Series comparison

-[PULL 00/24] tcg patch queue
+[PULL v2 00/15] tcg patch queue
-The following changes since commit 6587b0c1331d427b0939c37e763842550ed581db:
+Second try's the charm today, right?
-  Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2021-10-15' into staging (2021-10-15 14:16:28 -0700)
 r~
 The following changes since commit 00b1faea41d283e931256aa78aa975a369ec3ae6:
   Merge tag 'pull-target-arm-20230123' of https://git.linaro.org/people/pmaydell/qemu-arm into staging (2023-01-23 13:40:28 +0000)
 are available in the Git repository at:
-  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20211016
+  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20230123
-for you to fetch changes up to 995b87dedc78b0467f5f18bbc3546072ba97516a:
+for you to fetch changes up to 709bcd7da3f6b4655d910634a0d520fa1439df38:
-  Revert "cpu: Move cpu_common_props to hw/core/cpu.c" (2021-10-15 16:39:15 -0700)
+  tcg/loongarch64: Reorg goto_tb implementation (2023-01-23 16:00:13 -1000)
 ----------------------------------------------------------------
-Move gdb singlestep to generic code
+common-user: Re-enable ppc32 host
-Fix cpu_common_props
+tcg: Avoid recursion in tcg_gen_mulu2_i32
 tcg: Mark tcg helpers noinline to avoid an issue with LTO
 tcg/arm: Use register pair allocation for qemu_{ld,st}_i64
 disas: Enable loongarch disassembler, and fixes
 tcg/loongarch64: Improve move immediate
 tcg/loongarch64: Improve add immediate
 tcg/loongarch64: Improve setcond
 tcg/loongarch64: Implement movcond
 tcg/loongarch64: Use tcg_pcrel_diff in tcg_out_ldst
 tcg/loongarch64: Reorg goto_tb implementation
 ----------------------------------------------------------------
-Richard Henderson (24):
+Richard Henderson (14):
-      accel/tcg: Handle gdb singlestep in cpu_tb_exec
+      tcg: Avoid recursion in tcg_gen_mulu2_i32
-      target/alpha: Drop checks for singlestep_enabled
+      tcg/arm: Use register pair allocation for qemu_{ld,st}_i64
-      target/avr: Drop checks for singlestep_enabled
+      common-user/host/ppc: Implement safe-syscall.inc.S
-      target/cris: Drop checks for singlestep_enabled
+      linux-user: Implment host/ppc/host-signal.h
-      target/hexagon: Drop checks for singlestep_enabled
+      tcg: Mark tcg helpers noinline to avoid an issue with LTO
-      target/arm: Drop checks for singlestep_enabled
+      target/loongarch: Enable the disassembler for host tcg
-      target/hppa: Drop checks for singlestep_enabled
+      target/loongarch: Disassemble jirl properly
-      target/i386: Check CF_NO_GOTO_TB for dc->jmp_opt
+      target/loongarch: Disassemble pcadd* addresses
-      target/i386: Drop check for singlestep_enabled
+      tcg/loongarch64: Update tcg-insn-defs.c.inc
-      target/m68k: Drop checks for singlestep_enabled
+      tcg/loongarch64: Introduce tcg_out_addi
-      target/microblaze: Check CF_NO_GOTO_TB for DISAS_JUMP
+      tcg/loongarch64: Improve setcond expansion
-      target/microblaze: Drop checks for singlestep_enabled
+      tcg/loongarch64: Implement movcond
-      target/mips: Fix single stepping
+      tcg/loongarch64: Use tcg_pcrel_diff in tcg_out_ldst
-      target/mips: Drop exit checks for singlestep_enabled
+      tcg/loongarch64: Reorg goto_tb implementation
       target/openrisc: Drop checks for singlestep_enabled
       target/ppc: Drop exit checks for singlestep_enabled
       target/riscv: Remove dead code after exception
       target/riscv: Remove exit_tb and lookup_and_goto_ptr
       target/rx: Drop checks for singlestep_enabled
       target/s390x: Drop check for singlestep_enabled
       target/sh4: Drop check for singlestep_enabled
       target/tricore: Drop check for singlestep_enabled
       target/xtensa: Drop check for singlestep_enabled
       Revert "cpu: Move cpu_common_props to hw/core/cpu.c"
- include/hw/core/cpu.h                          |  1 +
+Rui Wang (1):
- target/i386/helper.h                           |  1 -
+      tcg/loongarch64: Optimize immediate loading
  target/rx/helper.h                             |  1 -
  target/sh4/helper.h                            |  1 -
  target/tricore/helper.h                        |  1 -
  accel/tcg/cpu-exec.c                           | 11 ++++
  cpu.c                                          | 21 ++++++++
  hw/core/cpu-common.c                           | 17 +-----
  target/alpha/translate.c                       | 13 ++---
  target/arm/translate-a64.c                     | 10 +---
  target/arm/translate.c                         | 36 +++----------
  target/avr/translate.c                         | 19 ++-----
  target/cris/translate.c                        | 16 ------
  target/hexagon/translate.c                     | 12 +----
  target/hppa/translate.c                        | 17 ++----
  target/i386/tcg/misc_helper.c                  |  8 ---
  target/i386/tcg/translate.c                    |  9 ++--
  target/m68k/translate.c                        | 44 ++++-----------
  target/microblaze/translate.c                  | 18 ++-----
  target/mips/tcg/translate.c                    | 75 ++++++++++++--------------
  target/openrisc/translate.c                    | 18 ++-----
  target/ppc/translate.c                         | 38 +++----------
  target/riscv/translate.c                       | 27 +---------
  target/rx/op_helper.c                          |  8 ---
  target/rx/translate.c                          | 12 +----
  target/s390x/tcg/translate.c                   |  8 +--
  target/sh4/op_helper.c                         |  5 --
  target/sh4/translate.c                         | 14 ++---
  target/tricore/op_helper.c                     |  7 ---
  target/tricore/translate.c                     | 14 +----
  target/xtensa/translate.c                      | 25 +++------
  target/riscv/insn_trans/trans_privileged.c.inc | 10 ++--
  target/riscv/insn_trans/trans_rvi.c.inc        |  8 ++-
  target/riscv/insn_trans/trans_rvv.c.inc        |  2 +-
 files changed, 141 insertions(+), 386 deletions(-)
+ include/exec/helper-proto.h                    |  32 ++-
+ include/tcg/tcg.h                              |   7 -
+ linux-user/include/host/ppc/host-signal.h      |  39 +++
+ tcg/arm/tcg-target-con-set.h                   |   7 +-
+ tcg/arm/tcg-target-con-str.h                   |   2 +
+ tcg/loongarch64/tcg-target-con-set.h           |   5 +-
+ tcg/loongarch64/tcg-target-con-str.h           |   2 +-
+ tcg/loongarch64/tcg-target.h                   |  11 +-
+ target/loongarch/insns.decode                  |   3 +-
+ disas.c                                        |   2 +
+ target/loongarch/disas.c                       |  39 ++-
+ tcg/tcg-op.c                                   |   4 +-
+ target/loongarch/insn_trans/trans_branch.c.inc |   2 +-
+ tcg/arm/tcg-target.c.inc                       |  28 +-
+ tcg/loongarch64/tcg-insn-defs.c.inc            |  10 +-
+ tcg/loongarch64/tcg-target.c.inc               | 364 ++++++++++++++++---------
+ common-user/host/ppc/safe-syscall.inc.S        | 107 ++++++++
+ target/loongarch/meson.build                   |   3 +-
+files changed, 497 insertions(+), 170 deletions(-)
+ create mode 100644 linux-user/include/host/ppc/host-signal.h
+ create mode 100644 common-user/host/ppc/safe-syscall.inc.S

-[PULL 01/24] accel/tcg: Handle gdb singlestep in cpu_tb_exec
+Deleted patch
-Currently the change in cpu_tb_exec is masked by the debug exception
-being raised by the translators.  But this allows us to remove that code.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- accel/tcg/cpu-exec.c | 11 +++++++++++
-file changed, 11 insertions(+)
-diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cpu-exec.c
-+++ b/accel/tcg/cpu-exec.c
-@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
-             cc->set_pc(cpu, last_tb->pc);
-         }
-     }
-+
-+    /*
-+     * If gdb single-step, and we haven't raised another exception,
-+     * raise a debug exception.  Single-step with another exception
-+     * is handled in cpu_handle_exception.
-+     */
-+    if (unlikely(cpu->singlestep_enabled) && cpu->exception_index == -1) {
-+        cpu->exception_index = EXCP_DEBUG;
-+        cpu_loop_exit(cpu);
-+    }
-+
-     return last_tb;
- }
---
-.25.1

-[PULL 02/24] target/alpha: Drop checks for singlestep_enabled
+Deleted patch
-GDB single-stepping is now handled generically.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/alpha/translate.c | 13 +++----------
-file changed, 3 insertions(+), 10 deletions(-)
-diff --git a/target/alpha/translate.c b/target/alpha/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/alpha/translate.c
-+++ b/target/alpha/translate.c
-@@ -XXX,XX +XXX,XX @@ static void alpha_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
-         tcg_gen_movi_i64(cpu_pc, ctx->base.pc_next);
-         /* FALLTHRU */
-     case DISAS_PC_UPDATED:
--        if (!ctx->base.singlestep_enabled) {
--            tcg_gen_lookup_and_goto_ptr();
--            break;
--        }
--        /* FALLTHRU */
-+        tcg_gen_lookup_and_goto_ptr();
-+        break;
-     case DISAS_PC_UPDATED_NOCHAIN:
--        if (ctx->base.singlestep_enabled) {
--            gen_excp_1(EXCP_DEBUG, 0);
--        } else {
--            tcg_gen_exit_tb(NULL, 0);
--        }
-+        tcg_gen_exit_tb(NULL, 0);
-         break;
-     default:
-         g_assert_not_reached();
---
-.25.1

