Series comparison

-[PULL 0/9] tcg patch queue
+[PULL v3 00/44] tcg patch queue
-Note that I've extended the expiration date of my gpg key
+Version 3: Rebase and fix a minor patch conflict.
 and have uploaded it to keyserver.ubuntu.com.
 r~
-The following changes since commit 99c44988d5ba1866a411450c877ed818b1b70081:
+The following changes since commit c6f5e042d89e79206cd1ce5525d3df219f13c3cc:
-  Merge remote-tracking branch 'remotes/bsdimp/tags/pull-bsd-user-20210910' into staging (2021-09-11 14:00:39 +0100)
+  Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20210913-3' into staging (2021-09-13 21:06:15 +0100)
 are available in the Git repository at:
-  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20210912
+  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20210914
-for you to fetch changes up to 267a3ec3e2a8fb3e06a9d46d09fcfc57dfefd118:
+for you to fetch changes up to a5b759b6dca7daf87fa5007a7f5784bf22f3830f:
-  tcg/arm: Fix tcg_out_vec_op function signature (2021-09-12 05:07:36 -0700)
+  tcg/arm: More use of the TCGReg enum (2021-09-14 07:59:43 -0700)
 ----------------------------------------------------------------
 Fix translation race condition for user-only.
 Fix tcg/i386 encoding for VPSLLVQ, VPSRLVQ.
 Fix tcg/arm tcg_out_vec_op signature.
 Fix tcg/ppc (32bit) build with clang.
 Remove dupluate TCG_KICK_PERIOD definition.
 Remove unused tcg_global_reg_new.
-Use __builtin_bswap*.
+Restrict cpu_exec_interrupt and its callees to sysemu.
 Cleanups for tcg/arm.
 ----------------------------------------------------------------
 Bin Meng (1):
       tcg: Remove tcg_global_reg_new defines
-Ilya Leoshkevich (2):
+Ilya Leoshkevich (3):
       accel/tcg: Add DisasContextBase argument to translator_ld*
       accel/tcg: Clear PAGE_WRITE before translation
+      accel/tcg/user-exec: Fix read-modify-write of code on s390 hosts
 Jose R. Ziviani (1):
       tcg/arm: Fix tcg_out_vec_op function signature
 Luc Michel (1):
       accel/tcg: remove redundant TCG_KICK_PERIOD define
-Richard Henderson (4):
+Philippe Mathieu-Daudé (25):
       target/avr: Remove pointless use of CONFIG_USER_ONLY definition
       target/i386: Restrict sysemu-only fpu_helper helpers
       target/i386: Simplify TARGET_X86_64 #ifdef'ry
       target/xtensa: Restrict do_transaction_failed() to sysemu
       accel/tcg: Rename user-mode do_interrupt hack as fake_user_interrupt
       target/alpha: Restrict cpu_exec_interrupt() handler to sysemu
       target/arm: Restrict cpu_exec_interrupt() handler to sysemu
       target/cris: Restrict cpu_exec_interrupt() handler to sysemu
       target/hppa: Restrict cpu_exec_interrupt() handler to sysemu
       target/i386: Restrict cpu_exec_interrupt() handler to sysemu
       target/i386: Move x86_cpu_exec_interrupt() under sysemu/ folder
       target/m68k: Restrict cpu_exec_interrupt() handler to sysemu
       target/microblaze: Restrict cpu_exec_interrupt() handler to sysemu
       target/mips: Restrict cpu_exec_interrupt() handler to sysemu
       target/nios2: Restrict cpu_exec_interrupt() handler to sysemu
       target/openrisc: Restrict cpu_exec_interrupt() handler to sysemu
       target/ppc: Restrict cpu_exec_interrupt() handler to sysemu
       target/riscv: Restrict cpu_exec_interrupt() handler to sysemu
       target/sh4: Restrict cpu_exec_interrupt() handler to sysemu
       target/sparc: Restrict cpu_exec_interrupt() handler to sysemu
       target/rx: Restrict cpu_exec_interrupt() handler to sysemu
       target/xtensa: Restrict cpu_exec_interrupt() handler to sysemu
       accel/tcg: Restrict TCGCPUOps::cpu_exec_interrupt() to sysemu
       user: Remove cpu_get_pic_interrupt() stubs
       user: Mark cpu_loop() with noreturn attribute
 Richard Henderson (13):
       tcg/i386: Split P_VEXW from P_REXW
-      include/qemu: Use builtins for bswap
       tcg/ppc: Replace TCG_TARGET_CALL_DARWIN with _CALL_DARWIN
       tcg/ppc: Ensure _CALL_SYSV is set for 32-bit ELF
+      tcg/arm: Remove fallback definition of __ARM_ARCH
+      tcg/arm: Standardize on tcg_out_<branch>_{reg,imm}
+      tcg/arm: Simplify use_armv5t_instructions
+      tcg/arm: Support armv4t in tcg_out_goto and tcg_out_call
+      tcg/arm: Split out tcg_out_ldstm
+      tcg/arm: Simplify usage of encode_imm
+      tcg/arm: Drop inline markers
+      tcg/arm: Give enum arm_cond_code_e a typedef and use it
+      tcg/arm: More use of the ARMInsn enum
+      tcg/arm: More use of the TCGReg enum
- meson.build                               |  6 ----
+ bsd-user/qemu.h                           |   2 +-
- include/exec/translate-all.h              |  1 +
+ include/exec/translate-all.h              |   1 +
- include/exec/translator.h                 | 44 +++++++++++++----------
+ include/exec/translator.h                 |  44 +--
- include/qemu/bswap.h                      | 53 ++-------------------------
+ include/hw/core/tcg-cpu-ops.h             |  26 +-
- include/tcg/tcg-op.h                      |  2 --
+ include/tcg/tcg-op.h                      |   2 -
- target/arm/arm_ldst.h                     | 12 +++----
+ linux-user/qemu.h                         |   2 +-
- accel/tcg/tcg-accel-ops-rr.c              |  2 --
+ target/alpha/cpu.h                        |   2 +-
- accel/tcg/translate-all.c                 | 59 ++++++++++++++++++-------------
+ target/arm/arm_ldst.h                     |  12 +-
- accel/tcg/translator.c                    | 39 ++++++++++++++++++++
+ target/arm/cpu.h                          |   3 +-
- target/alpha/translate.c                  |  2 +-
+ target/cris/cpu.h                         |   2 +-
- target/arm/translate-a64.c                |  2 +-
+ target/hppa/cpu.h                         |   4 +-
- target/arm/translate.c                    |  9 ++---
+ target/i386/cpu.h                         |   3 +
- target/hexagon/translate.c                |  3 +-
+ target/i386/tcg/helper-tcg.h              |   2 +
- target/hppa/translate.c                   |  5 +--
+ target/m68k/cpu.h                         |   2 +
- target/i386/tcg/translate.c               | 10 +++---
+ target/microblaze/cpu.h                   |   2 +
- target/m68k/translate.c                   |  2 +-
+ target/mips/tcg/tcg-internal.h            |   5 +-
- target/mips/tcg/translate.c               |  8 ++---
+ target/openrisc/cpu.h                     |   5 +-
- target/openrisc/translate.c               |  2 +-
+ target/ppc/cpu.h                          |   4 +-
- target/ppc/translate.c                    |  5 +--
+ target/riscv/cpu.h                        |   2 +-
- target/riscv/translate.c                  |  5 +--
+ target/rx/cpu.h                           |   2 +
- target/s390x/tcg/translate.c              | 16 +++++----
+ target/sh4/cpu.h                          |   4 +-
- target/sh4/translate.c                    |  4 +--
+ target/xtensa/cpu.h                       |   2 +
- target/sparc/translate.c                  |  2 +-
+ tcg/arm/tcg-target.h                      |  27 +-
- target/xtensa/translate.c                 |  5 +--
+ accel/tcg/cpu-exec.c                      |  14 +-
- target/mips/tcg/micromips_translate.c.inc |  2 +-
+ accel/tcg/tcg-accel-ops-rr.c              |   2 -
- target/mips/tcg/mips16e_translate.c.inc   |  4 +--
+ accel/tcg/translate-all.c                 |  59 ++--
- target/mips/tcg/nanomips_translate.c.inc  |  4 +--
+ accel/tcg/translator.c                    |  39 +++
- tcg/arm/tcg-target.c.inc                  |  3 +-
+ accel/tcg/user-exec.c                     |  48 ++-
- tcg/i386/tcg-target.c.inc                 | 13 +++----
+ bsd-user/i386/target_arch_cpu.c           |   5 -
- tcg/ppc/tcg-target.c.inc                  | 25 ++++++++++---
+ bsd-user/x86_64/target_arch_cpu.c         |   5 -
-files changed, 185 insertions(+), 164 deletions(-)
+ linux-user/main.c                         |   7 -
  target/alpha/cpu.c                        |   2 +-
  target/alpha/helper.c                     |   5 +-
  target/alpha/translate.c                  |   2 +-
  target/arm/cpu.c                          |   7 +-
  target/arm/cpu_tcg.c                      |   6 +-
  target/arm/translate-a64.c                |   2 +-
  target/arm/translate.c                    |   9 +-
  target/avr/cpu.c                          |   3 -
  target/cris/cpu.c                         |   4 +-
  target/cris/helper.c                      |  17 +-
  target/hexagon/translate.c                |   3 +-
  target/hppa/cpu.c                         |   2 +-
  target/hppa/int_helper.c                  |   7 +-
  target/hppa/translate.c                   |   5 +-
  target/i386/tcg/seg_helper.c              |  74 +----
  target/i386/tcg/sysemu/seg_helper.c       |  62 ++++
  target/i386/tcg/tcg-cpu.c                 |   8 +-
  target/i386/tcg/translate.c               |  10 +-
  target/m68k/cpu.c                         |   2 +-
  target/m68k/op_helper.c                   |  16 +-
  target/m68k/translate.c                   |   2 +-
  target/microblaze/cpu.c                   |   2 +-
  target/microblaze/helper.c                |  13 +-
  target/mips/cpu.c                         |   2 +-
  target/mips/tcg/exception.c               |  18 --
  target/mips/tcg/sysemu/tlb_helper.c       |  18 ++
  target/mips/tcg/translate.c               |   8 +-
  target/mips/tcg/user/tlb_helper.c         |   5 -
  target/nios2/cpu.c                        |   5 +-
  target/openrisc/cpu.c                     |   2 +-
  target/openrisc/interrupt.c               |   2 -
  target/openrisc/translate.c               |   2 +-
  target/ppc/cpu_init.c                     |   2 +-
  target/ppc/excp_helper.c                  |  21 +-
  target/ppc/translate.c                    |   5 +-
  target/riscv/cpu.c                        |   2 +-
  target/riscv/cpu_helper.c                 |   5 -
  target/riscv/translate.c                  |   5 +-
  target/rx/cpu.c                           |   2 +-
  target/rx/helper.c                        |   4 +
  target/s390x/tcg/translate.c              |  16 +-
  target/sh4/cpu.c                          |   2 +-
  target/sh4/helper.c                       |   9 +-
  target/sh4/translate.c                    |   4 +-
  target/sparc/cpu.c                        |   4 +-
  target/sparc/translate.c                  |   2 +-
  target/xtensa/cpu.c                       |   2 +-
  target/xtensa/exc_helper.c                |   7 +-
  target/xtensa/translate.c                 |   5 +-
  target/mips/tcg/micromips_translate.c.inc |   2 +-
  target/mips/tcg/mips16e_translate.c.inc   |   4 +-
  target/mips/tcg/nanomips_translate.c.inc  |   4 +-
  tcg/arm/tcg-target.c.inc                  | 517 ++++++++++++++++--------------
  tcg/i386/tcg-target.c.inc                 |  13 +-
  tcg/ppc/tcg-target.c.inc                  |  25 +-
  target/openrisc/meson.build               |   6 +-
 files changed, 702 insertions(+), 630 deletions(-)

-[PULL 1/9] accel/tcg: Add DisasContextBase argument to translator_ld*
+[PULL v3 01/44] accel/tcg: Add DisasContextBase argument to translator_ld*
 ...
      ctx->base.is_jmp = translate_one(ctx, insn);
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void disas_a64_insn(CPUARMState *env, DisasContext *s)
+@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
-     uint32_t insn;
+     }
      s->pc_curr = s->base.pc_next;
 -    insn = arm_ldl_code(env, s->base.pc_next, s->sctlr_b);
 +    insn = arm_ldl_code(env, &s->base, s->base.pc_next, s->sctlr_b);
      s->insn = insn;
 ...

