shri_i32(d, a, c);
-+    tcg_gen_andi_i32(s, d, s_mask);  /* isolate (shifted) sign bit */
-+    tcg_gen_muli_i32(s, s, (2 << c) - 2); /* replicate isolated signs */
-+    tcg_gen_andi_i32(d, d, c_mask);  /* clear out bits above sign  */
-+    tcg_gen_or_i32(d, d, s);         /* include sign extension */
-+    tcg_temp_free_i32(s);
-+}
-+
- void tcg_gen_vec_sar16i_i32(TCGv_i32 d, TCGv_i32 a, int32_t c)
- {
-     uint32_t s_mask = dup_const(MO_16, 0x8000 >> c);
---
-.25.1

-[PULL 33/63] tcg: Implement tcg_gen_vec_add{sub}32_tl
+Deleted patch
-From: LIU Zhiwei <zhiwei_liu@c-sky.com>
-Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
-Message-Id: <20210624105023.3852-6-zhiwei_liu@c-sky.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/tcg/tcg-op-gvec.h | 4 ++++
-file changed, 4 insertions(+)
-diff --git a/include/tcg/tcg-op-gvec.h b/include/tcg/tcg-op-gvec.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/tcg/tcg-op-gvec.h
-+++ b/include/tcg/tcg-op-gvec.h
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_vec_sar16i_i32(TCGv_i32 d, TCGv_i32 a, int32_t);
- #define tcg_gen_vec_sub8_tl  tcg_gen_vec_sub8_i64
- #define tcg_gen_vec_add16_tl tcg_gen_vec_add16_i64
- #define tcg_gen_vec_sub16_tl tcg_gen_vec_sub16_i64
-+#define tcg_gen_vec_add32_tl tcg_gen_vec_add32_i64
-+#define tcg_gen_vec_sub32_tl tcg_gen_vec_sub32_i64
- #define tcg_gen_vec_shl8i_tl tcg_gen_vec_shl8i_i64
- #define tcg_gen_vec_shr8i_tl tcg_gen_vec_shr8i_i64
- #define tcg_gen_vec_sar8i_tl tcg_gen_vec_sar8i_i64
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_vec_sar16i_i32(TCGv_i32 d, TCGv_i32 a, int32_t);
- #define tcg_gen_vec_sub8_tl  tcg_gen_vec_sub8_i32
- #define tcg_gen_vec_add16_tl tcg_gen_vec_add16_i32
- #define tcg_gen_vec_sub16_tl tcg_gen_vec_sub16_i32
-+#define tcg_gen_vec_add32_tl tcg_gen_add_i32
-+#define tcg_gen_vec_sub32_tl tcg_gen_sub_i32
- #define tcg_gen_vec_shl8i_tl tcg_gen_vec_shl8i_i32
- #define tcg_gen_vec_shr8i_tl tcg_gen_vec_shr8i_i32
- #define tcg_gen_vec_sar8i_tl tcg_gen_vec_sar8i_i32
---
-.25.1

-[PULL 34/63] tcg: Use correct trap number for page faults on *BSD systems
+Deleted patch
-From: Warner Losh <imp@bsdimp.com>
-The trap number for a page fault on BSD systems is T_PAGEFLT
-not 0xe -- 0xe is used by Linux and represents the intel hardware
-trap vector. The BSD kernels, however, translate this to T_PAGEFLT
-in their Xpage, Xtrap0e, Xtrap14, etc fault handlers. This is true
-for i386 and x86_64, though the name of the trap hanlder can very
-on the flavor of BSD. As far as I can tell, Linux doesn't provide
-a define for this value. Invent a new one (PAGE_FAULT_TRAP) and
-use it instead to avoid uglier ifdefs.
-Signed-off-by: Mark Johnston <markj@FreeBSD.org>
-Signed-off-by: Juergen Lock <nox@FreeBSD.org>
-[ Rework to avoid ifdefs and expand it to i386 ]
-Signed-off-by: Warner Losh <imp@bsdimp.com>
-Message-Id: <20210625045707.84534-3-imp@bsdimp.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- accel/tcg/user-exec.c | 20 ++++++++++++++++++--
-file changed, 18 insertions(+), 2 deletions(-)
-diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/user-exec.c
-+++ b/accel/tcg/user-exec.c
-@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
- #if defined(__NetBSD__)
- #include <ucontext.h>
-+#include <machine/trap.h>
- #define EIP_sig(context)     ((context)->uc_mcontext.__gregs[_REG_EIP])
- #define TRAP_sig(context)    ((context)->uc_mcontext.__gregs[_REG_TRAPNO])
- #define ERROR_sig(context)   ((context)->uc_mcontext.__gregs[_REG_ERR])
- #define MASK_sig(context)    ((context)->uc_sigmask)
-+#define PAGE_FAULT_TRAP      T_PAGEFLT
- #elif defined(__FreeBSD__) || defined(__DragonFly__)
- #include <ucontext.h>
-+#include <machine/trap.h>
- #define EIP_sig(context)  (*((unsigned long *)&(context)->uc_mcontext.mc_eip))
- #define TRAP_sig(context)    ((context)->uc_mcontext.mc_trapno)
- #define ERROR_sig(context)   ((context)->uc_mcontext.mc_err)
- #define MASK_sig(context)    ((context)->uc_sigmask)
-+#define PAGE_FAULT_TRAP      T_PAGEFLT
- #elif defined(__OpenBSD__)
-+#include <machine/trap.h>
- #define EIP_sig(context)     ((context)->sc_eip)
- #define TRAP_sig(context)    ((context)->sc_trapno)
- #define ERROR_sig(context)   ((context)->sc_err)
- #define MASK_sig(context)    ((context)->sc_mask)
-+#define PAGE_FAULT_TRAP      T_PAGEFLT
- #else
- #define EIP_sig(context)     ((context)->uc_mcontext.gregs[REG_EIP])
- #define TRAP_sig(context)    ((context)->uc_mcontext.gregs[REG_TRAPNO])
- #define ERROR_sig(context)   ((context)->uc_mcontext.gregs[REG_ERR])
- #define MASK_sig(context)    ((context)->uc_sigmask)
-+#define PAGE_FAULT_TRAP      0xe
- #endif
- int cpu_signal_handler(int host_signum, void *pinfo,
-@@ -XXX,XX +XXX,XX @@ int cpu_signal_handler(int host_signum, void *pinfo,
-     pc = EIP_sig(uc);
-     trapno = TRAP_sig(uc);
-     return handle_cpu_signal(pc, info,
--                             trapno == 0xe ? (ERROR_sig(uc) >> 1) & 1 : 0,
-+                             trapno == PAGE_FAULT_TRAP ?
-+                             (ERROR_sig(uc) >> 1) & 1 : 0,
-                              &MASK_sig(uc));
- }
- #elif defined(__x86_64__)
- #ifdef __NetBSD__
-+#include <machine/trap.h>
- #define PC_sig(context)       _UC_MACHINE_PC(context)
- #define TRAP_sig(context)     ((context)->uc_mcontext.__gregs[_REG_TRAPNO])
- #define ERROR_sig(context)    ((context)->uc_mcontext.__gregs[_REG_ERR])
- #define MASK_sig(context)     ((context)->uc_sigmask)
-+#define PAGE_FAULT_TRAP       T_PAGEFLT
- #elif defined(__OpenBSD__)
-+#include <machine/trap.h>
- #define PC_sig(context)       ((context)->sc_rip)
- #define TRAP_sig(context)     ((context)->sc_trapno)
- #define ERROR_sig(context)    ((context)->sc_err)
- #define MASK_sig(context)     ((context)->sc_mask)
-+#define PAGE_FAULT_TRAP       T_PAGEFLT
- #elif defined(__FreeBSD__) || defined(__DragonFly__)
- #include <ucontext.h>
-+#include <machine/trap.h>
- #define PC_sig(context)  (*((unsigned long *)&(context)->uc_mcontext.mc_rip))
- #define TRAP_sig(context)     ((context)->uc_mcontext.mc_trapno)
- #define ERROR_sig(context)    ((context)->uc_mcontext.mc_err)
- #define MASK_sig(context)     ((context)->uc_sigmask)
-+#define PAGE_FAULT_TRAP       T_PAGEFLT
- #else
- #define PC_sig(context)       ((context)->uc_mcontext.gregs[REG_RIP])
- #define TRAP_sig(context)     ((context)->uc_mcontext.gregs[REG_TRAPNO])
- #define ERROR_sig(context)    ((context)->uc_mcontext.gregs[REG_ERR])
- #define MASK_sig(context)     ((context)->uc_sigmask)
-+#define PAGE_FAULT_TRAP       0xe
- #endif
- int cpu_signal_handler(int host_signum, void *pinfo,
-@@ -XXX,XX +XXX,XX @@ int cpu_signal_handler(int host_signum, void *pinfo,
-     pc = PC_sig(uc);
-     return handle_cpu_signal(pc, info,
--                             TRAP_sig(uc) == 0xe ? (ERROR_sig(uc) >> 1) & 1 : 0,
-+                             TRAP_sig(uc) == PAGE_FAULT_TRAP ?
-+                             (ERROR_sig(uc) >> 1) & 1 : 0,
-                              &MASK_sig(uc));
- }
---
-.25.1

-[PULL 36/63] tcg/i386: Support bswap flags
+Deleted patch
-Retain the current rorw bswap16 expansion for the zero-in/zero-out case.
-Otherwise, perform a wider bswap plus a right-shift or extend.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/i386/tcg-target.c.inc | 20 +++++++++++++++++++-
-file changed, 19 insertions(+), 1 deletion(-)
-diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/i386/tcg-target.c.inc
-+++ b/tcg/i386/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
-         break;
-     OP_32_64(bswap16):
--        tcg_out_rolw_8(s, a0);
-+        if (a2 & TCG_BSWAP_OS) {
-+            /* Output must be sign-extended. */
-+            if (rexw) {
-+                tcg_out_bswap64(s, a0);
-+                tcg_out_shifti(s, SHIFT_SAR + rexw, a0, 48);
-+            } else {
-+                tcg_out_bswap32(s, a0);
-+                tcg_out_shifti(s, SHIFT_SAR, a0, 16);
-+            }
-+        } else if ((a2 & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
-+            /* Output must be zero-extended, but input isn't. */
-+            tcg_out_bswap32(s, a0);
-+            tcg_out_shifti(s, SHIFT_SHR, a0, 16);
-+        } else {
-+            tcg_out_rolw_8(s, a0);
-+        }
-         break;
-     OP_32_64(bswap32):
-         tcg_out_bswap32(s, a0);
-+        if (rexw && (a2 & TCG_BSWAP_OS)) {
-+            tcg_out_ext32s(s, a0, a0);
-+        }
-         break;
-     OP_32_64(neg):
---
-.25.1

-[PULL 37/63] tcg/aarch64: Merge tcg_out_rev{16,32,64}
+Deleted patch
-Pass in the input and output size.  We currently use 3 of the 5
-possible combinations; the others may be used by new tcg opcodes.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/aarch64/tcg-target.c.inc | 42 ++++++++++++++----------------------
-file changed, 16 insertions(+), 26 deletions(-)
-diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/aarch64/tcg-target.c.inc
-+++ b/tcg/aarch64/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ typedef enum {
-     /* Data-processing (1 source) instructions.  */
-     I3507_CLZ       = 0x5ac01000,
-     I3507_RBIT      = 0x5ac00000,
--    I3507_REV16     = 0x5ac00400,
--    I3507_REV32     = 0x5ac00800,
--    I3507_REV64     = 0x5ac00c00,
-+    I3507_REV       = 0x5ac00000, /* + size << 10 */
-     /* Data-processing (2 source) instructions.  */
-     I3508_LSLV      = 0x1ac02000,
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_brcond(TCGContext *s, TCGType ext, TCGCond c, TCGArg a,
-     }
- }
--static inline void tcg_out_rev64(TCGContext *s, TCGReg rd, TCGReg rn)
-+static inline void tcg_out_rev(TCGContext *s, int ext, MemOp s_bits,
-+                               TCGReg rd, TCGReg rn)
- {
--    tcg_out_insn(s, 3507, REV64, TCG_TYPE_I64, rd, rn);
--}
--
--static inline void tcg_out_rev32(TCGContext *s, TCGReg rd, TCGReg rn)
--{
--    tcg_out_insn(s, 3507, REV32, TCG_TYPE_I32, rd, rn);
--}
--
--static inline void tcg_out_rev16(TCGContext *s, TCGReg rd, TCGReg rn)
--{
--    tcg_out_insn(s, 3507, REV16, TCG_TYPE_I32, rd, rn);
-+    /* REV, REV16, REV32 */
-+    tcg_out_insn_3507(s, I3507_REV | (s_bits << 10), ext, rd, rn);
- }
- static inline void tcg_out_sxt(TCGContext *s, TCGType ext, MemOp s_bits,
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp memop, TCGType ext,
-     case MO_UW:
-         tcg_out_ldst_r(s, I3312_LDRH, data_r, addr_r, otype, off_r);
-         if (bswap) {
--            tcg_out_rev16(s, data_r, data_r);
-+            tcg_out_rev(s, TCG_TYPE_I32, MO_16, data_r, data_r);
-         }
-         break;
-     case MO_SW:
-         if (bswap) {
-             tcg_out_ldst_r(s, I3312_LDRH, data_r, addr_r, otype, off_r);
--            tcg_out_rev16(s, data_r, data_r);
-+            tcg_out_rev(s, TCG_TYPE_I32, MO_16, data_r, data_r);
-             tcg_out_sxt(s, ext, MO_16, data_r, data_r);
-         } else {
-             tcg_out_ldst_r(s, (ext ? I3312_LDRSHX : I3312_LDRSHW),
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp memop, TCGType ext,
-     case MO_UL:
-         tcg_out_ldst_r(s, I3312_LDRW, data_r, addr_r, otype, off_r);
-         if (bswap) {
--            tcg_out_rev32(s, data_r, data_r);
-+            tcg_out_rev(s, TCG_TYPE_I32, MO_32, data_r, data_r);
-         }
-         break;
-     case MO_SL:
-         if (bswap) {
-             tcg_out_ldst_r(s, I3312_LDRW, data_r, addr_r, otype, off_r);
--            tcg_out_rev32(s, data_r, data_r);
-+            tcg_out_rev(s, TCG_TYPE_I32, MO_32, data_r, data_r);
-             tcg_out_sxt(s, TCG_TYPE_I64, MO_32, data_r, data_r);
-         } else {
-             tcg_out_ldst_r(s, I3312_LDRSWX, data_r, addr_r, otype, off_r);
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp memop, TCGType ext,
-     case MO_Q:
-         tcg_out_ldst_r(s, I3312_LDRX, data_r, addr_r, otype, off_r);
-         if (bswap) {
--            tcg_out_rev64(s, data_r, data_r);
-+            tcg_out_rev(s, TCG_TYPE_I64, MO_64, data_r, data_r);
-         }
-         break;
-     default:
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, MemOp memop,
-         break;
-     case MO_16:
-         if (bswap && data_r != TCG_REG_XZR) {
--            tcg_out_rev16(s, TCG_REG_TMP, data_r);
-+            tcg_out_rev(s, TCG_TYPE_I32, MO_16, TCG_REG_TMP, data_r);
-             data_r = TCG_REG_TMP;
-         }
-         tcg_out_ldst_r(s, I3312_STRH, data_r, addr_r, otype, off_r);
-         break;
-     case MO_32:
-         if (bswap && data_r != TCG_REG_XZR) {
--            tcg_out_rev32(s, TCG_REG_TMP, data_r);
-+            tcg_out_rev(s, TCG_TYPE_I32, MO_32, TCG_REG_TMP, data_r);
-             data_r = TCG_REG_TMP;
-         }
-         tcg_out_ldst_r(s, I3312_STRW, data_r, addr_r, otype, off_r);
-         break;
-     case MO_64:
-         if (bswap && data_r != TCG_REG_XZR) {
--            tcg_out_rev64(s, TCG_REG_TMP, data_r);
-+            tcg_out_rev(s, TCG_TYPE_I64, MO_64, TCG_REG_TMP, data_r);
-             data_r = TCG_REG_TMP;
-         }
-         tcg_out_ldst_r(s, I3312_STRX, data_r, addr_r, otype, off_r);
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
-         break;
-     case INDEX_op_bswap64_i64:
--        tcg_out_rev64(s, a0, a1);
-+        tcg_out_rev(s, TCG_TYPE_I64, MO_64, a0, a1);
-         break;
-     case INDEX_op_bswap32_i64:
-     case INDEX_op_bswap32_i32:
--        tcg_out_rev32(s, a0, a1);
-+        tcg_out_rev(s, TCG_TYPE_I32, MO_32, a0, a1);
-         break;
-     case INDEX_op_bswap16_i64:
-     case INDEX_op_bswap16_i32:
--        tcg_out_rev16(s, a0, a1);
-+        tcg_out_rev(s, TCG_TYPE_I32, MO_16, a0, a1);
-         break;
-     case INDEX_op_ext8s_i64:
---
-.25.1

-[PULL 38/63] tcg/aarch64: Support bswap flags
+Deleted patch
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/aarch64/tcg-target.c.inc | 12 ++++++++++++
-file changed, 12 insertions(+)
-diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/aarch64/tcg-target.c.inc
-+++ b/tcg/aarch64/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
-         tcg_out_rev(s, TCG_TYPE_I64, MO_64, a0, a1);
-         break;
-     case INDEX_op_bswap32_i64:
-+        tcg_out_rev(s, TCG_TYPE_I32, MO_32, a0, a1);
-+        if (a2 & TCG_BSWAP_OS) {
-+            tcg_out_sxt(s, TCG_TYPE_I64, MO_32, a0, a0);
-+        }
-+        break;
-     case INDEX_op_bswap32_i32:
-         tcg_out_rev(s, TCG_TYPE_I32, MO_32, a0, a1);
-         break;
-     case INDEX_op_bswap16_i64:
-     case INDEX_op_bswap16_i32:
-         tcg_out_rev(s, TCG_TYPE_I32, MO_16, a0, a1);
-+        if (a2 & TCG_BSWAP_OS) {
-+            /* Output must be sign-extended. */
-+            tcg_out_sxt(s, ext, MO_16, a0, a0);
-+        } else if ((a2 & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
-+            /* Output must be zero-extended, but input isn't. */
-+            tcg_out_uxt(s, MO_16, a0, a0);
-+        }
-         break;
-     case INDEX_op_ext8s_i64:
---
-.25.1

-[PULL 40/63] tcg/ppc: Split out tcg_out_ext{8,16,32}s
+Deleted patch
-We will shortly require these in other context;
-make the expansion as clear as possible.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/ppc/tcg-target.c.inc | 31 +++++++++++++++++++++----------
-file changed, 21 insertions(+), 10 deletions(-)
-diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/ppc/tcg-target.c.inc
-+++ b/tcg/ppc/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_rlw(TCGContext *s, int op, TCGReg ra, TCGReg rs,
-     tcg_out32(s, op | RA(ra) | RS(rs) | SH(sh) | MB(mb) | ME(me));
- }
-+static inline void tcg_out_ext8s(TCGContext *s, TCGReg dst, TCGReg src)
-+{
-+    tcg_out32(s, EXTSB | RA(dst) | RS(src));
-+}
-+
-+static inline void tcg_out_ext16s(TCGContext *s, TCGReg dst, TCGReg src)
-+{
-+    tcg_out32(s, EXTSH | RA(dst) | RS(src));
-+}
-+
-+static inline void tcg_out_ext32s(TCGContext *s, TCGReg dst, TCGReg src)
-+{
-+    tcg_out32(s, EXTSW | RA(dst) | RS(src));
-+}
-+
- static inline void tcg_out_ext32u(TCGContext *s, TCGReg dst, TCGReg src)
- {
-     tcg_out_rld(s, RLDICL, dst, src, 0, 32);
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
-                        const int const_args[TCG_MAX_OP_ARGS])
- {
-     TCGArg a0, a1, a2;
--    int c;
-     switch (opc) {
-     case INDEX_op_exit_tb:
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
-     case INDEX_op_ld8s_i32:
-     case INDEX_op_ld8s_i64:
-         tcg_out_mem_long(s, LBZ, LBZX, args[0], args[1], args[2]);
--        tcg_out32(s, EXTSB | RS(args[0]) | RA(args[0]));
-+        tcg_out_ext8s(s, args[0], args[0]);
-         break;
-     case INDEX_op_ld16u_i32:
-     case INDEX_op_ld16u_i64:
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
-     case INDEX_op_ext8s_i32:
-     case INDEX_op_ext8s_i64:
--        c = EXTSB;
--        goto gen_ext;
-+        tcg_out_ext8s(s, args[0], args[1]);
-+        break;
-     case INDEX_op_ext16s_i32:
-     case INDEX_op_ext16s_i64:
--        c = EXTSH;
--        goto gen_ext;
-+        tcg_out_ext16s(s, args[0], args[1]);
-+        break;
-     case INDEX_op_ext_i32_i64:
-     case INDEX_op_ext32s_i64:
--        c = EXTSW;
--        goto gen_ext;
--    gen_ext:
--        tcg_out32(s, c | RS(args[1]) | RA(args[0]));
-+        tcg_out_ext32s(s, args[0], args[1]);
-         break;
-     case INDEX_op_extu_i32_i64:
-         tcg_out_ext32u(s, args[0], args[1]);
---
-.25.1

-[PULL 41/63] tcg/ppc: Split out tcg_out_sari{32,64}
+Deleted patch
-We will shortly require sari in other context;
-split out both for cleanliness sake.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/ppc/tcg-target.c.inc | 17 +++++++++++++----
-file changed, 13 insertions(+), 4 deletions(-)
-diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/ppc/tcg-target.c.inc
-+++ b/tcg/ppc/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_shli64(TCGContext *s, TCGReg dst, TCGReg src, int c)
-     tcg_out_rld(s, RLDICR, dst, src, c, 63 - c);
- }
-+static inline void tcg_out_sari32(TCGContext *s, TCGReg dst, TCGReg src, int c)
-+{
-+    /* Limit immediate shift count lest we create an illegal insn.  */
-+    tcg_out32(s, SRAWI | RA(dst) | RS(src) | SH(c & 31));
-+}
-+
- static inline void tcg_out_shri32(TCGContext *s, TCGReg dst, TCGReg src, int c)
- {
-     tcg_out_rlw(s, RLWINM, dst, src, 32 - c, c, 31);
-@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_shri64(TCGContext *s, TCGReg dst, TCGReg src, int c)
-     tcg_out_rld(s, RLDICL, dst, src, 64 - c, c);
- }
-+static inline void tcg_out_sari64(TCGContext *s, TCGReg dst, TCGReg src, int c)
-+{
-+    tcg_out32(s, SRADI | RA(dst) | RS(src) | SH(c & 0x1f) | ((c >> 4) & 2));
-+}
-+
- /* Emit a move into ret of arg, if it can be done in one insn.  */
- static bool tcg_out_movi_one(TCGContext *s, TCGReg ret, tcg_target_long arg)
- {
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
-         break;
-     case INDEX_op_sar_i32:
-         if (const_args[2]) {
--            /* Limit immediate shift count lest we create an illegal insn.  */
--            tcg_out32(s, SRAWI | RS(args[1]) | RA(args[0]) | SH(args[2] & 31));
-+            tcg_out_sari32(s, args[0], args[1], args[2]);
-         } else {
-             tcg_out32(s, SRAW | SAB(args[1], args[0], args[2]));
-         }
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
-         break;
-     case INDEX_op_sar_i64:
-         if (const_args[2]) {
--            int sh = SH(args[2] & 0x1f) | (((args[2] >> 5) & 1) << 1);
--            tcg_out32(s, SRADI | RA(args[0]) | RS(args[1]) | sh);
-+            tcg_out_sari64(s, args[0], args[1], args[2]);
-         } else {
-             tcg_out32(s, SRAD | SAB(args[1], args[0], args[2]));
-         }
---
-.25.1

-[PULL 42/63] tcg/ppc: Split out tcg_out_bswap16
+Deleted patch
-With the use of a suitable temporary, we can use the same
-algorithm when src overlaps dst.  The result is the same
-number of instructions either way.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/ppc/tcg-target.c.inc | 34 +++++++++++++++++++---------------
-file changed, 19 insertions(+), 15 deletions(-)
-diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/ppc/tcg-target.c.inc
-+++ b/tcg/ppc/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_sari64(TCGContext *s, TCGReg dst, TCGReg src, int c)
-     tcg_out32(s, SRADI | RA(dst) | RS(src) | SH(c & 0x1f) | ((c >> 4) & 2));
- }
-+static void tcg_out_bswap16(TCGContext *s, TCGReg dst, TCGReg src)
-+{
-+    TCGReg tmp = dst == src ? TCG_REG_R0 : dst;
-+
-+    /*
-+     * In the following,
-+     *   dep(a, b, m) -> (a & ~m) | (b & m)
-+     *
-+     * Begin with:                              src = xxxxabcd
-+     */
-+    /* tmp = rol32(src, 24) & 0x000000ff            = 0000000c */
-+    tcg_out_rlw(s, RLWINM, tmp, src, 24, 24, 31);
-+    /* tmp = dep(tmp, rol32(src, 8), 0x0000ff00)    = 000000dc */
-+    tcg_out_rlw(s, RLWIMI, tmp, src, 8, 16, 23);
-+
-+    tcg_out_mov(s, TCG_TYPE_REG, dst, tmp);
-+}
-+
- /* Emit a move into ret of arg, if it can be done in one insn.  */
- static bool tcg_out_movi_one(TCGContext *s, TCGReg ret, tcg_target_long arg)
- {
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
-     case INDEX_op_bswap16_i32:
-     case INDEX_op_bswap16_i64:
--        a0 = args[0], a1 = args[1];
--        /* a1 = abcd */
--        if (a0 != a1) {
--            /* a0 = (a1 r<< 24) & 0xff # 000c */
--            tcg_out_rlw(s, RLWINM, a0, a1, 24, 24, 31);
--            /* a0 = (a0 & ~0xff00) | (a1 r<< 8) & 0xff00 # 00dc */
--            tcg_out_rlw(s, RLWIMI, a0, a1, 8, 16, 23);
--        } else {
--            /* r0 = (a1 r<< 8) & 0xff00 # 00d0 */
--            tcg_out_rlw(s, RLWINM, TCG_REG_R0, a1, 8, 16, 23);
--            /* a0 = (a1 r<< 24) & 0xff # 000c */
--            tcg_out_rlw(s, RLWINM, a0, a1, 24, 24, 31);
--            /* a0 = a0 | r0 # 00dc */
--            tcg_out32(s, OR | SAB(TCG_REG_R0, a0, a0));
--        }
-+        tcg_out_bswap16(s, args[0], args[1]);
-         break;
-     case INDEX_op_bswap32_i32:
---
-.25.1

-[PULL 43/63] tcg/ppc: Split out tcg_out_bswap32
+Deleted patch
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/ppc/tcg-target.c.inc | 38 ++++++++++++++++++++++----------------
-file changed, 22 insertions(+), 16 deletions(-)
-diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/ppc/tcg-target.c.inc
-+++ b/tcg/ppc/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_bswap16(TCGContext *s, TCGReg dst, TCGReg src)
-     tcg_out_mov(s, TCG_TYPE_REG, dst, tmp);
- }
-+static void tcg_out_bswap32(TCGContext *s, TCGReg dst, TCGReg src)
-+{
-+    TCGReg tmp = dst == src ? TCG_REG_R0 : dst;
-+
-+    /*
-+     * Stolen from gcc's builtin_bswap32.
-+     * In the following,
-+     *   dep(a, b, m) -> (a & ~m) | (b & m)
-+     *
-+     * Begin with:                              src = xxxxabcd
-+     */
-+    /* tmp = rol32(src, 8) & 0xffffffff             = 0000bcda */
-+    tcg_out_rlw(s, RLWINM, tmp, src, 8, 0, 31);
-+    /* tmp = dep(tmp, rol32(src, 24), 0xff000000)   = 0000dcda */
-+    tcg_out_rlw(s, RLWIMI, tmp, src, 24, 0, 7);
-+    /* tmp = dep(tmp, rol32(src, 24), 0x0000ff00)   = 0000dcba */
-+    tcg_out_rlw(s, RLWIMI, tmp, src, 24, 16, 23);
-+
-+    tcg_out_mov(s, TCG_TYPE_REG, dst, tmp);
-+}
-+
- /* Emit a move into ret of arg, if it can be done in one insn.  */
- static bool tcg_out_movi_one(TCGContext *s, TCGReg ret, tcg_target_long arg)
- {
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
-     case INDEX_op_bswap16_i64:
-         tcg_out_bswap16(s, args[0], args[1]);
-         break;
--
-     case INDEX_op_bswap32_i32:
-     case INDEX_op_bswap32_i64:
--        /* Stolen from gcc's builtin_bswap32 */
--        a1 = args[1];
--        a0 = args[0] == a1 ? TCG_REG_R0 : args[0];
--
--        /* a1 = args[1] # abcd */
--        /* a0 = rotate_left (a1, 8) # bcda */
--        tcg_out_rlw(s, RLWINM, a0, a1, 8, 0, 31);
--        /* a0 = (a0 & ~0xff000000) | ((a1 r<< 24) & 0xff000000) # dcda */
--        tcg_out_rlw(s, RLWIMI, a0, a1, 24, 0, 7);
--        /* a0 = (a0 & ~0x0000ff00) | ((a1 r<< 24) & 0x0000ff00) # dcba */
--        tcg_out_rlw(s, RLWIMI, a0, a1, 24, 16, 23);
--
--        if (a0 == TCG_REG_R0) {
--            tcg_out_mov(s, TCG_TYPE_REG, args[0], a0);
--        }
-+        tcg_out_bswap32(s, args[0], args[1]);
-         break;
-     case INDEX_op_bswap64_i64:
---
-.25.1

-[PULL 44/63] tcg/ppc: Split out tcg_out_bswap64
+Deleted patch
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/ppc/tcg-target.c.inc | 64 +++++++++++++++++++++-------------------
-file changed, 34 insertions(+), 30 deletions(-)
-diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/ppc/tcg-target.c.inc
-+++ b/tcg/ppc/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_bswap32(TCGContext *s, TCGReg dst, TCGReg src)
-     tcg_out_mov(s, TCG_TYPE_REG, dst, tmp);
- }
-+static void tcg_out_bswap64(TCGContext *s, TCGReg dst, TCGReg src)
-+{
-+    TCGReg t0 = dst == src ? TCG_REG_R0 : dst;
-+    TCGReg t1 = dst == src ? dst : TCG_REG_R0;
-+
-+    /*
-+     * In the following,
-+     *   dep(a, b, m) -> (a & ~m) | (b & m)
-+     *
-+     * Begin with:                              src = abcdefgh
-+     */
-+    /* t0 = rol32(src, 8) & 0xffffffff              = 0000fghe */
-+    tcg_out_rlw(s, RLWINM, t0, src, 8, 0, 31);
-+    /* t0 = dep(t0, rol32(src, 24), 0xff000000)     = 0000hghe */
-+    tcg_out_rlw(s, RLWIMI, t0, src, 24, 0, 7);
-+    /* t0 = dep(t0, rol32(src, 24), 0x0000ff00)     = 0000hgfe */
-+    tcg_out_rlw(s, RLWIMI, t0, src, 24, 16, 23);
-+
-+    /* t0 = rol64(t0, 32)                           = hgfe0000 */
-+    tcg_out_rld(s, RLDICL, t0, t0, 32, 0);
-+    /* t1 = rol64(src, 32)                          = efghabcd */
-+    tcg_out_rld(s, RLDICL, t1, src, 32, 0);
-+
-+    /* t0 = dep(t0, rol32(t1, 24), 0xffffffff)      = hgfebcda */
-+    tcg_out_rlw(s, RLWIMI, t0, t1, 8, 0, 31);
-+    /* t0 = dep(t0, rol32(t1, 24), 0xff000000)      = hgfedcda */
-+    tcg_out_rlw(s, RLWIMI, t0, t1, 24, 0, 7);
-+    /* t0 = dep(t0, rol32(t1, 24), 0x0000ff00)      = hgfedcba */
-+    tcg_out_rlw(s, RLWIMI, t0, t1, 24, 16, 23);
-+
-+    tcg_out_mov(s, TCG_TYPE_REG, dst, t0);
-+}
-+
- /* Emit a move into ret of arg, if it can be done in one insn.  */
- static bool tcg_out_movi_one(TCGContext *s, TCGReg ret, tcg_target_long arg)
- {
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
-     case INDEX_op_bswap32_i64:
-         tcg_out_bswap32(s, args[0], args[1]);
-         break;
--
-     case INDEX_op_bswap64_i64:
--        a0 = args[0], a1 = args[1], a2 = TCG_REG_R0;
--        if (a0 == a1) {
--            a0 = TCG_REG_R0;
--            a2 = a1;
--        }
--
--        /* a1 = # abcd efgh */
--        /* a0 = rl32(a1, 8) # 0000 fghe */
--        tcg_out_rlw(s, RLWINM, a0, a1, 8, 0, 31);
--        /* a0 = dep(a0, rl32(a1, 24), 0xff000000) # 0000 hghe */
--        tcg_out_rlw(s, RLWIMI, a0, a1, 24, 0, 7);
--        /* a0 = dep(a0, rl32(a1, 24), 0x0000ff00) # 0000 hgfe */
--        tcg_out_rlw(s, RLWIMI, a0, a1, 24, 16, 23);
--
--        /* a0 = rl64(a0, 32) # hgfe 0000 */
--        /* a2 = rl64(a1, 32) # efgh abcd */
--        tcg_out_rld(s, RLDICL, a0, a0, 32, 0);
--        tcg_out_rld(s, RLDICL, a2, a1, 32, 0);
--
--        /* a0 = dep(a0, rl32(a2, 8), 0xffffffff)  # hgfe bcda */
--        tcg_out_rlw(s, RLWIMI, a0, a2, 8, 0, 31);
--        /* a0 = dep(a0, rl32(a2, 24), 0xff000000) # hgfe dcda */
--        tcg_out_rlw(s, RLWIMI, a0, a2, 24, 0, 7);
--        /* a0 = dep(a0, rl32(a2, 24), 0x0000ff00) # hgfe dcba */
--        tcg_out_rlw(s, RLWIMI, a0, a2, 24, 16, 23);
--
--        if (a0 == 0) {
--            tcg_out_mov(s, TCG_TYPE_REG, args[0], a0);
--        }
-+        tcg_out_bswap64(s, args[0], args[1]);
-         break;
-     case INDEX_op_deposit_i32:
---
-.25.1

-[PULL 46/63] tcg/ppc: Use power10 byte-reverse instructions
+[PULL 19/20] tcg/ppc: Optimize 26-bit jumps
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+From: Leandro Lupori <leandro.lupori@eldorado.org.br>
 PowerPC64 processors handle direct branches better than indirect
 ones, resulting in less stalled cycles and branch misses.
 However, PPC's tb_target_set_jmp_target() was only using direct
 branches for 16-bit jumps, while PowerPC64's unconditional branch
 instructions are able to handle displacements of up to 26 bits.
 To take advantage of this, now jumps whose displacements fit in
 between 17 and 26 bits are also converted to direct branches.
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Leandro Lupori <leandro.lupori@eldorado.org.br>
 [rth: Expanded some commentary.]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/ppc/tcg-target.c.inc | 34 ++++++++++++++++++++++++++++++++++
+ tcg/ppc/tcg-target.c.inc | 119 +++++++++++++++++++++++++++++----------
-file changed, 34 insertions(+)
+file changed, 88 insertions(+), 31 deletions(-)
 diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/ppc/tcg-target.c.inc
 +++ b/tcg/ppc/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_mb(TCGContext *s, TCGArg a0)
- #define SRAD   XO31(794)
+     tcg_out32(s, insn);
  #define SRADI  XO31(413<<1)
 +#define BRH    XO31(219)
 +#define BRW    XO31(155)
 +#define BRD    XO31(187)
 +
  #define TW     XO31( 4)
  #define TRAP   (TW | TO(31))
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_ext16s(TCGContext *s, TCGReg dst, TCGReg src)
      tcg_out32(s, EXTSH | RA(dst) | RS(src));
  }
-+static inline void tcg_out_ext16u(TCGContext *s, TCGReg dst, TCGReg src)
++static inline uint64_t make_pair(tcg_insn_unit i1, tcg_insn_unit i2)
 +{
-+    tcg_out32(s, ANDI | SAI(src, dst, 0xffff));
++    if (HOST_BIG_ENDIAN) {
 +        return (uint64_t)i1 << 32 | i2;
 +    }
 +    return (uint64_t)i2 << 32 | i1;
 +}
 +
- static inline void tcg_out_ext32s(TCGContext *s, TCGReg dst, TCGReg src)
++static inline void ppc64_replace2(uintptr_t rx, uintptr_t rw,
 +                                  tcg_insn_unit i0, tcg_insn_unit i1)
 +{
 +#if TCG_TARGET_REG_BITS == 64
 +    qatomic_set((uint64_t *)rw, make_pair(i0, i1));
 +    flush_idcache_range(rx, rw, 8);
 +#else
 +    qemu_build_not_reached();
 +#endif
 +}
 +
 +static inline void ppc64_replace4(uintptr_t rx, uintptr_t rw,
 +                                  tcg_insn_unit i0, tcg_insn_unit i1,
 +                                  tcg_insn_unit i2, tcg_insn_unit i3)
 +{
 +    uint64_t p[2];
 +
 +    p[!HOST_BIG_ENDIAN] = make_pair(i0, i1);
 +    p[HOST_BIG_ENDIAN] = make_pair(i2, i3);
 +
 +    /*
 +     * There's no convenient way to get the compiler to allocate a pair
 +     * of registers at an even index, so copy into r6/r7 and clobber.
 +     */
 +    asm("mr  %%r6, %1\n\t"
 +        "mr  %%r7, %2\n\t"
 +        "stq %%r6, %0"
 +        : "=Q"(*(__int128 *)rw) : "r"(p[0]), "r"(p[1]) : "r6", "r7");
 +    flush_idcache_range(rx, rw, 16);
 +}
 +
  void tb_target_set_jmp_target(uintptr_t tc_ptr, uintptr_t jmp_rx,
                                uintptr_t jmp_rw, uintptr_t addr)
  {
-     tcg_out32(s, EXTSW | RA(dst) | RS(src));
+-    if (TCG_TARGET_REG_BITS == 64) {
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_bswap16(TCGContext *s, TCGReg dst, TCGReg src, int flags)
+-        tcg_insn_unit i1, i2;
- {
+-        intptr_t tb_diff = addr - tc_ptr;
-     TCGReg tmp = dst == src ? TCG_REG_R0 : dst;
+-        intptr_t br_diff = addr - (jmp_rx + 4);
+-        uint64_t pair;
-+    if (have_isa_3_10) {
++    tcg_insn_unit i0, i1, i2, i3;
-+        tcg_out32(s, BRH | RA(dst) | RS(src));
++    intptr_t tb_diff = addr - tc_ptr;
-+        if (flags & TCG_BSWAP_OS) {
++    intptr_t br_diff = addr - (jmp_rx + 4);
-+            tcg_out_ext16s(s, dst, dst);
++    intptr_t lo, hi;
-+        } else if ((flags & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
-+            tcg_out_ext16u(s, dst, dst);
+-        /* This does not exercise the range of the branch, but we do
-+        }
+-           still need to be able to load the new value of TCG_REG_TB.
 -           But this does still happen quite often.  */
 -        if (tb_diff == (int16_t)tb_diff) {
 -            i1 = ADDI | TAI(TCG_REG_TB, TCG_REG_TB, tb_diff);
 -            i2 = B | (br_diff & 0x3fffffc);
 -        } else {
 -            intptr_t lo = (int16_t)tb_diff;
 -            intptr_t hi = (int32_t)(tb_diff - lo);
 -            assert(tb_diff == hi + lo);
 -            i1 = ADDIS | TAI(TCG_REG_TB, TCG_REG_TB, hi >> 16);
 -            i2 = ADDI | TAI(TCG_REG_TB, TCG_REG_TB, lo);
 -        }
 -#if HOST_BIG_ENDIAN
 -        pair = (uint64_t)i1 << 32 | i2;
 -#else
 -        pair = (uint64_t)i2 << 32 | i1;
 -#endif
 -
 -        /* As per the enclosing if, this is ppc64.  Avoid the _Static_assert
 -           within qatomic_set that would fail to build a ppc32 host.  */
 -        qatomic_set__nocheck((uint64_t *)jmp_rw, pair);
 -        flush_idcache_range(jmp_rx, jmp_rw, 8);
 -    } else {
 +    if (TCG_TARGET_REG_BITS == 32) {
          intptr_t diff = addr - jmp_rx;
          tcg_debug_assert(in_range_b(diff));
          qatomic_set((uint32_t *)jmp_rw, B | (diff & 0x3fffffc));
          flush_idcache_range(jmp_rx, jmp_rw, 4);
 +        return;
      }
 +
 +    /*
 +     * For 16-bit displacements, we can use a single add + branch.
 +     * This happens quite often.
 +     */
 +    if (tb_diff == (int16_t)tb_diff) {
 +        i0 = ADDI | TAI(TCG_REG_TB, TCG_REG_TB, tb_diff);
 +        i1 = B | (br_diff & 0x3fffffc);
 +        ppc64_replace2(jmp_rx, jmp_rw, i0, i1);
 +        return;
 +    }
 +
-     /*
++    lo = (int16_t)tb_diff;
-      * In the following,
++    hi = (int32_t)(tb_diff - lo);
-      *   dep(a, b, m) -> (a & ~m) | (b & m)
++    assert(tb_diff == hi + lo);
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_bswap32(TCGContext *s, TCGReg dst, TCGReg src, int flags)
++    i0 = ADDIS | TAI(TCG_REG_TB, TCG_REG_TB, hi >> 16);
- {
++    i1 = ADDI | TAI(TCG_REG_TB, TCG_REG_TB, lo);
-     TCGReg tmp = dst == src ? TCG_REG_R0 : dst;
++
++    /*
-+    if (have_isa_3_10) {
++     * Without stq from 2.07, we can only update two insns,
-+        tcg_out32(s, BRW | RA(dst) | RS(src));
++     * and those must be the ones that load the target address.
-+        if (flags & TCG_BSWAP_OS) {
++     */
-+            tcg_out_ext32s(s, dst, dst);
++    if (!have_isa_2_07) {
-+        } else if ((flags & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
++        ppc64_replace2(jmp_rx, jmp_rw, i0, i1);
 +            tcg_out_ext32u(s, dst, dst);
 +        }
 +        return;
 +    }
 +
-     /*
++    /*
-      * Stolen from gcc's builtin_bswap32.
++     * For 26-bit displacements, we can use a direct branch.
-      * In the following,
++     * Otherwise we still need the indirect branch, which we
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_bswap64(TCGContext *s, TCGReg dst, TCGReg src)
++     * must restore after a potential direct branch write.
-     TCGReg t0 = dst == src ? TCG_REG_R0 : dst;
++     */
-     TCGReg t1 = dst == src ? dst : TCG_REG_R0;
++    br_diff -= 4;
++    if (in_range_b(br_diff)) {
-+    if (have_isa_3_10) {
++        i2 = B | (br_diff & 0x3fffffc);
-+        tcg_out32(s, BRD | RA(dst) | RS(src));
++        i3 = NOP;
-+        return;
++    } else {
 +        i2 = MTSPR | RS(TCG_REG_TB) | CTR;
 +        i3 = BCCTR | BO_ALWAYS;
 +    }
-+
++    ppc64_replace4(jmp_rx, jmp_rw, i0, i1, i2, i3);
-     /*
+ }
-      * In the following,
-      *   dep(a, b, m) -> (a & ~m) | (b & m)
+ static void tcg_out_call_int(TCGContext *s, int lk,
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          if (s->tb_jmp_insn_offset) {
              /* Direct jump. */
              if (TCG_TARGET_REG_BITS == 64) {
 -                /* Ensure the next insns are 8-byte aligned. */
 -                if ((uintptr_t)s->code_ptr & 7) {
 +                /* Ensure the next insns are 8 or 16-byte aligned. */
 +                while ((uintptr_t)s->code_ptr & (have_isa_2_07 ? 15 : 7)) {
                      tcg_out32(s, NOP);
                  }
                  s->tb_jmp_insn_offset[args[0]] = tcg_current_code_size(s);
 --
-.25.1
+.34.1

-[PULL 47/63] tcg/s390: Support bswap flags
+Deleted patch
-For INDEX_op_bswap16_i64, use 64-bit instructions so that we can
-easily provide the extension to 64-bits.  Drop the special case,
-previously used, where the input is already zero-extended -- the
-minor code size savings is not worth the complication.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/s390/tcg-target.c.inc | 34 ++++++++++++++++++++++++++++------
-file changed, 28 insertions(+), 6 deletions(-)
-diff --git a/tcg/s390/tcg-target.c.inc b/tcg/s390/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/s390/tcg-target.c.inc
-+++ b/tcg/s390/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
-         tgen_ext16u(s, TCG_TYPE_I32, args[0], args[1]);
-         break;
--    OP_32_64(bswap16):
--        /* The TCG bswap definition requires bits 0-47 already be zero.
--           Thus we don't need the G-type insns to implement bswap16_i64.  */
--        tcg_out_insn(s, RRE, LRVR, args[0], args[1]);
--        tcg_out_sh32(s, RS_SRL, args[0], TCG_REG_NONE, 16);
-+    case INDEX_op_bswap16_i32:
-+        a0 = args[0], a1 = args[1], a2 = args[2];
-+        tcg_out_insn(s, RRE, LRVR, a0, a1);
-+        if (a2 & TCG_BSWAP_OS) {
-+            tcg_out_sh32(s, RS_SRA, a0, TCG_REG_NONE, 16);
-+        } else {
-+            tcg_out_sh32(s, RS_SRL, a0, TCG_REG_NONE, 16);
-+        }
-         break;
--    OP_32_64(bswap32):
-+    case INDEX_op_bswap16_i64:
-+        a0 = args[0], a1 = args[1], a2 = args[2];
-+        tcg_out_insn(s, RRE, LRVGR, a0, a1);
-+        if (a2 & TCG_BSWAP_OS) {
-+            tcg_out_sh64(s, RSY_SRAG, a0, a0, TCG_REG_NONE, 48);
-+        } else {
-+            tcg_out_sh64(s, RSY_SRLG, a0, a0, TCG_REG_NONE, 48);
-+        }
-+        break;
-+
-+    case INDEX_op_bswap32_i32:
-         tcg_out_insn(s, RRE, LRVR, args[0], args[1]);
-         break;
-+    case INDEX_op_bswap32_i64:
-+        a0 = args[0], a1 = args[1], a2 = args[2];
-+        tcg_out_insn(s, RRE, LRVR, a0, a1);
-+        if (a2 & TCG_BSWAP_OS) {
-+            tgen_ext32s(s, a0, a0);
-+        } else if ((a2 & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
-+            tgen_ext32u(s, a0, a0);
-+        }
-+        break;
-     case INDEX_op_add2_i32:
-         if (const_args[4]) {
---
-.25.1

-[PULL 51/63] tcg: Handle new bswap flags during optimize
+Deleted patch
-Notice when the input is known to be zero-extended and force
-the TCG_BSWAP_IZ flag on.  Honor the TCG_BSWAP_OS bit during
-constant folding.  Propagate the input to the output mask.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/optimize.c | 56 +++++++++++++++++++++++++++++++++++++++++++++-----
-file changed, 51 insertions(+), 5 deletions(-)
-diff --git a/tcg/optimize.c b/tcg/optimize.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/optimize.c
-+++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t do_constant_folding_2(TCGOpcode op, uint64_t x, uint64_t y)
-         return (uint16_t)x;
-     CASE_OP_32_64(bswap16):
--        return bswap16(x);
-+        x = bswap16(x);
-+        return y & TCG_BSWAP_OS ? (int16_t)x : x;
-     CASE_OP_32_64(bswap32):
--        return bswap32(x);
-+        x = bswap32(x);
-+        return y & TCG_BSWAP_OS ? (int32_t)x : x;
-     case INDEX_op_bswap64_i64:
-         return bswap64(x);
-@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
-             }
-             break;
-+        CASE_OP_32_64(bswap16):
-+            mask = arg_info(op->args[1])->mask;
-+            if (mask <= 0xffff) {
-+                op->args[2] |= TCG_BSWAP_IZ;
-+            }
-+            mask = bswap16(mask);
-+            switch (op->args[2] & (TCG_BSWAP_OZ | TCG_BSWAP_OS)) {
-+            case TCG_BSWAP_OZ:
-+                break;
-+            case TCG_BSWAP_OS:
-+                mask = (int16_t)mask;
-+                break;
-+            default: /* undefined high bits */
-+                mask |= MAKE_64BIT_MASK(16, 48);
-+                break;
-+            }
-+            break;
-+
-+        case INDEX_op_bswap32_i64:
-+            mask = arg_info(op->args[1])->mask;
-+            if (mask <= 0xffffffffu) {
-+                op->args[2] |= TCG_BSWAP_IZ;
-+            }
-+            mask = bswap32(mask);
-+            switch (op->args[2] & (TCG_BSWAP_OZ | TCG_BSWAP_OS)) {
-+            case TCG_BSWAP_OZ:
-+                break;
-+            case TCG_BSWAP_OS:
-+                mask = (int32_t)mask;
-+                break;
-+            default: /* undefined high bits */
-+                mask |= MAKE_64BIT_MASK(32, 32);
-+                break;
-+            }
-+            break;
-+
-         default:
-             break;
-         }
-@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
-         CASE_OP_32_64(ext16s):
-         CASE_OP_32_64(ext16u):
-         CASE_OP_32_64(ctpop):
--        CASE_OP_32_64(bswap16):
--        CASE_OP_32_64(bswap32):
--        case INDEX_op_bswap64_i64:
-         case INDEX_op_ext32s_i64:
-         case INDEX_op_ext32u_i64:
-         case INDEX_op_ext_i32_i64:
-@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
-             }
-             goto do_default;
-+        CASE_OP_32_64(bswap16):
-+        CASE_OP_32_64(bswap32):
-+        case INDEX_op_bswap64_i64:
-+            if (arg_is_const(op->args[1])) {
-+                tmp = do_constant_folding(opc, arg_info(op->args[1])->val,
-+                                          op->args[2]);
-+                tcg_opt_gen_movi(s, &temps_used, op, op->args[0], tmp);
-+                break;
-+            }
-+            goto do_default;
-+
-         CASE_OP_32_64(add):
-         CASE_OP_32_64(sub):
-         CASE_OP_32_64(mul):
---
-.25.1