-[PULL 03/24] target/avr: Drop checks for singlestep_enabled
+Deleted patch
-GDB single-stepping is now handled generically.
-Tested-by: Michael Rolnik <mrolnik@gmail.com>
-Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/avr/translate.c | 19 ++++---------------
-file changed, 4 insertions(+), 15 deletions(-)
-diff --git a/target/avr/translate.c b/target/avr/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/avr/translate.c
-+++ b/target/avr/translate.c
-@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
-         tcg_gen_exit_tb(tb, n);
-     } else {
-         tcg_gen_movi_i32(cpu_pc, dest);
--        if (ctx->base.singlestep_enabled) {
--            gen_helper_debug(cpu_env);
--        } else {
--            tcg_gen_lookup_and_goto_ptr();
--        }
-+        tcg_gen_lookup_and_goto_ptr();
-     }
-     ctx->base.is_jmp = DISAS_NORETURN;
- }
-@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
-         tcg_gen_movi_tl(cpu_pc, ctx->npc);
-         /* fall through */
-     case DISAS_LOOKUP:
--        if (!ctx->base.singlestep_enabled) {
--            tcg_gen_lookup_and_goto_ptr();
--            break;
--        }
--        /* fall through */
-+        tcg_gen_lookup_and_goto_ptr();
-+        break;
-     case DISAS_EXIT:
--        if (ctx->base.singlestep_enabled) {
--            gen_helper_debug(cpu_env);
--        } else {
--            tcg_gen_exit_tb(NULL, 0);
--        }
-+        tcg_gen_exit_tb(NULL, 0);
-         break;
-     default:
-         g_assert_not_reached();
---
-.25.1

-[PULL 04/24] target/cris: Drop checks for singlestep_enabled
+Deleted patch
-GDB single-stepping is now handled generically.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/cris/translate.c | 16 ----------------
-file changed, 16 deletions(-)
-diff --git a/target/cris/translate.c b/target/cris/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/cris/translate.c
-+++ b/target/cris/translate.c
-@@ -XXX,XX +XXX,XX @@ static void cris_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
-         }
-     }
--    if (unlikely(dc->base.singlestep_enabled)) {
--        switch (is_jmp) {
--        case DISAS_TOO_MANY:
--        case DISAS_UPDATE_NEXT:
--            tcg_gen_movi_tl(env_pc, npc);
--            /* fall through */
--        case DISAS_JUMP:
--        case DISAS_UPDATE:
--            t_gen_raise_exception(EXCP_DEBUG);
--            return;
--        default:
--            break;
--        }
--        g_assert_not_reached();
--    }
--
-     switch (is_jmp) {
-     case DISAS_TOO_MANY:
-         gen_goto_tb(dc, 0, npc);
---
-.25.1

-[PULL 05/24] target/hexagon: Drop checks for singlestep_enabled
+Deleted patch
-GDB single-stepping is now handled generically.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/hexagon/translate.c | 12 ++----------
-file changed, 2 insertions(+), 10 deletions(-)
-diff --git a/target/hexagon/translate.c b/target/hexagon/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/hexagon/translate.c
-+++ b/target/hexagon/translate.c
-@@ -XXX,XX +XXX,XX @@ static void gen_end_tb(DisasContext *ctx)
- {
-     gen_exec_counters(ctx);
-     tcg_gen_mov_tl(hex_gpr[HEX_REG_PC], hex_next_PC);
--    if (ctx->base.singlestep_enabled) {
--        gen_exception_raw(EXCP_DEBUG);
--    } else {
--        tcg_gen_exit_tb(NULL, 0);
--    }
-+    tcg_gen_exit_tb(NULL, 0);
-     ctx->base.is_jmp = DISAS_NORETURN;
- }
-@@ -XXX,XX +XXX,XX @@ static void hexagon_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
-     case DISAS_TOO_MANY:
-         gen_exec_counters(ctx);
-         tcg_gen_movi_tl(hex_gpr[HEX_REG_PC], ctx->base.pc_next);
--        if (ctx->base.singlestep_enabled) {
--            gen_exception_raw(EXCP_DEBUG);
--        } else {
--            tcg_gen_exit_tb(NULL, 0);
--        }
-+        tcg_gen_exit_tb(NULL, 0);
-         break;
-     case DISAS_NORETURN:
-         break;
---
-.25.1

-[PULL 22/24] target/tricore: Drop check for singlestep_enabled
+[PULL v2 01/15] tcg: Avoid recursion in tcg_gen_mulu2_i32
-GDB single-stepping is now handled generically.
+We have a test for one of TCG_TARGET_HAS_mulu2_i32 or
 TCG_TARGET_HAS_muluh_i32 being defined, but the test
 became non-functional when we changed to always define
 all of these macros.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Replace this with a build-time test in tcg_gen_mulu2_i32.
 Fixes: 25c4d9cc845 ("tcg: Always define all of the TCGOpcode enum members.")
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1435
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/tricore/helper.h    |  1 -
+ include/tcg/tcg.h | 7 -------
- target/tricore/op_helper.c |  7 -------
+ tcg/tcg-op.c      | 4 +++-
- target/tricore/translate.c | 14 +-------------
+files changed, 3 insertions(+), 8 deletions(-)
 files changed, 1 insertion(+), 21 deletions(-)
-diff --git a/target/tricore/helper.h b/target/tricore/helper.h
+diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/tricore/helper.h
+--- a/include/tcg/tcg.h
-+++ b/target/tricore/helper.h
++++ b/include/tcg/tcg.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_2(psw_write, void, env, i32)
+@@ -XXX,XX +XXX,XX @@ typedef uint64_t TCGRegSet;
- DEF_HELPER_1(psw_read, i32, env)
+ #define TCG_TARGET_HAS_rem_i64          0
- /* Exceptions */
+ #endif
- DEF_HELPER_3(raise_exception_sync, noreturn, env, i32, i32)
--DEF_HELPER_2(qemu_excp, noreturn, env, i32)
+-/* For 32-bit targets, some sort of unsigned widening multiply is required.  */
-diff --git a/target/tricore/op_helper.c b/target/tricore/op_helper.c
+-#if TCG_TARGET_REG_BITS == 32 \
 -    && !(defined(TCG_TARGET_HAS_mulu2_i32) \
 -         || defined(TCG_TARGET_HAS_muluh_i32))
 -# error "Missing unsigned widening multiply"
 -#endif
 -
  #if !defined(TCG_TARGET_HAS_v64) \
      && !defined(TCG_TARGET_HAS_v128) \
      && !defined(TCG_TARGET_HAS_v256)
 diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/tricore/op_helper.c
+--- a/tcg/tcg-op.c
-+++ b/target/tricore/op_helper.c
++++ b/tcg/tcg-op.c
-@@ -XXX,XX +XXX,XX @@ static void raise_exception_sync_helper(CPUTriCoreState *env, uint32_t class,
+@@ -XXX,XX +XXX,XX @@ void tcg_gen_mulu2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 arg1, TCGv_i32 arg2)
-     raise_exception_sync_internal(env, class, tin, pc, 0);
+         tcg_gen_op3_i32(INDEX_op_muluh_i32, rh, arg1, arg2);
- }
+         tcg_gen_mov_i32(rl, t);
+         tcg_temp_free_i32(t);
--void helper_qemu_excp(CPUTriCoreState *env, uint32_t excp)
+-    } else {
--{
++    } else if (TCG_TARGET_REG_BITS == 64) {
--    CPUState *cs = env_cpu(env);
+         TCGv_i64 t0 = tcg_temp_new_i64();
--    cs->exception_index = excp;
+         TCGv_i64 t1 = tcg_temp_new_i64();
--    cpu_loop_exit(cs);
+         tcg_gen_extu_i32_i64(t0, arg1);
--}
+@@ -XXX,XX +XXX,XX @@ void tcg_gen_mulu2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 arg1, TCGv_i32 arg2)
--
+         tcg_gen_extr_i64_i32(rl, rh, t0);
- /* Addressing mode helper */
+         tcg_temp_free_i64(t0);
+         tcg_temp_free_i64(t1);
- static uint16_t reverse16(uint16_t val)
++    } else {
-diff --git a/target/tricore/translate.c b/target/tricore/translate.c
++        qemu_build_not_reached();
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tricore/translate.c
 +++ b/target/tricore/translate.c
@@ -XXX,XX +XXX,XX @@ static inline void gen_save_pc(target_ulong pc)
      tcg_gen_movi_tl(cpu_PC, pc);
  }
 -static void generate_qemu_excp(DisasContext *ctx, int excp)
 -{
 -    TCGv_i32 tmp = tcg_const_i32(excp);
 -    gen_helper_qemu_excp(cpu_env, tmp);
 -    ctx->base.is_jmp = DISAS_NORETURN;
 -    tcg_temp_free(tmp);
 -}
 -
  static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
  {
      if (translator_use_goto_tb(&ctx->base, dest)) {
@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
          tcg_gen_exit_tb(ctx->base.tb, n);
      } else {
          gen_save_pc(dest);
 -        if (ctx->base.singlestep_enabled) {
 -            generate_qemu_excp(ctx, EXCP_DEBUG);
 -        } else {
 -            tcg_gen_lookup_and_goto_ptr();
 -        }
 +        tcg_gen_lookup_and_goto_ptr();
      }
  }
 --
-.25.1
+.34.1