-[PULL 2/9] accel/tcg: Clear PAGE_WRITE before translation
+Deleted patch
-From: Ilya Leoshkevich <iii@linux.ibm.com>
-translate_insn() implementations fetch instruction bytes piecemeal,
-which can cause qemu-user to generate inconsistent translations if
-another thread modifies them concurrently [1].
-Fix by making pages containing translated instruction non-writable
-right before loading instruction bytes from them.
-[1] https://lists.nongnu.org/archive/html/qemu-devel/2021-08/msg00644.html
-Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Message-Id: <20210805204835.158918-1-iii@linux.ibm.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/exec/translate-all.h |  1 +
- include/exec/translator.h    | 39 ++++++++++++++----------
- accel/tcg/translate-all.c    | 59 +++++++++++++++++++++---------------
- accel/tcg/translator.c       | 39 ++++++++++++++++++++++++
-files changed, 97 insertions(+), 41 deletions(-)
-diff --git a/include/exec/translate-all.h b/include/exec/translate-all.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/exec/translate-all.h
-+++ b/include/exec/translate-all.h
-@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end);
- void tb_check_watchpoint(CPUState *cpu, uintptr_t retaddr);
- #ifdef CONFIG_USER_ONLY
-+void page_protect(tb_page_addr_t page_addr);
- int page_unprotect(target_ulong address, uintptr_t pc);
- #endif
-diff --git a/include/exec/translator.h b/include/exec/translator.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/exec/translator.h
-+++ b/include/exec/translator.h
-@@ -XXX,XX +XXX,XX @@
- #include "exec/exec-all.h"
- #include "exec/cpu_ldst.h"
- #include "exec/plugin-gen.h"
-+#include "exec/translate-all.h"
- #include "tcg/tcg.h"
-@@ -XXX,XX +XXX,XX @@ typedef struct DisasContextBase {
-     int num_insns;
-     int max_insns;
-     bool singlestep_enabled;
-+#ifdef CONFIG_USER_ONLY
-+    /*
-+     * Guest address of the last byte of the last protected page.
-+     *
-+     * Pages containing the translated instructions are made non-writable in
-+     * order to achieve consistency in case another thread is modifying the
-+     * code while translate_insn() fetches the instruction bytes piecemeal.
-+     * Such writer threads are blocked on mmap_lock() in page_unprotect().
-+     */
-+    target_ulong page_protect_end;
-+#endif
- } DisasContextBase;
- /**
-@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
-  */
- #define GEN_TRANSLATOR_LD(fullname, type, load_fn, swap_fn)             \
--    static inline type                                                  \
--    fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase,      \
--                      abi_ptr pc, bool do_swap)                         \
--    {                                                                   \
--        type ret = load_fn(env, pc);                                    \
--        if (do_swap) {                                                  \
--            ret = swap_fn(ret);                                         \
--        }                                                               \
--        plugin_insn_append(&ret, sizeof(ret));                          \
--        return ret;                                                     \
--    }                                                                   \
-+    type fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase, \
-+                           abi_ptr pc, bool do_swap);                   \
-     static inline type fullname(CPUArchState *env,                      \
-                                 DisasContextBase *dcbase, abi_ptr pc)   \
-     {                                                                   \
-         return fullname ## _swap(env, dcbase, pc, false);               \
-     }
--GEN_TRANSLATOR_LD(translator_ldub, uint8_t, cpu_ldub_code, /* no swap */)
--GEN_TRANSLATOR_LD(translator_ldsw, int16_t, cpu_ldsw_code, bswap16)
--GEN_TRANSLATOR_LD(translator_lduw, uint16_t, cpu_lduw_code, bswap16)
--GEN_TRANSLATOR_LD(translator_ldl, uint32_t, cpu_ldl_code, bswap32)
--GEN_TRANSLATOR_LD(translator_ldq, uint64_t, cpu_ldq_code, bswap64)
-+#define FOR_EACH_TRANSLATOR_LD(F)                                       \
-+    F(translator_ldub, uint8_t, cpu_ldub_code, /* no swap */)           \
-+    F(translator_ldsw, int16_t, cpu_ldsw_code, bswap16)                 \
-+    F(translator_lduw, uint16_t, cpu_lduw_code, bswap16)                \
-+    F(translator_ldl, uint32_t, cpu_ldl_code, bswap32)                  \
-+    F(translator_ldq, uint64_t, cpu_ldq_code, bswap64)
-+
-+FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
-+
- #undef GEN_TRANSLATOR_LD
- #endif  /* EXEC__TRANSLATOR_H */
-diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/translate-all.c
-+++ b/accel/tcg/translate-all.c
-@@ -XXX,XX +XXX,XX @@ static inline void tb_page_add(PageDesc *p, TranslationBlock *tb,
-     invalidate_page_bitmap(p);
- #if defined(CONFIG_USER_ONLY)
--    if (p->flags & PAGE_WRITE) {
--        target_ulong addr;
--        PageDesc *p2;
--        int prot;
--
--        /* force the host page as non writable (writes will have a
--           page fault + mprotect overhead) */
--        page_addr &= qemu_host_page_mask;
--        prot = 0;
--        for (addr = page_addr; addr < page_addr + qemu_host_page_size;
--            addr += TARGET_PAGE_SIZE) {
--
--            p2 = page_find(addr >> TARGET_PAGE_BITS);
--            if (!p2) {
--                continue;
--            }
--            prot |= p2->flags;
--            p2->flags &= ~PAGE_WRITE;
--          }
--        mprotect(g2h_untagged(page_addr), qemu_host_page_size,
--                 (prot & PAGE_BITS) & ~PAGE_WRITE);
--        if (DEBUG_TB_INVALIDATE_GATE) {
--            printf("protecting code page: 0x" TB_PAGE_ADDR_FMT "\n", page_addr);
--        }
--    }
-+    /* translator_loop() must have made all TB pages non-writable */
-+    assert(!(p->flags & PAGE_WRITE));
- #else
-     /* if some code is already present, then the pages are already
-        protected. So we handle the case where only the first TB is
-@@ -XXX,XX +XXX,XX @@ int page_check_range(target_ulong start, target_ulong len, int flags)
-     return 0;
- }
-+void page_protect(tb_page_addr_t page_addr)
-+{
-+    target_ulong addr;
-+    PageDesc *p;
-+    int prot;
-+
-+    p = page_find(page_addr >> TARGET_PAGE_BITS);
-+    if (p && (p->flags & PAGE_WRITE)) {
-+        /*
-+         * Force the host page as non writable (writes will have a page fault +
-+         * mprotect overhead).
-+         */
-+        page_addr &= qemu_host_page_mask;
-+        prot = 0;
-+        for (addr = page_addr; addr < page_addr + qemu_host_page_size;
-+             addr += TARGET_PAGE_SIZE) {
-+
-+            p = page_find(addr >> TARGET_PAGE_BITS);
-+            if (!p) {
-+                continue;
-+            }
-+            prot |= p->flags;
-+            p->flags &= ~PAGE_WRITE;
-+        }
-+        mprotect(g2h_untagged(page_addr), qemu_host_page_size,
-+                 (prot & PAGE_BITS) & ~PAGE_WRITE);
-+        if (DEBUG_TB_INVALIDATE_GATE) {
-+            printf("protecting code page: 0x" TB_PAGE_ADDR_FMT "\n", page_addr);
-+        }
-+    }
-+}
-+
- /* called from signal handler: invalidate the code and unprotect the
-  * page. Return 0 if the fault was not handled, 1 if it was handled,
-  * and 2 if it was handled but the caller must cause the TB to be
-diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/translator.c
-+++ b/accel/tcg/translator.c
-@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest)
-     return ((db->pc_first ^ dest) & TARGET_PAGE_MASK) == 0;
- }
-+static inline void translator_page_protect(DisasContextBase *dcbase,
-+                                           target_ulong pc)
-+{
-+#ifdef CONFIG_USER_ONLY
-+    dcbase->page_protect_end = pc | ~TARGET_PAGE_MASK;
-+    page_protect(pc);
-+#endif
-+}
-+
- void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
-                      CPUState *cpu, TranslationBlock *tb, int max_insns)
- {
-@@ -XXX,XX +XXX,XX @@ void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
-     db->num_insns = 0;
-     db->max_insns = max_insns;
-     db->singlestep_enabled = cflags & CF_SINGLE_STEP;
-+    translator_page_protect(db, db->pc_next);
-     ops->init_disas_context(db, cpu);
-     tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
-@@ -XXX,XX +XXX,XX @@ void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
-     }
- #endif
- }
-+
-+static inline void translator_maybe_page_protect(DisasContextBase *dcbase,
-+                                                 target_ulong pc, size_t len)
-+{
-+#ifdef CONFIG_USER_ONLY
-+    target_ulong end = pc + len - 1;
-+
-+    if (end > dcbase->page_protect_end) {
-+        translator_page_protect(dcbase, end);
-+    }
-+#endif
-+}
-+
-+#define GEN_TRANSLATOR_LD(fullname, type, load_fn, swap_fn)             \
-+    type fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase, \
-+                           abi_ptr pc, bool do_swap)                    \
-+    {                                                                   \
-+        translator_maybe_page_protect(dcbase, pc, sizeof(type));        \
-+        type ret = load_fn(env, pc);                                    \
-+        if (do_swap) {                                                  \
-+            ret = swap_fn(ret);                                         \
-+        }                                                               \
-+        plugin_insn_append(&ret, sizeof(ret));                          \
-+        return ret;                                                     \
-+    }
-+
-+FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
-+
-+#undef GEN_TRANSLATOR_LD
---
-.25.1

-[PULL 3/9] tcg/i386: Split P_VEXW from P_REXW
+Deleted patch
-We need to be able to represent VEX.W on a 32-bit host, where REX.W
-will always be zero.  Fixes the encoding for VPSLLVQ and VPSRLVQ.
-Fixes: a2ce146a068 ("tcg/i386: Support vector variable shift opcodes")
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/385
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/i386/tcg-target.c.inc | 13 +++++++------
-file changed, 7 insertions(+), 6 deletions(-)
-diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/i386/tcg-target.c.inc
-+++ b/tcg/i386/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
- #define P_EXT        0x100        /* 0x0f opcode prefix */
- #define P_EXT38         0x200           /* 0x0f 0x38 opcode prefix */
- #define P_DATA16        0x400           /* 0x66 opcode prefix */
-+#define P_VEXW          0x1000          /* Set VEX.W = 1 */
- #if TCG_TARGET_REG_BITS == 64
--# define P_REXW         0x1000          /* Set REX.W = 1 */
-+# define P_REXW         P_VEXW          /* Set REX.W = 1; match VEXW */
- # define P_REXB_R       0x2000          /* REG field as byte register */
- # define P_REXB_RM      0x4000          /* R/M field as byte register */
- # define P_GS           0x8000          /* gs segment override */
-@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
- #define OPC_VPBROADCASTW (0x79 | P_EXT38 | P_DATA16)
- #define OPC_VPBROADCASTD (0x58 | P_EXT38 | P_DATA16)
- #define OPC_VPBROADCASTQ (0x59 | P_EXT38 | P_DATA16)
--#define OPC_VPERMQ      (0x00 | P_EXT3A | P_DATA16 | P_REXW)
-+#define OPC_VPERMQ      (0x00 | P_EXT3A | P_DATA16 | P_VEXW)
- #define OPC_VPERM2I128  (0x46 | P_EXT3A | P_DATA16 | P_VEXL)
- #define OPC_VPSLLVD     (0x47 | P_EXT38 | P_DATA16)
--#define OPC_VPSLLVQ     (0x47 | P_EXT38 | P_DATA16 | P_REXW)
-+#define OPC_VPSLLVQ     (0x47 | P_EXT38 | P_DATA16 | P_VEXW)
- #define OPC_VPSRAVD     (0x46 | P_EXT38 | P_DATA16)
- #define OPC_VPSRLVD     (0x45 | P_EXT38 | P_DATA16)
--#define OPC_VPSRLVQ     (0x45 | P_EXT38 | P_DATA16 | P_REXW)
-+#define OPC_VPSRLVQ     (0x45 | P_EXT38 | P_DATA16 | P_VEXW)
- #define OPC_VZEROUPPER  (0x77 | P_EXT)
- #define OPC_XCHG_ax_r32    (0x90)
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_vex_opc(TCGContext *s, int opc, int r, int v,
-     /* Use the two byte form if possible, which cannot encode
-        VEX.W, VEX.B, VEX.X, or an m-mmmm field other than P_EXT.  */
--    if ((opc & (P_EXT | P_EXT38 | P_EXT3A | P_REXW)) == P_EXT
-+    if ((opc & (P_EXT | P_EXT38 | P_EXT3A | P_VEXW)) == P_EXT
-         && ((rm | index) & 8) == 0) {
-         /* Two byte VEX prefix.  */
-         tcg_out8(s, 0xc5);
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_vex_opc(TCGContext *s, int opc, int r, int v,
-         tmp |= (rm & 8 ? 0 : 0x20);            /* VEX.B */
-         tcg_out8(s, tmp);
--        tmp = (opc & P_REXW ? 0x80 : 0);       /* VEX.W */
-+        tmp = (opc & P_VEXW ? 0x80 : 0);       /* VEX.W */
-     }
-     tmp |= (opc & P_VEXL ? 0x04 : 0);      /* VEX.L */
---
-.25.1

-[PULL 4/9] accel/tcg: remove redundant TCG_KICK_PERIOD define
+Deleted patch
-From: Luc Michel <lmichel@kalray.eu>
-The TCG_KICK_PERIOD macro is already defined in tcg-accel-ops-rr.h.
-Remove it from tcg-accel-ops-rr.c.
-Signed-off-by: Luc Michel <lmichel@kalray.eu>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <20210811141229.12470-1-lmichel@kalray.eu>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- accel/tcg/tcg-accel-ops-rr.c | 2 --
-file changed, 2 deletions(-)
-diff --git a/accel/tcg/tcg-accel-ops-rr.c b/accel/tcg/tcg-accel-ops-rr.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/tcg-accel-ops-rr.c
-+++ b/accel/tcg/tcg-accel-ops-rr.c
-@@ -XXX,XX +XXX,XX @@ void rr_kick_vcpu_thread(CPUState *unused)
- static QEMUTimer *rr_kick_vcpu_timer;
- static CPUState *rr_current_cpu;
--#define TCG_KICK_PERIOD (NANOSECONDS_PER_SECOND / 10)
--
- static inline int64_t rr_next_kick_time(void)
- {
-     return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + TCG_KICK_PERIOD;
---
-.25.1