-[PULL 52/63] tcg: Add flags argument to tcg_gen_bswap16_*, tcg_gen_bswap32_i64
+[PULL 20/20] target/sh4: Fix TB_FLAG_UNALIGN
-Implement the new semantics in the fallback expansion.
+The value previously chosen overlaps GUSA_MASK.
 Change all callers to supply the flags that keep the
 semantics unchanged locally.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Rename all DELAY_SLOT_* and GUSA_* defines to emphasize
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+that they are included in TB_FLAGs.  Add aliases for the
 FPSCR and SR bits that are included in TB_FLAGS, so that
 we don't accidentally reassign those bits.
 Fixes: 4da06fb3062 ("target/sh4: Implement prctl_unalign_sigbus")
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/856
 Reviewed-by: Yoshinori Sato <ysato@users.sourceforge.jp>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/tcg/tcg-op.h            |   8 +--
+ target/sh4/cpu.h        | 56 +++++++++++++------------
- target/arm/translate-a64.c      |  12 ++--
+ linux-user/sh4/signal.c |  6 +--
- target/arm/translate.c          |   2 +-
+ target/sh4/cpu.c        |  6 +--
- target/i386/tcg/translate.c     |   2 +-
+ target/sh4/helper.c     |  6 +--
- target/mips/tcg/mxu_translate.c |   2 +-
+ target/sh4/translate.c  | 90 ++++++++++++++++++++++-------------------
- target/s390x/translate.c        |   4 +-
+files changed, 88 insertions(+), 76 deletions(-)
  target/sh4/translate.c          |   2 +-
  tcg/tcg-op.c                    | 121 ++++++++++++++++++++++----------
 files changed, 99 insertions(+), 54 deletions(-)
-diff --git a/include/tcg/tcg-op.h b/include/tcg/tcg-op.h
+diff --git a/target/sh4/cpu.h b/target/sh4/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/tcg/tcg-op.h
+--- a/target/sh4/cpu.h
-+++ b/include/tcg/tcg-op.h
++++ b/target/sh4/cpu.h
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_ext8s_i32(TCGv_i32 ret, TCGv_i32 arg);
+@@ -XXX,XX +XXX,XX @@
- void tcg_gen_ext16s_i32(TCGv_i32 ret, TCGv_i32 arg);
+ #define FPSCR_RM_NEAREST       (0 << 0)
- void tcg_gen_ext8u_i32(TCGv_i32 ret, TCGv_i32 arg);
+ #define FPSCR_RM_ZERO          (1 << 0)
- void tcg_gen_ext16u_i32(TCGv_i32 ret, TCGv_i32 arg);
--void tcg_gen_bswap16_i32(TCGv_i32 ret, TCGv_i32 arg);
+-#define DELAY_SLOT_MASK        0x7
-+void tcg_gen_bswap16_i32(TCGv_i32 ret, TCGv_i32 arg, int flags);
+-#define DELAY_SLOT             (1 << 0)
- void tcg_gen_bswap32_i32(TCGv_i32 ret, TCGv_i32 arg);
+-#define DELAY_SLOT_CONDITIONAL (1 << 1)
- void tcg_gen_smin_i32(TCGv_i32, TCGv_i32 arg1, TCGv_i32 arg2);
+-#define DELAY_SLOT_RTE         (1 << 2)
- void tcg_gen_smax_i32(TCGv_i32, TCGv_i32 arg1, TCGv_i32 arg2);
++#define TB_FLAG_DELAY_SLOT       (1 << 0)
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_ext32s_i64(TCGv_i64 ret, TCGv_i64 arg);
++#define TB_FLAG_DELAY_SLOT_COND  (1 << 1)
- void tcg_gen_ext8u_i64(TCGv_i64 ret, TCGv_i64 arg);
++#define TB_FLAG_DELAY_SLOT_RTE   (1 << 2)
- void tcg_gen_ext16u_i64(TCGv_i64 ret, TCGv_i64 arg);
++#define TB_FLAG_PENDING_MOVCA    (1 << 3)
- void tcg_gen_ext32u_i64(TCGv_i64 ret, TCGv_i64 arg);
++#define TB_FLAG_GUSA_SHIFT       4                      /* [11:4] */
--void tcg_gen_bswap16_i64(TCGv_i64 ret, TCGv_i64 arg);
++#define TB_FLAG_GUSA_EXCLUSIVE   (1 << 12)
--void tcg_gen_bswap32_i64(TCGv_i64 ret, TCGv_i64 arg);
++#define TB_FLAG_UNALIGN          (1 << 13)
-+void tcg_gen_bswap16_i64(TCGv_i64 ret, TCGv_i64 arg, int flags);
++#define TB_FLAG_SR_FD            (1 << SR_FD)           /* 15 */
-+void tcg_gen_bswap32_i64(TCGv_i64 ret, TCGv_i64 arg, int flags);
++#define TB_FLAG_FPSCR_PR         FPSCR_PR               /* 19 */
- void tcg_gen_bswap64_i64(TCGv_i64 ret, TCGv_i64 arg);
++#define TB_FLAG_FPSCR_SZ         FPSCR_SZ               /* 20 */
- void tcg_gen_smin_i64(TCGv_i64, TCGv_i64 arg1, TCGv_i64 arg2);
++#define TB_FLAG_FPSCR_FR         FPSCR_FR               /* 21 */
- void tcg_gen_smax_i64(TCGv_i64, TCGv_i64 arg1, TCGv_i64 arg2);
++#define TB_FLAG_SR_RB            (1 << SR_RB)           /* 29 */
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_stl_vec(TCGv_vec r, TCGv_ptr base, TCGArg offset, TCGType t);
++#define TB_FLAG_SR_MD            (1 << SR_MD)           /* 30 */
- #define tcg_gen_ext32u_tl tcg_gen_mov_i32
- #define tcg_gen_ext32s_tl tcg_gen_mov_i32
+-#define TB_FLAG_PENDING_MOVCA  (1 << 3)
- #define tcg_gen_bswap16_tl tcg_gen_bswap16_i32
+-#define TB_FLAG_UNALIGN        (1 << 4)
--#define tcg_gen_bswap32_tl tcg_gen_bswap32_i32
+-
-+#define tcg_gen_bswap32_tl(D, S, F) tcg_gen_bswap32_i32(D, S)
+-#define GUSA_SHIFT             4
- #define tcg_gen_bswap_tl tcg_gen_bswap32_i32
+-#ifdef CONFIG_USER_ONLY
- #define tcg_gen_concat_tl_i64 tcg_gen_concat_i32_i64
+-#define GUSA_EXCLUSIVE         (1 << 12)
- #define tcg_gen_extr_i64_tl tcg_gen_extr_i64_i32
+-#define GUSA_MASK              ((0xff << GUSA_SHIFT) | GUSA_EXCLUSIVE)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+-#else
 -/* Provide dummy versions of the above to allow tests against tbflags
 -   to be elided while avoiding ifdefs.  */
 -#define GUSA_EXCLUSIVE         0
 -#define GUSA_MASK              0
 -#endif
 -
 -#define TB_FLAG_ENVFLAGS_MASK  (DELAY_SLOT_MASK | GUSA_MASK)
 +#define TB_FLAG_DELAY_SLOT_MASK  (TB_FLAG_DELAY_SLOT |       \
 +                                  TB_FLAG_DELAY_SLOT_COND |  \
 +                                  TB_FLAG_DELAY_SLOT_RTE)
 +#define TB_FLAG_GUSA_MASK        ((0xff << TB_FLAG_GUSA_SHIFT) | \
 +                                  TB_FLAG_GUSA_EXCLUSIVE)
 +#define TB_FLAG_FPSCR_MASK       (TB_FLAG_FPSCR_PR | \
 +                                  TB_FLAG_FPSCR_SZ | \
 +                                  TB_FLAG_FPSCR_FR)
 +#define TB_FLAG_SR_MASK          (TB_FLAG_SR_FD | \
 +                                  TB_FLAG_SR_RB | \
 +                                  TB_FLAG_SR_MD)
 +#define TB_FLAG_ENVFLAGS_MASK    (TB_FLAG_DELAY_SLOT_MASK | \
 +                                  TB_FLAG_GUSA_MASK)
  typedef struct tlb_t {
      uint32_t vpn;        /* virtual page number */
@@ -XXX,XX +XXX,XX @@ static inline int cpu_mmu_index (CPUSH4State *env, bool ifetch)
  {
      /* The instruction in a RTE delay slot is fetched in privileged
         mode, but executed in user mode.  */
 -    if (ifetch && (env->flags & DELAY_SLOT_RTE)) {
 +    if (ifetch && (env->flags & TB_FLAG_DELAY_SLOT_RTE)) {
          return 0;
      } else {
          return (env->sr & (1u << SR_MD)) == 0 ? 1 : 0;
@@ -XXX,XX +XXX,XX @@ static inline void cpu_get_tb_cpu_state(CPUSH4State *env, target_ulong *pc,
  {
      *pc = env->pc;
      /* For a gUSA region, notice the end of the region.  */
 -    *cs_base = env->flags & GUSA_MASK ? env->gregs[0] : 0;
 -    *flags = env->flags /* TB_FLAG_ENVFLAGS_MASK: bits 0-2, 4-12 */
 -            | (env->fpscr & (FPSCR_FR | FPSCR_SZ | FPSCR_PR))  /* Bits 19-21 */
 -            | (env->sr & ((1u << SR_MD) | (1u << SR_RB)))      /* Bits 29-30 */
 -            | (env->sr & (1u << SR_FD))                        /* Bit 15 */
 +    *cs_base = env->flags & TB_FLAG_GUSA_MASK ? env->gregs[0] : 0;
 +    *flags = env->flags
 +            | (env->fpscr & TB_FLAG_FPSCR_MASK)
 +            | (env->sr & TB_FLAG_SR_MASK)
              | (env->movcal_backup ? TB_FLAG_PENDING_MOVCA : 0); /* Bit 3 */
  #ifdef CONFIG_USER_ONLY
      *flags |= TB_FLAG_UNALIGN * !env_cpu(env)->prctl_unalign_sigbus;
 diff --git a/linux-user/sh4/signal.c b/linux-user/sh4/signal.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/linux-user/sh4/signal.c
-+++ b/target/arm/translate-a64.c
++++ b/linux-user/sh4/signal.c
-@@ -XXX,XX +XXX,XX @@ static void handle_rev32(DisasContext *s, unsigned int sf,
+@@ -XXX,XX +XXX,XX @@ static void restore_sigcontext(CPUSH4State *regs, struct target_sigcontext *sc)
+     __get_user(regs->fpul, &sc->sc_fpul);
-         /* bswap32_i64 requires zero high word */
-         tcg_gen_ext32u_i64(tcg_tmp, tcg_rn);
+     regs->tra = -1;         /* disable syscall checks */
--        tcg_gen_bswap32_i64(tcg_rd, tcg_tmp);
+-    regs->flags &= ~(DELAY_SLOT_MASK | GUSA_MASK);
-+        tcg_gen_bswap32_i64(tcg_rd, tcg_tmp, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
++    regs->flags = 0;
          tcg_gen_shri_i64(tcg_tmp, tcg_rn, 32);
 -        tcg_gen_bswap32_i64(tcg_tmp, tcg_tmp);
 +        tcg_gen_bswap32_i64(tcg_tmp, tcg_tmp, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
          tcg_gen_concat32_i64(tcg_rd, tcg_rd, tcg_tmp);
          tcg_temp_free_i64(tcg_tmp);
      } else {
          tcg_gen_ext32u_i64(tcg_rd, cpu_reg(s, rn));
 -        tcg_gen_bswap32_i64(tcg_rd, tcg_rd);
 +        tcg_gen_bswap32_i64(tcg_rd, tcg_rd, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
      }
  }
-@@ -XXX,XX +XXX,XX @@ static void handle_rev(DisasContext *s, int opcode, bool u,
+ void setup_frame(int sig, struct target_sigaction *ka,
-             read_vec_element(s, tcg_tmp, rn, i, grp_size);
+@@ -XXX,XX +XXX,XX @@ void setup_frame(int sig, struct target_sigaction *ka,
-             switch (grp_size) {
+     regs->gregs[5] = 0;
-             case MO_16:
+     regs->gregs[6] = frame_addr += offsetof(typeof(*frame), sc);
--                tcg_gen_bswap16_i64(tcg_tmp, tcg_tmp);
+     regs->pc = (unsigned long) ka->_sa_handler;
-+                tcg_gen_bswap16_i64(tcg_tmp, tcg_tmp,
+-    regs->flags &= ~(DELAY_SLOT_MASK | GUSA_MASK);
-+                                    TCG_BSWAP_IZ | TCG_BSWAP_OZ);
++    regs->flags &= ~(TB_FLAG_DELAY_SLOT_MASK | TB_FLAG_GUSA_MASK);
-                 break;
-             case MO_32:
+     unlock_user_struct(frame, frame_addr, 1);
--                tcg_gen_bswap32_i64(tcg_tmp, tcg_tmp);
+     return;
-+                tcg_gen_bswap32_i64(tcg_tmp, tcg_tmp,
+@@ -XXX,XX +XXX,XX @@ void setup_rt_frame(int sig, struct target_sigaction *ka,
-+                                    TCG_BSWAP_IZ | TCG_BSWAP_OZ);
+     regs->gregs[5] = frame_addr + offsetof(typeof(*frame), info);
-                 break;
+     regs->gregs[6] = frame_addr + offsetof(typeof(*frame), uc);
-             case MO_64:
+     regs->pc = (unsigned long) ka->_sa_handler;
-                 tcg_gen_bswap64_i64(tcg_tmp, tcg_tmp);
+-    regs->flags &= ~(DELAY_SLOT_MASK | GUSA_MASK);
-diff --git a/target/arm/translate.c b/target/arm/translate.c
++    regs->flags &= ~(TB_FLAG_DELAY_SLOT_MASK | TB_FLAG_GUSA_MASK);
      unlock_user_struct(frame, frame_addr, 1);
      return;
 diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
+--- a/target/sh4/cpu.c
-+++ b/target/arm/translate.c
++++ b/target/sh4/cpu.c
-@@ -XXX,XX +XXX,XX @@ void gen_rev16(TCGv_i32 dest, TCGv_i32 var)
+@@ -XXX,XX +XXX,XX @@ static void superh_cpu_synchronize_from_tb(CPUState *cs,
- static void gen_revsh(TCGv_i32 dest, TCGv_i32 var)
+     SuperHCPU *cpu = SUPERH_CPU(cs);
- {
-     tcg_gen_ext16u_i32(var, var);
+     cpu->env.pc = tb_pc(tb);
--    tcg_gen_bswap16_i32(var, var);
+-    cpu->env.flags = tb->flags & TB_FLAG_ENVFLAGS_MASK;
-+    tcg_gen_bswap16_i32(var, var, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
++    cpu->env.flags = tb->flags;
      tcg_gen_ext16s_i32(dest, var);
  }
-diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
+ #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static bool superh_io_recompile_replay_branch(CPUState *cs,
      SuperHCPU *cpu = SUPERH_CPU(cs);
      CPUSH4State *env = &cpu->env;
 -    if ((env->flags & ((DELAY_SLOT | DELAY_SLOT_CONDITIONAL))) != 0
 +    if ((env->flags & (TB_FLAG_DELAY_SLOT | TB_FLAG_DELAY_SLOT_COND))
          && env->pc != tb_pc(tb)) {
          env->pc -= 2;
 -        env->flags &= ~(DELAY_SLOT | DELAY_SLOT_CONDITIONAL);
 +        env->flags &= ~(TB_FLAG_DELAY_SLOT | TB_FLAG_DELAY_SLOT_COND);
          return true;
      }
      return false;
 diff --git a/target/sh4/helper.c b/target/sh4/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/i386/tcg/translate.c
+--- a/target/sh4/helper.c
-+++ b/target/i386/tcg/translate.c
++++ b/target/sh4/helper.c
-@@ -XXX,XX +XXX,XX @@ static target_ulong disas_insn(DisasContext *s, CPUState *cpu)
+@@ -XXX,XX +XXX,XX @@ void superh_cpu_do_interrupt(CPUState *cs)
-         {
+     env->sr |= (1u << SR_BL) | (1u << SR_MD) | (1u << SR_RB);
-             gen_op_mov_v_reg(s, MO_32, s->T0, reg);
+     env->lock_addr = -1;
-             tcg_gen_ext32u_tl(s->T0, s->T0);
--            tcg_gen_bswap32_tl(s->T0, s->T0);
+-    if (env->flags & DELAY_SLOT_MASK) {
-+            tcg_gen_bswap32_tl(s->T0, s->T0, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
++    if (env->flags & TB_FLAG_DELAY_SLOT_MASK) {
-             gen_op_mov_reg_v(s, MO_32, reg, s->T0);
+         /* Branch instruction should be executed again before delay slot. */
-         }
+     env->spc -= 2;
-         break;
+     /* Clear flags for exception/interrupt routine. */
-diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
+-        env->flags &= ~DELAY_SLOT_MASK;
-index XXXXXXX..XXXXXXX 100644
++        env->flags &= ~TB_FLAG_DELAY_SLOT_MASK;
---- a/target/mips/tcg/mxu_translate.c
+     }
-+++ b/target/mips/tcg/mxu_translate.c
-@@ -XXX,XX +XXX,XX @@ static void gen_mxu_s32ldd_s32lddr(DisasContext *ctx)
+     if (do_exp) {
+@@ -XXX,XX +XXX,XX @@ bool superh_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-     if (sel == 1) {
+         CPUSH4State *env = &cpu->env;
-         /* S32LDDR */
--        tcg_gen_bswap32_tl(t1, t1);
+         /* Delay slots are indivisible, ignore interrupts */
-+        tcg_gen_bswap32_tl(t1, t1, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
+-        if (env->flags & DELAY_SLOT_MASK) {
-     }
++        if (env->flags & TB_FLAG_DELAY_SLOT_MASK) {
-     gen_store_mxu_gpr(t1, XRa);
+             return false;
+         } else {
-diff --git a/target/s390x/translate.c b/target/s390x/translate.c
+             superh_cpu_do_interrupt(cs);
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/translate.c
 +++ b/target/s390x/translate.c
@@ -XXX,XX +XXX,XX @@ static DisasJumpType op_rosbg(DisasContext *s, DisasOps *o)
  static DisasJumpType op_rev16(DisasContext *s, DisasOps *o)
  {
 -    tcg_gen_bswap16_i64(o->out, o->in2);
 +    tcg_gen_bswap16_i64(o->out, o->in2, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
      return DISAS_NEXT;
  }
  static DisasJumpType op_rev32(DisasContext *s, DisasOps *o)
  {
 -    tcg_gen_bswap32_i64(o->out, o->in2);
 +    tcg_gen_bswap32_i64(o->out, o->in2, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
      return DISAS_NEXT;
  }
 diff --git a/target/sh4/translate.c b/target/sh4/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sh4/translate.c
 +++ b/target/sh4/translate.c
-@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
+@@ -XXX,XX +XXX,XX @@ void superh_cpu_dump_state(CPUState *cs, FILE *f, int flags)
-     {
+             i, env->gregs[i], i + 1, env->gregs[i + 1],
-             TCGv low = tcg_temp_new();
+             i + 2, env->gregs[i + 2], i + 3, env->gregs[i + 3]);
-         tcg_gen_ext16u_i32(low, REG(B7_4));
+     }
--        tcg_gen_bswap16_i32(low, low);
+-    if (env->flags & DELAY_SLOT) {
-+        tcg_gen_bswap16_i32(low, low, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
++    if (env->flags & TB_FLAG_DELAY_SLOT) {
-             tcg_gen_deposit_i32(REG(B11_8), REG(B7_4), low, 0, 16);
+         qemu_printf("in delay slot (delayed_pc=0x%08x)\n",
-         tcg_temp_free(low);
+             env->delayed_pc);
-     }
+-    } else if (env->flags & DELAY_SLOT_CONDITIONAL) {
-diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
++    } else if (env->flags & TB_FLAG_DELAY_SLOT_COND) {
-index XXXXXXX..XXXXXXX 100644
+         qemu_printf("in conditional delay slot (delayed_pc=0x%08x)\n",
---- a/tcg/tcg-op.c
+             env->delayed_pc);
-+++ b/tcg/tcg-op.c
+-    } else if (env->flags & DELAY_SLOT_RTE) {
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_ext16u_i32(TCGv_i32 ret, TCGv_i32 arg)
++    } else if (env->flags & TB_FLAG_DELAY_SLOT_RTE) {
-     }
+         qemu_fprintf(f, "in rte delay slot (delayed_pc=0x%08x)\n",
                       env->delayed_pc);
      }
@@ -XXX,XX +XXX,XX @@ static inline void gen_save_cpu_state(DisasContext *ctx, bool save_pc)
  static inline bool use_exit_tb(DisasContext *ctx)
  {
 -    return (ctx->tbflags & GUSA_EXCLUSIVE) != 0;
 +    return (ctx->tbflags & TB_FLAG_GUSA_EXCLUSIVE) != 0;
  }
--/* Note: we assume the two high bytes are set to zero */
+ static bool use_goto_tb(DisasContext *ctx, target_ulong dest)
--void tcg_gen_bswap16_i32(TCGv_i32 ret, TCGv_i32 arg)
+@@ -XXX,XX +XXX,XX @@ static void gen_conditional_jump(DisasContext *ctx, target_ulong dest,
-+void tcg_gen_bswap16_i32(TCGv_i32 ret, TCGv_i32 arg, int flags)
+     TCGLabel *l1 = gen_new_label();
      TCGCond cond_not_taken = jump_if_true ? TCG_COND_EQ : TCG_COND_NE;
 -    if (ctx->tbflags & GUSA_EXCLUSIVE) {
 +    if (ctx->tbflags & TB_FLAG_GUSA_EXCLUSIVE) {
          /* When in an exclusive region, we must continue to the end.
             Therefore, exit the region on a taken branch, but otherwise
             fall through to the next instruction.  */
          tcg_gen_brcondi_i32(cond_not_taken, cpu_sr_t, 0, l1);
 -        tcg_gen_movi_i32(cpu_flags, ctx->envflags & ~GUSA_MASK);
 +        tcg_gen_movi_i32(cpu_flags, ctx->envflags & ~TB_FLAG_GUSA_MASK);
          /* Note that this won't actually use a goto_tb opcode because we
             disallow it in use_goto_tb, but it handles exit + singlestep.  */
          gen_goto_tb(ctx, 0, dest);
@@ -XXX,XX +XXX,XX @@ static void gen_delayed_conditional_jump(DisasContext * ctx)
      tcg_gen_mov_i32(ds, cpu_delayed_cond);
      tcg_gen_discard_i32(cpu_delayed_cond);
 -    if (ctx->tbflags & GUSA_EXCLUSIVE) {
 +    if (ctx->tbflags & TB_FLAG_GUSA_EXCLUSIVE) {
          /* When in an exclusive region, we must continue to the end.
             Therefore, exit the region on a taken branch, but otherwise
             fall through to the next instruction.  */
          tcg_gen_brcondi_i32(TCG_COND_EQ, ds, 0, l1);
          /* Leave the gUSA region.  */
 -        tcg_gen_movi_i32(cpu_flags, ctx->envflags & ~GUSA_MASK);
 +        tcg_gen_movi_i32(cpu_flags, ctx->envflags & ~TB_FLAG_GUSA_MASK);
          gen_jump(ctx);
          gen_set_label(l1);
@@ -XXX,XX +XXX,XX @@ static inline void gen_store_fpr64(DisasContext *ctx, TCGv_i64 t, int reg)
  #define XHACK(x) ((((x) & 1 ) << 4) | ((x) & 0xe))
  #define CHECK_NOT_DELAY_SLOT \
 -    if (ctx->envflags & DELAY_SLOT_MASK) {  \
 -        goto do_illegal_slot;               \
 +    if (ctx->envflags & TB_FLAG_DELAY_SLOT_MASK) {  \
 +        goto do_illegal_slot;                       \
      }
  #define CHECK_PRIVILEGED \
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
      case 0x000b:        /* rts */
      CHECK_NOT_DELAY_SLOT
      tcg_gen_mov_i32(cpu_delayed_pc, cpu_pr);
 -        ctx->envflags |= DELAY_SLOT;
 +        ctx->envflags |= TB_FLAG_DELAY_SLOT;
      ctx->delayed_pc = (uint32_t) - 1;
      return;
      case 0x0028:        /* clrmac */
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
      CHECK_NOT_DELAY_SLOT
          gen_write_sr(cpu_ssr);
      tcg_gen_mov_i32(cpu_delayed_pc, cpu_spc);
 -        ctx->envflags |= DELAY_SLOT_RTE;
 +        ctx->envflags |= TB_FLAG_DELAY_SLOT_RTE;
      ctx->delayed_pc = (uint32_t) - 1;
          ctx->base.is_jmp = DISAS_STOP;
      return;
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
      return;
      case 0xe000:        /* mov #imm,Rn */
  #ifdef CONFIG_USER_ONLY
 -        /* Detect the start of a gUSA region.  If so, update envflags
 -           and end the TB.  This will allow us to see the end of the
 -           region (stored in R0) in the next TB.  */
 +        /*
 +         * Detect the start of a gUSA region (mov #-n, r15).
 +         * If so, update envflags and end the TB.  This will allow us
 +         * to see the end of the region (stored in R0) in the next TB.
 +         */
          if (B11_8 == 15 && B7_0s < 0 &&
              (tb_cflags(ctx->base.tb) & CF_PARALLEL)) {
 -            ctx->envflags = deposit32(ctx->envflags, GUSA_SHIFT, 8, B7_0s);
 +            ctx->envflags =
 +                deposit32(ctx->envflags, TB_FLAG_GUSA_SHIFT, 8, B7_0s);
              ctx->base.is_jmp = DISAS_STOP;
          }
  #endif
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
      case 0xa000:        /* bra disp */
      CHECK_NOT_DELAY_SLOT
          ctx->delayed_pc = ctx->base.pc_next + 4 + B11_0s * 2;
 -        ctx->envflags |= DELAY_SLOT;
 +        ctx->envflags |= TB_FLAG_DELAY_SLOT;
      return;
      case 0xb000:        /* bsr disp */
      CHECK_NOT_DELAY_SLOT
          tcg_gen_movi_i32(cpu_pr, ctx->base.pc_next + 4);
          ctx->delayed_pc = ctx->base.pc_next + 4 + B11_0s * 2;
 -        ctx->envflags |= DELAY_SLOT;
 +        ctx->envflags |= TB_FLAG_DELAY_SLOT;
      return;
      }
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
      CHECK_NOT_DELAY_SLOT
          tcg_gen_xori_i32(cpu_delayed_cond, cpu_sr_t, 1);
          ctx->delayed_pc = ctx->base.pc_next + 4 + B7_0s * 2;
 -        ctx->envflags |= DELAY_SLOT_CONDITIONAL;
 +        ctx->envflags |= TB_FLAG_DELAY_SLOT_COND;
      return;
      case 0x8900:        /* bt label */
      CHECK_NOT_DELAY_SLOT
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
      CHECK_NOT_DELAY_SLOT
          tcg_gen_mov_i32(cpu_delayed_cond, cpu_sr_t);
          ctx->delayed_pc = ctx->base.pc_next + 4 + B7_0s * 2;
 -        ctx->envflags |= DELAY_SLOT_CONDITIONAL;
 +        ctx->envflags |= TB_FLAG_DELAY_SLOT_COND;
      return;
      case 0x8800:        /* cmp/eq #imm,R0 */
          tcg_gen_setcondi_i32(TCG_COND_EQ, cpu_sr_t, REG(0), B7_0s);
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
      case 0x0023:        /* braf Rn */
      CHECK_NOT_DELAY_SLOT
          tcg_gen_addi_i32(cpu_delayed_pc, REG(B11_8), ctx->base.pc_next + 4);
 -        ctx->envflags |= DELAY_SLOT;
 +        ctx->envflags |= TB_FLAG_DELAY_SLOT;
      ctx->delayed_pc = (uint32_t) - 1;
      return;
      case 0x0003:        /* bsrf Rn */
      CHECK_NOT_DELAY_SLOT
          tcg_gen_movi_i32(cpu_pr, ctx->base.pc_next + 4);
      tcg_gen_add_i32(cpu_delayed_pc, REG(B11_8), cpu_pr);
 -        ctx->envflags |= DELAY_SLOT;
 +        ctx->envflags |= TB_FLAG_DELAY_SLOT;
      ctx->delayed_pc = (uint32_t) - 1;
      return;
      case 0x4015:        /* cmp/pl Rn */
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
      case 0x402b:        /* jmp @Rn */
      CHECK_NOT_DELAY_SLOT
      tcg_gen_mov_i32(cpu_delayed_pc, REG(B11_8));
 -        ctx->envflags |= DELAY_SLOT;
 +        ctx->envflags |= TB_FLAG_DELAY_SLOT;
      ctx->delayed_pc = (uint32_t) - 1;
      return;
      case 0x400b:        /* jsr @Rn */
      CHECK_NOT_DELAY_SLOT
          tcg_gen_movi_i32(cpu_pr, ctx->base.pc_next + 4);
      tcg_gen_mov_i32(cpu_delayed_pc, REG(B11_8));
 -        ctx->envflags |= DELAY_SLOT;
 +        ctx->envflags |= TB_FLAG_DELAY_SLOT;
      ctx->delayed_pc = (uint32_t) - 1;
      return;
      case 0x400e:        /* ldc Rm,SR */
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
      fflush(stderr);
  #endif
   do_illegal:
 -    if (ctx->envflags & DELAY_SLOT_MASK) {
 +    if (ctx->envflags & TB_FLAG_DELAY_SLOT_MASK) {
   do_illegal_slot:
          gen_save_cpu_state(ctx, true);
          gen_helper_raise_slot_illegal_instruction(cpu_env);
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
   do_fpu_disabled:
      gen_save_cpu_state(ctx, true);
 -    if (ctx->envflags & DELAY_SLOT_MASK) {
 +    if (ctx->envflags & TB_FLAG_DELAY_SLOT_MASK) {
          gen_helper_raise_slot_fpu_disable(cpu_env);
      } else {
          gen_helper_raise_fpu_disable(cpu_env);
@@ -XXX,XX +XXX,XX @@ static void decode_opc(DisasContext * ctx)
      _decode_opc(ctx);
 -    if (old_flags & DELAY_SLOT_MASK) {
 +    if (old_flags & TB_FLAG_DELAY_SLOT_MASK) {
          /* go out of the delay slot */
 -        ctx->envflags &= ~DELAY_SLOT_MASK;
 +        ctx->envflags &= ~TB_FLAG_DELAY_SLOT_MASK;
          /* When in an exclusive region, we must continue to the end
             for conditional branches.  */
 -        if (ctx->tbflags & GUSA_EXCLUSIVE
 -            && old_flags & DELAY_SLOT_CONDITIONAL) {
 +        if (ctx->tbflags & TB_FLAG_GUSA_EXCLUSIVE
 +            && old_flags & TB_FLAG_DELAY_SLOT_COND) {
              gen_delayed_conditional_jump(ctx);
              return;
          }
          /* Otherwise this is probably an invalid gUSA region.
             Drop the GUSA bits so the next TB doesn't see them.  */
 -        ctx->envflags &= ~GUSA_MASK;
 +        ctx->envflags &= ~TB_FLAG_GUSA_MASK;
          tcg_gen_movi_i32(cpu_flags, ctx->envflags);
 -        if (old_flags & DELAY_SLOT_CONDITIONAL) {
 +        if (old_flags & TB_FLAG_DELAY_SLOT_COND) {
          gen_delayed_conditional_jump(ctx);
          } else {
              gen_jump(ctx);
@@ -XXX,XX +XXX,XX @@ static void decode_gusa(DisasContext *ctx, CPUSH4State *env)
      }
      /* The entire region has been translated.  */
 -    ctx->envflags &= ~GUSA_MASK;
 +    ctx->envflags &= ~TB_FLAG_GUSA_MASK;
      ctx->base.pc_next = pc_end;
      ctx->base.num_insns += max_insns - 1;
      return;
@@ -XXX,XX +XXX,XX @@ static void decode_gusa(DisasContext *ctx, CPUSH4State *env)
      /* Restart with the EXCLUSIVE bit set, within a TB run via
         cpu_exec_step_atomic holding the exclusive lock.  */
 -    ctx->envflags |= GUSA_EXCLUSIVE;
 +    ctx->envflags |= TB_FLAG_GUSA_EXCLUSIVE;
      gen_save_cpu_state(ctx, false);
      gen_helper_exclusive(cpu_env);
      ctx->base.is_jmp = DISAS_NORETURN;
@@ -XXX,XX +XXX,XX @@ static void sh4_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
                    (tbflags & (1 << SR_RB))) * 0x10;
      ctx->fbank = tbflags & FPSCR_FR ? 0x10 : 0;
 -    if (tbflags & GUSA_MASK) {
 +#ifdef CONFIG_USER_ONLY
 +    if (tbflags & TB_FLAG_GUSA_MASK) {
 +        /* In gUSA exclusive region. */
          uint32_t pc = ctx->base.pc_next;
          uint32_t pc_end = ctx->base.tb->cs_base;
 -        int backup = sextract32(ctx->tbflags, GUSA_SHIFT, 8);
 +        int backup = sextract32(ctx->tbflags, TB_FLAG_GUSA_SHIFT, 8);
          int max_insns = (pc_end - pc) / 2;
          if (pc != pc_end + backup || max_insns < 2) {
              /* This is a malformed gUSA region.  Don't do anything special,
                 since the interpreter is likely to get confused.  */
 -            ctx->envflags &= ~GUSA_MASK;
 -        } else if (tbflags & GUSA_EXCLUSIVE) {
 +            ctx->envflags &= ~TB_FLAG_GUSA_MASK;
 +        } else if (tbflags & TB_FLAG_GUSA_EXCLUSIVE) {
              /* Regardless of single-stepping or the end of the page,
                 we must complete execution of the gUSA region while
                 holding the exclusive lock.  */
@@ -XXX,XX +XXX,XX @@ static void sh4_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
              return;
          }
      }
 +#endif
      /* Since the ISA is fixed-width, we can bound by the number
         of instructions remaining on the page.  */
@@ -XXX,XX +XXX,XX @@ static void sh4_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
      DisasContext *ctx = container_of(dcbase, DisasContext, base);
  #ifdef CONFIG_USER_ONLY
 -    if (unlikely(ctx->envflags & GUSA_MASK)
 -        && !(ctx->envflags & GUSA_EXCLUSIVE)) {
 +    if (unlikely(ctx->envflags & TB_FLAG_GUSA_MASK)
 +        && !(ctx->envflags & TB_FLAG_GUSA_EXCLUSIVE)) {
          /* We're in an gUSA region, and we have not already fallen
             back on using an exclusive region.  Attempt to parse the
             region into a single supported atomic operation.  Failure
@@ -XXX,XX +XXX,XX @@ static void sh4_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
  {
-+    /* Only one extension flag may be present. */
+     DisasContext *ctx = container_of(dcbase, DisasContext, base);
-+    tcg_debug_assert(!(flags & TCG_BSWAP_OS) || !(flags & TCG_BSWAP_OZ));
-+
+-    if (ctx->tbflags & GUSA_EXCLUSIVE) {
-     if (TCG_TARGET_HAS_bswap16_i32) {
++    if (ctx->tbflags & TB_FLAG_GUSA_EXCLUSIVE) {
--        tcg_gen_op3i_i32(INDEX_op_bswap16_i32, ret, arg,
+         /* Ending the region of exclusivity.  Clear the bits.  */
--                         TCG_BSWAP_IZ | TCG_BSWAP_OZ);
+-        ctx->envflags &= ~GUSA_MASK;
-+        tcg_gen_op3i_i32(INDEX_op_bswap16_i32, ret, arg, flags);
++        ctx->envflags &= ~TB_FLAG_GUSA_MASK;
-     } else {
+     }
-         TCGv_i32 t0 = tcg_temp_new_i32();
-+        TCGv_i32 t1 = tcg_temp_new_i32();
+     switch (ctx->base.is_jmp) {
 -        tcg_gen_ext8u_i32(t0, arg);
 -        tcg_gen_shli_i32(t0, t0, 8);
 -        tcg_gen_shri_i32(ret, arg, 8);
 -        tcg_gen_or_i32(ret, ret, t0);
 +        tcg_gen_shri_i32(t0, arg, 8);
 +        if (!(flags & TCG_BSWAP_IZ)) {
 +            tcg_gen_ext8u_i32(t0, t0);
 +        }
 +
 +        if (flags & TCG_BSWAP_OS) {
 +            tcg_gen_shli_i32(t1, arg, 24);
 +            tcg_gen_sari_i32(t1, t1, 16);
 +        } else if (flags & TCG_BSWAP_OZ) {
 +            tcg_gen_ext8u_i32(t1, arg);
 +            tcg_gen_shli_i32(t1, t1, 8);
 +        } else {
 +            tcg_gen_shli_i32(t1, arg, 8);
 +        }
 +
 +        tcg_gen_or_i32(ret, t0, t1);
          tcg_temp_free_i32(t0);
 +        tcg_temp_free_i32(t1);
      }
  }
@@ -XXX,XX +XXX,XX @@ void tcg_gen_ext32u_i64(TCGv_i64 ret, TCGv_i64 arg)
      }
  }
 -/* Note: we assume the six high bytes are set to zero */
 -void tcg_gen_bswap16_i64(TCGv_i64 ret, TCGv_i64 arg)
 +void tcg_gen_bswap16_i64(TCGv_i64 ret, TCGv_i64 arg, int flags)
  {
 +    /* Only one extension flag may be present. */
 +    tcg_debug_assert(!(flags & TCG_BSWAP_OS) || !(flags & TCG_BSWAP_OZ));
 +
      if (TCG_TARGET_REG_BITS == 32) {
 -        tcg_gen_bswap16_i32(TCGV_LOW(ret), TCGV_LOW(arg));
 -        tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
 +        tcg_gen_bswap16_i32(TCGV_LOW(ret), TCGV_LOW(arg), flags);
 +        if (flags & TCG_BSWAP_OS) {
 +            tcg_gen_sari_i32(TCGV_HIGH(ret), TCGV_LOW(ret), 31);
 +        } else {
 +            tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
 +        }
      } else if (TCG_TARGET_HAS_bswap16_i64) {
 -        tcg_gen_op3i_i64(INDEX_op_bswap16_i64, ret, arg,
 -                         TCG_BSWAP_IZ | TCG_BSWAP_OZ);
 +        tcg_gen_op3i_i64(INDEX_op_bswap16_i64, ret, arg, flags);
      } else {
          TCGv_i64 t0 = tcg_temp_new_i64();
 +        TCGv_i64 t1 = tcg_temp_new_i64();
 -        tcg_gen_ext8u_i64(t0, arg);
 -        tcg_gen_shli_i64(t0, t0, 8);
 -        tcg_gen_shri_i64(ret, arg, 8);
 -        tcg_gen_or_i64(ret, ret, t0);
 +        tcg_gen_shri_i64(t0, arg, 8);
 +        if (!(flags & TCG_BSWAP_IZ)) {
 +            tcg_gen_ext8u_i64(t0, t0);
 +        }
 +
 +        if (flags & TCG_BSWAP_OS) {
 +            tcg_gen_shli_i64(t1, arg, 56);
 +            tcg_gen_sari_i64(t1, t1, 48);
 +        } else if (flags & TCG_BSWAP_OZ) {
 +            tcg_gen_ext8u_i64(t1, arg);
 +            tcg_gen_shli_i64(t1, t1, 8);
 +        } else {
 +            tcg_gen_shli_i64(t1, arg, 8);
 +        }
 +
 +        tcg_gen_or_i64(ret, t0, t1);
          tcg_temp_free_i64(t0);
 +        tcg_temp_free_i64(t1);
      }
  }
 -/* Note: we assume the four high bytes are set to zero */
 -void tcg_gen_bswap32_i64(TCGv_i64 ret, TCGv_i64 arg)
 +void tcg_gen_bswap32_i64(TCGv_i64 ret, TCGv_i64 arg, int flags)
  {
 +    /* Only one extension flag may be present. */
 +    tcg_debug_assert(!(flags & TCG_BSWAP_OS) || !(flags & TCG_BSWAP_OZ));
 +
      if (TCG_TARGET_REG_BITS == 32) {
          tcg_gen_bswap32_i32(TCGV_LOW(ret), TCGV_LOW(arg));
 -        tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
 +        if (flags & TCG_BSWAP_OS) {
 +            tcg_gen_sari_i32(TCGV_HIGH(ret), TCGV_LOW(ret), 31);
 +        } else {
 +            tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
 +        }
      } else if (TCG_TARGET_HAS_bswap32_i64) {
 -        tcg_gen_op3i_i64(INDEX_op_bswap32_i64, ret, arg,
 -                         TCG_BSWAP_IZ | TCG_BSWAP_OZ);
 +        tcg_gen_op3i_i64(INDEX_op_bswap32_i64, ret, arg, flags);
      } else {
          TCGv_i64 t0 = tcg_temp_new_i64();
          TCGv_i64 t1 = tcg_temp_new_i64();
          TCGv_i64 t2 = tcg_constant_i64(0x00ff00ff);
 -                                        /* arg = ....abcd */
 -        tcg_gen_shri_i64(t0, arg, 8);   /*  t0 = .....abc */
 -        tcg_gen_and_i64(t1, arg, t2);   /*  t1 = .....b.d */
 -        tcg_gen_and_i64(t0, t0, t2);    /*  t0 = .....a.c */
 -        tcg_gen_shli_i64(t1, t1, 8);    /*  t1 = ....b.d. */
 -        tcg_gen_or_i64(ret, t0, t1);    /* ret = ....badc */
 +                                            /* arg = xxxxabcd */
 +        tcg_gen_shri_i64(t0, arg, 8);       /*  t0 = .xxxxabc */
 +        tcg_gen_and_i64(t1, arg, t2);       /*  t1 = .....b.d */
 +        tcg_gen_and_i64(t0, t0, t2);        /*  t0 = .....a.c */
 +        tcg_gen_shli_i64(t1, t1, 8);        /*  t1 = ....b.d. */
 +        tcg_gen_or_i64(ret, t0, t1);        /* ret = ....badc */
 -        tcg_gen_shli_i64(t1, ret, 48);  /*  t1 = dc...... */
 -        tcg_gen_shri_i64(t0, ret, 16);  /*  t0 = ......ba */
 -        tcg_gen_shri_i64(t1, t1, 32);   /*  t1 = ....dc.. */
 -        tcg_gen_or_i64(ret, t0, t1);    /* ret = ....dcba */
 +        tcg_gen_shli_i64(t1, ret, 48);      /*  t1 = dc...... */
 +        tcg_gen_shri_i64(t0, ret, 16);      /*  t0 = ......ba */
 +        if (flags & TCG_BSWAP_OS) {
 +            tcg_gen_sari_i64(t1, t1, 32);   /*  t1 = ssssdc.. */
 +        } else {
 +            tcg_gen_shri_i64(t1, t1, 32);   /*  t1 = ....dc.. */
 +        }
 +        tcg_gen_or_i64(ret, t0, t1);        /* ret = ssssdcba */
          tcg_temp_free_i64(t0);
          tcg_temp_free_i64(t1);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_qemu_ld_i32(TCGv_i32 val, TCGv addr, TCGArg idx, MemOp memop)
      if ((orig_memop ^ memop) & MO_BSWAP) {
          switch (orig_memop & MO_SIZE) {
          case MO_16:
 -            tcg_gen_bswap16_i32(val, val);
 +            tcg_gen_bswap16_i32(val, val, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
              if (orig_memop & MO_SIGN) {
                  tcg_gen_ext16s_i32(val, val);
              }
@@ -XXX,XX +XXX,XX @@ void tcg_gen_qemu_st_i32(TCGv_i32 val, TCGv addr, TCGArg idx, MemOp memop)
          switch (memop & MO_SIZE) {
          case MO_16:
              tcg_gen_ext16u_i32(swap, val);
 -            tcg_gen_bswap16_i32(swap, swap);
 +            tcg_gen_bswap16_i32(swap, swap, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
              break;
          case MO_32:
              tcg_gen_bswap32_i32(swap, val);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_qemu_ld_i64(TCGv_i64 val, TCGv addr, TCGArg idx, MemOp memop)
      if ((orig_memop ^ memop) & MO_BSWAP) {
          switch (orig_memop & MO_SIZE) {
          case MO_16:
 -            tcg_gen_bswap16_i64(val, val);
 +            tcg_gen_bswap16_i64(val, val, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
              if (orig_memop & MO_SIGN) {
                  tcg_gen_ext16s_i64(val, val);
              }
              break;
          case MO_32:
 -            tcg_gen_bswap32_i64(val, val);
 +            tcg_gen_bswap32_i64(val, val, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
              if (orig_memop & MO_SIGN) {
                  tcg_gen_ext32s_i64(val, val);
              }
@@ -XXX,XX +XXX,XX @@ void tcg_gen_qemu_st_i64(TCGv_i64 val, TCGv addr, TCGArg idx, MemOp memop)
          switch (memop & MO_SIZE) {
          case MO_16:
              tcg_gen_ext16u_i64(swap, val);
 -            tcg_gen_bswap16_i64(swap, swap);
 +            tcg_gen_bswap16_i64(swap, swap, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
              break;
          case MO_32:
              tcg_gen_ext32u_i64(swap, val);
 -            tcg_gen_bswap32_i64(swap, swap);
 +            tcg_gen_bswap32_i64(swap, swap, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
              break;
          case MO_64:
              tcg_gen_bswap64_i64(swap, val);
 --
-.25.1
+.34.1

-[PULL 53/63] tcg: Make use of bswap flags in tcg_gen_qemu_ld_*
+Deleted patch
-We can perform any required sign-extension via TCG_BSWAP_OS.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tcg-op.c | 24 ++++++++++--------------
-file changed, 10 insertions(+), 14 deletions(-)
-diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-op.c
-+++ b/tcg/tcg-op.c
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_qemu_ld_i32(TCGv_i32 val, TCGv addr, TCGArg idx, MemOp memop)
-     orig_memop = memop;
-     if (!TCG_TARGET_HAS_MEMORY_BSWAP && (memop & MO_BSWAP)) {
-         memop &= ~MO_BSWAP;
--        /* The bswap primitive requires zero-extended input.  */
-+        /* The bswap primitive benefits from zero-extended input.  */
-         if ((memop & MO_SSIZE) == MO_SW) {
-             memop &= ~MO_SIGN;
-         }
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_qemu_ld_i32(TCGv_i32 val, TCGv addr, TCGArg idx, MemOp memop)
-     if ((orig_memop ^ memop) & MO_BSWAP) {
-         switch (orig_memop & MO_SIZE) {
-         case MO_16:
--            tcg_gen_bswap16_i32(val, val, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
--            if (orig_memop & MO_SIGN) {
--                tcg_gen_ext16s_i32(val, val);
--            }
-+            tcg_gen_bswap16_i32(val, val, (orig_memop & MO_SIGN
-+                                           ? TCG_BSWAP_IZ | TCG_BSWAP_OS
-+                                           : TCG_BSWAP_IZ | TCG_BSWAP_OZ));
-             break;
-         case MO_32:
-             tcg_gen_bswap32_i32(val, val);
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_qemu_ld_i64(TCGv_i64 val, TCGv addr, TCGArg idx, MemOp memop)
-     orig_memop = memop;
-     if (!TCG_TARGET_HAS_MEMORY_BSWAP && (memop & MO_BSWAP)) {
-         memop &= ~MO_BSWAP;
--        /* The bswap primitive requires zero-extended input.  */
-+        /* The bswap primitive benefits from zero-extended input.  */
-         if ((memop & MO_SIGN) && (memop & MO_SIZE) < MO_64) {
-             memop &= ~MO_SIGN;
-         }
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_qemu_ld_i64(TCGv_i64 val, TCGv addr, TCGArg idx, MemOp memop)
-     plugin_gen_mem_callbacks(addr, info);
-     if ((orig_memop ^ memop) & MO_BSWAP) {
-+        int flags = (orig_memop & MO_SIGN
-+                     ? TCG_BSWAP_IZ | TCG_BSWAP_OS
-+                     : TCG_BSWAP_IZ | TCG_BSWAP_OZ);
-         switch (orig_memop & MO_SIZE) {
-         case MO_16:
--            tcg_gen_bswap16_i64(val, val, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
--            if (orig_memop & MO_SIGN) {
--                tcg_gen_ext16s_i64(val, val);
--            }
-+            tcg_gen_bswap16_i64(val, val, flags);
-             break;
-         case MO_32:
--            tcg_gen_bswap32_i64(val, val, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
--            if (orig_memop & MO_SIGN) {
--                tcg_gen_ext32s_i64(val, val);
--            }
-+            tcg_gen_bswap32_i64(val, val, flags);
-             break;
-         case MO_64:
-             tcg_gen_bswap64_i64(val, val);
---
-.25.1

-[PULL 54/63] tcg: Make use of bswap flags in tcg_gen_qemu_st_*
+Deleted patch
-By removing TCG_BSWAP_IZ we indicate that the input is
-not zero-extended, and thus can remove an explicit extend.
-By removing TCG_BSWAP_OZ, we allow the implementation to
-leave high bits set, which will be ignored by the store.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tcg-op.c | 9 +++------
-file changed, 3 insertions(+), 6 deletions(-)
-diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-op.c
-+++ b/tcg/tcg-op.c
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_qemu_st_i32(TCGv_i32 val, TCGv addr, TCGArg idx, MemOp memop)
-         swap = tcg_temp_new_i32();
-         switch (memop & MO_SIZE) {
-         case MO_16:
--            tcg_gen_ext16u_i32(swap, val);
--            tcg_gen_bswap16_i32(swap, swap, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
-+            tcg_gen_bswap16_i32(swap, val, 0);
-             break;
-         case MO_32:
-             tcg_gen_bswap32_i32(swap, val);
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_qemu_st_i64(TCGv_i64 val, TCGv addr, TCGArg idx, MemOp memop)
-         swap = tcg_temp_new_i64();
-         switch (memop & MO_SIZE) {
-         case MO_16:
--            tcg_gen_ext16u_i64(swap, val);
--            tcg_gen_bswap16_i64(swap, swap, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
-+            tcg_gen_bswap16_i64(swap, val, 0);
-             break;
-         case MO_32:
--            tcg_gen_ext32u_i64(swap, val);
--            tcg_gen_bswap32_i64(swap, swap, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
-+            tcg_gen_bswap32_i64(swap, val, 0);
-             break;
-         case MO_64:
-             tcg_gen_bswap64_i64(swap, val);
---
-.25.1

-[PULL 56/63] target/arm: Improve vector REV
+Deleted patch
-We can eliminate the requirement for a zero-extended output,
-because the following store will ignore any garbage high bits.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/arm/translate-a64.c | 6 ++----
-file changed, 2 insertions(+), 4 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
-+++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void handle_rev(DisasContext *s, int opcode, bool u,
-             read_vec_element(s, tcg_tmp, rn, i, grp_size);
-             switch (grp_size) {
-             case MO_16:
--                tcg_gen_bswap16_i64(tcg_tmp, tcg_tmp,
--                                    TCG_BSWAP_IZ | TCG_BSWAP_OZ);
-+                tcg_gen_bswap16_i64(tcg_tmp, tcg_tmp, TCG_BSWAP_IZ);
-                 break;
-             case MO_32:
--                tcg_gen_bswap32_i64(tcg_tmp, tcg_tmp,
--                                    TCG_BSWAP_IZ | TCG_BSWAP_OZ);
-+                tcg_gen_bswap32_i64(tcg_tmp, tcg_tmp, TCG_BSWAP_IZ);
-                 break;
-             case MO_64:
-                 tcg_gen_bswap64_i64(tcg_tmp, tcg_tmp);
---
-.25.1

-[PULL 58/63] target/i386: Improve bswap translation
+Deleted patch
-Use a break instead of an ifdefed else.
-There's no need to move the values through s->T0.
-Remove TCG_BSWAP_IZ and the preceding zero-extension.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/i386/tcg/translate.c | 14 ++++----------
-file changed, 4 insertions(+), 10 deletions(-)
-diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/i386/tcg/translate.c
-+++ b/target/i386/tcg/translate.c
-@@ -XXX,XX +XXX,XX @@ static target_ulong disas_insn(DisasContext *s, CPUState *cpu)
-         reg = (b & 7) | REX_B(s);
- #ifdef TARGET_X86_64
-         if (dflag == MO_64) {
--            gen_op_mov_v_reg(s, MO_64, s->T0, reg);
--            tcg_gen_bswap64_i64(s->T0, s->T0);
--            gen_op_mov_reg_v(s, MO_64, reg, s->T0);
--        } else
--#endif
--        {
--            gen_op_mov_v_reg(s, MO_32, s->T0, reg);
--            tcg_gen_ext32u_tl(s->T0, s->T0);
--            tcg_gen_bswap32_tl(s->T0, s->T0, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
--            gen_op_mov_reg_v(s, MO_32, reg, s->T0);
-+            tcg_gen_bswap64_i64(cpu_regs[reg], cpu_regs[reg]);
-+            break;
-         }
-+#endif
-+        tcg_gen_bswap32_tl(cpu_regs[reg], cpu_regs[reg], TCG_BSWAP_OZ);
-         break;
-     case 0xd6: /* salc */
-         if (CODE64(s))
---
-.25.1

-[PULL 59/63] target/sh4: Improve swap.b translation
+Deleted patch
-Remove TCG_BSWAP_IZ and the preceding zero-extension.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/sh4/translate.c | 3 +--
-file changed, 1 insertion(+), 2 deletions(-)
-diff --git a/target/sh4/translate.c b/target/sh4/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/sh4/translate.c
-+++ b/target/sh4/translate.c
-@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
-     case 0x6008:        /* swap.b Rm,Rn */
-     {
-             TCGv low = tcg_temp_new();
--        tcg_gen_ext16u_i32(low, REG(B7_4));
--        tcg_gen_bswap16_i32(low, low, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
-+            tcg_gen_bswap16_i32(low, REG(B7_4), 0);
-             tcg_gen_deposit_i32(REG(B11_8), REG(B7_4), low, 0, 16);
-         tcg_temp_free(low);
-     }
---
-.25.1

-[PULL 60/63] target/mips: Fix gen_mxu_s32ldd_s32lddr
+Deleted patch
-There were two bugs here: (1) the required endianness was
-not present in the MemOp, and (2) we were not providing a
-zero-extended input to the bswap as semantics required.
-The best fix is to fold the bswap into the memory operation,
-producing the desired result directly.
-Acked-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/mips/tcg/mxu_translate.c | 6 +-----
-file changed, 1 insertion(+), 5 deletions(-)
-diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/mips/tcg/mxu_translate.c
-+++ b/target/mips/tcg/mxu_translate.c
-@@ -XXX,XX +XXX,XX @@ static void gen_mxu_s32ldd_s32lddr(DisasContext *ctx)
-         tcg_gen_ori_tl(t1, t1, 0xFFFFF000);
-     }
-     tcg_gen_add_tl(t1, t0, t1);
--    tcg_gen_qemu_ld_tl(t1, t1, ctx->mem_idx, MO_SL);
-+    tcg_gen_qemu_ld_tl(t1, t1, ctx->mem_idx, MO_TESL ^ (sel * MO_BSWAP));
--    if (sel == 1) {
--        /* S32LDDR */
--        tcg_gen_bswap32_tl(t1, t1, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
--    }
-     gen_store_mxu_gpr(t1, XRa);
-     tcg_temp_free(t0);
---
-.25.1

The following changes since commit 13d5f87cc3b94bfccc501142df4a7b12fee3a6e7:

Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-axp-20210628' into staging (2021-06-29 10:02:42 +0100)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20210629

for you to fetch changes up to c86bd2dc4c1d37653c27293b2dacee6bb46bb995:

tcg/riscv: Remove MO_BSWAP handling (2021-06-29 10:04:57 -0700)

----------------------------------------------------------------
TranslatorOps conversion for target/avr
TranslatorOps conversion for target/cris
TranslatorOps conversion for target/nios2
Simple vector operations on TCGv_i32
Host signal fixes for *BSD
Improvements to tcg bswap operations

----------------------------------------------------------------
LIU Zhiwei (5):
      tcg: Add tcg_gen_vec_add{sub}16_i32
      tcg: Add tcg_gen_vec_add{sub}8_i32
      tcg: Add tcg_gen_vec_shl{shr}{sar}16i_i32
      tcg: Add tcg_gen_vec_shl{shr}{sar}8i_i32
      tcg: Implement tcg_gen_vec_add{sub}32_tl

Richard Henderson (57):
      target/nios2: Replace DISAS_TB_JUMP with DISAS_NORETURN
      target/nios2: Use global cpu_env
      target/nios2: Use global cpu_R
      target/nios2: Add DisasContextBase to DisasContext
      target/nios2: Convert to TranslatorOps
      target/nios2: Remove assignment to env in handle_instruction
      target/nios2: Clean up goto in handle_instruction
      target/nios2: Inline handle_instruction
      target/nios2: Use pc_next for pc + 4
      target/avr: Add DisasContextBase to DisasContext
      target/avr: Change ctx to DisasContext* in gen_intermediate_code
      target/avr: Convert to TranslatorOps
      target/cris: Add DisasContextBase to DisasContext
      target/cris: Remove DISAS_SWI
      target/cris: Replace DISAS_TB_JUMP with DISAS_NORETURN
      target/cris: Mark exceptions as DISAS_NORETURN
      target/cris: Fix use_goto_tb
      target/cris: Convert to TranslatorOps
      target/cris: Mark helper_raise_exception noreturn
      target/cris: Mark static arrays const
      target/cris: Fold unhandled X_FLAG changes into cpustate_changed
      target/cris: Set cpustate_changed for rfe/rfn
      target/cris: Add DISAS_UPDATE_NEXT
      target/cris: Add DISAS_DBRANCH
      target/cris: Use tcg_gen_lookup_and_goto_ptr
      target/cris: Improve JMP_INDIRECT
      target/cris: Remove dc->flagx_known
      target/cris: Do not exit tb for X_FLAG changes
      tcg: Add flags argument to bswap opcodes
      tcg/i386: Support bswap flags
      tcg/aarch64: Merge tcg_out_rev{16,32,64}
      tcg/aarch64: Support bswap flags
      tcg/arm: Support bswap flags
      tcg/ppc: Split out tcg_out_ext{8,16,32}s
      tcg/ppc: Split out tcg_out_sari{32,64}
      tcg/ppc: Split out tcg_out_bswap16
      tcg/ppc: Split out tcg_out_bswap32
      tcg/ppc: Split out tcg_out_bswap64
      tcg/ppc: Support bswap flags
      tcg/ppc: Use power10 byte-reverse instructions
      tcg/s390: Support bswap flags
      tcg/mips: Support bswap flags in tcg_out_bswap16
      tcg/mips: Support bswap flags in tcg_out_bswap32
      tcg/tci: Support bswap flags
      tcg: Handle new bswap flags during optimize
      tcg: Add flags argument to tcg_gen_bswap16_*, tcg_gen_bswap32_i64
      tcg: Make use of bswap flags in tcg_gen_qemu_ld_*
      tcg: Make use of bswap flags in tcg_gen_qemu_st_*
      target/arm: Improve REV32
      target/arm: Improve vector REV
      target/arm: Improve REVSH
      target/i386: Improve bswap translation
      target/sh4: Improve swap.b translation
      target/mips: Fix gen_mxu_s32ldd_s32lddr
      tcg/arm: Unset TCG_TARGET_HAS_MEMORY_BSWAP
      tcg/aarch64: Unset TCG_TARGET_HAS_MEMORY_BSWAP
      tcg/riscv: Remove MO_BSWAP handling

Warner Losh (1):
      tcg: Use correct trap number for page faults on *BSD systems

The only semantic of DISAS_TB_JUMP is that we've done goto_tb,
which is the same as DISAS_NORETURN -- we've exited the tb.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/nios2/translate.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/target/nios2/translate.c b/target/nios2/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/translate.c
+++ b/target/nios2/translate.c
@@ -XXX,XX +XXX,XX @@
 /* is_jmp field values */
 #define DISAS_JUMP    DISAS_TARGET_0 /* only pc was modified dynamically */
 #define DISAS_UPDATE  DISAS_TARGET_1 /* cpu state was modified dynamically */
-#define DISAS_TB_JUMP DISAS_TARGET_2 /* only pc was modified statically */
 
 #define INSTRUCTION_FLG(func, flags) { (func), (flags) }
 #define INSTRUCTION(func)                  \
@@ -XXX,XX +XXX,XX @@ static void jmpi(DisasContext *dc, uint32_t code, uint32_t flags)
 {
     J_TYPE(instr, code);
     gen_goto_tb(dc, 0, (dc->pc & 0xF0000000) | (instr.imm26 << 2));
-    dc->is_jmp = DISAS_TB_JUMP;
+    dc->is_jmp = DISAS_NORETURN;
 }
 
 static void call(DisasContext *dc, uint32_t code, uint32_t flags)
@@ -XXX,XX +XXX,XX @@ static void br(DisasContext *dc, uint32_t code, uint32_t flags)
     I_TYPE(instr, code);
 
     gen_goto_tb(dc, 0, dc->pc + 4 + (instr.imm16.s & -4));
-    dc->is_jmp = DISAS_TB_JUMP;
+    dc->is_jmp = DISAS_NORETURN;
 }
 
 static void gen_bxx(DisasContext *dc, uint32_t code, uint32_t flags)
@@ -XXX,XX +XXX,XX @@ static void gen_bxx(DisasContext *dc, uint32_t code, uint32_t flags)
     gen_goto_tb(dc, 0, dc->pc + 4);
     gen_set_label(l1);
     gen_goto_tb(dc, 1, dc->pc + 4 + (instr.imm16.s & -4));
-    dc->is_jmp = DISAS_TB_JUMP;
+    dc->is_jmp = DISAS_NORETURN;
 }
 
 /* Comparison instructions */
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
         break;
 
     case DISAS_NORETURN:
-    case DISAS_TB_JUMP:
         /* nothing more to generate */
         break;
     }
-- 
2.25.1

We do not need to copy this into DisasContext.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/nios2/translate.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

We do not need to copy this into DisasContext.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/nios2/translate.c | 73 +++++++++++++++++++---------------------
 1 file changed, 34 insertions(+), 39 deletions(-)

diff --git a/target/nios2/translate.c b/target/nios2/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/translate.c
+++ b/target/nios2/translate.c
@@ -XXX,XX +XXX,XX @@
     }
 
 typedef struct DisasContext {
-    TCGv             *cpu_R;
     TCGv_i32          zero;
     int               is_jmp;
     target_ulong      pc;
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     bool              singlestep_enabled;
 } DisasContext;
 
+static TCGv cpu_R[NUM_CORE_REGS];
+
 typedef struct Nios2Instruction {
     void     (*handler)(DisasContext *dc, uint32_t code, uint32_t flags);
     uint32_t  flags;
@@ -XXX,XX +XXX,XX @@ static TCGv load_zero(DisasContext *dc)
 static TCGv load_gpr(DisasContext *dc, uint8_t reg)
 {
     if (likely(reg != R_ZERO)) {
-        return dc->cpu_R[reg];
+        return cpu_R[reg];
     } else {
         return load_zero(dc);
     }
@@ -XXX,XX +XXX,XX @@ static void t_gen_helper_raise_exception(DisasContext *dc,
 {
     TCGv_i32 tmp = tcg_const_i32(index);
 
-    tcg_gen_movi_tl(dc->cpu_R[R_PC], dc->pc);
+    tcg_gen_movi_tl(cpu_R[R_PC], dc->pc);
     gen_helper_raise_exception(cpu_env, tmp);
     tcg_temp_free_i32(tmp);
     dc->is_jmp = DISAS_NORETURN;
@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *dc, int n, uint32_t dest)
 
     if (use_goto_tb(dc, dest)) {
         tcg_gen_goto_tb(n);
-        tcg_gen_movi_tl(dc->cpu_R[R_PC], dest);
+        tcg_gen_movi_tl(cpu_R[R_PC], dest);
         tcg_gen_exit_tb(tb, n);
     } else {
-        tcg_gen_movi_tl(dc->cpu_R[R_PC], dest);
+        tcg_gen_movi_tl(cpu_R[R_PC], dest);
         tcg_gen_exit_tb(NULL, 0);
     }
 }
@@ -XXX,XX +XXX,XX @@ static void jmpi(DisasContext *dc, uint32_t code, uint32_t flags)
 
 static void call(DisasContext *dc, uint32_t code, uint32_t flags)
 {
-    tcg_gen_movi_tl(dc->cpu_R[R_RA], dc->pc + 4);
+    tcg_gen_movi_tl(cpu_R[R_RA], dc->pc + 4);
     jmpi(dc, code, flags);
 }
 
@@ -XXX,XX +XXX,XX @@ static void gen_ldx(DisasContext *dc, uint32_t code, uint32_t flags)
      *          the Nios2 CPU.
      */
     if (likely(instr.b != R_ZERO)) {
-        data = dc->cpu_R[instr.b];
+        data = cpu_R[instr.b];
     } else {
         data = tcg_temp_new();
     }
@@ -XXX,XX +XXX,XX @@ static void gen_bxx(DisasContext *dc, uint32_t code, uint32_t flags)
     I_TYPE(instr, code);
 
     TCGLabel *l1 = gen_new_label();
-    tcg_gen_brcond_tl(flags, dc->cpu_R[instr.a], dc->cpu_R[instr.b], l1);
+    tcg_gen_brcond_tl(flags, cpu_R[instr.a], cpu_R[instr.b], l1);
     gen_goto_tb(dc, 0, dc->pc + 4);
     gen_set_label(l1);
     gen_goto_tb(dc, 1, dc->pc + 4 + (instr.imm16.s & -4));
@@ -XXX,XX +XXX,XX @@ static void gen_bxx(DisasContext *dc, uint32_t code, uint32_t flags)
 static void (fname)(DisasContext *dc, uint32_t code, uint32_t flags)         \
 {                                                                            \
     I_TYPE(instr, (code));                                                   \
-    tcg_gen_setcondi_tl(flags, (dc)->cpu_R[instr.b], (dc)->cpu_R[instr.a],   \
-                        (op3));                                              \
+    tcg_gen_setcondi_tl(flags, cpu_R[instr.b], cpu_R[instr.a], (op3));       \
 }
 
 gen_i_cmpxx(gen_cmpxxsi, instr.imm16.s)
@@ -XXX,XX +XXX,XX @@ static void (fname)(DisasContext *dc, uint32_t code, uint32_t flags)        \
     if (unlikely(instr.b == R_ZERO)) { /* Store to R_ZERO is ignored */     \
         return;                                                             \
     } else if (instr.a == R_ZERO) { /* MOVxI optimizations */               \
-        tcg_gen_movi_tl(dc->cpu_R[instr.b], (resimm) ? (op3) : 0);          \
+        tcg_gen_movi_tl(cpu_R[instr.b], (resimm) ? (op3) : 0);              \
     } else {                                                                \
-        tcg_gen_##insn##_tl((dc)->cpu_R[instr.b], (dc)->cpu_R[instr.a],     \
-                            (op3));                                         \
+        tcg_gen_##insn##_tl(cpu_R[instr.b], cpu_R[instr.a], (op3));         \
     }                                                                       \
 }
 
@@ -XXX,XX +XXX,XX @@ static const Nios2Instruction i_type_instructions[] = {
  */
 static void eret(DisasContext *dc, uint32_t code, uint32_t flags)
 {
-    tcg_gen_mov_tl(dc->cpu_R[CR_STATUS], dc->cpu_R[CR_ESTATUS]);
-    tcg_gen_mov_tl(dc->cpu_R[R_PC], dc->cpu_R[R_EA]);
+    tcg_gen_mov_tl(cpu_R[CR_STATUS], cpu_R[CR_ESTATUS]);
+    tcg_gen_mov_tl(cpu_R[R_PC], cpu_R[R_EA]);
 
     dc->is_jmp = DISAS_JUMP;
 }
@@ -XXX,XX +XXX,XX @@ static void eret(DisasContext *dc, uint32_t code, uint32_t flags)
 /* PC <- ra */
 static void ret(DisasContext *dc, uint32_t code, uint32_t flags)
 {
-    tcg_gen_mov_tl(dc->cpu_R[R_PC], dc->cpu_R[R_RA]);
+    tcg_gen_mov_tl(cpu_R[R_PC], cpu_R[R_RA]);
 
     dc->is_jmp = DISAS_JUMP;
 }
@@ -XXX,XX +XXX,XX @@ static void ret(DisasContext *dc, uint32_t code, uint32_t flags)
 /* PC <- ba */
 static void bret(DisasContext *dc, uint32_t code, uint32_t flags)
 {
-    tcg_gen_mov_tl(dc->cpu_R[R_PC], dc->cpu_R[R_BA]);
+    tcg_gen_mov_tl(cpu_R[R_PC], cpu_R[R_BA]);
 
     dc->is_jmp = DISAS_JUMP;
 }
@@ -XXX,XX +XXX,XX @@ static void jmp(DisasContext *dc, uint32_t code, uint32_t flags)
 {
     R_TYPE(instr, code);
 
-    tcg_gen_mov_tl(dc->cpu_R[R_PC], load_gpr(dc, instr.a));
+    tcg_gen_mov_tl(cpu_R[R_PC], load_gpr(dc, instr.a));
 
     dc->is_jmp = DISAS_JUMP;
 }
@@ -XXX,XX +XXX,XX @@ static void nextpc(DisasContext *dc, uint32_t code, uint32_t flags)
     R_TYPE(instr, code);
 
     if (likely(instr.c != R_ZERO)) {
-        tcg_gen_movi_tl(dc->cpu_R[instr.c], dc->pc + 4);
+        tcg_gen_movi_tl(cpu_R[instr.c], dc->pc + 4);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void callr(DisasContext *dc, uint32_t code, uint32_t flags)
 {
     R_TYPE(instr, code);
 
-    tcg_gen_mov_tl(dc->cpu_R[R_PC], load_gpr(dc, instr.a));
-    tcg_gen_movi_tl(dc->cpu_R[R_RA], dc->pc + 4);
+    tcg_gen_mov_tl(cpu_R[R_PC], load_gpr(dc, instr.a));
+    tcg_gen_movi_tl(cpu_R[R_RA], dc->pc + 4);
 
     dc->is_jmp = DISAS_JUMP;
 }
@@ -XXX,XX +XXX,XX @@ static void rdctl(DisasContext *dc, uint32_t code, uint32_t flags)
     {
 #if !defined(CONFIG_USER_ONLY)
         if (likely(instr.c != R_ZERO)) {
-            tcg_gen_mov_tl(dc->cpu_R[instr.c], dc->cpu_R[instr.imm5 + CR_BASE]);
+            tcg_gen_mov_tl(cpu_R[instr.c], cpu_R[instr.imm5 + CR_BASE]);
 #ifdef DEBUG_MMU
             TCGv_i32 tmp = tcg_const_i32(instr.imm5 + CR_BASE);
-            gen_helper_mmu_read_debug(dc->cpu_R[instr.c], cpu_env, tmp);
+            gen_helper_mmu_read_debug(cpu_R[instr.c], cpu_env, tmp);
             tcg_temp_free_i32(tmp);
 #endif
         }
@@ -XXX,XX +XXX,XX @@ static void rdctl(DisasContext *dc, uint32_t code, uint32_t flags)
 
     default:
         if (likely(instr.c != R_ZERO)) {
-            tcg_gen_mov_tl(dc->cpu_R[instr.c], dc->cpu_R[instr.imm5 + CR_BASE]);
+            tcg_gen_mov_tl(cpu_R[instr.c], cpu_R[instr.imm5 + CR_BASE]);
         }
         break;
     }
@@ -XXX,XX +XXX,XX @@ static void wrctl(DisasContext *dc, uint32_t code, uint32_t flags)
     }
 
     default:
-        tcg_gen_mov_tl(dc->cpu_R[instr.imm5 + CR_BASE], load_gpr(dc, instr.a));
+        tcg_gen_mov_tl(cpu_R[instr.imm5 + CR_BASE], load_gpr(dc, instr.a));
         break;
     }
 
@@ -XXX,XX +XXX,XX @@ static void gen_cmpxx(DisasContext *dc, uint32_t code, uint32_t flags)
 {
     R_TYPE(instr, code);
     if (likely(instr.c != R_ZERO)) {
-        tcg_gen_setcond_tl(flags, dc->cpu_R[instr.c], dc->cpu_R[instr.a],
-                           dc->cpu_R[instr.b]);
+        tcg_gen_setcond_tl(flags, cpu_R[instr.c], cpu_R[instr.a],
+                           cpu_R[instr.b]);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void (fname)(DisasContext *dc, uint32_t code, uint32_t flags)       \
 {                                                                          \
     R_TYPE(instr, (code));                                                 \
     if (likely(instr.c != R_ZERO)) {                                       \
-        tcg_gen_##insn((dc)->cpu_R[instr.c], load_gpr((dc), instr.a),      \
-                       (op3));                                             \
+        tcg_gen_##insn(cpu_R[instr.c], load_gpr((dc), instr.a), (op3));    \
     }                                                                      \
 }
 
@@ -XXX,XX +XXX,XX @@ static void (fname)(DisasContext *dc, uint32_t code, uint32_t flags)   \
     R_TYPE(instr, (code));                                             \
     if (likely(instr.c != R_ZERO)) {                                   \
         TCGv t0 = tcg_temp_new();                                      \
-        tcg_gen_##insn(t0, dc->cpu_R[instr.c],                         \
-                       load_gpr(dc, instr.a), load_gpr(dc, instr.b)); \
+        tcg_gen_##insn(t0, cpu_R[instr.c],                             \
+                       load_gpr(dc, instr.a), load_gpr(dc, instr.b));  \
         tcg_temp_free(t0);                                             \
     }                                                                  \
 }
@@ -XXX,XX +XXX,XX @@ static void (fname)(DisasContext *dc, uint32_t code, uint32_t flags)       \
     if (likely(instr.c != R_ZERO)) {                                       \
         TCGv t0 = tcg_temp_new();                                          \
         tcg_gen_andi_tl(t0, load_gpr((dc), instr.b), 31);                  \
-        tcg_gen_##insn((dc)->cpu_R[instr.c], load_gpr((dc), instr.a), t0); \
+        tcg_gen_##insn(cpu_R[instr.c], load_gpr((dc), instr.a), t0);       \
         tcg_temp_free(t0);                                                 \
     }                                                                      \
 }
@@ -XXX,XX +XXX,XX @@ static void divs(DisasContext *dc, uint32_t code, uint32_t flags)
     tcg_gen_or_tl(t2, t2, t3);
     tcg_gen_movi_tl(t3, 0);
     tcg_gen_movcond_tl(TCG_COND_NE, t1, t2, t3, t2, t1);
-    tcg_gen_div_tl(dc->cpu_R[instr.c], t0, t1);
-    tcg_gen_ext32s_tl(dc->cpu_R[instr.c], dc->cpu_R[instr.c]);
+    tcg_gen_div_tl(cpu_R[instr.c], t0, t1);
+    tcg_gen_ext32s_tl(cpu_R[instr.c], cpu_R[instr.c]);
 
     tcg_temp_free(t3);
     tcg_temp_free(t2);
@@ -XXX,XX +XXX,XX @@ static void divu(DisasContext *dc, uint32_t code, uint32_t flags)
     tcg_gen_ext32u_tl(t0, load_gpr(dc, instr.a));
     tcg_gen_ext32u_tl(t1, load_gpr(dc, instr.b));
     tcg_gen_movcond_tl(TCG_COND_EQ, t1, t1, t2, t3, t1);
-    tcg_gen_divu_tl(dc->cpu_R[instr.c], t0, t1);
-    tcg_gen_ext32s_tl(dc->cpu_R[instr.c], dc->cpu_R[instr.c]);
+    tcg_gen_divu_tl(cpu_R[instr.c], t0, t1);
+    tcg_gen_ext32s_tl(cpu_R[instr.c], cpu_R[instr.c]);
 
     tcg_temp_free(t3);
     tcg_temp_free(t2);
@@ -XXX,XX +XXX,XX @@ static const char * const regnames[] = {
     "rpc"
 };
 
-static TCGv cpu_R[NUM_CORE_REGS];
-
 #include "exec/gen-icount.h"
 
 static void gen_exception(DisasContext *dc, uint32_t excp)
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
     int num_insns;
 
     /* Initialize DC */
-    dc->cpu_R   = cpu_R;
     dc->is_jmp  = DISAS_NEXT;
     dc->pc      = tb->pc;
     dc->tb      = tb;
-- 
2.25.1

Migrate the is_jmp, tb and singlestep_enabled fields from
DisasContext into the base.  Use pc_first instead of tb->pc.
Increment pc_next prior to decode, leaving the address of
the current insn in dc->pc.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/nios2/translate.c | 70 +++++++++++++++++++++-------------------
 1 file changed, 36 insertions(+), 34 deletions(-)

diff --git a/target/nios2/translate.c b/target/nios2/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/translate.c
+++ b/target/nios2/translate.c
@@ -XXX,XX +XXX,XX @@
     }
 
 typedef struct DisasContext {
+    DisasContextBase  base;
     TCGv_i32          zero;
-    int               is_jmp;
     target_ulong      pc;
-    TranslationBlock *tb;
     int               mem_idx;
-    bool              singlestep_enabled;
 } DisasContext;
 
 static TCGv cpu_R[NUM_CORE_REGS];
@@ -XXX,XX +XXX,XX @@ static void t_gen_helper_raise_exception(DisasContext *dc,
     tcg_gen_movi_tl(cpu_R[R_PC], dc->pc);
     gen_helper_raise_exception(cpu_env, tmp);
     tcg_temp_free_i32(tmp);
-    dc->is_jmp = DISAS_NORETURN;
+    dc->base.is_jmp = DISAS_NORETURN;
 }
 
 static bool use_goto_tb(DisasContext *dc, uint32_t dest)
 {
-    if (unlikely(dc->singlestep_enabled)) {
+    if (unlikely(dc->base.singlestep_enabled)) {
         return false;
     }
 
 #ifndef CONFIG_USER_ONLY
-    return (dc->tb->pc & TARGET_PAGE_MASK) == (dest & TARGET_PAGE_MASK);
+    return (dc->base.pc_first & TARGET_PAGE_MASK) == (dest & TARGET_PAGE_MASK);
 #else
     return true;
 #endif
@@ -XXX,XX +XXX,XX @@ static bool use_goto_tb(DisasContext *dc, uint32_t dest)
 
 static void gen_goto_tb(DisasContext *dc, int n, uint32_t dest)
 {
-    TranslationBlock *tb = dc->tb;
+    const TranslationBlock *tb = dc->base.tb;
 
     if (use_goto_tb(dc, dest)) {
         tcg_gen_goto_tb(n);
@@ -XXX,XX +XXX,XX @@ static void gen_excp(DisasContext *dc, uint32_t code, uint32_t flags)
 
 static void gen_check_supervisor(DisasContext *dc)
 {
-    if (dc->tb->flags & CR_STATUS_U) {
+    if (dc->base.tb->flags & CR_STATUS_U) {
         /* CPU in user mode, privileged instruction called, stop. */
         t_gen_helper_raise_exception(dc, EXCP_SUPERI);
     }
@@ -XXX,XX +XXX,XX @@ static void jmpi(DisasContext *dc, uint32_t code, uint32_t flags)
 {
     J_TYPE(instr, code);
     gen_goto_tb(dc, 0, (dc->pc & 0xF0000000) | (instr.imm26 << 2));
-    dc->is_jmp = DISAS_NORETURN;
+    dc->base.is_jmp = DISAS_NORETURN;
 }
 
 static void call(DisasContext *dc, uint32_t code, uint32_t flags)
@@ -XXX,XX +XXX,XX @@ static void br(DisasContext *dc, uint32_t code, uint32_t flags)
     I_TYPE(instr, code);
 
     gen_goto_tb(dc, 0, dc->pc + 4 + (instr.imm16.s & -4));
-    dc->is_jmp = DISAS_NORETURN;
+    dc->base.is_jmp = DISAS_NORETURN;
 }
 
 static void gen_bxx(DisasContext *dc, uint32_t code, uint32_t flags)
@@ -XXX,XX +XXX,XX @@ static void gen_bxx(DisasContext *dc, uint32_t code, uint32_t flags)
     gen_goto_tb(dc, 0, dc->pc + 4);
     gen_set_label(l1);
     gen_goto_tb(dc, 1, dc->pc + 4 + (instr.imm16.s & -4));
-    dc->is_jmp = DISAS_NORETURN;
+    dc->base.is_jmp = DISAS_NORETURN;
 }
 
 /* Comparison instructions */
@@ -XXX,XX +XXX,XX @@ static void eret(DisasContext *dc, uint32_t code, uint32_t flags)
     tcg_gen_mov_tl(cpu_R[CR_STATUS], cpu_R[CR_ESTATUS]);
     tcg_gen_mov_tl(cpu_R[R_PC], cpu_R[R_EA]);
 
-    dc->is_jmp = DISAS_JUMP;
+    dc->base.is_jmp = DISAS_JUMP;
 }
 
 /* PC <- ra */
@@ -XXX,XX +XXX,XX @@ static void ret(DisasContext *dc, uint32_t code, uint32_t flags)
 {
     tcg_gen_mov_tl(cpu_R[R_PC], cpu_R[R_RA]);
 
-    dc->is_jmp = DISAS_JUMP;
+    dc->base.is_jmp = DISAS_JUMP;
 }
 
 /* PC <- ba */
@@ -XXX,XX +XXX,XX @@ static void bret(DisasContext *dc, uint32_t code, uint32_t flags)
 {
     tcg_gen_mov_tl(cpu_R[R_PC], cpu_R[R_BA]);
 
-    dc->is_jmp = DISAS_JUMP;
+    dc->base.is_jmp = DISAS_JUMP;
 }
 
 /* PC <- rA */
@@ -XXX,XX +XXX,XX @@ static void jmp(DisasContext *dc, uint32_t code, uint32_t flags)
 
     tcg_gen_mov_tl(cpu_R[R_PC], load_gpr(dc, instr.a));
 
-    dc->is_jmp = DISAS_JUMP;
+    dc->base.is_jmp = DISAS_JUMP;
 }
 
 /* rC <- PC + 4 */
@@ -XXX,XX +XXX,XX @@ static void callr(DisasContext *dc, uint32_t code, uint32_t flags)
     tcg_gen_mov_tl(cpu_R[R_PC], load_gpr(dc, instr.a));
     tcg_gen_movi_tl(cpu_R[R_RA], dc->pc + 4);
 
-    dc->is_jmp = DISAS_JUMP;
+    dc->base.is_jmp = DISAS_JUMP;
 }
 
 /* rC <- ctlN */
@@ -XXX,XX +XXX,XX @@ static void wrctl(DisasContext *dc, uint32_t code, uint32_t flags)
     /* If interrupts were enabled using WRCTL, trigger them. */
 #if !defined(CONFIG_USER_ONLY)
     if ((instr.imm5 + CR_BASE) == CR_STATUS) {
-        if (tb_cflags(dc->tb) & CF_USE_ICOUNT) {
+        if (tb_cflags(dc->base.tb) & CF_USE_ICOUNT) {
             gen_io_start();
         }
         gen_helper_check_interrupts(cpu_env);
-        dc->is_jmp = DISAS_UPDATE;
+        dc->base.is_jmp = DISAS_UPDATE;
     }
 #endif
 }
@@ -XXX,XX +XXX,XX @@ static void gen_exception(DisasContext *dc, uint32_t excp)
     tcg_gen_movi_tl(cpu_R[R_PC], dc->pc);
     gen_helper_raise_exception(cpu_env, tmp);
     tcg_temp_free_i32(tmp);
-    dc->is_jmp = DISAS_NORETURN;
+    dc->base.is_jmp = DISAS_NORETURN;
 }
 
 /* generate intermediate code for basic block 'tb'.  */
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
     int num_insns;
 
     /* Initialize DC */
-    dc->is_jmp  = DISAS_NEXT;
-    dc->pc      = tb->pc;
-    dc->tb      = tb;
+
+    dc->base.tb = tb;
+    dc->base.singlestep_enabled = cs->singlestep_enabled;
+    dc->base.is_jmp = DISAS_NEXT;
+    dc->base.pc_first = tb->pc;
+    dc->base.pc_next = tb->pc;
+
     dc->mem_idx = cpu_mmu_index(env, false);
-    dc->singlestep_enabled = cs->singlestep_enabled;
 
     /* Set up instruction counts */
     num_insns = 0;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 
     gen_tb_start(tb);
     do {
-        tcg_gen_insn_start(dc->pc);
+        tcg_gen_insn_start(dc->base.pc_next);
         num_insns++;
 
-        if (unlikely(cpu_breakpoint_test(cs, dc->pc, BP_ANY))) {
+        if (unlikely(cpu_breakpoint_test(cs, dc->base.pc_next, BP_ANY))) {
             gen_exception(dc, EXCP_DEBUG);
             /* The address covered by the breakpoint must be included in
                [tb->pc, tb->pc + tb->size) in order to for it to be
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
             gen_io_start();
         }
 
+        dc->pc = dc->base.pc_next;
+        dc->base.pc_next += 4;
+
         /* Decode an instruction */
         handle_instruction(dc, env);
 
-        dc->pc += 4;
-
         /* Translation stops when a conditional branch is encountered.
          * Otherwise the subsequent code could get translated several times.
          * Also stop translation when a page boundary is reached.  This
          * ensures prefetch aborts occur at the right place.  */
-    } while (!dc->is_jmp &&
+    } while (!dc->base.is_jmp &&
              !tcg_op_buf_full() &&
              num_insns < max_insns);
 
     /* Indicate where the next block should start */
-    switch (dc->is_jmp) {
+    switch (dc->base.is_jmp) {
     case DISAS_NEXT:
     case DISAS_UPDATE:
         /* Save the current PC back into the CPU register */
-        tcg_gen_movi_tl(cpu_R[R_PC], dc->pc);
+        tcg_gen_movi_tl(cpu_R[R_PC], dc->base.pc_next);
         tcg_gen_exit_tb(NULL, 0);
         break;
 
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
     gen_tb_end(tb, num_insns);
 
     /* Mark instruction starts for the final generated instruction */
-    tb->size = dc->pc - tb->pc;
+    tb->size = dc->base.pc_next - dc->base.pc_first;
     tb->icount = num_insns;
 
 #ifdef DEBUG_DISAS
     if (qemu_loglevel_mask(CPU_LOG_TB_IN_ASM)
-        && qemu_log_in_addr_range(tb->pc)) {
+        && qemu_log_in_addr_range(dc->base.pc_first)) {
         FILE *logfile = qemu_log_lock();
-        qemu_log("IN: %s\n", lookup_symbol(tb->pc));
-        log_target_disas(cs, tb->pc, dc->pc - tb->pc);
+        qemu_log("IN: %s\n", lookup_symbol(dc->base.pc_first));
+        log_target_disas(cs, tb->pc, tb->size);
         qemu_log("\n");
         qemu_log_unlock(logfile);
     }
-- 
2.25.1

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/nios2/translate.c | 128 ++++++++++++++++++++-------------------
 1 file changed, 65 insertions(+), 63 deletions(-)

diff --git a/target/nios2/translate.c b/target/nios2/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/translate.c
+++ b/target/nios2/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception(DisasContext *dc, uint32_t excp)
 }
 
 /* generate intermediate code for basic block 'tb'.  */
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+static void nios2_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
 {
+    DisasContext *dc = container_of(dcbase, DisasContext, base);
     CPUNios2State *env = cs->env_ptr;
-    DisasContext dc1, *dc = &dc1;
-    int num_insns;
-
-    /* Initialize DC */
-
-    dc->base.tb = tb;
-    dc->base.singlestep_enabled = cs->singlestep_enabled;
-    dc->base.is_jmp = DISAS_NEXT;
-    dc->base.pc_first = tb->pc;
-    dc->base.pc_next = tb->pc;
+    int page_insns;
 
     dc->mem_idx = cpu_mmu_index(env, false);
 
-    /* Set up instruction counts */
-    num_insns = 0;
-    if (max_insns > 1) {
-        int page_insns = (TARGET_PAGE_SIZE - (tb->pc & ~TARGET_PAGE_MASK)) / 4;
-        if (max_insns > page_insns) {
-            max_insns = page_insns;
-        }
-    }
+    /* Bound the number of insns to execute to those left on the page.  */
+    page_insns = -(dc->base.pc_first | TARGET_PAGE_MASK) / 4;
+    dc->base.max_insns = MIN(page_insns, dc->base.max_insns);
+}
 
-    gen_tb_start(tb);
-    do {
-        tcg_gen_insn_start(dc->base.pc_next);
-        num_insns++;
+static void nios2_tr_tb_start(DisasContextBase *db, CPUState *cs)
+{
+}
 
-        if (unlikely(cpu_breakpoint_test(cs, dc->base.pc_next, BP_ANY))) {
-            gen_exception(dc, EXCP_DEBUG);
-            /* The address covered by the breakpoint must be included in
-               [tb->pc, tb->pc + tb->size) in order to for it to be
-               properly cleared -- thus we increment the PC here so that
-               the logic setting tb->size below does the right thing.  */
-            dc->pc += 4;
-            break;
-        }
+static void nios2_tr_insn_start(DisasContextBase *dcbase, CPUState *cs)
+{
+    tcg_gen_insn_start(dcbase->pc_next);
+}
 
-        if (num_insns == max_insns && (tb_cflags(tb) & CF_LAST_IO)) {
-            gen_io_start();
-        }
+static bool nios2_tr_breakpoint_check(DisasContextBase *dcbase, CPUState *cs,
+                                      const CPUBreakpoint *bp)
+{
+    DisasContext *dc = container_of(dcbase, DisasContext, base);
 
-        dc->pc = dc->base.pc_next;
-        dc->base.pc_next += 4;
+    gen_exception(dc, EXCP_DEBUG);
+    /*
+     * The address covered by the breakpoint must be included in
+     * [tb->pc, tb->pc + tb->size) in order to for it to be
+     * properly cleared -- thus we increment the PC here so that
+     * the logic setting tb->size below does the right thing.
+     */
+    dc->base.pc_next += 4;
+    return true;
+}
 
-        /* Decode an instruction */
-        handle_instruction(dc, env);
+static void nios2_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
+{
+    DisasContext *dc = container_of(dcbase, DisasContext, base);
+    CPUNios2State *env = cs->env_ptr;
 
-        /* Translation stops when a conditional branch is encountered.
-         * Otherwise the subsequent code could get translated several times.
-         * Also stop translation when a page boundary is reached.  This
-         * ensures prefetch aborts occur at the right place.  */
-    } while (!dc->base.is_jmp &&
-             !tcg_op_buf_full() &&
-             num_insns < max_insns);
+    dc->pc = dc->base.pc_next;
+    dc->base.pc_next += 4;
+
+    /* Decode an instruction */
+    handle_instruction(dc, env);
+}
+
+static void nios2_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
+{
+    DisasContext *dc = container_of(dcbase, DisasContext, base);
 
     /* Indicate where the next block should start */
     switch (dc->base.is_jmp) {
-    case DISAS_NEXT:
+    case DISAS_TOO_MANY:
     case DISAS_UPDATE:
         /* Save the current PC back into the CPU register */
         tcg_gen_movi_tl(cpu_R[R_PC], dc->base.pc_next);
         tcg_gen_exit_tb(NULL, 0);
         break;
 
-    default:
     case DISAS_JUMP:
         /* The jump will already have updated the PC register */
         tcg_gen_exit_tb(NULL, 0);
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
     case DISAS_NORETURN:
         /* nothing more to generate */
         break;
+
+    default:
+        g_assert_not_reached();
     }
+}
 
-    /* End off the block */
-    gen_tb_end(tb, num_insns);
+static void nios2_tr_disas_log(const DisasContextBase *dcbase, CPUState *cpu)
+{
+    qemu_log("IN: %s\n", lookup_symbol(dcbase->pc_first));
+    log_target_disas(cpu, dcbase->pc_first, dcbase->tb->size);
+}
 
-    /* Mark instruction starts for the final generated instruction */
-    tb->size = dc->base.pc_next - dc->base.pc_first;
-    tb->icount = num_insns;
+static const TranslatorOps nios2_tr_ops = {
+    .init_disas_context = nios2_tr_init_disas_context,
+    .tb_start           = nios2_tr_tb_start,
+    .insn_start         = nios2_tr_insn_start,
+    .breakpoint_check   = nios2_tr_breakpoint_check,
+    .translate_insn     = nios2_tr_translate_insn,
+    .tb_stop            = nios2_tr_tb_stop,
+    .disas_log          = nios2_tr_disas_log,
+};
 
-#ifdef DEBUG_DISAS
-    if (qemu_loglevel_mask(CPU_LOG_TB_IN_ASM)
-        && qemu_log_in_addr_range(dc->base.pc_first)) {
-        FILE *logfile = qemu_log_lock();
-        qemu_log("IN: %s\n", lookup_symbol(dc->base.pc_first));
-        log_target_disas(cs, tb->pc, tb->size);
-        qemu_log("\n");
-        qemu_log_unlock(logfile);
-    }
-#endif
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+{
+    DisasContext dc;
+    translator_loop(&nios2_tr_ops, &dc.base, cs, tb, max_insns);
 }
 
 void nios2_cpu_dump_state(CPUState *cs, FILE *f, int flags)
-- 
2.25.1

Direct assignments to env during translation do not work.