-[PULL 23/24] target/xtensa: Drop check for singlestep_enabled
+[PULL v2 02/15] tcg/arm: Use register pair allocation for qemu_{ld, st}_i64
-GDB single-stepping is now handled generically.
+Although we still can't use ldrd and strd for all operations,
 increase the chances by getting the register allocation correct.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/xtensa/translate.c | 25 ++++++++-----------------
+ tcg/arm/tcg-target-con-set.h |  7 ++++---
-file changed, 8 insertions(+), 17 deletions(-)
+ tcg/arm/tcg-target-con-str.h |  2 ++
  tcg/arm/tcg-target.c.inc     | 28 ++++++++++++++++++----------
 files changed, 24 insertions(+), 13 deletions(-)
-diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
+diff --git a/tcg/arm/tcg-target-con-set.h b/tcg/arm/tcg-target-con-set.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/xtensa/translate.c
+--- a/tcg/arm/tcg-target-con-set.h
-+++ b/target/xtensa/translate.c
++++ b/tcg/arm/tcg-target-con-set.h
-@@ -XXX,XX +XXX,XX @@ static void gen_jump_slot(DisasContext *dc, TCGv dest, int slot)
+@@ -XXX,XX +XXX,XX @@ C_O0_I2(r, rIN)
-     if (dc->icount) {
+ C_O0_I2(s, s)
-         tcg_gen_mov_i32(cpu_SR[ICOUNT], dc->next_icount);
+ C_O0_I2(w, r)
-     }
+ C_O0_I3(s, s, s)
--    if (dc->base.singlestep_enabled) {
++C_O0_I3(S, p, s)
--        gen_exception(dc, EXCP_DEBUG);
+ C_O0_I4(r, r, rI, rI)
-+    if (dc->op_flags & XTENSA_OP_POSTPROCESS) {
+-C_O0_I4(s, s, s, s)
-+        slot = gen_postprocess(dc, slot);
++C_O0_I4(S, p, s, s)
-+    }
+ C_O1_I1(r, l)
-+    if (slot >= 0) {
+ C_O1_I1(r, r)
-+        tcg_gen_goto_tb(slot);
+ C_O1_I1(w, r)
-+        tcg_gen_exit_tb(dc->base.tb, slot);
+@@ -XXX,XX +XXX,XX @@ C_O1_I2(w, w, wZ)
-     } else {
+ C_O1_I3(w, w, w, w)
--        if (dc->op_flags & XTENSA_OP_POSTPROCESS) {
+ C_O1_I4(r, r, r, rI, rI)
--            slot = gen_postprocess(dc, slot);
+ C_O1_I4(r, r, rIN, rIK, 0)
--        }
+-C_O2_I1(r, r, l)
--        if (slot >= 0) {
+-C_O2_I2(r, r, l, l)
--            tcg_gen_goto_tb(slot);
++C_O2_I1(e, p, l)
--            tcg_gen_exit_tb(dc->base.tb, slot);
++C_O2_I2(e, p, l, l)
--        } else {
+ C_O2_I2(r, r, r, r)
--            tcg_gen_exit_tb(NULL, 0);
+ C_O2_I4(r, r, r, r, rIN, rIK)
--        }
+ C_O2_I4(r, r, rI, rI, rIN, rIK)
-+        tcg_gen_exit_tb(NULL, 0);
+diff --git a/tcg/arm/tcg-target-con-str.h b/tcg/arm/tcg-target-con-str.h
-     }
+index XXXXXXX..XXXXXXX 100644
-     dc->base.is_jmp = DISAS_NORETURN;
+--- a/tcg/arm/tcg-target-con-str.h
- }
++++ b/tcg/arm/tcg-target-con-str.h
-@@ -XXX,XX +XXX,XX @@ static void xtensa_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
+@@ -XXX,XX +XXX,XX @@
-     case DISAS_NORETURN:
+  * Define constraint letters for register sets:
   * REGS(letter, register_mask)
   */
 +REGS('e', ALL_GENERAL_REGS & 0x5555) /* even regs */
  REGS('r', ALL_GENERAL_REGS)
  REGS('l', ALL_QLOAD_REGS)
  REGS('s', ALL_QSTORE_REGS)
 +REGS('S', ALL_QSTORE_REGS & 0x5555)  /* even qstore */
  REGS('w', ALL_VECTOR_REGS)
  /*
 diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/arm/tcg-target.c.inc
 +++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_index(TCGContext *s, MemOp opc,
          tcg_out_ld32_r(s, COND_AL, datalo, addrlo, addend);
          break;
-     case DISAS_TOO_MANY:
+     case MO_UQ:
--        if (dc->base.singlestep_enabled) {
++        /* We used pair allocation for datalo, so already should be aligned. */
--            tcg_gen_movi_i32(cpu_pc, dc->pc);
++        tcg_debug_assert((datalo & 1) == 0);
--            gen_exception(dc, EXCP_DEBUG);
++        tcg_debug_assert(datahi == datalo + 1);
--        } else {
+         /* LDRD requires alignment; double-check that. */
--            gen_jumpi(dc, dc->pc, 0);
+-        if (get_alignment_bits(opc) >= MO_64
--        }
+-            && (datalo & 1) == 0 && datahi == datalo + 1) {
-+        gen_jumpi(dc, dc->pc, 0);
++        if (get_alignment_bits(opc) >= MO_64) {
              /*
               * Rm (the second address op) must not overlap Rt or Rt + 1.
               * Since datalo is aligned, we can simplify the test via alignment.
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp opc, TCGReg datalo,
          tcg_out_ld32_12(s, COND_AL, datalo, addrlo, 0);
          break;
-     default:
+     case MO_UQ:
-         g_assert_not_reached();
++        /* We used pair allocation for datalo, so already should be aligned. */
 +        tcg_debug_assert((datalo & 1) == 0);
 +        tcg_debug_assert(datahi == datalo + 1);
          /* LDRD requires alignment; double-check that. */
 -        if (get_alignment_bits(opc) >= MO_64
 -            && (datalo & 1) == 0 && datahi == datalo + 1) {
 +        if (get_alignment_bits(opc) >= MO_64) {
              tcg_out_ldrd_8(s, COND_AL, datalo, addrlo, 0);
          } else if (datalo == addrlo) {
              tcg_out_ld32_12(s, COND_AL, datahi, addrlo, 4);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_index(TCGContext *s, ARMCond cond, MemOp opc,
          tcg_out_st32_r(s, cond, datalo, addrlo, addend);
          break;
      case MO_64:
 +        /* We used pair allocation for datalo, so already should be aligned. */
 +        tcg_debug_assert((datalo & 1) == 0);
 +        tcg_debug_assert(datahi == datalo + 1);
          /* STRD requires alignment; double-check that. */
 -        if (get_alignment_bits(opc) >= MO_64
 -            && (datalo & 1) == 0 && datahi == datalo + 1) {
 +        if (get_alignment_bits(opc) >= MO_64) {
              tcg_out_strd_r(s, cond, datalo, addrlo, addend);
          } else if (scratch_addend) {
              tcg_out_st32_rwb(s, cond, datalo, addend, addrlo);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, MemOp opc, TCGReg datalo,
          tcg_out_st32_12(s, COND_AL, datalo, addrlo, 0);
          break;
      case MO_64:
 +        /* We used pair allocation for datalo, so already should be aligned. */
 +        tcg_debug_assert((datalo & 1) == 0);
 +        tcg_debug_assert(datahi == datalo + 1);
          /* STRD requires alignment; double-check that. */
 -        if (get_alignment_bits(opc) >= MO_64
 -            && (datalo & 1) == 0 && datahi == datalo + 1) {
 +        if (get_alignment_bits(opc) >= MO_64) {
              tcg_out_strd_8(s, COND_AL, datalo, addrlo, 0);
          } else {
              tcg_out_st32_12(s, COND_AL, datalo, addrlo, 0);
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
      case INDEX_op_qemu_ld_i32:
          return TARGET_LONG_BITS == 32 ? C_O1_I1(r, l) : C_O1_I2(r, l, l);
      case INDEX_op_qemu_ld_i64:
 -        return TARGET_LONG_BITS == 32 ? C_O2_I1(r, r, l) : C_O2_I2(r, r, l, l);
 +        return TARGET_LONG_BITS == 32 ? C_O2_I1(e, p, l) : C_O2_I2(e, p, l, l);
      case INDEX_op_qemu_st_i32:
          return TARGET_LONG_BITS == 32 ? C_O0_I2(s, s) : C_O0_I3(s, s, s);
      case INDEX_op_qemu_st_i64:
 -        return TARGET_LONG_BITS == 32 ? C_O0_I3(s, s, s) : C_O0_I4(s, s, s, s);
 +        return TARGET_LONG_BITS == 32 ? C_O0_I3(S, p, s) : C_O0_I4(S, p, s, s);
      case INDEX_op_st_vec:
          return C_O0_I2(w, r);
 --
-.25.1
+.34.1