-[PULL 5/9] tcg: Remove tcg_global_reg_new defines
+Deleted patch
-From: Bin Meng <bmeng.cn@gmail.com>
-Since commit 1c2adb958fc0 ("tcg: Initialize cpu_env generically"),
-these tcg_global_reg_new_ macros are not used anywhere.
-Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-Id: <20210816143507.11200-1-bmeng.cn@gmail.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/tcg/tcg-op.h    | 2 --
- target/hppa/translate.c | 3 ---
-files changed, 5 deletions(-)
-diff --git a/include/tcg/tcg-op.h b/include/tcg/tcg-op.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/tcg/tcg-op.h
-+++ b/include/tcg/tcg-op.h
-@@ -XXX,XX +XXX,XX @@ static inline void tcg_gen_plugin_cb_end(void)
- #if TARGET_LONG_BITS == 32
- #define tcg_temp_new() tcg_temp_new_i32()
--#define tcg_global_reg_new tcg_global_reg_new_i32
- #define tcg_global_mem_new tcg_global_mem_new_i32
- #define tcg_temp_local_new() tcg_temp_local_new_i32()
- #define tcg_temp_free tcg_temp_free_i32
-@@ -XXX,XX +XXX,XX @@ static inline void tcg_gen_plugin_cb_end(void)
- #define tcg_gen_qemu_st_tl tcg_gen_qemu_st_i32
- #else
- #define tcg_temp_new() tcg_temp_new_i64()
--#define tcg_global_reg_new tcg_global_reg_new_i64
- #define tcg_global_mem_new tcg_global_mem_new_i64
- #define tcg_temp_local_new() tcg_temp_local_new_i64()
- #define tcg_temp_free tcg_temp_free_i64
-diff --git a/target/hppa/translate.c b/target/hppa/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/hppa/translate.c
-+++ b/target/hppa/translate.c
-@@ -XXX,XX +XXX,XX @@
- #undef TCGv
- #undef tcg_temp_new
--#undef tcg_global_reg_new
- #undef tcg_global_mem_new
- #undef tcg_temp_local_new
- #undef tcg_temp_free
-@@ -XXX,XX +XXX,XX @@
- #define TCGv_reg             TCGv_i64
- #define tcg_temp_new         tcg_temp_new_i64
--#define tcg_global_reg_new   tcg_global_reg_new_i64
- #define tcg_global_mem_new   tcg_global_mem_new_i64
- #define tcg_temp_local_new   tcg_temp_local_new_i64
- #define tcg_temp_free        tcg_temp_free_i64
-@@ -XXX,XX +XXX,XX @@
- #else
- #define TCGv_reg             TCGv_i32
- #define tcg_temp_new         tcg_temp_new_i32
--#define tcg_global_reg_new   tcg_global_reg_new_i32
- #define tcg_global_mem_new   tcg_global_mem_new_i32
- #define tcg_temp_local_new   tcg_temp_local_new_i32
- #define tcg_temp_free        tcg_temp_free_i32
---
-.25.1

-[PULL 6/9] include/qemu: Use builtins for bswap
+Deleted patch
-All supported compilers have builtins for this.
-Drop all of the complicated system detection stuff.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-Id: <20210708181743.750220-1-richard.henderson@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- meson.build          |  6 -----
- include/qemu/bswap.h | 53 +++-----------------------------------------
-files changed, 3 insertions(+), 56 deletions(-)
-diff --git a/meson.build b/meson.build
-index XXXXXXX..XXXXXXX 100644
---- a/meson.build
-+++ b/meson.build
-@@ -XXX,XX +XXX,XX @@ config_host_data.set('HAVE_STRCHRNUL', cc.has_function('strchrnul'))
- config_host_data.set('HAVE_SYSTEM_FUNCTION', cc.has_function('system', prefix: '#include <stdlib.h>'))
- # has_header_symbol
--config_host_data.set('CONFIG_BYTESWAP_H',
--                     cc.has_header_symbol('byteswap.h', 'bswap_32'))
- config_host_data.set('CONFIG_EPOLL_CREATE1',
-                      cc.has_header_symbol('sys/epoll.h', 'epoll_create1'))
- config_host_data.set('CONFIG_HAS_ENVIRON',
-@@ -XXX,XX +XXX,XX @@ config_host_data.set('CONFIG_INOTIFY',
-                      cc.has_header_symbol('sys/inotify.h', 'inotify_init'))
- config_host_data.set('CONFIG_INOTIFY1',
-                      cc.has_header_symbol('sys/inotify.h', 'inotify_init1'))
--config_host_data.set('CONFIG_MACHINE_BSWAP_H',
--                     cc.has_header_symbol('machine/bswap.h', 'bswap32',
--                                          prefix: '''#include <sys/endian.h>
--                                                     #include <sys/types.h>'''))
- config_host_data.set('CONFIG_PRCTL_PR_SET_TIMERSLACK',
-                      cc.has_header_symbol('sys/prctl.h', 'PR_SET_TIMERSLACK'))
- config_host_data.set('CONFIG_RTNETLINK',
-diff --git a/include/qemu/bswap.h b/include/qemu/bswap.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/bswap.h
-+++ b/include/qemu/bswap.h
-@@ -XXX,XX +XXX,XX @@
- #ifndef BSWAP_H
- #define BSWAP_H
--#ifdef CONFIG_MACHINE_BSWAP_H
--# include <sys/endian.h>
--# include <machine/bswap.h>
--#elif defined(__FreeBSD__)
--# include <sys/endian.h>
--#elif defined(__HAIKU__)
--# include <endian.h>
--#elif defined(CONFIG_BYTESWAP_H)
--# include <byteswap.h>
--#define BSWAP_FROM_BYTESWAP
--# else
--#define BSWAP_FROM_FALLBACKS
--#endif /* ! CONFIG_MACHINE_BSWAP_H */
--
- #ifdef __cplusplus
- extern "C" {
- #endif
- #include "fpu/softfloat-types.h"
--#ifdef BSWAP_FROM_BYTESWAP
- static inline uint16_t bswap16(uint16_t x)
- {
--    return bswap_16(x);
-+    return __builtin_bswap16(x);
- }
- static inline uint32_t bswap32(uint32_t x)
- {
--    return bswap_32(x);
-+    return __builtin_bswap32(x);
- }
- static inline uint64_t bswap64(uint64_t x)
- {
--    return bswap_64(x);
-+    return __builtin_bswap64(x);
- }
--#endif
--
--#ifdef BSWAP_FROM_FALLBACKS
--static inline uint16_t bswap16(uint16_t x)
--{
--    return (((x & 0x00ff) << 8) |
--            ((x & 0xff00) >> 8));
--}
--
--static inline uint32_t bswap32(uint32_t x)
--{
--    return (((x & 0x000000ffU) << 24) |
--            ((x & 0x0000ff00U) <<  8) |
--            ((x & 0x00ff0000U) >>  8) |
--            ((x & 0xff000000U) >> 24));
--}
--
--static inline uint64_t bswap64(uint64_t x)
--{
--    return (((x & 0x00000000000000ffULL) << 56) |
--            ((x & 0x000000000000ff00ULL) << 40) |
--            ((x & 0x0000000000ff0000ULL) << 24) |
--            ((x & 0x00000000ff000000ULL) <<  8) |
--            ((x & 0x000000ff00000000ULL) >>  8) |
--            ((x & 0x0000ff0000000000ULL) >> 24) |
--            ((x & 0x00ff000000000000ULL) >> 40) |
--            ((x & 0xff00000000000000ULL) >> 56));
--}
--#endif
--
--#undef BSWAP_FROM_BYTESWAP
--#undef BSWAP_FROM_FALLBACKS
- static inline void bswap16s(uint16_t *s)
- {
---
-.25.1

-[PULL 7/9] tcg/ppc: Replace TCG_TARGET_CALL_DARWIN with _CALL_DARWIN
+Deleted patch
-If __APPLE__, ensure that _CALL_DARWIN is set, then remove
-our local TCG_TARGET_CALL_DARWIN.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/ppc/tcg-target.c.inc | 8 ++++----
-file changed, 4 insertions(+), 4 deletions(-)
-diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/ppc/tcg-target.c.inc
-+++ b/tcg/ppc/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@
- #include "elf.h"
- #include "../tcg-pool.c.inc"
--#if defined _CALL_DARWIN || defined __APPLE__
--#define TCG_TARGET_CALL_DARWIN
-+#if !defined _CALL_DARWIN && defined __APPLE__
-+#define _CALL_DARWIN 1
- #endif
- #ifdef _CALL_SYSV
- # define TCG_TARGET_CALL_ALIGN_ARGS   1
-@@ -XXX,XX +XXX,XX @@ static const int tcg_target_call_oarg_regs[] = {
- };
- static const int tcg_target_callee_save_regs[] = {
--#ifdef TCG_TARGET_CALL_DARWIN
-+#ifdef _CALL_DARWIN
-     TCG_REG_R11,
- #endif
-     TCG_REG_R14,
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_nop_fill(tcg_insn_unit *p, int count)
- # define LINK_AREA_SIZE                (6 * SZR)
- # define LR_OFFSET                     (1 * SZR)
- # define TCG_TARGET_CALL_STACK_OFFSET  (LINK_AREA_SIZE + 8 * SZR)
--#elif defined(TCG_TARGET_CALL_DARWIN)
-+#elif defined(_CALL_DARWIN)
- # define LINK_AREA_SIZE                (6 * SZR)
- # define LR_OFFSET                     (2 * SZR)
- #elif TCG_TARGET_REG_BITS == 64
---
-.25.1

-[PULL 8/9] tcg/ppc: Ensure _CALL_SYSV is set for 32-bit ELF
+Deleted patch
-Clang only sets _CALL_ELF for ppc64, and nothing at all to specify
-the ABI for ppc32.  Make a good guess based on other symbols.
-Reported-by: Brad Smith <brad@comstyle.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/ppc/tcg-target.c.inc | 21 ++++++++++++++++++---
-file changed, 18 insertions(+), 3 deletions(-)
-diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/ppc/tcg-target.c.inc
-+++ b/tcg/ppc/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@
- #include "elf.h"
- #include "../tcg-pool.c.inc"
--#if !defined _CALL_DARWIN && defined __APPLE__
--#define _CALL_DARWIN 1
--#endif
-+/*
-+ * Standardize on the _CALL_FOO symbols used by GCC:
-+ * Apple XCode does not define _CALL_DARWIN.
-+ * Clang defines _CALL_ELF (64-bit) but not _CALL_SYSV (32-bit).
-+ */
-+#if !defined(_CALL_SYSV) && \
-+    !defined(_CALL_DARWIN) && \
-+    !defined(_CALL_AIX) && \
-+    !defined(_CALL_ELF)
-+# if defined(__APPLE__)
-+#  define _CALL_DARWIN
-+# elif defined(__ELF__) && TCG_TARGET_REG_BITS == 32
-+#  define _CALL_SYSV
-+# else
-+#  error "Unknown ABI"
-+# endif
-+#endif
-+
- #ifdef _CALL_SYSV
- # define TCG_TARGET_CALL_ALIGN_ARGS   1
- #endif
---
-.25.1

-[PULL 9/9] tcg/arm: Fix tcg_out_vec_op function signature
+Deleted patch
-From: "Jose R. Ziviani" <jziviani@suse.de>
-Commit 5e8892db93 fixed several function signatures but tcg_out_vec_op
-for arm is missing. It causes a build error on armv6 and armv7:
-tcg-target.c.inc:2718:42: error: argument 5 of type 'const TCGArg *'
-{aka 'const unsigned int *'} declared as a pointer [-Werror=array-parameter=]
-   const TCGArg *args, const int *const_args)
-  ~~~~~~~~~~~~~~^~~~
-../tcg/tcg.c:120:41: note: previously declared as an array 'const TCGArg[16]'
-{aka 'const unsigned int[16]'}
-   const TCGArg args[TCG_MAX_OP_ARGS],
-  ~~~~~~~~~~~~~~^~~~
-Signed-off-by: Jose R. Ziviani <jziviani@suse.de>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-Id: <20210908185338.7927-1-jziviani@suse.de>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/arm/tcg-target.c.inc | 3 ++-
-file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/arm/tcg-target.c.inc
-+++ b/tcg/arm/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static const ARMInsn vec_cmp0_insn[16] = {
- static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
-                            unsigned vecl, unsigned vece,
--                           const TCGArg *args, const int *const_args)
-+                           const TCGArg args[TCG_MAX_OP_ARGS],
-+                           const int const_args[TCG_MAX_OP_ARGS])
- {
-     TCGType type = vecl + TCG_TYPE_V64;
-     unsigned q = vecl;
---
-.25.1

Note that I've extended the expiration date of my gpg key
and have uploaded it to keyserver.ubuntu.com.

The following changes since commit 99c44988d5ba1866a411450c877ed818b1b70081:

Merge remote-tracking branch 'remotes/bsdimp/tags/pull-bsd-user-20210910' into staging (2021-09-11 14:00:39 +0100)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20210912

for you to fetch changes up to 267a3ec3e2a8fb3e06a9d46d09fcfc57dfefd118:

tcg/arm: Fix tcg_out_vec_op function signature (2021-09-12 05:07:36 -0700)

----------------------------------------------------------------
Fix translation race condition for user-only.
Fix tcg/i386 encoding for VPSLLVQ, VPSRLVQ.
Fix tcg/arm tcg_out_vec_op signature.
Fix tcg/ppc (32bit) build with clang.
Remove dupluate TCG_KICK_PERIOD definition.
Remove unused tcg_global_reg_new.
Use __builtin_bswap*.