As it happens, the only way we can get here is if env->pc
is already set to dc->pc.  We will trap on the first insn
we execute anywhere on the page.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/nios2/translate.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/nios2/translate.c b/target/nios2/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/translate.c
+++ b/target/nios2/translate.c
@@ -XXX,XX +XXX,XX @@ static void handle_instruction(DisasContext *dc, CPUNios2State *env)
     uint32_t code;
     uint8_t op;
     const Nios2Instruction *instr;
+
 #if defined(CONFIG_USER_ONLY)
     /* FIXME: Is this needed ? */
     if (dc->pc >= 0x1000 && dc->pc < 0x2000) {
-        env->regs[R_PC] = dc->pc;
         t_gen_helper_raise_exception(dc, 0xaa);
         return;
     }
 #endif
+
     code = cpu_ldl_code(env, dc->pc);
     op = get_opcode(code);
 
-- 
2.25.1

Move handle_instruction into nios2_tr_translate_insn
as the only caller.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/nios2/translate.c | 66 +++++++++++++++++++---------------------
 1 file changed, 31 insertions(+), 35 deletions(-)

diff --git a/target/nios2/translate.c b/target/nios2/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/translate.c
+++ b/target/nios2/translate.c
@@ -XXX,XX +XXX,XX @@ illegal_op:
     t_gen_helper_raise_exception(dc, EXCP_ILLEGAL);
 }
 
-static void handle_instruction(DisasContext *dc, CPUNios2State *env)
-{
-    uint32_t code;
-    uint8_t op;
-    const Nios2Instruction *instr;
-
-#if defined(CONFIG_USER_ONLY)
-    /* FIXME: Is this needed ? */
-    if (dc->pc >= 0x1000 && dc->pc < 0x2000) {
-        t_gen_helper_raise_exception(dc, 0xaa);
-        return;
-    }
-#endif
-
-    code = cpu_ldl_code(env, dc->pc);
-    op = get_opcode(code);
-
-    if (unlikely(op >= ARRAY_SIZE(i_type_instructions))) {
-        t_gen_helper_raise_exception(dc, EXCP_ILLEGAL);
-        return;
-    }
-
-    dc->zero = NULL;
-
-    instr = &i_type_instructions[op];
-    instr->handler(dc, code, instr->flags);
-
-    if (dc->zero) {
-        tcg_temp_free(dc->zero);
-    }
-}
-
 static const char * const regnames[] = {
     "zero",       "at",         "r2",         "r3",
     "r4",         "r5",         "r6",         "r7",
@@ -XXX,XX +XXX,XX @@ static void nios2_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
 {
     DisasContext *dc = container_of(dcbase, DisasContext, base);
     CPUNios2State *env = cs->env_ptr;
+    const Nios2Instruction *instr;
+    uint32_t code, pc;
+    uint8_t op;
 
-    dc->pc = dc->base.pc_next;
-    dc->base.pc_next += 4;
+    pc = dc->base.pc_next;
+    dc->pc = pc;
+    dc->base.pc_next = pc + 4;
 
     /* Decode an instruction */
-    handle_instruction(dc, env);
+
+#if defined(CONFIG_USER_ONLY)
+    /* FIXME: Is this needed ? */
+    if (pc >= 0x1000 && pc < 0x2000) {
+        t_gen_helper_raise_exception(dc, 0xaa);
+        return;
+    }
+#endif
+
+    code = cpu_ldl_code(env, pc);
+    op = get_opcode(code);
+
+    if (unlikely(op >= ARRAY_SIZE(i_type_instructions))) {
+        t_gen_helper_raise_exception(dc, EXCP_ILLEGAL);
+        return;
+    }
+
+    dc->zero = NULL;
+
+    instr = &i_type_instructions[op];
+    instr->handler(dc, code, instr->flags);
+
+    if (dc->zero) {
+        tcg_temp_free(dc->zero);
+    }
 }
 
 static void nios2_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
-- 
2.25.1

We have pre-computed the next instruction address into
dc->base.pc_next, so we might as well use it.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/nios2/translate.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/nios2/translate.c b/target/nios2/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/translate.c
+++ b/target/nios2/translate.c
@@ -XXX,XX +XXX,XX @@ static void jmpi(DisasContext *dc, uint32_t code, uint32_t flags)
 
 static void call(DisasContext *dc, uint32_t code, uint32_t flags)
 {
-    tcg_gen_movi_tl(cpu_R[R_RA], dc->pc + 4);
+    tcg_gen_movi_tl(cpu_R[R_RA], dc->base.pc_next);
     jmpi(dc, code, flags);
 }
 
@@ -XXX,XX +XXX,XX @@ static void br(DisasContext *dc, uint32_t code, uint32_t flags)
 {
     I_TYPE(instr, code);
 
-    gen_goto_tb(dc, 0, dc->pc + 4 + (instr.imm16.s & -4));
+    gen_goto_tb(dc, 0, dc->base.pc_next + (instr.imm16.s & -4));
     dc->base.is_jmp = DISAS_NORETURN;
 }
 
@@ -XXX,XX +XXX,XX @@ static void gen_bxx(DisasContext *dc, uint32_t code, uint32_t flags)
 
     TCGLabel *l1 = gen_new_label();
     tcg_gen_brcond_tl(flags, cpu_R[instr.a], cpu_R[instr.b], l1);
-    gen_goto_tb(dc, 0, dc->pc + 4);
+    gen_goto_tb(dc, 0, dc->base.pc_next);
     gen_set_label(l1);
-    gen_goto_tb(dc, 1, dc->pc + 4 + (instr.imm16.s & -4));
+    gen_goto_tb(dc, 1, dc->base.pc_next + (instr.imm16.s & -4));
     dc->base.is_jmp = DISAS_NORETURN;
 }
 
@@ -XXX,XX +XXX,XX @@ static void nextpc(DisasContext *dc, uint32_t code, uint32_t flags)
     R_TYPE(instr, code);
 
     if (likely(instr.c != R_ZERO)) {
-        tcg_gen_movi_tl(cpu_R[instr.c], dc->pc + 4);
+        tcg_gen_movi_tl(cpu_R[instr.c], dc->base.pc_next);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void callr(DisasContext *dc, uint32_t code, uint32_t flags)
     R_TYPE(instr, code);
 
     tcg_gen_mov_tl(cpu_R[R_PC], load_gpr(dc, instr.a));
-    tcg_gen_movi_tl(cpu_R[R_RA], dc->pc + 4);
+    tcg_gen_movi_tl(cpu_R[R_RA], dc->base.pc_next);
 
     dc->base.is_jmp = DISAS_JUMP;
 }
-- 
2.25.1

Migrate the bstate, tb and singlestep_enabled fields
from DisasContext into the base.

Tested-by: Michael Rolnik <mrolnik@gmail.com>
Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/translate.c | 58 +++++++++++++++++++++---------------------
 1 file changed, 29 insertions(+), 29 deletions(-)

diff --git a/target/avr/translate.c b/target/avr/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/translate.c
+++ b/target/avr/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext DisasContext;
 
 /* This is the state at translation time. */
 struct DisasContext {
-    TranslationBlock *tb;
+    DisasContextBase base;
 
     CPUAVRState *env;
     CPUState *cs;
@@ -XXX,XX +XXX,XX @@ struct DisasContext {
 
     /* Routine used to access memory */
     int memidx;
-    int bstate;
-    int singlestep;
 
     /*
      * some AVR instructions can make the following instruction to be skipped
@@ -XXX,XX +XXX,XX @@ static bool avr_have_feature(DisasContext *ctx, int feature)
 {
     if (!avr_feature(ctx->env, feature)) {
         gen_helper_unsupported(cpu_env);
-        ctx->bstate = DISAS_NORETURN;
+        ctx->base.is_jmp = DISAS_NORETURN;
         return false;
     }
     return true;
@@ -XXX,XX +XXX,XX @@ static void gen_jmp_ez(DisasContext *ctx)
 {
     tcg_gen_deposit_tl(cpu_pc, cpu_r[30], cpu_r[31], 8, 8);
     tcg_gen_or_tl(cpu_pc, cpu_pc, cpu_eind);
-    ctx->bstate = DISAS_LOOKUP;
+    ctx->base.is_jmp = DISAS_LOOKUP;
 }
 
 static void gen_jmp_z(DisasContext *ctx)
 {
     tcg_gen_deposit_tl(cpu_pc, cpu_r[30], cpu_r[31], 8, 8);
-    ctx->bstate = DISAS_LOOKUP;
+    ctx->base.is_jmp = DISAS_LOOKUP;
 }
 
 static void gen_push_ret(DisasContext *ctx, int ret)
@@ -XXX,XX +XXX,XX @@ static void gen_pop_ret(DisasContext *ctx, TCGv ret)
 
 static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
 {
-    TranslationBlock *tb = ctx->tb;
+    const TranslationBlock *tb = ctx->base.tb;
 
-    if (ctx->singlestep == 0) {
+    if (!ctx->base.singlestep_enabled) {
         tcg_gen_goto_tb(n);
         tcg_gen_movi_i32(cpu_pc, dest);
         tcg_gen_exit_tb(tb, n);
@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
         gen_helper_debug(cpu_env);
         tcg_gen_exit_tb(NULL, 0);
     }
-    ctx->bstate = DISAS_NORETURN;
+    ctx->base.is_jmp = DISAS_NORETURN;
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static bool trans_RET(DisasContext *ctx, arg_RET *a)
 {
     gen_pop_ret(ctx, cpu_pc);
 
-    ctx->bstate = DISAS_LOOKUP;
+    ctx->base.is_jmp = DISAS_LOOKUP;
     return true;
 }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_RETI(DisasContext *ctx, arg_RETI *a)
     tcg_gen_movi_tl(cpu_If, 1);
 
     /* Need to return to main loop to re-evaluate interrupts.  */
-    ctx->bstate = DISAS_EXIT;
+    ctx->base.is_jmp = DISAS_EXIT;
     return true;
 }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_BRBC(DisasContext *ctx, arg_BRBC *a)
     gen_goto_tb(ctx, 0, ctx->npc + a->imm);
     gen_set_label(not_taken);
 
-    ctx->bstate = DISAS_CHAIN;
+    ctx->base.is_jmp = DISAS_CHAIN;
     return true;
 }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_BRBS(DisasContext *ctx, arg_BRBS *a)
     gen_goto_tb(ctx, 0, ctx->npc + a->imm);
     gen_set_label(not_taken);
 
-    ctx->bstate = DISAS_CHAIN;
+    ctx->base.is_jmp = DISAS_CHAIN;
     return true;
 }
 
@@ -XXX,XX +XXX,XX @@ static TCGv gen_get_zaddr(void)
  */
 static void gen_data_store(DisasContext *ctx, TCGv data, TCGv addr)
 {
-    if (ctx->tb->flags & TB_FLAGS_FULL_ACCESS) {
+    if (ctx->base.tb->flags & TB_FLAGS_FULL_ACCESS) {
         gen_helper_fullwr(cpu_env, data, addr);
     } else {
         tcg_gen_qemu_st8(data, addr, MMU_DATA_IDX); /* mem[addr] = data */
@@ -XXX,XX +XXX,XX @@ static void gen_data_store(DisasContext *ctx, TCGv data, TCGv addr)
 
 static void gen_data_load(DisasContext *ctx, TCGv data, TCGv addr)
 {
-    if (ctx->tb->flags & TB_FLAGS_FULL_ACCESS) {
+    if (ctx->base.tb->flags & TB_FLAGS_FULL_ACCESS) {
         gen_helper_fullrd(data, cpu_env, addr);
     } else {
         tcg_gen_qemu_ld8u(data, addr, MMU_DATA_IDX); /* data = mem[addr] */
@@ -XXX,XX +XXX,XX @@ static bool trans_BREAK(DisasContext *ctx, arg_BREAK *a)
 #ifdef BREAKPOINT_ON_BREAK
     tcg_gen_movi_tl(cpu_pc, ctx->npc - 1);
     gen_helper_debug(cpu_env);
-    ctx->bstate = DISAS_EXIT;
+    ctx->base.is_jmp = DISAS_EXIT;
 #else
     /* NOP */
 #endif
@@ -XXX,XX +XXX,XX @@ static bool trans_NOP(DisasContext *ctx, arg_NOP *a)
 static bool trans_SLEEP(DisasContext *ctx, arg_SLEEP *a)
 {
     gen_helper_sleep(cpu_env);
-    ctx->bstate = DISAS_NORETURN;
+    ctx->base.is_jmp = DISAS_NORETURN;
     return true;
 }
 
@@ -XXX,XX +XXX,XX @@ static void translate(DisasContext *ctx)
 
     if (!decode_insn(ctx, opcode)) {
         gen_helper_unsupported(cpu_env);
-        ctx->bstate = DISAS_NORETURN;
+        ctx->base.is_jmp = DISAS_NORETURN;
     }
 }
 
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     CPUAVRState *env = cs->env_ptr;
     DisasContext ctx = {
-        .tb = tb,
+        .base.tb = tb,
+        .base.is_jmp = DISAS_NEXT,
+        .base.pc_first = tb->pc,
+        .base.pc_next = tb->pc,
+        .base.singlestep_enabled = cs->singlestep_enabled,
         .cs = cs,
         .env = env,
         .memidx = 0,
-        .bstate = DISAS_NEXT,
         .skip_cond = TCG_COND_NEVER,
-        .singlestep = cs->singlestep_enabled,
     };
     target_ulong pc_start = tb->pc / 2;
     int num_insns = 0;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
          */
         max_insns = 1;
     }
-    if (ctx.singlestep) {
+    if (ctx.base.singlestep_enabled) {
         max_insns = 1;
     }
 
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
          * b main   - sets breakpoint at address 0x00000100 (code)
          * b *0x100 - sets breakpoint at address 0x00800100 (data)
          */
-        if (unlikely(!ctx.singlestep &&
+        if (unlikely(!ctx.base.singlestep_enabled &&
                 (cpu_breakpoint_test(cs, OFFSET_CODE + ctx.npc * 2, BP_ANY) ||
                  cpu_breakpoint_test(cs, OFFSET_DATA + ctx.npc * 2, BP_ANY)))) {
             canonicalize_skip(&ctx);
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
         if (skip_label) {
             canonicalize_skip(&ctx);
             gen_set_label(skip_label);
-            if (ctx.bstate == DISAS_NORETURN) {
-                ctx.bstate = DISAS_CHAIN;
+            if (ctx.base.is_jmp == DISAS_NORETURN) {
+                ctx.base.is_jmp = DISAS_CHAIN;
             }
         }
-    } while (ctx.bstate == DISAS_NEXT
+    } while (ctx.base.is_jmp == DISAS_NEXT
              && num_insns < max_insns
              && (ctx.npc - pc_start) * 2 < TARGET_PAGE_SIZE - 4
              && !tcg_op_buf_full());
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 
     bool nonconst_skip = canonicalize_skip(&ctx);
 
-    switch (ctx.bstate) {
+    switch (ctx.base.is_jmp) {
     case DISAS_NORETURN:
         assert(!nonconst_skip);
         break;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
         tcg_gen_movi_tl(cpu_pc, ctx.npc);
         /* fall through */
     case DISAS_LOOKUP:
-        if (!ctx.singlestep) {
+        if (!ctx.base.singlestep_enabled) {
             tcg_gen_lookup_and_goto_ptr();
             break;
         }
         /* fall through */
     case DISAS_EXIT:
-        if (ctx.singlestep) {
+        if (ctx.base.singlestep_enabled) {
             gen_helper_debug(cpu_env);
         } else {
             tcg_gen_exit_tb(NULL, 0);
-- 
2.25.1

Prepare for receiving it as a pointer input.

Tested-by: Michael Rolnik <mrolnik@gmail.com>
Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/translate.c | 84 +++++++++++++++++++++---------------------
 1 file changed, 43 insertions(+), 41 deletions(-)

diff --git a/target/avr/translate.c b/target/avr/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/translate.c
+++ b/target/avr/translate.c
@@ -XXX,XX +XXX,XX @@ struct DisasContext {
      * used in the following manner (sketch)
      *
      * TCGLabel *skip_label = NULL;
-     * if (ctx.skip_cond != TCG_COND_NEVER) {
+     * if (ctx->skip_cond != TCG_COND_NEVER) {
      *     skip_label = gen_new_label();
      *     tcg_gen_brcond_tl(skip_cond, skip_var0, skip_var1, skip_label);
      * }
@@ -XXX,XX +XXX,XX @@ struct DisasContext {
      *     free_skip_var0 = false;
      * }
      *
-     * translate(&ctx);
+     * translate(ctx);
      *
      * if (skip_label) {
      *     gen_set_label(skip_label);
@@ -XXX,XX +XXX,XX @@ static bool canonicalize_skip(DisasContext *ctx)
 void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     CPUAVRState *env = cs->env_ptr;
-    DisasContext ctx = {
+    DisasContext ctx1 = {
         .base.tb = tb,
         .base.is_jmp = DISAS_NEXT,
         .base.pc_first = tb->pc,
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
         .memidx = 0,
         .skip_cond = TCG_COND_NEVER,
     };
+    DisasContext *ctx = &ctx1;
     target_ulong pc_start = tb->pc / 2;
     int num_insns = 0;
 
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
          */
         max_insns = 1;
     }
-    if (ctx.base.singlestep_enabled) {
+    if (ctx->base.singlestep_enabled) {
         max_insns = 1;
     }
 
     gen_tb_start(tb);
 
-    ctx.npc = pc_start;
+    ctx->npc = pc_start;
     if (tb->flags & TB_FLAGS_SKIP) {
-        ctx.skip_cond = TCG_COND_ALWAYS;
-        ctx.skip_var0 = cpu_skip;
+        ctx->skip_cond = TCG_COND_ALWAYS;
+        ctx->skip_var0 = cpu_skip;
     }
 
     do {
         TCGLabel *skip_label = NULL;
 
         /* translate current instruction */
-        tcg_gen_insn_start(ctx.npc);
+        tcg_gen_insn_start(ctx->npc);
         num_insns++;
 
         /*
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
          * b main   - sets breakpoint at address 0x00000100 (code)
          * b *0x100 - sets breakpoint at address 0x00800100 (data)
          */
-        if (unlikely(!ctx.base.singlestep_enabled &&
-                (cpu_breakpoint_test(cs, OFFSET_CODE + ctx.npc * 2, BP_ANY) ||
-                 cpu_breakpoint_test(cs, OFFSET_DATA + ctx.npc * 2, BP_ANY)))) {
-            canonicalize_skip(&ctx);
-            tcg_gen_movi_tl(cpu_pc, ctx.npc);
+        if (unlikely(!ctx->base.singlestep_enabled &&
+            (cpu_breakpoint_test(cs, OFFSET_CODE + ctx->npc * 2, BP_ANY) ||
+             cpu_breakpoint_test(cs, OFFSET_DATA + ctx->npc * 2, BP_ANY)))) {
+            canonicalize_skip(ctx);
+            tcg_gen_movi_tl(cpu_pc, ctx->npc);
             gen_helper_debug(cpu_env);
             goto done_generating;
         }
 
         /* Conditionally skip the next instruction, if indicated.  */
-        if (ctx.skip_cond != TCG_COND_NEVER) {
+        if (ctx->skip_cond != TCG_COND_NEVER) {
             skip_label = gen_new_label();
-            if (ctx.skip_var0 == cpu_skip) {
+            if (ctx->skip_var0 == cpu_skip) {
                 /*
                  * Copy cpu_skip so that we may zero it before the branch.
                  * This ensures that cpu_skip is non-zero after the label
                  * if and only if the skipped insn itself sets a skip.
                  */
-                ctx.free_skip_var0 = true;
-                ctx.skip_var0 = tcg_temp_new();
-                tcg_gen_mov_tl(ctx.skip_var0, cpu_skip);
+                ctx->free_skip_var0 = true;
+                ctx->skip_var0 = tcg_temp_new();
+                tcg_gen_mov_tl(ctx->skip_var0, cpu_skip);
                 tcg_gen_movi_tl(cpu_skip, 0);
             }
-            if (ctx.skip_var1 == NULL) {
-                tcg_gen_brcondi_tl(ctx.skip_cond, ctx.skip_var0, 0, skip_label);
+            if (ctx->skip_var1 == NULL) {
+                tcg_gen_brcondi_tl(ctx->skip_cond, ctx->skip_var0,
+                                   0, skip_label);
             } else {
-                tcg_gen_brcond_tl(ctx.skip_cond, ctx.skip_var0,
-                                  ctx.skip_var1, skip_label);
-                ctx.skip_var1 = NULL;
+                tcg_gen_brcond_tl(ctx->skip_cond, ctx->skip_var0,
+                                  ctx->skip_var1, skip_label);
+                ctx->skip_var1 = NULL;
             }
-            if (ctx.free_skip_var0) {
-                tcg_temp_free(ctx.skip_var0);
-                ctx.free_skip_var0 = false;
+            if (ctx->free_skip_var0) {
+                tcg_temp_free(ctx->skip_var0);
+                ctx->free_skip_var0 = false;
             }
-            ctx.skip_cond = TCG_COND_NEVER;
-            ctx.skip_var0 = NULL;
+            ctx->skip_cond = TCG_COND_NEVER;
+            ctx->skip_var0 = NULL;
         }
 
-        translate(&ctx);
+        translate(ctx);
 
         if (skip_label) {
-            canonicalize_skip(&ctx);
+            canonicalize_skip(ctx);
             gen_set_label(skip_label);
-            if (ctx.base.is_jmp == DISAS_NORETURN) {
-                ctx.base.is_jmp = DISAS_CHAIN;
+            if (ctx->base.is_jmp == DISAS_NORETURN) {
+                ctx->base.is_jmp = DISAS_CHAIN;
             }
         }
-    } while (ctx.base.is_jmp == DISAS_NEXT
+    } while (ctx->base.is_jmp == DISAS_NEXT
              && num_insns < max_insns
-             && (ctx.npc - pc_start) * 2 < TARGET_PAGE_SIZE - 4
+             && (ctx->npc - pc_start) * 2 < TARGET_PAGE_SIZE - 4
              && !tcg_op_buf_full());
 
     if (tb->cflags & CF_LAST_IO) {
         gen_io_end();
     }
 
-    bool nonconst_skip = canonicalize_skip(&ctx);
+    bool nonconst_skip = canonicalize_skip(ctx);
 
-    switch (ctx.base.is_jmp) {
+    switch (ctx->base.is_jmp) {
     case DISAS_NORETURN:
         assert(!nonconst_skip);
         break;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
     case DISAS_CHAIN:
         if (!nonconst_skip) {
             /* Note gen_goto_tb checks singlestep.  */
-            gen_goto_tb(&ctx, 1, ctx.npc);
+            gen_goto_tb(ctx, 1, ctx->npc);
             break;
         }
-        tcg_gen_movi_tl(cpu_pc, ctx.npc);
+        tcg_gen_movi_tl(cpu_pc, ctx->npc);
         /* fall through */
     case DISAS_LOOKUP:
-        if (!ctx.base.singlestep_enabled) {
+        if (!ctx->base.singlestep_enabled) {
             tcg_gen_lookup_and_goto_ptr();
             break;
         }
         /* fall through */
     case DISAS_EXIT:
-        if (ctx.base.singlestep_enabled) {
+        if (ctx->base.singlestep_enabled) {
             gen_helper_debug(cpu_env);
         } else {
             tcg_gen_exit_tb(NULL, 0);
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 done_generating:
     gen_tb_end(tb, num_insns);
 
-    tb->size = (ctx.npc - pc_start) * 2;
+    tb->size = (ctx->npc - pc_start) * 2;
     tb->icount = num_insns;
 
 #ifdef DEBUG_DISAS
-- 
2.25.1

Tested-by: Michael Rolnik <mrolnik@gmail.com>
Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/translate.c | 234 ++++++++++++++++++++++-------------------
 1 file changed, 128 insertions(+), 106 deletions(-)

diff --git a/target/avr/translate.c b/target/avr/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/translate.c
+++ b/target/avr/translate.c
@@ -XXX,XX +XXX,XX @@ static bool canonicalize_skip(DisasContext *ctx)
     return true;
 }
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+static void gen_breakpoint(DisasContext *ctx)
 {
+    canonicalize_skip(ctx);
+    tcg_gen_movi_tl(cpu_pc, ctx->npc);
+    gen_helper_debug(cpu_env);
+    ctx->base.is_jmp = DISAS_NORETURN;
+}
+
+static void avr_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
+{
+    DisasContext *ctx = container_of(dcbase, DisasContext, base);
     CPUAVRState *env = cs->env_ptr;
-    DisasContext ctx1 = {
-        .base.tb = tb,
-        .base.is_jmp = DISAS_NEXT,
-        .base.pc_first = tb->pc,
-        .base.pc_next = tb->pc,
-        .base.singlestep_enabled = cs->singlestep_enabled,
-        .cs = cs,
-        .env = env,
-        .memidx = 0,
-        .skip_cond = TCG_COND_NEVER,
-    };
-    DisasContext *ctx = &ctx1;
-    target_ulong pc_start = tb->pc / 2;
-    int num_insns = 0;
+    uint32_t tb_flags = ctx->base.tb->flags;
 
-    if (tb->flags & TB_FLAGS_FULL_ACCESS) {
-        /*
-         * This flag is set by ST/LD instruction we will regenerate it ONLY
-         * with mem/cpu memory access instead of mem access
-         */
-        max_insns = 1;
-    }
-    if (ctx->base.singlestep_enabled) {
-        max_insns = 1;
-    }
+    ctx->cs = cs;
+    ctx->env = env;
+    ctx->npc = ctx->base.pc_first / 2;
 
-    gen_tb_start(tb);
-
-    ctx->npc = pc_start;
-    if (tb->flags & TB_FLAGS_SKIP) {
+    ctx->skip_cond = TCG_COND_NEVER;
+    if (tb_flags & TB_FLAGS_SKIP) {
         ctx->skip_cond = TCG_COND_ALWAYS;
         ctx->skip_var0 = cpu_skip;
     }
 
-    do {
-        TCGLabel *skip_label = NULL;
-
-        /* translate current instruction */
-        tcg_gen_insn_start(ctx->npc);
-        num_insns++;
-
+    if (tb_flags & TB_FLAGS_FULL_ACCESS) {
         /*
-         * this is due to some strange GDB behavior
-         * let's assume main has address 0x100
-         * b main   - sets breakpoint at address 0x00000100 (code)
-         * b *0x100 - sets breakpoint at address 0x00800100 (data)
+         * This flag is set by ST/LD instruction we will regenerate it ONLY
+         * with mem/cpu memory access instead of mem access
          */
-        if (unlikely(!ctx->base.singlestep_enabled &&
-            (cpu_breakpoint_test(cs, OFFSET_CODE + ctx->npc * 2, BP_ANY) ||
-             cpu_breakpoint_test(cs, OFFSET_DATA + ctx->npc * 2, BP_ANY)))) {
-            canonicalize_skip(ctx);
-            tcg_gen_movi_tl(cpu_pc, ctx->npc);
-            gen_helper_debug(cpu_env);
-            goto done_generating;
-        }
+        ctx->base.max_insns = 1;
+    }
+}
 
-        /* Conditionally skip the next instruction, if indicated.  */
-        if (ctx->skip_cond != TCG_COND_NEVER) {
-            skip_label = gen_new_label();
-            if (ctx->skip_var0 == cpu_skip) {
-                /*
-                 * Copy cpu_skip so that we may zero it before the branch.
-                 * This ensures that cpu_skip is non-zero after the label
-                 * if and only if the skipped insn itself sets a skip.
-                 */
-                ctx->free_skip_var0 = true;
-                ctx->skip_var0 = tcg_temp_new();
-                tcg_gen_mov_tl(ctx->skip_var0, cpu_skip);
-                tcg_gen_movi_tl(cpu_skip, 0);
-            }
-            if (ctx->skip_var1 == NULL) {
-                tcg_gen_brcondi_tl(ctx->skip_cond, ctx->skip_var0,
-                                   0, skip_label);
-            } else {
-                tcg_gen_brcond_tl(ctx->skip_cond, ctx->skip_var0,
-                                  ctx->skip_var1, skip_label);
-                ctx->skip_var1 = NULL;
-            }
-            if (ctx->free_skip_var0) {
-                tcg_temp_free(ctx->skip_var0);
-                ctx->free_skip_var0 = false;
-            }
-            ctx->skip_cond = TCG_COND_NEVER;
-            ctx->skip_var0 = NULL;
-        }
+static void avr_tr_tb_start(DisasContextBase *db, CPUState *cs)
+{
+}
 
-        translate(ctx);
+static void avr_tr_insn_start(DisasContextBase *dcbase, CPUState *cs)
+{
+    DisasContext *ctx = container_of(dcbase, DisasContext, base);
 
-        if (skip_label) {
-            canonicalize_skip(ctx);
-            gen_set_label(skip_label);
-            if (ctx->base.is_jmp == DISAS_NORETURN) {
-                ctx->base.is_jmp = DISAS_CHAIN;
-            }
-        }
-    } while (ctx->base.is_jmp == DISAS_NEXT
-             && num_insns < max_insns
-             && (ctx->npc - pc_start) * 2 < TARGET_PAGE_SIZE - 4
-             && !tcg_op_buf_full());
+    tcg_gen_insn_start(ctx->npc);
+}
 
-    if (tb->cflags & CF_LAST_IO) {
-        gen_io_end();
+static bool avr_tr_breakpoint_check(DisasContextBase *dcbase, CPUState *cs,
+                                    const CPUBreakpoint *bp)
+{
+    DisasContext *ctx = container_of(dcbase, DisasContext, base);
+
+    gen_breakpoint(ctx);
+    return true;
+}
+
+static void avr_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
+{
+    DisasContext *ctx = container_of(dcbase, DisasContext, base);
+    TCGLabel *skip_label = NULL;
+
+    /*
+     * This is due to some strange GDB behavior
+     * Let's assume main has address 0x100:
+     * b main   - sets breakpoint at address 0x00000100 (code)
+     * b *0x100 - sets breakpoint at address 0x00800100 (data)
+     *
+     * The translator driver has already taken care of the code pointer.
+     */
+    if (!ctx->base.singlestep_enabled &&
+        cpu_breakpoint_test(cs, OFFSET_DATA + ctx->base.pc_next, BP_ANY)) {
+        gen_breakpoint(ctx);
+        return;
     }
 
+    /* Conditionally skip the next instruction, if indicated.  */
+    if (ctx->skip_cond != TCG_COND_NEVER) {
+        skip_label = gen_new_label();
+        if (ctx->skip_var0 == cpu_skip) {
+            /*
+             * Copy cpu_skip so that we may zero it before the branch.
+             * This ensures that cpu_skip is non-zero after the label
+             * if and only if the skipped insn itself sets a skip.
+             */
+            ctx->free_skip_var0 = true;
+            ctx->skip_var0 = tcg_temp_new();
+            tcg_gen_mov_tl(ctx->skip_var0, cpu_skip);
+            tcg_gen_movi_tl(cpu_skip, 0);
+        }
+        if (ctx->skip_var1 == NULL) {
+            tcg_gen_brcondi_tl(ctx->skip_cond, ctx->skip_var0, 0, skip_label);
+        } else {
+            tcg_gen_brcond_tl(ctx->skip_cond, ctx->skip_var0,
+                              ctx->skip_var1, skip_label);
+            ctx->skip_var1 = NULL;
+        }
+        if (ctx->free_skip_var0) {
+            tcg_temp_free(ctx->skip_var0);
+            ctx->free_skip_var0 = false;
+        }
+        ctx->skip_cond = TCG_COND_NEVER;
+        ctx->skip_var0 = NULL;
+    }
+
+    translate(ctx);
+
+    ctx->base.pc_next = ctx->npc * 2;
+
+    if (skip_label) {
+        canonicalize_skip(ctx);
+        gen_set_label(skip_label);
+        if (ctx->base.is_jmp == DISAS_NORETURN) {
+            ctx->base.is_jmp = DISAS_CHAIN;
+        }
+    }
+
+    if (ctx->base.is_jmp == DISAS_NEXT) {
+        target_ulong page_first = ctx->base.pc_first & TARGET_PAGE_MASK;
+
+        if ((ctx->base.pc_next - page_first) >= TARGET_PAGE_SIZE - 4) {
+            ctx->base.is_jmp = DISAS_TOO_MANY;
+        }
+    }
+}
+
+static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
+{
+    DisasContext *ctx = container_of(dcbase, DisasContext, base);
     bool nonconst_skip = canonicalize_skip(ctx);
 
     switch (ctx->base.is_jmp) {
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
     default:
         g_assert_not_reached();
     }
+}
 
-done_generating:
-    gen_tb_end(tb, num_insns);
+static void avr_tr_disas_log(const DisasContextBase *dcbase, CPUState *cs)
+{
+    qemu_log("IN: %s\n", lookup_symbol(dcbase->pc_first));
+    log_target_disas(cs, dcbase->pc_first, dcbase->tb->size);
+}
 
-    tb->size = (ctx->npc - pc_start) * 2;
-    tb->icount = num_insns;
+static const TranslatorOps avr_tr_ops = {
+    .init_disas_context = avr_tr_init_disas_context,
+    .tb_start           = avr_tr_tb_start,
+    .insn_start         = avr_tr_insn_start,
+    .breakpoint_check   = avr_tr_breakpoint_check,
+    .translate_insn     = avr_tr_translate_insn,
+    .tb_stop            = avr_tr_tb_stop,
+    .disas_log          = avr_tr_disas_log,
+};
 
-#ifdef DEBUG_DISAS
-    if (qemu_loglevel_mask(CPU_LOG_TB_IN_ASM)
-        && qemu_log_in_addr_range(tb->pc)) {
-        FILE *fd;
-        fd = qemu_log_lock();
-        qemu_log("IN: %s\n", lookup_symbol(tb->pc));
-        log_target_disas(cs, tb->pc, tb->size);
-        qemu_log("\n");
-        qemu_log_unlock(fd);
-    }
-#endif
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+{
+    DisasContext dc = { };
+    translator_loop(&avr_tr_ops, &dc.base, cs, tb, max_insns);
 }
 
 void restore_state_to_opc(CPUAVRState *env, TranslationBlock *tb,
-- 
2.25.1

Migrate the is_jmp, tb and singlestep_enabled fields
from DisasContext into the base.

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/cris/translate.c         | 49 +++++++++++++++++----------------
 target/cris/translate_v10.c.inc |  4 +--
 2 files changed, 27 insertions(+), 26 deletions(-)

diff --git a/target/cris/translate.c b/target/cris/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/translate.c
+++ b/target/cris/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv env_pc;
 
 /* This is the state at translation time.  */
 typedef struct DisasContext {
+    DisasContextBase base;
+
     CRISCPU *cpu;
     target_ulong pc, ppc;
 
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     int clear_locked_irq; /* Clear the irq lockout.  */
     int cpustate_changed;
     unsigned int tb_flags; /* tb dependent flags.  */
-    int is_jmp;
 
 #define JMP_NOJMP     0
 #define JMP_DIRECT    1
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     uint32_t jmp_pc;
 
     int delayed_branch;
-
-    TranslationBlock *tb;
-    int singlestep_enabled;
 } DisasContext;
 
 static void gen_BUG(DisasContext *dc, const char *file, int line)
@@ -XXX,XX +XXX,XX @@ static void t_gen_cc_jmp(TCGv pc_true, TCGv pc_false)
 static inline bool use_goto_tb(DisasContext *dc, target_ulong dest)
 {
 #ifndef CONFIG_USER_ONLY
-    return (dc->tb->pc & TARGET_PAGE_MASK) == (dest & TARGET_PAGE_MASK) ||
+    return (dc->base.pc_first & TARGET_PAGE_MASK) == (dest & TARGET_PAGE_MASK) ||
            (dc->ppc & TARGET_PAGE_MASK) == (dest & TARGET_PAGE_MASK);
 #else
     return true;
@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *dc, int n, target_ulong dest)
     if (use_goto_tb(dc, dest)) {
         tcg_gen_goto_tb(n);
         tcg_gen_movi_tl(env_pc, dest);
-        tcg_gen_exit_tb(dc->tb, n);
+        tcg_gen_exit_tb(dc->base.tb, n);
     } else {
         tcg_gen_movi_tl(env_pc, dest);
         tcg_gen_exit_tb(NULL, 0);
@@ -XXX,XX +XXX,XX @@ static int dec_setclrf(CPUCRISState *env, DisasContext *dc)
     /* Break the TB if any of the SPI flag changes.  */
     if (flags & (P_FLAG | S_FLAG)) {
         tcg_gen_movi_tl(env_pc, dc->pc + 2);
-        dc->is_jmp = DISAS_UPDATE;
+        dc->base.is_jmp = DISAS_UPDATE;
         dc->cpustate_changed = 1;
     }
 
     /* For the I flag, only act on posedge.  */
     if ((flags & I_FLAG)) {
         tcg_gen_movi_tl(env_pc, dc->pc + 2);
-        dc->is_jmp = DISAS_UPDATE;
+        dc->base.is_jmp = DISAS_UPDATE;
         dc->cpustate_changed = 1;
     }
 
@@ -XXX,XX +XXX,XX @@ static int dec_rfe_etc(CPUCRISState *env, DisasContext *dc)
         LOG_DIS("rfe\n");
         cris_evaluate_flags(dc);
         gen_helper_rfe(cpu_env);
-        dc->is_jmp = DISAS_UPDATE;
+        dc->base.is_jmp = DISAS_UPDATE;
         break;
     case 5:
         /* rfn.  */
         LOG_DIS("rfn\n");
         cris_evaluate_flags(dc);
         gen_helper_rfn(cpu_env);
-        dc->is_jmp = DISAS_UPDATE;
+        dc->base.is_jmp = DISAS_UPDATE;
         break;
     case 6:
         LOG_DIS("break %d\n", dc->op1);
@@ -XXX,XX +XXX,XX @@ static int dec_rfe_etc(CPUCRISState *env, DisasContext *dc)
         /* Breaks start at 16 in the exception vector.  */
         t_gen_movi_env_TN(trap_vector, dc->op1 + 16);
         t_gen_raise_exception(EXCP_BREAK);
-        dc->is_jmp = DISAS_UPDATE;
+        dc->base.is_jmp = DISAS_UPDATE;
         break;
     default:
         printf("op2=%x\n", dc->op2);
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
      * delayslot, like in real hw.
      */
     pc_start = tb->pc & ~1;
-    dc->cpu = env_archcpu(env);
-    dc->tb = tb;
 
-    dc->is_jmp = DISAS_NEXT;
+    dc->base.tb = tb;
+    dc->base.pc_first = pc_start;
+    dc->base.pc_next = pc_start;
+    dc->base.is_jmp = DISAS_NEXT;
+    dc->base.singlestep_enabled = cs->singlestep_enabled;
+
+    dc->cpu = env_archcpu(env);
     dc->ppc = pc_start;
     dc->pc = pc_start;
-    dc->singlestep_enabled = cs->singlestep_enabled;
     dc->flags_uptodate = 1;
     dc->flagx_known = 1;
     dc->flags_x = tb->flags & X_FLAG;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
             cris_evaluate_flags(dc);
             tcg_gen_movi_tl(env_pc, dc->pc);
             t_gen_raise_exception(EXCP_DEBUG);
-            dc->is_jmp = DISAS_UPDATE;
+            dc->base.is_jmp = DISAS_UPDATE;
             /* The address covered by the breakpoint must be included in
                [tb->pc, tb->pc + tb->size) in order to for it to be
                properly cleared -- thus we increment the PC here so that
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
                     gen_goto_tb(dc, 1, dc->jmp_pc);
                     gen_set_label(l1);
                     gen_goto_tb(dc, 0, dc->pc);
-                    dc->is_jmp = DISAS_TB_JUMP;
+                    dc->base.is_jmp = DISAS_TB_JUMP;
                     dc->jmp = JMP_NOJMP;
                 } else if (dc->jmp == JMP_DIRECT) {
                     cris_evaluate_flags(dc);
                     gen_goto_tb(dc, 0, dc->jmp_pc);
-                    dc->is_jmp = DISAS_TB_JUMP;
+                    dc->base.is_jmp = DISAS_TB_JUMP;
                     dc->jmp = JMP_NOJMP;
                 } else {
                     TCGv c = tcg_const_tl(dc->pc);
                     t_gen_cc_jmp(env_btarget, c);
                     tcg_temp_free(c);
-                    dc->is_jmp = DISAS_JUMP;
+                    dc->base.is_jmp = DISAS_JUMP;
                 }
                 break;
             }
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
         if (!(tb->pc & 1) && cs->singlestep_enabled) {
             break;
         }
-    } while (!dc->is_jmp && !dc->cpustate_changed
+    } while (!dc->base.is_jmp && !dc->cpustate_changed
             && !tcg_op_buf_full()
             && !singlestep
             && (dc->pc - page_start < TARGET_PAGE_SIZE)
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
     npc = dc->pc;
 
     /* Force an update if the per-tb cpu state has changed.  */
-    if (dc->is_jmp == DISAS_NEXT
+    if (dc->base.is_jmp == DISAS_NEXT
         && (dc->cpustate_changed || !dc->flagx_known
         || (dc->flags_x != (tb->flags & X_FLAG)))) {
-        dc->is_jmp = DISAS_UPDATE;
+        dc->base.is_jmp = DISAS_UPDATE;
         tcg_gen_movi_tl(env_pc, npc);
     }
     /* Broken branch+delayslot sequence.  */
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
     cris_evaluate_flags(dc);
 
     if (unlikely(cs->singlestep_enabled)) {
-        if (dc->is_jmp == DISAS_NEXT) {
+        if (dc->base.is_jmp == DISAS_NEXT) {
             tcg_gen_movi_tl(env_pc, npc);
         }
         t_gen_raise_exception(EXCP_DEBUG);
     } else {
-        switch (dc->is_jmp) {
+        switch (dc->base.is_jmp) {
         case DISAS_NEXT:
             gen_goto_tb(dc, 1, npc);
             break;
diff --git a/target/cris/translate_v10.c.inc b/target/cris/translate_v10.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/translate_v10.c.inc
+++ b/target/cris/translate_v10.c.inc
@@ -XXX,XX +XXX,XX @@ static unsigned int dec10_ind(CPUCRISState *env, DisasContext *dc)
                     t_gen_mov_env_TN(trap_vector, c);
                     tcg_temp_free(c);
                     t_gen_raise_exception(EXCP_BREAK);
-                    dc->is_jmp = DISAS_UPDATE;
+                    dc->base.is_jmp = DISAS_UPDATE;
                     return insn_len;
                 }
                 LOG_DIS("%d: jump.%d %d r%d r%d\n", __LINE__, size,
@@ -XXX,XX +XXX,XX @@ static unsigned int crisv10_decoder(CPUCRISState *env, DisasContext *dc)
     if (dc->clear_prefix && dc->tb_flags & PFIX_FLAG) {
         dc->tb_flags &= ~PFIX_FLAG;
         tcg_gen_andi_tl(cpu_PR[PR_CCS], cpu_PR[PR_CCS], ~PFIX_FLAG);
-        if (dc->tb_flags != dc->tb->flags) {
+        if (dc->tb_flags != dc->base.tb->flags) {
             dc->cpustate_changed = 1;
         }
     }
-- 
2.25.1

This value is unused.

diff --git a/target/cris/translate.c b/target/cris/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/translate.c
+++ b/target/cris/translate.c
@@ -XXX,XX +XXX,XX @@
 #define DISAS_JUMP    DISAS_TARGET_0 /* only pc was modified dynamically */
 #define DISAS_UPDATE  DISAS_TARGET_1 /* cpu state was modified dynamically */
 #define DISAS_TB_JUMP DISAS_TARGET_2 /* only pc was modified statically */
-#define DISAS_SWI     DISAS_TARGET_3
 
 /* Used by the decoder.  */
 #define EXTRACT_FIELD(src, start, end) \
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
                    to find the next TB */
             tcg_gen_exit_tb(NULL, 0);
             break;
-        case DISAS_SWI:
         case DISAS_TB_JUMP:
             /* nothing more to generate */
             break;
-- 
2.25.1

The only semantic of DISAS_TB_JUMP is that we've done goto_tb,
which is the same as DISAS_NORETURN -- we've exited the tb.

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/cris/translate.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/target/cris/translate.c b/target/cris/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/translate.c
+++ b/target/cris/translate.c
@@ -XXX,XX +XXX,XX @@
 /* is_jmp field values */
 #define DISAS_JUMP    DISAS_TARGET_0 /* only pc was modified dynamically */
 #define DISAS_UPDATE  DISAS_TARGET_1 /* cpu state was modified dynamically */
-#define DISAS_TB_JUMP DISAS_TARGET_2 /* only pc was modified statically */
 
 /* Used by the decoder.  */
 #define EXTRACT_FIELD(src, start, end) \
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
                     gen_goto_tb(dc, 1, dc->jmp_pc);
                     gen_set_label(l1);
                     gen_goto_tb(dc, 0, dc->pc);
-                    dc->base.is_jmp = DISAS_TB_JUMP;
+                    dc->base.is_jmp = DISAS_NORETURN;
                     dc->jmp = JMP_NOJMP;
                 } else if (dc->jmp == JMP_DIRECT) {
                     cris_evaluate_flags(dc);
                     gen_goto_tb(dc, 0, dc->jmp_pc);
-                    dc->base.is_jmp = DISAS_TB_JUMP;
+                    dc->base.is_jmp = DISAS_NORETURN;
                     dc->jmp = JMP_NOJMP;
                 } else {
                     TCGv c = tcg_const_tl(dc->pc);
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
                    to find the next TB */
             tcg_gen_exit_tb(NULL, 0);
             break;
-        case DISAS_TB_JUMP:
+        case DISAS_NORETURN:
             /* nothing more to generate */
             break;
         }
-- 
2.25.1

After we've raised the exception, we have left the TB.

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/cris/translate.c         | 5 +++--
 target/cris/translate_v10.c.inc | 3 ++-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/target/cris/translate.c b/target/cris/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/translate.c
+++ b/target/cris/translate.c
@@ -XXX,XX +XXX,XX @@ static int dec_rfe_etc(CPUCRISState *env, DisasContext *dc)
                        -offsetof(CRISCPU, env) + offsetof(CPUState, halted));
         tcg_gen_movi_tl(env_pc, dc->pc + 2);
         t_gen_raise_exception(EXCP_HLT);
+        dc->base.is_jmp = DISAS_NORETURN;
         return 2;
     }
 
@@ -XXX,XX +XXX,XX @@ static int dec_rfe_etc(CPUCRISState *env, DisasContext *dc)
         /* Breaks start at 16 in the exception vector.  */
         t_gen_movi_env_TN(trap_vector, dc->op1 + 16);
         t_gen_raise_exception(EXCP_BREAK);
-        dc->base.is_jmp = DISAS_UPDATE;
+        dc->base.is_jmp = DISAS_NORETURN;
         break;
     default:
         printf("op2=%x\n", dc->op2);
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
             cris_evaluate_flags(dc);
             tcg_gen_movi_tl(env_pc, dc->pc);
             t_gen_raise_exception(EXCP_DEBUG);
-            dc->base.is_jmp = DISAS_UPDATE;
+            dc->base.is_jmp = DISAS_NORETURN;
             /* The address covered by the breakpoint must be included in
                [tb->pc, tb->pc + tb->size) in order to for it to be
                properly cleared -- thus we increment the PC here so that
diff --git a/target/cris/translate_v10.c.inc b/target/cris/translate_v10.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/translate_v10.c.inc
+++ b/target/cris/translate_v10.c.inc
@@ -XXX,XX +XXX,XX @@ static inline void cris_illegal_insn(DisasContext *dc)
 {
     qemu_log_mask(LOG_GUEST_ERROR, "illegal insn at pc=%x\n", dc->pc);
     t_gen_raise_exception(EXCP_BREAK);
+    dc->base.is_jmp = DISAS_NORETURN;
 }
 
 static void gen_store_v10_conditional(DisasContext *dc, TCGv addr, TCGv val,
@@ -XXX,XX +XXX,XX @@ static unsigned int dec10_ind(CPUCRISState *env, DisasContext *dc)
                     t_gen_mov_env_TN(trap_vector, c);
                     tcg_temp_free(c);
                     t_gen_raise_exception(EXCP_BREAK);
-                    dc->base.is_jmp = DISAS_UPDATE;
+                    dc->base.is_jmp = DISAS_NORETURN;
                     return insn_len;
                 }
                 LOG_DIS("%d: jump.%d %d r%d r%d\n", __LINE__, size,
-- 
2.25.1

Do not skip the page check for user-only -- mmap/mprotect can
still change page mappings.  Only check dc->base.pc_first, not
dc->ppc -- the start page is the only one that's relevant.

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/cris/translate.c | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/target/cris/translate.c b/target/cris/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/translate.c
+++ b/target/cris/translate.c
@@ -XXX,XX +XXX,XX @@ static void t_gen_cc_jmp(TCGv pc_true, TCGv pc_false)
     gen_set_label(l1);
 }
 
-static inline bool use_goto_tb(DisasContext *dc, target_ulong dest)
+static bool use_goto_tb(DisasContext *dc, target_ulong dest)
 {
-#ifndef CONFIG_USER_ONLY
-    return (dc->base.pc_first & TARGET_PAGE_MASK) == (dest & TARGET_PAGE_MASK) ||
-           (dc->ppc & TARGET_PAGE_MASK) == (dest & TARGET_PAGE_MASK);
-#else
-    return true;
-#endif
+    return ((dest ^ dc->base.pc_first) & TARGET_PAGE_MASK) == 0;
 }
 
 static void gen_goto_tb(DisasContext *dc, int n, target_ulong dest)
-- 
2.25.1

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/cris/translate.c | 317 ++++++++++++++++++++++------------------
 1 file changed, 174 insertions(+), 143 deletions(-)

diff --git a/target/cris/translate.c b/target/cris/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/translate.c
+++ b/target/cris/translate.c
@@ -XXX,XX +XXX,XX @@ static unsigned int crisv32_decoder(CPUCRISState *env, DisasContext *dc)
  *
  */
 
-/* generate intermediate code for basic block 'tb'.  */
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+static void cris_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
 {
+    DisasContext *dc = container_of(dcbase, DisasContext, base);
     CPUCRISState *env = cs->env_ptr;
+    uint32_t tb_flags = dc->base.tb->flags;
     uint32_t pc_start;
-    unsigned int insn_len;
-    struct DisasContext ctx;
-    struct DisasContext *dc = &ctx;
-    uint32_t page_start;
-    target_ulong npc;
-    int num_insns;
 
     if (env->pregs[PR_VR] == 32) {
         dc->decoder = crisv32_decoder;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
         dc->clear_locked_irq = 1;
     }
 
-    /* Odd PC indicates that branch is rexecuting due to exception in the
+    /*
+     * Odd PC indicates that branch is rexecuting due to exception in the
      * delayslot, like in real hw.
      */
-    pc_start = tb->pc & ~1;
-
-    dc->base.tb = tb;
+    pc_start = dc->base.pc_first & ~1;
     dc->base.pc_first = pc_start;
     dc->base.pc_next = pc_start;
-    dc->base.is_jmp = DISAS_NEXT;
-    dc->base.singlestep_enabled = cs->singlestep_enabled;
 
     dc->cpu = env_archcpu(env);
     dc->ppc = pc_start;
     dc->pc = pc_start;
     dc->flags_uptodate = 1;
     dc->flagx_known = 1;
-    dc->flags_x = tb->flags & X_FLAG;
+    dc->flags_x = tb_flags & X_FLAG;
     dc->cc_x_uptodate = 0;
     dc->cc_mask = 0;
     dc->update_cc = 0;
     dc->clear_prefix = 0;
+    dc->cpustate_changed = 0;
 
     cris_update_cc_op(dc, CC_OP_FLAGS, 4);
     dc->cc_size_uptodate = -1;
 
     /* Decode TB flags.  */
-    dc->tb_flags = tb->flags & (S_FLAG | P_FLAG | U_FLAG \
-            | X_FLAG | PFIX_FLAG);
-    dc->delayed_branch = !!(tb->flags & 7);
+    dc->tb_flags = tb_flags & (S_FLAG | P_FLAG | U_FLAG | X_FLAG | PFIX_FLAG);
+    dc->delayed_branch = !!(tb_flags & 7);
     if (dc->delayed_branch) {
         dc->jmp = JMP_INDIRECT;
     } else {
         dc->jmp = JMP_NOJMP;
     }
+}
 
-    dc->cpustate_changed = 0;
+static void cris_tr_tb_start(DisasContextBase *db, CPUState *cpu)
+{
+}
 
-    page_start = pc_start & TARGET_PAGE_MASK;
-    num_insns = 0;
+static void cris_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu)
+{
+    DisasContext *dc = container_of(dcbase, DisasContext, base);
 
-    gen_tb_start(tb);
-    do {
-        tcg_gen_insn_start(dc->delayed_branch == 1
-                           ? dc->ppc | 1 : dc->pc);
-        num_insns++;
+    tcg_gen_insn_start(dc->delayed_branch == 1 ? dc->ppc | 1 : dc->pc);
+}
 
-        if (unlikely(cpu_breakpoint_test(cs, dc->pc, BP_ANY))) {
+static bool cris_tr_breakpoint_check(DisasContextBase *dcbase, CPUState *cpu,
+                                     const CPUBreakpoint *bp)
+{
+    DisasContext *dc = container_of(dcbase, DisasContext, base);
+
+    cris_evaluate_flags(dc);
+    tcg_gen_movi_tl(env_pc, dc->pc);
+    t_gen_raise_exception(EXCP_DEBUG);
+    dc->base.is_jmp = DISAS_NORETURN;
+    /*
+     * The address covered by the breakpoint must be included in
+     * [tb->pc, tb->pc + tb->size) in order to for it to be
+     * properly cleared -- thus we increment the PC here so that
+     * the logic setting tb->size below does the right thing.
+     */
+    dc->pc += 2;
+    return true;
+}
+
+static void cris_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
+{
+    DisasContext *dc = container_of(dcbase, DisasContext, base);
+    CPUCRISState *env = cs->env_ptr;
+    unsigned int insn_len;
+
+    /* Pretty disas.  */
+    LOG_DIS("%8.8x:\t", dc->pc);
+
+    dc->clear_x = 1;
+
+    insn_len = dc->decoder(env, dc);
+    dc->ppc = dc->pc;
+    dc->pc += insn_len;
+    dc->base.pc_next += insn_len;
+
+    if (dc->base.is_jmp == DISAS_NORETURN) {
+        return;
+    }
+
+    if (dc->clear_x) {
+        cris_clear_x_flag(dc);
+    }
+
+    /*
+     * Check for delayed branches here.  If we do it before
+     * actually generating any host code, the simulator will just
+     * loop doing nothing for on this program location.
+     */
+    if (dc->delayed_branch && --dc->delayed_branch == 0) {
+        if (dc->base.tb->flags & 7) {
+            t_gen_movi_env_TN(dslot, 0);
+        }
+
+        if (dc->cpustate_changed
+            || !dc->flagx_known
+            || (dc->flags_x != (dc->base.tb->flags & X_FLAG))) {
+            cris_store_direct_jmp(dc);
+        }
+
+        if (dc->clear_locked_irq) {
+            dc->clear_locked_irq = 0;
+            t_gen_movi_env_TN(locked_irq, 0);
+        }
+
+        if (dc->jmp == JMP_DIRECT_CC) {
+            TCGLabel *l1 = gen_new_label();
             cris_evaluate_flags(dc);
-            tcg_gen_movi_tl(env_pc, dc->pc);
-            t_gen_raise_exception(EXCP_DEBUG);
+
+            /* Conditional jmp.  */
+            tcg_gen_brcondi_tl(TCG_COND_EQ, env_btaken, 0, l1);
+            gen_goto_tb(dc, 1, dc->jmp_pc);
+            gen_set_label(l1);
+            gen_goto_tb(dc, 0, dc->pc);
             dc->base.is_jmp = DISAS_NORETURN;
-            /* The address covered by the breakpoint must be included in
-               [tb->pc, tb->pc + tb->size) in order to for it to be
-               properly cleared -- thus we increment the PC here so that
-               the logic setting tb->size below does the right thing.  */
-            dc->pc += 2;
-            break;
+            dc->jmp = JMP_NOJMP;
+        } else if (dc->jmp == JMP_DIRECT) {
+            cris_evaluate_flags(dc);
+            gen_goto_tb(dc, 0, dc->jmp_pc);
+            dc->base.is_jmp = DISAS_NORETURN;
+            dc->jmp = JMP_NOJMP;
+        } else {
+            TCGv c = tcg_const_tl(dc->pc);
+            t_gen_cc_jmp(env_btarget, c);
+            tcg_temp_free(c);
+            dc->base.is_jmp = DISAS_JUMP;
         }
+    }
 
-        /* Pretty disas.  */
-        LOG_DIS("%8.8x:\t", dc->pc);
+    /* Force an update if the per-tb cpu state has changed.  */
+    if (dc->base.is_jmp == DISAS_NEXT
+        && (dc->cpustate_changed
+            || !dc->flagx_known
+            || (dc->flags_x != (dc->base.tb->flags & X_FLAG)))) {
+        dc->base.is_jmp = DISAS_UPDATE;
+        tcg_gen_movi_tl(env_pc, dc->pc);
+    }
 
-        if (num_insns == max_insns && (tb_cflags(tb) & CF_LAST_IO)) {
-            gen_io_start();
-        }
-        dc->clear_x = 1;
+    /*
+     * FIXME: Only the first insn in the TB should cross a page boundary.
+     * If we can detect the length of the next insn easily, we should.
+     * In the meantime, simply stop when we do cross.
+     */
+    if (dc->base.is_jmp == DISAS_NEXT
+        && ((dc->pc ^ dc->base.pc_first) & TARGET_PAGE_MASK) != 0) {
+        dc->base.is_jmp = DISAS_TOO_MANY;
+    }
+}
 
-        insn_len = dc->decoder(env, dc);
-        dc->ppc = dc->pc;
-        dc->pc += insn_len;
-        if (dc->clear_x) {
-            cris_clear_x_flag(dc);
-        }
+static void cris_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
+{
+    DisasContext *dc = container_of(dcbase, DisasContext, base);
+    DisasJumpType is_jmp = dc->base.is_jmp;
+    target_ulong npc = dc->pc;
 
-        /* Check for delayed branches here. If we do it before
-           actually generating any host code, the simulator will just
-           loop doing nothing for on this program location.  */
-        if (dc->delayed_branch) {
-            dc->delayed_branch--;
-            if (dc->delayed_branch == 0) {
-                if (tb->flags & 7) {
-                    t_gen_movi_env_TN(dslot, 0);
-                }
-                if (dc->cpustate_changed || !dc->flagx_known
-                    || (dc->flags_x != (tb->flags & X_FLAG))) {
-                    cris_store_direct_jmp(dc);
-                }
-
-                if (dc->clear_locked_irq) {
-                    dc->clear_locked_irq = 0;
-                    t_gen_movi_env_TN(locked_irq, 0);
-                }
-
-                if (dc->jmp == JMP_DIRECT_CC) {
-                    TCGLabel *l1 = gen_new_label();
-                    cris_evaluate_flags(dc);
-
-                    /* Conditional jmp.  */
-                    tcg_gen_brcondi_tl(TCG_COND_EQ,
-                               env_btaken, 0, l1);
-                    gen_goto_tb(dc, 1, dc->jmp_pc);
-                    gen_set_label(l1);
-                    gen_goto_tb(dc, 0, dc->pc);
-                    dc->base.is_jmp = DISAS_NORETURN;
-                    dc->jmp = JMP_NOJMP;
-                } else if (dc->jmp == JMP_DIRECT) {
-                    cris_evaluate_flags(dc);
-                    gen_goto_tb(dc, 0, dc->jmp_pc);
-                    dc->base.is_jmp = DISAS_NORETURN;
-                    dc->jmp = JMP_NOJMP;
-                } else {
-                    TCGv c = tcg_const_tl(dc->pc);
-                    t_gen_cc_jmp(env_btarget, c);
-                    tcg_temp_free(c);
-                    dc->base.is_jmp = DISAS_JUMP;
-                }
-                break;
-            }
-        }
-
-        /* If we are rexecuting a branch due to exceptions on
-           delay slots don't break.  */
-        if (!(tb->pc & 1) && cs->singlestep_enabled) {
-            break;
-        }
-    } while (!dc->base.is_jmp && !dc->cpustate_changed
-            && !tcg_op_buf_full()
-            && !singlestep
-            && (dc->pc - page_start < TARGET_PAGE_SIZE)
-            && num_insns < max_insns);
+    if (is_jmp == DISAS_NORETURN) {
+        /* If we have a broken branch+delayslot sequence, it's too late. */
+        assert(dc->delayed_branch != 1);
+        return;
+    }
 
     if (dc->clear_locked_irq) {
         t_gen_movi_env_TN(locked_irq, 0);
     }
 
-    npc = dc->pc;
-
-    /* Force an update if the per-tb cpu state has changed.  */
-    if (dc->base.is_jmp == DISAS_NEXT
-        && (dc->cpustate_changed || !dc->flagx_known
-        || (dc->flags_x != (tb->flags & X_FLAG)))) {
-        dc->base.is_jmp = DISAS_UPDATE;
-        tcg_gen_movi_tl(env_pc, npc);
-    }
     /* Broken branch+delayslot sequence.  */
     if (dc->delayed_branch == 1) {
         /* Set env->dslot to the size of the branch insn.  */
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 
     cris_evaluate_flags(dc);
 
-    if (unlikely(cs->singlestep_enabled)) {
-        if (dc->base.is_jmp == DISAS_NEXT) {
+    if (unlikely(dc->base.singlestep_enabled)) {
+        switch (is_jmp) {
+        case DISAS_TOO_MANY:
             tcg_gen_movi_tl(env_pc, npc);
-        }
-        t_gen_raise_exception(EXCP_DEBUG);
-    } else {
-        switch (dc->base.is_jmp) {
-        case DISAS_NEXT:
-            gen_goto_tb(dc, 1, npc);
-            break;
-        default:
+            /* fall through */
         case DISAS_JUMP:
         case DISAS_UPDATE:
-            /* indicate that the hash table must be used
-                   to find the next TB */
-            tcg_gen_exit_tb(NULL, 0);
-            break;
-        case DISAS_NORETURN:
-            /* nothing more to generate */
+            t_gen_raise_exception(EXCP_DEBUG);
+            return;
+        default:
             break;
         }
+        g_assert_not_reached();
     }
-    gen_tb_end(tb, num_insns);
 
-    tb->size = dc->pc - pc_start;
-    tb->icount = num_insns;
-
-#ifdef DEBUG_DISAS
-#if !DISAS_CRIS
-    if (qemu_loglevel_mask(CPU_LOG_TB_IN_ASM)
-        && qemu_log_in_addr_range(pc_start)) {
-        FILE *logfile = qemu_log_lock();
-        qemu_log("--------------\n");
-        qemu_log("IN: %s\n", lookup_symbol(pc_start));
-        log_target_disas(cs, pc_start, dc->pc - pc_start);
-        qemu_log_unlock(logfile);
+    switch (is_jmp) {
+    case DISAS_TOO_MANY:
+        gen_goto_tb(dc, 0, npc);
+        break;
+    case DISAS_JUMP:
+    case DISAS_UPDATE:
+        /* Indicate that interupts must be re-evaluated before the next TB. */
+        tcg_gen_exit_tb(NULL, 0);
+        break;
+    default:
+        g_assert_not_reached();
     }
-#endif
-#endif
+}
+
+static void cris_tr_disas_log(const DisasContextBase *dcbase, CPUState *cpu)
+{
+    if (!DISAS_CRIS) {
+        qemu_log("IN: %s\n", lookup_symbol(dcbase->pc_first));
+        log_target_disas(cpu, dcbase->pc_first, dcbase->tb->size);
+    }
+}
+
+static const TranslatorOps cris_tr_ops = {
+    .init_disas_context = cris_tr_init_disas_context,
+    .tb_start           = cris_tr_tb_start,
+    .insn_start         = cris_tr_insn_start,
+    .breakpoint_check   = cris_tr_breakpoint_check,
+    .translate_insn     = cris_tr_translate_insn,
+    .tb_stop            = cris_tr_tb_stop,
+    .disas_log          = cris_tr_disas_log,
+};
+
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+{
+    DisasContext dc;
+    translator_loop(&cris_tr_ops, &dc.base, cs, tb, max_insns);
 }
 
 void cris_cpu_dump_state(CPUState *cs, FILE *f, int flags)
-- 
2.25.1

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/cris/translate.c         | 19 ++++++++++---------
 target/cris/translate_v10.c.inc |  6 +++---
 2 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/target/cris/translate.c b/target/cris/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/translate.c
+++ b/target/cris/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_BUG(DisasContext *dc, const char *file, int line)
     cpu_abort(CPU(dc->cpu), "%s:%d pc=%x\n", file, line, dc->pc);
 }
 
-static const char *regnames_v32[] =
+static const char * const regnames_v32[] =
 {
     "$r0", "$r1", "$r2", "$r3",
     "$r4", "$r5", "$r6", "$r7",
     "$r8", "$r9", "$r10", "$r11",
     "$r12", "$r13", "$sp", "$acr",
 };
-static const char *pregnames_v32[] =
+
+static const char * const pregnames_v32[] =
 {
     "$bz", "$vr", "$pid", "$srs",
     "$wz", "$exs", "$eda", "$mof",
@@ -XXX,XX +XXX,XX @@ static const char *pregnames_v32[] =
 };
 
 /* We need this table to handle preg-moves with implicit width.  */
-static int preg_sizes[] = {
+static const int preg_sizes[] = {
     1, /* bz.  */
     1, /* vr.  */
     4, /* pid.  */
@@ -XXX,XX +XXX,XX @@ static inline void t_gen_swapw(TCGv d, TCGv s)
    ((T0 >> 5) & 0x02020202) |
    ((T0 >> 7) & 0x01010101));
  */
-static inline void t_gen_swapr(TCGv d, TCGv s)
+static void t_gen_swapr(TCGv d, TCGv s)
 {
-    struct {
+    static const struct {
         int shift; /* LSL when positive, LSR when negative.  */
         uint32_t mask;
     } bitrev[] = {
@@ -XXX,XX +XXX,XX @@ static int dec_prep_alu_m(CPUCRISState *env, DisasContext *dc,
 #if DISAS_CRIS
 static const char *cc_name(int cc)
 {
-    static const char *cc_names[16] = {
+    static const char * const cc_names[16] = {
         "cc", "cs", "ne", "eq", "vc", "vs", "pl", "mi",
         "ls", "hi", "ge", "lt", "gt", "le", "a", "p"
     };
@@ -XXX,XX +XXX,XX @@ static int dec_null(CPUCRISState *env, DisasContext *dc)
     return 2;
 }
 
-static struct decoder_info {
+static const struct decoder_info {
     struct {
         uint32_t bits;
         uint32_t mask;
@@ -XXX,XX +XXX,XX @@ void cris_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 {
     CRISCPU *cpu = CRIS_CPU(cs);
     CPUCRISState *env = &cpu->env;
-    const char **regnames;
-    const char **pregnames;
+    const char * const *regnames;
+    const char * const *pregnames;
     int i;
 
     if (!env) {
diff --git a/target/cris/translate_v10.c.inc b/target/cris/translate_v10.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/translate_v10.c.inc
+++ b/target/cris/translate_v10.c.inc
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "crisv10-decode.h"
 
-static const char *regnames_v10[] =
+static const char * const regnames_v10[] =
 {
     "$r0", "$r1", "$r2", "$r3",
     "$r4", "$r5", "$r6", "$r7",
@@ -XXX,XX +XXX,XX @@ static const char *regnames_v10[] =
     "$r12", "$r13", "$sp", "$pc",
 };
 
-static const char *pregnames_v10[] =
+static const char * const pregnames_v10[] =
 {
     "$bz", "$vr", "$p2", "$p3",
     "$wz", "$ccr", "$p6-prefix", "$mof",
@@ -XXX,XX +XXX,XX @@ static const char *pregnames_v10[] =
 };
 
 /* We need this table to handle preg-moves with implicit width.  */
-static int preg_sizes_v10[] = {
+static const int preg_sizes_v10[] = {
     1, /* bz.  */
     1, /* vr.  */
     1, /* pid. */
-- 
2.25.1

We really do this already, by including them into the same test.
This just hoists the expression up a bit.