-[PULL 21/24] target/sh4: Drop check for singlestep_enabled
+[PULL v2 03/15] common-user/host/ppc: Implement safe-syscall.inc.S
-GDB single-stepping is now handled generically.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
 Message-Id: <20220729172141.1789105-2-richard.henderson@linaro.org>
 ---
  common-user/host/ppc/safe-syscall.inc.S | 107 ++++++++++++++++++++++++
 file changed, 107 insertions(+)
  create mode 100644 common-user/host/ppc/safe-syscall.inc.S
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+diff --git a/common-user/host/ppc/safe-syscall.inc.S b/common-user/host/ppc/safe-syscall.inc.S
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+new file mode 100644
----
+index XXXXXXX..XXXXXXX
- target/sh4/helper.h    |  1 -
+--- /dev/null
- target/sh4/op_helper.c |  5 -----
++++ b/common-user/host/ppc/safe-syscall.inc.S
- target/sh4/translate.c | 14 +++-----------
+@@ -XXX,XX +XXX,XX @@
-files changed, 3 insertions(+), 17 deletions(-)
++/*
++ * safe-syscall.inc.S : host-specific assembly fragment
-diff --git a/target/sh4/helper.h b/target/sh4/helper.h
++ * to handle signals occurring at the same time as system calls.
-index XXXXXXX..XXXXXXX 100644
++ * This is intended to be included by common-user/safe-syscall.S
---- a/target/sh4/helper.h
++ *
-+++ b/target/sh4/helper.h
++ * Copyright (C) 2022 Linaro, Ltd.
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_1(raise_illegal_instruction, noreturn, env)
++ *
- DEF_HELPER_1(raise_slot_illegal_instruction, noreturn, env)
++ * This work is licensed under the terms of the GNU GPL, version 2 or later.
- DEF_HELPER_1(raise_fpu_disable, noreturn, env)
++ * See the COPYING file in the top-level directory.
- DEF_HELPER_1(raise_slot_fpu_disable, noreturn, env)
++ */
--DEF_HELPER_1(debug, noreturn, env)
++
- DEF_HELPER_1(sleep, noreturn, env)
++/*
- DEF_HELPER_2(trapa, noreturn, env, i32)
++ * Standardize on the _CALL_FOO symbols used by GCC:
- DEF_HELPER_1(exclusive, noreturn, env)
++ * Apple XCode does not define _CALL_DARWIN.
-diff --git a/target/sh4/op_helper.c b/target/sh4/op_helper.c
++ * Clang defines _CALL_ELF (64-bit) but not _CALL_SYSV (32-bit).
-index XXXXXXX..XXXXXXX 100644
++ */
---- a/target/sh4/op_helper.c
++#if !defined(_CALL_SYSV) && \
-+++ b/target/sh4/op_helper.c
++    !defined(_CALL_DARWIN) && \
-@@ -XXX,XX +XXX,XX @@ void helper_raise_slot_fpu_disable(CPUSH4State *env)
++    !defined(_CALL_AIX) && \
-     raise_exception(env, 0x820, 0);
++    !defined(_CALL_ELF)
- }
++# if defined(__APPLE__)
++#  define _CALL_DARWIN
--void helper_debug(CPUSH4State *env)
++# elif defined(__ELF__) && TCG_TARGET_REG_BITS == 32
--{
++#  define _CALL_SYSV
--    raise_exception(env, EXCP_DEBUG, 0);
++# else
--}
++#  error "Unknown ABI"
--
++# endif
- void helper_sleep(CPUSH4State *env)
++#endif
- {
++
-     CPUState *cs = env_cpu(env);
++#ifndef _CALL_SYSV
-diff --git a/target/sh4/translate.c b/target/sh4/translate.c
++# error "Unsupported ABI"
-index XXXXXXX..XXXXXXX 100644
++#endif
---- a/target/sh4/translate.c
++
-+++ b/target/sh4/translate.c
++
-@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
++        .global safe_syscall_base
-         tcg_gen_exit_tb(ctx->base.tb, n);
++        .global safe_syscall_start
-     } else {
++        .global safe_syscall_end
-         tcg_gen_movi_i32(cpu_pc, dest);
++        .type   safe_syscall_base, @function
--        if (ctx->base.singlestep_enabled) {
++
--            gen_helper_debug(cpu_env);
++        .text
--        } else if (use_exit_tb(ctx)) {
++
-+        if (use_exit_tb(ctx)) {
++        /*
-             tcg_gen_exit_tb(NULL, 0);
++         * This is the entry point for making a system call. The calling
-         } else {
++         * convention here is that of a C varargs function with the
-             tcg_gen_lookup_and_goto_ptr();
++         * first argument an 'int *' to the signal_pending flag, the
-@@ -XXX,XX +XXX,XX @@ static void gen_jump(DisasContext * ctx)
++         * second one the system call number (as a 'long'), and all further
-        delayed jump as immediate jump are conditinal jumps */
++         * arguments being syscall arguments (also 'long').
-     tcg_gen_mov_i32(cpu_pc, cpu_delayed_pc);
++         */
-         tcg_gen_discard_i32(cpu_delayed_pc);
++safe_syscall_base:
--        if (ctx->base.singlestep_enabled) {
++        .cfi_startproc
--            gen_helper_debug(cpu_env);
++        stwu    1, -8(1)
--        } else if (use_exit_tb(ctx)) {
++        .cfi_def_cfa_offset 8
-+        if (use_exit_tb(ctx)) {
++        stw     30, 4(1)
-             tcg_gen_exit_tb(NULL, 0);
++        .cfi_offset 30, -4
-         } else {
++
-             tcg_gen_lookup_and_goto_ptr();
++        /*
-@@ -XXX,XX +XXX,XX @@ static void sh4_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
++         * We enter with r3 == &signal_pending
-     switch (ctx->base.is_jmp) {
++         *               r4 == syscall number
-     case DISAS_STOP:
++         *               r5 ... r10 == syscall arguments
-         gen_save_cpu_state(ctx, true);
++         *               and return the result in r3
--        if (ctx->base.singlestep_enabled) {
++         * and the syscall instruction needs
--            gen_helper_debug(cpu_env);
++         *               r0 == syscall number
--        } else {
++         *               r3 ... r8 == syscall arguments
--            tcg_gen_exit_tb(NULL, 0);
++         *               and returns the result in r3
--        }
++         * Shuffle everything around appropriately.
-+        tcg_gen_exit_tb(NULL, 0);
++         */
-         break;
++        mr      30, 3           /* signal_pending */
-     case DISAS_NEXT:
++        mr      0, 4            /* syscall number */
-     case DISAS_TOO_MANY:
++        mr      3, 5            /* syscall arguments */
 +        mr      4, 6
 +        mr      5, 7
 +        mr      6, 8
 +        mr      7, 9
 +        mr      8, 10
 +
 +        /*
 +         * This next sequence of code works in conjunction with the
 +         * rewind_if_safe_syscall_function(). If a signal is taken
 +         * and the interrupted PC is anywhere between 'safe_syscall_start'
 +         * and 'safe_syscall_end' then we rewind it to 'safe_syscall_start'.
 +         * The code sequence must therefore be able to cope with this, and
 +         * the syscall instruction must be the final one in the sequence.
 +         */
 +safe_syscall_start:
 +        /* if signal_pending is non-zero, don't do the call */
 +        lwz     12, 0(30)
 +        cmpwi   0, 12, 0
 +        bne-    2f
 +        sc
 +safe_syscall_end:
 +        /* code path when we did execute the syscall */
 +        lwz     30, 4(1)        /* restore r30 */
 +        addi    1, 1, 8         /* restore stack */
 +        .cfi_restore 30
 +        .cfi_def_cfa_offset 0
 +        bnslr+                  /* return on success */
 +        b       safe_syscall_set_errno_tail
 +
 +        /* code path when we didn't execute the syscall */
 +2:      lwz     30, 4(1)
 +        addi    1, 1, 8
 +        addi    3, 0, QEMU_ERESTARTSYS
 +        b       safe_syscall_set_errno_tail
 +
 +        .cfi_endproc
 +
 +        .size   safe_syscall_base, .-safe_syscall_base
 --
-.25.1
+.34.1

-[PULL 20/24] target/s390x: Drop check for singlestep_enabled
+[PULL v2 04/15] linux-user: Implment host/ppc/host-signal.h
-GDB single-stepping is now handled generically.
+This commit re-enables ppc32 as a linux-user host,
 as existance of the directory is noted by configure.
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1097
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
+Message-Id: <20220729172141.1789105-3-richard.henderson@linaro.org>
 ---
- target/s390x/tcg/translate.c | 8 ++------
+ linux-user/include/host/ppc/host-signal.h | 39 +++++++++++++++++++++++
-file changed, 2 insertions(+), 6 deletions(-)
+file changed, 39 insertions(+)
  create mode 100644 linux-user/include/host/ppc/host-signal.h
-diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
+diff --git a/linux-user/include/host/ppc/host-signal.h b/linux-user/include/host/ppc/host-signal.h
-index XXXXXXX..XXXXXXX 100644
+new file mode 100644
---- a/target/s390x/tcg/translate.c
+index XXXXXXX..XXXXXXX
-+++ b/target/s390x/tcg/translate.c
+--- /dev/null
-@@ -XXX,XX +XXX,XX @@ struct DisasContext {
++++ b/linux-user/include/host/ppc/host-signal.h
-     uint64_t pc_tmp;
+@@ -XXX,XX +XXX,XX @@
-     uint32_t ilen;
++/*
-     enum cc_op cc_op;
++ * host-signal.h: signal info dependent on the host architecture
--    bool do_debug;
++ *
- };
++ * Copyright (c) 2022 Linaro Ltd.
++ *
- /* Information carried about a condition to be evaluated.  */
++ * This work is licensed under the terms of the GNU LGPL, version 2.1 or later.
-@@ -XXX,XX +XXX,XX @@ static void s390x_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
++ * See the COPYING file in the top-level directory.
++ */
-     dc->cc_op = CC_OP_DYNAMIC;
++
-     dc->ex_value = dc->base.tb->cs_base;
++#ifndef PPC_HOST_SIGNAL_H
--    dc->do_debug = dc->base.singlestep_enabled;
++#define PPC_HOST_SIGNAL_H
- }
++
++#include <asm/ptrace.h>
- static void s390x_tr_tb_start(DisasContextBase *db, CPUState *cs)
++
-@@ -XXX,XX +XXX,XX @@ static void s390x_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
++/* The third argument to a SA_SIGINFO handler is ucontext_t. */
-         /* FALLTHRU */
++typedef ucontext_t host_sigcontext;
-     case DISAS_PC_CC_UPDATED:
++
-         /* Exit the TB, either by raising a debug exception or by return.  */
++static inline uintptr_t host_signal_pc(host_sigcontext *uc)
--        if (dc->do_debug) {
++{
--            gen_exception(EXCP_DEBUG);
++    return uc->uc_mcontext.regs->nip;
--        } else if ((dc->base.tb->flags & FLAG_MASK_PER) ||
++}
--                   dc->base.is_jmp == DISAS_PC_STALE_NOCHAIN) {
++
-+        if ((dc->base.tb->flags & FLAG_MASK_PER) ||
++static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
-+             dc->base.is_jmp == DISAS_PC_STALE_NOCHAIN) {
++{
-             tcg_gen_exit_tb(NULL, 0);
++    uc->uc_mcontext.regs->nip = pc;
-         } else {
++}
-             tcg_gen_lookup_and_goto_ptr();
++
 +static inline void *host_signal_mask(host_sigcontext *uc)
 +{
 +    return &uc->uc_sigmask;
 +}
 +
 +static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
 +{
 +    return uc->uc_mcontext.regs->trap != 0x400
 +        && (uc->uc_mcontext.regs->dsisr & 0x02000000);
 +}
 +
 +#endif
 --
-.25.1
+.34.1