----------------------------------------------------------------
Bin Meng (1):
      tcg: Remove tcg_global_reg_new defines

Ilya Leoshkevich (2):
      accel/tcg: Add DisasContextBase argument to translator_ld*
      accel/tcg: Clear PAGE_WRITE before translation

Jose R. Ziviani (1):
      tcg/arm: Fix tcg_out_vec_op function signature

Luc Michel (1):
      accel/tcg: remove redundant TCG_KICK_PERIOD define

Richard Henderson (4):
      tcg/i386: Split P_VEXW from P_REXW
      include/qemu: Use builtins for bswap
      tcg/ppc: Replace TCG_TARGET_CALL_DARWIN with _CALL_DARWIN
      tcg/ppc: Ensure _CALL_SYSV is set for 32-bit ELF

From: Ilya Leoshkevich <iii@linux.ibm.com>

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
[rth: Split out of a larger patch.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/translator.h                 |  9 +++++----
 target/arm/arm_ldst.h                     | 12 ++++++------
 target/alpha/translate.c                  |  2 +-
 target/arm/translate-a64.c                |  2 +-
 target/arm/translate.c                    |  9 +++++----
 target/hexagon/translate.c                |  3 ++-
 target/hppa/translate.c                   |  2 +-
 target/i386/tcg/translate.c               | 10 +++++-----
 target/m68k/translate.c                   |  2 +-
 target/mips/tcg/translate.c               |  8 ++++----
 target/openrisc/translate.c               |  2 +-
 target/ppc/translate.c                    |  5 +++--
 target/riscv/translate.c                  |  5 +++--
 target/s390x/tcg/translate.c              | 16 +++++++++-------
 target/sh4/translate.c                    |  4 ++--
 target/sparc/translate.c                  |  2 +-
 target/xtensa/translate.c                 |  5 +++--
 target/mips/tcg/micromips_translate.c.inc |  2 +-
 target/mips/tcg/mips16e_translate.c.inc   |  4 ++--
 target/mips/tcg/nanomips_translate.c.inc  |  4 ++--
 20 files changed, 58 insertions(+), 50 deletions(-)

diff --git a/include/exec/translator.h b/include/exec/translator.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/translator.h
+++ b/include/exec/translator.h
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
 
 #define GEN_TRANSLATOR_LD(fullname, type, load_fn, swap_fn)             \
     static inline type                                                  \
-    fullname ## _swap(CPUArchState *env, abi_ptr pc, bool do_swap)      \
+    fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase,      \
+                      abi_ptr pc, bool do_swap)                         \
     {                                                                   \
         type ret = load_fn(env, pc);                                    \
         if (do_swap) {                                                  \
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
         plugin_insn_append(&ret, sizeof(ret));                          \
         return ret;                                                     \
     }                                                                   \
-                                                                        \
-    static inline type fullname(CPUArchState *env, abi_ptr pc)          \
+    static inline type fullname(CPUArchState *env,                      \
+                                DisasContextBase *dcbase, abi_ptr pc)   \
     {                                                                   \
-        return fullname ## _swap(env, pc, false);                       \
+        return fullname ## _swap(env, dcbase, pc, false);               \
     }
 
 GEN_TRANSLATOR_LD(translator_ldub, uint8_t, cpu_ldub_code, /* no swap */)
diff --git a/target/arm/arm_ldst.h b/target/arm/arm_ldst.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm_ldst.h
+++ b/target/arm/arm_ldst.h
@@ -XXX,XX +XXX,XX @@
 #include "qemu/bswap.h"
 
 /* Load an instruction and return it in the standard little-endian order */
-static inline uint32_t arm_ldl_code(CPUARMState *env, target_ulong addr,
-                                    bool sctlr_b)
+static inline uint32_t arm_ldl_code(CPUARMState *env, DisasContextBase *s,
+                                    target_ulong addr, bool sctlr_b)
 {
-    return translator_ldl_swap(env, addr, bswap_code(sctlr_b));
+    return translator_ldl_swap(env, s, addr, bswap_code(sctlr_b));
 }
 
 /* Ditto, for a halfword (Thumb) instruction */
-static inline uint16_t arm_lduw_code(CPUARMState *env, target_ulong addr,
-                                     bool sctlr_b)
+static inline uint16_t arm_lduw_code(CPUARMState *env, DisasContextBase* s,
+                                     target_ulong addr, bool sctlr_b)
 {
 #ifndef CONFIG_USER_ONLY
     /* In big-endian (BE32) mode, adjacent Thumb instructions have been swapped
@@ -XXX,XX +XXX,XX @@ static inline uint16_t arm_lduw_code(CPUARMState *env, target_ulong addr,
         addr ^= 2;
     }
 #endif
-    return translator_lduw_swap(env, addr, bswap_code(sctlr_b));
+    return translator_lduw_swap(env, s, addr, bswap_code(sctlr_b));
 }
 
 #endif
diff --git a/target/alpha/translate.c b/target/alpha/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/translate.c
+++ b/target/alpha/translate.c
@@ -XXX,XX +XXX,XX @@ static void alpha_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
 {
     DisasContext *ctx = container_of(dcbase, DisasContext, base);
     CPUAlphaState *env = cpu->env_ptr;
-    uint32_t insn = translator_ldl(env, ctx->base.pc_next);
+    uint32_t insn = translator_ldl(env, &ctx->base, ctx->base.pc_next);
 
     ctx->base.pc_next += 4;
     ctx->base.is_jmp = translate_one(ctx, insn);
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_a64_insn(CPUARMState *env, DisasContext *s)
     uint32_t insn;
 
     s->pc_curr = s->base.pc_next;
-    insn = arm_ldl_code(env, s->base.pc_next, s->sctlr_b);
+    insn = arm_ldl_code(env, &s->base, s->base.pc_next, s->sctlr_b);
     s->insn = insn;
     s->base.pc_next += 4;
 
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static bool insn_crosses_page(CPUARMState *env, DisasContext *s)
      * boundary, so we cross the page if the first 16 bits indicate
      * that this is a 32 bit insn.
      */
-    uint16_t insn = arm_lduw_code(env, s->base.pc_next, s->sctlr_b);
+    uint16_t insn = arm_lduw_code(env, &s->base, s->base.pc_next, s->sctlr_b);
 
     return !thumb_insn_is_16bit(s, s->base.pc_next, insn);
 }
@@ -XXX,XX +XXX,XX @@ static void arm_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
     }
 
     dc->pc_curr = dc->base.pc_next;
-    insn = arm_ldl_code(env, dc->base.pc_next, dc->sctlr_b);
+    insn = arm_ldl_code(env, &dc->base, dc->base.pc_next, dc->sctlr_b);
     dc->insn = insn;
     dc->base.pc_next += 4;
     disas_arm_insn(dc, insn);
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
     }
 
     dc->pc_curr = dc->base.pc_next;
-    insn = arm_lduw_code(env, dc->base.pc_next, dc->sctlr_b);
+    insn = arm_lduw_code(env, &dc->base, dc->base.pc_next, dc->sctlr_b);
     is_16bit = thumb_insn_is_16bit(dc, dc->base.pc_next, insn);
     dc->base.pc_next += 2;
     if (!is_16bit) {
-        uint32_t insn2 = arm_lduw_code(env, dc->base.pc_next, dc->sctlr_b);
+        uint32_t insn2 = arm_lduw_code(env, &dc->base, dc->base.pc_next,
+                                       dc->sctlr_b);
 
         insn = insn << 16 | insn2;
         dc->base.pc_next += 2;
diff --git a/target/hexagon/translate.c b/target/hexagon/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/translate.c
+++ b/target/hexagon/translate.c
@@ -XXX,XX +XXX,XX @@ static int read_packet_words(CPUHexagonState *env, DisasContext *ctx,
     memset(words, 0, PACKET_WORDS_MAX * sizeof(uint32_t));
     for (nwords = 0; !found_end && nwords < PACKET_WORDS_MAX; nwords++) {
         words[nwords] =
-            translator_ldl(env, ctx->base.pc_next + nwords * sizeof(uint32_t));
+            translator_ldl(env, &ctx->base,
+                           ctx->base.pc_next + nwords * sizeof(uint32_t));
         found_end = is_packet_end(words[nwords]);
     }
     if (!found_end) {
diff --git a/target/hppa/translate.c b/target/hppa/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/translate.c
+++ b/target/hppa/translate.c
@@ -XXX,XX +XXX,XX @@ static void hppa_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
     {
         /* Always fetch the insn, even if nullified, so that we check
            the page permissions for execute.  */
-        uint32_t insn = translator_ldl(env, ctx->base.pc_next);
+        uint32_t insn = translator_ldl(env, &ctx->base, ctx->base.pc_next);
 
         /* Set up the IA queue for the next insn.
            This will be overwritten by a branch.  */
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static uint64_t advance_pc(CPUX86State *env, DisasContext *s, int num_bytes)
 
 static inline uint8_t x86_ldub_code(CPUX86State *env, DisasContext *s)
 {
-    return translator_ldub(env, advance_pc(env, s, 1));
+    return translator_ldub(env, &s->base, advance_pc(env, s, 1));
 }
 
 static inline int16_t x86_ldsw_code(CPUX86State *env, DisasContext *s)
 {
-    return translator_ldsw(env, advance_pc(env, s, 2));
+    return translator_ldsw(env, &s->base, advance_pc(env, s, 2));
 }
 
 static inline uint16_t x86_lduw_code(CPUX86State *env, DisasContext *s)
 {
-    return translator_lduw(env, advance_pc(env, s, 2));
+    return translator_lduw(env, &s->base, advance_pc(env, s, 2));
 }
 
 static inline uint32_t x86_ldl_code(CPUX86State *env, DisasContext *s)
 {
-    return translator_ldl(env, advance_pc(env, s, 4));
+    return translator_ldl(env, &s->base, advance_pc(env, s, 4));
 }
 
 #ifdef TARGET_X86_64
 static inline uint64_t x86_ldq_code(CPUX86State *env, DisasContext *s)
 {
-    return translator_ldq(env, advance_pc(env, s, 8));
+    return translator_ldq(env, &s->base, advance_pc(env, s, 8));
 }
 #endif
 
diff --git a/target/m68k/translate.c b/target/m68k/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/translate.c
+++ b/target/m68k/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv gen_ldst(DisasContext *s, int opsize, TCGv addr, TCGv val,
 static inline uint16_t read_im16(CPUM68KState *env, DisasContext *s)
 {
     uint16_t im;
-    im = translator_lduw(env, s->pc);
+    im = translator_lduw(env, &s->base, s->pc);
     s->pc += 2;
     return im;
 }
diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/translate.c
+++ b/target/mips/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static void mips_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
 
     is_slot = ctx->hflags & MIPS_HFLAG_BMASK;
     if (ctx->insn_flags & ISA_NANOMIPS32) {
-        ctx->opcode = translator_lduw(env, ctx->base.pc_next);
+        ctx->opcode = translator_lduw(env, &ctx->base, ctx->base.pc_next);
         insn_bytes = decode_isa_nanomips(env, ctx);
     } else if (!(ctx->hflags & MIPS_HFLAG_M16)) {
-        ctx->opcode = translator_ldl(env, ctx->base.pc_next);
+        ctx->opcode = translator_ldl(env, &ctx->base, ctx->base.pc_next);
         insn_bytes = 4;
         decode_opc(env, ctx);
     } else if (ctx->insn_flags & ASE_MICROMIPS) {
-        ctx->opcode = translator_lduw(env, ctx->base.pc_next);
+        ctx->opcode = translator_lduw(env, &ctx->base, ctx->base.pc_next);
         insn_bytes = decode_isa_micromips(env, ctx);
     } else if (ctx->insn_flags & ASE_MIPS16) {
-        ctx->opcode = translator_lduw(env, ctx->base.pc_next);
+        ctx->opcode = translator_lduw(env, &ctx->base, ctx->base.pc_next);
         insn_bytes = decode_ase_mips16e(env, ctx);
     } else {
         gen_reserved_instruction(ctx);
diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/translate.c
+++ b/target/openrisc/translate.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
 {
     DisasContext *dc = container_of(dcbase, DisasContext, base);
     OpenRISCCPU *cpu = OPENRISC_CPU(cs);
-    uint32_t insn = translator_ldl(&cpu->env, dc->base.pc_next);
+    uint32_t insn = translator_ldl(&cpu->env, &dc->base, dc->base.pc_next);
 
     if (!decode(dc, insn)) {
         gen_illegal_exception(dc);
diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -XXX,XX +XXX,XX @@ static void ppc_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
               ctx->base.pc_next, ctx->mem_idx, (int)msr_ir);
 
     ctx->cia = pc = ctx->base.pc_next;
-    insn = translator_ldl_swap(env, pc, need_byteswap(ctx));
+    insn = translator_ldl_swap(env, dcbase, pc, need_byteswap(ctx));
     ctx->base.pc_next = pc += 4;
 
     if (!is_prefix_insn(ctx, insn)) {
@@ -XXX,XX +XXX,XX @@ static void ppc_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
         gen_exception_err(ctx, POWERPC_EXCP_ALIGN, POWERPC_EXCP_ALIGN_INSN);
         ok = true;
     } else {
-        uint32_t insn2 = translator_ldl_swap(env, pc, need_byteswap(ctx));
+        uint32_t insn2 = translator_ldl_swap(env, dcbase, pc,
+                                             need_byteswap(ctx));
         ctx->base.pc_next = pc += 4;
         ok = decode_insn64(ctx, deposit64(insn2, 32, 32, insn));
     }
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
     } else {
         uint32_t opcode32 = opcode;
         opcode32 = deposit32(opcode32, 16, 16,
-                             translator_lduw(env, ctx->base.pc_next + 2));
+                             translator_lduw(env, &ctx->base,
+                                             ctx->base.pc_next + 2));
         ctx->pc_succ_insn = ctx->base.pc_next + 4;
         if (!decode_insn32(ctx, opcode32)) {
             gen_exception_illegal(ctx);
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
 {
     DisasContext *ctx = container_of(dcbase, DisasContext, base);
     CPURISCVState *env = cpu->env_ptr;
-    uint16_t opcode16 = translator_lduw(env, ctx->base.pc_next);
+    uint16_t opcode16 = translator_lduw(env, &ctx->base, ctx->base.pc_next);
 
     decode_opc(env, ctx, opcode16);
     ctx->base.pc_next = ctx->pc_succ_insn;
diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static void update_cc_op(DisasContext *s)
     }
 }
 