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/cris/translate.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/target/cris/translate.c b/target/cris/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/translate.c
+++ b/target/cris/translate.c
@@ -XXX,XX +XXX,XX @@ static void cris_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
         cris_clear_x_flag(dc);
     }
 
+    /* Fold unhandled changes to X_FLAG into cpustate_changed. */
+    dc->cpustate_changed |= !dc->flagx_known;
+    dc->cpustate_changed |= dc->flags_x != (dc->base.tb->flags & X_FLAG);
+
     /*
      * Check for delayed branches here.  If we do it before
      * actually generating any host code, the simulator will just
@@ -XXX,XX +XXX,XX @@ static void cris_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
             t_gen_movi_env_TN(dslot, 0);
         }
 
-        if (dc->cpustate_changed
-            || !dc->flagx_known
-            || (dc->flags_x != (dc->base.tb->flags & X_FLAG))) {
+        if (dc->cpustate_changed) {
             cris_store_direct_jmp(dc);
         }
 
@@ -XXX,XX +XXX,XX @@ static void cris_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
     }
 
     /* Force an update if the per-tb cpu state has changed.  */
-    if (dc->base.is_jmp == DISAS_NEXT
-        && (dc->cpustate_changed
-            || !dc->flagx_known
-            || (dc->flags_x != (dc->base.tb->flags & X_FLAG)))) {
+    if (dc->base.is_jmp == DISAS_NEXT && dc->cpustate_changed) {
         dc->base.is_jmp = DISAS_UPDATE;
         tcg_gen_movi_tl(env_pc, dc->pc);
     }
-- 
2.25.1

These insns set DISAS_UPDATE without cpustate_changed,
which isn't quite right.

diff --git a/target/cris/translate.c b/target/cris/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/translate.c
+++ b/target/cris/translate.c
@@ -XXX,XX +XXX,XX @@ static int dec_rfe_etc(CPUCRISState *env, DisasContext *dc)
         cris_evaluate_flags(dc);
         gen_helper_rfe(cpu_env);
         dc->base.is_jmp = DISAS_UPDATE;
+        dc->cpustate_changed = true;
         break;
     case 5:
         /* rfn.  */
@@ -XXX,XX +XXX,XX @@ static int dec_rfe_etc(CPUCRISState *env, DisasContext *dc)
         cris_evaluate_flags(dc);
         gen_helper_rfn(cpu_env);
         dc->base.is_jmp = DISAS_UPDATE;
+        dc->cpustate_changed = true;
         break;
     case 6:
         LOG_DIS("break %d\n", dc->op1);
-- 
2.25.1

Move this pc update into tb_stop.
We will be able to re-use this code shortly.

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/cris/translate.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/target/cris/translate.c b/target/cris/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/translate.c
+++ b/target/cris/translate.c
@@ -XXX,XX +XXX,XX @@
 #define BUG() (gen_BUG(dc, __FILE__, __LINE__))
 #define BUG_ON(x) ({if (x) BUG();})
 
-/* is_jmp field values */
-#define DISAS_JUMP    DISAS_TARGET_0 /* only pc was modified dynamically */
-#define DISAS_UPDATE  DISAS_TARGET_1 /* cpu state was modified dynamically */
+/*
+ * Target-specific is_jmp field values
+ */
+/* Only pc was modified dynamically */
+#define DISAS_JUMP          DISAS_TARGET_0
+/* Cpu state was modified dynamically, including pc */
+#define DISAS_UPDATE        DISAS_TARGET_1
+/* Cpu state was modified dynamically, excluding pc -- use npc */
+#define DISAS_UPDATE_NEXT   DISAS_TARGET_2
 
 /* Used by the decoder.  */
 #define EXTRACT_FIELD(src, start, end) \
@@ -XXX,XX +XXX,XX @@ static void cris_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
 
     /* Force an update if the per-tb cpu state has changed.  */
     if (dc->base.is_jmp == DISAS_NEXT && dc->cpustate_changed) {
-        dc->base.is_jmp = DISAS_UPDATE;
-        tcg_gen_movi_tl(env_pc, dc->pc);
+        dc->base.is_jmp = DISAS_UPDATE_NEXT;
+        return;
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ static void cris_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
     if (unlikely(dc->base.singlestep_enabled)) {
         switch (is_jmp) {
         case DISAS_TOO_MANY:
+        case DISAS_UPDATE_NEXT:
             tcg_gen_movi_tl(env_pc, npc);
             /* fall through */
         case DISAS_JUMP:
@@ -XXX,XX +XXX,XX @@ static void cris_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
     case DISAS_TOO_MANY:
         gen_goto_tb(dc, 0, npc);
         break;
+    case DISAS_UPDATE_NEXT:
+        tcg_gen_movi_tl(env_pc, npc);
+        /* fall through */
     case DISAS_JUMP:
     case DISAS_UPDATE:
         /* Indicate that interupts must be re-evaluated before the next TB. */
-- 
2.25.1

Move delayed branch handling to tb_stop, where we can re-use other
end-of-tb code, e.g. the evaluation of flags.  Honor single stepping.
Validate that we aren't losing state by overwriting is_jmp.

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/cris/translate.c | 96 ++++++++++++++++++++++++-----------------
 1 file changed, 56 insertions(+), 40 deletions(-)

diff --git a/target/cris/translate.c b/target/cris/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/translate.c
+++ b/target/cris/translate.c
@@ -XXX,XX +XXX,XX @@
 #define DISAS_UPDATE        DISAS_TARGET_1
 /* Cpu state was modified dynamically, excluding pc -- use npc */
 #define DISAS_UPDATE_NEXT   DISAS_TARGET_2
+/* PC update for delayed branch, see cpustate_changed otherwise */
+#define DISAS_DBRANCH       DISAS_TARGET_3
 
 /* Used by the decoder.  */
 #define EXTRACT_FIELD(src, start, end) \
@@ -XXX,XX +XXX,XX @@ static void cris_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
     dc->cpustate_changed |= dc->flags_x != (dc->base.tb->flags & X_FLAG);
 
     /*
-     * Check for delayed branches here.  If we do it before
-     * actually generating any host code, the simulator will just
-     * loop doing nothing for on this program location.
+     * All branches are delayed branches, handled immediately below.
+     * We don't expect to see odd combinations of exit conditions.
      */
+    assert(dc->base.is_jmp == DISAS_NEXT || dc->cpustate_changed);
+
     if (dc->delayed_branch && --dc->delayed_branch == 0) {
-        if (dc->base.tb->flags & 7) {
-            t_gen_movi_env_TN(dslot, 0);
-        }
+        dc->base.is_jmp = DISAS_DBRANCH;
+        return;
+    }
 
-        if (dc->cpustate_changed) {
-            cris_store_direct_jmp(dc);
-        }
-
-        if (dc->clear_locked_irq) {
-            dc->clear_locked_irq = 0;
-            t_gen_movi_env_TN(locked_irq, 0);
-        }
-
-        if (dc->jmp == JMP_DIRECT_CC) {
-            TCGLabel *l1 = gen_new_label();
-            cris_evaluate_flags(dc);
-
-            /* Conditional jmp.  */
-            tcg_gen_brcondi_tl(TCG_COND_EQ, env_btaken, 0, l1);
-            gen_goto_tb(dc, 1, dc->jmp_pc);
-            gen_set_label(l1);
-            gen_goto_tb(dc, 0, dc->pc);
-            dc->base.is_jmp = DISAS_NORETURN;
-            dc->jmp = JMP_NOJMP;
-        } else if (dc->jmp == JMP_DIRECT) {
-            cris_evaluate_flags(dc);
-            gen_goto_tb(dc, 0, dc->jmp_pc);
-            dc->base.is_jmp = DISAS_NORETURN;
-            dc->jmp = JMP_NOJMP;
-        } else {
-            TCGv c = tcg_const_tl(dc->pc);
-            t_gen_cc_jmp(env_btarget, c);
-            tcg_temp_free(c);
-            dc->base.is_jmp = DISAS_JUMP;
-        }
+    if (dc->base.is_jmp != DISAS_NEXT) {
+        return;
     }
 
     /* Force an update if the per-tb cpu state has changed.  */
-    if (dc->base.is_jmp == DISAS_NEXT && dc->cpustate_changed) {
+    if (dc->cpustate_changed) {
         dc->base.is_jmp = DISAS_UPDATE_NEXT;
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void cris_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
      * If we can detect the length of the next insn easily, we should.
      * In the meantime, simply stop when we do cross.
      */
-    if (dc->base.is_jmp == DISAS_NEXT
-        && ((dc->pc ^ dc->base.pc_first) & TARGET_PAGE_MASK) != 0) {
+    if ((dc->pc ^ dc->base.pc_first) & TARGET_PAGE_MASK) {
         dc->base.is_jmp = DISAS_TOO_MANY;
     }
 }
@@ -XXX,XX +XXX,XX @@ static void cris_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
 
     cris_evaluate_flags(dc);
 
+    /* Evaluate delayed branch destination and fold to another is_jmp case. */
+    if (is_jmp == DISAS_DBRANCH) {
+        if (dc->base.tb->flags & 7) {
+            t_gen_movi_env_TN(dslot, 0);
+        }
+
+        switch (dc->jmp) {
+        case JMP_DIRECT:
+            npc = dc->jmp_pc;
+            is_jmp = dc->cpustate_changed ? DISAS_UPDATE_NEXT : DISAS_TOO_MANY;
+            break;
+
+        case JMP_DIRECT_CC:
+            /*
+             * Use a conditional branch if either taken or not-taken path
+             * can use goto_tb.  If neither can, then treat it as indirect.
+             */
+            if (likely(!dc->base.singlestep_enabled)
+                && likely(!dc->cpustate_changed)
+                && (use_goto_tb(dc, dc->jmp_pc) || use_goto_tb(dc, npc))) {
+                TCGLabel *not_taken = gen_new_label();
+
+                tcg_gen_brcondi_tl(TCG_COND_EQ, env_btaken, 0, not_taken);
+                gen_goto_tb(dc, 1, dc->jmp_pc);
+                gen_set_label(not_taken);
+
+                /* not-taken case handled below. */
+                is_jmp = DISAS_TOO_MANY;
+                break;
+            }
+            tcg_gen_movi_tl(env_btarget, dc->jmp_pc);
+            /* fall through */
+
+        case JMP_INDIRECT:
+            t_gen_cc_jmp(env_btarget, tcg_constant_tl(npc));
+            is_jmp = dc->cpustate_changed ? DISAS_UPDATE : DISAS_JUMP;
+            break;
+
+        default:
+            g_assert_not_reached();
+        }
+    }
+
     if (unlikely(dc->base.singlestep_enabled)) {
         switch (is_jmp) {
         case DISAS_TOO_MANY:
-- 
2.25.1

We can use this in gen_goto_tb and for DISAS_JUMP
to indirectly chain to the next TB.

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/cris/translate.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/cris/translate.c b/target/cris/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/translate.c
+++ b/target/cris/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *dc, int n, target_ulong dest)
         tcg_gen_exit_tb(dc->base.tb, n);
     } else {
         tcg_gen_movi_tl(env_pc, dest);
-        tcg_gen_exit_tb(NULL, 0);
+        tcg_gen_lookup_and_goto_ptr();
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void cris_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
         tcg_gen_movi_tl(env_pc, npc);
         /* fall through */
     case DISAS_JUMP:
+        tcg_gen_lookup_and_goto_ptr();
+        break;
     case DISAS_UPDATE:
         /* Indicate that interupts must be re-evaluated before the next TB. */
         tcg_gen_exit_tb(NULL, 0);
-- 
2.25.1

Use movcond instead of brcond to set env_pc.
Discard the btarget and btaken variables to improve
register allocation and avoid unnecessary writeback.

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/cris/translate.c | 22 ++++++++++------------
 1 file changed, 10 insertions(+), 12 deletions(-)

diff --git a/target/cris/translate.c b/target/cris/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/translate.c
+++ b/target/cris/translate.c
@@ -XXX,XX +XXX,XX @@ static void t_gen_swapr(TCGv d, TCGv s)
     tcg_temp_free(org_s);
 }
 
-static void t_gen_cc_jmp(TCGv pc_true, TCGv pc_false)
-{
-    TCGLabel *l1 = gen_new_label();
-
-    /* Conditional jmp.  */
-    tcg_gen_mov_tl(env_pc, pc_false);
-    tcg_gen_brcondi_tl(TCG_COND_EQ, env_btaken, 0, l1);
-    tcg_gen_mov_tl(env_pc, pc_true);
-    gen_set_label(l1);
-}
-
 static bool use_goto_tb(DisasContext *dc, target_ulong dest)
 {
     return ((dest ^ dc->base.pc_first) & TARGET_PAGE_MASK) == 0;
@@ -XXX,XX +XXX,XX @@ static void cris_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
             /* fall through */
 
         case JMP_INDIRECT:
-            t_gen_cc_jmp(env_btarget, tcg_constant_tl(npc));
+            tcg_gen_movcond_tl(TCG_COND_NE, env_pc,
+                               env_btaken, tcg_constant_tl(0),
+                               env_btarget, tcg_constant_tl(npc));
             is_jmp = dc->cpustate_changed ? DISAS_UPDATE : DISAS_JUMP;
+
+            /*
+             * We have now consumed btaken and btarget.  Hint to the
+             * tcg compiler that the writeback to env may be dropped.
+             */
+            tcg_gen_discard_tl(env_btaken);
+            tcg_gen_discard_tl(env_btarget);
             break;
 
         default:
-- 
2.25.1

Ever since 2a44f7f17364, flagx_known is always true.
Fold away all of the tests against the flag.

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/cris/translate.c         | 99 ++++++++-------------------------
 target/cris/translate_v10.c.inc |  6 +-
 2 files changed, 24 insertions(+), 81 deletions(-)

diff --git a/target/cris/translate.c b/target/cris/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/translate.c
+++ b/target/cris/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
 
     int cc_x_uptodate;  /* 1 - ccs, 2 - known | X_FLAG. 0 not up-to-date.  */
     int flags_uptodate; /* Whether or not $ccs is up-to-date.  */
-    int flagx_known; /* Whether or not flags_x has the x flag known at
-                translation time.  */
     int flags_x;
 
     int clear_x; /* Clear x after this insn?  */
@@ -XXX,XX +XXX,XX @@ static inline void t_gen_add_flag(TCGv d, int flag)
 
 static inline void t_gen_addx_carry(DisasContext *dc, TCGv d)
 {
-    if (dc->flagx_known) {
-        if (dc->flags_x) {
-            TCGv c;
-            
-            c = tcg_temp_new();
-            t_gen_mov_TN_preg(c, PR_CCS);
-            /* C flag is already at bit 0.  */
-            tcg_gen_andi_tl(c, c, C_FLAG);
-            tcg_gen_add_tl(d, d, c);
-            tcg_temp_free(c);
-        }
-    } else {
-        TCGv x, c;
+    if (dc->flags_x) {
+        TCGv c = tcg_temp_new();
 
-        x = tcg_temp_new();
-        c = tcg_temp_new();
-        t_gen_mov_TN_preg(x, PR_CCS);
-        tcg_gen_mov_tl(c, x);
-
-        /* Propagate carry into d if X is set. Branch free.  */
+        t_gen_mov_TN_preg(c, PR_CCS);
+        /* C flag is already at bit 0.  */
         tcg_gen_andi_tl(c, c, C_FLAG);
-        tcg_gen_andi_tl(x, x, X_FLAG);
-        tcg_gen_shri_tl(x, x, 4);
-
-        tcg_gen_and_tl(x, x, c);
-        tcg_gen_add_tl(d, d, x);
-        tcg_temp_free(x);
+        tcg_gen_add_tl(d, d, c);
         tcg_temp_free(c);
     }
 }
 
 static inline void t_gen_subx_carry(DisasContext *dc, TCGv d)
 {
-    if (dc->flagx_known) {
-        if (dc->flags_x) {
-            TCGv c;
-            
-            c = tcg_temp_new();
-            t_gen_mov_TN_preg(c, PR_CCS);
-            /* C flag is already at bit 0.  */
-            tcg_gen_andi_tl(c, c, C_FLAG);
-            tcg_gen_sub_tl(d, d, c);
-            tcg_temp_free(c);
-        }
-    } else {
-        TCGv x, c;
+    if (dc->flags_x) {
+        TCGv c = tcg_temp_new();
 
-        x = tcg_temp_new();
-        c = tcg_temp_new();
-        t_gen_mov_TN_preg(x, PR_CCS);
-        tcg_gen_mov_tl(c, x);
-
-        /* Propagate carry into d if X is set. Branch free.  */
+        t_gen_mov_TN_preg(c, PR_CCS);
+        /* C flag is already at bit 0.  */
         tcg_gen_andi_tl(c, c, C_FLAG);
-        tcg_gen_andi_tl(x, x, X_FLAG);
-        tcg_gen_shri_tl(x, x, 4);
-
-        tcg_gen_and_tl(x, x, c);
-        tcg_gen_sub_tl(d, d, x);
-        tcg_temp_free(x);
+        tcg_gen_sub_tl(d, d, c);
         tcg_temp_free(c);
     }
 }
@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *dc, int n, target_ulong dest)
 
 static inline void cris_clear_x_flag(DisasContext *dc)
 {
-    if (dc->flagx_known && dc->flags_x) {
+    if (dc->flags_x) {
         dc->flags_uptodate = 0;
     }
-
-    dc->flagx_known = 1;
     dc->flags_x = 0;
 }
 
@@ -XXX,XX +XXX,XX @@ static void cris_evaluate_flags(DisasContext *dc)
         break;
     }
 
-    if (dc->flagx_known) {
-        if (dc->flags_x) {
-            tcg_gen_ori_tl(cpu_PR[PR_CCS], cpu_PR[PR_CCS], X_FLAG);
-        } else if (dc->cc_op == CC_OP_FLAGS) {
-            tcg_gen_andi_tl(cpu_PR[PR_CCS], cpu_PR[PR_CCS], ~X_FLAG);
-        }
+    if (dc->flags_x) {
+        tcg_gen_ori_tl(cpu_PR[PR_CCS], cpu_PR[PR_CCS], X_FLAG);
+    } else if (dc->cc_op == CC_OP_FLAGS) {
+        tcg_gen_andi_tl(cpu_PR[PR_CCS], cpu_PR[PR_CCS], ~X_FLAG);
     }
     dc->flags_uptodate = 1;
 }
@@ -XXX,XX +XXX,XX @@ static void cris_update_cc_op(DisasContext *dc, int op, int size)
 static inline void cris_update_cc_x(DisasContext *dc)
 {
     /* Save the x flag state at the time of the cc snapshot.  */
-    if (dc->flagx_known) {
-        if (dc->cc_x_uptodate == (2 | dc->flags_x)) {
-            return;
-        }
-        tcg_gen_movi_tl(cc_x, dc->flags_x);
-        dc->cc_x_uptodate = 2 | dc->flags_x;
-    } else {
-        tcg_gen_andi_tl(cc_x, cpu_PR[PR_CCS], X_FLAG);
-        dc->cc_x_uptodate = 1;
+    if (dc->cc_x_uptodate == (2 | dc->flags_x)) {
+        return;
     }
+    tcg_gen_movi_tl(cc_x, dc->flags_x);
+    dc->cc_x_uptodate = 2 | dc->flags_x;
 }
 
 /* Update cc prior to executing ALU op. Needs source operands untouched.  */
@@ -XXX,XX +XXX,XX @@ static void gen_store (DisasContext *dc, TCGv addr, TCGv val,
 
     /* Conditional writes. We only support the kind were X and P are known
        at translation time.  */
-    if (dc->flagx_known && dc->flags_x && (dc->tb_flags & P_FLAG)) {
+    if (dc->flags_x && (dc->tb_flags & P_FLAG)) {
         dc->postinc = 0;
         cris_evaluate_flags(dc);
         tcg_gen_ori_tl(cpu_PR[PR_CCS], cpu_PR[PR_CCS], C_FLAG);
@@ -XXX,XX +XXX,XX @@ static void gen_store (DisasContext *dc, TCGv addr, TCGv val,
 
     tcg_gen_qemu_st_tl(val, addr, mem_index, MO_TE + ctz32(size));
 
-    if (dc->flagx_known && dc->flags_x) {
+    if (dc->flags_x) {
         cris_evaluate_flags(dc);
         tcg_gen_andi_tl(cpu_PR[PR_CCS], cpu_PR[PR_CCS], ~C_FLAG);
     }
@@ -XXX,XX +XXX,XX @@ static int dec_addc_r(CPUCRISState *env, DisasContext *dc)
     LOG_DIS("addc $r%u, $r%u\n",
             dc->op1, dc->op2);
     cris_evaluate_flags(dc);
+
     /* Set for this insn.  */
-    dc->flagx_known = 1;
     dc->flags_x = X_FLAG;
 
     cris_cc_mask(dc, CC_MASK_NZVC);
@@ -XXX,XX +XXX,XX @@ static int dec_setclrf(CPUCRISState *env, DisasContext *dc)
     }
 
     if (flags & X_FLAG) {
-        dc->flagx_known = 1;
         if (set) {
             dc->flags_x = X_FLAG;
         } else {
@@ -XXX,XX +XXX,XX @@ static int dec_addc_mr(CPUCRISState *env, DisasContext *dc)
     cris_evaluate_flags(dc);
 
     /* Set for this insn.  */
-    dc->flagx_known = 1;
     dc->flags_x = X_FLAG;
 
     cris_alu_m_alloc_temps(t);
@@ -XXX,XX +XXX,XX @@ static void cris_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     dc->ppc = pc_start;
     dc->pc = pc_start;
     dc->flags_uptodate = 1;
-    dc->flagx_known = 1;
     dc->flags_x = tb_flags & X_FLAG;
     dc->cc_x_uptodate = 0;
     dc->cc_mask = 0;
@@ -XXX,XX +XXX,XX @@ static void cris_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
     }
 
     /* Fold unhandled changes to X_FLAG into cpustate_changed. */
-    dc->cpustate_changed |= !dc->flagx_known;
     dc->cpustate_changed |= dc->flags_x != (dc->base.tb->flags & X_FLAG);
 
     /*
diff --git a/target/cris/translate_v10.c.inc b/target/cris/translate_v10.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/translate_v10.c.inc
+++ b/target/cris/translate_v10.c.inc
@@ -XXX,XX +XXX,XX @@ static void gen_store_v10(DisasContext *dc, TCGv addr, TCGv val,
         cris_store_direct_jmp(dc);
     }
 
-    /* Conditional writes. We only support the kind were X is known
-       at translation time.  */
-    if (dc->flagx_known && dc->flags_x) {
+    /* Conditional writes. */
+    if (dc->flags_x) {
         gen_store_v10_conditional(dc, addr, val, size, mem_index);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static unsigned int dec10_setclrf(DisasContext *dc)
 
 
     if (flags & X_FLAG) {
-        dc->flagx_known = 1;
         if (set)
             dc->flags_x = X_FLAG;
         else
-- 
2.25.1

From: LIU Zhiwei <zhiwei_liu@c-sky.com>

Implement tcg_gen_vec_add{sub}16_tl by adding corresponding i32 OP.

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Message-Id: <20210624105023.3852-2-zhiwei_liu@c-sky.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg-op-gvec.h | 13 +++++++++++++
 tcg/tcg-op-gvec.c         | 28 ++++++++++++++++++++++++++++
 2 files changed, 41 insertions(+)

From: LIU Zhiwei <zhiwei_liu@c-sky.com>

Implement tcg_gen_vec_add{sub}8_tl by adding corresponging i32 OP.

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Message-Id: <20210624105023.3852-3-zhiwei_liu@c-sky.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg-op-gvec.h |  6 ++++++
 tcg/tcg-op-gvec.c         | 38 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 44 insertions(+)

diff --git a/include/tcg/tcg-op-gvec.h b/include/tcg/tcg-op-gvec.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg-op-gvec.h
+++ b/include/tcg/tcg-op-gvec.h
@@ -XXX,XX +XXX,XX @@ void tcg_gen_vec_rotl8i_i64(TCGv_i64 d, TCGv_i64 a, int64_t c);
 void tcg_gen_vec_rotl16i_i64(TCGv_i64 d, TCGv_i64 a, int64_t c);
 
 /* 32-bit vector operations. */
+void tcg_gen_vec_add8_i32(TCGv_i32 d, TCGv_i32 a, TCGv_i32 b);
 void tcg_gen_vec_add16_i32(TCGv_i32 d, TCGv_i32 a, TCGv_i32 b);
 
+void tcg_gen_vec_sub8_i32(TCGv_i32 d, TCGv_i32 a, TCGv_i32 b);
 void tcg_gen_vec_sub16_i32(TCGv_i32 d, TCGv_i32 a, TCGv_i32 b);
 
 #if TARGET_LONG_BITS == 64
+#define tcg_gen_vec_add8_tl  tcg_gen_vec_add8_i64
+#define tcg_gen_vec_sub8_tl  tcg_gen_vec_sub8_i64
 #define tcg_gen_vec_add16_tl tcg_gen_vec_add16_i64
 #define tcg_gen_vec_sub16_tl tcg_gen_vec_sub16_i64
 #else
+#define tcg_gen_vec_add8_tl  tcg_gen_vec_add8_i32
+#define tcg_gen_vec_sub8_tl  tcg_gen_vec_sub8_i32
 #define tcg_gen_vec_add16_tl tcg_gen_vec_add16_i32
 #define tcg_gen_vec_sub16_tl tcg_gen_vec_sub16_i32
 #endif
diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op-gvec.c
+++ b/tcg/tcg-op-gvec.c
@@ -XXX,XX +XXX,XX @@ void tcg_gen_vec_add8_i64(TCGv_i64 d, TCGv_i64 a, TCGv_i64 b)
     gen_addv_mask(d, a, b, m);
 }
 
+void tcg_gen_vec_add8_i32(TCGv_i32 d, TCGv_i32 a, TCGv_i32 b)
+{
+    TCGv_i32 m = tcg_constant_i32((int32_t)dup_const(MO_8, 0x80));
+    TCGv_i32 t1 = tcg_temp_new_i32();
+    TCGv_i32 t2 = tcg_temp_new_i32();
+    TCGv_i32 t3 = tcg_temp_new_i32();
+
+    tcg_gen_andc_i32(t1, a, m);
+    tcg_gen_andc_i32(t2, b, m);
+    tcg_gen_xor_i32(t3, a, b);
+    tcg_gen_add_i32(d, t1, t2);
+    tcg_gen_and_i32(t3, t3, m);
+    tcg_gen_xor_i32(d, d, t3);
+
+    tcg_temp_free_i32(t1);
+    tcg_temp_free_i32(t2);
+    tcg_temp_free_i32(t3);
+}
+
 void tcg_gen_vec_add16_i64(TCGv_i64 d, TCGv_i64 a, TCGv_i64 b)
 {
     TCGv_i64 m = tcg_constant_i64(dup_const(MO_16, 0x8000));
@@ -XXX,XX +XXX,XX @@ void tcg_gen_vec_sub8_i64(TCGv_i64 d, TCGv_i64 a, TCGv_i64 b)
     gen_subv_mask(d, a, b, m);
 }
 
+void tcg_gen_vec_sub8_i32(TCGv_i32 d, TCGv_i32 a, TCGv_i32 b)
+{
+    TCGv_i32 m = tcg_constant_i32((int32_t)dup_const(MO_8, 0x80));
+    TCGv_i32 t1 = tcg_temp_new_i32();
+    TCGv_i32 t2 = tcg_temp_new_i32();
+    TCGv_i32 t3 = tcg_temp_new_i32();
+
+    tcg_gen_or_i32(t1, a, m);
+    tcg_gen_andc_i32(t2, b, m);
+    tcg_gen_eqv_i32(t3, a, b);
+    tcg_gen_sub_i32(d, t1, t2);
+    tcg_gen_and_i32(t3, t3, m);
+    tcg_gen_xor_i32(d, d, t3);
+
+    tcg_temp_free_i32(t1);
+    tcg_temp_free_i32(t2);
+    tcg_temp_free_i32(t3);
+}
+
 void tcg_gen_vec_sub16_i64(TCGv_i64 d, TCGv_i64 a, TCGv_i64 b)
 {
     TCGv_i64 m = tcg_constant_i64(dup_const(MO_16, 0x8000));
-- 
2.25.1

From: LIU Zhiwei <zhiwei_liu@c-sky.com>

Implement tcg_gen_vec_shl{shr}{sar}16i_tl by adding corresponging i32 OP.

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Message-Id: <20210624105023.3852-4-zhiwei_liu@c-sky.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg-op-gvec.h | 10 ++++++++++
 tcg/tcg-op-gvec.c         | 28 ++++++++++++++++++++++++++++
 2 files changed, 38 insertions(+)

diff --git a/include/tcg/tcg-op-gvec.h b/include/tcg/tcg-op-gvec.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg-op-gvec.h
+++ b/include/tcg/tcg-op-gvec.h
@@ -XXX,XX +XXX,XX @@ void tcg_gen_vec_add16_i32(TCGv_i32 d, TCGv_i32 a, TCGv_i32 b);
 void tcg_gen_vec_sub8_i32(TCGv_i32 d, TCGv_i32 a, TCGv_i32 b);
 void tcg_gen_vec_sub16_i32(TCGv_i32 d, TCGv_i32 a, TCGv_i32 b);
 
+void tcg_gen_vec_shl16i_i32(TCGv_i32 d, TCGv_i32 a, int32_t);
+void tcg_gen_vec_shr16i_i32(TCGv_i32 d, TCGv_i32 a, int32_t);
+void tcg_gen_vec_sar16i_i32(TCGv_i32 d, TCGv_i32 a, int32_t);
+
 #if TARGET_LONG_BITS == 64
 #define tcg_gen_vec_add8_tl  tcg_gen_vec_add8_i64
 #define tcg_gen_vec_sub8_tl  tcg_gen_vec_sub8_i64
 #define tcg_gen_vec_add16_tl tcg_gen_vec_add16_i64
 #define tcg_gen_vec_sub16_tl tcg_gen_vec_sub16_i64
+#define tcg_gen_vec_shl16i_tl tcg_gen_vec_shl16i_i64
+#define tcg_gen_vec_shr16i_tl tcg_gen_vec_shr16i_i64
+#define tcg_gen_vec_sar16i_tl tcg_gen_vec_sar16i_i64
 #else
 #define tcg_gen_vec_add8_tl  tcg_gen_vec_add8_i32
 #define tcg_gen_vec_sub8_tl  tcg_gen_vec_sub8_i32
 #define tcg_gen_vec_add16_tl tcg_gen_vec_add16_i32
 #define tcg_gen_vec_sub16_tl tcg_gen_vec_sub16_i32
+#define tcg_gen_vec_shl16i_tl tcg_gen_vec_shl16i_i32
+#define tcg_gen_vec_shr16i_tl tcg_gen_vec_shr16i_i32
+#define tcg_gen_vec_sar16i_tl tcg_gen_vec_sar16i_i32
 #endif
 
 #endif
diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op-gvec.c
+++ b/tcg/tcg-op-gvec.c
@@ -XXX,XX +XXX,XX @@ void tcg_gen_vec_shl16i_i64(TCGv_i64 d, TCGv_i64 a, int64_t c)
     tcg_gen_andi_i64(d, d, mask);
 }
 
+void tcg_gen_vec_shl16i_i32(TCGv_i32 d, TCGv_i32 a, int32_t c)
+{
+    uint32_t mask = dup_const(MO_16, 0xffff << c);
+    tcg_gen_shli_i32(d, a, c);
+    tcg_gen_andi_i32(d, d, mask);
+}
+
 void tcg_gen_gvec_shli(unsigned vece, uint32_t dofs, uint32_t aofs,
                        int64_t shift, uint32_t oprsz, uint32_t maxsz)
 {
@@ -XXX,XX +XXX,XX @@ void tcg_gen_vec_shr16i_i64(TCGv_i64 d, TCGv_i64 a, int64_t c)
     tcg_gen_andi_i64(d, d, mask);
 }
 
+void tcg_gen_vec_shr16i_i32(TCGv_i32 d, TCGv_i32 a, int32_t c)
+{
+    uint32_t mask = dup_const(MO_16, 0xffff >> c);
+    tcg_gen_shri_i32(d, a, c);
+    tcg_gen_andi_i32(d, d, mask);
+}
+
 void tcg_gen_gvec_shri(unsigned vece, uint32_t dofs, uint32_t aofs,
                        int64_t shift, uint32_t oprsz, uint32_t maxsz)
 {
@@ -XXX,XX +XXX,XX @@ void tcg_gen_vec_sar16i_i64(TCGv_i64 d, TCGv_i64 a, int64_t c)
     tcg_temp_free_i64(s);
 }
 
+void tcg_gen_vec_sar16i_i32(TCGv_i32 d, TCGv_i32 a, int32_t c)
+{
+    uint32_t s_mask = dup_const(MO_16, 0x8000 >> c);
+    uint32_t c_mask = dup_const(MO_16, 0xffff >> c);
+    TCGv_i32 s = tcg_temp_new_i32();
+
+    tcg_gen_shri_i32(d, a, c);
+    tcg_gen_andi_i32(s, d, s_mask);  /* isolate (shifted) sign bit */
+    tcg_gen_andi_i32(d, d, c_mask);  /* clear out bits above sign  */
+    tcg_gen_muli_i32(s, s, (2 << c) - 2); /* replicate isolated signs */
+    tcg_gen_or_i32(d, d, s);         /* include sign extension */
+    tcg_temp_free_i32(s);
+}
+
 void tcg_gen_gvec_sari(unsigned vece, uint32_t dofs, uint32_t aofs,
                        int64_t shift, uint32_t oprsz, uint32_t maxsz)
 {
-- 
2.25.1

From: LIU Zhiwei <zhiwei_liu@c-sky.com>

Implement tcg_gen_vec_shl{shr}{sar}8i_tl by adding corresponging i32 OP.

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Message-Id: <20210624105023.3852-5-zhiwei_liu@c-sky.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg-op-gvec.h | 10 ++++++++++
 tcg/tcg-op-gvec.c         | 28 ++++++++++++++++++++++++++++
 2 files changed, 38 insertions(+)

diff --git a/include/tcg/tcg-op-gvec.h b/include/tcg/tcg-op-gvec.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg-op-gvec.h
+++ b/include/tcg/tcg-op-gvec.h
@@ -XXX,XX +XXX,XX @@ void tcg_gen_vec_add16_i32(TCGv_i32 d, TCGv_i32 a, TCGv_i32 b);
 void tcg_gen_vec_sub8_i32(TCGv_i32 d, TCGv_i32 a, TCGv_i32 b);
 void tcg_gen_vec_sub16_i32(TCGv_i32 d, TCGv_i32 a, TCGv_i32 b);
 
+void tcg_gen_vec_shl8i_i32(TCGv_i32 d, TCGv_i32 a, int32_t);
 void tcg_gen_vec_shl16i_i32(TCGv_i32 d, TCGv_i32 a, int32_t);
+void tcg_gen_vec_shr8i_i32(TCGv_i32 d, TCGv_i32 a, int32_t);
 void tcg_gen_vec_shr16i_i32(TCGv_i32 d, TCGv_i32 a, int32_t);
+void tcg_gen_vec_sar8i_i32(TCGv_i32 d, TCGv_i32 a, int32_t);
 void tcg_gen_vec_sar16i_i32(TCGv_i32 d, TCGv_i32 a, int32_t);
 
 #if TARGET_LONG_BITS == 64
@@ -XXX,XX +XXX,XX @@ void tcg_gen_vec_sar16i_i32(TCGv_i32 d, TCGv_i32 a, int32_t);
 #define tcg_gen_vec_sub8_tl  tcg_gen_vec_sub8_i64
 #define tcg_gen_vec_add16_tl tcg_gen_vec_add16_i64
 #define tcg_gen_vec_sub16_tl tcg_gen_vec_sub16_i64
+#define tcg_gen_vec_shl8i_tl tcg_gen_vec_shl8i_i64
+#define tcg_gen_vec_shr8i_tl tcg_gen_vec_shr8i_i64
+#define tcg_gen_vec_sar8i_tl tcg_gen_vec_sar8i_i64
 #define tcg_gen_vec_shl16i_tl tcg_gen_vec_shl16i_i64
 #define tcg_gen_vec_shr16i_tl tcg_gen_vec_shr16i_i64
 #define tcg_gen_vec_sar16i_tl tcg_gen_vec_sar16i_i64
+
 #else
 #define tcg_gen_vec_add8_tl  tcg_gen_vec_add8_i32
 #define tcg_gen_vec_sub8_tl  tcg_gen_vec_sub8_i32
 #define tcg_gen_vec_add16_tl tcg_gen_vec_add16_i32
 #define tcg_gen_vec_sub16_tl tcg_gen_vec_sub16_i32
+#define tcg_gen_vec_shl8i_tl tcg_gen_vec_shl8i_i32
+#define tcg_gen_vec_shr8i_tl tcg_gen_vec_shr8i_i32
+#define tcg_gen_vec_sar8i_tl tcg_gen_vec_sar8i_i32
 #define tcg_gen_vec_shl16i_tl tcg_gen_vec_shl16i_i32
 #define tcg_gen_vec_shr16i_tl tcg_gen_vec_shr16i_i32
 #define tcg_gen_vec_sar16i_tl tcg_gen_vec_sar16i_i32
diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op-gvec.c
+++ b/tcg/tcg-op-gvec.c
@@ -XXX,XX +XXX,XX @@ void tcg_gen_vec_shl16i_i64(TCGv_i64 d, TCGv_i64 a, int64_t c)
     tcg_gen_andi_i64(d, d, mask);
 }
 
+void tcg_gen_vec_shl8i_i32(TCGv_i32 d, TCGv_i32 a, int32_t c)
+{
+    uint32_t mask = dup_const(MO_8, 0xff << c);
+    tcg_gen_shli_i32(d, a, c);
+    tcg_gen_andi_i32(d, d, mask);
+}
+
 void tcg_gen_vec_shl16i_i32(TCGv_i32 d, TCGv_i32 a, int32_t c)
 {
     uint32_t mask = dup_const(MO_16, 0xffff << c);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_vec_shr16i_i64(TCGv_i64 d, TCGv_i64 a, int64_t c)
     tcg_gen_andi_i64(d, d, mask);
 }
 
+void tcg_gen_vec_shr8i_i32(TCGv_i32 d, TCGv_i32 a, int32_t c)
+{
+    uint32_t mask = dup_const(MO_8, 0xff >> c);
+    tcg_gen_shri_i32(d, a, c);
+    tcg_gen_andi_i32(d, d, mask);
+}
+
 void tcg_gen_vec_shr16i_i32(TCGv_i32 d, TCGv_i32 a, int32_t c)
 {
     uint32_t mask = dup_const(MO_16, 0xffff >> c);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_vec_sar16i_i64(TCGv_i64 d, TCGv_i64 a, int64_t c)
     tcg_temp_free_i64(s);
 }
 
+void tcg_gen_vec_sar8i_i32(TCGv_i32 d, TCGv_i32 a, int32_t c)
+{
+    uint32_t s_mask = dup_const(MO_8, 0x80 >> c);
+    uint32_t c_mask = dup_const(MO_8, 0xff >> c);
+    TCGv_i32 s = tcg_temp_new_i32();
+
+    tcg_gen_shri_i32(d, a, c);
+    tcg_gen_andi_i32(s, d, s_mask);  /* isolate (shifted) sign bit */
+    tcg_gen_muli_i32(s, s, (2 << c) - 2); /* replicate isolated signs */
+    tcg_gen_andi_i32(d, d, c_mask);  /* clear out bits above sign  */
+    tcg_gen_or_i32(d, d, s);         /* include sign extension */
+    tcg_temp_free_i32(s);
+}
+
 void tcg_gen_vec_sar16i_i32(TCGv_i32 d, TCGv_i32 a, int32_t c)
 {
     uint32_t s_mask = dup_const(MO_16, 0x8000 >> c);
-- 
2.25.1

From: LIU Zhiwei <zhiwei_liu@c-sky.com>

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Message-Id: <20210624105023.3852-6-zhiwei_liu@c-sky.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg-op-gvec.h | 4 ++++
 1 file changed, 4 insertions(+)

From: Warner Losh <imp@bsdimp.com>

The trap number for a page fault on BSD systems is T_PAGEFLT
not 0xe -- 0xe is used by Linux and represents the intel hardware
trap vector. The BSD kernels, however, translate this to T_PAGEFLT
in their Xpage, Xtrap0e, Xtrap14, etc fault handlers. This is true
for i386 and x86_64, though the name of the trap hanlder can very
on the flavor of BSD. As far as I can tell, Linux doesn't provide
a define for this value. Invent a new one (PAGE_FAULT_TRAP) and
use it instead to avoid uglier ifdefs.

Signed-off-by: Mark Johnston <markj@FreeBSD.org>
Signed-off-by: Juergen Lock <nox@FreeBSD.org>
[ Rework to avoid ifdefs and expand it to i386 ]
Signed-off-by: Warner Losh <imp@bsdimp.com>
Message-Id: <20210625045707.84534-3-imp@bsdimp.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/user-exec.c | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
 
 #if defined(__NetBSD__)
 #include <ucontext.h>
+#include <machine/trap.h>
 
 #define EIP_sig(context)     ((context)->uc_mcontext.__gregs[_REG_EIP])
 #define TRAP_sig(context)    ((context)->uc_mcontext.__gregs[_REG_TRAPNO])
 #define ERROR_sig(context)   ((context)->uc_mcontext.__gregs[_REG_ERR])
 #define MASK_sig(context)    ((context)->uc_sigmask)
+#define PAGE_FAULT_TRAP      T_PAGEFLT
 #elif defined(__FreeBSD__) || defined(__DragonFly__)
 #include <ucontext.h>
+#include <machine/trap.h>
 
 #define EIP_sig(context)  (*((unsigned long *)&(context)->uc_mcontext.mc_eip))
 #define TRAP_sig(context)    ((context)->uc_mcontext.mc_trapno)
 #define ERROR_sig(context)   ((context)->uc_mcontext.mc_err)
 #define MASK_sig(context)    ((context)->uc_sigmask)
+#define PAGE_FAULT_TRAP      T_PAGEFLT
 #elif defined(__OpenBSD__)
+#include <machine/trap.h>
 #define EIP_sig(context)     ((context)->sc_eip)
 #define TRAP_sig(context)    ((context)->sc_trapno)
 #define ERROR_sig(context)   ((context)->sc_err)
 #define MASK_sig(context)    ((context)->sc_mask)
+#define PAGE_FAULT_TRAP      T_PAGEFLT
 #else
 #define EIP_sig(context)     ((context)->uc_mcontext.gregs[REG_EIP])
 #define TRAP_sig(context)    ((context)->uc_mcontext.gregs[REG_TRAPNO])
 #define ERROR_sig(context)   ((context)->uc_mcontext.gregs[REG_ERR])
 #define MASK_sig(context)    ((context)->uc_sigmask)
+#define PAGE_FAULT_TRAP      0xe
 #endif
 
 int cpu_signal_handler(int host_signum, void *pinfo,
@@ -XXX,XX +XXX,XX @@ int cpu_signal_handler(int host_signum, void *pinfo,
     pc = EIP_sig(uc);
     trapno = TRAP_sig(uc);
     return handle_cpu_signal(pc, info,
-                             trapno == 0xe ? (ERROR_sig(uc) >> 1) & 1 : 0,
+                             trapno == PAGE_FAULT_TRAP ?
+                             (ERROR_sig(uc) >> 1) & 1 : 0,
                              &MASK_sig(uc));
 }
 
 #elif defined(__x86_64__)
 
 #ifdef __NetBSD__
+#include <machine/trap.h>
 #define PC_sig(context)       _UC_MACHINE_PC(context)
 #define TRAP_sig(context)     ((context)->uc_mcontext.__gregs[_REG_TRAPNO])
 #define ERROR_sig(context)    ((context)->uc_mcontext.__gregs[_REG_ERR])
 #define MASK_sig(context)     ((context)->uc_sigmask)
+#define PAGE_FAULT_TRAP       T_PAGEFLT
 #elif defined(__OpenBSD__)
+#include <machine/trap.h>
 #define PC_sig(context)       ((context)->sc_rip)
 #define TRAP_sig(context)     ((context)->sc_trapno)
 #define ERROR_sig(context)    ((context)->sc_err)
 #define MASK_sig(context)     ((context)->sc_mask)
+#define PAGE_FAULT_TRAP       T_PAGEFLT
 #elif defined(__FreeBSD__) || defined(__DragonFly__)
 #include <ucontext.h>
+#include <machine/trap.h>
 
 #define PC_sig(context)  (*((unsigned long *)&(context)->uc_mcontext.mc_rip))
 #define TRAP_sig(context)     ((context)->uc_mcontext.mc_trapno)
 #define ERROR_sig(context)    ((context)->uc_mcontext.mc_err)
 #define MASK_sig(context)     ((context)->uc_sigmask)
+#define PAGE_FAULT_TRAP       T_PAGEFLT
 #else
 #define PC_sig(context)       ((context)->uc_mcontext.gregs[REG_RIP])
 #define TRAP_sig(context)     ((context)->uc_mcontext.gregs[REG_TRAPNO])
 #define ERROR_sig(context)    ((context)->uc_mcontext.gregs[REG_ERR])
 #define MASK_sig(context)     ((context)->uc_sigmask)
+#define PAGE_FAULT_TRAP       0xe
 #endif
 
 int cpu_signal_handler(int host_signum, void *pinfo,
@@ -XXX,XX +XXX,XX @@ int cpu_signal_handler(int host_signum, void *pinfo,
 
     pc = PC_sig(uc);
     return handle_cpu_signal(pc, info,
-                             TRAP_sig(uc) == 0xe ? (ERROR_sig(uc) >> 1) & 1 : 0,
+                             TRAP_sig(uc) == PAGE_FAULT_TRAP ?
+                             (ERROR_sig(uc) >> 1) & 1 : 0,
                              &MASK_sig(uc));
 }
 
-- 
2.25.1

This will eventually simplify front-end usage, and will allow
backends to unset TCG_TARGET_HAS_MEMORY_BSWAP without loss of
optimization.

The argument is added during expansion, not currently exposed to the
front end translators.  The backends currently only support a flags
value of either TCG_BSWAP_IZ, or (TCG_BSWAP_IZ | TCG_BSWAP_OZ),
since they all require zero top bytes and leave them that way.
At the existing call sites we pass in (TCG_BSWAP_IZ | TCG_BSWAP_OZ),
except for the flags-ignored cases of a 32-bit swap of a 32-bit
value and or a 64-bit swap of a 64-bit value, where we pass 0.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg-opc.h | 10 +++++-----
 include/tcg/tcg.h     | 12 ++++++++++++
 tcg/tcg-op.c          | 13 ++++++++-----
 tcg/tcg.c             | 28 ++++++++++++++++++++++++++++
 tcg/README            | 22 ++++++++++++++--------
 5 files changed, 67 insertions(+), 18 deletions(-)

diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -XXX,XX +XXX,XX @@ DEF(ext8s_i32, 1, 1, 0, IMPL(TCG_TARGET_HAS_ext8s_i32))
 DEF(ext16s_i32, 1, 1, 0, IMPL(TCG_TARGET_HAS_ext16s_i32))
 DEF(ext8u_i32, 1, 1, 0, IMPL(TCG_TARGET_HAS_ext8u_i32))
 DEF(ext16u_i32, 1, 1, 0, IMPL(TCG_TARGET_HAS_ext16u_i32))
-DEF(bswap16_i32, 1, 1, 0, IMPL(TCG_TARGET_HAS_bswap16_i32))
-DEF(bswap32_i32, 1, 1, 0, IMPL(TCG_TARGET_HAS_bswap32_i32))
+DEF(bswap16_i32, 1, 1, 1, IMPL(TCG_TARGET_HAS_bswap16_i32))
+DEF(bswap32_i32, 1, 1, 1, IMPL(TCG_TARGET_HAS_bswap32_i32))
 DEF(not_i32, 1, 1, 0, IMPL(TCG_TARGET_HAS_not_i32))
 DEF(neg_i32, 1, 1, 0, IMPL(TCG_TARGET_HAS_neg_i32))
 DEF(andc_i32, 1, 2, 0, IMPL(TCG_TARGET_HAS_andc_i32))
@@ -XXX,XX +XXX,XX @@ DEF(ext32s_i64, 1, 1, 0, IMPL64 | IMPL(TCG_TARGET_HAS_ext32s_i64))
 DEF(ext8u_i64, 1, 1, 0, IMPL64 | IMPL(TCG_TARGET_HAS_ext8u_i64))
 DEF(ext16u_i64, 1, 1, 0, IMPL64 | IMPL(TCG_TARGET_HAS_ext16u_i64))
 DEF(ext32u_i64, 1, 1, 0, IMPL64 | IMPL(TCG_TARGET_HAS_ext32u_i64))
-DEF(bswap16_i64, 1, 1, 0, IMPL64 | IMPL(TCG_TARGET_HAS_bswap16_i64))
-DEF(bswap32_i64, 1, 1, 0, IMPL64 | IMPL(TCG_TARGET_HAS_bswap32_i64))
-DEF(bswap64_i64, 1, 1, 0, IMPL64 | IMPL(TCG_TARGET_HAS_bswap64_i64))
+DEF(bswap16_i64, 1, 1, 1, IMPL64 | IMPL(TCG_TARGET_HAS_bswap16_i64))
+DEF(bswap32_i64, 1, 1, 1, IMPL64 | IMPL(TCG_TARGET_HAS_bswap32_i64))
+DEF(bswap64_i64, 1, 1, 1, IMPL64 | IMPL(TCG_TARGET_HAS_bswap64_i64))
 DEF(not_i64, 1, 1, 0, IMPL64 | IMPL(TCG_TARGET_HAS_not_i64))
 DEF(neg_i64, 1, 1, 0, IMPL64 | IMPL(TCG_TARGET_HAS_neg_i64))
 DEF(andc_i64, 1, 2, 0, IMPL64 | IMPL(TCG_TARGET_HAS_andc_i64))
diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ typedef TCGv_ptr TCGv_env;
 /* Used to align parameters.  See the comment before tcgv_i32_temp.  */
 #define TCG_CALL_DUMMY_ARG      ((TCGArg)0)
 
+/*
+ * Flags for the bswap opcodes.
+ * If IZ, the input is zero-extended, otherwise unknown.
+ * If OZ or OS, the output is zero- or sign-extended respectively,
+ * otherwise the high bits are undefined.
+ */
+enum {
+    TCG_BSWAP_IZ = 1,
+    TCG_BSWAP_OZ = 2,
+    TCG_BSWAP_OS = 4,
+};
+
 typedef enum TCGTempVal {
     TEMP_VAL_DEAD,
     TEMP_VAL_REG,
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -XXX,XX +XXX,XX @@ void tcg_gen_ext16u_i32(TCGv_i32 ret, TCGv_i32 arg)
 void tcg_gen_bswap16_i32(TCGv_i32 ret, TCGv_i32 arg)
 {
     if (TCG_TARGET_HAS_bswap16_i32) {
-        tcg_gen_op2_i32(INDEX_op_bswap16_i32, ret, arg);
+        tcg_gen_op3i_i32(INDEX_op_bswap16_i32, ret, arg,
+                         TCG_BSWAP_IZ | TCG_BSWAP_OZ);
     } else {
         TCGv_i32 t0 = tcg_temp_new_i32();
 
@@ -XXX,XX +XXX,XX @@ void tcg_gen_bswap16_i32(TCGv_i32 ret, TCGv_i32 arg)
 void tcg_gen_bswap32_i32(TCGv_i32 ret, TCGv_i32 arg)
 {
     if (TCG_TARGET_HAS_bswap32_i32) {
-        tcg_gen_op2_i32(INDEX_op_bswap32_i32, ret, arg);
+        tcg_gen_op3i_i32(INDEX_op_bswap32_i32, ret, arg, 0);
     } else {
         TCGv_i32 t0 = tcg_temp_new_i32();
         TCGv_i32 t1 = tcg_temp_new_i32();
@@ -XXX,XX +XXX,XX @@ void tcg_gen_bswap16_i64(TCGv_i64 ret, TCGv_i64 arg)
         tcg_gen_bswap16_i32(TCGV_LOW(ret), TCGV_LOW(arg));
         tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
     } else if (TCG_TARGET_HAS_bswap16_i64) {
-        tcg_gen_op2_i64(INDEX_op_bswap16_i64, ret, arg);
+        tcg_gen_op3i_i64(INDEX_op_bswap16_i64, ret, arg,
+                         TCG_BSWAP_IZ | TCG_BSWAP_OZ);
     } else {
         TCGv_i64 t0 = tcg_temp_new_i64();
 
@@ -XXX,XX +XXX,XX @@ void tcg_gen_bswap32_i64(TCGv_i64 ret, TCGv_i64 arg)
         tcg_gen_bswap32_i32(TCGV_LOW(ret), TCGV_LOW(arg));
         tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
     } else if (TCG_TARGET_HAS_bswap32_i64) {
-        tcg_gen_op2_i64(INDEX_op_bswap32_i64, ret, arg);
+        tcg_gen_op3i_i64(INDEX_op_bswap32_i64, ret, arg,
+                         TCG_BSWAP_IZ | TCG_BSWAP_OZ);
     } else {
         TCGv_i64 t0 = tcg_temp_new_i64();
         TCGv_i64 t1 = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ void tcg_gen_bswap64_i64(TCGv_i64 ret, TCGv_i64 arg)
         tcg_temp_free_i32(t0);
         tcg_temp_free_i32(t1);
     } else if (TCG_TARGET_HAS_bswap64_i64) {
-        tcg_gen_op2_i64(INDEX_op_bswap64_i64, ret, arg);
+        tcg_gen_op3i_i64(INDEX_op_bswap64_i64, ret, arg, 0);
     } else {
         TCGv_i64 t0 = tcg_temp_new_i64();
         TCGv_i64 t1 = tcg_temp_new_i64();
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static const char * const alignment_name[(MO_AMASK >> MO_ASHIFT) + 1] = {
     [MO_ALIGN_64 >> MO_ASHIFT] = "al64+",
 };
 
+static const char bswap_flag_name[][6] = {
+    [TCG_BSWAP_IZ] = "iz",
+    [TCG_BSWAP_OZ] = "oz",
+    [TCG_BSWAP_OS] = "os",
+    [TCG_BSWAP_IZ | TCG_BSWAP_OZ] = "iz,oz",
+    [TCG_BSWAP_IZ | TCG_BSWAP_OS] = "iz,os",
+};
+
 static inline bool tcg_regset_single(TCGRegSet d)
 {
     return (d & (d - 1)) == 0;
@@ -XXX,XX +XXX,XX @@ static void tcg_dump_ops(TCGContext *s, bool have_prefs)
                     i = 1;
                 }
                 break;
+            case INDEX_op_bswap16_i32:
+            case INDEX_op_bswap16_i64:
+            case INDEX_op_bswap32_i32:
+            case INDEX_op_bswap32_i64:
+            case INDEX_op_bswap64_i64:
+                {
+                    TCGArg flags = op->args[k];
+                    const char *name = NULL;
+
+                    if (flags < ARRAY_SIZE(bswap_flag_name)) {
+                        name = bswap_flag_name[flags];
+                    }
+                    if (name) {
+                        col += qemu_log(",%s", name);
+                    } else {
+                        col += qemu_log(",$0x%" TCG_PRIlx, flags);
+                    }
+                    i = k = 1;
+                }
+                break;
             default:
                 i = 0;
                 break;
diff --git a/tcg/README b/tcg/README
index XXXXXXX..XXXXXXX 100644
--- a/tcg/README
+++ b/tcg/README
@@ -XXX,XX +XXX,XX @@ ext32u_i64 t0, t1
 
 8, 16 or 32 bit sign/zero extension (both operands must have the same type)
 
-* bswap16_i32/i64 t0, t1
+* bswap16_i32/i64 t0, t1, flags
 
-16 bit byte swap on a 32/64 bit value. It assumes that the two/six high order
-bytes are set to zero.
+16 bit byte swap on the low bits of a 32/64 bit input.
+If flags & TCG_BSWAP_IZ, then t1 is known to be zero-extended from bit 15.
+If flags & TCG_BSWAP_OZ, then t0 will be zero-extended from bit 15.
+If flags & TCG_BSWAP_OS, then t0 will be sign-extended from bit 15.
+If neither TCG_BSWAP_OZ nor TCG_BSWAP_OS are set, then the bits of
+t0 above bit 15 may contain any value.
 
-* bswap32_i32/i64 t0, t1
+* bswap32_i64 t0, t1, flags
 
-32 bit byte swap on a 32/64 bit value. With a 64 bit value, it assumes that
-the four high order bytes are set to zero.
+32 bit byte swap on a 64-bit value.  The flags are the same as for bswap16,
+except they apply from bit 31 instead of bit 15.
 
-* bswap64_i64 t0, t1
+* bswap32_i32 t0, t1, flags
+* bswap64_i64 t0, t1, flags
 
-64 bit byte swap
+32/64 bit byte swap.  The flags are ignored, but still present
+for consistency with the other bswap opcodes.
 