-[PULL 16/24] target/ppc: Drop exit checks for singlestep_enabled
+[PULL v2 05/15] tcg: Mark tcg helpers noinline to avoid an issue with LTO
-GDB single-stepping is now handled generically.
+Marking helpers __attribute__((noinline)) prevents an issue
-Reuse gen_debug_exception to handle architectural debug exceptions.
+with GCC's ipa-split pass under --enable-lto.
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1454
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Tested-by: Idan Horowitz <idan.horowitz@gmail.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/ppc/translate.c | 38 ++++++++------------------------------
+ include/exec/helper-proto.h | 32 ++++++++++++++++++++++++--------
-file changed, 8 insertions(+), 30 deletions(-)
+file changed, 24 insertions(+), 8 deletions(-)
-diff --git a/target/ppc/translate.c b/target/ppc/translate.c
+diff --git a/include/exec/helper-proto.h b/include/exec/helper-proto.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/ppc/translate.c
+--- a/include/exec/helper-proto.h
-+++ b/target/ppc/translate.c
++++ b/include/exec/helper-proto.h
 @@ -XXX,XX +XXX,XX @@
- #define CPU_SINGLE_STEP 0x1
+ #include "exec/helper-head.h"
- #define CPU_BRANCH_STEP 0x2
--#define GDBSTUB_SINGLE_STEP 0x4
++/*
++ * Work around an issue with --enable-lto, in which GCC's ipa-split pass
- /* Include definitions for instructions classes and implementations flags */
++ * decides to split out the noreturn code paths that raise an exception,
- /* #define PPC_DEBUG_DISAS */
++ * taking the __builtin_return_address() along into the new function,
-@@ -XXX,XX +XXX,XX @@ static uint32_t gen_prep_dbgex(DisasContext *ctx)
++ * where it no longer computes a value that returns to TCG generated code.
++ * Despite the name, the noinline attribute affects splitter, so this
- static void gen_debug_exception(DisasContext *ctx)
++ * prevents the optimization in question.  Given that helpers should not
- {
++ * otherwise be called directly, this should have any other visible effect.
--    gen_helper_raise_exception(cpu_env, tcg_constant_i32(EXCP_DEBUG));
++ *
-+    gen_helper_raise_exception(cpu_env, tcg_constant_i32(gen_prep_dbgex(ctx)));
++ * See https://gitlab.com/qemu-project/qemu/-/issues/1454
-     ctx->base.is_jmp = DISAS_NORETURN;
++ */
- }
++#define DEF_HELPER_ATTR  __attribute__((noinline))
++
-@@ -XXX,XX +XXX,XX @@ static inline bool use_goto_tb(DisasContext *ctx, target_ulong dest)
+ #define DEF_HELPER_FLAGS_0(name, flags, ret) \
+-dh_ctype(ret) HELPER(name) (void);
- static void gen_lookup_and_goto_ptr(DisasContext *ctx)
++dh_ctype(ret) HELPER(name) (void) DEF_HELPER_ATTR;
- {
--    int sse = ctx->singlestep_enabled;
+ #define DEF_HELPER_FLAGS_1(name, flags, ret, t1) \
--    if (unlikely(sse)) {
+-dh_ctype(ret) HELPER(name) (dh_ctype(t1));
--        if (sse & GDBSTUB_SINGLE_STEP) {
++dh_ctype(ret) HELPER(name) (dh_ctype(t1)) DEF_HELPER_ATTR;
--            gen_debug_exception(ctx);
--        } else if (sse & (CPU_SINGLE_STEP | CPU_BRANCH_STEP)) {
+ #define DEF_HELPER_FLAGS_2(name, flags, ret, t1, t2) \
--            gen_helper_raise_exception(cpu_env, tcg_constant_i32(gen_prep_dbgex(ctx)));
+-dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2));
--        } else {
++dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2)) DEF_HELPER_ATTR;
--            tcg_gen_exit_tb(NULL, 0);
--        }
+ #define DEF_HELPER_FLAGS_3(name, flags, ret, t1, t2, t3) \
-+    if (unlikely(ctx->singlestep_enabled)) {
+-dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3));
-+        gen_debug_exception(ctx);
++dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), \
-     } else {
++                            dh_ctype(t3)) DEF_HELPER_ATTR;
-         tcg_gen_lookup_and_goto_ptr();
-     }
+ #define DEF_HELPER_FLAGS_4(name, flags, ret, t1, t2, t3, t4) \
-@@ -XXX,XX +XXX,XX @@ static void ppc_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
+ dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3), \
-     ctx->singlestep_enabled = 0;
+-                                   dh_ctype(t4));
-     if ((hflags >> HFLAGS_SE) & 1) {
++                            dh_ctype(t4)) DEF_HELPER_ATTR;
-         ctx->singlestep_enabled |= CPU_SINGLE_STEP;
-+        ctx->base.max_insns = 1;
+ #define DEF_HELPER_FLAGS_5(name, flags, ret, t1, t2, t3, t4, t5) \
-     }
+ dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3), \
-     if ((hflags >> HFLAGS_BE) & 1) {
+-                            dh_ctype(t4), dh_ctype(t5));
-         ctx->singlestep_enabled |= CPU_BRANCH_STEP;
++                            dh_ctype(t4), dh_ctype(t5)) DEF_HELPER_ATTR;
-     }
--    if (unlikely(ctx->base.singlestep_enabled)) {
+ #define DEF_HELPER_FLAGS_6(name, flags, ret, t1, t2, t3, t4, t5, t6) \
--        ctx->singlestep_enabled |= GDBSTUB_SINGLE_STEP;
+ dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3), \
--    }
+-                            dh_ctype(t4), dh_ctype(t5), dh_ctype(t6));
--
++                            dh_ctype(t4), dh_ctype(t5), \
--    if (ctx->singlestep_enabled & (CPU_SINGLE_STEP | GDBSTUB_SINGLE_STEP)) {
++                            dh_ctype(t6)) DEF_HELPER_ATTR;
--        ctx->base.max_insns = 1;
--    }
+ #define DEF_HELPER_FLAGS_7(name, flags, ret, t1, t2, t3, t4, t5, t6, t7) \
- }
+ dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3), \
+                             dh_ctype(t4), dh_ctype(t5), dh_ctype(t6), \
- static void ppc_tr_tb_start(DisasContextBase *db, CPUState *cs)
+-                            dh_ctype(t7));
-@@ -XXX,XX +XXX,XX @@ static void ppc_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
++                            dh_ctype(t7)) DEF_HELPER_ATTR;
-     DisasContext *ctx = container_of(dcbase, DisasContext, base);
-     DisasJumpType is_jmp = ctx->base.is_jmp;
+ #define IN_HELPER_PROTO
-     target_ulong nip = ctx->base.pc_next;
--    int sse;
+@@ -XXX,XX +XXX,XX @@ dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3), \
+ #undef DEF_HELPER_FLAGS_5
-     if (is_jmp == DISAS_NORETURN) {
+ #undef DEF_HELPER_FLAGS_6
-         /* We have already exited the TB. */
+ #undef DEF_HELPER_FLAGS_7
-@@ -XXX,XX +XXX,XX @@ static void ppc_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
++#undef DEF_HELPER_ATTR
-     }
+ #endif /* HELPER_PROTO_H */
      /* Honor single stepping. */
 -    sse = ctx->singlestep_enabled & (CPU_SINGLE_STEP | GDBSTUB_SINGLE_STEP);
 -    if (unlikely(sse)) {
 +    if (unlikely(ctx->singlestep_enabled & CPU_SINGLE_STEP)
 +        && (nip <= 0x100 || nip > 0xf00)) {
          switch (is_jmp) {
          case DISAS_TOO_MANY:
          case DISAS_EXIT_UPDATE:
@@ -XXX,XX +XXX,XX @@ static void ppc_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
              g_assert_not_reached();
          }
 -        if (sse & GDBSTUB_SINGLE_STEP) {
 -            gen_debug_exception(ctx);
 -            return;
 -        }
 -        /* else CPU_SINGLE_STEP... */
 -        if (nip <= 0x100 || nip > 0xf00) {
 -            gen_helper_raise_exception(cpu_env, tcg_constant_i32(gen_prep_dbgex(ctx)));
 -            return;
 -        }
 +        gen_debug_exception(ctx);
 +        return;
      }
      switch (is_jmp) {
 --
-.25.1
+.34.1