-static inline uint64_t ld_code2(CPUS390XState *env, uint64_t pc)
+static inline uint64_t ld_code2(CPUS390XState *env, DisasContext *s,
+                                uint64_t pc)
 {
-    return (uint64_t)cpu_lduw_code(env, pc);
+    return (uint64_t)translator_lduw(env, &s->base, pc);
 }
 
-static inline uint64_t ld_code4(CPUS390XState *env, uint64_t pc)
+static inline uint64_t ld_code4(CPUS390XState *env, DisasContext *s,
+                                uint64_t pc)
 {
-    return (uint64_t)(uint32_t)cpu_ldl_code(env, pc);
+    return (uint64_t)(uint32_t)translator_ldl(env, &s->base, pc);
 }
 
 static int get_mem_index(DisasContext *s)
@@ -XXX,XX +XXX,XX @@ static const DisasInsn *extract_insn(CPUS390XState *env, DisasContext *s)
         ilen = s->ex_value & 0xf;
         op = insn >> 56;
     } else {
-        insn = ld_code2(env, pc);
+        insn = ld_code2(env, s, pc);
         op = (insn >> 8) & 0xff;
         ilen = get_ilen(op);
         switch (ilen) {
@@ -XXX,XX +XXX,XX @@ static const DisasInsn *extract_insn(CPUS390XState *env, DisasContext *s)
             insn = insn << 48;
             break;
         case 4:
-            insn = ld_code4(env, pc) << 32;
+            insn = ld_code4(env, s, pc) << 32;
             break;
         case 6:
-            insn = (insn << 48) | (ld_code4(env, pc + 2) << 16);
+            insn = (insn << 48) | (ld_code4(env, s, pc + 2) << 16);
             break;
         default:
             g_assert_not_reached();
diff --git a/target/sh4/translate.c b/target/sh4/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/translate.c
+++ b/target/sh4/translate.c
@@ -XXX,XX +XXX,XX @@ static void decode_gusa(DisasContext *ctx, CPUSH4State *env)
 
     /* Read all of the insns for the region.  */
     for (i = 0; i < max_insns; ++i) {
-        insns[i] = translator_lduw(env, pc + i * 2);
+        insns[i] = translator_lduw(env, &ctx->base, pc + i * 2);
     }
 
     ld_adr = ld_dst = ld_mop = -1;
@@ -XXX,XX +XXX,XX @@ static void sh4_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
     }
 #endif
 
-    ctx->opcode = translator_lduw(env, ctx->base.pc_next);
+    ctx->opcode = translator_lduw(env, &ctx->base, ctx->base.pc_next);
     decode_opc(ctx);
     ctx->base.pc_next += 2;
 }
diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -XXX,XX +XXX,XX @@ static void sparc_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
     CPUSPARCState *env = cs->env_ptr;
     unsigned int insn;
 
-    insn = translator_ldl(env, dc->pc);
+    insn = translator_ldl(env, &dc->base, dc->pc);
     dc->base.pc_next += 4;
     disas_sparc_insn(dc, insn);
 
diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/translate.c
+++ b/target/xtensa/translate.c
@@ -XXX,XX +XXX,XX @@ static int arg_copy_compare(const void *a, const void *b)
 static void disas_xtensa_insn(CPUXtensaState *env, DisasContext *dc)
 {
     xtensa_isa isa = dc->config->isa;
-    unsigned char b[MAX_INSN_LENGTH] = {translator_ldub(env, dc->pc)};
+    unsigned char b[MAX_INSN_LENGTH] = {translator_ldub(env, &dc->base,
+                                                        dc->pc)};
     unsigned len = xtensa_op0_insn_len(dc, b[0]);
     xtensa_format fmt;
     int slot, slots;
@@ -XXX,XX +XXX,XX @@ static void disas_xtensa_insn(CPUXtensaState *env, DisasContext *dc)
 
     dc->base.pc_next = dc->pc + len;
     for (i = 1; i < len; ++i) {
-        b[i] = translator_ldub(env, dc->pc + i);
+        b[i] = translator_ldub(env, &dc->base, dc->pc + i);
     }
     xtensa_insnbuf_from_chars(isa, dc->insnbuf, b, len);
     fmt = xtensa_format_decode(isa, dc->insnbuf);
diff --git a/target/mips/tcg/micromips_translate.c.inc b/target/mips/tcg/micromips_translate.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/micromips_translate.c.inc
+++ b/target/mips/tcg/micromips_translate.c.inc
@@ -XXX,XX +XXX,XX @@ static void decode_micromips32_opc(CPUMIPSState *env, DisasContext *ctx)
     uint32_t op, minor, minor2, mips32_op;
     uint32_t cond, fmt, cc;
 
-    insn = translator_lduw(env, ctx->base.pc_next + 2);
+    insn = translator_lduw(env, &ctx->base, ctx->base.pc_next + 2);
     ctx->opcode = (ctx->opcode << 16) | insn;
 
     rt = (ctx->opcode >> 21) & 0x1f;
diff --git a/target/mips/tcg/mips16e_translate.c.inc b/target/mips/tcg/mips16e_translate.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/mips16e_translate.c.inc
+++ b/target/mips/tcg/mips16e_translate.c.inc
@@ -XXX,XX +XXX,XX @@ static void decode_i64_mips16(DisasContext *ctx,
 
 static int decode_extended_mips16_opc(CPUMIPSState *env, DisasContext *ctx)
 {
-    int extend = translator_lduw(env, ctx->base.pc_next + 2);
+    int extend = translator_lduw(env, &ctx->base, ctx->base.pc_next + 2);
     int op, rx, ry, funct, sa;
     int16_t imm, offset;
 
@@ -XXX,XX +XXX,XX @@ static int decode_ase_mips16e(CPUMIPSState *env, DisasContext *ctx)
         /* No delay slot, so just process as a normal instruction */
         break;
     case M16_OPC_JAL:
-        offset = translator_lduw(env, ctx->base.pc_next + 2);
+        offset = translator_lduw(env, &ctx->base, ctx->base.pc_next + 2);
         offset = (((ctx->opcode & 0x1f) << 21)
                   | ((ctx->opcode >> 5) & 0x1f) << 16
                   | offset) << 2;
diff --git a/target/mips/tcg/nanomips_translate.c.inc b/target/mips/tcg/nanomips_translate.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/nanomips_translate.c.inc
+++ b/target/mips/tcg/nanomips_translate.c.inc
@@ -XXX,XX +XXX,XX @@ static int decode_nanomips_32_48_opc(CPUMIPSState *env, DisasContext *ctx)
     int offset;
     int imm;
 
-    insn = translator_lduw(env, ctx->base.pc_next + 2);
+    insn = translator_lduw(env, &ctx->base, ctx->base.pc_next + 2);
     ctx->opcode = (ctx->opcode << 16) | insn;
 
     rt = extract32(ctx->opcode, 21, 5);
@@ -XXX,XX +XXX,XX @@ static int decode_nanomips_32_48_opc(CPUMIPSState *env, DisasContext *ctx)
         break;
     case NM_P48I:
         {
-            insn = translator_lduw(env, ctx->base.pc_next + 4);
+            insn = translator_lduw(env, &ctx->base, ctx->base.pc_next + 4);
             target_long addr_off = extract32(ctx->opcode, 0, 16) | insn << 16;
             switch (extract32(ctx->opcode, 16, 5)) {
             case NM_LI48:
-- 
2.25.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

translate_insn() implementations fetch instruction bytes piecemeal,
which can cause qemu-user to generate inconsistent translations if
another thread modifies them concurrently [1].

Fix by making pages containing translated instruction non-writable
right before loading instruction bytes from them.

[1] https://lists.nongnu.org/archive/html/qemu-devel/2021-08/msg00644.html

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20210805204835.158918-1-iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/translate-all.h |  1 +
 include/exec/translator.h    | 39 ++++++++++++++----------
 accel/tcg/translate-all.c    | 59 +++++++++++++++++++++---------------
 accel/tcg/translator.c       | 39 ++++++++++++++++++++++++
 4 files changed, 97 insertions(+), 41 deletions(-)

diff --git a/include/exec/translate-all.h b/include/exec/translate-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/translate-all.h
+++ b/include/exec/translate-all.h
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end);
 void tb_check_watchpoint(CPUState *cpu, uintptr_t retaddr);
 
 #ifdef CONFIG_USER_ONLY
+void page_protect(tb_page_addr_t page_addr);
 int page_unprotect(target_ulong address, uintptr_t pc);
 #endif
 
diff --git a/include/exec/translator.h b/include/exec/translator.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/translator.h
+++ b/include/exec/translator.h
@@ -XXX,XX +XXX,XX @@
 #include "exec/exec-all.h"
 #include "exec/cpu_ldst.h"
 #include "exec/plugin-gen.h"
+#include "exec/translate-all.h"
 #include "tcg/tcg.h"
 
 
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContextBase {
     int num_insns;
     int max_insns;
     bool singlestep_enabled;
+#ifdef CONFIG_USER_ONLY
+    /*
+     * Guest address of the last byte of the last protected page.
+     *
+     * Pages containing the translated instructions are made non-writable in
+     * order to achieve consistency in case another thread is modifying the
+     * code while translate_insn() fetches the instruction bytes piecemeal.
+     * Such writer threads are blocked on mmap_lock() in page_unprotect().
+     */
+    target_ulong page_protect_end;
+#endif
 } DisasContextBase;
 
 /**
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
  */
 
 #define GEN_TRANSLATOR_LD(fullname, type, load_fn, swap_fn)             \
-    static inline type                                                  \
-    fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase,      \
-                      abi_ptr pc, bool do_swap)                         \
-    {                                                                   \
-        type ret = load_fn(env, pc);                                    \
-        if (do_swap) {                                                  \
-            ret = swap_fn(ret);                                         \
-        }                                                               \
-        plugin_insn_append(&ret, sizeof(ret));                          \
-        return ret;                                                     \
-    }                                                                   \
+    type fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase, \
+                           abi_ptr pc, bool do_swap);                   \
     static inline type fullname(CPUArchState *env,                      \
                                 DisasContextBase *dcbase, abi_ptr pc)   \
     {                                                                   \
         return fullname ## _swap(env, dcbase, pc, false);               \
     }
 
-GEN_TRANSLATOR_LD(translator_ldub, uint8_t, cpu_ldub_code, /* no swap */)
-GEN_TRANSLATOR_LD(translator_ldsw, int16_t, cpu_ldsw_code, bswap16)
-GEN_TRANSLATOR_LD(translator_lduw, uint16_t, cpu_lduw_code, bswap16)
-GEN_TRANSLATOR_LD(translator_ldl, uint32_t, cpu_ldl_code, bswap32)
-GEN_TRANSLATOR_LD(translator_ldq, uint64_t, cpu_ldq_code, bswap64)
+#define FOR_EACH_TRANSLATOR_LD(F)                                       \
+    F(translator_ldub, uint8_t, cpu_ldub_code, /* no swap */)           \
+    F(translator_ldsw, int16_t, cpu_ldsw_code, bswap16)                 \
+    F(translator_lduw, uint16_t, cpu_lduw_code, bswap16)                \
+    F(translator_ldl, uint32_t, cpu_ldl_code, bswap32)                  \
+    F(translator_ldq, uint64_t, cpu_ldq_code, bswap64)
+
+FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
+
 #undef GEN_TRANSLATOR_LD
 
 #endif  /* EXEC__TRANSLATOR_H */
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ static inline void tb_page_add(PageDesc *p, TranslationBlock *tb,
     invalidate_page_bitmap(p);
 
 #if defined(CONFIG_USER_ONLY)
-    if (p->flags & PAGE_WRITE) {
-        target_ulong addr;
-        PageDesc *p2;
-        int prot;
-
-        /* force the host page as non writable (writes will have a
-           page fault + mprotect overhead) */
-        page_addr &= qemu_host_page_mask;
-        prot = 0;
-        for (addr = page_addr; addr < page_addr + qemu_host_page_size;
-            addr += TARGET_PAGE_SIZE) {
-
-            p2 = page_find(addr >> TARGET_PAGE_BITS);
-            if (!p2) {
-                continue;
-            }
-            prot |= p2->flags;
-            p2->flags &= ~PAGE_WRITE;
-          }
-        mprotect(g2h_untagged(page_addr), qemu_host_page_size,
-                 (prot & PAGE_BITS) & ~PAGE_WRITE);
-        if (DEBUG_TB_INVALIDATE_GATE) {
-            printf("protecting code page: 0x" TB_PAGE_ADDR_FMT "\n", page_addr);
-        }
-    }
+    /* translator_loop() must have made all TB pages non-writable */
+    assert(!(p->flags & PAGE_WRITE));
 #else
     /* if some code is already present, then the pages are already
        protected. So we handle the case where only the first TB is
@@ -XXX,XX +XXX,XX @@ int page_check_range(target_ulong start, target_ulong len, int flags)
     return 0;
 }
 