 * discard_i32/i64 t0
 
-- 
2.25.1

Retain the current rorw bswap16 expansion for the zero-in/zero-out case.
Otherwise, perform a wider bswap plus a right-shift or extend.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.c.inc | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         break;
 
     OP_32_64(bswap16):
-        tcg_out_rolw_8(s, a0);
+        if (a2 & TCG_BSWAP_OS) {
+            /* Output must be sign-extended. */
+            if (rexw) {
+                tcg_out_bswap64(s, a0);
+                tcg_out_shifti(s, SHIFT_SAR + rexw, a0, 48);
+            } else {
+                tcg_out_bswap32(s, a0);
+                tcg_out_shifti(s, SHIFT_SAR, a0, 16);
+            }
+        } else if ((a2 & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
+            /* Output must be zero-extended, but input isn't. */
+            tcg_out_bswap32(s, a0);
+            tcg_out_shifti(s, SHIFT_SHR, a0, 16);
+        } else {
+            tcg_out_rolw_8(s, a0);
+        }
         break;
     OP_32_64(bswap32):
         tcg_out_bswap32(s, a0);
+        if (rexw && (a2 & TCG_BSWAP_OS)) {
+            tcg_out_ext32s(s, a0, a0);
+        }
         break;
 
     OP_32_64(neg):
-- 
2.25.1

Pass in the input and output size.  We currently use 3 of the 5
possible combinations; the others may be used by new tcg opcodes.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc | 42 ++++++++++++++----------------------
 1 file changed, 16 insertions(+), 26 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ typedef enum {
     /* Data-processing (1 source) instructions.  */
     I3507_CLZ       = 0x5ac01000,
     I3507_RBIT      = 0x5ac00000,
-    I3507_REV16     = 0x5ac00400,
-    I3507_REV32     = 0x5ac00800,
-    I3507_REV64     = 0x5ac00c00,
+    I3507_REV       = 0x5ac00000, /* + size << 10 */
 
     /* Data-processing (2 source) instructions.  */
     I3508_LSLV      = 0x1ac02000,
@@ -XXX,XX +XXX,XX @@ static void tcg_out_brcond(TCGContext *s, TCGType ext, TCGCond c, TCGArg a,
     }
 }
 
-static inline void tcg_out_rev64(TCGContext *s, TCGReg rd, TCGReg rn)
+static inline void tcg_out_rev(TCGContext *s, int ext, MemOp s_bits,
+                               TCGReg rd, TCGReg rn)
 {
-    tcg_out_insn(s, 3507, REV64, TCG_TYPE_I64, rd, rn);
-}
-
-static inline void tcg_out_rev32(TCGContext *s, TCGReg rd, TCGReg rn)
-{
-    tcg_out_insn(s, 3507, REV32, TCG_TYPE_I32, rd, rn);
-}
-
-static inline void tcg_out_rev16(TCGContext *s, TCGReg rd, TCGReg rn)
-{
-    tcg_out_insn(s, 3507, REV16, TCG_TYPE_I32, rd, rn);
+    /* REV, REV16, REV32 */
+    tcg_out_insn_3507(s, I3507_REV | (s_bits << 10), ext, rd, rn);
 }
 
 static inline void tcg_out_sxt(TCGContext *s, TCGType ext, MemOp s_bits,
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp memop, TCGType ext,
     case MO_UW:
         tcg_out_ldst_r(s, I3312_LDRH, data_r, addr_r, otype, off_r);
         if (bswap) {
-            tcg_out_rev16(s, data_r, data_r);
+            tcg_out_rev(s, TCG_TYPE_I32, MO_16, data_r, data_r);
         }
         break;
     case MO_SW:
         if (bswap) {
             tcg_out_ldst_r(s, I3312_LDRH, data_r, addr_r, otype, off_r);
-            tcg_out_rev16(s, data_r, data_r);
+            tcg_out_rev(s, TCG_TYPE_I32, MO_16, data_r, data_r);
             tcg_out_sxt(s, ext, MO_16, data_r, data_r);
         } else {
             tcg_out_ldst_r(s, (ext ? I3312_LDRSHX : I3312_LDRSHW),
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp memop, TCGType ext,
     case MO_UL:
         tcg_out_ldst_r(s, I3312_LDRW, data_r, addr_r, otype, off_r);
         if (bswap) {
-            tcg_out_rev32(s, data_r, data_r);
+            tcg_out_rev(s, TCG_TYPE_I32, MO_32, data_r, data_r);
         }
         break;
     case MO_SL:
         if (bswap) {
             tcg_out_ldst_r(s, I3312_LDRW, data_r, addr_r, otype, off_r);
-            tcg_out_rev32(s, data_r, data_r);
+            tcg_out_rev(s, TCG_TYPE_I32, MO_32, data_r, data_r);
             tcg_out_sxt(s, TCG_TYPE_I64, MO_32, data_r, data_r);
         } else {
             tcg_out_ldst_r(s, I3312_LDRSWX, data_r, addr_r, otype, off_r);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp memop, TCGType ext,
     case MO_Q:
         tcg_out_ldst_r(s, I3312_LDRX, data_r, addr_r, otype, off_r);
         if (bswap) {
-            tcg_out_rev64(s, data_r, data_r);
+            tcg_out_rev(s, TCG_TYPE_I64, MO_64, data_r, data_r);
         }
         break;
     default:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, MemOp memop,
         break;
     case MO_16:
         if (bswap && data_r != TCG_REG_XZR) {
-            tcg_out_rev16(s, TCG_REG_TMP, data_r);
+            tcg_out_rev(s, TCG_TYPE_I32, MO_16, TCG_REG_TMP, data_r);
             data_r = TCG_REG_TMP;
         }
         tcg_out_ldst_r(s, I3312_STRH, data_r, addr_r, otype, off_r);
         break;
     case MO_32:
         if (bswap && data_r != TCG_REG_XZR) {
-            tcg_out_rev32(s, TCG_REG_TMP, data_r);
+            tcg_out_rev(s, TCG_TYPE_I32, MO_32, TCG_REG_TMP, data_r);
             data_r = TCG_REG_TMP;
         }
         tcg_out_ldst_r(s, I3312_STRW, data_r, addr_r, otype, off_r);
         break;
     case MO_64:
         if (bswap && data_r != TCG_REG_XZR) {
-            tcg_out_rev64(s, TCG_REG_TMP, data_r);
+            tcg_out_rev(s, TCG_TYPE_I64, MO_64, TCG_REG_TMP, data_r);
             data_r = TCG_REG_TMP;
         }
         tcg_out_ldst_r(s, I3312_STRX, data_r, addr_r, otype, off_r);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         break;
 
     case INDEX_op_bswap64_i64:
-        tcg_out_rev64(s, a0, a1);
+        tcg_out_rev(s, TCG_TYPE_I64, MO_64, a0, a1);
         break;
     case INDEX_op_bswap32_i64:
     case INDEX_op_bswap32_i32:
-        tcg_out_rev32(s, a0, a1);
+        tcg_out_rev(s, TCG_TYPE_I32, MO_32, a0, a1);
         break;
     case INDEX_op_bswap16_i64:
     case INDEX_op_bswap16_i32:
-        tcg_out_rev16(s, a0, a1);
+        tcg_out_rev(s, TCG_TYPE_I32, MO_16, a0, a1);
         break;
 
     case INDEX_op_ext8s_i64:
-- 
2.25.1

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_rev(s, TCG_TYPE_I64, MO_64, a0, a1);
         break;
     case INDEX_op_bswap32_i64:
+        tcg_out_rev(s, TCG_TYPE_I32, MO_32, a0, a1);
+        if (a2 & TCG_BSWAP_OS) {
+            tcg_out_sxt(s, TCG_TYPE_I64, MO_32, a0, a0);
+        }
+        break;
     case INDEX_op_bswap32_i32:
         tcg_out_rev(s, TCG_TYPE_I32, MO_32, a0, a1);
         break;
     case INDEX_op_bswap16_i64:
     case INDEX_op_bswap16_i32:
         tcg_out_rev(s, TCG_TYPE_I32, MO_16, a0, a1);
+        if (a2 & TCG_BSWAP_OS) {
+            /* Output must be sign-extended. */
+            tcg_out_sxt(s, ext, MO_16, a0, a0);
+        } else if ((a2 & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
+            /* Output must be zero-extended, but input isn't. */
+            tcg_out_uxt(s, MO_16, a0, a0);
+        }
         break;
 
     case INDEX_op_ext8s_i64:
-- 
2.25.1

Combine the three bswap16 routines, and differentiate via the flags.
Use the correct flags combination from the load/store routines, and
pass along the constant parameter from tcg_out_op.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/arm/tcg-target.c.inc | 101 ++++++++++++++++++++++++---------------
 1 file changed, 63 insertions(+), 38 deletions(-)

diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_ext16u(TCGContext *s, int cond,
     }
 }
 
-static inline void tcg_out_bswap16s(TCGContext *s, int cond, int rd, int rn)
+static void tcg_out_bswap16(TCGContext *s, int cond, int rd, int rn, int flags)
 {
     if (use_armv6_instructions) {
-        /* revsh */
-        tcg_out32(s, 0x06ff0fb0 | (cond << 28) | (rd << 12) | rn);
-    } else {
-        tcg_out_dat_reg(s, cond, ARITH_MOV,
-                        TCG_REG_TMP, 0, rn, SHIFT_IMM_LSL(24));
-        tcg_out_dat_reg(s, cond, ARITH_MOV,
-                        TCG_REG_TMP, 0, TCG_REG_TMP, SHIFT_IMM_ASR(16));
-        tcg_out_dat_reg(s, cond, ARITH_ORR,
-                        rd, TCG_REG_TMP, rn, SHIFT_IMM_LSR(8));
-    }
-}
+        if (flags & TCG_BSWAP_OS) {
+            /* revsh */
+            tcg_out32(s, 0x06ff0fb0 | (cond << 28) | (rd << 12) | rn);
+            return;
+        }
 
-static inline void tcg_out_bswap16(TCGContext *s, int cond, int rd, int rn)
-{
-    if (use_armv6_instructions) {
         /* rev16 */
         tcg_out32(s, 0x06bf0fb0 | (cond << 28) | (rd << 12) | rn);
-    } else {
-        tcg_out_dat_reg(s, cond, ARITH_MOV,
-                        TCG_REG_TMP, 0, rn, SHIFT_IMM_LSL(24));
-        tcg_out_dat_reg(s, cond, ARITH_MOV,
-                        TCG_REG_TMP, 0, TCG_REG_TMP, SHIFT_IMM_LSR(16));
-        tcg_out_dat_reg(s, cond, ARITH_ORR,
-                        rd, TCG_REG_TMP, rn, SHIFT_IMM_LSR(8));
+        if ((flags & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
+            /* uxth */
+            tcg_out32(s, 0x06ff0070 | (cond << 28) | (rd << 12) | rd);
+        }
+        return;
     }
-}
 
-/* swap the two low bytes assuming that the two high input bytes and the
-   two high output bit can hold any value. */
-static inline void tcg_out_bswap16st(TCGContext *s, int cond, int rd, int rn)
-{
-    if (use_armv6_instructions) {
-        /* rev16 */
-        tcg_out32(s, 0x06bf0fb0 | (cond << 28) | (rd << 12) | rn);
-    } else {
+    if (flags == 0) {
+        /*
+         * For stores, no input or output extension:
+         *                              rn  = xxAB
+         * lsr tmp, rn, #8              tmp = 0xxA
+         * and tmp, tmp, #0xff          tmp = 000A
+         * orr rd, tmp, rn, lsl #8      rd  = xABA
+         */
         tcg_out_dat_reg(s, cond, ARITH_MOV,
                         TCG_REG_TMP, 0, rn, SHIFT_IMM_LSR(8));
         tcg_out_dat_imm(s, cond, ARITH_AND, TCG_REG_TMP, TCG_REG_TMP, 0xff);
         tcg_out_dat_reg(s, cond, ARITH_ORR,
                         rd, TCG_REG_TMP, rn, SHIFT_IMM_LSL(8));
+        return;
     }
+
+    /*
+     * Byte swap, leaving the result at the top of the register.
+     * We will then shift down, zero or sign-extending.
+     */
+    if (flags & TCG_BSWAP_IZ) {
+        /*
+         *                              rn  = 00AB
+         * ror tmp, rn, #8              tmp = B00A
+         * orr tmp, tmp, tmp, lsl #16   tmp = BA00
+         */
+        tcg_out_dat_reg(s, cond, ARITH_MOV,
+                        TCG_REG_TMP, 0, rn, SHIFT_IMM_ROR(8));
+        tcg_out_dat_reg(s, cond, ARITH_ORR,
+                        TCG_REG_TMP, TCG_REG_TMP, TCG_REG_TMP,
+                        SHIFT_IMM_LSL(16));
+    } else {
+        /*
+         *                              rn  = xxAB
+         * and tmp, rn, #0xff00         tmp = 00A0
+         * lsl tmp, tmp, #8             tmp = 0A00
+         * orr tmp, tmp, rn, lsl #24    tmp = BA00
+         */
+        tcg_out_dat_rI(s, cond, ARITH_AND, TCG_REG_TMP, rn, 0xff00, 1);
+        tcg_out_dat_reg(s, cond, ARITH_MOV,
+                        TCG_REG_TMP, 0, TCG_REG_TMP, SHIFT_IMM_LSL(8));
+        tcg_out_dat_reg(s, cond, ARITH_ORR,
+                        TCG_REG_TMP, TCG_REG_TMP, rn, SHIFT_IMM_LSL(24));
+    }
+    tcg_out_dat_reg(s, cond, ARITH_MOV, rd, 0, TCG_REG_TMP,
+                    (flags & TCG_BSWAP_OS
+                     ? SHIFT_IMM_ASR(8) : SHIFT_IMM_LSR(8)));
 }
 
 static inline void tcg_out_bswap32(TCGContext *s, int cond, int rd, int rn)
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_qemu_ld_index(TCGContext *s, MemOp opc,
     case MO_UW:
         tcg_out_ld16u_r(s, COND_AL, datalo, addrlo, addend);
         if (bswap) {
-            tcg_out_bswap16(s, COND_AL, datalo, datalo);
+            tcg_out_bswap16(s, COND_AL, datalo, datalo,
+                            TCG_BSWAP_IZ | TCG_BSWAP_OZ);
         }
         break;
     case MO_SW:
         if (bswap) {
             tcg_out_ld16u_r(s, COND_AL, datalo, addrlo, addend);
-            tcg_out_bswap16s(s, COND_AL, datalo, datalo);
+            tcg_out_bswap16(s, COND_AL, datalo, datalo,
+                            TCG_BSWAP_IZ | TCG_BSWAP_OS);
         } else {
             tcg_out_ld16s_r(s, COND_AL, datalo, addrlo, addend);
         }
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_qemu_ld_direct(TCGContext *s, MemOp opc,
     case MO_UW:
         tcg_out_ld16u_8(s, COND_AL, datalo, addrlo, 0);
         if (bswap) {
-            tcg_out_bswap16(s, COND_AL, datalo, datalo);
+            tcg_out_bswap16(s, COND_AL, datalo, datalo,
+                            TCG_BSWAP_IZ | TCG_BSWAP_OZ);
         }
         break;
     case MO_SW:
         if (bswap) {
             tcg_out_ld16u_8(s, COND_AL, datalo, addrlo, 0);
-            tcg_out_bswap16s(s, COND_AL, datalo, datalo);
+            tcg_out_bswap16(s, COND_AL, datalo, datalo,
+                            TCG_BSWAP_IZ | TCG_BSWAP_OS);
         } else {
             tcg_out_ld16s_8(s, COND_AL, datalo, addrlo, 0);
         }
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_qemu_st_index(TCGContext *s, int cond, MemOp opc,
         break;
     case MO_16:
         if (bswap) {
-            tcg_out_bswap16st(s, cond, TCG_REG_R0, datalo);
+            tcg_out_bswap16(s, cond, TCG_REG_R0, datalo, 0);
             tcg_out_st16_r(s, cond, TCG_REG_R0, addrlo, addend);
         } else {
             tcg_out_st16_r(s, cond, datalo, addrlo, addend);
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_qemu_st_direct(TCGContext *s, MemOp opc,
         break;
     case MO_16:
         if (bswap) {
-            tcg_out_bswap16st(s, COND_AL, TCG_REG_R0, datalo);
+            tcg_out_bswap16(s, COND_AL, TCG_REG_R0, datalo, 0);
             tcg_out_st16_8(s, COND_AL, TCG_REG_R0, addrlo, 0);
         } else {
             tcg_out_st16_8(s, COND_AL, datalo, addrlo, 0);
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         break;
 
     case INDEX_op_bswap16_i32:
-        tcg_out_bswap16(s, COND_AL, args[0], args[1]);
+        tcg_out_bswap16(s, COND_AL, args[0], args[1], args[2]);
         break;
     case INDEX_op_bswap32_i32:
         tcg_out_bswap32(s, COND_AL, args[0], args[1]);
-- 
2.25.1

We will shortly require these in other context;
make the expansion as clear as possible.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/ppc/tcg-target.c.inc | 31 +++++++++++++++++++++----------
 1 file changed, 21 insertions(+), 10 deletions(-)

diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_rlw(TCGContext *s, int op, TCGReg ra, TCGReg rs,
     tcg_out32(s, op | RA(ra) | RS(rs) | SH(sh) | MB(mb) | ME(me));
 }
 
+static inline void tcg_out_ext8s(TCGContext *s, TCGReg dst, TCGReg src)
+{
+    tcg_out32(s, EXTSB | RA(dst) | RS(src));
+}
+
+static inline void tcg_out_ext16s(TCGContext *s, TCGReg dst, TCGReg src)
+{
+    tcg_out32(s, EXTSH | RA(dst) | RS(src));
+}
+
+static inline void tcg_out_ext32s(TCGContext *s, TCGReg dst, TCGReg src)
+{
+    tcg_out32(s, EXTSW | RA(dst) | RS(src));
+}
+
 static inline void tcg_out_ext32u(TCGContext *s, TCGReg dst, TCGReg src)
 {
     tcg_out_rld(s, RLDICL, dst, src, 0, 32);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
                        const int const_args[TCG_MAX_OP_ARGS])
 {
     TCGArg a0, a1, a2;
-    int c;
 
     switch (opc) {
     case INDEX_op_exit_tb:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ld8s_i32:
     case INDEX_op_ld8s_i64:
         tcg_out_mem_long(s, LBZ, LBZX, args[0], args[1], args[2]);
-        tcg_out32(s, EXTSB | RS(args[0]) | RA(args[0]));
+        tcg_out_ext8s(s, args[0], args[0]);
         break;
     case INDEX_op_ld16u_i32:
     case INDEX_op_ld16u_i64:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
 
     case INDEX_op_ext8s_i32:
     case INDEX_op_ext8s_i64:
-        c = EXTSB;
-        goto gen_ext;
+        tcg_out_ext8s(s, args[0], args[1]);
+        break;
     case INDEX_op_ext16s_i32:
     case INDEX_op_ext16s_i64:
-        c = EXTSH;
-        goto gen_ext;
+        tcg_out_ext16s(s, args[0], args[1]);
+        break;
     case INDEX_op_ext_i32_i64:
     case INDEX_op_ext32s_i64:
-        c = EXTSW;
-        goto gen_ext;
-    gen_ext:
-        tcg_out32(s, c | RS(args[1]) | RA(args[0]));
+        tcg_out_ext32s(s, args[0], args[1]);
         break;
     case INDEX_op_extu_i32_i64:
         tcg_out_ext32u(s, args[0], args[1]);
-- 
2.25.1

We will shortly require sari in other context;
split out both for cleanliness sake.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/ppc/tcg-target.c.inc | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_shli64(TCGContext *s, TCGReg dst, TCGReg src, int c)
     tcg_out_rld(s, RLDICR, dst, src, c, 63 - c);
 }
 
+static inline void tcg_out_sari32(TCGContext *s, TCGReg dst, TCGReg src, int c)
+{
+    /* Limit immediate shift count lest we create an illegal insn.  */
+    tcg_out32(s, SRAWI | RA(dst) | RS(src) | SH(c & 31));
+}
+
 static inline void tcg_out_shri32(TCGContext *s, TCGReg dst, TCGReg src, int c)
 {
     tcg_out_rlw(s, RLWINM, dst, src, 32 - c, c, 31);
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_shri64(TCGContext *s, TCGReg dst, TCGReg src, int c)
     tcg_out_rld(s, RLDICL, dst, src, 64 - c, c);
 }
 
+static inline void tcg_out_sari64(TCGContext *s, TCGReg dst, TCGReg src, int c)
+{
+    tcg_out32(s, SRADI | RA(dst) | RS(src) | SH(c & 0x1f) | ((c >> 4) & 2));
+}
+
 /* Emit a move into ret of arg, if it can be done in one insn.  */
 static bool tcg_out_movi_one(TCGContext *s, TCGReg ret, tcg_target_long arg)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         break;
     case INDEX_op_sar_i32:
         if (const_args[2]) {
-            /* Limit immediate shift count lest we create an illegal insn.  */
-            tcg_out32(s, SRAWI | RS(args[1]) | RA(args[0]) | SH(args[2] & 31));
+            tcg_out_sari32(s, args[0], args[1], args[2]);
         } else {
             tcg_out32(s, SRAW | SAB(args[1], args[0], args[2]));
         }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         break;
     case INDEX_op_sar_i64:
         if (const_args[2]) {
-            int sh = SH(args[2] & 0x1f) | (((args[2] >> 5) & 1) << 1);
-            tcg_out32(s, SRADI | RA(args[0]) | RS(args[1]) | sh);
+            tcg_out_sari64(s, args[0], args[1], args[2]);
         } else {
             tcg_out32(s, SRAD | SAB(args[1], args[0], args[2]));
         }
-- 
2.25.1

With the use of a suitable temporary, we can use the same
algorithm when src overlaps dst.  The result is the same
number of instructions either way.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/ppc/tcg-target.c.inc | 34 +++++++++++++++++++---------------
 1 file changed, 19 insertions(+), 15 deletions(-)

diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_sari64(TCGContext *s, TCGReg dst, TCGReg src, int c)
     tcg_out32(s, SRADI | RA(dst) | RS(src) | SH(c & 0x1f) | ((c >> 4) & 2));
 }
 
+static void tcg_out_bswap16(TCGContext *s, TCGReg dst, TCGReg src)
+{
+    TCGReg tmp = dst == src ? TCG_REG_R0 : dst;
+
+    /*
+     * In the following,
+     *   dep(a, b, m) -> (a & ~m) | (b & m)
+     *
+     * Begin with:                              src = xxxxabcd
+     */
+    /* tmp = rol32(src, 24) & 0x000000ff            = 0000000c */
+    tcg_out_rlw(s, RLWINM, tmp, src, 24, 24, 31);
+    /* tmp = dep(tmp, rol32(src, 8), 0x0000ff00)    = 000000dc */
+    tcg_out_rlw(s, RLWIMI, tmp, src, 8, 16, 23);
+
+    tcg_out_mov(s, TCG_TYPE_REG, dst, tmp);
+}
+
 /* Emit a move into ret of arg, if it can be done in one insn.  */
 static bool tcg_out_movi_one(TCGContext *s, TCGReg ret, tcg_target_long arg)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
 
     case INDEX_op_bswap16_i32:
     case INDEX_op_bswap16_i64:
-        a0 = args[0], a1 = args[1];
-        /* a1 = abcd */
-        if (a0 != a1) {
-            /* a0 = (a1 r<< 24) & 0xff # 000c */
-            tcg_out_rlw(s, RLWINM, a0, a1, 24, 24, 31);
-            /* a0 = (a0 & ~0xff00) | (a1 r<< 8) & 0xff00 # 00dc */
-            tcg_out_rlw(s, RLWIMI, a0, a1, 8, 16, 23);
-        } else {
-            /* r0 = (a1 r<< 8) & 0xff00 # 00d0 */
-            tcg_out_rlw(s, RLWINM, TCG_REG_R0, a1, 8, 16, 23);
-            /* a0 = (a1 r<< 24) & 0xff # 000c */
-            tcg_out_rlw(s, RLWINM, a0, a1, 24, 24, 31);
-            /* a0 = a0 | r0 # 00dc */
-            tcg_out32(s, OR | SAB(TCG_REG_R0, a0, a0));
-        }
+        tcg_out_bswap16(s, args[0], args[1]);
         break;
 
     case INDEX_op_bswap32_i32:
-- 
2.25.1

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/ppc/tcg-target.c.inc | 38 ++++++++++++++++++++++----------------
 1 file changed, 22 insertions(+), 16 deletions(-)

diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_bswap16(TCGContext *s, TCGReg dst, TCGReg src)
     tcg_out_mov(s, TCG_TYPE_REG, dst, tmp);
 }
 
+static void tcg_out_bswap32(TCGContext *s, TCGReg dst, TCGReg src)
+{
+    TCGReg tmp = dst == src ? TCG_REG_R0 : dst;
+
+    /*
+     * Stolen from gcc's builtin_bswap32.
+     * In the following,
+     *   dep(a, b, m) -> (a & ~m) | (b & m)
+     *
+     * Begin with:                              src = xxxxabcd
+     */
+    /* tmp = rol32(src, 8) & 0xffffffff             = 0000bcda */
+    tcg_out_rlw(s, RLWINM, tmp, src, 8, 0, 31);
+    /* tmp = dep(tmp, rol32(src, 24), 0xff000000)   = 0000dcda */
+    tcg_out_rlw(s, RLWIMI, tmp, src, 24, 0, 7);
+    /* tmp = dep(tmp, rol32(src, 24), 0x0000ff00)   = 0000dcba */
+    tcg_out_rlw(s, RLWIMI, tmp, src, 24, 16, 23);
+
+    tcg_out_mov(s, TCG_TYPE_REG, dst, tmp);
+}
+
 /* Emit a move into ret of arg, if it can be done in one insn.  */
 static bool tcg_out_movi_one(TCGContext *s, TCGReg ret, tcg_target_long arg)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_bswap16_i64:
         tcg_out_bswap16(s, args[0], args[1]);
         break;
-
     case INDEX_op_bswap32_i32:
     case INDEX_op_bswap32_i64:
-        /* Stolen from gcc's builtin_bswap32 */
-        a1 = args[1];
-        a0 = args[0] == a1 ? TCG_REG_R0 : args[0];
-
-        /* a1 = args[1] # abcd */
-        /* a0 = rotate_left (a1, 8) # bcda */
-        tcg_out_rlw(s, RLWINM, a0, a1, 8, 0, 31);
-        /* a0 = (a0 & ~0xff000000) | ((a1 r<< 24) & 0xff000000) # dcda */
-        tcg_out_rlw(s, RLWIMI, a0, a1, 24, 0, 7);
-        /* a0 = (a0 & ~0x0000ff00) | ((a1 r<< 24) & 0x0000ff00) # dcba */
-        tcg_out_rlw(s, RLWIMI, a0, a1, 24, 16, 23);
-
-        if (a0 == TCG_REG_R0) {
-            tcg_out_mov(s, TCG_TYPE_REG, args[0], a0);
-        }
+        tcg_out_bswap32(s, args[0], args[1]);
         break;
 
     case INDEX_op_bswap64_i64:
-- 
2.25.1

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/ppc/tcg-target.c.inc | 64 +++++++++++++++++++++-------------------
 1 file changed, 34 insertions(+), 30 deletions(-)

diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_bswap32(TCGContext *s, TCGReg dst, TCGReg src)
     tcg_out_mov(s, TCG_TYPE_REG, dst, tmp);
 }
 
+static void tcg_out_bswap64(TCGContext *s, TCGReg dst, TCGReg src)
+{
+    TCGReg t0 = dst == src ? TCG_REG_R0 : dst;
+    TCGReg t1 = dst == src ? dst : TCG_REG_R0;
+
+    /*
+     * In the following,
+     *   dep(a, b, m) -> (a & ~m) | (b & m)
+     *
+     * Begin with:                              src = abcdefgh
+     */
+    /* t0 = rol32(src, 8) & 0xffffffff              = 0000fghe */
+    tcg_out_rlw(s, RLWINM, t0, src, 8, 0, 31);
+    /* t0 = dep(t0, rol32(src, 24), 0xff000000)     = 0000hghe */
+    tcg_out_rlw(s, RLWIMI, t0, src, 24, 0, 7);
+    /* t0 = dep(t0, rol32(src, 24), 0x0000ff00)     = 0000hgfe */
+    tcg_out_rlw(s, RLWIMI, t0, src, 24, 16, 23);
+
+    /* t0 = rol64(t0, 32)                           = hgfe0000 */
+    tcg_out_rld(s, RLDICL, t0, t0, 32, 0);
+    /* t1 = rol64(src, 32)                          = efghabcd */
+    tcg_out_rld(s, RLDICL, t1, src, 32, 0);
+
+    /* t0 = dep(t0, rol32(t1, 24), 0xffffffff)      = hgfebcda */
+    tcg_out_rlw(s, RLWIMI, t0, t1, 8, 0, 31);
+    /* t0 = dep(t0, rol32(t1, 24), 0xff000000)      = hgfedcda */
+    tcg_out_rlw(s, RLWIMI, t0, t1, 24, 0, 7);
+    /* t0 = dep(t0, rol32(t1, 24), 0x0000ff00)      = hgfedcba */
+    tcg_out_rlw(s, RLWIMI, t0, t1, 24, 16, 23);
+
+    tcg_out_mov(s, TCG_TYPE_REG, dst, t0);
+}
+
 /* Emit a move into ret of arg, if it can be done in one insn.  */
 static bool tcg_out_movi_one(TCGContext *s, TCGReg ret, tcg_target_long arg)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_bswap32_i64:
         tcg_out_bswap32(s, args[0], args[1]);
         break;
-
     case INDEX_op_bswap64_i64:
-        a0 = args[0], a1 = args[1], a2 = TCG_REG_R0;
-        if (a0 == a1) {
-            a0 = TCG_REG_R0;
-            a2 = a1;
-        }
-
-        /* a1 = # abcd efgh */
-        /* a0 = rl32(a1, 8) # 0000 fghe */
-        tcg_out_rlw(s, RLWINM, a0, a1, 8, 0, 31);
-        /* a0 = dep(a0, rl32(a1, 24), 0xff000000) # 0000 hghe */
-        tcg_out_rlw(s, RLWIMI, a0, a1, 24, 0, 7);
-        /* a0 = dep(a0, rl32(a1, 24), 0x0000ff00) # 0000 hgfe */
-        tcg_out_rlw(s, RLWIMI, a0, a1, 24, 16, 23);
-
-        /* a0 = rl64(a0, 32) # hgfe 0000 */
-        /* a2 = rl64(a1, 32) # efgh abcd */
-        tcg_out_rld(s, RLDICL, a0, a0, 32, 0);
-        tcg_out_rld(s, RLDICL, a2, a1, 32, 0);
-
-        /* a0 = dep(a0, rl32(a2, 8), 0xffffffff)  # hgfe bcda */
-        tcg_out_rlw(s, RLWIMI, a0, a2, 8, 0, 31);
-        /* a0 = dep(a0, rl32(a2, 24), 0xff000000) # hgfe dcda */
-        tcg_out_rlw(s, RLWIMI, a0, a2, 24, 0, 7);
-        /* a0 = dep(a0, rl32(a2, 24), 0x0000ff00) # hgfe dcba */
-        tcg_out_rlw(s, RLWIMI, a0, a2, 24, 16, 23);
-
-        if (a0 == 0) {
-            tcg_out_mov(s, TCG_TYPE_REG, args[0], a0);
-        }
+        tcg_out_bswap64(s, args[0], args[1]);
         break;
 
     case INDEX_op_deposit_i32:
-- 
2.25.1

For INDEX_op_bswap32_i32, pass 0 for flags: input not zero-extended,
output does not need extension within the host 64-bit register.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/ppc/tcg-target.c.inc | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_sari64(TCGContext *s, TCGReg dst, TCGReg src, int c)
     tcg_out32(s, SRADI | RA(dst) | RS(src) | SH(c & 0x1f) | ((c >> 4) & 2));
 }
 
-static void tcg_out_bswap16(TCGContext *s, TCGReg dst, TCGReg src)
+static void tcg_out_bswap16(TCGContext *s, TCGReg dst, TCGReg src, int flags)
 {
     TCGReg tmp = dst == src ? TCG_REG_R0 : dst;
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_bswap16(TCGContext *s, TCGReg dst, TCGReg src)
     /* tmp = dep(tmp, rol32(src, 8), 0x0000ff00)    = 000000dc */
     tcg_out_rlw(s, RLWIMI, tmp, src, 8, 16, 23);
 
-    tcg_out_mov(s, TCG_TYPE_REG, dst, tmp);
+    if (flags & TCG_BSWAP_OS) {
+        tcg_out_ext16s(s, dst, tmp);
+    } else {
+        tcg_out_mov(s, TCG_TYPE_REG, dst, tmp);
+    }
 }
 
-static void tcg_out_bswap32(TCGContext *s, TCGReg dst, TCGReg src)
+static void tcg_out_bswap32(TCGContext *s, TCGReg dst, TCGReg src, int flags)
 {
     TCGReg tmp = dst == src ? TCG_REG_R0 : dst;
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_bswap32(TCGContext *s, TCGReg dst, TCGReg src)
     /* tmp = dep(tmp, rol32(src, 24), 0x0000ff00)   = 0000dcba */
     tcg_out_rlw(s, RLWIMI, tmp, src, 24, 16, 23);
 
-    tcg_out_mov(s, TCG_TYPE_REG, dst, tmp);
+    if (flags & TCG_BSWAP_OS) {
+        tcg_out_ext32s(s, dst, tmp);
+    } else {
+        tcg_out_mov(s, TCG_TYPE_REG, dst, tmp);
+    }
 }
 
 static void tcg_out_bswap64(TCGContext *s, TCGReg dst, TCGReg src)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
 
     case INDEX_op_bswap16_i32:
     case INDEX_op_bswap16_i64:
-        tcg_out_bswap16(s, args[0], args[1]);
+        tcg_out_bswap16(s, args[0], args[1], args[2]);
         break;
     case INDEX_op_bswap32_i32:
+        tcg_out_bswap32(s, args[0], args[1], 0);
+        break;
     case INDEX_op_bswap32_i64:
-        tcg_out_bswap32(s, args[0], args[1]);
+        tcg_out_bswap32(s, args[0], args[1], args[2]);
         break;
     case INDEX_op_bswap64_i64:
         tcg_out_bswap64(s, args[0], args[1]);
-- 
2.25.1

diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
 #define SRAD   XO31(794)
 #define SRADI  XO31(413<<1)
 
+#define BRH    XO31(219)
+#define BRW    XO31(155)
+#define BRD    XO31(187)
+
 #define TW     XO31( 4)
 #define TRAP   (TW | TO(31))
 
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_ext16s(TCGContext *s, TCGReg dst, TCGReg src)
     tcg_out32(s, EXTSH | RA(dst) | RS(src));
 }
 
+static inline void tcg_out_ext16u(TCGContext *s, TCGReg dst, TCGReg src)
+{
+    tcg_out32(s, ANDI | SAI(src, dst, 0xffff));
+}
+
 static inline void tcg_out_ext32s(TCGContext *s, TCGReg dst, TCGReg src)
 {
     tcg_out32(s, EXTSW | RA(dst) | RS(src));
@@ -XXX,XX +XXX,XX @@ static void tcg_out_bswap16(TCGContext *s, TCGReg dst, TCGReg src, int flags)
 {
     TCGReg tmp = dst == src ? TCG_REG_R0 : dst;
 
+    if (have_isa_3_10) {
+        tcg_out32(s, BRH | RA(dst) | RS(src));
+        if (flags & TCG_BSWAP_OS) {
+            tcg_out_ext16s(s, dst, dst);
+        } else if ((flags & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
+            tcg_out_ext16u(s, dst, dst);
+        }
+        return;
+    }
+
     /*
      * In the following,
      *   dep(a, b, m) -> (a & ~m) | (b & m)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_bswap32(TCGContext *s, TCGReg dst, TCGReg src, int flags)
 {
     TCGReg tmp = dst == src ? TCG_REG_R0 : dst;
 
+    if (have_isa_3_10) {
+        tcg_out32(s, BRW | RA(dst) | RS(src));
+        if (flags & TCG_BSWAP_OS) {
+            tcg_out_ext32s(s, dst, dst);
+        } else if ((flags & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
+            tcg_out_ext32u(s, dst, dst);
+        }
+        return;
+    }
+
     /*
      * Stolen from gcc's builtin_bswap32.
      * In the following,
@@ -XXX,XX +XXX,XX @@ static void tcg_out_bswap64(TCGContext *s, TCGReg dst, TCGReg src)
     TCGReg t0 = dst == src ? TCG_REG_R0 : dst;
     TCGReg t1 = dst == src ? dst : TCG_REG_R0;
 
+    if (have_isa_3_10) {
+        tcg_out32(s, BRD | RA(dst) | RS(src));
+        return;
+    }
+
     /*
      * In the following,
      *   dep(a, b, m) -> (a & ~m) | (b & m)
-- 
2.25.1

For INDEX_op_bswap16_i64, use 64-bit instructions so that we can
easily provide the extension to 64-bits.  Drop the special case,
previously used, where the input is already zero-extended -- the
minor code size savings is not worth the complication.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/s390/tcg-target.c.inc | 34 ++++++++++++++++++++++++++++------
 1 file changed, 28 insertions(+), 6 deletions(-)

diff --git a/tcg/s390/tcg-target.c.inc b/tcg/s390/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390/tcg-target.c.inc
+++ b/tcg/s390/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tgen_ext16u(s, TCG_TYPE_I32, args[0], args[1]);
         break;
 
-    OP_32_64(bswap16):
-        /* The TCG bswap definition requires bits 0-47 already be zero.
-           Thus we don't need the G-type insns to implement bswap16_i64.  */
-        tcg_out_insn(s, RRE, LRVR, args[0], args[1]);
-        tcg_out_sh32(s, RS_SRL, args[0], TCG_REG_NONE, 16);
+    case INDEX_op_bswap16_i32:
+        a0 = args[0], a1 = args[1], a2 = args[2];
+        tcg_out_insn(s, RRE, LRVR, a0, a1);
+        if (a2 & TCG_BSWAP_OS) {
+            tcg_out_sh32(s, RS_SRA, a0, TCG_REG_NONE, 16);
+        } else {
+            tcg_out_sh32(s, RS_SRL, a0, TCG_REG_NONE, 16);
+        }
         break;
-    OP_32_64(bswap32):
+    case INDEX_op_bswap16_i64:
+        a0 = args[0], a1 = args[1], a2 = args[2];
+        tcg_out_insn(s, RRE, LRVGR, a0, a1);
+        if (a2 & TCG_BSWAP_OS) {
+            tcg_out_sh64(s, RSY_SRAG, a0, a0, TCG_REG_NONE, 48);
+        } else {
+            tcg_out_sh64(s, RSY_SRLG, a0, a0, TCG_REG_NONE, 48);
+        }
+        break;
+
+    case INDEX_op_bswap32_i32:
         tcg_out_insn(s, RRE, LRVR, args[0], args[1]);
         break;
+    case INDEX_op_bswap32_i64:
+        a0 = args[0], a1 = args[1], a2 = args[2];
+        tcg_out_insn(s, RRE, LRVR, a0, a1);
+        if (a2 & TCG_BSWAP_OS) {
+            tgen_ext32s(s, a0, a0);
+        } else if ((a2 & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
+            tgen_ext32u(s, a0, a0);
+        }
+        break;
 
     case INDEX_op_add2_i32:
         if (const_args[4]) {
-- 
2.25.1

Merge tcg_out_bswap16 and tcg_out_bswap16s.  Use the flags
in the internal uses for loads and stores.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/mips/tcg-target.c.inc | 63 +++++++++++++++++++--------------------
 1 file changed, 30 insertions(+), 33 deletions(-)

diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi(TCGContext *s, TCGType type,
     }
 }
 
-static inline void tcg_out_bswap16(TCGContext *s, TCGReg ret, TCGReg arg)
+static void tcg_out_bswap16(TCGContext *s, TCGReg ret, TCGReg arg, int flags)
 {
+    /* ret and arg can't be register tmp0 */
+    tcg_debug_assert(ret != TCG_TMP0);
+    tcg_debug_assert(arg != TCG_TMP0);
+
+    /* With arg = abcd: */
     if (use_mips32r2_instructions) {
-        tcg_out_opc_reg(s, OPC_WSBH, ret, 0, arg);
-    } else {
-        /* ret and arg can't be register at */
-        if (ret == TCG_TMP0 || arg == TCG_TMP0) {
-            tcg_abort();
+        tcg_out_opc_reg(s, OPC_WSBH, ret, 0, arg);                 /* badc */
+        if (flags & TCG_BSWAP_OS) {
+            tcg_out_opc_reg(s, OPC_SEH, ret, 0, ret);              /* ssdc */
+        } else if ((flags & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
+            tcg_out_opc_imm(s, OPC_ANDI, ret, ret, 0xffff);        /* 00dc */
         }
-
-        tcg_out_opc_sa(s, OPC_SRL, TCG_TMP0, arg, 8);
-        tcg_out_opc_sa(s, OPC_SLL, ret, arg, 8);
-        tcg_out_opc_imm(s, OPC_ANDI, ret, ret, 0xff00);
-        tcg_out_opc_reg(s, OPC_OR, ret, ret, TCG_TMP0);
+        return;
     }
-}
 
-static inline void tcg_out_bswap16s(TCGContext *s, TCGReg ret, TCGReg arg)
-{
-    if (use_mips32r2_instructions) {
-        tcg_out_opc_reg(s, OPC_WSBH, ret, 0, arg);
-        tcg_out_opc_reg(s, OPC_SEH, ret, 0, ret);
+    tcg_out_opc_sa(s, OPC_SRL, TCG_TMP0, arg, 8);                  /* 0abc */
+    if (!(flags & TCG_BSWAP_IZ)) {
+        tcg_out_opc_imm(s, OPC_ANDI, TCG_TMP0, TCG_TMP0, 0x00ff);  /* 000c */
+    }
+    if (flags & TCG_BSWAP_OS) {
+        tcg_out_opc_sa(s, OPC_SLL, ret, arg, 24);                  /* d000 */
+        tcg_out_opc_sa(s, OPC_SRA, ret, ret, 16);                  /* ssd0 */
     } else {
-        /* ret and arg can't be register at */
-        if (ret == TCG_TMP0 || arg == TCG_TMP0) {
-            tcg_abort();
+        tcg_out_opc_sa(s, OPC_SLL, ret, arg, 8);                   /* bcd0 */
+        if (flags & TCG_BSWAP_OZ) {
+            tcg_out_opc_imm(s, OPC_ANDI, ret, ret, 0xff00);        /* 00d0 */
         }
-
-        tcg_out_opc_sa(s, OPC_SRL, TCG_TMP0, arg, 8);
-        tcg_out_opc_sa(s, OPC_SLL, ret, arg, 24);
-        tcg_out_opc_sa(s, OPC_SRA, ret, ret, 16);
-        tcg_out_opc_reg(s, OPC_OR, ret, ret, TCG_TMP0);
     }
+    tcg_out_opc_reg(s, OPC_OR, ret, ret, TCG_TMP0);                /* ssdc */
 }
 
 static void tcg_out_bswap_subr(TCGContext *s, const tcg_insn_unit *sub)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg lo, TCGReg hi,
         break;
     case MO_UW | MO_BSWAP:
         tcg_out_opc_imm(s, OPC_LHU, TCG_TMP1, base, 0);
-        tcg_out_bswap16(s, lo, TCG_TMP1);
+        tcg_out_bswap16(s, lo, TCG_TMP1, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
         break;
     case MO_UW:
         tcg_out_opc_imm(s, OPC_LHU, lo, base, 0);
         break;
     case MO_SW | MO_BSWAP:
         tcg_out_opc_imm(s, OPC_LHU, TCG_TMP1, base, 0);
-        tcg_out_bswap16s(s, lo, TCG_TMP1);
+        tcg_out_bswap16(s, lo, TCG_TMP1, TCG_BSWAP_IZ | TCG_BSWAP_OS);
         break;
     case MO_SW:
         tcg_out_opc_imm(s, OPC_LH, lo, base, 0);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, TCGReg lo, TCGReg hi,
         break;
 
     case MO_16 | MO_BSWAP:
-        tcg_out_opc_imm(s, OPC_ANDI, TCG_TMP1, lo, 0xffff);
-        tcg_out_bswap16(s, TCG_TMP1, TCG_TMP1);
+        tcg_out_bswap16(s, TCG_TMP1, lo, 0);
         lo = TCG_TMP1;
         /* FALLTHRU */
     case MO_16:
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_not_i64:
         i1 = OPC_NOR;
         goto do_unary;
-    case INDEX_op_bswap16_i32:
-    case INDEX_op_bswap16_i64:
-        i1 = OPC_WSBH;
-        goto do_unary;
     case INDEX_op_ext8s_i32:
     case INDEX_op_ext8s_i64:
         i1 = OPC_SEB;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_opc_reg(s, i1, a0, TCG_REG_ZERO, a1);
         break;
 
+    case INDEX_op_bswap16_i32:
+    case INDEX_op_bswap16_i64:
+        tcg_out_bswap16(s, a0, a1, a2);
+        break;
     case INDEX_op_bswap32_i32:
         tcg_out_bswap32(s, a0, a1);
         break;
-- 
2.25.1

Merge tcg_out_bswap32 and tcg_out_bswap32s.
Use the flags in the internal uses for loads and stores.

For mips32r2 bswap32 with zero-extension, standardize on
WSBH+ROTR+DEXT.  This is the same number of insns as the
previous DSBH+DSHD+DSRL but fits in better with the flags check.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/mips/tcg-target.c.inc | 39 ++++++++++++++++-----------------------
 1 file changed, 16 insertions(+), 23 deletions(-)

diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_bswap_subr(TCGContext *s, const tcg_insn_unit *sub)
     tcg_debug_assert(ok);
 }
 
-static void tcg_out_bswap32(TCGContext *s, TCGReg ret, TCGReg arg)
+static void tcg_out_bswap32(TCGContext *s, TCGReg ret, TCGReg arg, int flags)
 {
     if (use_mips32r2_instructions) {
         tcg_out_opc_reg(s, OPC_WSBH, ret, 0, arg);
         tcg_out_opc_sa(s, OPC_ROTR, ret, ret, 16);
+        if (flags & TCG_BSWAP_OZ) {
+            tcg_out_opc_bf(s, OPC_DEXT, ret, ret, 31, 0);
+        }
     } else {
-        tcg_out_bswap_subr(s, bswap32_addr);
-        /* delay slot -- never omit the insn, like tcg_out_mov might.  */
-        tcg_out_opc_reg(s, OPC_OR, TCG_TMP0, arg, TCG_REG_ZERO);
-        tcg_out_mov(s, TCG_TYPE_I32, ret, TCG_TMP3);
-    }
-}
-
-static void tcg_out_bswap32u(TCGContext *s, TCGReg ret, TCGReg arg)
-{
-    if (use_mips32r2_instructions) {
-        tcg_out_opc_reg(s, OPC_DSBH, ret, 0, arg);
-        tcg_out_opc_reg(s, OPC_DSHD, ret, 0, ret);
-        tcg_out_dsrl(s, ret, ret, 32);
-    } else {
-        tcg_out_bswap_subr(s, bswap32u_addr);
+        if (flags & TCG_BSWAP_OZ) {
+            tcg_out_bswap_subr(s, bswap32u_addr);
+        } else {
+            tcg_out_bswap_subr(s, bswap32_addr);
+        }
         /* delay slot -- never omit the insn, like tcg_out_mov might.  */
         tcg_out_opc_reg(s, OPC_OR, TCG_TMP0, arg, TCG_REG_ZERO);
         tcg_out_mov(s, TCG_TYPE_I32, ret, TCG_TMP3);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg lo, TCGReg hi,
         if (TCG_TARGET_REG_BITS == 64 && is_64) {
             if (use_mips32r2_instructions) {
                 tcg_out_opc_imm(s, OPC_LWU, lo, base, 0);
-                tcg_out_bswap32u(s, lo, lo);
+                tcg_out_bswap32(s, lo, lo, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
             } else {
                 tcg_out_bswap_subr(s, bswap32u_addr);
                 /* delay slot */
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg lo, TCGReg hi,
     case MO_SL | MO_BSWAP:
         if (use_mips32r2_instructions) {
             tcg_out_opc_imm(s, OPC_LW, lo, base, 0);
-            tcg_out_bswap32(s, lo, lo);
+            tcg_out_bswap32(s, lo, lo, 0);
         } else {
             tcg_out_bswap_subr(s, bswap32_addr);
             /* delay slot */
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, TCGReg lo, TCGReg hi,
         break;
 
     case MO_32 | MO_BSWAP:
-        tcg_out_bswap32(s, TCG_TMP3, lo);
+        tcg_out_bswap32(s, TCG_TMP3, lo, 0);
         lo = TCG_TMP3;
         /* FALLTHRU */
     case MO_32:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, TCGReg lo, TCGReg hi,
             tcg_out_opc_imm(s, OPC_SW, TCG_TMP0, base, 0);
             tcg_out_opc_imm(s, OPC_SW, TCG_TMP1, base, 4);
         } else {
-            tcg_out_bswap32(s, TCG_TMP3, MIPS_BE ? lo : hi);
+            tcg_out_bswap32(s, TCG_TMP3, MIPS_BE ? lo : hi, 0);
             tcg_out_opc_imm(s, OPC_SW, TCG_TMP3, base, 0);
-            tcg_out_bswap32(s, TCG_TMP3, MIPS_BE ? hi : lo);
+            tcg_out_bswap32(s, TCG_TMP3, MIPS_BE ? hi : lo, 0);
             tcg_out_opc_imm(s, OPC_SW, TCG_TMP3, base, 4);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_bswap16(s, a0, a1, a2);
         break;
     case INDEX_op_bswap32_i32:
-        tcg_out_bswap32(s, a0, a1);
+        tcg_out_bswap32(s, a0, a1, 0);
         break;
     case INDEX_op_bswap32_i64:
-        tcg_out_bswap32u(s, a0, a1);
+        tcg_out_bswap32(s, a0, a1, a2);
         break;
     case INDEX_op_bswap64_i64:
         tcg_out_bswap64(s, a0, a1);
-- 
2.25.1

The existing interpreter zero-extends, ignoring high bits.
Simply add a separate sign-extension opcode if required.
Ensure that the interpreter supports ext16s when bswap16 is enabled.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c                |  3 ++-
 tcg/tci/tcg-target.c.inc | 23 ++++++++++++++++++++---
 2 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             regs[r0] = (int8_t)regs[r1];
             break;
 #endif
-#if TCG_TARGET_HAS_ext16s_i32 || TCG_TARGET_HAS_ext16s_i64
+#if TCG_TARGET_HAS_ext16s_i32 || TCG_TARGET_HAS_ext16s_i64 || \
+    TCG_TARGET_HAS_bswap16_i32 || TCG_TARGET_HAS_bswap16_i64
         CASE_32_64(ext16s)
             tci_args_rr(insn, &r0, &r1);
             regs[r0] = (int16_t)regs[r1];
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
+    TCGOpcode exts;
+
     switch (opc) {
     case INDEX_op_exit_tb:
         tcg_out_op_p(s, opc, (void *)args[0]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     CASE_64(ext32u)      /* Optional (TCG_TARGET_HAS_ext32u_i64). */
     CASE_64(ext_i32)
     CASE_64(extu_i32)
-    CASE_32_64(bswap16)  /* Optional (TCG_TARGET_HAS_bswap16_*). */
-    CASE_32_64(bswap32)  /* Optional (TCG_TARGET_HAS_bswap32_*). */
-    CASE_64(bswap64)     /* Optional (TCG_TARGET_HAS_bswap64_i64). */
     CASE_32_64(ctpop)    /* Optional (TCG_TARGET_HAS_ctpop_*). */
+    case INDEX_op_bswap32_i32: /* Optional (TCG_TARGET_HAS_bswap32_i32). */
+    case INDEX_op_bswap64_i64: /* Optional (TCG_TARGET_HAS_bswap64_i64). */
         tcg_out_op_rr(s, opc, args[0], args[1]);
         break;
 
+    case INDEX_op_bswap16_i32: /* Optional (TCG_TARGET_HAS_bswap16_i32). */
+        exts = INDEX_op_ext16s_i32;
+        goto do_bswap;
+    case INDEX_op_bswap16_i64: /* Optional (TCG_TARGET_HAS_bswap16_i64). */
+        exts = INDEX_op_ext16s_i64;
+        goto do_bswap;
+    case INDEX_op_bswap32_i64: /* Optional (TCG_TARGET_HAS_bswap32_i64). */
+        exts = INDEX_op_ext32s_i64;
+    do_bswap:
+        /* The base tci bswaps zero-extend, and ignore high bits. */
+        tcg_out_op_rr(s, opc, args[0], args[1]);
+        if (args[2] & TCG_BSWAP_OS) {
+            tcg_out_op_rr(s, exts, args[0], args[0]);
+        }
+        break;
+
     CASE_32_64(add2)
     CASE_32_64(sub2)
         tcg_out_op_rrrrrr(s, opc, args[0], args[1], args[2],
-- 
2.25.1

Notice when the input is known to be zero-extended and force
the TCG_BSWAP_IZ flag on.  Honor the TCG_BSWAP_OS bit during
constant folding.  Propagate the input to the output mask.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 56 +++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 51 insertions(+), 5 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static uint64_t do_constant_folding_2(TCGOpcode op, uint64_t x, uint64_t y)
         return (uint16_t)x;
 
     CASE_OP_32_64(bswap16):
-        return bswap16(x);
+        x = bswap16(x);
+        return y & TCG_BSWAP_OS ? (int16_t)x : x;
 
     CASE_OP_32_64(bswap32):
-        return bswap32(x);
+        x = bswap32(x);
+        return y & TCG_BSWAP_OS ? (int32_t)x : x;
 
     case INDEX_op_bswap64_i64:
         return bswap64(x);
@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
             }
             break;
 
+        CASE_OP_32_64(bswap16):
+            mask = arg_info(op->args[1])->mask;
+            if (mask <= 0xffff) {
+                op->args[2] |= TCG_BSWAP_IZ;
+            }
+            mask = bswap16(mask);
+            switch (op->args[2] & (TCG_BSWAP_OZ | TCG_BSWAP_OS)) {
+            case TCG_BSWAP_OZ:
+                break;
+            case TCG_BSWAP_OS:
+                mask = (int16_t)mask;
+                break;
+            default: /* undefined high bits */
+                mask |= MAKE_64BIT_MASK(16, 48);
+                break;
+            }
+            break;
+
+        case INDEX_op_bswap32_i64:
+            mask = arg_info(op->args[1])->mask;
+            if (mask <= 0xffffffffu) {
+                op->args[2] |= TCG_BSWAP_IZ;
+            }
+            mask = bswap32(mask);
+            switch (op->args[2] & (TCG_BSWAP_OZ | TCG_BSWAP_OS)) {
+            case TCG_BSWAP_OZ:
+                break;
+            case TCG_BSWAP_OS:
+                mask = (int32_t)mask;
+                break;
+            default: /* undefined high bits */
+                mask |= MAKE_64BIT_MASK(32, 32);
+                break;
+            }
+            break;
+
         default:
             break;
         }
@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
         CASE_OP_32_64(ext16s):
         CASE_OP_32_64(ext16u):
         CASE_OP_32_64(ctpop):
-        CASE_OP_32_64(bswap16):
-        CASE_OP_32_64(bswap32):
-        case INDEX_op_bswap64_i64:
         case INDEX_op_ext32s_i64:
         case INDEX_op_ext32u_i64:
         case INDEX_op_ext_i32_i64:
@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
             }
             goto do_default;
 
+        CASE_OP_32_64(bswap16):
+        CASE_OP_32_64(bswap32):
+        case INDEX_op_bswap64_i64:
+            if (arg_is_const(op->args[1])) {
+                tmp = do_constant_folding(opc, arg_info(op->args[1])->val,
+                                          op->args[2]);
+                tcg_opt_gen_movi(s, &temps_used, op, op->args[0], tmp);
+                break;
+            }
+            goto do_default;
+
         CASE_OP_32_64(add):
         CASE_OP_32_64(sub):
         CASE_OP_32_64(mul):
-- 
2.25.1

Implement the new semantics in the fallback expansion.
Change all callers to supply the flags that keep the
semantics unchanged locally.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg-op.h            |   8 +--
 target/arm/translate-a64.c      |  12 ++--
 target/arm/translate.c          |   2 +-
 target/i386/tcg/translate.c     |   2 +-
 target/mips/tcg/mxu_translate.c |   2 +-
 target/s390x/translate.c        |   4 +-
 target/sh4/translate.c          |   2 +-
 tcg/tcg-op.c                    | 121 ++++++++++++++++++++++----------
 8 files changed, 99 insertions(+), 54 deletions(-)

diff --git a/include/tcg/tcg-op.h b/include/tcg/tcg-op.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg-op.h
+++ b/include/tcg/tcg-op.h
@@ -XXX,XX +XXX,XX @@ void tcg_gen_ext8s_i32(TCGv_i32 ret, TCGv_i32 arg);
 void tcg_gen_ext16s_i32(TCGv_i32 ret, TCGv_i32 arg);
 void tcg_gen_ext8u_i32(TCGv_i32 ret, TCGv_i32 arg);
 void tcg_gen_ext16u_i32(TCGv_i32 ret, TCGv_i32 arg);
-void tcg_gen_bswap16_i32(TCGv_i32 ret, TCGv_i32 arg);
+void tcg_gen_bswap16_i32(TCGv_i32 ret, TCGv_i32 arg, int flags);
 void tcg_gen_bswap32_i32(TCGv_i32 ret, TCGv_i32 arg);
 void tcg_gen_smin_i32(TCGv_i32, TCGv_i32 arg1, TCGv_i32 arg2);
 void tcg_gen_smax_i32(TCGv_i32, TCGv_i32 arg1, TCGv_i32 arg2);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_ext32s_i64(TCGv_i64 ret, TCGv_i64 arg);
 void tcg_gen_ext8u_i64(TCGv_i64 ret, TCGv_i64 arg);
 void tcg_gen_ext16u_i64(TCGv_i64 ret, TCGv_i64 arg);
 void tcg_gen_ext32u_i64(TCGv_i64 ret, TCGv_i64 arg);
-void tcg_gen_bswap16_i64(TCGv_i64 ret, TCGv_i64 arg);
-void tcg_gen_bswap32_i64(TCGv_i64 ret, TCGv_i64 arg);
+void tcg_gen_bswap16_i64(TCGv_i64 ret, TCGv_i64 arg, int flags);
+void tcg_gen_bswap32_i64(TCGv_i64 ret, TCGv_i64 arg, int flags);
 void tcg_gen_bswap64_i64(TCGv_i64 ret, TCGv_i64 arg);
 void tcg_gen_smin_i64(TCGv_i64, TCGv_i64 arg1, TCGv_i64 arg2);
 void tcg_gen_smax_i64(TCGv_i64, TCGv_i64 arg1, TCGv_i64 arg2);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_stl_vec(TCGv_vec r, TCGv_ptr base, TCGArg offset, TCGType t);
 #define tcg_gen_ext32u_tl tcg_gen_mov_i32
 #define tcg_gen_ext32s_tl tcg_gen_mov_i32
 #define tcg_gen_bswap16_tl tcg_gen_bswap16_i32
-#define tcg_gen_bswap32_tl tcg_gen_bswap32_i32
+#define tcg_gen_bswap32_tl(D, S, F) tcg_gen_bswap32_i32(D, S)
 #define tcg_gen_bswap_tl tcg_gen_bswap32_i32
 #define tcg_gen_concat_tl_i64 tcg_gen_concat_i32_i64
 #define tcg_gen_extr_i64_tl tcg_gen_extr_i64_i32
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_rev32(DisasContext *s, unsigned int sf,
 
         /* bswap32_i64 requires zero high word */
         tcg_gen_ext32u_i64(tcg_tmp, tcg_rn);
-        tcg_gen_bswap32_i64(tcg_rd, tcg_tmp);
+        tcg_gen_bswap32_i64(tcg_rd, tcg_tmp, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
         tcg_gen_shri_i64(tcg_tmp, tcg_rn, 32);
-        tcg_gen_bswap32_i64(tcg_tmp, tcg_tmp);
+        tcg_gen_bswap32_i64(tcg_tmp, tcg_tmp, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
         tcg_gen_concat32_i64(tcg_rd, tcg_rd, tcg_tmp);
 
         tcg_temp_free_i64(tcg_tmp);
     } else {
         tcg_gen_ext32u_i64(tcg_rd, cpu_reg(s, rn));
-        tcg_gen_bswap32_i64(tcg_rd, tcg_rd);
+        tcg_gen_bswap32_i64(tcg_rd, tcg_rd, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void handle_rev(DisasContext *s, int opcode, bool u,
             read_vec_element(s, tcg_tmp, rn, i, grp_size);
             switch (grp_size) {
             case MO_16:
-                tcg_gen_bswap16_i64(tcg_tmp, tcg_tmp);
+                tcg_gen_bswap16_i64(tcg_tmp, tcg_tmp,
+                                    TCG_BSWAP_IZ | TCG_BSWAP_OZ);
                 break;
             case MO_32:
-                tcg_gen_bswap32_i64(tcg_tmp, tcg_tmp);
+                tcg_gen_bswap32_i64(tcg_tmp, tcg_tmp,
+                                    TCG_BSWAP_IZ | TCG_BSWAP_OZ);
                 break;
             case MO_64:
                 tcg_gen_bswap64_i64(tcg_tmp, tcg_tmp);
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ void gen_rev16(TCGv_i32 dest, TCGv_i32 var)
 static void gen_revsh(TCGv_i32 dest, TCGv_i32 var)
 {
     tcg_gen_ext16u_i32(var, var);
-    tcg_gen_bswap16_i32(var, var);
+    tcg_gen_bswap16_i32(var, var, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
     tcg_gen_ext16s_i32(dest, var);
 }
 
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static target_ulong disas_insn(DisasContext *s, CPUState *cpu)
         {
             gen_op_mov_v_reg(s, MO_32, s->T0, reg);
             tcg_gen_ext32u_tl(s->T0, s->T0);
-            tcg_gen_bswap32_tl(s->T0, s->T0);
+            tcg_gen_bswap32_tl(s->T0, s->T0, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
             gen_op_mov_reg_v(s, MO_32, reg, s->T0);
         }
         break;
diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_mxu_s32ldd_s32lddr(DisasContext *ctx)
 
     if (sel == 1) {
         /* S32LDDR */
-        tcg_gen_bswap32_tl(t1, t1);
+        tcg_gen_bswap32_tl(t1, t1, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
     }
     gen_store_mxu_gpr(t1, XRa);
 
diff --git a/target/s390x/translate.c b/target/s390x/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/translate.c
+++ b/target/s390x/translate.c
@@ -XXX,XX +XXX,XX @@ static DisasJumpType op_rosbg(DisasContext *s, DisasOps *o)
 
 static DisasJumpType op_rev16(DisasContext *s, DisasOps *o)
 {
-    tcg_gen_bswap16_i64(o->out, o->in2);
+    tcg_gen_bswap16_i64(o->out, o->in2, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
     return DISAS_NEXT;
 }
 
 static DisasJumpType op_rev32(DisasContext *s, DisasOps *o)
 {
-    tcg_gen_bswap32_i64(o->out, o->in2);
+    tcg_gen_bswap32_i64(o->out, o->in2, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
     return DISAS_NEXT;
 }
 
diff --git a/target/sh4/translate.c b/target/sh4/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/translate.c
+++ b/target/sh4/translate.c
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
 	{
             TCGv low = tcg_temp_new();
 	    tcg_gen_ext16u_i32(low, REG(B7_4));
-	    tcg_gen_bswap16_i32(low, low);
+	    tcg_gen_bswap16_i32(low, low, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
             tcg_gen_deposit_i32(REG(B11_8), REG(B7_4), low, 0, 16);
 	    tcg_temp_free(low);
 	}
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -XXX,XX +XXX,XX @@ void tcg_gen_ext16u_i32(TCGv_i32 ret, TCGv_i32 arg)
     }
 }
 
-/* Note: we assume the two high bytes are set to zero */
-void tcg_gen_bswap16_i32(TCGv_i32 ret, TCGv_i32 arg)
+void tcg_gen_bswap16_i32(TCGv_i32 ret, TCGv_i32 arg, int flags)
 {
+    /* Only one extension flag may be present. */
+    tcg_debug_assert(!(flags & TCG_BSWAP_OS) || !(flags & TCG_BSWAP_OZ));
+
     if (TCG_TARGET_HAS_bswap16_i32) {
-        tcg_gen_op3i_i32(INDEX_op_bswap16_i32, ret, arg,
-                         TCG_BSWAP_IZ | TCG_BSWAP_OZ);
+        tcg_gen_op3i_i32(INDEX_op_bswap16_i32, ret, arg, flags);
     } else {
         TCGv_i32 t0 = tcg_temp_new_i32();
+        TCGv_i32 t1 = tcg_temp_new_i32();
 
-        tcg_gen_ext8u_i32(t0, arg);
-        tcg_gen_shli_i32(t0, t0, 8);
-        tcg_gen_shri_i32(ret, arg, 8);
-        tcg_gen_or_i32(ret, ret, t0);
+        tcg_gen_shri_i32(t0, arg, 8);
+        if (!(flags & TCG_BSWAP_IZ)) {
+            tcg_gen_ext8u_i32(t0, t0);
+        }
+
+        if (flags & TCG_BSWAP_OS) {
+            tcg_gen_shli_i32(t1, arg, 24);
+            tcg_gen_sari_i32(t1, t1, 16);
+        } else if (flags & TCG_BSWAP_OZ) {
+            tcg_gen_ext8u_i32(t1, arg);
+            tcg_gen_shli_i32(t1, t1, 8);
+        } else {
+            tcg_gen_shli_i32(t1, arg, 8);
+        }
+
+        tcg_gen_or_i32(ret, t0, t1);
         tcg_temp_free_i32(t0);
+        tcg_temp_free_i32(t1);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ void tcg_gen_ext32u_i64(TCGv_i64 ret, TCGv_i64 arg)
     }
 }
 
-/* Note: we assume the six high bytes are set to zero */
-void tcg_gen_bswap16_i64(TCGv_i64 ret, TCGv_i64 arg)
+void tcg_gen_bswap16_i64(TCGv_i64 ret, TCGv_i64 arg, int flags)
 {
+    /* Only one extension flag may be present. */
+    tcg_debug_assert(!(flags & TCG_BSWAP_OS) || !(flags & TCG_BSWAP_OZ));
+
     if (TCG_TARGET_REG_BITS == 32) {
-        tcg_gen_bswap16_i32(TCGV_LOW(ret), TCGV_LOW(arg));
-        tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
+        tcg_gen_bswap16_i32(TCGV_LOW(ret), TCGV_LOW(arg), flags);
+        if (flags & TCG_BSWAP_OS) {
+            tcg_gen_sari_i32(TCGV_HIGH(ret), TCGV_LOW(ret), 31);
+        } else {
+            tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
+        }
     } else if (TCG_TARGET_HAS_bswap16_i64) {
-        tcg_gen_op3i_i64(INDEX_op_bswap16_i64, ret, arg,
-                         TCG_BSWAP_IZ | TCG_BSWAP_OZ);
+        tcg_gen_op3i_i64(INDEX_op_bswap16_i64, ret, arg, flags);
     } else {
         TCGv_i64 t0 = tcg_temp_new_i64();
+        TCGv_i64 t1 = tcg_temp_new_i64();
 
-        tcg_gen_ext8u_i64(t0, arg);
-        tcg_gen_shli_i64(t0, t0, 8);
-        tcg_gen_shri_i64(ret, arg, 8);
-        tcg_gen_or_i64(ret, ret, t0);
+        tcg_gen_shri_i64(t0, arg, 8);
+        if (!(flags & TCG_BSWAP_IZ)) {
+            tcg_gen_ext8u_i64(t0, t0);
+        }
+
+        if (flags & TCG_BSWAP_OS) {
+            tcg_gen_shli_i64(t1, arg, 56);
+            tcg_gen_sari_i64(t1, t1, 48);
+        } else if (flags & TCG_BSWAP_OZ) {
+            tcg_gen_ext8u_i64(t1, arg);
+            tcg_gen_shli_i64(t1, t1, 8);
+        } else {
+            tcg_gen_shli_i64(t1, arg, 8);
+        }
+
+        tcg_gen_or_i64(ret, t0, t1);
         tcg_temp_free_i64(t0);
+        tcg_temp_free_i64(t1);
     }
 }
 
-/* Note: we assume the four high bytes are set to zero */
-void tcg_gen_bswap32_i64(TCGv_i64 ret, TCGv_i64 arg)
+void tcg_gen_bswap32_i64(TCGv_i64 ret, TCGv_i64 arg, int flags)
 {
+    /* Only one extension flag may be present. */
+    tcg_debug_assert(!(flags & TCG_BSWAP_OS) || !(flags & TCG_BSWAP_OZ));
+
     if (TCG_TARGET_REG_BITS == 32) {
         tcg_gen_bswap32_i32(TCGV_LOW(ret), TCGV_LOW(arg));
-        tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
+        if (flags & TCG_BSWAP_OS) {
+            tcg_gen_sari_i32(TCGV_HIGH(ret), TCGV_LOW(ret), 31);
+        } else {
+            tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
+        }
     } else if (TCG_TARGET_HAS_bswap32_i64) {
-        tcg_gen_op3i_i64(INDEX_op_bswap32_i64, ret, arg,
-                         TCG_BSWAP_IZ | TCG_BSWAP_OZ);
+        tcg_gen_op3i_i64(INDEX_op_bswap32_i64, ret, arg, flags);
     } else {
         TCGv_i64 t0 = tcg_temp_new_i64();
         TCGv_i64 t1 = tcg_temp_new_i64();
         TCGv_i64 t2 = tcg_constant_i64(0x00ff00ff);
 
-                                        /* arg = ....abcd */
-        tcg_gen_shri_i64(t0, arg, 8);   /*  t0 = .....abc */
-        tcg_gen_and_i64(t1, arg, t2);   /*  t1 = .....b.d */
-        tcg_gen_and_i64(t0, t0, t2);    /*  t0 = .....a.c */
-        tcg_gen_shli_i64(t1, t1, 8);    /*  t1 = ....b.d. */
-        tcg_gen_or_i64(ret, t0, t1);    /* ret = ....badc */
+                                            /* arg = xxxxabcd */
+        tcg_gen_shri_i64(t0, arg, 8);       /*  t0 = .xxxxabc */
+        tcg_gen_and_i64(t1, arg, t2);       /*  t1 = .....b.d */
+        tcg_gen_and_i64(t0, t0, t2);        /*  t0 = .....a.c */
+        tcg_gen_shli_i64(t1, t1, 8);        /*  t1 = ....b.d. */
+        tcg_gen_or_i64(ret, t0, t1);        /* ret = ....badc */
 
-        tcg_gen_shli_i64(t1, ret, 48);  /*  t1 = dc...... */
-        tcg_gen_shri_i64(t0, ret, 16);  /*  t0 = ......ba */
-        tcg_gen_shri_i64(t1, t1, 32);   /*  t1 = ....dc.. */
-        tcg_gen_or_i64(ret, t0, t1);    /* ret = ....dcba */
+        tcg_gen_shli_i64(t1, ret, 48);      /*  t1 = dc...... */
+        tcg_gen_shri_i64(t0, ret, 16);      /*  t0 = ......ba */
+        if (flags & TCG_BSWAP_OS) {
+            tcg_gen_sari_i64(t1, t1, 32);   /*  t1 = ssssdc.. */
+        } else {
+            tcg_gen_shri_i64(t1, t1, 32);   /*  t1 = ....dc.. */
+        }
+        tcg_gen_or_i64(ret, t0, t1);        /* ret = ssssdcba */
 
         tcg_temp_free_i64(t0);
         tcg_temp_free_i64(t1);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_qemu_ld_i32(TCGv_i32 val, TCGv addr, TCGArg idx, MemOp memop)
     if ((orig_memop ^ memop) & MO_BSWAP) {
         switch (orig_memop & MO_SIZE) {
         case MO_16:
-            tcg_gen_bswap16_i32(val, val);
+            tcg_gen_bswap16_i32(val, val, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
             if (orig_memop & MO_SIGN) {
                 tcg_gen_ext16s_i32(val, val);
             }
@@ -XXX,XX +XXX,XX @@ void tcg_gen_qemu_st_i32(TCGv_i32 val, TCGv addr, TCGArg idx, MemOp memop)
         switch (memop & MO_SIZE) {
         case MO_16:
             tcg_gen_ext16u_i32(swap, val);
-            tcg_gen_bswap16_i32(swap, swap);
+            tcg_gen_bswap16_i32(swap, swap, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
             break;
         case MO_32:
             tcg_gen_bswap32_i32(swap, val);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_qemu_ld_i64(TCGv_i64 val, TCGv addr, TCGArg idx, MemOp memop)
     if ((orig_memop ^ memop) & MO_BSWAP) {
         switch (orig_memop & MO_SIZE) {
         case MO_16:
-            tcg_gen_bswap16_i64(val, val);
+            tcg_gen_bswap16_i64(val, val, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
             if (orig_memop & MO_SIGN) {
                 tcg_gen_ext16s_i64(val, val);
             }
             break;
         case MO_32:
-            tcg_gen_bswap32_i64(val, val);
+            tcg_gen_bswap32_i64(val, val, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
             if (orig_memop & MO_SIGN) {
                 tcg_gen_ext32s_i64(val, val);
             }
@@ -XXX,XX +XXX,XX @@ void tcg_gen_qemu_st_i64(TCGv_i64 val, TCGv addr, TCGArg idx, MemOp memop)
         switch (memop & MO_SIZE) {
         case MO_16:
             tcg_gen_ext16u_i64(swap, val);
-            tcg_gen_bswap16_i64(swap, swap);
+            tcg_gen_bswap16_i64(swap, swap, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
             break;
         case MO_32:
             tcg_gen_ext32u_i64(swap, val);
-            tcg_gen_bswap32_i64(swap, swap);
+            tcg_gen_bswap32_i64(swap, swap, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
             break;
         case MO_64:
             tcg_gen_bswap64_i64(swap, val);
-- 
2.25.1

We can perform any required sign-extension via TCG_BSWAP_OS.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op.c | 24 ++++++++++--------------
 1 file changed, 10 insertions(+), 14 deletions(-)

diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -XXX,XX +XXX,XX @@ void tcg_gen_qemu_ld_i32(TCGv_i32 val, TCGv addr, TCGArg idx, MemOp memop)
     orig_memop = memop;
     if (!TCG_TARGET_HAS_MEMORY_BSWAP && (memop & MO_BSWAP)) {
         memop &= ~MO_BSWAP;
-        /* The bswap primitive requires zero-extended input.  */
+        /* The bswap primitive benefits from zero-extended input.  */
         if ((memop & MO_SSIZE) == MO_SW) {
             memop &= ~MO_SIGN;
         }
@@ -XXX,XX +XXX,XX @@ void tcg_gen_qemu_ld_i32(TCGv_i32 val, TCGv addr, TCGArg idx, MemOp memop)
     if ((orig_memop ^ memop) & MO_BSWAP) {
         switch (orig_memop & MO_SIZE) {
         case MO_16:
-            tcg_gen_bswap16_i32(val, val, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
-            if (orig_memop & MO_SIGN) {
-                tcg_gen_ext16s_i32(val, val);
-            }
+            tcg_gen_bswap16_i32(val, val, (orig_memop & MO_SIGN
+                                           ? TCG_BSWAP_IZ | TCG_BSWAP_OS
+                                           : TCG_BSWAP_IZ | TCG_BSWAP_OZ));
             break;
         case MO_32:
             tcg_gen_bswap32_i32(val, val);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_qemu_ld_i64(TCGv_i64 val, TCGv addr, TCGArg idx, MemOp memop)
     orig_memop = memop;
     if (!TCG_TARGET_HAS_MEMORY_BSWAP && (memop & MO_BSWAP)) {
         memop &= ~MO_BSWAP;
-        /* The bswap primitive requires zero-extended input.  */
+        /* The bswap primitive benefits from zero-extended input.  */
         if ((memop & MO_SIGN) && (memop & MO_SIZE) < MO_64) {
             memop &= ~MO_SIGN;
         }
@@ -XXX,XX +XXX,XX @@ void tcg_gen_qemu_ld_i64(TCGv_i64 val, TCGv addr, TCGArg idx, MemOp memop)
     plugin_gen_mem_callbacks(addr, info);
 
     if ((orig_memop ^ memop) & MO_BSWAP) {
+        int flags = (orig_memop & MO_SIGN
+                     ? TCG_BSWAP_IZ | TCG_BSWAP_OS
+                     : TCG_BSWAP_IZ | TCG_BSWAP_OZ);
         switch (orig_memop & MO_SIZE) {
         case MO_16:
-            tcg_gen_bswap16_i64(val, val, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
-            if (orig_memop & MO_SIGN) {
-                tcg_gen_ext16s_i64(val, val);
-            }
+            tcg_gen_bswap16_i64(val, val, flags);
             break;
         case MO_32:
-            tcg_gen_bswap32_i64(val, val, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
-            if (orig_memop & MO_SIGN) {
-                tcg_gen_ext32s_i64(val, val);
-            }
+            tcg_gen_bswap32_i64(val, val, flags);
             break;
         case MO_64:
             tcg_gen_bswap64_i64(val, val);
-- 
2.25.1

By removing TCG_BSWAP_IZ we indicate that the input is
not zero-extended, and thus can remove an explicit extend.
By removing TCG_BSWAP_OZ, we allow the implementation to
leave high bits set, which will be ignored by the store.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -XXX,XX +XXX,XX @@ void tcg_gen_qemu_st_i32(TCGv_i32 val, TCGv addr, TCGArg idx, MemOp memop)
         swap = tcg_temp_new_i32();
         switch (memop & MO_SIZE) {
         case MO_16:
-            tcg_gen_ext16u_i32(swap, val);
-            tcg_gen_bswap16_i32(swap, swap, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
+            tcg_gen_bswap16_i32(swap, val, 0);
             break;
         case MO_32:
             tcg_gen_bswap32_i32(swap, val);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_qemu_st_i64(TCGv_i64 val, TCGv addr, TCGArg idx, MemOp memop)
         swap = tcg_temp_new_i64();
         switch (memop & MO_SIZE) {
         case MO_16:
-            tcg_gen_ext16u_i64(swap, val);
-            tcg_gen_bswap16_i64(swap, swap, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
+            tcg_gen_bswap16_i64(swap, val, 0);
             break;
         case MO_32:
-            tcg_gen_ext32u_i64(swap, val);
-            tcg_gen_bswap32_i64(swap, swap, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
+            tcg_gen_bswap32_i64(swap, val, 0);
             break;
         case MO_64:
             tcg_gen_bswap64_i64(swap, val);
-- 
2.25.1

For the sf version, we are performing two 32-bit bswaps
in either half of the register.  This is equivalent to
performing one 64-bit bswap followed by a rotate.