-[PULL 14/24] target/mips: Drop exit checks for singlestep_enabled
+[PULL v2 06/15] target/loongarch: Enable the disassembler for host tcg
-GDB single-stepping is now handled generically.
+Reuse the decodetree based disassembler from
 target/loongarch/ for tcg/loongarch64/.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+The generation of decode-insns.c.inc into ./libcommon.fa.p/ could
 eventually result in conflict, if any other host requires the same
 trick, but this is good enough for now.
 Reviewed-by: WANG Xuerui <git@xen0n.name>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/mips/tcg/translate.c | 50 +++++++++++++------------------------
+ disas.c                      | 2 ++
-file changed, 18 insertions(+), 32 deletions(-)
+ target/loongarch/meson.build | 3 ++-
 files changed, 4 insertions(+), 1 deletion(-)
-diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
+diff --git a/disas.c b/disas.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/mips/tcg/translate.c
+--- a/disas.c
-+++ b/target/mips/tcg/translate.c
++++ b/disas.c
-@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
+@@ -XXX,XX +XXX,XX @@ static void initialize_debug_host(CPUDebug *s)
-         tcg_gen_exit_tb(ctx->base.tb, n);
+     s->info.cap_insn_split = 6;
-     } else {
+ #elif defined(__hppa__)
-         gen_save_pc(dest);
+     s->info.print_insn = print_insn_hppa;
--        if (ctx->base.singlestep_enabled) {
++#elif defined(__loongarch__)
--            save_cpu_state(ctx, 0);
++    s->info.print_insn = print_insn_loongarch;
--            gen_helper_raise_exception_debug(cpu_env);
+ #endif
 -        } else {
 -            tcg_gen_lookup_and_goto_ptr();
 -        }
 +        tcg_gen_lookup_and_goto_ptr();
      }
  }
-@@ -XXX,XX +XXX,XX @@ static void gen_branch(DisasContext *ctx, int insn_bytes)
+diff --git a/target/loongarch/meson.build b/target/loongarch/meson.build
-             } else {
+index XXXXXXX..XXXXXXX 100644
-                 tcg_gen_mov_tl(cpu_PC, btarget);
+--- a/target/loongarch/meson.build
-             }
++++ b/target/loongarch/meson.build
--            if (ctx->base.singlestep_enabled) {
+@@ -XXX,XX +XXX,XX @@ gen = decodetree.process('insns.decode')
--                save_cpu_state(ctx, 0);
+ loongarch_ss = ss.source_set()
--                gen_helper_raise_exception_debug(cpu_env);
+ loongarch_ss.add(files(
--            }
+   'cpu.c',
-             tcg_gen_lookup_and_goto_ptr();
+-  'disas.c',
-             break;
+ ))
-         default:
+ loongarch_tcg_ss = ss.source_set()
-@@ -XXX,XX +XXX,XX @@ static void mips_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
+ loongarch_tcg_ss.add(gen)
- {
+@@ -XXX,XX +XXX,XX @@ loongarch_softmmu_ss.add(files(
-     DisasContext *ctx = container_of(dcbase, DisasContext, base);
+   'iocsr_helper.c',
+ ))
--    if (ctx->base.singlestep_enabled && ctx->base.is_jmp != DISAS_NORETURN) {
--        save_cpu_state(ctx, ctx->base.is_jmp != DISAS_EXIT);
++common_ss.add(when: 'CONFIG_LOONGARCH_DIS', if_true: [files('disas.c'), gen])
--        gen_helper_raise_exception_debug(cpu_env);
++
--    } else {
+ loongarch_ss.add_all(when: 'CONFIG_TCG', if_true: [loongarch_tcg_ss])
--        switch (ctx->base.is_jmp) {
--        case DISAS_STOP:
+ target_arch += {'loongarch': loongarch_ss}
 -            gen_save_pc(ctx->base.pc_next);
 -            tcg_gen_lookup_and_goto_ptr();
 -            break;
 -        case DISAS_NEXT:
 -        case DISAS_TOO_MANY:
 -            save_cpu_state(ctx, 0);
 -            gen_goto_tb(ctx, 0, ctx->base.pc_next);
 -            break;
 -        case DISAS_EXIT:
 -            tcg_gen_exit_tb(NULL, 0);
 -            break;
 -        case DISAS_NORETURN:
 -            break;
 -        default:
 -            g_assert_not_reached();
 -        }
 +    switch (ctx->base.is_jmp) {
 +    case DISAS_STOP:
 +        gen_save_pc(ctx->base.pc_next);
 +        tcg_gen_lookup_and_goto_ptr();
 +        break;
 +    case DISAS_NEXT:
 +    case DISAS_TOO_MANY:
 +        save_cpu_state(ctx, 0);
 +        gen_goto_tb(ctx, 0, ctx->base.pc_next);
 +        break;
 +    case DISAS_EXIT:
 +        tcg_gen_exit_tb(NULL, 0);
 +        break;
 +    case DISAS_NORETURN:
 +        break;
 +    default:
 +        g_assert_not_reached();
      }
  }
 --
-.25.1
+.34.1

-[PULL 19/24] target/rx: Drop checks for singlestep_enabled
+[PULL v2 07/15] target/loongarch: Disassemble jirl properly
-GDB single-stepping is now handled generically.
+While jirl shares the same instruction format as bne etc,
 it is not assembled the same.  In particular, rd is printed
 first not second and the immediate is not pc-relative.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Decode into the arg_rr_i structure, which prints correctly.
 This changes the "offs" member to "imm", to update translate.
 Reviewed-by: WANG Xuerui <git@xen0n.name>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/rx/helper.h    |  1 -
+ target/loongarch/insns.decode                  | 3 ++-
- target/rx/op_helper.c |  8 --------
+ target/loongarch/disas.c                       | 2 +-
- target/rx/translate.c | 12 ++----------
+ target/loongarch/insn_trans/trans_branch.c.inc | 2 +-
-files changed, 2 insertions(+), 19 deletions(-)
+files changed, 4 insertions(+), 3 deletions(-)
-diff --git a/target/rx/helper.h b/target/rx/helper.h
+diff --git a/target/loongarch/insns.decode b/target/loongarch/insns.decode
 index XXXXXXX..XXXXXXX 100644
---- a/target/rx/helper.h
+--- a/target/loongarch/insns.decode
-+++ b/target/rx/helper.h
++++ b/target/loongarch/insns.decode
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_1(raise_illegal_instruction, noreturn, env)
+@@ -XXX,XX +XXX,XX @@
- DEF_HELPER_1(raise_access_fault, noreturn, env)
+ @rr_ui12                 .... ...... imm:12 rj:5 rd:5    &rr_i
- DEF_HELPER_1(raise_privilege_violation, noreturn, env)
+ @rr_i14s2         .... ....  .............. rj:5 rd:5    &rr_i imm=%i14s2
- DEF_HELPER_1(wait, noreturn, env)
+ @rr_i16                     .... .. imm:s16 rj:5 rd:5    &rr_i
--DEF_HELPER_1(debug, noreturn, env)
++@rr_i16s2         .... ..  ................ rj:5 rd:5    &rr_i imm=%offs16
- DEF_HELPER_2(rxint, noreturn, env, i32)
+ @hint_r_i12           .... ...... imm:s12 rj:5 hint:5    &hint_r_i
- DEF_HELPER_1(rxbrk, noreturn, env)
+ @rrr_sa2p1        .... ........ ... .. rk:5 rj:5 rd:5    &rrr_sa  sa=%sa2p1
- DEF_HELPER_FLAGS_3(fadd, TCG_CALL_NO_WG, f32, env, f32, f32)
+ @rrr_sa2        .... ........ ... sa:2 rk:5 rj:5 rd:5    &rrr_sa
-diff --git a/target/rx/op_helper.c b/target/rx/op_helper.c
+@@ -XXX,XX +XXX,XX @@ beqz            0100 00 ................ ..... .....     @r_offs21
  bnez            0100 01 ................ ..... .....     @r_offs21
  bceqz           0100 10 ................ 00 ... .....    @c_offs21
  bcnez           0100 10 ................ 01 ... .....    @c_offs21
 -jirl            0100 11 ................ ..... .....     @rr_offs16
 +jirl            0100 11 ................ ..... .....     @rr_i16s2
  b               0101 00 ..........................       @offs26
  bl              0101 01 ..........................       @offs26
  beq             0101 10 ................ ..... .....     @rr_offs16
 diff --git a/target/loongarch/disas.c b/target/loongarch/disas.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/rx/op_helper.c
+--- a/target/loongarch/disas.c
-+++ b/target/rx/op_helper.c
++++ b/target/loongarch/disas.c
-@@ -XXX,XX +XXX,XX @@ void QEMU_NORETURN helper_wait(CPURXState *env)
+@@ -XXX,XX +XXX,XX @@ INSN(beqz,         r_offs)
-     raise_exception(env, EXCP_HLT, 0);
+ INSN(bnez,         r_offs)
- }
+ INSN(bceqz,        c_offs)
+ INSN(bcnez,        c_offs)
--void QEMU_NORETURN helper_debug(CPURXState *env)
+-INSN(jirl,         rr_offs)
--{
++INSN(jirl,         rr_i)
--    CPUState *cs = env_cpu(env);
+ INSN(b,            offs)
--
+ INSN(bl,           offs)
--    cs->exception_index = EXCP_DEBUG;
+ INSN(beq,          rr_offs)
--    cpu_loop_exit(cs);
+diff --git a/target/loongarch/insn_trans/trans_branch.c.inc b/target/loongarch/insn_trans/trans_branch.c.inc
 -}
 -
  void QEMU_NORETURN helper_rxint(CPURXState *env, uint32_t vec)
  {
      raise_exception(env, 0x100 + vec, 0);
 diff --git a/target/rx/translate.c b/target/rx/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/rx/translate.c
+--- a/target/loongarch/insn_trans/trans_branch.c.inc
-+++ b/target/rx/translate.c
++++ b/target/loongarch/insn_trans/trans_branch.c.inc
-@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *dc, int n, target_ulong dest)
+@@ -XXX,XX +XXX,XX @@ static bool trans_jirl(DisasContext *ctx, arg_jirl *a)
-         tcg_gen_exit_tb(dc->base.tb, n);
+     TCGv dest = gpr_dst(ctx, a->rd, EXT_NONE);
-     } else {
+     TCGv src1 = gpr_src(ctx, a->rj, EXT_NONE);
-         tcg_gen_movi_i32(cpu_pc, dest);
--        if (dc->base.singlestep_enabled) {
+-    tcg_gen_addi_tl(cpu_pc, src1, a->offs);
--            gen_helper_debug(cpu_env);
++    tcg_gen_addi_tl(cpu_pc, src1, a->imm);
--        } else {
+     tcg_gen_movi_tl(dest, ctx->base.pc_next + 4);
--            tcg_gen_lookup_and_goto_ptr();
+     gen_set_gpr(a->rd, dest, EXT_NONE);
--        }
+     tcg_gen_lookup_and_goto_ptr();
 +        tcg_gen_lookup_and_goto_ptr();
      }
      dc->base.is_jmp = DISAS_NORETURN;
  }
@@ -XXX,XX +XXX,XX @@ static void rx_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
          gen_goto_tb(ctx, 0, dcbase->pc_next);
          break;
      case DISAS_JUMP:
 -        if (ctx->base.singlestep_enabled) {
 -            gen_helper_debug(cpu_env);
 -        } else {
 -            tcg_gen_lookup_and_goto_ptr();
 -        }
 +        tcg_gen_lookup_and_goto_ptr();
          break;
      case DISAS_UPDATE:
          tcg_gen_movi_i32(cpu_pc, ctx->base.pc_next);
 --
-.25.1
+.34.1