+void page_protect(tb_page_addr_t page_addr)
+{
+    target_ulong addr;
+    PageDesc *p;
+    int prot;
+
+    p = page_find(page_addr >> TARGET_PAGE_BITS);
+    if (p && (p->flags & PAGE_WRITE)) {
+        /*
+         * Force the host page as non writable (writes will have a page fault +
+         * mprotect overhead).
+         */
+        page_addr &= qemu_host_page_mask;
+        prot = 0;
+        for (addr = page_addr; addr < page_addr + qemu_host_page_size;
+             addr += TARGET_PAGE_SIZE) {
+
+            p = page_find(addr >> TARGET_PAGE_BITS);
+            if (!p) {
+                continue;
+            }
+            prot |= p->flags;
+            p->flags &= ~PAGE_WRITE;
+        }
+        mprotect(g2h_untagged(page_addr), qemu_host_page_size,
+                 (prot & PAGE_BITS) & ~PAGE_WRITE);
+        if (DEBUG_TB_INVALIDATE_GATE) {
+            printf("protecting code page: 0x" TB_PAGE_ADDR_FMT "\n", page_addr);
+        }
+    }
+}
+
 /* called from signal handler: invalidate the code and unprotect the
  * page. Return 0 if the fault was not handled, 1 if it was handled,
  * and 2 if it was handled but the caller must cause the TB to be
diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translator.c
+++ b/accel/tcg/translator.c
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest)
     return ((db->pc_first ^ dest) & TARGET_PAGE_MASK) == 0;
 }
 
+static inline void translator_page_protect(DisasContextBase *dcbase,
+                                           target_ulong pc)
+{
+#ifdef CONFIG_USER_ONLY
+    dcbase->page_protect_end = pc | ~TARGET_PAGE_MASK;
+    page_protect(pc);
+#endif
+}
+
 void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
                      CPUState *cpu, TranslationBlock *tb, int max_insns)
 {
@@ -XXX,XX +XXX,XX @@ void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
     db->num_insns = 0;
     db->max_insns = max_insns;
     db->singlestep_enabled = cflags & CF_SINGLE_STEP;
+    translator_page_protect(db, db->pc_next);
 
     ops->init_disas_context(db, cpu);
     tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
@@ -XXX,XX +XXX,XX @@ void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
     }
 #endif
 }
+
+static inline void translator_maybe_page_protect(DisasContextBase *dcbase,
+                                                 target_ulong pc, size_t len)
+{
+#ifdef CONFIG_USER_ONLY
+    target_ulong end = pc + len - 1;
+
+    if (end > dcbase->page_protect_end) {
+        translator_page_protect(dcbase, end);
+    }
+#endif
+}
+
+#define GEN_TRANSLATOR_LD(fullname, type, load_fn, swap_fn)             \
+    type fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase, \
+                           abi_ptr pc, bool do_swap)                    \
+    {                                                                   \
+        translator_maybe_page_protect(dcbase, pc, sizeof(type));        \
+        type ret = load_fn(env, pc);                                    \
+        if (do_swap) {                                                  \
+            ret = swap_fn(ret);                                         \
+        }                                                               \
+        plugin_insn_append(&ret, sizeof(ret));                          \
+        return ret;                                                     \
+    }
+
+FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
+
+#undef GEN_TRANSLATOR_LD
-- 
2.25.1

We need to be able to represent VEX.W on a 32-bit host, where REX.W
will always be zero.  Fixes the encoding for VPSLLVQ and VPSRLVQ.

Fixes: a2ce146a068 ("tcg/i386: Support vector variable shift opcodes")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/385
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.c.inc | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
 #define P_EXT		0x100		/* 0x0f opcode prefix */
 #define P_EXT38         0x200           /* 0x0f 0x38 opcode prefix */
 #define P_DATA16        0x400           /* 0x66 opcode prefix */
+#define P_VEXW          0x1000          /* Set VEX.W = 1 */
 #if TCG_TARGET_REG_BITS == 64
-# define P_REXW         0x1000          /* Set REX.W = 1 */
+# define P_REXW         P_VEXW          /* Set REX.W = 1; match VEXW */
 # define P_REXB_R       0x2000          /* REG field as byte register */
 # define P_REXB_RM      0x4000          /* R/M field as byte register */
 # define P_GS           0x8000          /* gs segment override */
@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
 #define OPC_VPBROADCASTW (0x79 | P_EXT38 | P_DATA16)
 #define OPC_VPBROADCASTD (0x58 | P_EXT38 | P_DATA16)
 #define OPC_VPBROADCASTQ (0x59 | P_EXT38 | P_DATA16)
-#define OPC_VPERMQ      (0x00 | P_EXT3A | P_DATA16 | P_REXW)
+#define OPC_VPERMQ      (0x00 | P_EXT3A | P_DATA16 | P_VEXW)
 #define OPC_VPERM2I128  (0x46 | P_EXT3A | P_DATA16 | P_VEXL)
 #define OPC_VPSLLVD     (0x47 | P_EXT38 | P_DATA16)
-#define OPC_VPSLLVQ     (0x47 | P_EXT38 | P_DATA16 | P_REXW)
+#define OPC_VPSLLVQ     (0x47 | P_EXT38 | P_DATA16 | P_VEXW)
 #define OPC_VPSRAVD     (0x46 | P_EXT38 | P_DATA16)
 #define OPC_VPSRLVD     (0x45 | P_EXT38 | P_DATA16)
-#define OPC_VPSRLVQ     (0x45 | P_EXT38 | P_DATA16 | P_REXW)
+#define OPC_VPSRLVQ     (0x45 | P_EXT38 | P_DATA16 | P_VEXW)
 #define OPC_VZEROUPPER  (0x77 | P_EXT)
 #define OPC_XCHG_ax_r32	(0x90)
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_vex_opc(TCGContext *s, int opc, int r, int v,
 
     /* Use the two byte form if possible, which cannot encode
        VEX.W, VEX.B, VEX.X, or an m-mmmm field other than P_EXT.  */
-    if ((opc & (P_EXT | P_EXT38 | P_EXT3A | P_REXW)) == P_EXT
+    if ((opc & (P_EXT | P_EXT38 | P_EXT3A | P_VEXW)) == P_EXT
         && ((rm | index) & 8) == 0) {
         /* Two byte VEX prefix.  */
         tcg_out8(s, 0xc5);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_vex_opc(TCGContext *s, int opc, int r, int v,
         tmp |= (rm & 8 ? 0 : 0x20);            /* VEX.B */
         tcg_out8(s, tmp);
 
-        tmp = (opc & P_REXW ? 0x80 : 0);       /* VEX.W */
+        tmp = (opc & P_VEXW ? 0x80 : 0);       /* VEX.W */
     }
 
     tmp |= (opc & P_VEXL ? 0x04 : 0);      /* VEX.L */
-- 
2.25.1

From: Bin Meng <bmeng.cn@gmail.com>

Since commit 1c2adb958fc0 ("tcg: Initialize cpu_env generically"),
these tcg_global_reg_new_ macros are not used anywhere.

Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210816143507.11200-1-bmeng.cn@gmail.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg-op.h    | 2 --
 target/hppa/translate.c | 3 ---
 2 files changed, 5 deletions(-)

diff --git a/include/tcg/tcg-op.h b/include/tcg/tcg-op.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg-op.h
+++ b/include/tcg/tcg-op.h
@@ -XXX,XX +XXX,XX @@ static inline void tcg_gen_plugin_cb_end(void)
 
 #if TARGET_LONG_BITS == 32
 #define tcg_temp_new() tcg_temp_new_i32()
-#define tcg_global_reg_new tcg_global_reg_new_i32
 #define tcg_global_mem_new tcg_global_mem_new_i32
 #define tcg_temp_local_new() tcg_temp_local_new_i32()
 #define tcg_temp_free tcg_temp_free_i32
@@ -XXX,XX +XXX,XX @@ static inline void tcg_gen_plugin_cb_end(void)
 #define tcg_gen_qemu_st_tl tcg_gen_qemu_st_i32
 #else
 #define tcg_temp_new() tcg_temp_new_i64()
-#define tcg_global_reg_new tcg_global_reg_new_i64
 #define tcg_global_mem_new tcg_global_mem_new_i64
 #define tcg_temp_local_new() tcg_temp_local_new_i64()
 #define tcg_temp_free tcg_temp_free_i64
diff --git a/target/hppa/translate.c b/target/hppa/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/translate.c
+++ b/target/hppa/translate.c
@@ -XXX,XX +XXX,XX @@
 
 #undef TCGv
 #undef tcg_temp_new
-#undef tcg_global_reg_new
 #undef tcg_global_mem_new
 #undef tcg_temp_local_new
 #undef tcg_temp_free
@@ -XXX,XX +XXX,XX @@
 #define TCGv_reg             TCGv_i64
 
 #define tcg_temp_new         tcg_temp_new_i64
-#define tcg_global_reg_new   tcg_global_reg_new_i64
 #define tcg_global_mem_new   tcg_global_mem_new_i64
 #define tcg_temp_local_new   tcg_temp_local_new_i64
 #define tcg_temp_free        tcg_temp_free_i64
@@ -XXX,XX +XXX,XX @@
 #else
 #define TCGv_reg             TCGv_i32
 #define tcg_temp_new         tcg_temp_new_i32
-#define tcg_global_reg_new   tcg_global_reg_new_i32
 #define tcg_global_mem_new   tcg_global_mem_new_i32
 #define tcg_temp_local_new   tcg_temp_local_new_i32
 #define tcg_temp_free        tcg_temp_free_i32
-- 
2.25.1

All supported compilers have builtins for this.
Drop all of the complicated system detection stuff.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210708181743.750220-1-richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 meson.build          |  6 -----
 include/qemu/bswap.h | 53 +++-----------------------------------------
 2 files changed, 3 insertions(+), 56 deletions(-)

diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ config_host_data.set('HAVE_STRCHRNUL', cc.has_function('strchrnul'))
 config_host_data.set('HAVE_SYSTEM_FUNCTION', cc.has_function('system', prefix: '#include <stdlib.h>'))
 
 # has_header_symbol
-config_host_data.set('CONFIG_BYTESWAP_H',
-                     cc.has_header_symbol('byteswap.h', 'bswap_32'))
 config_host_data.set('CONFIG_EPOLL_CREATE1',
                      cc.has_header_symbol('sys/epoll.h', 'epoll_create1'))
 config_host_data.set('CONFIG_HAS_ENVIRON',
@@ -XXX,XX +XXX,XX @@ config_host_data.set('CONFIG_INOTIFY',
                      cc.has_header_symbol('sys/inotify.h', 'inotify_init'))
 config_host_data.set('CONFIG_INOTIFY1',
                      cc.has_header_symbol('sys/inotify.h', 'inotify_init1'))
-config_host_data.set('CONFIG_MACHINE_BSWAP_H',
-                     cc.has_header_symbol('machine/bswap.h', 'bswap32',
-                                          prefix: '''#include <sys/endian.h>
-                                                     #include <sys/types.h>'''))
 config_host_data.set('CONFIG_PRCTL_PR_SET_TIMERSLACK',
                      cc.has_header_symbol('sys/prctl.h', 'PR_SET_TIMERSLACK'))
 config_host_data.set('CONFIG_RTNETLINK',
diff --git a/include/qemu/bswap.h b/include/qemu/bswap.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/bswap.h
+++ b/include/qemu/bswap.h
@@ -XXX,XX +XXX,XX @@
 #ifndef BSWAP_H
 #define BSWAP_H
 
-#ifdef CONFIG_MACHINE_BSWAP_H
-# include <sys/endian.h>
-# include <machine/bswap.h>
-#elif defined(__FreeBSD__)
-# include <sys/endian.h>
-#elif defined(__HAIKU__)
-# include <endian.h>
-#elif defined(CONFIG_BYTESWAP_H)
-# include <byteswap.h>
-#define BSWAP_FROM_BYTESWAP
-# else
-#define BSWAP_FROM_FALLBACKS
-#endif /* ! CONFIG_MACHINE_BSWAP_H */
-
 #ifdef __cplusplus
 extern "C" {
 #endif
 
 #include "fpu/softfloat-types.h"
 
-#ifdef BSWAP_FROM_BYTESWAP
 static inline uint16_t bswap16(uint16_t x)
 {
-    return bswap_16(x);
+    return __builtin_bswap16(x);
 }
 
 static inline uint32_t bswap32(uint32_t x)
 {
-    return bswap_32(x);
+    return __builtin_bswap32(x);
 }
 
 static inline uint64_t bswap64(uint64_t x)
 {
-    return bswap_64(x);
+    return __builtin_bswap64(x);
 }
-#endif
-
-#ifdef BSWAP_FROM_FALLBACKS
-static inline uint16_t bswap16(uint16_t x)
-{
-    return (((x & 0x00ff) << 8) |
-            ((x & 0xff00) >> 8));
-}
-
-static inline uint32_t bswap32(uint32_t x)
-{
-    return (((x & 0x000000ffU) << 24) |
-            ((x & 0x0000ff00U) <<  8) |
-            ((x & 0x00ff0000U) >>  8) |
-            ((x & 0xff000000U) >> 24));
-}
-
-static inline uint64_t bswap64(uint64_t x)
-{
-    return (((x & 0x00000000000000ffULL) << 56) |
-            ((x & 0x000000000000ff00ULL) << 40) |
-            ((x & 0x0000000000ff0000ULL) << 24) |
-            ((x & 0x00000000ff000000ULL) <<  8) |
-            ((x & 0x000000ff00000000ULL) >>  8) |
-            ((x & 0x0000ff0000000000ULL) >> 24) |
-            ((x & 0x00ff000000000000ULL) >> 40) |
-            ((x & 0xff00000000000000ULL) >> 56));
-}
-#endif
-
-#undef BSWAP_FROM_BYTESWAP
-#undef BSWAP_FROM_FALLBACKS
 
 static inline void bswap16s(uint16_t *s)
 {
-- 
2.25.1

If __APPLE__, ensure that _CALL_DARWIN is set, then remove
our local TCG_TARGET_CALL_DARWIN.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/ppc/tcg-target.c.inc | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@
 #include "elf.h"
 #include "../tcg-pool.c.inc"
 
-#if defined _CALL_DARWIN || defined __APPLE__
-#define TCG_TARGET_CALL_DARWIN
+#if !defined _CALL_DARWIN && defined __APPLE__
+#define _CALL_DARWIN 1
 #endif
 #ifdef _CALL_SYSV
 # define TCG_TARGET_CALL_ALIGN_ARGS   1
@@ -XXX,XX +XXX,XX @@ static const int tcg_target_call_oarg_regs[] = {
 };
 
 static const int tcg_target_callee_save_regs[] = {
-#ifdef TCG_TARGET_CALL_DARWIN
+#ifdef _CALL_DARWIN
     TCG_REG_R11,
 #endif
     TCG_REG_R14,
@@ -XXX,XX +XXX,XX @@ static void tcg_out_nop_fill(tcg_insn_unit *p, int count)
 # define LINK_AREA_SIZE                (6 * SZR)
 # define LR_OFFSET                     (1 * SZR)
 # define TCG_TARGET_CALL_STACK_OFFSET  (LINK_AREA_SIZE + 8 * SZR)
-#elif defined(TCG_TARGET_CALL_DARWIN)
+#elif defined(_CALL_DARWIN)
 # define LINK_AREA_SIZE                (6 * SZR)
 # define LR_OFFSET                     (2 * SZR)
 #elif TCG_TARGET_REG_BITS == 64
-- 
2.25.1

Clang only sets _CALL_ELF for ppc64, and nothing at all to specify
the ABI for ppc32.  Make a good guess based on other symbols.