For the non-sf version, we can remove TCG_BSWAP_IZ
and the preceding zero-extension.

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_rev32(DisasContext *s, unsigned int sf,
                          unsigned int rn, unsigned int rd)
 {
     TCGv_i64 tcg_rd = cpu_reg(s, rd);
+    TCGv_i64 tcg_rn = cpu_reg(s, rn);
 
     if (sf) {
-        TCGv_i64 tcg_tmp = tcg_temp_new_i64();
-        TCGv_i64 tcg_rn = read_cpu_reg(s, rn, sf);
-
-        /* bswap32_i64 requires zero high word */
-        tcg_gen_ext32u_i64(tcg_tmp, tcg_rn);
-        tcg_gen_bswap32_i64(tcg_rd, tcg_tmp, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
-        tcg_gen_shri_i64(tcg_tmp, tcg_rn, 32);
-        tcg_gen_bswap32_i64(tcg_tmp, tcg_tmp, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
-        tcg_gen_concat32_i64(tcg_rd, tcg_rd, tcg_tmp);
-
-        tcg_temp_free_i64(tcg_tmp);
+        tcg_gen_bswap64_i64(tcg_rd, tcg_rn);
+        tcg_gen_rotri_i64(tcg_rd, tcg_rd, 32);
     } else {
-        tcg_gen_ext32u_i64(tcg_rd, cpu_reg(s, rn));
-        tcg_gen_bswap32_i64(tcg_rd, tcg_rd, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
+        tcg_gen_bswap32_i64(tcg_rd, tcg_rn, TCG_BSWAP_OZ);
     }
 }
 
-- 
2.25.1

We can eliminate the requirement for a zero-extended output,
because the following store will ignore any garbage high bits.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/translate-a64.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_rev(DisasContext *s, int opcode, bool u,
             read_vec_element(s, tcg_tmp, rn, i, grp_size);
             switch (grp_size) {
             case MO_16:
-                tcg_gen_bswap16_i64(tcg_tmp, tcg_tmp,
-                                    TCG_BSWAP_IZ | TCG_BSWAP_OZ);
+                tcg_gen_bswap16_i64(tcg_tmp, tcg_tmp, TCG_BSWAP_IZ);
                 break;
             case MO_32:
-                tcg_gen_bswap32_i64(tcg_tmp, tcg_tmp,
-                                    TCG_BSWAP_IZ | TCG_BSWAP_OZ);
+                tcg_gen_bswap32_i64(tcg_tmp, tcg_tmp, TCG_BSWAP_IZ);
                 break;
             case MO_64:
                 tcg_gen_bswap64_i64(tcg_tmp, tcg_tmp);
-- 
2.25.1

Use a break instead of an ifdefed else.
There's no need to move the values through s->T0.
Remove TCG_BSWAP_IZ and the preceding zero-extension.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/i386/tcg/translate.c | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static target_ulong disas_insn(DisasContext *s, CPUState *cpu)
         reg = (b & 7) | REX_B(s);
 #ifdef TARGET_X86_64
         if (dflag == MO_64) {
-            gen_op_mov_v_reg(s, MO_64, s->T0, reg);
-            tcg_gen_bswap64_i64(s->T0, s->T0);
-            gen_op_mov_reg_v(s, MO_64, reg, s->T0);
-        } else
-#endif
-        {
-            gen_op_mov_v_reg(s, MO_32, s->T0, reg);
-            tcg_gen_ext32u_tl(s->T0, s->T0);
-            tcg_gen_bswap32_tl(s->T0, s->T0, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
-            gen_op_mov_reg_v(s, MO_32, reg, s->T0);
+            tcg_gen_bswap64_i64(cpu_regs[reg], cpu_regs[reg]);
+            break;
         }
+#endif
+        tcg_gen_bswap32_tl(cpu_regs[reg], cpu_regs[reg], TCG_BSWAP_OZ);
         break;
     case 0xd6: /* salc */
         if (CODE64(s))
-- 
2.25.1

There were two bugs here: (1) the required endianness was
not present in the MemOp, and (2) we were not providing a
zero-extended input to the bswap as semantics required.

The best fix is to fold the bswap into the memory operation,
producing the desired result directly.

Acked-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_mxu_s32ldd_s32lddr(DisasContext *ctx)
         tcg_gen_ori_tl(t1, t1, 0xFFFFF000);
     }
     tcg_gen_add_tl(t1, t0, t1);
-    tcg_gen_qemu_ld_tl(t1, t1, ctx->mem_idx, MO_SL);
+    tcg_gen_qemu_ld_tl(t1, t1, ctx->mem_idx, MO_TESL ^ (sel * MO_BSWAP));
 
-    if (sel == 1) {
-        /* S32LDDR */
-        tcg_gen_bswap32_tl(t1, t1, TCG_BSWAP_IZ | TCG_BSWAP_OZ);
-    }
     gen_store_mxu_gpr(t1, XRa);
 
     tcg_temp_free(t0);
-- 
2.25.1

Now that the middle-end can replicate the same tricks as tcg/arm
used for optimizing bswap for signed loads and for stores, do not
pretend to have these memory ops in the backend.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/arm/tcg-target.h     |   2 +-
 tcg/arm/tcg-target.c.inc | 214 ++++++++++++++-------------------------
 2 files changed, 77 insertions(+), 139 deletions(-)

diff --git a/tcg/arm/tcg-target.h b/tcg/arm/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.h
+++ b/tcg/arm/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool use_neon_instructions;
 #define TCG_TARGET_HAS_cmpsel_vec       0
 
 #define TCG_TARGET_DEFAULT_MO (0)
-#define TCG_TARGET_HAS_MEMORY_BSWAP     1
+#define TCG_TARGET_HAS_MEMORY_BSWAP     0
 
 /* not defined -- call should be eliminated at compile time */
 void tb_target_set_jmp_target(uintptr_t, uintptr_t, uintptr_t, uintptr_t);
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_vldst(TCGContext *s, ARMInsn insn,
 /* helper signature: helper_ret_ld_mmu(CPUState *env, target_ulong addr,
  *                                     int mmu_idx, uintptr_t ra)
  */
-static void * const qemu_ld_helpers[16] = {
+static void * const qemu_ld_helpers[8] = {
     [MO_UB]   = helper_ret_ldub_mmu,
     [MO_SB]   = helper_ret_ldsb_mmu,
-
-    [MO_LEUW] = helper_le_lduw_mmu,
-    [MO_LEUL] = helper_le_ldul_mmu,
-    [MO_LEQ]  = helper_le_ldq_mmu,
-    [MO_LESW] = helper_le_ldsw_mmu,
-    [MO_LESL] = helper_le_ldul_mmu,
-
-    [MO_BEUW] = helper_be_lduw_mmu,
-    [MO_BEUL] = helper_be_ldul_mmu,
-    [MO_BEQ]  = helper_be_ldq_mmu,
-    [MO_BESW] = helper_be_ldsw_mmu,
-    [MO_BESL] = helper_be_ldul_mmu,
+#ifdef HOST_WORDS_BIGENDIAN
+    [MO_UW] = helper_be_lduw_mmu,
+    [MO_UL] = helper_be_ldul_mmu,
+    [MO_Q]  = helper_be_ldq_mmu,
+    [MO_SW] = helper_be_ldsw_mmu,
+    [MO_SL] = helper_be_ldul_mmu,
+#else
+    [MO_UW] = helper_le_lduw_mmu,
+    [MO_UL] = helper_le_ldul_mmu,
+    [MO_Q]  = helper_le_ldq_mmu,
+    [MO_SW] = helper_le_ldsw_mmu,
+    [MO_SL] = helper_le_ldul_mmu,
+#endif
 };
 
 /* helper signature: helper_ret_st_mmu(CPUState *env, target_ulong addr,
  *                                     uintxx_t val, int mmu_idx, uintptr_t ra)
  */
-static void * const qemu_st_helpers[16] = {
-    [MO_UB]   = helper_ret_stb_mmu,
-    [MO_LEUW] = helper_le_stw_mmu,
-    [MO_LEUL] = helper_le_stl_mmu,
-    [MO_LEQ]  = helper_le_stq_mmu,
-    [MO_BEUW] = helper_be_stw_mmu,
-    [MO_BEUL] = helper_be_stl_mmu,
-    [MO_BEQ]  = helper_be_stq_mmu,
+static void * const qemu_st_helpers[4] = {
+    [MO_8]   = helper_ret_stb_mmu,
+#ifdef HOST_WORDS_BIGENDIAN
+    [MO_16] = helper_be_stw_mmu,
+    [MO_32] = helper_be_stl_mmu,
+    [MO_64] = helper_be_stq_mmu,
+#else
+    [MO_16] = helper_le_stw_mmu,
+    [MO_32] = helper_le_stl_mmu,
+    [MO_64] = helper_le_stq_mmu,
+#endif
 };
 
 /* Helper routines for marshalling helper function arguments into
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
        icache usage.  For pre-armv6, use the signed helpers since we do
        not have a single insn sign-extend.  */
     if (use_armv6_instructions) {
-        func = qemu_ld_helpers[opc & (MO_BSWAP | MO_SIZE)];
+        func = qemu_ld_helpers[opc & MO_SIZE];
     } else {
-        func = qemu_ld_helpers[opc & (MO_BSWAP | MO_SSIZE)];
+        func = qemu_ld_helpers[opc & MO_SSIZE];
         if (opc & MO_SIGN) {
             opc = MO_UL;
         }
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
     argreg = tcg_out_arg_reg32(s, argreg, TCG_REG_R14);
 
     /* Tail-call to the helper, which will return to the fast path.  */
-    tcg_out_goto(s, COND_AL, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)]);
+    tcg_out_goto(s, COND_AL, qemu_st_helpers[opc & MO_SIZE]);
     return true;
 }
 #endif /* SOFTMMU */
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_qemu_ld_index(TCGContext *s, MemOp opc,
                                          TCGReg datalo, TCGReg datahi,
                                          TCGReg addrlo, TCGReg addend)
 {
-    MemOp bswap = opc & MO_BSWAP;
+    /* Byte swapping is left to middle-end expansion. */
+    tcg_debug_assert((opc & MO_BSWAP) == 0);
 
     switch (opc & MO_SSIZE) {
     case MO_UB:
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_qemu_ld_index(TCGContext *s, MemOp opc,
         break;
     case MO_UW:
         tcg_out_ld16u_r(s, COND_AL, datalo, addrlo, addend);
-        if (bswap) {
-            tcg_out_bswap16(s, COND_AL, datalo, datalo,
-                            TCG_BSWAP_IZ | TCG_BSWAP_OZ);
-        }
         break;
     case MO_SW:
-        if (bswap) {
-            tcg_out_ld16u_r(s, COND_AL, datalo, addrlo, addend);
-            tcg_out_bswap16(s, COND_AL, datalo, datalo,
-                            TCG_BSWAP_IZ | TCG_BSWAP_OS);
-        } else {
-            tcg_out_ld16s_r(s, COND_AL, datalo, addrlo, addend);
-        }
+        tcg_out_ld16s_r(s, COND_AL, datalo, addrlo, addend);
         break;
     case MO_UL:
-    default:
         tcg_out_ld32_r(s, COND_AL, datalo, addrlo, addend);
-        if (bswap) {
-            tcg_out_bswap32(s, COND_AL, datalo, datalo);
-        }
         break;
     case MO_Q:
-        {
-            TCGReg dl = (bswap ? datahi : datalo);
-            TCGReg dh = (bswap ? datalo : datahi);
-
-            /* Avoid ldrd for user-only emulation, to handle unaligned.  */
-            if (USING_SOFTMMU && use_armv6_instructions
-                && (dl & 1) == 0 && dh == dl + 1) {
-                tcg_out_ldrd_r(s, COND_AL, dl, addrlo, addend);
-            } else if (dl != addend) {
-                tcg_out_ld32_rwb(s, COND_AL, dl, addend, addrlo);
-                tcg_out_ld32_12(s, COND_AL, dh, addend, 4);
-            } else {
-                tcg_out_dat_reg(s, COND_AL, ARITH_ADD, TCG_REG_TMP,
-                                addend, addrlo, SHIFT_IMM_LSL(0));
-                tcg_out_ld32_12(s, COND_AL, dl, TCG_REG_TMP, 0);
-                tcg_out_ld32_12(s, COND_AL, dh, TCG_REG_TMP, 4);
-            }
-            if (bswap) {
-                tcg_out_bswap32(s, COND_AL, dl, dl);
-                tcg_out_bswap32(s, COND_AL, dh, dh);
-            }
+        /* Avoid ldrd for user-only emulation, to handle unaligned.  */
+        if (USING_SOFTMMU && use_armv6_instructions
+            && (datalo & 1) == 0 && datahi == datalo + 1) {
+            tcg_out_ldrd_r(s, COND_AL, datalo, addrlo, addend);
+        } else if (datalo != addend) {
+            tcg_out_ld32_rwb(s, COND_AL, datalo, addend, addrlo);
+            tcg_out_ld32_12(s, COND_AL, datahi, addend, 4);
+        } else {
+            tcg_out_dat_reg(s, COND_AL, ARITH_ADD, TCG_REG_TMP,
+                            addend, addrlo, SHIFT_IMM_LSL(0));
+            tcg_out_ld32_12(s, COND_AL, datalo, TCG_REG_TMP, 0);
+            tcg_out_ld32_12(s, COND_AL, datahi, TCG_REG_TMP, 4);
         }
         break;
+    default:
+        g_assert_not_reached();
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_qemu_ld_direct(TCGContext *s, MemOp opc,
                                           TCGReg datalo, TCGReg datahi,
                                           TCGReg addrlo)
 {
-    MemOp bswap = opc & MO_BSWAP;
+    /* Byte swapping is left to middle-end expansion. */
+    tcg_debug_assert((opc & MO_BSWAP) == 0);
 
     switch (opc & MO_SSIZE) {
     case MO_UB:
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_qemu_ld_direct(TCGContext *s, MemOp opc,
         break;
     case MO_UW:
         tcg_out_ld16u_8(s, COND_AL, datalo, addrlo, 0);
-        if (bswap) {
-            tcg_out_bswap16(s, COND_AL, datalo, datalo,
-                            TCG_BSWAP_IZ | TCG_BSWAP_OZ);
-        }
         break;
     case MO_SW:
-        if (bswap) {
-            tcg_out_ld16u_8(s, COND_AL, datalo, addrlo, 0);
-            tcg_out_bswap16(s, COND_AL, datalo, datalo,
-                            TCG_BSWAP_IZ | TCG_BSWAP_OS);
-        } else {
-            tcg_out_ld16s_8(s, COND_AL, datalo, addrlo, 0);
-        }
+        tcg_out_ld16s_8(s, COND_AL, datalo, addrlo, 0);
         break;
     case MO_UL:
-    default:
         tcg_out_ld32_12(s, COND_AL, datalo, addrlo, 0);
-        if (bswap) {
-            tcg_out_bswap32(s, COND_AL, datalo, datalo);
-        }
         break;
     case MO_Q:
-        {
-            TCGReg dl = (bswap ? datahi : datalo);
-            TCGReg dh = (bswap ? datalo : datahi);
-
-            /* Avoid ldrd for user-only emulation, to handle unaligned.  */
-            if (USING_SOFTMMU && use_armv6_instructions
-                && (dl & 1) == 0 && dh == dl + 1) {
-                tcg_out_ldrd_8(s, COND_AL, dl, addrlo, 0);
-            } else if (dl == addrlo) {
-                tcg_out_ld32_12(s, COND_AL, dh, addrlo, bswap ? 0 : 4);
-                tcg_out_ld32_12(s, COND_AL, dl, addrlo, bswap ? 4 : 0);
-            } else {
-                tcg_out_ld32_12(s, COND_AL, dl, addrlo, bswap ? 4 : 0);
-                tcg_out_ld32_12(s, COND_AL, dh, addrlo, bswap ? 0 : 4);
-            }
-            if (bswap) {
-                tcg_out_bswap32(s, COND_AL, dl, dl);
-                tcg_out_bswap32(s, COND_AL, dh, dh);
-            }
+        /* Avoid ldrd for user-only emulation, to handle unaligned.  */
+        if (USING_SOFTMMU && use_armv6_instructions
+            && (datalo & 1) == 0 && datahi == datalo + 1) {
+            tcg_out_ldrd_8(s, COND_AL, datalo, addrlo, 0);
+        } else if (datalo == addrlo) {
+            tcg_out_ld32_12(s, COND_AL, datahi, addrlo, 4);
+            tcg_out_ld32_12(s, COND_AL, datalo, addrlo, 0);
+        } else {
+            tcg_out_ld32_12(s, COND_AL, datalo, addrlo, 0);
+            tcg_out_ld32_12(s, COND_AL, datahi, addrlo, 4);
         }
         break;
+    default:
+        g_assert_not_reached();
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_qemu_st_index(TCGContext *s, int cond, MemOp opc,
                                          TCGReg datalo, TCGReg datahi,
                                          TCGReg addrlo, TCGReg addend)
 {
-    MemOp bswap = opc & MO_BSWAP;
+    /* Byte swapping is left to middle-end expansion. */
+    tcg_debug_assert((opc & MO_BSWAP) == 0);
 
     switch (opc & MO_SIZE) {
     case MO_8:
         tcg_out_st8_r(s, cond, datalo, addrlo, addend);
         break;
     case MO_16:
-        if (bswap) {
-            tcg_out_bswap16(s, cond, TCG_REG_R0, datalo, 0);
-            tcg_out_st16_r(s, cond, TCG_REG_R0, addrlo, addend);
-        } else {
-            tcg_out_st16_r(s, cond, datalo, addrlo, addend);
-        }
+        tcg_out_st16_r(s, cond, datalo, addrlo, addend);
         break;
     case MO_32:
-    default:
-        if (bswap) {
-            tcg_out_bswap32(s, cond, TCG_REG_R0, datalo);
-            tcg_out_st32_r(s, cond, TCG_REG_R0, addrlo, addend);
-        } else {
-            tcg_out_st32_r(s, cond, datalo, addrlo, addend);
-        }
+        tcg_out_st32_r(s, cond, datalo, addrlo, addend);
         break;
     case MO_64:
         /* Avoid strd for user-only emulation, to handle unaligned.  */
-        if (bswap) {
-            tcg_out_bswap32(s, cond, TCG_REG_R0, datahi);
-            tcg_out_st32_rwb(s, cond, TCG_REG_R0, addend, addrlo);
-            tcg_out_bswap32(s, cond, TCG_REG_R0, datalo);
-            tcg_out_st32_12(s, cond, TCG_REG_R0, addend, 4);
-        } else if (USING_SOFTMMU && use_armv6_instructions
-                   && (datalo & 1) == 0 && datahi == datalo + 1) {
+        if (USING_SOFTMMU && use_armv6_instructions
+            && (datalo & 1) == 0 && datahi == datalo + 1) {
             tcg_out_strd_r(s, cond, datalo, addrlo, addend);
         } else {
             tcg_out_st32_rwb(s, cond, datalo, addend, addrlo);
             tcg_out_st32_12(s, cond, datahi, addend, 4);
         }
         break;
+    default:
+        g_assert_not_reached();
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_qemu_st_direct(TCGContext *s, MemOp opc,
                                           TCGReg datalo, TCGReg datahi,
                                           TCGReg addrlo)
 {
-    MemOp bswap = opc & MO_BSWAP;
+    /* Byte swapping is left to middle-end expansion. */
+    tcg_debug_assert((opc & MO_BSWAP) == 0);
 
     switch (opc & MO_SIZE) {
     case MO_8:
         tcg_out_st8_12(s, COND_AL, datalo, addrlo, 0);
         break;
     case MO_16:
-        if (bswap) {
-            tcg_out_bswap16(s, COND_AL, TCG_REG_R0, datalo, 0);
-            tcg_out_st16_8(s, COND_AL, TCG_REG_R0, addrlo, 0);
-        } else {
-            tcg_out_st16_8(s, COND_AL, datalo, addrlo, 0);
-        }
+        tcg_out_st16_8(s, COND_AL, datalo, addrlo, 0);
         break;
     case MO_32:
-    default:
-        if (bswap) {
-            tcg_out_bswap32(s, COND_AL, TCG_REG_R0, datalo);
-            tcg_out_st32_12(s, COND_AL, TCG_REG_R0, addrlo, 0);
-        } else {
-            tcg_out_st32_12(s, COND_AL, datalo, addrlo, 0);
-        }
+        tcg_out_st32_12(s, COND_AL, datalo, addrlo, 0);
         break;
     case MO_64:
         /* Avoid strd for user-only emulation, to handle unaligned.  */
-        if (bswap) {
-            tcg_out_bswap32(s, COND_AL, TCG_REG_R0, datahi);
-            tcg_out_st32_12(s, COND_AL, TCG_REG_R0, addrlo, 0);
-            tcg_out_bswap32(s, COND_AL, TCG_REG_R0, datalo);
-            tcg_out_st32_12(s, COND_AL, TCG_REG_R0, addrlo, 4);
-        } else if (USING_SOFTMMU && use_armv6_instructions
-                   && (datalo & 1) == 0 && datahi == datalo + 1) {
+        if (USING_SOFTMMU && use_armv6_instructions
+            && (datalo & 1) == 0 && datahi == datalo + 1) {
             tcg_out_strd_8(s, COND_AL, datalo, addrlo, 0);
         } else {
             tcg_out_st32_12(s, COND_AL, datalo, addrlo, 0);
             tcg_out_st32_12(s, COND_AL, datahi, addrlo, 4);
         }
         break;
+    default:
+        g_assert_not_reached();
     }
 }
 
-- 
2.25.1

The memory bswap support in the aarch64 backend merely dates from
a time when it was required.  There is nothing special about the
backend support that could not have been provided by the middle-end
even prior to the introduction of the bswap flags.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.h     |  2 +-
 tcg/aarch64/tcg-target.c.inc | 87 +++++++++++++-----------------------
 2 files changed, 32 insertions(+), 57 deletions(-)

diff --git a/tcg/aarch64/tcg-target.h b/tcg/aarch64/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.h
+++ b/tcg/aarch64/tcg-target.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
 #define TCG_TARGET_HAS_cmpsel_vec       0
 
 #define TCG_TARGET_DEFAULT_MO (0)
-#define TCG_TARGET_HAS_MEMORY_BSWAP     1
+#define TCG_TARGET_HAS_MEMORY_BSWAP     0
 
 void tb_target_set_jmp_target(uintptr_t, uintptr_t, uintptr_t, uintptr_t);
 
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_cltz(TCGContext *s, TCGType ext, TCGReg d,
 /* helper signature: helper_ret_ld_mmu(CPUState *env, target_ulong addr,
  *                                     TCGMemOpIdx oi, uintptr_t ra)
  */
-static void * const qemu_ld_helpers[16] = {
-    [MO_UB]   = helper_ret_ldub_mmu,
-    [MO_LEUW] = helper_le_lduw_mmu,
-    [MO_LEUL] = helper_le_ldul_mmu,
-    [MO_LEQ]  = helper_le_ldq_mmu,
-    [MO_BEUW] = helper_be_lduw_mmu,
-    [MO_BEUL] = helper_be_ldul_mmu,
-    [MO_BEQ]  = helper_be_ldq_mmu,
+static void * const qemu_ld_helpers[4] = {
+    [MO_8]  = helper_ret_ldub_mmu,
+#ifdef HOST_WORDS_BIGENDIAN
+    [MO_16] = helper_be_lduw_mmu,
+    [MO_32] = helper_be_ldul_mmu,
+    [MO_64] = helper_be_ldq_mmu,
+#else
+    [MO_16] = helper_le_lduw_mmu,
+    [MO_32] = helper_le_ldul_mmu,
+    [MO_64] = helper_le_ldq_mmu,
+#endif
 };
 
 /* helper signature: helper_ret_st_mmu(CPUState *env, target_ulong addr,
  *                                     uintxx_t val, TCGMemOpIdx oi,
  *                                     uintptr_t ra)
  */
-static void * const qemu_st_helpers[16] = {
-    [MO_UB]   = helper_ret_stb_mmu,
-    [MO_LEUW] = helper_le_stw_mmu,
-    [MO_LEUL] = helper_le_stl_mmu,
-    [MO_LEQ]  = helper_le_stq_mmu,
-    [MO_BEUW] = helper_be_stw_mmu,
-    [MO_BEUL] = helper_be_stl_mmu,
-    [MO_BEQ]  = helper_be_stq_mmu,
+static void * const qemu_st_helpers[4] = {
+    [MO_8]  = helper_ret_stb_mmu,
+#ifdef HOST_WORDS_BIGENDIAN
+    [MO_16] = helper_be_stw_mmu,
+    [MO_32] = helper_be_stl_mmu,
+    [MO_64] = helper_be_stq_mmu,
+#else
+    [MO_16] = helper_le_stw_mmu,
+    [MO_32] = helper_le_stl_mmu,
+    [MO_64] = helper_le_stq_mmu,
+#endif
 };
 
 static inline void tcg_out_adr(TCGContext *s, TCGReg rd, const void *target)
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
     tcg_out_mov(s, TARGET_LONG_BITS == 64, TCG_REG_X1, lb->addrlo_reg);
     tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_X2, oi);
     tcg_out_adr(s, TCG_REG_X3, lb->raddr);
-    tcg_out_call(s, qemu_ld_helpers[opc & (MO_BSWAP | MO_SIZE)]);
+    tcg_out_call(s, qemu_ld_helpers[opc & MO_SIZE]);
     if (opc & MO_SIGN) {
         tcg_out_sxt(s, lb->type, size, lb->datalo_reg, TCG_REG_X0);
     } else {
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
     tcg_out_mov(s, size == MO_64, TCG_REG_X2, lb->datalo_reg);
     tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_X3, oi);
     tcg_out_adr(s, TCG_REG_X4, lb->raddr);
-    tcg_out_call(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)]);
+    tcg_out_call(s, qemu_st_helpers[opc & MO_SIZE]);
     tcg_out_goto(s, lb->raddr);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp memop, TCGType ext,
                                    TCGReg data_r, TCGReg addr_r,
                                    TCGType otype, TCGReg off_r)
 {
-    const MemOp bswap = memop & MO_BSWAP;
+    /* Byte swapping is left to middle-end expansion. */
+    tcg_debug_assert((memop & MO_BSWAP) == 0);
 
     switch (memop & MO_SSIZE) {
     case MO_UB:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp memop, TCGType ext,
         break;
     case MO_UW:
         tcg_out_ldst_r(s, I3312_LDRH, data_r, addr_r, otype, off_r);
-        if (bswap) {
-            tcg_out_rev(s, TCG_TYPE_I32, MO_16, data_r, data_r);
-        }
         break;
     case MO_SW:
-        if (bswap) {
-            tcg_out_ldst_r(s, I3312_LDRH, data_r, addr_r, otype, off_r);
-            tcg_out_rev(s, TCG_TYPE_I32, MO_16, data_r, data_r);
-            tcg_out_sxt(s, ext, MO_16, data_r, data_r);
-        } else {
-            tcg_out_ldst_r(s, (ext ? I3312_LDRSHX : I3312_LDRSHW),
-                           data_r, addr_r, otype, off_r);
-        }
+        tcg_out_ldst_r(s, (ext ? I3312_LDRSHX : I3312_LDRSHW),
+                       data_r, addr_r, otype, off_r);
         break;
     case MO_UL:
         tcg_out_ldst_r(s, I3312_LDRW, data_r, addr_r, otype, off_r);
-        if (bswap) {
-            tcg_out_rev(s, TCG_TYPE_I32, MO_32, data_r, data_r);
-        }
         break;
     case MO_SL:
-        if (bswap) {
-            tcg_out_ldst_r(s, I3312_LDRW, data_r, addr_r, otype, off_r);
-            tcg_out_rev(s, TCG_TYPE_I32, MO_32, data_r, data_r);
-            tcg_out_sxt(s, TCG_TYPE_I64, MO_32, data_r, data_r);
-        } else {
-            tcg_out_ldst_r(s, I3312_LDRSWX, data_r, addr_r, otype, off_r);
-        }
+        tcg_out_ldst_r(s, I3312_LDRSWX, data_r, addr_r, otype, off_r);
         break;
     case MO_Q:
         tcg_out_ldst_r(s, I3312_LDRX, data_r, addr_r, otype, off_r);
-        if (bswap) {
-            tcg_out_rev(s, TCG_TYPE_I64, MO_64, data_r, data_r);
-        }
         break;
     default:
         tcg_abort();
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, MemOp memop,
                                    TCGReg data_r, TCGReg addr_r,
                                    TCGType otype, TCGReg off_r)
 {
-    const MemOp bswap = memop & MO_BSWAP;
+    /* Byte swapping is left to middle-end expansion. */
+    tcg_debug_assert((memop & MO_BSWAP) == 0);
 
     switch (memop & MO_SIZE) {
     case MO_8:
         tcg_out_ldst_r(s, I3312_STRB, data_r, addr_r, otype, off_r);
         break;
     case MO_16:
-        if (bswap && data_r != TCG_REG_XZR) {
-            tcg_out_rev(s, TCG_TYPE_I32, MO_16, TCG_REG_TMP, data_r);
-            data_r = TCG_REG_TMP;
-        }
         tcg_out_ldst_r(s, I3312_STRH, data_r, addr_r, otype, off_r);
         break;
     case MO_32:
-        if (bswap && data_r != TCG_REG_XZR) {
-            tcg_out_rev(s, TCG_TYPE_I32, MO_32, TCG_REG_TMP, data_r);
-            data_r = TCG_REG_TMP;
-        }
         tcg_out_ldst_r(s, I3312_STRW, data_r, addr_r, otype, off_r);
         break;
     case MO_64:
-        if (bswap && data_r != TCG_REG_XZR) {
-            tcg_out_rev(s, TCG_TYPE_I64, MO_64, TCG_REG_TMP, data_r);
-            data_r = TCG_REG_TMP;
-        }
         tcg_out_ldst_r(s, I3312_STRX, data_r, addr_r, otype, off_r);
         break;
     default:
-- 
2.25.1

TCG_TARGET_HAS_MEMORY_BSWAP is already unset for this backend,
which means that MO_BSWAP be handled by the middle-end and
will never be seen by the backend.  Thus the indexes used with
qemu_{ld,st}_helpers will always be zero.

Tidy the comments and asserts in tcg_out_qemu_{ld,st}_direct.
It is not that we do not handle bswap "yet", but never will.

Acked-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/riscv/tcg-target.c.inc | 64 ++++++++++++++++++++------------------
 1 file changed, 33 insertions(+), 31 deletions(-)

diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_mb(TCGContext *s, TCGArg a0)
 /* helper signature: helper_ret_ld_mmu(CPUState *env, target_ulong addr,
  *                                     TCGMemOpIdx oi, uintptr_t ra)
  */
-static void * const qemu_ld_helpers[16] = {
-    [MO_UB]   = helper_ret_ldub_mmu,
-    [MO_SB]   = helper_ret_ldsb_mmu,
-    [MO_LEUW] = helper_le_lduw_mmu,
-    [MO_LESW] = helper_le_ldsw_mmu,
-    [MO_LEUL] = helper_le_ldul_mmu,
+static void * const qemu_ld_helpers[8] = {
+    [MO_UB] = helper_ret_ldub_mmu,
+    [MO_SB] = helper_ret_ldsb_mmu,
+#ifdef HOST_WORDS_BIGENDIAN
+    [MO_UW] = helper_be_lduw_mmu,
+    [MO_SW] = helper_be_ldsw_mmu,
+    [MO_UL] = helper_be_ldul_mmu,
 #if TCG_TARGET_REG_BITS == 64
-    [MO_LESL] = helper_le_ldsl_mmu,
+    [MO_SL] = helper_be_ldsl_mmu,
 #endif
-    [MO_LEQ]  = helper_le_ldq_mmu,
-    [MO_BEUW] = helper_be_lduw_mmu,
-    [MO_BESW] = helper_be_ldsw_mmu,
-    [MO_BEUL] = helper_be_ldul_mmu,
+    [MO_Q]  = helper_be_ldq_mmu,
+#else
+    [MO_UW] = helper_le_lduw_mmu,
+    [MO_SW] = helper_le_ldsw_mmu,
+    [MO_UL] = helper_le_ldul_mmu,
 #if TCG_TARGET_REG_BITS == 64
-    [MO_BESL] = helper_be_ldsl_mmu,
+    [MO_SL] = helper_le_ldsl_mmu,
+#endif
+    [MO_Q]  = helper_le_ldq_mmu,
 #endif
-    [MO_BEQ]  = helper_be_ldq_mmu,
 };
 
 /* helper signature: helper_ret_st_mmu(CPUState *env, target_ulong addr,
  *                                     uintxx_t val, TCGMemOpIdx oi,
  *                                     uintptr_t ra)
  */
-static void * const qemu_st_helpers[16] = {
-    [MO_UB]   = helper_ret_stb_mmu,
-    [MO_LEUW] = helper_le_stw_mmu,
-    [MO_LEUL] = helper_le_stl_mmu,
-    [MO_LEQ]  = helper_le_stq_mmu,
-    [MO_BEUW] = helper_be_stw_mmu,
-    [MO_BEUL] = helper_be_stl_mmu,
-    [MO_BEQ]  = helper_be_stq_mmu,
+static void * const qemu_st_helpers[4] = {
+    [MO_8]   = helper_ret_stb_mmu,
+#ifdef HOST_WORDS_BIGENDIAN
+    [MO_16] = helper_be_stw_mmu,
+    [MO_32] = helper_be_stl_mmu,
+    [MO_64] = helper_be_stq_mmu,
+#else
+    [MO_16] = helper_le_stw_mmu,
+    [MO_32] = helper_le_stl_mmu,
+    [MO_64] = helper_le_stq_mmu,
+#endif
 };
 
 /* We don't support oversize guests */
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
     tcg_out_movi(s, TCG_TYPE_PTR, a2, oi);
     tcg_out_movi(s, TCG_TYPE_PTR, a3, (tcg_target_long)l->raddr);
 
-    tcg_out_call(s, qemu_ld_helpers[opc & (MO_BSWAP | MO_SSIZE)]);
+    tcg_out_call(s, qemu_ld_helpers[opc & MO_SSIZE]);
     tcg_out_mov(s, (opc & MO_SIZE) == MO_64, l->datalo_reg, a0);
 
     tcg_out_goto(s, l->raddr);
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
     tcg_out_movi(s, TCG_TYPE_PTR, a3, oi);
     tcg_out_movi(s, TCG_TYPE_PTR, a4, (tcg_target_long)l->raddr);
 
-    tcg_out_call(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SSIZE)]);
+    tcg_out_call(s, qemu_st_helpers[opc & MO_SIZE]);
 
     tcg_out_goto(s, l->raddr);
     return true;
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg lo, TCGReg hi,
                                    TCGReg base, MemOp opc, bool is_64)
 {
-    const MemOp bswap = opc & MO_BSWAP;
-
-    /* We don't yet handle byteswapping, assert */
-    g_assert(!bswap);
+    /* Byte swapping is left to middle-end expansion. */
+    tcg_debug_assert((opc & MO_BSWAP) == 0);
 
     switch (opc & (MO_SSIZE)) {
     case MO_UB:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
 static void tcg_out_qemu_st_direct(TCGContext *s, TCGReg lo, TCGReg hi,
                                    TCGReg base, MemOp opc)
 {
-    const MemOp bswap = opc & MO_BSWAP;
-
-    /* We don't yet handle byteswapping, assert */
-    g_assert(!bswap);
+    /* Byte swapping is left to middle-end expansion. */
+    tcg_debug_assert((opc & MO_BSWAP) == 0);
 
     switch (opc & (MO_SSIZE)) {
     case MO_8:
-- 
2.25.1

TCG patch queue, plus one target/sh4 patch that
Yoshinori Sato asked me to process.

The following changes since commit efbf38d73e5dcc4d5f8b98c6e7a12be1f3b91745:

Merge tag 'for-upstream' of git://repo.or.cz/qemu/kevin into staging (2022-10-03 15:06:07 -0400)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20221004

for you to fetch changes up to ab419fd8a035a65942de4e63effcd55ccbf1a9fe:

target/sh4: Fix TB_FLAG_UNALIGN (2022-10-04 12:33:05 -0700)

----------------------------------------------------------------
Cache CPUClass for use in hot code paths.
Add CPUTLBEntryFull, probe_access_full, tlb_set_page_full.
Add generic support for TARGET_TB_PCREL.
tcg/ppc: Optimize 26-bit jumps using STQ for POWER 2.07
target/sh4: Fix TB_FLAG_UNALIGN

----------------------------------------------------------------
Alex Bennée (3):
      cpu: cache CPUClass in CPUState for hot code paths
      hw/core/cpu-sysemu: used cached class in cpu_asidx_from_attrs
      cputlb: used cached CPUClass in our hot-paths

Leandro Lupori (1):
      tcg/ppc: Optimize 26-bit jumps

Richard Henderson (16):
      accel/tcg: Rename CPUIOTLBEntry to CPUTLBEntryFull
      accel/tcg: Drop addr member from SavedIOTLB
      accel/tcg: Suppress auto-invalidate in probe_access_internal
      accel/tcg: Introduce probe_access_full
      accel/tcg: Introduce tlb_set_page_full
      include/exec: Introduce TARGET_PAGE_ENTRY_EXTRA
      accel/tcg: Remove PageDesc code_bitmap
      accel/tcg: Use bool for page_find_alloc
      accel/tcg: Use DisasContextBase in plugin_gen_tb_start
      accel/tcg: Do not align tb->page_addr[0]
      accel/tcg: Inline tb_flush_jmp_cache
      include/hw/core: Create struct CPUJumpCache
      hw/core: Add CPUClass.get_pc
      accel/tcg: Introduce tb_pc and log_pc
      accel/tcg: Introduce TARGET_TB_PCREL
      target/sh4: Fix TB_FLAG_UNALIGN

From: Alex Bennée <alex.bennee@linaro.org>

The class cast checkers are quite expensive and always on (unlike the
dynamic case who's checks are gated by CONFIG_QOM_CAST_DEBUG). To
avoid the overhead of repeatedly checking something which should never
change we cache the CPUClass reference for use in the hot code paths.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220811151413.3350684-3-alex.bennee@linaro.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220923084803.498337-3-clg@kaod.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h | 9 +++++++++
 cpu.c                 | 9 ++++-----
 2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef int (*WriteCoreDumpFunction)(const void *buf, size_t size,
  */
 #define CPU(obj) ((CPUState *)(obj))
 
+/*
+ * The class checkers bring in CPU_GET_CLASS() which is potentially
+ * expensive given the eventual call to
+ * object_class_dynamic_cast_assert(). Because of this the CPUState
+ * has a cached value for the class in cs->cc which is set up in
+ * cpu_exec_realizefn() for use in hot code paths.
+ */
 typedef struct CPUClass CPUClass;
 DECLARE_CLASS_CHECKERS(CPUClass, CPU,
                        TYPE_CPU)
@@ -XXX,XX +XXX,XX @@ struct qemu_work_item;
 struct CPUState {
     /*< private >*/
     DeviceState parent_obj;
+    /* cache to avoid expensive CPU_GET_CLASS */
+    CPUClass *cc;
     /*< public >*/
 
     int nr_cores;
diff --git a/cpu.c b/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/cpu.c
+++ b/cpu.c
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_cpu_common = {
 
 void cpu_exec_realizefn(CPUState *cpu, Error **errp)
 {
-#ifndef CONFIG_USER_ONLY
-    CPUClass *cc = CPU_GET_CLASS(cpu);
-#endif
+    /* cache the cpu class for the hotpath */
+    cpu->cc = CPU_GET_CLASS(cpu);
 
     cpu_list_add(cpu);
     if (!accel_cpu_realizefn(cpu, errp)) {
@@ -XXX,XX +XXX,XX @@ void cpu_exec_realizefn(CPUState *cpu, Error **errp)
     if (qdev_get_vmsd(DEVICE(cpu)) == NULL) {
         vmstate_register(NULL, cpu->cpu_index, &vmstate_cpu_common, cpu);
     }
-    if (cc->sysemu_ops->legacy_vmsd != NULL) {
-        vmstate_register(NULL, cpu->cpu_index, cc->sysemu_ops->legacy_vmsd, cpu);
+    if (cpu->cc->sysemu_ops->legacy_vmsd != NULL) {
+        vmstate_register(NULL, cpu->cpu_index, cpu->cc->sysemu_ops->legacy_vmsd, cpu);
     }
 #endif /* CONFIG_USER_ONLY */
 }
-- 
2.34.1

From: Alex Bennée <alex.bennee@linaro.org>

This is a heavily used function so lets avoid the cost of
CPU_GET_CLASS. On the romulus-bmc run it has a modest effect:

Before: 36.812 s ±  0.506 s
  After:  35.912 s ±  0.168 s

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220811151413.3350684-4-alex.bennee@linaro.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220923084803.498337-4-clg@kaod.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 hw/core/cpu-sysemu.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/hw/core/cpu-sysemu.c b/hw/core/cpu-sysemu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/cpu-sysemu.c
+++ b/hw/core/cpu-sysemu.c
@@ -XXX,XX +XXX,XX @@ hwaddr cpu_get_phys_page_debug(CPUState *cpu, vaddr addr)
 
 int cpu_asidx_from_attrs(CPUState *cpu, MemTxAttrs attrs)
 {
-    CPUClass *cc = CPU_GET_CLASS(cpu);
     int ret = 0;
 
-    if (cc->sysemu_ops->asidx_from_attrs) {
-        ret = cc->sysemu_ops->asidx_from_attrs(cpu, attrs);
+    if (cpu->cc->sysemu_ops->asidx_from_attrs) {
+        ret = cpu->cc->sysemu_ops->asidx_from_attrs(cpu, attrs);
         assert(ret < cpu->num_ases && ret >= 0);
     }
     return ret;
-- 
2.34.1

From: Alex Bennée <alex.bennee@linaro.org>

Before: 35.912 s ±  0.168 s
  After: 35.565 s ±  0.087 s

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220811151413.3350684-5-alex.bennee@linaro.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220923084803.498337-5-clg@kaod.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ void tlb_set_page(CPUState *cpu, target_ulong vaddr,
 static void tlb_fill(CPUState *cpu, target_ulong addr, int size,
                      MMUAccessType access_type, int mmu_idx, uintptr_t retaddr)
 {
-    CPUClass *cc = CPU_GET_CLASS(cpu);
     bool ok;
 
     /*
      * This is not a probe, so only valid return is success; failure
      * should result in exception + longjmp to the cpu loop.
      */
-    ok = cc->tcg_ops->tlb_fill(cpu, addr, size,
-                               access_type, mmu_idx, false, retaddr);
+    ok = cpu->cc->tcg_ops->tlb_fill(cpu, addr, size,
+                                    access_type, mmu_idx, false, retaddr);
     assert(ok);
 }
 
@@ -XXX,XX +XXX,XX @@ static inline void cpu_unaligned_access(CPUState *cpu, vaddr addr,
                                         MMUAccessType access_type,
                                         int mmu_idx, uintptr_t retaddr)
 {
-    CPUClass *cc = CPU_GET_CLASS(cpu);
-
-    cc->tcg_ops->do_unaligned_access(cpu, addr, access_type, mmu_idx, retaddr);
+    cpu->cc->tcg_ops->do_unaligned_access(cpu, addr, access_type,
+                                          mmu_idx, retaddr);
 }
 
 static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
     if (!tlb_hit_page(tlb_addr, page_addr)) {
         if (!victim_tlb_hit(env, mmu_idx, index, elt_ofs, page_addr)) {
             CPUState *cs = env_cpu(env);
-            CPUClass *cc = CPU_GET_CLASS(cs);
 
-            if (!cc->tcg_ops->tlb_fill(cs, addr, fault_size, access_type,
-                                       mmu_idx, nonfault, retaddr)) {
+            if (!cs->cc->tcg_ops->tlb_fill(cs, addr, fault_size, access_type,
+                                           mmu_idx, nonfault, retaddr)) {
                 /* Non-faulting page table read failed.  */
                 *phost = NULL;
                 return TLB_INVALID_MASK;
-- 
2.34.1

This structure will shortly contain more than just
data for accessing MMIO.  Rename the 'addr' member
to 'xlat_section' to more clearly indicate its purpose.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-defs.h    |  22 ++++----
 accel/tcg/cputlb.c         | 102 +++++++++++++++++++------------------
 target/arm/mte_helper.c    |  14 ++---
 target/arm/sve_helper.c    |   4 +-
 target/arm/translate-a64.c |   2 +-
 5 files changed, 73 insertions(+), 71 deletions(-)

diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -XXX,XX +XXX,XX @@ typedef uint64_t target_ulong;
 #  endif
 # endif
 
+/* Minimalized TLB entry for use by TCG fast path. */
 typedef struct CPUTLBEntry {
     /* bit TARGET_LONG_BITS to TARGET_PAGE_BITS : virtual address
        bit TARGET_PAGE_BITS-1..4  : Nonzero for accesses that should not
@@ -XXX,XX +XXX,XX @@ typedef struct CPUTLBEntry {
 
 QEMU_BUILD_BUG_ON(sizeof(CPUTLBEntry) != (1 << CPU_TLB_ENTRY_BITS));
 
-/* The IOTLB is not accessed directly inline by generated TCG code,
- * so the CPUIOTLBEntry layout is not as critical as that of the
- * CPUTLBEntry. (This is also why we don't want to combine the two
- * structs into one.)
+/*
+ * The full TLB entry, which is not accessed by generated TCG code,
+ * so the layout is not as critical as that of CPUTLBEntry. This is
+ * also why we don't want to combine the two structs.
  */
-typedef struct CPUIOTLBEntry {
+typedef struct CPUTLBEntryFull {
     /*
-     * @addr contains:
+     * @xlat_section contains:
      *  - in the lower TARGET_PAGE_BITS, a physical section number
      *  - with the lower TARGET_PAGE_BITS masked off, an offset which
      *    must be added to the virtual address to obtain:
@@ -XXX,XX +XXX,XX @@ typedef struct CPUIOTLBEntry {
      *       number is PHYS_SECTION_NOTDIRTY or PHYS_SECTION_ROM)
      *     + the offset within the target MemoryRegion (otherwise)
      */
-    hwaddr addr;
+    hwaddr xlat_section;
     MemTxAttrs attrs;
-} CPUIOTLBEntry;
+} CPUTLBEntryFull;
 
 /*
  * Data elements that are per MMU mode, minus the bits accessed by
@@ -XXX,XX +XXX,XX @@ typedef struct CPUTLBDesc {
     size_t vindex;
     /* The tlb victim table, in two parts.  */
     CPUTLBEntry vtable[CPU_VTLB_SIZE];
-    CPUIOTLBEntry viotlb[CPU_VTLB_SIZE];
-    /* The iotlb.  */
-    CPUIOTLBEntry *iotlb;
+    CPUTLBEntryFull vfulltlb[CPU_VTLB_SIZE];
+    CPUTLBEntryFull *fulltlb;
 } CPUTLBDesc;
 
 /*
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast,
     }
 
     g_free(fast->table);
-    g_free(desc->iotlb);
+    g_free(desc->fulltlb);
 
     tlb_window_reset(desc, now, 0);
     /* desc->n_used_entries is cleared by the caller */
     fast->mask = (new_size - 1) << CPU_TLB_ENTRY_BITS;
     fast->table = g_try_new(CPUTLBEntry, new_size);
-    desc->iotlb = g_try_new(CPUIOTLBEntry, new_size);
+    desc->fulltlb = g_try_new(CPUTLBEntryFull, new_size);
 
     /*
      * If the allocations fail, try smaller sizes. We just freed some
@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast,
      * allocations to fail though, so we progressively reduce the allocation
      * size, aborting if we cannot even allocate the smallest TLB we support.
      */
-    while (fast->table == NULL || desc->iotlb == NULL) {
+    while (fast->table == NULL || desc->fulltlb == NULL) {
         if (new_size == (1 << CPU_TLB_DYN_MIN_BITS)) {
             error_report("%s: %s", __func__, strerror(errno));
             abort();
@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast,
         fast->mask = (new_size - 1) << CPU_TLB_ENTRY_BITS;
 
         g_free(fast->table);
-        g_free(desc->iotlb);
+        g_free(desc->fulltlb);
         fast->table = g_try_new(CPUTLBEntry, new_size);
-        desc->iotlb = g_try_new(CPUIOTLBEntry, new_size);
+        desc->fulltlb = g_try_new(CPUTLBEntryFull, new_size);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_init(CPUTLBDesc *desc, CPUTLBDescFast *fast, int64_t now)
     desc->n_used_entries = 0;
     fast->mask = (n_entries - 1) << CPU_TLB_ENTRY_BITS;
     fast->table = g_new(CPUTLBEntry, n_entries);
-    desc->iotlb = g_new(CPUIOTLBEntry, n_entries);
+    desc->fulltlb = g_new(CPUTLBEntryFull, n_entries);
     tlb_mmu_flush_locked(desc, fast);
 }
 
@@ -XXX,XX +XXX,XX @@ void tlb_destroy(CPUState *cpu)
         CPUTLBDescFast *fast = &env_tlb(env)->f[i];
 
         g_free(fast->table);
-        g_free(desc->iotlb);
+        g_free(desc->fulltlb);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
 
         /* Evict the old entry into the victim tlb.  */
         copy_tlb_helper_locked(tv, te);
-        desc->viotlb[vidx] = desc->iotlb[index];
+        desc->vfulltlb[vidx] = desc->fulltlb[index];
         tlb_n_used_entries_dec(env, mmu_idx);
     }
 
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
      * subtract here is that of the page base, and not the same as the
      * vaddr we add back in io_readx()/io_writex()/get_page_addr_code().
      */
-    desc->iotlb[index].addr = iotlb - vaddr_page;
-    desc->iotlb[index].attrs = attrs;
+    desc->fulltlb[index].xlat_section = iotlb - vaddr_page;
+    desc->fulltlb[index].attrs = attrs;
 
     /* Now calculate the new entry */
     tn.addend = addend - vaddr_page;
@@ -XXX,XX +XXX,XX @@ static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
     }
 }
 
-static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
+static uint64_t io_readx(CPUArchState *env, CPUTLBEntryFull *full,
                          int mmu_idx, target_ulong addr, uintptr_t retaddr,
                          MMUAccessType access_type, MemOp op)
 {
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
     bool locked = false;
     MemTxResult r;
 
-    section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
+    section = iotlb_to_section(cpu, full->xlat_section, full->attrs);
     mr = section->mr;
-    mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
+    mr_offset = (full->xlat_section & TARGET_PAGE_MASK) + addr;
     cpu->mem_io_pc = retaddr;
     if (!cpu->can_do_io) {
         cpu_io_recompile(cpu, retaddr);
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
         qemu_mutex_lock_iothread();
         locked = true;
     }
-    r = memory_region_dispatch_read(mr, mr_offset, &val, op, iotlbentry->attrs);
+    r = memory_region_dispatch_read(mr, mr_offset, &val, op, full->attrs);
     if (r != MEMTX_OK) {
         hwaddr physaddr = mr_offset +
             section->offset_within_address_space -
             section->offset_within_region;
 
         cpu_transaction_failed(cpu, physaddr, addr, memop_size(op), access_type,
-                               mmu_idx, iotlbentry->attrs, r, retaddr);
+                               mmu_idx, full->attrs, r, retaddr);
     }
     if (locked) {
         qemu_mutex_unlock_iothread();
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
 }
 
 /*
- * Save a potentially trashed IOTLB entry for later lookup by plugin.
- * This is read by tlb_plugin_lookup if the iotlb entry doesn't match
+ * Save a potentially trashed CPUTLBEntryFull for later lookup by plugin.
+ * This is read by tlb_plugin_lookup if the fulltlb entry doesn't match
  * because of the side effect of io_writex changing memory layout.
  */
 static void save_iotlb_data(CPUState *cs, hwaddr addr,
@@ -XXX,XX +XXX,XX @@ static void save_iotlb_data(CPUState *cs, hwaddr addr,
 #endif
 }
 
-static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
+static void io_writex(CPUArchState *env, CPUTLBEntryFull *full,
                       int mmu_idx, uint64_t val, target_ulong addr,
                       uintptr_t retaddr, MemOp op)
 {
@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
     bool locked = false;
     MemTxResult r;
 
-    section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
+    section = iotlb_to_section(cpu, full->xlat_section, full->attrs);
     mr = section->mr;
-    mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
+    mr_offset = (full->xlat_section & TARGET_PAGE_MASK) + addr;
     if (!cpu->can_do_io) {
         cpu_io_recompile(cpu, retaddr);
     }
@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
      * The memory_region_dispatch may trigger a flush/resize
      * so for plugins we save the iotlb_data just in case.
      */
-    save_iotlb_data(cpu, iotlbentry->addr, section, mr_offset);
+    save_iotlb_data(cpu, full->xlat_section, section, mr_offset);
 
     if (!qemu_mutex_iothread_locked()) {
         qemu_mutex_lock_iothread();
         locked = true;
     }
-    r = memory_region_dispatch_write(mr, mr_offset, val, op, iotlbentry->attrs);
+    r = memory_region_dispatch_write(mr, mr_offset, val, op, full->attrs);
     if (r != MEMTX_OK) {
         hwaddr physaddr = mr_offset +
             section->offset_within_address_space -
             section->offset_within_region;
 
         cpu_transaction_failed(cpu, physaddr, addr, memop_size(op),
-                               MMU_DATA_STORE, mmu_idx, iotlbentry->attrs, r,
+                               MMU_DATA_STORE, mmu_idx, full->attrs, r,
                                retaddr);
     }
     if (locked) {
@@ -XXX,XX +XXX,XX @@ static bool victim_tlb_hit(CPUArchState *env, size_t mmu_idx, size_t index,
             copy_tlb_helper_locked(vtlb, &tmptlb);
             qemu_spin_unlock(&env_tlb(env)->c.lock);
 
-            CPUIOTLBEntry tmpio, *io = &env_tlb(env)->d[mmu_idx].iotlb[index];
-            CPUIOTLBEntry *vio = &env_tlb(env)->d[mmu_idx].viotlb[vidx];
-            tmpio = *io; *io = *vio; *vio = tmpio;
+            CPUTLBEntryFull *f1 = &env_tlb(env)->d[mmu_idx].fulltlb[index];
+            CPUTLBEntryFull *f2 = &env_tlb(env)->d[mmu_idx].vfulltlb[vidx];
+            CPUTLBEntryFull tmpf;
+            tmpf = *f1; *f1 = *f2; *f2 = tmpf;
             return true;
         }
     }
@@ -XXX,XX +XXX,XX @@ static bool victim_tlb_hit(CPUArchState *env, size_t mmu_idx, size_t index,
                  (ADDR) & TARGET_PAGE_MASK)
 
 static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
-                           CPUIOTLBEntry *iotlbentry, uintptr_t retaddr)
+                           CPUTLBEntryFull *full, uintptr_t retaddr)
 {
-    ram_addr_t ram_addr = mem_vaddr + iotlbentry->addr;
+    ram_addr_t ram_addr = mem_vaddr + full->xlat_section;
 
     trace_memory_notdirty_write_access(mem_vaddr, ram_addr, size);
 
@@ -XXX,XX +XXX,XX @@ int probe_access_flags(CPUArchState *env, target_ulong addr,
     /* Handle clean RAM pages.  */
     if (unlikely(flags & TLB_NOTDIRTY)) {
         uintptr_t index = tlb_index(env, mmu_idx, addr);
-        CPUIOTLBEntry *iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
+        CPUTLBEntryFull *full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
 
-        notdirty_write(env_cpu(env), addr, 1, iotlbentry, retaddr);
+        notdirty_write(env_cpu(env), addr, 1, full, retaddr);
         flags &= ~TLB_NOTDIRTY;
     }
 
@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
 
     if (unlikely(flags & (TLB_NOTDIRTY | TLB_WATCHPOINT))) {
         uintptr_t index = tlb_index(env, mmu_idx, addr);
-        CPUIOTLBEntry *iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
+        CPUTLBEntryFull *full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
 
         /* Handle watchpoints.  */
         if (flags & TLB_WATCHPOINT) {
             int wp_access = (access_type == MMU_DATA_STORE
                              ? BP_MEM_WRITE : BP_MEM_READ);
             cpu_check_watchpoint(env_cpu(env), addr, size,
-                                 iotlbentry->attrs, wp_access, retaddr);
+                                 full->attrs, wp_access, retaddr);
         }
 
         /* Handle clean RAM pages.  */
         if (flags & TLB_NOTDIRTY) {
-            notdirty_write(env_cpu(env), addr, 1, iotlbentry, retaddr);
+            notdirty_write(env_cpu(env), addr, 1, full, retaddr);
         }
     }
 
@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
  * should have just filled the TLB. The one corner case is io_writex
  * which can cause TLB flushes and potential resizing of the TLBs
  * losing the information we need. In those cases we need to recover
- * data from a copy of the iotlbentry. As long as this always occurs
+ * data from a copy of the CPUTLBEntryFull. As long as this always occurs
  * from the same thread (which a mem callback will be) this is safe.
  */
 
@@ -XXX,XX +XXX,XX @@ bool tlb_plugin_lookup(CPUState *cpu, target_ulong addr, int mmu_idx,
     if (likely(tlb_hit(tlb_addr, addr))) {
         /* We must have an iotlb entry for MMIO */
         if (tlb_addr & TLB_MMIO) {
-            CPUIOTLBEntry *iotlbentry;
-            iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
+            CPUTLBEntryFull *full;
+            full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
             data->is_io = true;
-            data->v.io.section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
-            data->v.io.offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
+            data->v.io.section =
+                iotlb_to_section(cpu, full->xlat_section, full->attrs);
+            data->v.io.offset = (full->xlat_section & TARGET_PAGE_MASK) + addr;
         } else {
             data->is_io = false;
             data->v.ram.hostaddr = (void *)((uintptr_t)addr + tlbe->addend);
@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
 
     if (unlikely(tlb_addr & TLB_NOTDIRTY)) {
         notdirty_write(env_cpu(env), addr, size,
-                       &env_tlb(env)->d[mmu_idx].iotlb[index], retaddr);
+                       &env_tlb(env)->d[mmu_idx].fulltlb[index], retaddr);
     }
 
     return hostaddr;
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, MemOpIdx oi,
 
     /* Handle anything that isn't just a straight memory access.  */
     if (unlikely(tlb_addr & ~TARGET_PAGE_MASK)) {
-        CPUIOTLBEntry *iotlbentry;
+        CPUTLBEntryFull *full;
         bool need_swap;
 
         /* For anything that is unaligned, recurse through full_load.  */
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, MemOpIdx oi,
             goto do_unaligned_access;
         }
 
-        iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
+        full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
 
         /* Handle watchpoints.  */
         if (unlikely(tlb_addr & TLB_WATCHPOINT)) {
             /* On watchpoint hit, this will longjmp out.  */
             cpu_check_watchpoint(env_cpu(env), addr, size,
-                                 iotlbentry->attrs, BP_MEM_READ, retaddr);
+                                 full->attrs, BP_MEM_READ, retaddr);
         }
 
         need_swap = size > 1 && (tlb_addr & TLB_BSWAP);
 
         /* Handle I/O access.  */
         if (likely(tlb_addr & TLB_MMIO)) {
-            return io_readx(env, iotlbentry, mmu_idx, addr, retaddr,
+            return io_readx(env, full, mmu_idx, addr, retaddr,
                             access_type, op ^ (need_swap * MO_BSWAP));
         }
 
@@ -XXX,XX +XXX,XX @@ store_helper_unaligned(CPUArchState *env, target_ulong addr, uint64_t val,
      */
     if (unlikely(tlb_addr & TLB_WATCHPOINT)) {
         cpu_check_watchpoint(env_cpu(env), addr, size - size2,
-                             env_tlb(env)->d[mmu_idx].iotlb[index].attrs,
+                             env_tlb(env)->d[mmu_idx].fulltlb[index].attrs,
                              BP_MEM_WRITE, retaddr);
     }
     if (unlikely(tlb_addr2 & TLB_WATCHPOINT)) {
         cpu_check_watchpoint(env_cpu(env), page2, size2,
-                             env_tlb(env)->d[mmu_idx].iotlb[index2].attrs,
+                             env_tlb(env)->d[mmu_idx].fulltlb[index2].attrs,
                              BP_MEM_WRITE, retaddr);
     }
 
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
 
     /* Handle anything that isn't just a straight memory access.  */
     if (unlikely(tlb_addr & ~TARGET_PAGE_MASK)) {
-        CPUIOTLBEntry *iotlbentry;
+        CPUTLBEntryFull *full;
         bool need_swap;
 
         /* For anything that is unaligned, recurse through byte stores.  */
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
             goto do_unaligned_access;
         }
 
-        iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
+        full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
 
         /* Handle watchpoints.  */
         if (unlikely(tlb_addr & TLB_WATCHPOINT)) {
             /* On watchpoint hit, this will longjmp out.  */
             cpu_check_watchpoint(env_cpu(env), addr, size,
-                                 iotlbentry->attrs, BP_MEM_WRITE, retaddr);
+                                 full->attrs, BP_MEM_WRITE, retaddr);
         }
 
         need_swap = size > 1 && (tlb_addr & TLB_BSWAP);
 
         /* Handle I/O access.  */
         if (tlb_addr & TLB_MMIO) {
-            io_writex(env, iotlbentry, mmu_idx, val, addr, retaddr,
+            io_writex(env, full, mmu_idx, val, addr, retaddr,
                       op ^ (need_swap * MO_BSWAP));
             return;
         }
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
 
         /* Handle clean RAM pages.  */
         if (tlb_addr & TLB_NOTDIRTY) {
-            notdirty_write(env_cpu(env), addr, size, iotlbentry, retaddr);
+            notdirty_write(env_cpu(env), addr, size, full, retaddr);
         }
 
         haddr = (void *)((uintptr_t)addr + entry->addend);
diff --git a/target/arm/mte_helper.c b/target/arm/mte_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/mte_helper.c
+++ b/target/arm/mte_helper.c
@@ -XXX,XX +XXX,XX @@ static uint8_t *allocation_tag_mem(CPUARMState *env, int ptr_mmu_idx,
     return tags + index;
 #else
     uintptr_t index;
-    CPUIOTLBEntry *iotlbentry;
+    CPUTLBEntryFull *full;
     int in_page, flags;
     ram_addr_t ptr_ra;
     hwaddr ptr_paddr, tag_paddr, xlat;
@@ -XXX,XX +XXX,XX @@ static uint8_t *allocation_tag_mem(CPUARMState *env, int ptr_mmu_idx,
     assert(!(flags & TLB_INVALID_MASK));
 
     /*
-     * Find the iotlbentry for ptr.  This *must* be present in the TLB
+     * Find the CPUTLBEntryFull for ptr.  This *must* be present in the TLB
      * because we just found the mapping.
      * TODO: Perhaps there should be a cputlb helper that returns a
      * matching tlb entry + iotlb entry.
@@ -XXX,XX +XXX,XX @@ static uint8_t *allocation_tag_mem(CPUARMState *env, int ptr_mmu_idx,
         g_assert(tlb_hit(comparator, ptr));
     }
 # endif
-    iotlbentry = &env_tlb(env)->d[ptr_mmu_idx].iotlb[index];
+    full = &env_tlb(env)->d[ptr_mmu_idx].fulltlb[index];
 
     /* If the virtual page MemAttr != Tagged, access unchecked. */
-    if (!arm_tlb_mte_tagged(&iotlbentry->attrs)) {
+    if (!arm_tlb_mte_tagged(&full->attrs)) {
         return NULL;
     }
 
@@ -XXX,XX +XXX,XX @@ static uint8_t *allocation_tag_mem(CPUARMState *env, int ptr_mmu_idx,
         int wp = ptr_access == MMU_DATA_LOAD ? BP_MEM_READ : BP_MEM_WRITE;
         assert(ra != 0);
         cpu_check_watchpoint(env_cpu(env), ptr, ptr_size,
-                             iotlbentry->attrs, wp, ra);
+                             full->attrs, wp, ra);
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ static uint8_t *allocation_tag_mem(CPUARMState *env, int ptr_mmu_idx,
     tag_paddr = ptr_paddr >> (LOG2_TAG_GRANULE + 1);
 
     /* Look up the address in tag space. */
-    tag_asi = iotlbentry->attrs.secure ? ARMASIdx_TagS : ARMASIdx_TagNS;
+    tag_asi = full->attrs.secure ? ARMASIdx_TagS : ARMASIdx_TagNS;
     tag_as = cpu_get_address_space(env_cpu(env), tag_asi);
     mr = address_space_translate(tag_as, tag_paddr, &xlat, NULL,
                                  tag_access == MMU_DATA_STORE,
-                                 iotlbentry->attrs);
+                                 full->attrs);
 
     /*
      * Note that @mr will never be NULL.  If there is nothing in the address
diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/sve_helper.c
+++ b/target/arm/sve_helper.c
@@ -XXX,XX +XXX,XX @@ bool sve_probe_page(SVEHostPage *info, bool nofault, CPUARMState *env,
         g_assert(tlb_hit(comparator, addr));
 # endif
 
-        CPUIOTLBEntry *iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
-        info->attrs = iotlbentry->attrs;
+        CPUTLBEntryFull *full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
+        info->attrs = full->attrs;
     }
 #endif
 
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static bool is_guarded_page(CPUARMState *env, DisasContext *s)
      * table entry even for that case.
      */
     return (tlb_hit(entry->addr_code, addr) &&
-            arm_tlb_bti_gp(&env_tlb(env)->d[mmu_idx].iotlb[index].attrs));
+            arm_tlb_bti_gp(&env_tlb(env)->d[mmu_idx].fulltlb[index].attrs));
 #endif
 }
 
-- 
2.34.1

This field is only written, not read; remove it.