-[PULL 15/24] target/openrisc: Drop checks for singlestep_enabled
+[PULL v2 08/15] target/loongarch: Disassemble pcadd* addresses
-GDB single-stepping is now handled generically.
+Print both the raw field and the resolved pc-relative
 address, as we do for branches.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: WANG Xuerui <git@xen0n.name>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/openrisc/translate.c | 18 +++---------------
+ target/loongarch/disas.c | 37 +++++++++++++++++++++++++++++++++----
-file changed, 3 insertions(+), 15 deletions(-)
+file changed, 33 insertions(+), 4 deletions(-)
-diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
+diff --git a/target/loongarch/disas.c b/target/loongarch/disas.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/openrisc/translate.c
+--- a/target/loongarch/disas.c
-+++ b/target/openrisc/translate.c
++++ b/target/loongarch/disas.c
-@@ -XXX,XX +XXX,XX @@ static void openrisc_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ INSN(fsel,         fffc)
-             /* The jump destination is indirect/computed; use jmp_pc.  */
+ INSN(addu16i_d,    rr_i)
-             tcg_gen_mov_tl(cpu_pc, jmp_pc);
+ INSN(lu12i_w,      r_i)
-             tcg_gen_discard_tl(jmp_pc);
+ INSN(lu32i_d,      r_i)
--            if (unlikely(dc->base.singlestep_enabled)) {
+-INSN(pcaddi,       r_i)
--                gen_exception(dc, EXCP_DEBUG);
+-INSN(pcalau12i,    r_i)
--            } else {
+-INSN(pcaddu12i,    r_i)
--                tcg_gen_lookup_and_goto_ptr();
+-INSN(pcaddu18i,    r_i)
--            }
+ INSN(ll_w,         rr_i)
-+            tcg_gen_lookup_and_goto_ptr();
+ INSN(sc_w,         rr_i)
-             break;
+ INSN(ll_d,         rr_i)
-         }
+@@ -XXX,XX +XXX,XX @@ static bool trans_fcmp_cond_##suffix(DisasContext *ctx, \
-         /* The jump destination is direct; use jmp_pc_imm.
-@@ -XXX,XX +XXX,XX @@ static void openrisc_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
+ FCMP_INSN(s)
-             break;
+ FCMP_INSN(d)
-         }
++
-         tcg_gen_movi_tl(cpu_pc, jmp_dest);
++#define PCADD_INSN(name)                                        \
--        if (unlikely(dc->base.singlestep_enabled)) {
++static bool trans_##name(DisasContext *ctx, arg_##name *a)      \
--            gen_exception(dc, EXCP_DEBUG);
++{                                                               \
--        } else {
++    output(ctx, #name, "r%d, %d # 0x%" PRIx64,                  \
--            tcg_gen_lookup_and_goto_ptr();
++           a->rd, a->imm, gen_##name(ctx->pc, a->imm));         \
--        }
++    return true;                                                \
-+        tcg_gen_lookup_and_goto_ptr();
++}
-         break;
++
++static uint64_t gen_pcaddi(uint64_t pc, int imm)
-     case DISAS_EXIT:
++{
--        if (unlikely(dc->base.singlestep_enabled)) {
++    return pc + (imm << 2);
--            gen_exception(dc, EXCP_DEBUG);
++}
--        } else {
++
--            tcg_gen_exit_tb(NULL, 0);
++static uint64_t gen_pcalau12i(uint64_t pc, int imm)
--        }
++{
-+        tcg_gen_exit_tb(NULL, 0);
++    return (pc + (imm << 12)) & ~0xfff;
-         break;
++}
-     default:
++
-         g_assert_not_reached();
++static uint64_t gen_pcaddu12i(uint64_t pc, int imm)
 +{
 +    return pc + (imm << 12);
 +}
 +
 +static uint64_t gen_pcaddu18i(uint64_t pc, int imm)
 +{
 +    return pc + ((uint64_t)(imm) << 18);
 +}
 +
 +PCADD_INSN(pcaddi)
 +PCADD_INSN(pcalau12i)
 +PCADD_INSN(pcaddu12i)
 +PCADD_INSN(pcaddu18i)
 --
-.25.1
+.34.1