Reported-by: Brad Smith <brad@comstyle.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/ppc/tcg-target.c.inc | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@
 #include "elf.h"
 #include "../tcg-pool.c.inc"
 
-#if !defined _CALL_DARWIN && defined __APPLE__
-#define _CALL_DARWIN 1
-#endif
+/*
+ * Standardize on the _CALL_FOO symbols used by GCC:
+ * Apple XCode does not define _CALL_DARWIN.
+ * Clang defines _CALL_ELF (64-bit) but not _CALL_SYSV (32-bit).
+ */
+#if !defined(_CALL_SYSV) && \
+    !defined(_CALL_DARWIN) && \
+    !defined(_CALL_AIX) && \
+    !defined(_CALL_ELF)
+# if defined(__APPLE__)
+#  define _CALL_DARWIN
+# elif defined(__ELF__) && TCG_TARGET_REG_BITS == 32
+#  define _CALL_SYSV
+# else
+#  error "Unknown ABI"
+# endif
+#endif 
+
 #ifdef _CALL_SYSV
 # define TCG_TARGET_CALL_ALIGN_ARGS   1
 #endif
-- 
2.25.1

From: "Jose R. Ziviani" <jziviani@suse.de>

Commit 5e8892db93 fixed several function signatures but tcg_out_vec_op
for arm is missing. It causes a build error on armv6 and armv7:

tcg-target.c.inc:2718:42: error: argument 5 of type 'const TCGArg *'
{aka 'const unsigned int *'} declared as a pointer [-Werror=array-parameter=]
   const TCGArg *args, const int *const_args)
  ~~~~~~~~~~~~~~^~~~
../tcg/tcg.c:120:41: note: previously declared as an array 'const TCGArg[16]'
{aka 'const unsigned int[16]'}
   const TCGArg args[TCG_MAX_OP_ARGS],
  ~~~~~~~~~~~~~~^~~~

Signed-off-by: Jose R. Ziviani <jziviani@suse.de>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210908185338.7927-1-jziviani@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/arm/tcg-target.c.inc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const ARMInsn vec_cmp0_insn[16] = {
 
 static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
                            unsigned vecl, unsigned vece,
-                           const TCGArg *args, const int *const_args)
+                           const TCGArg args[TCG_MAX_OP_ARGS],
+                           const int const_args[TCG_MAX_OP_ARGS])
 {
     TCGType type = vecl + TCG_TYPE_V64;
     unsigned q = vecl;
-- 
2.25.1

Version 3: Rebase and fix a minor patch conflict.

The following changes since commit c6f5e042d89e79206cd1ce5525d3df219f13c3cc:

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20210913-3' into staging (2021-09-13 21:06:15 +0100)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20210914

for you to fetch changes up to a5b759b6dca7daf87fa5007a7f5784bf22f3830f:

tcg/arm: More use of the TCGReg enum (2021-09-14 07:59:43 -0700)

----------------------------------------------------------------
Bin Meng (1):
      tcg: Remove tcg_global_reg_new defines

Ilya Leoshkevich (3):
      accel/tcg: Add DisasContextBase argument to translator_ld*
      accel/tcg: Clear PAGE_WRITE before translation
      accel/tcg/user-exec: Fix read-modify-write of code on s390 hosts

Jose R. Ziviani (1):
      tcg/arm: Fix tcg_out_vec_op function signature

Luc Michel (1):
      accel/tcg: remove redundant TCG_KICK_PERIOD define

Philippe Mathieu-Daudé (25):
      target/avr: Remove pointless use of CONFIG_USER_ONLY definition
      target/i386: Restrict sysemu-only fpu_helper helpers
      target/i386: Simplify TARGET_X86_64 #ifdef'ry
      target/xtensa: Restrict do_transaction_failed() to sysemu
      accel/tcg: Rename user-mode do_interrupt hack as fake_user_interrupt
      target/alpha: Restrict cpu_exec_interrupt() handler to sysemu
      target/arm: Restrict cpu_exec_interrupt() handler to sysemu
      target/cris: Restrict cpu_exec_interrupt() handler to sysemu
      target/hppa: Restrict cpu_exec_interrupt() handler to sysemu
      target/i386: Restrict cpu_exec_interrupt() handler to sysemu
      target/i386: Move x86_cpu_exec_interrupt() under sysemu/ folder
      target/m68k: Restrict cpu_exec_interrupt() handler to sysemu
      target/microblaze: Restrict cpu_exec_interrupt() handler to sysemu
      target/mips: Restrict cpu_exec_interrupt() handler to sysemu
      target/nios2: Restrict cpu_exec_interrupt() handler to sysemu
      target/openrisc: Restrict cpu_exec_interrupt() handler to sysemu
      target/ppc: Restrict cpu_exec_interrupt() handler to sysemu
      target/riscv: Restrict cpu_exec_interrupt() handler to sysemu
      target/sh4: Restrict cpu_exec_interrupt() handler to sysemu
      target/sparc: Restrict cpu_exec_interrupt() handler to sysemu
      target/rx: Restrict cpu_exec_interrupt() handler to sysemu
      target/xtensa: Restrict cpu_exec_interrupt() handler to sysemu
      accel/tcg: Restrict TCGCPUOps::cpu_exec_interrupt() to sysemu
      user: Remove cpu_get_pic_interrupt() stubs
      user: Mark cpu_loop() with noreturn attribute

Richard Henderson (13):
      tcg/i386: Split P_VEXW from P_REXW
      tcg/ppc: Replace TCG_TARGET_CALL_DARWIN with _CALL_DARWIN
      tcg/ppc: Ensure _CALL_SYSV is set for 32-bit ELF
      tcg/arm: Remove fallback definition of __ARM_ARCH
      tcg/arm: Standardize on tcg_out_<branch>_{reg,imm}
      tcg/arm: Simplify use_armv5t_instructions
      tcg/arm: Support armv4t in tcg_out_goto and tcg_out_call
      tcg/arm: Split out tcg_out_ldstm
      tcg/arm: Simplify usage of encode_imm
      tcg/arm: Drop inline markers
      tcg/arm: Give enum arm_cond_code_e a typedef and use it
      tcg/arm: More use of the ARMInsn enum
      tcg/arm: More use of the TCGReg enum

From: Ilya Leoshkevich <iii@linux.ibm.com>

diff --git a/include/exec/translator.h b/include/exec/translator.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/translator.h
+++ b/include/exec/translator.h
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
 
 #define GEN_TRANSLATOR_LD(fullname, type, load_fn, swap_fn)             \
     static inline type                                                  \
-    fullname ## _swap(CPUArchState *env, abi_ptr pc, bool do_swap)      \
+    fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase,      \
+                      abi_ptr pc, bool do_swap)                         \
     {                                                                   \
         type ret = load_fn(env, pc);                                    \
         if (do_swap) {                                                  \
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
         plugin_insn_append(&ret, sizeof(ret));                          \
         return ret;                                                     \
     }                                                                   \
-                                                                        \
-    static inline type fullname(CPUArchState *env, abi_ptr pc)          \
+    static inline type fullname(CPUArchState *env,                      \
+                                DisasContextBase *dcbase, abi_ptr pc)   \
     {                                                                   \
-        return fullname ## _swap(env, pc, false);                       \
+        return fullname ## _swap(env, dcbase, pc, false);               \
     }
 
 GEN_TRANSLATOR_LD(translator_ldub, uint8_t, cpu_ldub_code, /* no swap */)
diff --git a/target/arm/arm_ldst.h b/target/arm/arm_ldst.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm_ldst.h
+++ b/target/arm/arm_ldst.h
@@ -XXX,XX +XXX,XX @@
 #include "qemu/bswap.h"
 
 /* Load an instruction and return it in the standard little-endian order */
-static inline uint32_t arm_ldl_code(CPUARMState *env, target_ulong addr,
-                                    bool sctlr_b)
+static inline uint32_t arm_ldl_code(CPUARMState *env, DisasContextBase *s,
+                                    target_ulong addr, bool sctlr_b)
 {
-    return translator_ldl_swap(env, addr, bswap_code(sctlr_b));
+    return translator_ldl_swap(env, s, addr, bswap_code(sctlr_b));
 }
 
 /* Ditto, for a halfword (Thumb) instruction */
-static inline uint16_t arm_lduw_code(CPUARMState *env, target_ulong addr,
-                                     bool sctlr_b)
+static inline uint16_t arm_lduw_code(CPUARMState *env, DisasContextBase* s,
+                                     target_ulong addr, bool sctlr_b)
 {
 #ifndef CONFIG_USER_ONLY
     /* In big-endian (BE32) mode, adjacent Thumb instructions have been swapped
@@ -XXX,XX +XXX,XX @@ static inline uint16_t arm_lduw_code(CPUARMState *env, target_ulong addr,
         addr ^= 2;
     }
 #endif
-    return translator_lduw_swap(env, addr, bswap_code(sctlr_b));
+    return translator_lduw_swap(env, s, addr, bswap_code(sctlr_b));
 }
 
 #endif
diff --git a/target/alpha/translate.c b/target/alpha/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/translate.c
+++ b/target/alpha/translate.c
@@ -XXX,XX +XXX,XX @@ static void alpha_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
 {
     DisasContext *ctx = container_of(dcbase, DisasContext, base);
     CPUAlphaState *env = cpu->env_ptr;
-    uint32_t insn = translator_ldl(env, ctx->base.pc_next);
+    uint32_t insn = translator_ldl(env, &ctx->base, ctx->base.pc_next);
 
     ctx->base.pc_next += 4;
     ctx->base.is_jmp = translate_one(ctx, insn);
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
     }
 
     s->pc_curr = s->base.pc_next;
-    insn = arm_ldl_code(env, s->base.pc_next, s->sctlr_b);
+    insn = arm_ldl_code(env, &s->base, s->base.pc_next, s->sctlr_b);
     s->insn = insn;
     s->base.pc_next += 4;
 
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static bool insn_crosses_page(CPUARMState *env, DisasContext *s)
      * boundary, so we cross the page if the first 16 bits indicate
      * that this is a 32 bit insn.
      */
-    uint16_t insn = arm_lduw_code(env, s->base.pc_next, s->sctlr_b);
+    uint16_t insn = arm_lduw_code(env, &s->base, s->base.pc_next, s->sctlr_b);
 
     return !thumb_insn_is_16bit(s, s->base.pc_next, insn);
 }
@@ -XXX,XX +XXX,XX @@ static void arm_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
     }
 
     dc->pc_curr = dc->base.pc_next;
-    insn = arm_ldl_code(env, dc->base.pc_next, dc->sctlr_b);
+    insn = arm_ldl_code(env, &dc->base, dc->base.pc_next, dc->sctlr_b);
     dc->insn = insn;
     dc->base.pc_next += 4;
     disas_arm_insn(dc, insn);
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
     }
 
     dc->pc_curr = dc->base.pc_next;
-    insn = arm_lduw_code(env, dc->base.pc_next, dc->sctlr_b);
+    insn = arm_lduw_code(env, &dc->base, dc->base.pc_next, dc->sctlr_b);
     is_16bit = thumb_insn_is_16bit(dc, dc->base.pc_next, insn);
     dc->base.pc_next += 2;
     if (!is_16bit) {
-        uint32_t insn2 = arm_lduw_code(env, dc->base.pc_next, dc->sctlr_b);
+        uint32_t insn2 = arm_lduw_code(env, &dc->base, dc->base.pc_next,
+                                       dc->sctlr_b);
 
         insn = insn << 16 | insn2;
         dc->base.pc_next += 2;
diff --git a/target/hexagon/translate.c b/target/hexagon/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/translate.c
+++ b/target/hexagon/translate.c
@@ -XXX,XX +XXX,XX @@ static int read_packet_words(CPUHexagonState *env, DisasContext *ctx,
     memset(words, 0, PACKET_WORDS_MAX * sizeof(uint32_t));
     for (nwords = 0; !found_end && nwords < PACKET_WORDS_MAX; nwords++) {
         words[nwords] =
-            translator_ldl(env, ctx->base.pc_next + nwords * sizeof(uint32_t));
+            translator_ldl(env, &ctx->base,
+                           ctx->base.pc_next + nwords * sizeof(uint32_t));
         found_end = is_packet_end(words[nwords]);
     }
     if (!found_end) {
diff --git a/target/hppa/translate.c b/target/hppa/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/translate.c
+++ b/target/hppa/translate.c
@@ -XXX,XX +XXX,XX @@ static void hppa_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
     {
         /* Always fetch the insn, even if nullified, so that we check
            the page permissions for execute.  */
-        uint32_t insn = translator_ldl(env, ctx->base.pc_next);
+        uint32_t insn = translator_ldl(env, &ctx->base, ctx->base.pc_next);
 