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPUWatchpoint {
  * the memory regions get moved around  by io_writex.
  */
 typedef struct SavedIOTLB {
-    hwaddr addr;
     MemoryRegionSection *section;
     hwaddr mr_offset;
 } SavedIOTLB;
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUTLBEntryFull *full,
  * This is read by tlb_plugin_lookup if the fulltlb entry doesn't match
  * because of the side effect of io_writex changing memory layout.
  */
-static void save_iotlb_data(CPUState *cs, hwaddr addr,
-                            MemoryRegionSection *section, hwaddr mr_offset)
+static void save_iotlb_data(CPUState *cs, MemoryRegionSection *section,
+                            hwaddr mr_offset)
 {
 #ifdef CONFIG_PLUGIN
     SavedIOTLB *saved = &cs->saved_iotlb;
-    saved->addr = addr;
     saved->section = section;
     saved->mr_offset = mr_offset;
 #endif
@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUTLBEntryFull *full,
      * The memory_region_dispatch may trigger a flush/resize
      * so for plugins we save the iotlb_data just in case.
      */
-    save_iotlb_data(cpu, full->xlat_section, section, mr_offset);
+    save_iotlb_data(cpu, section, mr_offset);
 
     if (!qemu_mutex_iothread_locked()) {
         qemu_mutex_lock_iothread();
-- 
2.34.1

When PAGE_WRITE_INV is set when calling tlb_set_page,
we immediately set TLB_INVALID_MASK in order to force
tlb_fill to be called on the next lookup.  Here in
probe_access_internal, we have just called tlb_fill
and eliminated true misses, thus the lookup must be valid.

This allows us to remove a warning comment from s390x.
There doesn't seem to be a reason to change the code though.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c            | 10 +++++++++-
 target/s390x/tcg/mem_helper.c |  4 ----
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
     }
     tlb_addr = tlb_read_ofs(entry, elt_ofs);
 
+    flags = TLB_FLAGS_MASK;
     page_addr = addr & TARGET_PAGE_MASK;
     if (!tlb_hit_page(tlb_addr, page_addr)) {
         if (!victim_tlb_hit(env, mmu_idx, index, elt_ofs, page_addr)) {
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
 
             /* TLB resize via tlb_fill may have moved the entry.  */
             entry = tlb_entry(env, mmu_idx, addr);
+
+            /*
+             * With PAGE_WRITE_INV, we set TLB_INVALID_MASK immediately,
+             * to force the next access through tlb_fill.  We've just
+             * called tlb_fill, so we know that this entry *is* valid.
+             */
+            flags &= ~TLB_INVALID_MASK;
         }
         tlb_addr = tlb_read_ofs(entry, elt_ofs);
     }
-    flags = tlb_addr & TLB_FLAGS_MASK;
+    flags &= tlb_addr;
 
     /* Fold all "mmio-like" bits into TLB_MMIO.  This is not RAM.  */
     if (unlikely(flags & ~(TLB_WATCHPOINT | TLB_NOTDIRTY))) {
diff --git a/target/s390x/tcg/mem_helper.c b/target/s390x/tcg/mem_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/tcg/mem_helper.c
+++ b/target/s390x/tcg/mem_helper.c
@@ -XXX,XX +XXX,XX @@ static int s390_probe_access(CPUArchState *env, target_ulong addr, int size,
 #else
     int flags;
 
-    /*
-     * For !CONFIG_USER_ONLY, we cannot rely on TLB_INVALID_MASK or haddr==NULL
-     * to detect if there was an exception during tlb_fill().
-     */
     env->tlb_fill_exc = 0;
     flags = probe_access_flags(env, addr, access_type, mmu_idx, nonfault, phost,
                                ra);
-- 
2.34.1

Add an interface to return the CPUTLBEntryFull struct
that goes with the lookup.  The result is not intended
to be valid across multiple lookups, so the user must
use the results immediately.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/exec-all.h | 15 +++++++++++++
 include/qemu/typedefs.h |  1 +
 accel/tcg/cputlb.c      | 47 +++++++++++++++++++++++++----------------
 3 files changed, 45 insertions(+), 18 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ int probe_access_flags(CPUArchState *env, target_ulong addr,
                        MMUAccessType access_type, int mmu_idx,
                        bool nonfault, void **phost, uintptr_t retaddr);
 
+#ifndef CONFIG_USER_ONLY
+/**
+ * probe_access_full:
+ * Like probe_access_flags, except also return into @pfull.
+ *
+ * The CPUTLBEntryFull structure returned via @pfull is transient
+ * and must be consumed or copied immediately, before any further
+ * access or changes to TLB @mmu_idx.
+ */
+int probe_access_full(CPUArchState *env, target_ulong addr,
+                      MMUAccessType access_type, int mmu_idx,
+                      bool nonfault, void **phost,
+                      CPUTLBEntryFull **pfull, uintptr_t retaddr);
+#endif
+
 #define CODE_GEN_ALIGN           16 /* must be >= of the size of a icache line */
 
 /* Estimated block size for TB allocation.  */
diff --git a/include/qemu/typedefs.h b/include/qemu/typedefs.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/typedefs.h
+++ b/include/qemu/typedefs.h
@@ -XXX,XX +XXX,XX @@ typedef struct ConfidentialGuestSupport ConfidentialGuestSupport;
 typedef struct CPUAddressSpace CPUAddressSpace;
 typedef struct CPUArchState CPUArchState;
 typedef struct CPUState CPUState;
+typedef struct CPUTLBEntryFull CPUTLBEntryFull;
 typedef struct DeviceListener DeviceListener;
 typedef struct DeviceState DeviceState;
 typedef struct DirtyBitmapSnapshot DirtyBitmapSnapshot;
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
 static int probe_access_internal(CPUArchState *env, target_ulong addr,
                                  int fault_size, MMUAccessType access_type,
                                  int mmu_idx, bool nonfault,
-                                 void **phost, uintptr_t retaddr)
+                                 void **phost, CPUTLBEntryFull **pfull,
+                                 uintptr_t retaddr)
 {
     uintptr_t index = tlb_index(env, mmu_idx, addr);
     CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
                                            mmu_idx, nonfault, retaddr)) {
                 /* Non-faulting page table read failed.  */
                 *phost = NULL;
+                *pfull = NULL;
                 return TLB_INVALID_MASK;
             }
 
             /* TLB resize via tlb_fill may have moved the entry.  */
+            index = tlb_index(env, mmu_idx, addr);
             entry = tlb_entry(env, mmu_idx, addr);
 
             /*
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
     }
     flags &= tlb_addr;
 
+    *pfull = &env_tlb(env)->d[mmu_idx].fulltlb[index];
+
     /* Fold all "mmio-like" bits into TLB_MMIO.  This is not RAM.  */
     if (unlikely(flags & ~(TLB_WATCHPOINT | TLB_NOTDIRTY))) {
         *phost = NULL;
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
     return flags;
 }
 
-int probe_access_flags(CPUArchState *env, target_ulong addr,
-                       MMUAccessType access_type, int mmu_idx,
-                       bool nonfault, void **phost, uintptr_t retaddr)
+int probe_access_full(CPUArchState *env, target_ulong addr,
+                      MMUAccessType access_type, int mmu_idx,
+                      bool nonfault, void **phost, CPUTLBEntryFull **pfull,
+                      uintptr_t retaddr)
 {
-    int flags;
-
-    flags = probe_access_internal(env, addr, 0, access_type, mmu_idx,
-                                  nonfault, phost, retaddr);
+    int flags = probe_access_internal(env, addr, 0, access_type, mmu_idx,
+                                      nonfault, phost, pfull, retaddr);
 
     /* Handle clean RAM pages.  */
     if (unlikely(flags & TLB_NOTDIRTY)) {
-        uintptr_t index = tlb_index(env, mmu_idx, addr);
-        CPUTLBEntryFull *full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
-
-        notdirty_write(env_cpu(env), addr, 1, full, retaddr);
+        notdirty_write(env_cpu(env), addr, 1, *pfull, retaddr);
         flags &= ~TLB_NOTDIRTY;
     }
 
     return flags;
 }
 
+int probe_access_flags(CPUArchState *env, target_ulong addr,
+                       MMUAccessType access_type, int mmu_idx,
+                       bool nonfault, void **phost, uintptr_t retaddr)
+{
+    CPUTLBEntryFull *full;
+
+    return probe_access_full(env, addr, access_type, mmu_idx,
+                             nonfault, phost, &full, retaddr);
+}
+
 void *probe_access(CPUArchState *env, target_ulong addr, int size,
                    MMUAccessType access_type, int mmu_idx, uintptr_t retaddr)
 {
+    CPUTLBEntryFull *full;
     void *host;
     int flags;
 
     g_assert(-(addr | TARGET_PAGE_MASK) >= size);
 
     flags = probe_access_internal(env, addr, size, access_type, mmu_idx,
-                                  false, &host, retaddr);
+                                  false, &host, &full, retaddr);
 
     /* Per the interface, size == 0 merely faults the access. */
     if (size == 0) {
@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
     }
 
     if (unlikely(flags & (TLB_NOTDIRTY | TLB_WATCHPOINT))) {
-        uintptr_t index = tlb_index(env, mmu_idx, addr);
-        CPUTLBEntryFull *full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
-
         /* Handle watchpoints.  */
         if (flags & TLB_WATCHPOINT) {
             int wp_access = (access_type == MMU_DATA_STORE
@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
 void *tlb_vaddr_to_host(CPUArchState *env, abi_ptr addr,
                         MMUAccessType access_type, int mmu_idx)
 {
+    CPUTLBEntryFull *full;
     void *host;
     int flags;
 
     flags = probe_access_internal(env, addr, 0, access_type,
-                                  mmu_idx, true, &host, 0);
+                                  mmu_idx, true, &host, &full, 0);
 
     /* No combination of flags are expected by the caller. */
     return flags ? NULL : host;
@@ -XXX,XX +XXX,XX @@ void *tlb_vaddr_to_host(CPUArchState *env, abi_ptr addr,
 tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
                                         void **hostp)
 {
+    CPUTLBEntryFull *full;
     void *p;
 
     (void)probe_access_internal(env, addr, 1, MMU_INST_FETCH,
-                                cpu_mmu_index(env, true), false, &p, 0);
+                                cpu_mmu_index(env, true), false, &p, &full, 0);
     if (p == NULL) {
         return -1;
     }
-- 
2.34.1

Now that we have collected all of the page data into
CPUTLBEntryFull, provide an interface to record that
all in one go, instead of using 4 arguments.  This interface
allows CPUTLBEntryFull to be extended without having to
change the number of arguments.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-defs.h | 14 +++++++++++
 include/exec/exec-all.h | 22 ++++++++++++++++++
 accel/tcg/cputlb.c      | 51 ++++++++++++++++++++++++++---------------
 3 files changed, 69 insertions(+), 18 deletions(-)

diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUTLBEntryFull {
      *     + the offset within the target MemoryRegion (otherwise)
      */
     hwaddr xlat_section;
+
+    /*
+     * @phys_addr contains the physical address in the address space
+     * given by cpu_asidx_from_attrs(cpu, @attrs).
+     */
+    hwaddr phys_addr;
+
+    /* @attrs contains the memory transaction attributes for the page. */
     MemTxAttrs attrs;
+
+    /* @prot contains the complete protections for the page. */
+    uint8_t prot;
+
+    /* @lg_page_size contains the log2 of the page size. */
+    uint8_t lg_page_size;
 } CPUTLBEntryFull;
 
 /*
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ void tlb_flush_range_by_mmuidx_all_cpus_synced(CPUState *cpu,
                                                uint16_t idxmap,
                                                unsigned bits);
 
+/**
+ * tlb_set_page_full:
+ * @cpu: CPU context
+ * @mmu_idx: mmu index of the tlb to modify
+ * @vaddr: virtual address of the entry to add
+ * @full: the details of the tlb entry
+ *
+ * Add an entry to @cpu tlb index @mmu_idx.  All of the fields of
+ * @full must be filled, except for xlat_section, and constitute
+ * the complete description of the translated page.
+ *
+ * This is generally called by the target tlb_fill function after
+ * having performed a successful page table walk to find the physical
+ * address and attributes for the translation.
+ *
+ * At most one entry for a given virtual address is permitted. Only a
+ * single TARGET_PAGE_SIZE region is mapped; @full->lg_page_size is only
+ * used by tlb_flush_page.
+ */
+void tlb_set_page_full(CPUState *cpu, int mmu_idx, target_ulong vaddr,
+                       CPUTLBEntryFull *full);
+
 /**
  * tlb_set_page_with_attrs:
  * @cpu: CPU to add this TLB entry for
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_add_large_page(CPUArchState *env, int mmu_idx,
     env_tlb(env)->d[mmu_idx].large_page_mask = lp_mask;
 }
 
-/* Add a new TLB entry. At most one entry for a given virtual address
+/*
+ * Add a new TLB entry. At most one entry for a given virtual address
  * is permitted. Only a single TARGET_PAGE_SIZE region is mapped, the
  * supplied size is only used by tlb_flush_page.
  *
  * Called from TCG-generated code, which is under an RCU read-side
  * critical section.
  */
-void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
-                             hwaddr paddr, MemTxAttrs attrs, int prot,
-                             int mmu_idx, target_ulong size)
+void tlb_set_page_full(CPUState *cpu, int mmu_idx,
+                       target_ulong vaddr, CPUTLBEntryFull *full)
 {
     CPUArchState *env = cpu->env_ptr;
     CPUTLB *tlb = env_tlb(env);
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
     CPUTLBEntry *te, tn;
     hwaddr iotlb, xlat, sz, paddr_page;
     target_ulong vaddr_page;
-    int asidx = cpu_asidx_from_attrs(cpu, attrs);
-    int wp_flags;
+    int asidx, wp_flags, prot;
     bool is_ram, is_romd;
 
     assert_cpu_is_self(cpu);
 
-    if (size <= TARGET_PAGE_SIZE) {
+    if (full->lg_page_size <= TARGET_PAGE_BITS) {
         sz = TARGET_PAGE_SIZE;
     } else {
-        tlb_add_large_page(env, mmu_idx, vaddr, size);
-        sz = size;
+        sz = (hwaddr)1 << full->lg_page_size;
+        tlb_add_large_page(env, mmu_idx, vaddr, sz);
     }
     vaddr_page = vaddr & TARGET_PAGE_MASK;
-    paddr_page = paddr & TARGET_PAGE_MASK;
+    paddr_page = full->phys_addr & TARGET_PAGE_MASK;
 
+    prot = full->prot;
+    asidx = cpu_asidx_from_attrs(cpu, full->attrs);
     section = address_space_translate_for_iotlb(cpu, asidx, paddr_page,
-                                                &xlat, &sz, attrs, &prot);
+                                                &xlat, &sz, full->attrs, &prot);
     assert(sz >= TARGET_PAGE_SIZE);
 
     tlb_debug("vaddr=" TARGET_FMT_lx " paddr=0x" TARGET_FMT_plx
               " prot=%x idx=%d\n",
-              vaddr, paddr, prot, mmu_idx);
+              vaddr, full->phys_addr, prot, mmu_idx);
 
     address = vaddr_page;
-    if (size < TARGET_PAGE_SIZE) {
+    if (full->lg_page_size < TARGET_PAGE_BITS) {
         /* Repeat the MMU check and TLB fill on every access.  */
         address |= TLB_INVALID_MASK;
     }
-    if (attrs.byte_swap) {
+    if (full->attrs.byte_swap) {
         address |= TLB_BSWAP;
     }
 
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
      * subtract here is that of the page base, and not the same as the
      * vaddr we add back in io_readx()/io_writex()/get_page_addr_code().
      */
+    desc->fulltlb[index] = *full;
     desc->fulltlb[index].xlat_section = iotlb - vaddr_page;
-    desc->fulltlb[index].attrs = attrs;
+    desc->fulltlb[index].phys_addr = paddr_page;
+    desc->fulltlb[index].prot = prot;
 
     /* Now calculate the new entry */
     tn.addend = addend - vaddr_page;
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
     qemu_spin_unlock(&tlb->c.lock);
 }
 
-/* Add a new TLB entry, but without specifying the memory
- * transaction attributes to be used.
- */
+void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
+                             hwaddr paddr, MemTxAttrs attrs, int prot,
+                             int mmu_idx, target_ulong size)
+{
+    CPUTLBEntryFull full = {
+        .phys_addr = paddr,
+        .attrs = attrs,
+        .prot = prot,
+        .lg_page_size = ctz64(size)
+    };
+
+    assert(is_power_of_2(size));
+    tlb_set_page_full(cpu, mmu_idx, vaddr, &full);
+}
+
 void tlb_set_page(CPUState *cpu, target_ulong vaddr,
                   hwaddr paddr, int prot,
                   int mmu_idx, target_ulong size)
-- 
2.34.1

This bitmap is created and discarded immediately.
We gain nothing by its existence.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220822232338.1727934-2-richard.henderson@linaro.org>
---
 accel/tcg/translate-all.c | 78 ++-------------------------------------
 1 file changed, 4 insertions(+), 74 deletions(-)

diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@
 #define assert_memory_lock() tcg_debug_assert(have_mmap_lock())
 #endif
 
-#define SMC_BITMAP_USE_THRESHOLD 10
-
 typedef struct PageDesc {
     /* list of TBs intersecting this ram page */
     uintptr_t first_tb;
-#ifdef CONFIG_SOFTMMU
-    /* in order to optimize self modifying code, we count the number
-       of lookups we do to a given page to use a bitmap */
-    unsigned long *code_bitmap;
-    unsigned int code_write_count;
-#else
+#ifdef CONFIG_USER_ONLY
     unsigned long flags;
     void *target_data;
 #endif
-#ifndef CONFIG_USER_ONLY
+#ifdef CONFIG_SOFTMMU
     QemuSpin lock;
 #endif
 } PageDesc;
@@ -XXX,XX +XXX,XX @@ void tb_htable_init(void)
     qht_init(&tb_ctx.htable, tb_cmp, CODE_GEN_HTABLE_SIZE, mode);
 }
 
-/* call with @p->lock held */
-static inline void invalidate_page_bitmap(PageDesc *p)
-{
-    assert_page_locked(p);
-#ifdef CONFIG_SOFTMMU
-    g_free(p->code_bitmap);
-    p->code_bitmap = NULL;
-    p->code_write_count = 0;
-#endif
-}
-
 /* Set to NULL all the 'first_tb' fields in all PageDescs. */
 static void page_flush_tb_1(int level, void **lp)
 {
@@ -XXX,XX +XXX,XX @@ static void page_flush_tb_1(int level, void **lp)
         for (i = 0; i < V_L2_SIZE; ++i) {
             page_lock(&pd[i]);
             pd[i].first_tb = (uintptr_t)NULL;
-            invalidate_page_bitmap(pd + i);
             page_unlock(&pd[i]);
         }
     } else {
@@ -XXX,XX +XXX,XX @@ static void do_tb_phys_invalidate(TranslationBlock *tb, bool rm_from_page_list)
     if (rm_from_page_list) {
         p = page_find(tb->page_addr[0] >> TARGET_PAGE_BITS);
         tb_page_remove(p, tb);
-        invalidate_page_bitmap(p);
         if (tb->page_addr[1] != -1) {
             p = page_find(tb->page_addr[1] >> TARGET_PAGE_BITS);
             tb_page_remove(p, tb);
-            invalidate_page_bitmap(p);
         }
     }
 
@@ -XXX,XX +XXX,XX @@ void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr)
     }
 }
 
-#ifdef CONFIG_SOFTMMU
-/* call with @p->lock held */
-static void build_page_bitmap(PageDesc *p)
-{
-    int n, tb_start, tb_end;
-    TranslationBlock *tb;
-
-    assert_page_locked(p);
-    p->code_bitmap = bitmap_new(TARGET_PAGE_SIZE);
-
-    PAGE_FOR_EACH_TB(p, tb, n) {
-        /* NOTE: this is subtle as a TB may span two physical pages */
-        if (n == 0) {
-            /* NOTE: tb_end may be after the end of the page, but
-               it is not a problem */
-            tb_start = tb->pc & ~TARGET_PAGE_MASK;
-            tb_end = tb_start + tb->size;
-            if (tb_end > TARGET_PAGE_SIZE) {
-                tb_end = TARGET_PAGE_SIZE;
-             }
-        } else {
-            tb_start = 0;
-            tb_end = ((tb->pc + tb->size) & ~TARGET_PAGE_MASK);
-        }
-        bitmap_set(p->code_bitmap, tb_start, tb_end - tb_start);
-    }
-}
-#endif
-
 /* add the tb in the target page and protect it if necessary
  *
  * Called with mmap_lock held for user-mode emulation.
@@ -XXX,XX +XXX,XX @@ static inline void tb_page_add(PageDesc *p, TranslationBlock *tb,
     page_already_protected = p->first_tb != (uintptr_t)NULL;
 #endif
     p->first_tb = (uintptr_t)tb | n;
-    invalidate_page_bitmap(p);
 
 #if defined(CONFIG_USER_ONLY)
     /* translator_loop() must have made all TB pages non-writable */
@@ -XXX,XX +XXX,XX @@ tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
     /* remove TB from the page(s) if we couldn't insert it */
     if (unlikely(existing_tb)) {
         tb_page_remove(p, tb);
-        invalidate_page_bitmap(p);
         if (p2) {
             tb_page_remove(p2, tb);
-            invalidate_page_bitmap(p2);
         }
         tb = existing_tb;
     }
@@ -XXX,XX +XXX,XX @@ tb_invalidate_phys_page_range__locked(struct page_collection *pages,
 #if !defined(CONFIG_USER_ONLY)
     /* if no code remaining, no need to continue to use slow writes */
     if (!p->first_tb) {
-        invalidate_page_bitmap(p);
         tlb_unprotect_code(start);
     }
 #endif
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_page_fast(struct page_collection *pages,
     }
 
     assert_page_locked(p);
-    if (!p->code_bitmap &&
-        ++p->code_write_count >= SMC_BITMAP_USE_THRESHOLD) {
-        build_page_bitmap(p);
-    }
-    if (p->code_bitmap) {
-        unsigned int nr;
-        unsigned long b;
-
-        nr = start & ~TARGET_PAGE_MASK;
-        b = p->code_bitmap[BIT_WORD(nr)] >> (nr & (BITS_PER_LONG - 1));
-        if (b & ((1 << len) - 1)) {
-            goto do_invalidate;
-        }
-    } else {
-    do_invalidate:
-        tb_invalidate_phys_page_range__locked(pages, p, start, start + len,
-                                              retaddr);
-    }
+    tb_invalidate_phys_page_range__locked(pages, p, start, start + len,
+                                          retaddr);
 }
 #else
 /* Called with mmap_lock held. If pc is not 0 then it indicates the
-- 
2.34.1

Bool is more appropriate type for the alloc parameter.

diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ void page_init(void)
 #endif
 }
 
-static PageDesc *page_find_alloc(tb_page_addr_t index, int alloc)
+static PageDesc *page_find_alloc(tb_page_addr_t index, bool alloc)
 {
     PageDesc *pd;
     void **lp;
@@ -XXX,XX +XXX,XX @@ static PageDesc *page_find_alloc(tb_page_addr_t index, int alloc)
 
 static inline PageDesc *page_find(tb_page_addr_t index)
 {
-    return page_find_alloc(index, 0);
+    return page_find_alloc(index, false);
 }
 
 static void page_lock_pair(PageDesc **ret_p1, tb_page_addr_t phys1,
-                           PageDesc **ret_p2, tb_page_addr_t phys2, int alloc);
+                           PageDesc **ret_p2, tb_page_addr_t phys2, bool alloc);
 
 /* In user-mode page locks aren't used; mmap_lock is enough */
 #ifdef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static inline void page_unlock(PageDesc *pd)
 /* lock the page(s) of a TB in the correct acquisition order */
 static inline void page_lock_tb(const TranslationBlock *tb)
 {
-    page_lock_pair(NULL, tb->page_addr[0], NULL, tb->page_addr[1], 0);
+    page_lock_pair(NULL, tb->page_addr[0], NULL, tb->page_addr[1], false);
 }
 
 static inline void page_unlock_tb(const TranslationBlock *tb)
@@ -XXX,XX +XXX,XX @@ void page_collection_unlock(struct page_collection *set)
 #endif /* !CONFIG_USER_ONLY */
 
 static void page_lock_pair(PageDesc **ret_p1, tb_page_addr_t phys1,
-                           PageDesc **ret_p2, tb_page_addr_t phys2, int alloc)
+                           PageDesc **ret_p2, tb_page_addr_t phys2, bool alloc)
 {
     PageDesc *p1, *p2;
     tb_page_addr_t page1;
@@ -XXX,XX +XXX,XX @@ tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
      * Note that inserting into the hash table first isn't an option, since
      * we can only insert TBs that are fully initialized.
      */
-    page_lock_pair(&p, phys_pc, &p2, phys_page2, 1);
+    page_lock_pair(&p, phys_pc, &p2, phys_page2, true);
     tb_page_add(p, tb, 0, phys_pc & TARGET_PAGE_MASK);
     if (p2) {
         tb_page_add(p2, tb, 1, phys_page2);
@@ -XXX,XX +XXX,XX @@ void page_set_flags(target_ulong start, target_ulong end, int flags)
     for (addr = start, len = end - start;
          len != 0;
          len -= TARGET_PAGE_SIZE, addr += TARGET_PAGE_SIZE) {
-        PageDesc *p = page_find_alloc(addr >> TARGET_PAGE_BITS, 1);
+        PageDesc *p = page_find_alloc(addr >> TARGET_PAGE_BITS, true);
 
         /* If the write protection bit is set, then we invalidate
            the code inside.  */
-- 
2.34.1

Use the pc coming from db->pc_first rather than the TB.

Use the cached host_addr rather than re-computing for the
first page.  We still need a separate lookup for the second
page because it won't be computed for DisasContextBase until
the translator actually performs a read from the page.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/plugin-gen.h |  7 ++++---
 accel/tcg/plugin-gen.c    | 22 +++++++++++-----------
 accel/tcg/translator.c    |  2 +-
 3 files changed, 16 insertions(+), 15 deletions(-)

diff --git a/include/exec/plugin-gen.h b/include/exec/plugin-gen.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/plugin-gen.h
+++ b/include/exec/plugin-gen.h
@@ -XXX,XX +XXX,XX @@ struct DisasContextBase;
 
 #ifdef CONFIG_PLUGIN
 
-bool plugin_gen_tb_start(CPUState *cpu, const TranslationBlock *tb, bool supress);
+bool plugin_gen_tb_start(CPUState *cpu, const struct DisasContextBase *db,
+                         bool supress);
 void plugin_gen_tb_end(CPUState *cpu);
 void plugin_gen_insn_start(CPUState *cpu, const struct DisasContextBase *db);
 void plugin_gen_insn_end(void);
@@ -XXX,XX +XXX,XX @@ static inline void plugin_insn_append(abi_ptr pc, const void *from, size_t size)
 
 #else /* !CONFIG_PLUGIN */
 
-static inline
-bool plugin_gen_tb_start(CPUState *cpu, const TranslationBlock *tb, bool supress)
+static inline bool
+plugin_gen_tb_start(CPUState *cpu, const struct DisasContextBase *db, bool sup)
 {
     return false;
 }
diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/plugin-gen.c
+++ b/accel/tcg/plugin-gen.c
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(const struct qemu_plugin_tb *plugin_tb)
     pr_ops();
 }
 
-bool plugin_gen_tb_start(CPUState *cpu, const TranslationBlock *tb, bool mem_only)
+bool plugin_gen_tb_start(CPUState *cpu, const DisasContextBase *db,
+                         bool mem_only)
 {
     bool ret = false;
 
@@ -XXX,XX +XXX,XX @@ bool plugin_gen_tb_start(CPUState *cpu, const TranslationBlock *tb, bool mem_onl
 
         ret = true;
 
-        ptb->vaddr = tb->pc;
+        ptb->vaddr = db->pc_first;
         ptb->vaddr2 = -1;
-        get_page_addr_code_hostp(cpu->env_ptr, tb->pc, &ptb->haddr1);
+        ptb->haddr1 = db->host_addr[0];
         ptb->haddr2 = NULL;
         ptb->mem_only = mem_only;
 
@@ -XXX,XX +XXX,XX @@ void plugin_gen_insn_start(CPUState *cpu, const DisasContextBase *db)
      * Note that we skip this when haddr1 == NULL, e.g. when we're
      * fetching instructions from a region not backed by RAM.
      */
-    if (likely(ptb->haddr1 != NULL && ptb->vaddr2 == -1) &&
-        unlikely((db->pc_next & TARGET_PAGE_MASK) !=
-                 (db->pc_first & TARGET_PAGE_MASK))) {
-        get_page_addr_code_hostp(cpu->env_ptr, db->pc_next,
-                                 &ptb->haddr2);
-        ptb->vaddr2 = db->pc_next;
-    }
-    if (likely(ptb->vaddr2 == -1)) {
+    if (ptb->haddr1 == NULL) {
+        pinsn->haddr = NULL;
+    } else if (is_same_page(db, db->pc_next)) {
         pinsn->haddr = ptb->haddr1 + pinsn->vaddr - ptb->vaddr;
     } else {
+        if (ptb->vaddr2 == -1) {
+            ptb->vaddr2 = TARGET_PAGE_ALIGN(db->pc_first);
+            get_page_addr_code_hostp(cpu->env_ptr, ptb->vaddr2, &ptb->haddr2);
+        }
         pinsn->haddr = ptb->haddr2 + pinsn->vaddr - ptb->vaddr2;
     }
 }
diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translator.c
+++ b/accel/tcg/translator.c
@@ -XXX,XX +XXX,XX @@ void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
     ops->tb_start(db, cpu);
     tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
 
-    plugin_enabled = plugin_gen_tb_start(cpu, tb, cflags & CF_MEMI_ONLY);
+    plugin_enabled = plugin_gen_tb_start(cpu, db, cflags & CF_MEMI_ONLY);
 
     while (true) {
         db->num_insns++;
-- 
2.34.1

Let tb->page_addr[0] contain the address of the first byte of the
translated block, rather than the address of the page containing the
start of the translated block.  We need to recover this value anyway
at various points, and it is easier to discard a page offset when it
is not needed, which happens naturally via the existing find_page shift.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c      | 16 ++++++++--------
 accel/tcg/cputlb.c        |  3 ++-
 accel/tcg/translate-all.c |  9 +++++----
 3 files changed, 15 insertions(+), 13 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ struct tb_desc {
     target_ulong pc;
     target_ulong cs_base;
     CPUArchState *env;
-    tb_page_addr_t phys_page1;
+    tb_page_addr_t page_addr0;
     uint32_t flags;
     uint32_t cflags;
     uint32_t trace_vcpu_dstate;
@@ -XXX,XX +XXX,XX @@ static bool tb_lookup_cmp(const void *p, const void *d)
     const struct tb_desc *desc = d;
 
     if (tb->pc == desc->pc &&
-        tb->page_addr[0] == desc->phys_page1 &&
+        tb->page_addr[0] == desc->page_addr0 &&
         tb->cs_base == desc->cs_base &&
         tb->flags == desc->flags &&
         tb->trace_vcpu_dstate == desc->trace_vcpu_dstate &&
@@ -XXX,XX +XXX,XX @@ static bool tb_lookup_cmp(const void *p, const void *d)
         if (tb->page_addr[1] == -1) {
             return true;
         } else {
-            tb_page_addr_t phys_page2;
-            target_ulong virt_page2;
+            tb_page_addr_t phys_page1;
+            target_ulong virt_page1;
 
             /*
              * We know that the first page matched, and an otherwise valid TB
@@ -XXX,XX +XXX,XX @@ static bool tb_lookup_cmp(const void *p, const void *d)
              * is different for the new TB.  Therefore any exception raised
              * here by the faulting lookup is not premature.
              */
-            virt_page2 = TARGET_PAGE_ALIGN(desc->pc);
-            phys_page2 = get_page_addr_code(desc->env, virt_page2);
-            if (tb->page_addr[1] == phys_page2) {
+            virt_page1 = TARGET_PAGE_ALIGN(desc->pc);
+            phys_page1 = get_page_addr_code(desc->env, virt_page1);
+            if (tb->page_addr[1] == phys_page1) {
                 return true;
             }
         }
@@ -XXX,XX +XXX,XX @@ static TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
     if (phys_pc == -1) {
         return NULL;
     }
-    desc.phys_page1 = phys_pc & TARGET_PAGE_MASK;
+    desc.page_addr0 = phys_pc;
     h = tb_hash_func(phys_pc, pc, flags, cflags, *cpu->trace_dstate);
     return qht_lookup_custom(&tb_ctx.htable, &desc, h, tb_lookup_cmp);
 }
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ void tlb_flush_page_bits_by_mmuidx_all_cpus_synced(CPUState *src_cpu,
    can be detected */
 void tlb_protect_code(ram_addr_t ram_addr)
 {
-    cpu_physical_memory_test_and_clear_dirty(ram_addr, TARGET_PAGE_SIZE,
+    cpu_physical_memory_test_and_clear_dirty(ram_addr & TARGET_PAGE_MASK,
+                                             TARGET_PAGE_SIZE,
                                              DIRTY_MEMORY_CODE);
 }
 
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ static void do_tb_phys_invalidate(TranslationBlock *tb, bool rm_from_page_list)
     qemu_spin_unlock(&tb->jmp_lock);
 
     /* remove the TB from the hash list */
-    phys_pc = tb->page_addr[0] + (tb->pc & ~TARGET_PAGE_MASK);
+    phys_pc = tb->page_addr[0];
     h = tb_hash_func(phys_pc, tb->pc, tb->flags, orig_cflags,
                      tb->trace_vcpu_dstate);
     if (!qht_remove(&tb_ctx.htable, tb, h)) {
@@ -XXX,XX +XXX,XX @@ tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
      * we can only insert TBs that are fully initialized.
      */
     page_lock_pair(&p, phys_pc, &p2, phys_page2, true);
-    tb_page_add(p, tb, 0, phys_pc & TARGET_PAGE_MASK);
+    tb_page_add(p, tb, 0, phys_pc);
     if (p2) {
         tb_page_add(p2, tb, 1, phys_page2);
     } else {
@@ -XXX,XX +XXX,XX @@ tb_invalidate_phys_page_range__locked(struct page_collection *pages,
         if (n == 0) {
             /* NOTE: tb_end may be after the end of the page, but
                it is not a problem */
-            tb_start = tb->page_addr[0] + (tb->pc & ~TARGET_PAGE_MASK);
+            tb_start = tb->page_addr[0];
             tb_end = tb_start + tb->size;
         } else {
             tb_start = tb->page_addr[1];
-            tb_end = tb_start + ((tb->pc + tb->size) & ~TARGET_PAGE_MASK);
+            tb_end = tb_start + ((tb->page_addr[0] + tb->size)
+                                 & ~TARGET_PAGE_MASK);
         }
         if (!(tb_end <= start || tb_start >= end)) {
 #ifdef TARGET_HAS_PRECISE_SMC
-- 
2.34.1

This function has two users, who use it incompatibly.
In tlb_flush_page_by_mmuidx_async_0, when flushing a
single page, we need to flush exactly two pages.
In tlb_flush_range_by_mmuidx_async_0, when flushing a
range of pages, we need to flush N+1 pages.

This avoids double-flushing of jmp cache pages in a range.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 25 ++++++++++++++-----------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tb_jmp_cache_clear_page(CPUState *cpu, target_ulong page_addr)
     }
 }
 
-static void tb_flush_jmp_cache(CPUState *cpu, target_ulong addr)
-{
-    /* Discard jump cache entries for any tb which might potentially
-       overlap the flushed page.  */
-    tb_jmp_cache_clear_page(cpu, addr - TARGET_PAGE_SIZE);
-    tb_jmp_cache_clear_page(cpu, addr);
-}
-
 /**
  * tlb_mmu_resize_locked() - perform TLB resize bookkeeping; resize if necessary
  * @desc: The CPUTLBDesc portion of the TLB
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_page_by_mmuidx_async_0(CPUState *cpu,
     }
     qemu_spin_unlock(&env_tlb(env)->c.lock);
 
-    tb_flush_jmp_cache(cpu, addr);
+    /*
+     * Discard jump cache entries for any tb which might potentially
+     * overlap the flushed page, which includes the previous.
+     */
+    tb_jmp_cache_clear_page(cpu, addr - TARGET_PAGE_SIZE);
+    tb_jmp_cache_clear_page(cpu, addr);
 }
 
 /**
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_range_by_mmuidx_async_0(CPUState *cpu,
         return;
     }
 
-    for (target_ulong i = 0; i < d.len; i += TARGET_PAGE_SIZE) {
-        tb_flush_jmp_cache(cpu, d.addr + i);
+    /*
+     * Discard jump cache entries for any tb which might potentially
+     * overlap the flushed pages, which includes the previous.
+     */
+    d.addr -= TARGET_PAGE_SIZE;
+    for (target_ulong i = 0, n = d.len / TARGET_PAGE_SIZE + 1; i < n; i++) {
+        tb_jmp_cache_clear_page(cpu, d.addr);
+        d.addr += TARGET_PAGE_SIZE;
     }
 }
 
-- 
2.34.1

Wrap the bare TranslationBlock pointer into a structure.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tb-hash.h       |  1 +
 accel/tcg/tb-jmp-cache.h  | 24 ++++++++++++++++++++++++
 include/exec/cpu-common.h |  1 +
 include/hw/core/cpu.h     | 15 +--------------
 include/qemu/typedefs.h   |  1 +
 accel/stubs/tcg-stub.c    |  4 ++++
 accel/tcg/cpu-exec.c      | 10 +++++++---
 accel/tcg/cputlb.c        |  9 +++++----
 accel/tcg/translate-all.c | 28 +++++++++++++++++++++++++---
 hw/core/cpu-common.c      |  3 +--
 plugins/core.c            |  2 +-
 trace/control-target.c    |  2 +-
 12 files changed, 72 insertions(+), 28 deletions(-)
 create mode 100644 accel/tcg/tb-jmp-cache.h

diff --git a/accel/tcg/tb-hash.h b/accel/tcg/tb-hash.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tb-hash.h
+++ b/accel/tcg/tb-hash.h
@@ -XXX,XX +XXX,XX @@
 #include "exec/cpu-defs.h"
 #include "exec/exec-all.h"
 #include "qemu/xxhash.h"
+#include "tb-jmp-cache.h"
 
 #ifdef CONFIG_SOFTMMU
 
diff --git a/accel/tcg/tb-jmp-cache.h b/accel/tcg/tb-jmp-cache.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/accel/tcg/tb-jmp-cache.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * The per-CPU TranslationBlock jump cache.
+ *
+ *  Copyright (c) 2003 Fabrice Bellard
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef ACCEL_TCG_TB_JMP_CACHE_H
+#define ACCEL_TCG_TB_JMP_CACHE_H
+
+#define TB_JMP_CACHE_BITS 12
+#define TB_JMP_CACHE_SIZE (1 << TB_JMP_CACHE_BITS)
+
+/*
+ * Accessed in parallel; all accesses to 'tb' must be atomic.
+ */
+struct CPUJumpCache {
+    struct {
+        TranslationBlock *tb;
+    } array[TB_JMP_CACHE_SIZE];
+};
+
+#endif /* ACCEL_TCG_TB_JMP_CACHE_H */
diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -XXX,XX +XXX,XX @@ void cpu_list_unlock(void);
 unsigned int cpu_list_generation_id_get(void);
 
 void tcg_flush_softmmu_tlb(CPUState *cs);
+void tcg_flush_jmp_cache(CPUState *cs);
 
 void tcg_iommu_init_notifier_list(CPUState *cpu);
 void tcg_iommu_free_notifier_list(CPUState *cpu);
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ struct kvm_run;
 struct hax_vcpu_state;
 struct hvf_vcpu_state;
 
-#define TB_JMP_CACHE_BITS 12
-#define TB_JMP_CACHE_SIZE (1 << TB_JMP_CACHE_BITS)
-
 /* work queue */
 
 /* The union type allows passing of 64 bit target pointers on 32 bit
@@ -XXX,XX +XXX,XX @@ struct CPUState {
     CPUArchState *env_ptr;
     IcountDecr *icount_decr_ptr;
 
-    /* Accessed in parallel; all accesses must be atomic */
-    TranslationBlock *tb_jmp_cache[TB_JMP_CACHE_SIZE];
+    CPUJumpCache *tb_jmp_cache;
 
     struct GDBRegisterState *gdb_regs;
     int gdb_num_regs;
@@ -XXX,XX +XXX,XX @@ extern CPUTailQ cpus;
 
 extern __thread CPUState *current_cpu;
 
-static inline void cpu_tb_jmp_cache_clear(CPUState *cpu)
-{
-    unsigned int i;
-
-    for (i = 0; i < TB_JMP_CACHE_SIZE; i++) {
-        qatomic_set(&cpu->tb_jmp_cache[i], NULL);
-    }
-}
-
 /**
  * qemu_tcg_mttcg_enabled:
  * Check whether we are running MultiThread TCG or not.
diff --git a/include/qemu/typedefs.h b/include/qemu/typedefs.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/typedefs.h
+++ b/include/qemu/typedefs.h
@@ -XXX,XX +XXX,XX @@ typedef struct CoMutex CoMutex;
 typedef struct ConfidentialGuestSupport ConfidentialGuestSupport;
 typedef struct CPUAddressSpace CPUAddressSpace;
 typedef struct CPUArchState CPUArchState;
+typedef struct CPUJumpCache CPUJumpCache;
 typedef struct CPUState CPUState;
 typedef struct CPUTLBEntryFull CPUTLBEntryFull;
 typedef struct DeviceListener DeviceListener;
diff --git a/accel/stubs/tcg-stub.c b/accel/stubs/tcg-stub.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/stubs/tcg-stub.c
+++ b/accel/stubs/tcg-stub.c
@@ -XXX,XX +XXX,XX @@ void tlb_set_dirty(CPUState *cpu, target_ulong vaddr)
 {
 }
 
+void tcg_flush_jmp_cache(CPUState *cpu)
+{
+}
+
 int probe_access_flags(CPUArchState *env, target_ulong addr,
                        MMUAccessType access_type, int mmu_idx,
                        bool nonfault, void **phost, uintptr_t retaddr)
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/replay.h"
 #include "sysemu/tcg.h"
 #include "exec/helper-proto.h"
+#include "tb-jmp-cache.h"
 #include "tb-hash.h"
 #include "tb-context.h"
 #include "internal.h"
@@ -XXX,XX +XXX,XX @@ static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
     tcg_debug_assert(!(cflags & CF_INVALID));
 
     hash = tb_jmp_cache_hash_func(pc);
-    tb = qatomic_rcu_read(&cpu->tb_jmp_cache[hash]);
+    tb = qatomic_rcu_read(&cpu->tb_jmp_cache->array[hash].tb);
 
     if (likely(tb &&
                tb->pc == pc &&
@@ -XXX,XX +XXX,XX @@ static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
     if (tb == NULL) {
         return NULL;
     }
-    qatomic_set(&cpu->tb_jmp_cache[hash], tb);
+    qatomic_set(&cpu->tb_jmp_cache->array[hash].tb, tb);
     return tb;
 }
 
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
 
             tb = tb_lookup(cpu, pc, cs_base, flags, cflags);
             if (tb == NULL) {
+                uint32_t h;
+
                 mmap_lock();
                 tb = tb_gen_code(cpu, pc, cs_base, flags, cflags);
                 mmap_unlock();
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
                  * We add the TB in the virtual pc hash table
                  * for the fast lookup
                  */
-                qatomic_set(&cpu->tb_jmp_cache[tb_jmp_cache_hash_func(pc)], tb);
+                h = tb_jmp_cache_hash_func(pc);
+                qatomic_set(&cpu->tb_jmp_cache->array[h].tb, tb);
             }
 
 #ifndef CONFIG_USER_ONLY
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_window_reset(CPUTLBDesc *desc, int64_t ns,
 
 static void tb_jmp_cache_clear_page(CPUState *cpu, target_ulong page_addr)
 {
-    unsigned int i, i0 = tb_jmp_cache_hash_page(page_addr);
+    int i, i0 = tb_jmp_cache_hash_page(page_addr);
+    CPUJumpCache *jc = cpu->tb_jmp_cache;
 
     for (i = 0; i < TB_JMP_PAGE_SIZE; i++) {
-        qatomic_set(&cpu->tb_jmp_cache[i0 + i], NULL);
+        qatomic_set(&jc->array[i0 + i].tb, NULL);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_by_mmuidx_async_work(CPUState *cpu, run_on_cpu_data data)
 
     qemu_spin_unlock(&env_tlb(env)->c.lock);
 
-    cpu_tb_jmp_cache_clear(cpu);
+    tcg_flush_jmp_cache(cpu);
 
     if (to_clean == ALL_MMUIDX_BITS) {
         qatomic_set(&env_tlb(env)->c.full_flush_count,
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_range_by_mmuidx_async_0(CPUState *cpu,
      * longer to clear each entry individually than it will to clear it all.
      */
     if (d.len >= (TARGET_PAGE_SIZE * TB_JMP_CACHE_SIZE)) {
-        cpu_tb_jmp_cache_clear(cpu);
+        tcg_flush_jmp_cache(cpu);
         return;
     }
 
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/tcg.h"
 #include "qapi/error.h"
 #include "hw/core/tcg-cpu-ops.h"
+#include "tb-jmp-cache.h"
 #include "tb-hash.h"
 #include "tb-context.h"
 #include "internal.h"
@@ -XXX,XX +XXX,XX @@ static void do_tb_flush(CPUState *cpu, run_on_cpu_data tb_flush_count)
     }
 
     CPU_FOREACH(cpu) {
-        cpu_tb_jmp_cache_clear(cpu);
+        tcg_flush_jmp_cache(cpu);
     }
 
     qht_reset_size(&tb_ctx.htable, CODE_GEN_HTABLE_SIZE);
@@ -XXX,XX +XXX,XX @@ static void do_tb_phys_invalidate(TranslationBlock *tb, bool rm_from_page_list)
     /* remove the TB from the hash list */
     h = tb_jmp_cache_hash_func(tb->pc);
     CPU_FOREACH(cpu) {
-        if (qatomic_read(&cpu->tb_jmp_cache[h]) == tb) {
-            qatomic_set(&cpu->tb_jmp_cache[h], NULL);
+        CPUJumpCache *jc = cpu->tb_jmp_cache;
+        if (qatomic_read(&jc->array[h].tb) == tb) {
+            qatomic_set(&jc->array[h].tb, NULL);
         }
     }
 
@@ -XXX,XX +XXX,XX @@ int page_unprotect(target_ulong address, uintptr_t pc)
 }
 #endif /* CONFIG_USER_ONLY */
 
+/*
+ * Called by generic code at e.g. cpu reset after cpu creation,
+ * therefore we must be prepared to allocate the jump cache.
+ */
+void tcg_flush_jmp_cache(CPUState *cpu)
+{
+    CPUJumpCache *jc = cpu->tb_jmp_cache;
+
+    if (likely(jc)) {
+        for (int i = 0; i < TB_JMP_CACHE_SIZE; i++) {
+            qatomic_set(&jc->array[i].tb, NULL);
+        }
+    } else {
+        /* This should happen once during realize, and thus never race. */
+        jc = g_new0(CPUJumpCache, 1);
+        jc = qatomic_xchg(&cpu->tb_jmp_cache, jc);
+        assert(jc == NULL);
+    }
+}
+
 /* This is a wrapper for common code that can not use CONFIG_SOFTMMU */
 void tcg_flush_softmmu_tlb(CPUState *cs)
 {
diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/cpu-common.c
+++ b/hw/core/cpu-common.c
@@ -XXX,XX +XXX,XX @@ static void cpu_common_reset(DeviceState *dev)
     cpu->cflags_next_tb = -1;
 
     if (tcg_enabled()) {
-        cpu_tb_jmp_cache_clear(cpu);
-
+        tcg_flush_jmp_cache(cpu);
         tcg_flush_softmmu_tlb(cpu);
     }
 }
diff --git a/plugins/core.c b/plugins/core.c
index XXXXXXX..XXXXXXX 100644
--- a/plugins/core.c
+++ b/plugins/core.c
@@ -XXX,XX +XXX,XX @@ struct qemu_plugin_ctx *plugin_id_to_ctx_locked(qemu_plugin_id_t id)
 static void plugin_cpu_update__async(CPUState *cpu, run_on_cpu_data data)
 {
     bitmap_copy(cpu->plugin_mask, &data.host_ulong, QEMU_PLUGIN_EV_MAX);
-    cpu_tb_jmp_cache_clear(cpu);
+    tcg_flush_jmp_cache(cpu);
 }
 
 static void plugin_cpu_update__locked(gpointer k, gpointer v, gpointer udata)
diff --git a/trace/control-target.c b/trace/control-target.c
index XXXXXXX..XXXXXXX 100644
--- a/trace/control-target.c
+++ b/trace/control-target.c
@@ -XXX,XX +XXX,XX @@ static void trace_event_synchronize_vcpu_state_dynamic(
 {
     bitmap_copy(vcpu->trace_dstate, vcpu->trace_dstate_delayed,
                 CPU_TRACE_DSTATE_MAX_EVENTS);
-    cpu_tb_jmp_cache_clear(vcpu);
+    tcg_flush_jmp_cache(vcpu);
 }
 
 void trace_event_set_vcpu_state_dynamic(CPUState *vcpu,
-- 
2.34.1

Populate this new method for all targets.  Always match
the result that would be given by cpu_get_tb_cpu_state,
as we will want these values to correspond in the logs.

Reviewed-by: Taylor Simpson <tsimpson@quicinc.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> (target/sparc)
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
Cc: Eduardo Habkost <eduardo@habkost.net> (supporter:Machine core)
Cc: Marcel Apfelbaum <marcel.apfelbaum@gmail.com> (supporter:Machine core)
Cc: "Philippe Mathieu-Daudé" <f4bug@amsat.org> (reviewer:Machine core)
Cc: Yanan Wang <wangyanan55@huawei.com> (reviewer:Machine core)
Cc: Michael Rolnik <mrolnik@gmail.com> (maintainer:AVR TCG CPUs)
Cc: "Edgar E. Iglesias" <edgar.iglesias@gmail.com> (maintainer:CRIS TCG CPUs)
Cc: Taylor Simpson <tsimpson@quicinc.com> (supporter:Hexagon TCG CPUs)
Cc: Song Gao <gaosong@loongson.cn> (maintainer:LoongArch TCG CPUs)
Cc: Xiaojuan Yang <yangxiaojuan@loongson.cn> (maintainer:LoongArch TCG CPUs)
Cc: Laurent Vivier <laurent@vivier.eu> (maintainer:M68K TCG CPUs)
Cc: Jiaxun Yang <jiaxun.yang@flygoat.com> (reviewer:MIPS TCG CPUs)
Cc: Aleksandar Rikalo <aleksandar.rikalo@syrmia.com> (reviewer:MIPS TCG CPUs)
Cc: Chris Wulff <crwulff@gmail.com> (maintainer:NiosII TCG CPUs)
Cc: Marek Vasut <marex@denx.de> (maintainer:NiosII TCG CPUs)
Cc: Stafford Horne <shorne@gmail.com> (odd fixer:OpenRISC TCG CPUs)
Cc: Yoshinori Sato <ysato@users.sourceforge.jp> (reviewer:RENESAS RX CPUs)
Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> (maintainer:SPARC TCG CPUs)
Cc: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> (maintainer:TriCore TCG CPUs)
Cc: Max Filippov <jcmvbkbc@gmail.com> (maintainer:Xtensa TCG CPUs)
Cc: qemu-arm@nongnu.org (open list:ARM TCG CPUs)
Cc: qemu-ppc@nongnu.org (open list:PowerPC TCG CPUs)
Cc: qemu-riscv@nongnu.org (open list:RISC-V TCG CPUs)
Cc: qemu-s390x@nongnu.org (open list:S390 TCG CPUs)
---
 include/hw/core/cpu.h   |  3 +++
 target/alpha/cpu.c      |  9 +++++++++
 target/arm/cpu.c        | 13 +++++++++++++
 target/avr/cpu.c        |  8 ++++++++
 target/cris/cpu.c       |  8 ++++++++
 target/hexagon/cpu.c    |  8 ++++++++
 target/hppa/cpu.c       |  8 ++++++++
 target/i386/cpu.c       |  9 +++++++++
 target/loongarch/cpu.c  |  9 +++++++++
 target/m68k/cpu.c       |  8 ++++++++
 target/microblaze/cpu.c |  8 ++++++++
 target/mips/cpu.c       |  8 ++++++++
 target/nios2/cpu.c      |  9 +++++++++
 target/openrisc/cpu.c   |  8 ++++++++
 target/ppc/cpu_init.c   |  8 ++++++++
 target/riscv/cpu.c      | 13 +++++++++++++
 target/rx/cpu.c         |  8 ++++++++
 target/s390x/cpu.c      |  8 ++++++++
 target/sh4/cpu.c        |  8 ++++++++
 target/sparc/cpu.c      |  8 ++++++++
 target/tricore/cpu.c    |  9 +++++++++
 target/xtensa/cpu.c     |  8 ++++++++
 22 files changed, 186 insertions(+)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ struct SysemuCPUOps;
  *       If the target behaviour here is anything other than "set
  *       the PC register to the value passed in" then the target must
  *       also implement the synchronize_from_tb hook.
+ * @get_pc: Callback for getting the Program Counter register.
+ *       As above, with the semantics of the target architecture.
  * @gdb_read_register: Callback for letting GDB read a register.
  * @gdb_write_register: Callback for letting GDB write a register.
  * @gdb_adjust_breakpoint: Callback for adjusting the address of a
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     void (*dump_state)(CPUState *cpu, FILE *, int flags);
     int64_t (*get_arch_id)(CPUState *cpu);
     void (*set_pc)(CPUState *cpu, vaddr value);
+    vaddr (*get_pc)(CPUState *cpu);
     int (*gdb_read_register)(CPUState *cpu, GByteArray *buf, int reg);
     int (*gdb_write_register)(CPUState *cpu, uint8_t *buf, int reg);
     vaddr (*gdb_adjust_breakpoint)(CPUState *cpu, vaddr addr);
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.pc = value;
 }
 
+static vaddr alpha_cpu_get_pc(CPUState *cs)
+{
+    AlphaCPU *cpu = ALPHA_CPU(cs);
+
+    return cpu->env.pc;
+}
+
+
 static bool alpha_cpu_has_work(CPUState *cs)
 {
     /* Here we are checking to see if the CPU should wake up from HALT.
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
     cc->has_work = alpha_cpu_has_work;
     cc->dump_state = alpha_cpu_dump_state;
     cc->set_pc = alpha_cpu_set_pc;
+    cc->get_pc = alpha_cpu_get_pc;
     cc->gdb_read_register = alpha_cpu_gdb_read_register;
     cc->gdb_write_register = alpha_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_set_pc(CPUState *cs, vaddr value)
     }
 }
 
+static vaddr arm_cpu_get_pc(CPUState *cs)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
+
+    if (is_a64(env)) {
+        return env->pc;
+    } else {
+        return env->regs[15];
+    }
+}
+
 #ifdef CONFIG_TCG
 void arm_cpu_synchronize_from_tb(CPUState *cs,
                                  const TranslationBlock *tb)
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->has_work = arm_cpu_has_work;
     cc->dump_state = arm_cpu_dump_state;
     cc->set_pc = arm_cpu_set_pc;
+    cc->get_pc = arm_cpu_get_pc;
     cc->gdb_read_register = arm_cpu_gdb_read_register;
     cc->gdb_write_register = arm_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.pc_w = value / 2; /* internally PC points to words */
 }
 
+static vaddr avr_cpu_get_pc(CPUState *cs)
+{
+    AVRCPU *cpu = AVR_CPU(cs);
+
+    return cpu->env.pc_w * 2;
+}
+
 static bool avr_cpu_has_work(CPUState *cs)
 {
     AVRCPU *cpu = AVR_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
     cc->has_work = avr_cpu_has_work;
     cc->dump_state = avr_cpu_dump_state;
     cc->set_pc = avr_cpu_set_pc;
+    cc->get_pc = avr_cpu_get_pc;
     dc->vmsd = &vms_avr_cpu;
     cc->sysemu_ops = &avr_sysemu_ops;
     cc->disas_set_info = avr_cpu_disas_set_info;
diff --git a/target/cris/cpu.c b/target/cris/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/cpu.c
+++ b/target/cris/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.pc = value;
 }
 
+static vaddr cris_cpu_get_pc(CPUState *cs)
+{
+    CRISCPU *cpu = CRIS_CPU(cs);
+
+    return cpu->env.pc;
+}
+
 static bool cris_cpu_has_work(CPUState *cs)
 {
     return cs->interrupt_request & (CPU_INTERRUPT_HARD | CPU_INTERRUPT_NMI);
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
     cc->has_work = cris_cpu_has_work;
     cc->dump_state = cris_cpu_dump_state;
     cc->set_pc = cris_cpu_set_pc;
+    cc->get_pc = cris_cpu_get_pc;
     cc->gdb_read_register = cris_cpu_gdb_read_register;
     cc->gdb_write_register = cris_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/cpu.c
+++ b/target/hexagon/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hexagon_cpu_set_pc(CPUState *cs, vaddr value)
     env->gpr[HEX_REG_PC] = value;
 }
 
+static vaddr hexagon_cpu_get_pc(CPUState *cs)
+{
+    HexagonCPU *cpu = HEXAGON_CPU(cs);
+    CPUHexagonState *env = &cpu->env;
+    return env->gpr[HEX_REG_PC];
+}
+
 static void hexagon_cpu_synchronize_from_tb(CPUState *cs,
                                             const TranslationBlock *tb)
 {
@@ -XXX,XX +XXX,XX @@ static void hexagon_cpu_class_init(ObjectClass *c, void *data)
     cc->has_work = hexagon_cpu_has_work;
     cc->dump_state = hexagon_dump_state;
     cc->set_pc = hexagon_cpu_set_pc;
+    cc->get_pc = hexagon_cpu_get_pc;
     cc->gdb_read_register = hexagon_gdb_read_register;
     cc->gdb_write_register = hexagon_gdb_write_register;
     cc->gdb_num_core_regs = TOTAL_PER_THREAD_REGS + NUM_VREGS + NUM_QREGS;
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.iaoq_b = value + 4;
 }
 
+static vaddr hppa_cpu_get_pc(CPUState *cs)
+{
+    HPPACPU *cpu = HPPA_CPU(cs);
+
+    return cpu->env.iaoq_f;
+}
+
 static void hppa_cpu_synchronize_from_tb(CPUState *cs,
                                          const TranslationBlock *tb)
 {
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
     cc->has_work = hppa_cpu_has_work;
     cc->dump_state = hppa_cpu_dump_state;
     cc->set_pc = hppa_cpu_set_pc;
+    cc->get_pc = hppa_cpu_get_pc;
     cc->gdb_read_register = hppa_cpu_gdb_read_register;
     cc->gdb_write_register = hppa_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -XXX,XX +XXX,XX @@ static void x86_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.eip = value;
 }
 
+static vaddr x86_cpu_get_pc(CPUState *cs)
+{
+    X86CPU *cpu = X86_CPU(cs);
+
+    /* Match cpu_get_tb_cpu_state. */
+    return cpu->env.eip + cpu->env.segs[R_CS].base;
+}
+
 int x86_cpu_pending_interrupt(CPUState *cs, int interrupt_request)
 {
     X86CPU *cpu = X86_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static void x86_cpu_common_class_init(ObjectClass *oc, void *data)
     cc->has_work = x86_cpu_has_work;
     cc->dump_state = x86_cpu_dump_state;
     cc->set_pc = x86_cpu_set_pc;
+    cc->get_pc = x86_cpu_get_pc;
     cc->gdb_read_register = x86_cpu_gdb_read_register;
     cc->gdb_write_register = x86_cpu_gdb_write_register;
     cc->get_arch_id = x86_cpu_get_arch_id;
diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -XXX,XX +XXX,XX @@ static void loongarch_cpu_set_pc(CPUState *cs, vaddr value)
     env->pc = value;
 }
 
+static vaddr loongarch_cpu_get_pc(CPUState *cs)
+{
+    LoongArchCPU *cpu = LOONGARCH_CPU(cs);
+    CPULoongArchState *env = &cpu->env;
+
+    return env->pc;
+}
+
 #ifndef CONFIG_USER_ONLY
 #include "hw/loongarch/virt.h"
 
@@ -XXX,XX +XXX,XX @@ static void loongarch_cpu_class_init(ObjectClass *c, void *data)
     cc->has_work = loongarch_cpu_has_work;
     cc->dump_state = loongarch_cpu_dump_state;
     cc->set_pc = loongarch_cpu_set_pc;
+    cc->get_pc = loongarch_cpu_get_pc;
 #ifndef CONFIG_USER_ONLY
     dc->vmsd = &vmstate_loongarch_cpu;
     cc->sysemu_ops = &loongarch_sysemu_ops;
diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.pc = value;
 }
 
+static vaddr m68k_cpu_get_pc(CPUState *cs)
+{
+    M68kCPU *cpu = M68K_CPU(cs);
+
+    return cpu->env.pc;
+}
+
 static bool m68k_cpu_has_work(CPUState *cs)
 {
     return cs->interrupt_request & CPU_INTERRUPT_HARD;
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
     cc->has_work = m68k_cpu_has_work;
     cc->dump_state = m68k_cpu_dump_state;
     cc->set_pc = m68k_cpu_set_pc;
+    cc->get_pc = m68k_cpu_get_pc;
     cc->gdb_read_register = m68k_cpu_gdb_read_register;
     cc->gdb_write_register = m68k_cpu_gdb_write_register;
 #if defined(CONFIG_SOFTMMU)
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.iflags = 0;
 }
 
+static vaddr mb_cpu_get_pc(CPUState *cs)
+{
+    MicroBlazeCPU *cpu = MICROBLAZE_CPU(cs);
+
+    return cpu->env.pc;
+}
+
 static void mb_cpu_synchronize_from_tb(CPUState *cs,
                                        const TranslationBlock *tb)
 {
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->dump_state = mb_cpu_dump_state;
     cc->set_pc = mb_cpu_set_pc;
+    cc->get_pc = mb_cpu_get_pc;
     cc->gdb_read_register = mb_cpu_gdb_read_register;
     cc->gdb_write_register = mb_cpu_gdb_write_register;
 
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_set_pc(CPUState *cs, vaddr value)
     mips_env_set_pc(&cpu->env, value);
 }
 
+static vaddr mips_cpu_get_pc(CPUState *cs)
+{
+    MIPSCPU *cpu = MIPS_CPU(cs);
+
+    return cpu->env.active_tc.PC;
+}
+
 static bool mips_cpu_has_work(CPUState *cs)
 {
     MIPSCPU *cpu = MIPS_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->has_work = mips_cpu_has_work;
     cc->dump_state = mips_cpu_dump_state;
     cc->set_pc = mips_cpu_set_pc;
+    cc->get_pc = mips_cpu_get_pc;
     cc->gdb_read_register = mips_cpu_gdb_read_register;
     cc->gdb_write_register = mips_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/cpu.c
+++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_set_pc(CPUState *cs, vaddr value)
     env->pc = value;
 }
 
+static vaddr nios2_cpu_get_pc(CPUState *cs)
+{
+    Nios2CPU *cpu = NIOS2_CPU(cs);
+    CPUNios2State *env = &cpu->env;
+
+    return env->pc;
+}
+
 static bool nios2_cpu_has_work(CPUState *cs)
 {
     return cs->interrupt_request & CPU_INTERRUPT_HARD;
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
     cc->has_work = nios2_cpu_has_work;
     cc->dump_state = nios2_cpu_dump_state;
     cc->set_pc = nios2_cpu_set_pc;
+    cc->get_pc = nios2_cpu_get_pc;
     cc->disas_set_info = nios2_cpu_disas_set_info;
 #ifndef CONFIG_USER_ONLY
     cc->sysemu_ops = &nios2_sysemu_ops;
diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.dflag = 0;
 }
 
+static vaddr openrisc_cpu_get_pc(CPUState *cs)
+{
+    OpenRISCCPU *cpu = OPENRISC_CPU(cs);
+
+    return cpu->env.pc;
+}
+
 static void openrisc_cpu_synchronize_from_tb(CPUState *cs,
                                              const TranslationBlock *tb)
 {
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
     cc->has_work = openrisc_cpu_has_work;
     cc->dump_state = openrisc_cpu_dump_state;
     cc->set_pc = openrisc_cpu_set_pc;
+    cc->get_pc = openrisc_cpu_get_pc;
     cc->gdb_read_register = openrisc_cpu_gdb_read_register;
     cc->gdb_write_register = openrisc_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.nip = value;
 }
 
+static vaddr ppc_cpu_get_pc(CPUState *cs)
+{
+    PowerPCCPU *cpu = POWERPC_CPU(cs);
+
+    return cpu->env.nip;
+}
+
 static bool ppc_cpu_has_work(CPUState *cs)
 {
     PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
     cc->has_work = ppc_cpu_has_work;
     cc->dump_state = ppc_cpu_dump_state;
     cc->set_pc = ppc_cpu_set_pc;
+    cc->get_pc = ppc_cpu_get_pc;
     cc->gdb_read_register = ppc_cpu_gdb_read_register;
     cc->gdb_write_register = ppc_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_set_pc(CPUState *cs, vaddr value)
     }
 }
 
+static vaddr riscv_cpu_get_pc(CPUState *cs)
+{
+    RISCVCPU *cpu = RISCV_CPU(cs);
+    CPURISCVState *env = &cpu->env;
+
+    /* Match cpu_get_tb_cpu_state. */
+    if (env->xl == MXL_RV32) {
+        return env->pc & UINT32_MAX;
+    }
+    return env->pc;
+}
+
 static void riscv_cpu_synchronize_from_tb(CPUState *cs,
                                           const TranslationBlock *tb)
 {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     cc->has_work = riscv_cpu_has_work;
     cc->dump_state = riscv_cpu_dump_state;
     cc->set_pc = riscv_cpu_set_pc;
+    cc->get_pc = riscv_cpu_get_pc;
     cc->gdb_read_register = riscv_cpu_gdb_read_register;
     cc->gdb_write_register = riscv_cpu_gdb_write_register;
     cc->gdb_num_core_regs = 33;
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.pc = value;
 }
 
+static vaddr rx_cpu_get_pc(CPUState *cs)
+{
+    RXCPU *cpu = RX_CPU(cs);
+
+    return cpu->env.pc;
+}
+
 static void rx_cpu_synchronize_from_tb(CPUState *cs,
                                        const TranslationBlock *tb)
 {
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
     cc->has_work = rx_cpu_has_work;
     cc->dump_state = rx_cpu_dump_state;
     cc->set_pc = rx_cpu_set_pc;
+    cc->get_pc = rx_cpu_get_pc;
 
 #ifndef CONFIG_USER_ONLY
     cc->sysemu_ops = &rx_sysemu_ops;
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.psw.addr = value;
 }
 
+static vaddr s390_cpu_get_pc(CPUState *cs)
+{
+    S390CPU *cpu = S390_CPU(cs);
+
+    return cpu->env.psw.addr;
+}
+
 static bool s390_cpu_has_work(CPUState *cs)
 {
     S390CPU *cpu = S390_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
     cc->has_work = s390_cpu_has_work;
     cc->dump_state = s390_cpu_dump_state;
     cc->set_pc = s390_cpu_set_pc;
+    cc->get_pc = s390_cpu_get_pc;
     cc->gdb_read_register = s390_cpu_gdb_read_register;
     cc->gdb_write_register = s390_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.pc = value;
 }
 
+static vaddr superh_cpu_get_pc(CPUState *cs)
+{
+    SuperHCPU *cpu = SUPERH_CPU(cs);
+
+    return cpu->env.pc;
+}
+
 static void superh_cpu_synchronize_from_tb(CPUState *cs,
                                            const TranslationBlock *tb)
 {
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
     cc->has_work = superh_cpu_has_work;
     cc->dump_state = superh_cpu_dump_state;
     cc->set_pc = superh_cpu_set_pc;
+    cc->get_pc = superh_cpu_get_pc;
     cc->gdb_read_register = superh_cpu_gdb_read_register;
     cc->gdb_write_register = superh_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.npc = value + 4;
 }
 
+static vaddr sparc_cpu_get_pc(CPUState *cs)
+{
+    SPARCCPU *cpu = SPARC_CPU(cs);
+
+    return cpu->env.pc;
+}
+
 static void sparc_cpu_synchronize_from_tb(CPUState *cs,
                                           const TranslationBlock *tb)
 {
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
     cc->memory_rw_debug = sparc_cpu_memory_rw_debug;
 #endif
     cc->set_pc = sparc_cpu_set_pc;
+    cc->get_pc = sparc_cpu_get_pc;
     cc->gdb_read_register = sparc_cpu_gdb_read_register;
     cc->gdb_write_register = sparc_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_set_pc(CPUState *cs, vaddr value)
     env->PC = value & ~(target_ulong)1;
 }
 
+static vaddr tricore_cpu_get_pc(CPUState *cs)
+{
+    TriCoreCPU *cpu = TRICORE_CPU(cs);
+    CPUTriCoreState *env = &cpu->env;
+
+    return env->PC;
+}
+
 static void tricore_cpu_synchronize_from_tb(CPUState *cs,
                                             const TranslationBlock *tb)
 {
@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_class_init(ObjectClass *c, void *data)
 
     cc->dump_state = tricore_cpu_dump_state;
     cc->set_pc = tricore_cpu_set_pc;
+    cc->get_pc = tricore_cpu_get_pc;
     cc->sysemu_ops = &tricore_sysemu_ops;
     cc->tcg_ops = &tricore_tcg_ops;
 }
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.pc = value;
 }
 
+static vaddr xtensa_cpu_get_pc(CPUState *cs)
+{
+    XtensaCPU *cpu = XTENSA_CPU(cs);
+
+    return cpu->env.pc;
+}
+
 static bool xtensa_cpu_has_work(CPUState *cs)
 {
 #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
     cc->has_work = xtensa_cpu_has_work;
     cc->dump_state = xtensa_cpu_dump_state;
     cc->set_pc = xtensa_cpu_set_pc;
+    cc->get_pc = xtensa_cpu_get_pc;
     cc->gdb_read_register = xtensa_cpu_gdb_read_register;
     cc->gdb_write_register = xtensa_cpu_gdb_write_register;
     cc->gdb_stop_before_watchpoint = true;
-- 
2.34.1

The availability of tb->pc will shortly be conditional.
Introduce accessor functions to minimize ifdefs.