         /* Set up the IA queue for the next insn.
            This will be overwritten by a branch.  */
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static uint64_t advance_pc(CPUX86State *env, DisasContext *s, int num_bytes)
 
 static inline uint8_t x86_ldub_code(CPUX86State *env, DisasContext *s)
 {
-    return translator_ldub(env, advance_pc(env, s, 1));
+    return translator_ldub(env, &s->base, advance_pc(env, s, 1));
 }
 
 static inline int16_t x86_ldsw_code(CPUX86State *env, DisasContext *s)
 {
-    return translator_ldsw(env, advance_pc(env, s, 2));
+    return translator_ldsw(env, &s->base, advance_pc(env, s, 2));
 }
 
 static inline uint16_t x86_lduw_code(CPUX86State *env, DisasContext *s)
 {
-    return translator_lduw(env, advance_pc(env, s, 2));
+    return translator_lduw(env, &s->base, advance_pc(env, s, 2));
 }
 
 static inline uint32_t x86_ldl_code(CPUX86State *env, DisasContext *s)
 {
-    return translator_ldl(env, advance_pc(env, s, 4));
+    return translator_ldl(env, &s->base, advance_pc(env, s, 4));
 }
 
 #ifdef TARGET_X86_64
 static inline uint64_t x86_ldq_code(CPUX86State *env, DisasContext *s)
 {
-    return translator_ldq(env, advance_pc(env, s, 8));
+    return translator_ldq(env, &s->base, advance_pc(env, s, 8));
 }
 #endif
 
diff --git a/target/m68k/translate.c b/target/m68k/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/translate.c
+++ b/target/m68k/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv gen_ldst(DisasContext *s, int opsize, TCGv addr, TCGv val,
 static inline uint16_t read_im16(CPUM68KState *env, DisasContext *s)
 {
     uint16_t im;
-    im = translator_lduw(env, s->pc);
+    im = translator_lduw(env, &s->base, s->pc);
     s->pc += 2;
     return im;
 }
diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/translate.c
+++ b/target/mips/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static void mips_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
 
     is_slot = ctx->hflags & MIPS_HFLAG_BMASK;
     if (ctx->insn_flags & ISA_NANOMIPS32) {
-        ctx->opcode = translator_lduw(env, ctx->base.pc_next);
+        ctx->opcode = translator_lduw(env, &ctx->base, ctx->base.pc_next);
         insn_bytes = decode_isa_nanomips(env, ctx);
     } else if (!(ctx->hflags & MIPS_HFLAG_M16)) {
-        ctx->opcode = translator_ldl(env, ctx->base.pc_next);
+        ctx->opcode = translator_ldl(env, &ctx->base, ctx->base.pc_next);
         insn_bytes = 4;
         decode_opc(env, ctx);
     } else if (ctx->insn_flags & ASE_MICROMIPS) {
-        ctx->opcode = translator_lduw(env, ctx->base.pc_next);
+        ctx->opcode = translator_lduw(env, &ctx->base, ctx->base.pc_next);
         insn_bytes = decode_isa_micromips(env, ctx);
     } else if (ctx->insn_flags & ASE_MIPS16) {
-        ctx->opcode = translator_lduw(env, ctx->base.pc_next);
+        ctx->opcode = translator_lduw(env, &ctx->base, ctx->base.pc_next);
         insn_bytes = decode_ase_mips16e(env, ctx);
     } else {
         gen_reserved_instruction(ctx);
diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/translate.c
+++ b/target/openrisc/translate.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
 {
     DisasContext *dc = container_of(dcbase, DisasContext, base);
     OpenRISCCPU *cpu = OPENRISC_CPU(cs);
-    uint32_t insn = translator_ldl(&cpu->env, dc->base.pc_next);
+    uint32_t insn = translator_ldl(&cpu->env, &dc->base, dc->base.pc_next);
 
     if (!decode(dc, insn)) {
         gen_illegal_exception(dc);
diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -XXX,XX +XXX,XX @@ static void ppc_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
               ctx->base.pc_next, ctx->mem_idx, (int)msr_ir);
 
     ctx->cia = pc = ctx->base.pc_next;
-    insn = translator_ldl_swap(env, pc, need_byteswap(ctx));
+    insn = translator_ldl_swap(env, dcbase, pc, need_byteswap(ctx));
     ctx->base.pc_next = pc += 4;
 
     if (!is_prefix_insn(ctx, insn)) {
@@ -XXX,XX +XXX,XX @@ static void ppc_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
         gen_exception_err(ctx, POWERPC_EXCP_ALIGN, POWERPC_EXCP_ALIGN_INSN);
         ok = true;
     } else {
-        uint32_t insn2 = translator_ldl_swap(env, pc, need_byteswap(ctx));
+        uint32_t insn2 = translator_ldl_swap(env, dcbase, pc,
+                                             need_byteswap(ctx));
         ctx->base.pc_next = pc += 4;
         ok = decode_insn64(ctx, deposit64(insn2, 32, 32, insn));
     }
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
     } else {
         uint32_t opcode32 = opcode;
         opcode32 = deposit32(opcode32, 16, 16,
-                             translator_lduw(env, ctx->base.pc_next + 2));
+                             translator_lduw(env, &ctx->base,
+                                             ctx->base.pc_next + 2));
         ctx->pc_succ_insn = ctx->base.pc_next + 4;
         if (!decode_insn32(ctx, opcode32)) {
             gen_exception_illegal(ctx);
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
 {
     DisasContext *ctx = container_of(dcbase, DisasContext, base);
     CPURISCVState *env = cpu->env_ptr;
-    uint16_t opcode16 = translator_lduw(env, ctx->base.pc_next);
+    uint16_t opcode16 = translator_lduw(env, &ctx->base, ctx->base.pc_next);
 
     decode_opc(env, ctx, opcode16);
     ctx->base.pc_next = ctx->pc_succ_insn;
diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static void update_cc_op(DisasContext *s)
     }
 }
 
-static inline uint64_t ld_code2(CPUS390XState *env, uint64_t pc)
+static inline uint64_t ld_code2(CPUS390XState *env, DisasContext *s,
+                                uint64_t pc)
 {
-    return (uint64_t)cpu_lduw_code(env, pc);
+    return (uint64_t)translator_lduw(env, &s->base, pc);
 }
 
-static inline uint64_t ld_code4(CPUS390XState *env, uint64_t pc)
+static inline uint64_t ld_code4(CPUS390XState *env, DisasContext *s,
+                                uint64_t pc)
 {
-    return (uint64_t)(uint32_t)cpu_ldl_code(env, pc);
+    return (uint64_t)(uint32_t)translator_ldl(env, &s->base, pc);
 }
 
 static int get_mem_index(DisasContext *s)
@@ -XXX,XX +XXX,XX @@ static const DisasInsn *extract_insn(CPUS390XState *env, DisasContext *s)
         ilen = s->ex_value & 0xf;
         op = insn >> 56;
     } else {
-        insn = ld_code2(env, pc);
+        insn = ld_code2(env, s, pc);
         op = (insn >> 8) & 0xff;
         ilen = get_ilen(op);
         switch (ilen) {
@@ -XXX,XX +XXX,XX @@ static const DisasInsn *extract_insn(CPUS390XState *env, DisasContext *s)
             insn = insn << 48;
             break;
         case 4:
-            insn = ld_code4(env, pc) << 32;
+            insn = ld_code4(env, s, pc) << 32;
             break;
         case 6:
-            insn = (insn << 48) | (ld_code4(env, pc + 2) << 16);
+            insn = (insn << 48) | (ld_code4(env, s, pc + 2) << 16);
             break;
         default:
             g_assert_not_reached();
diff --git a/target/sh4/translate.c b/target/sh4/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/translate.c
+++ b/target/sh4/translate.c
@@ -XXX,XX +XXX,XX @@ static void decode_gusa(DisasContext *ctx, CPUSH4State *env)
 
     /* Read all of the insns for the region.  */
     for (i = 0; i < max_insns; ++i) {
-        insns[i] = translator_lduw(env, pc + i * 2);
+        insns[i] = translator_lduw(env, &ctx->base, pc + i * 2);
     }
 
     ld_adr = ld_dst = ld_mop = -1;
@@ -XXX,XX +XXX,XX @@ static void sh4_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
     }
 #endif
 
-    ctx->opcode = translator_lduw(env, ctx->base.pc_next);
+    ctx->opcode = translator_lduw(env, &ctx->base, ctx->base.pc_next);
     decode_opc(ctx);
     ctx->base.pc_next += 2;
 }
diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -XXX,XX +XXX,XX @@ static void sparc_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
     CPUSPARCState *env = cs->env_ptr;
     unsigned int insn;
 
-    insn = translator_ldl(env, dc->pc);
+    insn = translator_ldl(env, &dc->base, dc->pc);
     dc->base.pc_next += 4;
     disas_sparc_insn(dc, insn);
 
diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/translate.c
+++ b/target/xtensa/translate.c
@@ -XXX,XX +XXX,XX @@ static int arg_copy_compare(const void *a, const void *b)
 static void disas_xtensa_insn(CPUXtensaState *env, DisasContext *dc)
 {
     xtensa_isa isa = dc->config->isa;
-    unsigned char b[MAX_INSN_LENGTH] = {translator_ldub(env, dc->pc)};
+    unsigned char b[MAX_INSN_LENGTH] = {translator_ldub(env, &dc->base,
+                                                        dc->pc)};
     unsigned len = xtensa_op0_insn_len(dc, b[0]);
     xtensa_format fmt;
     int slot, slots;
@@ -XXX,XX +XXX,XX @@ static void disas_xtensa_insn(CPUXtensaState *env, DisasContext *dc)
 
     dc->base.pc_next = dc->pc + len;
     for (i = 1; i < len; ++i) {
-        b[i] = translator_ldub(env, dc->pc + i);
+        b[i] = translator_ldub(env, &dc->base, dc->pc + i);
     }
     xtensa_insnbuf_from_chars(isa, dc->insnbuf, b, len);
     fmt = xtensa_format_decode(isa, dc->insnbuf);
diff --git a/target/mips/tcg/micromips_translate.c.inc b/target/mips/tcg/micromips_translate.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/micromips_translate.c.inc
+++ b/target/mips/tcg/micromips_translate.c.inc
@@ -XXX,XX +XXX,XX @@ static void decode_micromips32_opc(CPUMIPSState *env, DisasContext *ctx)
     uint32_t op, minor, minor2, mips32_op;
     uint32_t cond, fmt, cc;
 
-    insn = translator_lduw(env, ctx->base.pc_next + 2);
+    insn = translator_lduw(env, &ctx->base, ctx->base.pc_next + 2);
     ctx->opcode = (ctx->opcode << 16) | insn;
 
     rt = (ctx->opcode >> 21) & 0x1f;
diff --git a/target/mips/tcg/mips16e_translate.c.inc b/target/mips/tcg/mips16e_translate.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/mips16e_translate.c.inc
+++ b/target/mips/tcg/mips16e_translate.c.inc
@@ -XXX,XX +XXX,XX @@ static void decode_i64_mips16(DisasContext *ctx,
 
 static int decode_extended_mips16_opc(CPUMIPSState *env, DisasContext *ctx)
 {
-    int extend = translator_lduw(env, ctx->base.pc_next + 2);
+    int extend = translator_lduw(env, &ctx->base, ctx->base.pc_next + 2);
     int op, rx, ry, funct, sa;
     int16_t imm, offset;
 
@@ -XXX,XX +XXX,XX @@ static int decode_ase_mips16e(CPUMIPSState *env, DisasContext *ctx)
         /* No delay slot, so just process as a normal instruction */
         break;
     case M16_OPC_JAL:
-        offset = translator_lduw(env, ctx->base.pc_next + 2);
+        offset = translator_lduw(env, &ctx->base, ctx->base.pc_next + 2);
         offset = (((ctx->opcode & 0x1f) << 21)
                   | ((ctx->opcode >> 5) & 0x1f) << 16
                   | offset) << 2;
diff --git a/target/mips/tcg/nanomips_translate.c.inc b/target/mips/tcg/nanomips_translate.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/nanomips_translate.c.inc
+++ b/target/mips/tcg/nanomips_translate.c.inc
@@ -XXX,XX +XXX,XX @@ static int decode_nanomips_32_48_opc(CPUMIPSState *env, DisasContext *ctx)
     int offset;
     int imm;
 
-    insn = translator_lduw(env, ctx->base.pc_next + 2);
+    insn = translator_lduw(env, &ctx->base, ctx->base.pc_next + 2);
     ctx->opcode = (ctx->opcode << 16) | insn;
 
     rt = extract32(ctx->opcode, 21, 5);
@@ -XXX,XX +XXX,XX @@ static int decode_nanomips_32_48_opc(CPUMIPSState *env, DisasContext *ctx)
         break;
     case NM_P48I:
         {
-            insn = translator_lduw(env, ctx->base.pc_next + 4);
+            insn = translator_lduw(env, &ctx->base, ctx->base.pc_next + 4);
             target_long addr_off = extract32(ctx->opcode, 0, 16) | insn << 16;
             switch (extract32(ctx->opcode, 16, 5)) {
             case NM_LI48:
-- 
2.25.1