Pass around a known pc to places like tcg_gen_code,
where the caller must already have the value.

diff --git a/accel/tcg/internal.h b/accel/tcg/internal.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/internal.h
+++ b/accel/tcg/internal.h
@@ -XXX,XX +XXX,XX @@ G_NORETURN void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr);
 void page_init(void);
 void tb_htable_init(void);
 
+/* Return the current PC from CPU, which may be cached in TB. */
+static inline target_ulong log_pc(CPUState *cpu, const TranslationBlock *tb)
+{
+    return tb_pc(tb);
+}
+
 #endif /* ACCEL_TCG_INTERNAL_H */
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ struct TranslationBlock {
     uintptr_t jmp_dest[2];
 };
 
+/* Hide the read to avoid ifdefs for TARGET_TB_PCREL. */
+static inline target_ulong tb_pc(const TranslationBlock *tb)
+{
+    return tb->pc;
+}
+
 /* Hide the qatomic_read to make code a little easier on the eyes */
 static inline uint32_t tb_cflags(const TranslationBlock *tb)
 {
diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ void tcg_register_thread(void);
 void tcg_prologue_init(TCGContext *s);
 void tcg_func_start(TCGContext *s);
 
-int tcg_gen_code(TCGContext *s, TranslationBlock *tb);
+int tcg_gen_code(TCGContext *s, TranslationBlock *tb, target_ulong pc_start);
 
 void tcg_set_frame(TCGContext *s, TCGReg reg, intptr_t start, intptr_t size);
 
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static bool tb_lookup_cmp(const void *p, const void *d)
     const TranslationBlock *tb = p;
     const struct tb_desc *desc = d;
 
-    if (tb->pc == desc->pc &&
+    if (tb_pc(tb) == desc->pc &&
         tb->page_addr[0] == desc->page_addr0 &&
         tb->cs_base == desc->cs_base &&
         tb->flags == desc->flags &&
@@ -XXX,XX +XXX,XX @@ static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
     return tb;
 }
 
-static inline void log_cpu_exec(target_ulong pc, CPUState *cpu,
-                                const TranslationBlock *tb)
+static void log_cpu_exec(target_ulong pc, CPUState *cpu,
+                         const TranslationBlock *tb)
 {
-    if (unlikely(qemu_loglevel_mask(CPU_LOG_TB_CPU | CPU_LOG_EXEC))
-        && qemu_log_in_addr_range(pc)) {
-
+    if (qemu_log_in_addr_range(pc)) {
         qemu_log_mask(CPU_LOG_EXEC,
                       "Trace %d: %p [" TARGET_FMT_lx
                       "/" TARGET_FMT_lx "/%08x/%08x] %s\n",
@@ -XXX,XX +XXX,XX @@ const void *HELPER(lookup_tb_ptr)(CPUArchState *env)
         return tcg_code_gen_epilogue;
     }
 
-    log_cpu_exec(pc, cpu, tb);
+    if (qemu_loglevel_mask(CPU_LOG_TB_CPU | CPU_LOG_EXEC)) {
+        log_cpu_exec(pc, cpu, tb);
+    }
 
     return tb->tc.ptr;
 }
@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
     TranslationBlock *last_tb;
     const void *tb_ptr = itb->tc.ptr;
 
-    log_cpu_exec(itb->pc, cpu, itb);
+    if (qemu_loglevel_mask(CPU_LOG_TB_CPU | CPU_LOG_EXEC)) {
+        log_cpu_exec(log_pc(cpu, itb), cpu, itb);
+    }
 
     qemu_thread_jit_execute();
     ret = tcg_qemu_tb_exec(env, tb_ptr);
@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
          * of the start of the TB.
          */
         CPUClass *cc = CPU_GET_CLASS(cpu);
-        qemu_log_mask_and_addr(CPU_LOG_EXEC, last_tb->pc,
-                               "Stopped execution of TB chain before %p ["
-                               TARGET_FMT_lx "] %s\n",
-                               last_tb->tc.ptr, last_tb->pc,
-                               lookup_symbol(last_tb->pc));
+
         if (cc->tcg_ops->synchronize_from_tb) {
             cc->tcg_ops->synchronize_from_tb(cpu, last_tb);
         } else {
             assert(cc->set_pc);
-            cc->set_pc(cpu, last_tb->pc);
+            cc->set_pc(cpu, tb_pc(last_tb));
+        }
+        if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
+            target_ulong pc = log_pc(cpu, last_tb);
+            if (qemu_log_in_addr_range(pc)) {
+                qemu_log("Stopped execution of TB chain before %p ["
+                         TARGET_FMT_lx "] %s\n",
+                         last_tb->tc.ptr, pc, lookup_symbol(pc));
+            }
         }
     }
 
@@ -XXX,XX +XXX,XX @@ static inline void tb_add_jump(TranslationBlock *tb, int n,
 
     qemu_spin_unlock(&tb_next->jmp_lock);
 
-    qemu_log_mask_and_addr(CPU_LOG_EXEC, tb->pc,
-                           "Linking TBs %p [" TARGET_FMT_lx
-                           "] index %d -> %p [" TARGET_FMT_lx "]\n",
-                           tb->tc.ptr, tb->pc, n,
-                           tb_next->tc.ptr, tb_next->pc);
+    qemu_log_mask(CPU_LOG_EXEC, "Linking TBs %p index %d -> %p\n",
+                  tb->tc.ptr, n, tb_next->tc.ptr);
     return;
 
  out_unlock_next:
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
 }
 
 static inline void cpu_loop_exec_tb(CPUState *cpu, TranslationBlock *tb,
+                                    target_ulong pc,
                                     TranslationBlock **last_tb, int *tb_exit)
 {
     int32_t insns_left;
 
-    trace_exec_tb(tb, tb->pc);
+    trace_exec_tb(tb, pc);
     tb = cpu_tb_exec(cpu, tb, tb_exit);
     if (*tb_exit != TB_EXIT_REQUESTED) {
         *last_tb = tb;
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
                 tb_add_jump(last_tb, tb_exit, tb);
             }
 
-            cpu_loop_exec_tb(cpu, tb, &last_tb, &tb_exit);
+            cpu_loop_exec_tb(cpu, tb, pc, &last_tb, &tb_exit);
 
             /* Try to align the host and virtual clocks
                if the guest is in advance */
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ static int encode_search(TranslationBlock *tb, uint8_t *block)
 
         for (j = 0; j < TARGET_INSN_START_WORDS; ++j) {
             if (i == 0) {
-                prev = (j == 0 ? tb->pc : 0);
+                prev = (j == 0 ? tb_pc(tb) : 0);
             } else {
                 prev = tcg_ctx->gen_insn_data[i - 1][j];
             }
@@ -XXX,XX +XXX,XX @@ static int encode_search(TranslationBlock *tb, uint8_t *block)
 static int cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
                                      uintptr_t searched_pc, bool reset_icount)
 {
-    target_ulong data[TARGET_INSN_START_WORDS] = { tb->pc };
+    target_ulong data[TARGET_INSN_START_WORDS] = { tb_pc(tb) };
     uintptr_t host_pc = (uintptr_t)tb->tc.ptr;
     CPUArchState *env = cpu->env_ptr;
     const uint8_t *p = tb->tc.ptr + tb->tc.size;
@@ -XXX,XX +XXX,XX @@ static bool tb_cmp(const void *ap, const void *bp)
     const TranslationBlock *a = ap;
     const TranslationBlock *b = bp;
 
-    return a->pc == b->pc &&
+    return tb_pc(a) == tb_pc(b) &&
         a->cs_base == b->cs_base &&
         a->flags == b->flags &&
         (tb_cflags(a) & ~CF_INVALID) == (tb_cflags(b) & ~CF_INVALID) &&
@@ -XXX,XX +XXX,XX @@ static void do_tb_invalidate_check(void *p, uint32_t hash, void *userp)
     TranslationBlock *tb = p;
     target_ulong addr = *(target_ulong *)userp;
 
-    if (!(addr + TARGET_PAGE_SIZE <= tb->pc || addr >= tb->pc + tb->size)) {
+    if (!(addr + TARGET_PAGE_SIZE <= tb_pc(tb) ||
+          addr >= tb_pc(tb) + tb->size)) {
         printf("ERROR invalidate: address=" TARGET_FMT_lx
-               " PC=%08lx size=%04x\n", addr, (long)tb->pc, tb->size);
+               " PC=%08lx size=%04x\n", addr, (long)tb_pc(tb), tb->size);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void do_tb_page_check(void *p, uint32_t hash, void *userp)
     TranslationBlock *tb = p;
     int flags1, flags2;
 
-    flags1 = page_get_flags(tb->pc);
-    flags2 = page_get_flags(tb->pc + tb->size - 1);
+    flags1 = page_get_flags(tb_pc(tb));
+    flags2 = page_get_flags(tb_pc(tb) + tb->size - 1);
     if ((flags1 & PAGE_WRITE) || (flags2 & PAGE_WRITE)) {
         printf("ERROR page flags: PC=%08lx size=%04x f1=%x f2=%x\n",
-               (long)tb->pc, tb->size, flags1, flags2);
+               (long)tb_pc(tb), tb->size, flags1, flags2);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void do_tb_phys_invalidate(TranslationBlock *tb, bool rm_from_page_list)
 
     /* remove the TB from the hash list */
     phys_pc = tb->page_addr[0];
-    h = tb_hash_func(phys_pc, tb->pc, tb->flags, orig_cflags,
+    h = tb_hash_func(phys_pc, tb_pc(tb), tb->flags, orig_cflags,
                      tb->trace_vcpu_dstate);
     if (!qht_remove(&tb_ctx.htable, tb, h)) {
         return;
@@ -XXX,XX +XXX,XX @@ tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
     }
 
     /* add in the hash table */
-    h = tb_hash_func(phys_pc, tb->pc, tb->flags, tb->cflags,
+    h = tb_hash_func(phys_pc, tb_pc(tb), tb->flags, tb->cflags,
                      tb->trace_vcpu_dstate);
     qht_insert(&tb_ctx.htable, tb, h, &existing_tb);
 
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     tcg_ctx->cpu = NULL;
     max_insns = tb->icount;
 
-    trace_translate_block(tb, tb->pc, tb->tc.ptr);
+    trace_translate_block(tb, pc, tb->tc.ptr);
 
     /* generate machine code */
     tb->jmp_reset_offset[0] = TB_JMP_RESET_OFFSET_INVALID;
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     ti = profile_getclock();
 #endif
 
-    gen_code_size = tcg_gen_code(tcg_ctx, tb);
+    gen_code_size = tcg_gen_code(tcg_ctx, tb, pc);
     if (unlikely(gen_code_size < 0)) {
  error_return:
         switch (gen_code_size) {
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
 
 #ifdef DEBUG_DISAS
     if (qemu_loglevel_mask(CPU_LOG_TB_OUT_ASM) &&
-        qemu_log_in_addr_range(tb->pc)) {
+        qemu_log_in_addr_range(pc)) {
         FILE *logfile = qemu_log_trylock();
         if (logfile) {
             int code_size, data_size;
@@ -XXX,XX +XXX,XX @@ void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr)
      */
     cpu->cflags_next_tb = curr_cflags(cpu) | CF_MEMI_ONLY | CF_LAST_IO | n;
 
-    qemu_log_mask_and_addr(CPU_LOG_EXEC, tb->pc,
-                           "cpu_io_recompile: rewound execution of TB to "
-                           TARGET_FMT_lx "\n", tb->pc);
+    if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
+        target_ulong pc = log_pc(cpu, tb);
+        if (qemu_log_in_addr_range(pc)) {
+            qemu_log("cpu_io_recompile: rewound execution of TB to "
+                     TARGET_FMT_lx "\n", pc);
+        }
+    }
 
     cpu_loop_exit_noexc(cpu);
 }
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_synchronize_from_tb(CPUState *cs,
      * never possible for an AArch64 TB to chain to an AArch32 TB.
      */
     if (is_a64(env)) {
-        env->pc = tb->pc;
+        env->pc = tb_pc(tb);
     } else {
-        env->regs[15] = tb->pc;
+        env->regs[15] = tb_pc(tb);
     }
 }
 #endif /* CONFIG_TCG */
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_synchronize_from_tb(CPUState *cs,
     AVRCPU *cpu = AVR_CPU(cs);
     CPUAVRState *env = &cpu->env;
 
-    env->pc_w = tb->pc / 2; /* internally PC points to words */
+    env->pc_w = tb_pc(tb) / 2; /* internally PC points to words */
 }
 
 static void avr_cpu_reset(DeviceState *ds)
diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/cpu.c
+++ b/target/hexagon/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hexagon_cpu_synchronize_from_tb(CPUState *cs,
 {
     HexagonCPU *cpu = HEXAGON_CPU(cs);
     CPUHexagonState *env = &cpu->env;
-    env->gpr[HEX_REG_PC] = tb->pc;
+    env->gpr[HEX_REG_PC] = tb_pc(tb);
 }
 
 static bool hexagon_cpu_has_work(CPUState *cs)
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_synchronize_from_tb(CPUState *cs,
     HPPACPU *cpu = HPPA_CPU(cs);
 
 #ifdef CONFIG_USER_ONLY
-    cpu->env.iaoq_f = tb->pc;
+    cpu->env.iaoq_f = tb_pc(tb);
     cpu->env.iaoq_b = tb->cs_base;
 #else
     /* Recover the IAOQ values from the GVA + PRIV.  */
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_synchronize_from_tb(CPUState *cs,
     int32_t diff = cs_base;
 
     cpu->env.iasq_f = iasq_f;
-    cpu->env.iaoq_f = (tb->pc & ~iasq_f) + priv;
+    cpu->env.iaoq_f = (tb_pc(tb) & ~iasq_f) + priv;
     if (diff) {
         cpu->env.iaoq_b = cpu->env.iaoq_f + diff;
     }
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void x86_cpu_synchronize_from_tb(CPUState *cs,
 {
     X86CPU *cpu = X86_CPU(cs);
 
-    cpu->env.eip = tb->pc - tb->cs_base;
+    cpu->env.eip = tb_pc(tb) - tb->cs_base;
 }
 
 #ifndef CONFIG_USER_ONLY
diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -XXX,XX +XXX,XX @@ static void loongarch_cpu_synchronize_from_tb(CPUState *cs,
     LoongArchCPU *cpu = LOONGARCH_CPU(cs);
     CPULoongArchState *env = &cpu->env;
 
-    env->pc = tb->pc;
+    env->pc = tb_pc(tb);
 }
 #endif /* CONFIG_TCG */
 
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_synchronize_from_tb(CPUState *cs,
 {
     MicroBlazeCPU *cpu = MICROBLAZE_CPU(cs);
 
-    cpu->env.pc = tb->pc;
+    cpu->env.pc = tb_pc(tb);
     cpu->env.iflags = tb->flags & IFLAGS_TB_MASK;
 }
 
diff --git a/target/mips/tcg/exception.c b/target/mips/tcg/exception.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/exception.c
+++ b/target/mips/tcg/exception.c
@@ -XXX,XX +XXX,XX @@ void mips_cpu_synchronize_from_tb(CPUState *cs, const TranslationBlock *tb)
     MIPSCPU *cpu = MIPS_CPU(cs);
     CPUMIPSState *env = &cpu->env;
 
-    env->active_tc.PC = tb->pc;
+    env->active_tc.PC = tb_pc(tb);
     env->hflags &= ~MIPS_HFLAG_BMASK;
     env->hflags |= tb->flags & MIPS_HFLAG_BMASK;
 }
diff --git a/target/mips/tcg/sysemu/special_helper.c b/target/mips/tcg/sysemu/special_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/sysemu/special_helper.c
+++ b/target/mips/tcg/sysemu/special_helper.c
@@ -XXX,XX +XXX,XX @@ bool mips_io_recompile_replay_branch(CPUState *cs, const TranslationBlock *tb)
     CPUMIPSState *env = &cpu->env;
 
     if ((env->hflags & MIPS_HFLAG_BMASK) != 0
-        && env->active_tc.PC != tb->pc) {
+        && env->active_tc.PC != tb_pc(tb)) {
         env->active_tc.PC -= (env->hflags & MIPS_HFLAG_B16 ? 2 : 4);
         env->hflags &= ~MIPS_HFLAG_BMASK;
         return true;
diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_synchronize_from_tb(CPUState *cs,
 {
     OpenRISCCPU *cpu = OPENRISC_CPU(cs);
 
-    cpu->env.pc = tb->pc;
+    cpu->env.pc = tb_pc(tb);
 }
 
 
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_synchronize_from_tb(CPUState *cs,
     RISCVMXL xl = FIELD_EX32(tb->flags, TB_FLAGS, XL);
 
     if (xl == MXL_RV32) {
-        env->pc = (int32_t)tb->pc;
+        env->pc = (int32_t)tb_pc(tb);
     } else {
-        env->pc = tb->pc;
+        env->pc = tb_pc(tb);
     }
 }
 
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_synchronize_from_tb(CPUState *cs,
 {
     RXCPU *cpu = RX_CPU(cs);
 
-    cpu->env.pc = tb->pc;
+    cpu->env.pc = tb_pc(tb);
 }
 
 static bool rx_cpu_has_work(CPUState *cs)
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_synchronize_from_tb(CPUState *cs,
 {
     SuperHCPU *cpu = SUPERH_CPU(cs);
 
-    cpu->env.pc = tb->pc;
+    cpu->env.pc = tb_pc(tb);
     cpu->env.flags = tb->flags & TB_FLAG_ENVFLAGS_MASK;
 }
 
@@ -XXX,XX +XXX,XX @@ static bool superh_io_recompile_replay_branch(CPUState *cs,
     CPUSH4State *env = &cpu->env;
 
     if ((env->flags & ((DELAY_SLOT | DELAY_SLOT_CONDITIONAL))) != 0
-        && env->pc != tb->pc) {
+        && env->pc != tb_pc(tb)) {
         env->pc -= 2;
         env->flags &= ~(DELAY_SLOT | DELAY_SLOT_CONDITIONAL);
         return true;
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_synchronize_from_tb(CPUState *cs,
 {
     SPARCCPU *cpu = SPARC_CPU(cs);
 
-    cpu->env.pc = tb->pc;
+    cpu->env.pc = tb_pc(tb);
     cpu->env.npc = tb->cs_base;
 }
 
diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_synchronize_from_tb(CPUState *cs,
     TriCoreCPU *cpu = TRICORE_CPU(cs);
     CPUTriCoreState *env = &cpu->env;
 
-    env->PC = tb->pc;
+    env->PC = tb_pc(tb);
 }
 
 static void tricore_cpu_reset(DeviceState *dev)
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ int64_t tcg_cpu_exec_time(void)
 #endif
 
 
-int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
+int tcg_gen_code(TCGContext *s, TranslationBlock *tb, target_ulong pc_start)
 {
 #ifdef CONFIG_PROFILER
     TCGProfile *prof = &s->prof;
@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
 
 #ifdef DEBUG_DISAS
     if (unlikely(qemu_loglevel_mask(CPU_LOG_TB_OP)
-                 && qemu_log_in_addr_range(tb->pc))) {
+                 && qemu_log_in_addr_range(pc_start))) {
         FILE *logfile = qemu_log_trylock();
         if (logfile) {
             fprintf(logfile, "OP:\n");
@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
     if (s->nb_indirects > 0) {
 #ifdef DEBUG_DISAS
         if (unlikely(qemu_loglevel_mask(CPU_LOG_TB_OP_IND)
-                     && qemu_log_in_addr_range(tb->pc))) {
+                     && qemu_log_in_addr_range(pc_start))) {
             FILE *logfile = qemu_log_trylock();
             if (logfile) {
                 fprintf(logfile, "OP before indirect lowering:\n");
@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
 
 #ifdef DEBUG_DISAS
     if (unlikely(qemu_loglevel_mask(CPU_LOG_TB_OP_OPT)
-                 && qemu_log_in_addr_range(tb->pc))) {
+                 && qemu_log_in_addr_range(pc_start))) {
         FILE *logfile = qemu_log_trylock();
         if (logfile) {
             fprintf(logfile, "OP after optimization and liveness analysis:\n");
-- 
2.34.1

Prepare for targets to be able to produce TBs that can
run in more than one virtual context.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/internal.h      |  4 +++
 accel/tcg/tb-jmp-cache.h  | 41 +++++++++++++++++++++++++
 include/exec/cpu-defs.h   |  3 ++
 include/exec/exec-all.h   | 32 ++++++++++++++++++--
 accel/tcg/cpu-exec.c      | 16 ++++++----
 accel/tcg/translate-all.c | 64 ++++++++++++++++++++++++++-------------
 6 files changed, 131 insertions(+), 29 deletions(-)

diff --git a/accel/tcg/internal.h b/accel/tcg/internal.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/internal.h
+++ b/accel/tcg/internal.h
@@ -XXX,XX +XXX,XX @@ void tb_htable_init(void);
 /* Return the current PC from CPU, which may be cached in TB. */
 static inline target_ulong log_pc(CPUState *cpu, const TranslationBlock *tb)
 {
+#if TARGET_TB_PCREL
+    return cpu->cc->get_pc(cpu);
+#else
     return tb_pc(tb);
+#endif
 }
 
 #endif /* ACCEL_TCG_INTERNAL_H */
diff --git a/accel/tcg/tb-jmp-cache.h b/accel/tcg/tb-jmp-cache.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tb-jmp-cache.h
+++ b/accel/tcg/tb-jmp-cache.h
@@ -XXX,XX +XXX,XX @@
 
 /*
  * Accessed in parallel; all accesses to 'tb' must be atomic.
+ * For TARGET_TB_PCREL, accesses to 'pc' must be protected by
+ * a load_acquire/store_release to 'tb'.
  */
 struct CPUJumpCache {
     struct {
         TranslationBlock *tb;
+#if TARGET_TB_PCREL
+        target_ulong pc;
+#endif
     } array[TB_JMP_CACHE_SIZE];
 };
 
+static inline TranslationBlock *
+tb_jmp_cache_get_tb(CPUJumpCache *jc, uint32_t hash)
+{
+#if TARGET_TB_PCREL
+    /* Use acquire to ensure current load of pc from jc. */
+    return qatomic_load_acquire(&jc->array[hash].tb);
+#else
+    /* Use rcu_read to ensure current load of pc from *tb. */
+    return qatomic_rcu_read(&jc->array[hash].tb);
+#endif
+}
+
+static inline target_ulong
+tb_jmp_cache_get_pc(CPUJumpCache *jc, uint32_t hash, TranslationBlock *tb)
+{
+#if TARGET_TB_PCREL
+    return jc->array[hash].pc;
+#else
+    return tb_pc(tb);
+#endif
+}
+
+static inline void
+tb_jmp_cache_set(CPUJumpCache *jc, uint32_t hash,
+                 TranslationBlock *tb, target_ulong pc)
+{
+#if TARGET_TB_PCREL
+    jc->array[hash].pc = pc;
+    /* Use store_release on tb to ensure pc is written first. */
+    qatomic_store_release(&jc->array[hash].tb, tb);
+#else
+    /* Use the pc value already stored in tb->pc. */
+    qatomic_set(&jc->array[hash].tb, tb);
+#endif
+}
+
 #endif /* ACCEL_TCG_TB_JMP_CACHE_H */
diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -XXX,XX +XXX,XX @@
 #  error TARGET_PAGE_BITS must be defined in cpu-param.h
 # endif
 #endif
+#ifndef TARGET_TB_PCREL
+# define TARGET_TB_PCREL 0
+#endif
 
 #define TARGET_LONG_SIZE (TARGET_LONG_BITS / 8)
 
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ struct tb_tc {
 };
 
 struct TranslationBlock {
-    target_ulong pc;   /* simulated PC corresponding to this block (EIP + CS base) */
-    target_ulong cs_base; /* CS base for this block */
+#if !TARGET_TB_PCREL
+    /*
+     * Guest PC corresponding to this block.  This must be the true
+     * virtual address.  Therefore e.g. x86 stores EIP + CS_BASE, and
+     * targets like Arm, MIPS, HP-PA, which reuse low bits for ISA or
+     * privilege, must store those bits elsewhere.
+     *
+     * If TARGET_TB_PCREL, the opcodes for the TranslationBlock are
+     * written such that the TB is associated only with the physical
+     * page and may be run in any virtual address context.  In this case,
+     * PC must always be taken from ENV in a target-specific manner.
+     * Unwind information is taken as offsets from the page, to be
+     * deposited into the "current" PC.
+     */
+    target_ulong pc;
+#endif
+
+    /*
+     * Target-specific data associated with the TranslationBlock, e.g.:
+     * x86: the original user, the Code Segment virtual base,
+     * arm: an extension of tb->flags,
+     * s390x: instruction data for EXECUTE,
+     * sparc: the next pc of the instruction queue (for delay slots).
+     */
+    target_ulong cs_base;
+
     uint32_t flags; /* flags defining in which context the code was generated */
     uint32_t cflags;    /* compile flags */
 
@@ -XXX,XX +XXX,XX @@ struct TranslationBlock {
 /* Hide the read to avoid ifdefs for TARGET_TB_PCREL. */
 static inline target_ulong tb_pc(const TranslationBlock *tb)
 {
+#if TARGET_TB_PCREL
+    qemu_build_not_reached();
+#else
     return tb->pc;
+#endif
 }
 
 /* Hide the qatomic_read to make code a little easier on the eyes */
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static bool tb_lookup_cmp(const void *p, const void *d)
     const TranslationBlock *tb = p;
     const struct tb_desc *desc = d;
 
-    if (tb_pc(tb) == desc->pc &&
+    if ((TARGET_TB_PCREL || tb_pc(tb) == desc->pc) &&
         tb->page_addr[0] == desc->page_addr0 &&
         tb->cs_base == desc->cs_base &&
         tb->flags == desc->flags &&
@@ -XXX,XX +XXX,XX @@ static TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
         return NULL;
     }
     desc.page_addr0 = phys_pc;
-    h = tb_hash_func(phys_pc, pc, flags, cflags, *cpu->trace_dstate);
+    h = tb_hash_func(phys_pc, (TARGET_TB_PCREL ? 0 : pc),
+                     flags, cflags, *cpu->trace_dstate);
     return qht_lookup_custom(&tb_ctx.htable, &desc, h, tb_lookup_cmp);
 }
 
@@ -XXX,XX +XXX,XX @@ static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
                                           uint32_t flags, uint32_t cflags)
 {
     TranslationBlock *tb;
+    CPUJumpCache *jc;
     uint32_t hash;
 
     /* we should never be trying to look up an INVALID tb */
     tcg_debug_assert(!(cflags & CF_INVALID));
 
     hash = tb_jmp_cache_hash_func(pc);
-    tb = qatomic_rcu_read(&cpu->tb_jmp_cache->array[hash].tb);
+    jc = cpu->tb_jmp_cache;
+    tb = tb_jmp_cache_get_tb(jc, hash);
 
     if (likely(tb &&
-               tb->pc == pc &&
+               tb_jmp_cache_get_pc(jc, hash, tb) == pc &&
                tb->cs_base == cs_base &&
                tb->flags == flags &&
                tb->trace_vcpu_dstate == *cpu->trace_dstate &&
@@ -XXX,XX +XXX,XX @@ static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
     if (tb == NULL) {
         return NULL;
     }
-    qatomic_set(&cpu->tb_jmp_cache->array[hash].tb, tb);
+    tb_jmp_cache_set(jc, hash, tb, pc);
     return tb;
 }
 
@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
         if (cc->tcg_ops->synchronize_from_tb) {
             cc->tcg_ops->synchronize_from_tb(cpu, last_tb);
         } else {
+            assert(!TARGET_TB_PCREL);
             assert(cc->set_pc);
             cc->set_pc(cpu, tb_pc(last_tb));
         }
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
                  * for the fast lookup
                  */
                 h = tb_jmp_cache_hash_func(pc);
-                qatomic_set(&cpu->tb_jmp_cache->array[h].tb, tb);
+                tb_jmp_cache_set(cpu->tb_jmp_cache, h, tb, pc);
             }
 
 #ifndef CONFIG_USER_ONLY
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ static int encode_search(TranslationBlock *tb, uint8_t *block)
 
         for (j = 0; j < TARGET_INSN_START_WORDS; ++j) {
             if (i == 0) {
-                prev = (j == 0 ? tb_pc(tb) : 0);
+                prev = (!TARGET_TB_PCREL && j == 0 ? tb_pc(tb) : 0);
             } else {
                 prev = tcg_ctx->gen_insn_data[i - 1][j];
             }
@@ -XXX,XX +XXX,XX @@ static int encode_search(TranslationBlock *tb, uint8_t *block)
 static int cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
                                      uintptr_t searched_pc, bool reset_icount)
 {
-    target_ulong data[TARGET_INSN_START_WORDS] = { tb_pc(tb) };
+    target_ulong data[TARGET_INSN_START_WORDS];
     uintptr_t host_pc = (uintptr_t)tb->tc.ptr;
     CPUArchState *env = cpu->env_ptr;
     const uint8_t *p = tb->tc.ptr + tb->tc.size;
@@ -XXX,XX +XXX,XX @@ static int cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
         return -1;
     }
 
+    memset(data, 0, sizeof(data));
+    if (!TARGET_TB_PCREL) {
+        data[0] = tb_pc(tb);
+    }
+
     /* Reconstruct the stored insn data while looking for the point at
        which the end of the insn exceeds the searched_pc.  */
     for (i = 0; i < num_insns; ++i) {
@@ -XXX,XX +XXX,XX @@ static bool tb_cmp(const void *ap, const void *bp)
     const TranslationBlock *a = ap;
     const TranslationBlock *b = bp;
 
-    return tb_pc(a) == tb_pc(b) &&
-        a->cs_base == b->cs_base &&
-        a->flags == b->flags &&
-        (tb_cflags(a) & ~CF_INVALID) == (tb_cflags(b) & ~CF_INVALID) &&
-        a->trace_vcpu_dstate == b->trace_vcpu_dstate &&
-        a->page_addr[0] == b->page_addr[0] &&
-        a->page_addr[1] == b->page_addr[1];
+    return ((TARGET_TB_PCREL || tb_pc(a) == tb_pc(b)) &&
+            a->cs_base == b->cs_base &&
+            a->flags == b->flags &&
+            (tb_cflags(a) & ~CF_INVALID) == (tb_cflags(b) & ~CF_INVALID) &&
+            a->trace_vcpu_dstate == b->trace_vcpu_dstate &&
+            a->page_addr[0] == b->page_addr[0] &&
+            a->page_addr[1] == b->page_addr[1]);
 }
 
 void tb_htable_init(void)
@@ -XXX,XX +XXX,XX @@ static inline void tb_jmp_unlink(TranslationBlock *dest)
     qemu_spin_unlock(&dest->jmp_lock);
 }
 
+static void tb_jmp_cache_inval_tb(TranslationBlock *tb)
+{
+    CPUState *cpu;
+
+    if (TARGET_TB_PCREL) {
+        /* A TB may be at any virtual address */
+        CPU_FOREACH(cpu) {
+            tcg_flush_jmp_cache(cpu);
+        }
+    } else {
+        uint32_t h = tb_jmp_cache_hash_func(tb_pc(tb));
+
+        CPU_FOREACH(cpu) {
+            CPUJumpCache *jc = cpu->tb_jmp_cache;
+
+            if (qatomic_read(&jc->array[h].tb) == tb) {
+                qatomic_set(&jc->array[h].tb, NULL);
+            }
+        }
+    }
+}
+
 /*
  * In user-mode, call with mmap_lock held.
  * In !user-mode, if @rm_from_page_list is set, call with the TB's pages'
@@ -XXX,XX +XXX,XX @@ static inline void tb_jmp_unlink(TranslationBlock *dest)
  */
 static void do_tb_phys_invalidate(TranslationBlock *tb, bool rm_from_page_list)
 {
-    CPUState *cpu;
     PageDesc *p;
     uint32_t h;
     tb_page_addr_t phys_pc;
@@ -XXX,XX +XXX,XX @@ static void do_tb_phys_invalidate(TranslationBlock *tb, bool rm_from_page_list)
 
     /* remove the TB from the hash list */
     phys_pc = tb->page_addr[0];
-    h = tb_hash_func(phys_pc, tb_pc(tb), tb->flags, orig_cflags,
-                     tb->trace_vcpu_dstate);
+    h = tb_hash_func(phys_pc, (TARGET_TB_PCREL ? 0 : tb_pc(tb)),
+                     tb->flags, orig_cflags, tb->trace_vcpu_dstate);
     if (!qht_remove(&tb_ctx.htable, tb, h)) {
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void do_tb_phys_invalidate(TranslationBlock *tb, bool rm_from_page_list)
     }
 
     /* remove the TB from the hash list */
-    h = tb_jmp_cache_hash_func(tb->pc);
-    CPU_FOREACH(cpu) {
-        CPUJumpCache *jc = cpu->tb_jmp_cache;
-        if (qatomic_read(&jc->array[h].tb) == tb) {
-            qatomic_set(&jc->array[h].tb, NULL);
-        }
-    }
+    tb_jmp_cache_inval_tb(tb);
 
     /* suppress this TB from the two jump lists */
     tb_remove_from_jmp_list(tb, 0);
@@ -XXX,XX +XXX,XX @@ tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
     }
 
     /* add in the hash table */
-    h = tb_hash_func(phys_pc, tb_pc(tb), tb->flags, tb->cflags,
-                     tb->trace_vcpu_dstate);
+    h = tb_hash_func(phys_pc, (TARGET_TB_PCREL ? 0 : tb_pc(tb)),
+                     tb->flags, tb->cflags, tb->trace_vcpu_dstate);
     qht_insert(&tb_ctx.htable, tb, h, &existing_tb);
 
     /* remove TB from the page(s) if we couldn't insert it */
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
 
     gen_code_buf = tcg_ctx->code_gen_ptr;
     tb->tc.ptr = tcg_splitwx_to_rx(gen_code_buf);
+#if !TARGET_TB_PCREL
     tb->pc = pc;
+#endif
     tb->cs_base = cs_base;
     tb->flags = flags;
     tb->cflags = cflags;
-- 
2.34.1

From: Leandro Lupori <leandro.lupori@eldorado.org.br>

PowerPC64 processors handle direct branches better than indirect
ones, resulting in less stalled cycles and branch misses.

However, PPC's tb_target_set_jmp_target() was only using direct
branches for 16-bit jumps, while PowerPC64's unconditional branch
instructions are able to handle displacements of up to 26 bits.
To take advantage of this, now jumps whose displacements fit in
between 17 and 26 bits are also converted to direct branches.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Leandro Lupori <leandro.lupori@eldorado.org.br>
[rth: Expanded some commentary.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/ppc/tcg-target.c.inc | 119 +++++++++++++++++++++++++++++----------
 1 file changed, 88 insertions(+), 31 deletions(-)

diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_mb(TCGContext *s, TCGArg a0)
     tcg_out32(s, insn);
 }
 
+static inline uint64_t make_pair(tcg_insn_unit i1, tcg_insn_unit i2)
+{
+    if (HOST_BIG_ENDIAN) {
+        return (uint64_t)i1 << 32 | i2;
+    }
+    return (uint64_t)i2 << 32 | i1;
+}
+
+static inline void ppc64_replace2(uintptr_t rx, uintptr_t rw,
+                                  tcg_insn_unit i0, tcg_insn_unit i1)
+{
+#if TCG_TARGET_REG_BITS == 64
+    qatomic_set((uint64_t *)rw, make_pair(i0, i1));
+    flush_idcache_range(rx, rw, 8);
+#else
+    qemu_build_not_reached();
+#endif
+}
+
+static inline void ppc64_replace4(uintptr_t rx, uintptr_t rw,
+                                  tcg_insn_unit i0, tcg_insn_unit i1,
+                                  tcg_insn_unit i2, tcg_insn_unit i3)
+{
+    uint64_t p[2];
+
+    p[!HOST_BIG_ENDIAN] = make_pair(i0, i1);
+    p[HOST_BIG_ENDIAN] = make_pair(i2, i3);
+
+    /*
+     * There's no convenient way to get the compiler to allocate a pair
+     * of registers at an even index, so copy into r6/r7 and clobber.
+     */
+    asm("mr  %%r6, %1\n\t"
+        "mr  %%r7, %2\n\t"
+        "stq %%r6, %0"
+        : "=Q"(*(__int128 *)rw) : "r"(p[0]), "r"(p[1]) : "r6", "r7");
+    flush_idcache_range(rx, rw, 16);
+}
+
 void tb_target_set_jmp_target(uintptr_t tc_ptr, uintptr_t jmp_rx,
                               uintptr_t jmp_rw, uintptr_t addr)
 {
-    if (TCG_TARGET_REG_BITS == 64) {
-        tcg_insn_unit i1, i2;
-        intptr_t tb_diff = addr - tc_ptr;
-        intptr_t br_diff = addr - (jmp_rx + 4);
-        uint64_t pair;
+    tcg_insn_unit i0, i1, i2, i3;
+    intptr_t tb_diff = addr - tc_ptr;
+    intptr_t br_diff = addr - (jmp_rx + 4);
+    intptr_t lo, hi;
 
-        /* This does not exercise the range of the branch, but we do
-           still need to be able to load the new value of TCG_REG_TB.
-           But this does still happen quite often.  */
-        if (tb_diff == (int16_t)tb_diff) {
-            i1 = ADDI | TAI(TCG_REG_TB, TCG_REG_TB, tb_diff);
-            i2 = B | (br_diff & 0x3fffffc);
-        } else {
-            intptr_t lo = (int16_t)tb_diff;
-            intptr_t hi = (int32_t)(tb_diff - lo);
-            assert(tb_diff == hi + lo);
-            i1 = ADDIS | TAI(TCG_REG_TB, TCG_REG_TB, hi >> 16);
-            i2 = ADDI | TAI(TCG_REG_TB, TCG_REG_TB, lo);
-        }
-#if HOST_BIG_ENDIAN
-        pair = (uint64_t)i1 << 32 | i2;
-#else
-        pair = (uint64_t)i2 << 32 | i1;
-#endif
-
-        /* As per the enclosing if, this is ppc64.  Avoid the _Static_assert
-           within qatomic_set that would fail to build a ppc32 host.  */
-        qatomic_set__nocheck((uint64_t *)jmp_rw, pair);
-        flush_idcache_range(jmp_rx, jmp_rw, 8);
-    } else {
+    if (TCG_TARGET_REG_BITS == 32) {
         intptr_t diff = addr - jmp_rx;
         tcg_debug_assert(in_range_b(diff));
         qatomic_set((uint32_t *)jmp_rw, B | (diff & 0x3fffffc));
         flush_idcache_range(jmp_rx, jmp_rw, 4);
+        return;
     }
+
+    /*
+     * For 16-bit displacements, we can use a single add + branch.
+     * This happens quite often.
+     */
+    if (tb_diff == (int16_t)tb_diff) {
+        i0 = ADDI | TAI(TCG_REG_TB, TCG_REG_TB, tb_diff);
+        i1 = B | (br_diff & 0x3fffffc);
+        ppc64_replace2(jmp_rx, jmp_rw, i0, i1);
+        return;
+    }
+
+    lo = (int16_t)tb_diff;
+    hi = (int32_t)(tb_diff - lo);
+    assert(tb_diff == hi + lo);
+    i0 = ADDIS | TAI(TCG_REG_TB, TCG_REG_TB, hi >> 16);
+    i1 = ADDI | TAI(TCG_REG_TB, TCG_REG_TB, lo);
+
+    /*
+     * Without stq from 2.07, we can only update two insns,
+     * and those must be the ones that load the target address.
+     */
+    if (!have_isa_2_07) {
+        ppc64_replace2(jmp_rx, jmp_rw, i0, i1);
+        return;
+    }
+
+    /*
+     * For 26-bit displacements, we can use a direct branch.
+     * Otherwise we still need the indirect branch, which we
+     * must restore after a potential direct branch write.
+     */
+    br_diff -= 4;
+    if (in_range_b(br_diff)) {
+        i2 = B | (br_diff & 0x3fffffc);
+        i3 = NOP;
+    } else {
+        i2 = MTSPR | RS(TCG_REG_TB) | CTR;
+        i3 = BCCTR | BO_ALWAYS;
+    }
+    ppc64_replace4(jmp_rx, jmp_rw, i0, i1, i2, i3);
 }
 
 static void tcg_out_call_int(TCGContext *s, int lk,
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         if (s->tb_jmp_insn_offset) {
             /* Direct jump. */
             if (TCG_TARGET_REG_BITS == 64) {
-                /* Ensure the next insns are 8-byte aligned. */
-                if ((uintptr_t)s->code_ptr & 7) {
+                /* Ensure the next insns are 8 or 16-byte aligned. */
+                while ((uintptr_t)s->code_ptr & (have_isa_2_07 ? 15 : 7)) {
                     tcg_out32(s, NOP);
                 }
                 s->tb_jmp_insn_offset[args[0]] = tcg_current_code_size(s);
-- 
2.34.1

The value previously chosen overlaps GUSA_MASK.

Rename all DELAY_SLOT_* and GUSA_* defines to emphasize
that they are included in TB_FLAGs.  Add aliases for the
FPSCR and SR bits that are included in TB_FLAGS, so that
we don't accidentally reassign those bits.

Fixes: 4da06fb3062 ("target/sh4: Implement prctl_unalign_sigbus")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/856
Reviewed-by: Yoshinori Sato <ysato@users.sourceforge.jp>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/sh4/cpu.h        | 56 +++++++++++++------------
 linux-user/sh4/signal.c |  6 +--
 target/sh4/cpu.c        |  6 +--
 target/sh4/helper.c     |  6 +--
 target/sh4/translate.c  | 90 ++++++++++++++++++++++-------------------
 5 files changed, 88 insertions(+), 76 deletions(-)

diff --git a/target/sh4/cpu.h b/target/sh4/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.h
+++ b/target/sh4/cpu.h
@@ -XXX,XX +XXX,XX @@
 #define FPSCR_RM_NEAREST       (0 << 0)
 #define FPSCR_RM_ZERO          (1 << 0)
 
-#define DELAY_SLOT_MASK        0x7
-#define DELAY_SLOT             (1 << 0)
-#define DELAY_SLOT_CONDITIONAL (1 << 1)
-#define DELAY_SLOT_RTE         (1 << 2)
+#define TB_FLAG_DELAY_SLOT       (1 << 0)
+#define TB_FLAG_DELAY_SLOT_COND  (1 << 1)
+#define TB_FLAG_DELAY_SLOT_RTE   (1 << 2)
+#define TB_FLAG_PENDING_MOVCA    (1 << 3)
+#define TB_FLAG_GUSA_SHIFT       4                      /* [11:4] */
+#define TB_FLAG_GUSA_EXCLUSIVE   (1 << 12)
+#define TB_FLAG_UNALIGN          (1 << 13)
+#define TB_FLAG_SR_FD            (1 << SR_FD)           /* 15 */
+#define TB_FLAG_FPSCR_PR         FPSCR_PR               /* 19 */
+#define TB_FLAG_FPSCR_SZ         FPSCR_SZ               /* 20 */
+#define TB_FLAG_FPSCR_FR         FPSCR_FR               /* 21 */
+#define TB_FLAG_SR_RB            (1 << SR_RB)           /* 29 */
+#define TB_FLAG_SR_MD            (1 << SR_MD)           /* 30 */
 
-#define TB_FLAG_PENDING_MOVCA  (1 << 3)
-#define TB_FLAG_UNALIGN        (1 << 4)
-
-#define GUSA_SHIFT             4
-#ifdef CONFIG_USER_ONLY
-#define GUSA_EXCLUSIVE         (1 << 12)
-#define GUSA_MASK              ((0xff << GUSA_SHIFT) | GUSA_EXCLUSIVE)
-#else
-/* Provide dummy versions of the above to allow tests against tbflags
-   to be elided while avoiding ifdefs.  */
-#define GUSA_EXCLUSIVE         0
-#define GUSA_MASK              0
-#endif
-
-#define TB_FLAG_ENVFLAGS_MASK  (DELAY_SLOT_MASK | GUSA_MASK)
+#define TB_FLAG_DELAY_SLOT_MASK  (TB_FLAG_DELAY_SLOT |       \
+                                  TB_FLAG_DELAY_SLOT_COND |  \
+                                  TB_FLAG_DELAY_SLOT_RTE)
+#define TB_FLAG_GUSA_MASK        ((0xff << TB_FLAG_GUSA_SHIFT) | \
+                                  TB_FLAG_GUSA_EXCLUSIVE)
+#define TB_FLAG_FPSCR_MASK       (TB_FLAG_FPSCR_PR | \
+                                  TB_FLAG_FPSCR_SZ | \
+                                  TB_FLAG_FPSCR_FR)
+#define TB_FLAG_SR_MASK          (TB_FLAG_SR_FD | \
+                                  TB_FLAG_SR_RB | \
+                                  TB_FLAG_SR_MD)
+#define TB_FLAG_ENVFLAGS_MASK    (TB_FLAG_DELAY_SLOT_MASK | \
+                                  TB_FLAG_GUSA_MASK)
 
 typedef struct tlb_t {
     uint32_t vpn;		/* virtual page number */
@@ -XXX,XX +XXX,XX @@ static inline int cpu_mmu_index (CPUSH4State *env, bool ifetch)
 {
     /* The instruction in a RTE delay slot is fetched in privileged
        mode, but executed in user mode.  */
-    if (ifetch && (env->flags & DELAY_SLOT_RTE)) {
+    if (ifetch && (env->flags & TB_FLAG_DELAY_SLOT_RTE)) {
         return 0;
     } else {
         return (env->sr & (1u << SR_MD)) == 0 ? 1 : 0;
@@ -XXX,XX +XXX,XX @@ static inline void cpu_get_tb_cpu_state(CPUSH4State *env, target_ulong *pc,
 {
     *pc = env->pc;
     /* For a gUSA region, notice the end of the region.  */
-    *cs_base = env->flags & GUSA_MASK ? env->gregs[0] : 0;
-    *flags = env->flags /* TB_FLAG_ENVFLAGS_MASK: bits 0-2, 4-12 */
-            | (env->fpscr & (FPSCR_FR | FPSCR_SZ | FPSCR_PR))  /* Bits 19-21 */
-            | (env->sr & ((1u << SR_MD) | (1u << SR_RB)))      /* Bits 29-30 */
-            | (env->sr & (1u << SR_FD))                        /* Bit 15 */
+    *cs_base = env->flags & TB_FLAG_GUSA_MASK ? env->gregs[0] : 0;
+    *flags = env->flags
+            | (env->fpscr & TB_FLAG_FPSCR_MASK)
+            | (env->sr & TB_FLAG_SR_MASK)
             | (env->movcal_backup ? TB_FLAG_PENDING_MOVCA : 0); /* Bit 3 */
 #ifdef CONFIG_USER_ONLY
     *flags |= TB_FLAG_UNALIGN * !env_cpu(env)->prctl_unalign_sigbus;
diff --git a/linux-user/sh4/signal.c b/linux-user/sh4/signal.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/sh4/signal.c
+++ b/linux-user/sh4/signal.c
@@ -XXX,XX +XXX,XX @@ static void restore_sigcontext(CPUSH4State *regs, struct target_sigcontext *sc)
     __get_user(regs->fpul, &sc->sc_fpul);
 
     regs->tra = -1;         /* disable syscall checks */
-    regs->flags &= ~(DELAY_SLOT_MASK | GUSA_MASK);
+    regs->flags = 0;
 }
 
 void setup_frame(int sig, struct target_sigaction *ka,
@@ -XXX,XX +XXX,XX @@ void setup_frame(int sig, struct target_sigaction *ka,
     regs->gregs[5] = 0;
     regs->gregs[6] = frame_addr += offsetof(typeof(*frame), sc);
     regs->pc = (unsigned long) ka->_sa_handler;
-    regs->flags &= ~(DELAY_SLOT_MASK | GUSA_MASK);
+    regs->flags &= ~(TB_FLAG_DELAY_SLOT_MASK | TB_FLAG_GUSA_MASK);
 
     unlock_user_struct(frame, frame_addr, 1);
     return;
@@ -XXX,XX +XXX,XX @@ void setup_rt_frame(int sig, struct target_sigaction *ka,
     regs->gregs[5] = frame_addr + offsetof(typeof(*frame), info);
     regs->gregs[6] = frame_addr + offsetof(typeof(*frame), uc);
     regs->pc = (unsigned long) ka->_sa_handler;
-    regs->flags &= ~(DELAY_SLOT_MASK | GUSA_MASK);
+    regs->flags &= ~(TB_FLAG_DELAY_SLOT_MASK | TB_FLAG_GUSA_MASK);
 
     unlock_user_struct(frame, frame_addr, 1);
     return;
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_synchronize_from_tb(CPUState *cs,
     SuperHCPU *cpu = SUPERH_CPU(cs);
 
     cpu->env.pc = tb_pc(tb);
-    cpu->env.flags = tb->flags & TB_FLAG_ENVFLAGS_MASK;
+    cpu->env.flags = tb->flags;
 }
 
 #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static bool superh_io_recompile_replay_branch(CPUState *cs,
     SuperHCPU *cpu = SUPERH_CPU(cs);
     CPUSH4State *env = &cpu->env;
 
-    if ((env->flags & ((DELAY_SLOT | DELAY_SLOT_CONDITIONAL))) != 0
+    if ((env->flags & (TB_FLAG_DELAY_SLOT | TB_FLAG_DELAY_SLOT_COND))
         && env->pc != tb_pc(tb)) {
         env->pc -= 2;
-        env->flags &= ~(DELAY_SLOT | DELAY_SLOT_CONDITIONAL);
+        env->flags &= ~(TB_FLAG_DELAY_SLOT | TB_FLAG_DELAY_SLOT_COND);
         return true;
     }
     return false;
diff --git a/target/sh4/helper.c b/target/sh4/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/helper.c
+++ b/target/sh4/helper.c
@@ -XXX,XX +XXX,XX @@ void superh_cpu_do_interrupt(CPUState *cs)
     env->sr |= (1u << SR_BL) | (1u << SR_MD) | (1u << SR_RB);
     env->lock_addr = -1;
 
-    if (env->flags & DELAY_SLOT_MASK) {
+    if (env->flags & TB_FLAG_DELAY_SLOT_MASK) {
         /* Branch instruction should be executed again before delay slot. */
 	env->spc -= 2;
 	/* Clear flags for exception/interrupt routine. */
-        env->flags &= ~DELAY_SLOT_MASK;
+        env->flags &= ~TB_FLAG_DELAY_SLOT_MASK;
     }
 
     if (do_exp) {
@@ -XXX,XX +XXX,XX @@ bool superh_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
         CPUSH4State *env = &cpu->env;
 
         /* Delay slots are indivisible, ignore interrupts */
-        if (env->flags & DELAY_SLOT_MASK) {
+        if (env->flags & TB_FLAG_DELAY_SLOT_MASK) {
             return false;
         } else {
             superh_cpu_do_interrupt(cs);
diff --git a/target/sh4/translate.c b/target/sh4/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/translate.c
+++ b/target/sh4/translate.c
@@ -XXX,XX +XXX,XX @@ void superh_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 		    i, env->gregs[i], i + 1, env->gregs[i + 1],
 		    i + 2, env->gregs[i + 2], i + 3, env->gregs[i + 3]);
     }
-    if (env->flags & DELAY_SLOT) {
+    if (env->flags & TB_FLAG_DELAY_SLOT) {
         qemu_printf("in delay slot (delayed_pc=0x%08x)\n",
 		    env->delayed_pc);
-    } else if (env->flags & DELAY_SLOT_CONDITIONAL) {
+    } else if (env->flags & TB_FLAG_DELAY_SLOT_COND) {
         qemu_printf("in conditional delay slot (delayed_pc=0x%08x)\n",
 		    env->delayed_pc);
-    } else if (env->flags & DELAY_SLOT_RTE) {
+    } else if (env->flags & TB_FLAG_DELAY_SLOT_RTE) {
         qemu_fprintf(f, "in rte delay slot (delayed_pc=0x%08x)\n",
                      env->delayed_pc);
     }
@@ -XXX,XX +XXX,XX @@ static inline void gen_save_cpu_state(DisasContext *ctx, bool save_pc)
 
 static inline bool use_exit_tb(DisasContext *ctx)
 {
-    return (ctx->tbflags & GUSA_EXCLUSIVE) != 0;
+    return (ctx->tbflags & TB_FLAG_GUSA_EXCLUSIVE) != 0;
 }
 
 static bool use_goto_tb(DisasContext *ctx, target_ulong dest)
@@ -XXX,XX +XXX,XX @@ static void gen_conditional_jump(DisasContext *ctx, target_ulong dest,
     TCGLabel *l1 = gen_new_label();
     TCGCond cond_not_taken = jump_if_true ? TCG_COND_EQ : TCG_COND_NE;
 
-    if (ctx->tbflags & GUSA_EXCLUSIVE) {
+    if (ctx->tbflags & TB_FLAG_GUSA_EXCLUSIVE) {
         /* When in an exclusive region, we must continue to the end.
            Therefore, exit the region on a taken branch, but otherwise
            fall through to the next instruction.  */
         tcg_gen_brcondi_i32(cond_not_taken, cpu_sr_t, 0, l1);
-        tcg_gen_movi_i32(cpu_flags, ctx->envflags & ~GUSA_MASK);
+        tcg_gen_movi_i32(cpu_flags, ctx->envflags & ~TB_FLAG_GUSA_MASK);
         /* Note that this won't actually use a goto_tb opcode because we
            disallow it in use_goto_tb, but it handles exit + singlestep.  */
         gen_goto_tb(ctx, 0, dest);
@@ -XXX,XX +XXX,XX @@ static void gen_delayed_conditional_jump(DisasContext * ctx)
     tcg_gen_mov_i32(ds, cpu_delayed_cond);
     tcg_gen_discard_i32(cpu_delayed_cond);
 
-    if (ctx->tbflags & GUSA_EXCLUSIVE) {
+    if (ctx->tbflags & TB_FLAG_GUSA_EXCLUSIVE) {
         /* When in an exclusive region, we must continue to the end.
            Therefore, exit the region on a taken branch, but otherwise
            fall through to the next instruction.  */
         tcg_gen_brcondi_i32(TCG_COND_EQ, ds, 0, l1);
 
         /* Leave the gUSA region.  */
-        tcg_gen_movi_i32(cpu_flags, ctx->envflags & ~GUSA_MASK);
+        tcg_gen_movi_i32(cpu_flags, ctx->envflags & ~TB_FLAG_GUSA_MASK);
         gen_jump(ctx);
 
         gen_set_label(l1);
@@ -XXX,XX +XXX,XX @@ static inline void gen_store_fpr64(DisasContext *ctx, TCGv_i64 t, int reg)
 #define XHACK(x) ((((x) & 1 ) << 4) | ((x) & 0xe))
 
 #define CHECK_NOT_DELAY_SLOT \
-    if (ctx->envflags & DELAY_SLOT_MASK) {  \
-        goto do_illegal_slot;               \
+    if (ctx->envflags & TB_FLAG_DELAY_SLOT_MASK) {  \
+        goto do_illegal_slot;                       \
     }
 
 #define CHECK_PRIVILEGED \
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
     case 0x000b:		/* rts */
 	CHECK_NOT_DELAY_SLOT
 	tcg_gen_mov_i32(cpu_delayed_pc, cpu_pr);
-        ctx->envflags |= DELAY_SLOT;
+        ctx->envflags |= TB_FLAG_DELAY_SLOT;
 	ctx->delayed_pc = (uint32_t) - 1;
 	return;
     case 0x0028:		/* clrmac */
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
 	CHECK_NOT_DELAY_SLOT
         gen_write_sr(cpu_ssr);
 	tcg_gen_mov_i32(cpu_delayed_pc, cpu_spc);
-        ctx->envflags |= DELAY_SLOT_RTE;
+        ctx->envflags |= TB_FLAG_DELAY_SLOT_RTE;
 	ctx->delayed_pc = (uint32_t) - 1;
         ctx->base.is_jmp = DISAS_STOP;
 	return;
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
 	return;
     case 0xe000:		/* mov #imm,Rn */
 #ifdef CONFIG_USER_ONLY
-        /* Detect the start of a gUSA region.  If so, update envflags
-           and end the TB.  This will allow us to see the end of the
-           region (stored in R0) in the next TB.  */
+        /*
+         * Detect the start of a gUSA region (mov #-n, r15).
+         * If so, update envflags and end the TB.  This will allow us
+         * to see the end of the region (stored in R0) in the next TB.
+         */
         if (B11_8 == 15 && B7_0s < 0 &&
             (tb_cflags(ctx->base.tb) & CF_PARALLEL)) {
-            ctx->envflags = deposit32(ctx->envflags, GUSA_SHIFT, 8, B7_0s);
+            ctx->envflags =
+                deposit32(ctx->envflags, TB_FLAG_GUSA_SHIFT, 8, B7_0s);
             ctx->base.is_jmp = DISAS_STOP;
         }
 #endif
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
     case 0xa000:		/* bra disp */
 	CHECK_NOT_DELAY_SLOT
         ctx->delayed_pc = ctx->base.pc_next + 4 + B11_0s * 2;
-        ctx->envflags |= DELAY_SLOT;
+        ctx->envflags |= TB_FLAG_DELAY_SLOT;
 	return;
     case 0xb000:		/* bsr disp */
 	CHECK_NOT_DELAY_SLOT
         tcg_gen_movi_i32(cpu_pr, ctx->base.pc_next + 4);
         ctx->delayed_pc = ctx->base.pc_next + 4 + B11_0s * 2;
-        ctx->envflags |= DELAY_SLOT;
+        ctx->envflags |= TB_FLAG_DELAY_SLOT;
 	return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
 	CHECK_NOT_DELAY_SLOT
         tcg_gen_xori_i32(cpu_delayed_cond, cpu_sr_t, 1);
         ctx->delayed_pc = ctx->base.pc_next + 4 + B7_0s * 2;
-        ctx->envflags |= DELAY_SLOT_CONDITIONAL;
+        ctx->envflags |= TB_FLAG_DELAY_SLOT_COND;
 	return;
     case 0x8900:		/* bt label */
 	CHECK_NOT_DELAY_SLOT
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
 	CHECK_NOT_DELAY_SLOT
         tcg_gen_mov_i32(cpu_delayed_cond, cpu_sr_t);
         ctx->delayed_pc = ctx->base.pc_next + 4 + B7_0s * 2;
-        ctx->envflags |= DELAY_SLOT_CONDITIONAL;
+        ctx->envflags |= TB_FLAG_DELAY_SLOT_COND;
 	return;
     case 0x8800:		/* cmp/eq #imm,R0 */
         tcg_gen_setcondi_i32(TCG_COND_EQ, cpu_sr_t, REG(0), B7_0s);
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
     case 0x0023:		/* braf Rn */
 	CHECK_NOT_DELAY_SLOT
         tcg_gen_addi_i32(cpu_delayed_pc, REG(B11_8), ctx->base.pc_next + 4);
-        ctx->envflags |= DELAY_SLOT;
+        ctx->envflags |= TB_FLAG_DELAY_SLOT;
 	ctx->delayed_pc = (uint32_t) - 1;
 	return;
     case 0x0003:		/* bsrf Rn */
 	CHECK_NOT_DELAY_SLOT
         tcg_gen_movi_i32(cpu_pr, ctx->base.pc_next + 4);
 	tcg_gen_add_i32(cpu_delayed_pc, REG(B11_8), cpu_pr);
-        ctx->envflags |= DELAY_SLOT;
+        ctx->envflags |= TB_FLAG_DELAY_SLOT;
 	ctx->delayed_pc = (uint32_t) - 1;
 	return;
     case 0x4015:		/* cmp/pl Rn */
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
     case 0x402b:		/* jmp @Rn */
 	CHECK_NOT_DELAY_SLOT
 	tcg_gen_mov_i32(cpu_delayed_pc, REG(B11_8));
-        ctx->envflags |= DELAY_SLOT;
+        ctx->envflags |= TB_FLAG_DELAY_SLOT;
 	ctx->delayed_pc = (uint32_t) - 1;
 	return;
     case 0x400b:		/* jsr @Rn */
 	CHECK_NOT_DELAY_SLOT
         tcg_gen_movi_i32(cpu_pr, ctx->base.pc_next + 4);
 	tcg_gen_mov_i32(cpu_delayed_pc, REG(B11_8));
-        ctx->envflags |= DELAY_SLOT;
+        ctx->envflags |= TB_FLAG_DELAY_SLOT;
 	ctx->delayed_pc = (uint32_t) - 1;
 	return;
     case 0x400e:		/* ldc Rm,SR */
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
     fflush(stderr);
 #endif
  do_illegal:
-    if (ctx->envflags & DELAY_SLOT_MASK) {
+    if (ctx->envflags & TB_FLAG_DELAY_SLOT_MASK) {
  do_illegal_slot:
         gen_save_cpu_state(ctx, true);
         gen_helper_raise_slot_illegal_instruction(cpu_env);
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
 
  do_fpu_disabled:
     gen_save_cpu_state(ctx, true);
-    if (ctx->envflags & DELAY_SLOT_MASK) {
+    if (ctx->envflags & TB_FLAG_DELAY_SLOT_MASK) {
         gen_helper_raise_slot_fpu_disable(cpu_env);
     } else {
         gen_helper_raise_fpu_disable(cpu_env);
@@ -XXX,XX +XXX,XX @@ static void decode_opc(DisasContext * ctx)
 
     _decode_opc(ctx);
 
-    if (old_flags & DELAY_SLOT_MASK) {
+    if (old_flags & TB_FLAG_DELAY_SLOT_MASK) {
         /* go out of the delay slot */
-        ctx->envflags &= ~DELAY_SLOT_MASK;
+        ctx->envflags &= ~TB_FLAG_DELAY_SLOT_MASK;
 
         /* When in an exclusive region, we must continue to the end
            for conditional branches.  */
-        if (ctx->tbflags & GUSA_EXCLUSIVE
-            && old_flags & DELAY_SLOT_CONDITIONAL) {
+        if (ctx->tbflags & TB_FLAG_GUSA_EXCLUSIVE
+            && old_flags & TB_FLAG_DELAY_SLOT_COND) {
             gen_delayed_conditional_jump(ctx);
             return;
         }
         /* Otherwise this is probably an invalid gUSA region.
            Drop the GUSA bits so the next TB doesn't see them.  */
-        ctx->envflags &= ~GUSA_MASK;
+        ctx->envflags &= ~TB_FLAG_GUSA_MASK;
 
         tcg_gen_movi_i32(cpu_flags, ctx->envflags);
-        if (old_flags & DELAY_SLOT_CONDITIONAL) {
+        if (old_flags & TB_FLAG_DELAY_SLOT_COND) {
 	    gen_delayed_conditional_jump(ctx);
         } else {
             gen_jump(ctx);
@@ -XXX,XX +XXX,XX @@ static void decode_gusa(DisasContext *ctx, CPUSH4State *env)
     }
 
     /* The entire region has been translated.  */
-    ctx->envflags &= ~GUSA_MASK;
+    ctx->envflags &= ~TB_FLAG_GUSA_MASK;
     ctx->base.pc_next = pc_end;
     ctx->base.num_insns += max_insns - 1;
     return;
@@ -XXX,XX +XXX,XX @@ static void decode_gusa(DisasContext *ctx, CPUSH4State *env)
 
     /* Restart with the EXCLUSIVE bit set, within a TB run via
        cpu_exec_step_atomic holding the exclusive lock.  */
-    ctx->envflags |= GUSA_EXCLUSIVE;
+    ctx->envflags |= TB_FLAG_GUSA_EXCLUSIVE;
     gen_save_cpu_state(ctx, false);
     gen_helper_exclusive(cpu_env);
     ctx->base.is_jmp = DISAS_NORETURN;
@@ -XXX,XX +XXX,XX @@ static void sh4_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
                   (tbflags & (1 << SR_RB))) * 0x10;
     ctx->fbank = tbflags & FPSCR_FR ? 0x10 : 0;
 
-    if (tbflags & GUSA_MASK) {
+#ifdef CONFIG_USER_ONLY
+    if (tbflags & TB_FLAG_GUSA_MASK) {
+        /* In gUSA exclusive region. */
         uint32_t pc = ctx->base.pc_next;
         uint32_t pc_end = ctx->base.tb->cs_base;
-        int backup = sextract32(ctx->tbflags, GUSA_SHIFT, 8);
+        int backup = sextract32(ctx->tbflags, TB_FLAG_GUSA_SHIFT, 8);
         int max_insns = (pc_end - pc) / 2;
 
         if (pc != pc_end + backup || max_insns < 2) {
             /* This is a malformed gUSA region.  Don't do anything special,
                since the interpreter is likely to get confused.  */
-            ctx->envflags &= ~GUSA_MASK;
-        } else if (tbflags & GUSA_EXCLUSIVE) {
+            ctx->envflags &= ~TB_FLAG_GUSA_MASK;
+        } else if (tbflags & TB_FLAG_GUSA_EXCLUSIVE) {
             /* Regardless of single-stepping or the end of the page,
                we must complete execution of the gUSA region while
                holding the exclusive lock.  */
@@ -XXX,XX +XXX,XX @@ static void sh4_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
             return;
         }
     }
+#endif
 
     /* Since the ISA is fixed-width, we can bound by the number
        of instructions remaining on the page.  */
@@ -XXX,XX +XXX,XX @@ static void sh4_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
     DisasContext *ctx = container_of(dcbase, DisasContext, base);
 
 #ifdef CONFIG_USER_ONLY
-    if (unlikely(ctx->envflags & GUSA_MASK)
-        && !(ctx->envflags & GUSA_EXCLUSIVE)) {
+    if (unlikely(ctx->envflags & TB_FLAG_GUSA_MASK)
+        && !(ctx->envflags & TB_FLAG_GUSA_EXCLUSIVE)) {
         /* We're in an gUSA region, and we have not already fallen
            back on using an exclusive region.  Attempt to parse the
            region into a single supported atomic operation.  Failure
@@ -XXX,XX +XXX,XX @@ static void sh4_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
 {
     DisasContext *ctx = container_of(dcbase, DisasContext, base);
 
-    if (ctx->tbflags & GUSA_EXCLUSIVE) {
+    if (ctx->tbflags & TB_FLAG_GUSA_EXCLUSIVE) {
         /* Ending the region of exclusivity.  Clear the bits.  */
-        ctx->envflags &= ~GUSA_MASK;
+        ctx->envflags &= ~TB_FLAG_GUSA_MASK;
     }
 
     switch (ctx->base.is_jmp) {
-- 
2.34.1