-[PULL 18/24] target/riscv: Remove exit_tb and lookup_and_goto_ptr
+[PULL v2 09/15] tcg/loongarch64: Optimize immediate loading
-GDB single-stepping is now handled generically, which means
+From: Rui Wang <wangrui@loongson.cn>
 we don't need to do anything in the wrappers.
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+diff:
   Imm                 Before                  After
   0000000000000000    addi.w  rd, zero, 0     addi.w  rd, zero, 0
                       lu52i.d rd, zero, 0
   00000000fffff800    lu12i.w rd, -1          addi.w  rd, zero, -2048
                       ori     rd, rd, 2048    lu32i.d rd, 0
                       lu32i.d rd, 0
 Reviewed-by: WANG Xuerui <git@xen0n.name>
 Signed-off-by: Rui Wang <wangrui@loongson.cn>
 Message-Id: <20221107144713.845550-1-wangrui@loongson.cn>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/riscv/translate.c                      | 27 +------------------
+ tcg/loongarch64/tcg-target.c.inc | 35 +++++++++++---------------------
- .../riscv/insn_trans/trans_privileged.c.inc   |  4 +--
+file changed, 12 insertions(+), 23 deletions(-)
  target/riscv/insn_trans/trans_rvi.c.inc       |  8 +++---
  target/riscv/insn_trans/trans_rvv.c.inc       |  2 +-
 files changed, 7 insertions(+), 34 deletions(-)
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
+diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
+--- a/tcg/loongarch64/tcg-target.c.inc
-+++ b/target/riscv/translate.c
++++ b/tcg/loongarch64/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static void generate_exception_mtval(DisasContext *ctx, int excp)
+@@ -XXX,XX +XXX,XX @@ static bool tcg_out_mov(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg)
-     ctx->base.is_jmp = DISAS_NORETURN;
+     return true;
  }
--static void gen_exception_debug(void)
+-static bool imm_part_needs_loading(bool high_bits_are_ones,
 -                                   tcg_target_long part)
 -{
--    gen_helper_raise_exception(cpu_env, tcg_constant_i32(EXCP_DEBUG));
+-    if (high_bits_are_ones) {
--}
+-        return part != -1;
 -
 -/* Wrapper around tcg_gen_exit_tb that handles single stepping */
 -static void exit_tb(DisasContext *ctx)
 -{
 -    if (ctx->base.singlestep_enabled) {
 -        gen_exception_debug();
 -    } else {
--        tcg_gen_exit_tb(NULL, 0);
+-        return part != 0;
 -    }
 -}
 -
--/* Wrapper around tcg_gen_lookup_and_goto_ptr that handles single stepping */
+ /* Loads a 32-bit immediate into rd, sign-extended.  */
--static void lookup_and_goto_ptr(DisasContext *ctx)
+ static void tcg_out_movi_i32(TCGContext *s, TCGReg rd, int32_t val)
--{
+ {
--    if (ctx->base.singlestep_enabled) {
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi_i32(TCGContext *s, TCGReg rd, int32_t val)
--        gen_exception_debug();
+     tcg_target_long hi12 = sextreg(val, 12, 20);
--    } else {
--        tcg_gen_lookup_and_goto_ptr();
+     /* Single-instruction cases.  */
 -    if (lo == val) {
 -        /* val fits in simm12: addi.w rd, zero, val */
 -        tcg_out_opc_addi_w(s, rd, TCG_REG_ZERO, val);
 -        return;
 -    }
--}
+-    if (0x800 <= val && val <= 0xfff) {
--
++    if (hi12 == 0) {
- static void gen_exception_illegal(DisasContext *ctx)
+         /* val fits in uimm12: ori rd, zero, val */
- {
+         tcg_out_opc_ori(s, rd, TCG_REG_ZERO, val);
-     generate_exception(ctx, RISCV_EXCP_ILLEGAL_INST);
+         return;
-@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
+     }
-         tcg_gen_exit_tb(ctx->base.tb, n);
++    if (hi12 == sextreg(lo, 12, 20)) {
-     } else {
++        /* val fits in simm12: addi.w rd, zero, val */
-         tcg_gen_movi_tl(cpu_pc, dest);
++        tcg_out_opc_addi_w(s, rd, TCG_REG_ZERO, val);
--        lookup_and_goto_ptr(ctx);
++        return;
-+        tcg_gen_lookup_and_goto_ptr();
++    }
      /* High bits must be set; load with lu12i.w + optional ori.  */
      tcg_out_opc_lu12i_w(s, rd, hi12);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi(TCGContext *s, TCGType type, TCGReg rd,
      intptr_t pc_offset;
      tcg_target_long val_lo, val_hi, pc_hi, offset_hi;
 -    tcg_target_long hi32, hi52;
 -    bool rd_high_bits_are_ones;
 +    tcg_target_long hi12, hi32, hi52;
      /* Value fits in signed i32.  */
      if (type == TCG_TYPE_I32 || val == (int32_t)val) {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi(TCGContext *s, TCGType type, TCGReg rd,
          return;
      }
 +    hi12 = sextreg(val, 12, 20);
      hi32 = sextreg(val, 32, 20);
      hi52 = sextreg(val, 52, 12);
      /* Single cu52i.d case.  */
 -    if (ctz64(val) >= 52) {
 +    if ((hi52 != 0) && (ctz64(val) >= 52)) {
          tcg_out_opc_cu52i_d(s, rd, TCG_REG_ZERO, hi52);
          return;
      }
      /* Slow path.  Initialize the low 32 bits, then concat high bits.  */
      tcg_out_movi_i32(s, rd, val);
 -    rd_high_bits_are_ones = (int32_t)val < 0;
 -    if (imm_part_needs_loading(rd_high_bits_are_ones, hi32)) {
 +    /* Load hi32 and hi52 explicitly when they are unexpected values. */
 +    if (hi32 != sextreg(hi12, 20, 20)) {
          tcg_out_opc_cu32i_d(s, rd, hi32);
 -        rd_high_bits_are_ones = hi32 < 0;
      }
 -    if (imm_part_needs_loading(rd_high_bits_are_ones, hi52)) {
 +    if (hi52 != sextreg(hi32, 20, 12)) {
          tcg_out_opc_cu52i_d(s, rd, rd, hi52);
      }
  }
-diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/insn_trans/trans_privileged.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_privileged.c.inc
-+++ b/target/riscv/insn_trans/trans_privileged.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool trans_sret(DisasContext *ctx, arg_sret *a)
-     if (has_ext(ctx, RVS)) {
-         gen_helper_sret(cpu_pc, cpu_env, cpu_pc);
--        exit_tb(ctx); /* no chaining */
-+        tcg_gen_exit_tb(NULL, 0); /* no chaining */
-         ctx->base.is_jmp = DISAS_NORETURN;
-     } else {
-         return false;
-@@ -XXX,XX +XXX,XX @@ static bool trans_mret(DisasContext *ctx, arg_mret *a)
- #ifndef CONFIG_USER_ONLY
-     tcg_gen_movi_tl(cpu_pc, ctx->base.pc_next);
-     gen_helper_mret(cpu_pc, cpu_env, cpu_pc);
--    exit_tb(ctx); /* no chaining */
-+    tcg_gen_exit_tb(NULL, 0); /* no chaining */
-     ctx->base.is_jmp = DISAS_NORETURN;
-     return true;
- #else
-diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/insn_trans/trans_rvi.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvi.c.inc
-+++ b/target/riscv/insn_trans/trans_rvi.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool trans_jalr(DisasContext *ctx, arg_jalr *a)
-     if (a->rd != 0) {
-         tcg_gen_movi_tl(cpu_gpr[a->rd], ctx->pc_succ_insn);
-     }
--
--    /* No chaining with JALR. */
--    lookup_and_goto_ptr(ctx);
-+    tcg_gen_lookup_and_goto_ptr();
-     if (misaligned) {
-         gen_set_label(misaligned);
-@@ -XXX,XX +XXX,XX @@ static bool trans_fence_i(DisasContext *ctx, arg_fence_i *a)
-      * however we need to end the translation block
-      */
-     tcg_gen_movi_tl(cpu_pc, ctx->pc_succ_insn);
--    exit_tb(ctx);
-+    tcg_gen_exit_tb(NULL, 0);
-     ctx->base.is_jmp = DISAS_NORETURN;
-     return true;
- }
-@@ -XXX,XX +XXX,XX @@ static bool do_csr_post(DisasContext *ctx)
- {
-     /* We may have changed important cpu state -- exit to main loop. */
-     tcg_gen_movi_tl(cpu_pc, ctx->pc_succ_insn);
--    exit_tb(ctx);
-+    tcg_gen_exit_tb(NULL, 0);
-     ctx->base.is_jmp = DISAS_NORETURN;
-     return true;
- }
-diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvv.c.inc
-+++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool trans_vsetvl(DisasContext *ctx, arg_vsetvl *a)
-     gen_set_gpr(ctx, a->rd, dst);
-     tcg_gen_movi_tl(cpu_pc, ctx->pc_succ_insn);
--    lookup_and_goto_ptr(ctx);
-+    tcg_gen_lookup_and_goto_ptr();
-     ctx->base.is_jmp = DISAS_NORETURN;
-     return true;
- }
 --
-.25.1
+.34.1

-[PULL 24/24] Revert "cpu: Move cpu_common_props to hw/core/cpu.c"
+[PULL v2 10/15] tcg/loongarch64: Update tcg-insn-defs.c.inc
-This reverts commit 1b36e4f5a5de585210ea95f2257839c2312be28f.
+Regenerate with ADDU16I included:
-Despite a comment saying why cpu_common_props cannot be placed in
+   $ cd loongarch-opcodes/scripts/go
-a file that is compiled once, it was moved anyway.  Revert that.
+   $ go run ./genqemutcgdefs > $QEMU/tcg/loongarch64/tcg-insn-defs.c.inc
-Since then, Property is not defined in hw/core/cpu.h, so it is now
+Reviewed-by: WANG Xuerui <git@xen0n.name>
-easier to declare a function to install the properties rather than
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 the Property array itself.
 Cc: Eduardo Habkost <ehabkost@redhat.com>
 Suggested-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h |  1 +
+ tcg/loongarch64/tcg-insn-defs.c.inc | 10 +++++++++-
- cpu.c                 | 21 +++++++++++++++++++++
+file changed, 9 insertions(+), 1 deletion(-)
  hw/core/cpu-common.c  | 17 +----------------
 files changed, 23 insertions(+), 16 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
+diff --git a/tcg/loongarch64/tcg-insn-defs.c.inc b/tcg/loongarch64/tcg-insn-defs.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
+--- a/tcg/loongarch64/tcg-insn-defs.c.inc
-+++ b/include/hw/core/cpu.h
++++ b/tcg/loongarch64/tcg-insn-defs.c.inc
-@@ -XXX,XX +XXX,XX @@ void QEMU_NORETURN cpu_abort(CPUState *cpu, const char *fmt, ...)
+@@ -XXX,XX +XXX,XX @@
-     GCC_FMT_ATTR(2, 3);
+  *
+  * This file is auto-generated by genqemutcgdefs from
- /* $(top_srcdir)/cpu.c */
+  * https://github.com/loongson-community/loongarch-opcodes,
-+void cpu_class_init_props(DeviceClass *dc);
+- * from commit 961f0c60f5b63e574d785995600c71ad5413fdc4.
- void cpu_exec_initfn(CPUState *cpu);
++ * from commit 25ca7effe9d88101c1cf96c4005423643386d81f.
- void cpu_exec_realizefn(CPUState *cpu, Error **errp);
+  * DO NOT EDIT.
- void cpu_exec_unrealizefn(CPUState *cpu);
+  */
-diff --git a/cpu.c b/cpu.c
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ typedef enum {
---- a/cpu.c
+     OPC_ANDI = 0x03400000,
-+++ b/cpu.c
+     OPC_ORI = 0x03800000,
-@@ -XXX,XX +XXX,XX @@ void cpu_exec_unrealizefn(CPUState *cpu)
+     OPC_XORI = 0x03c00000,
-     cpu_list_remove(cpu);
++    OPC_ADDU16I_D = 0x10000000,
      OPC_LU12I_W = 0x14000000,
      OPC_CU32I_D = 0x16000000,
      OPC_PCADDU2I = 0x18000000,
@@ -XXX,XX +XXX,XX @@ tcg_out_opc_xori(TCGContext *s, TCGReg d, TCGReg j, uint32_t uk12)
      tcg_out32(s, encode_djuk12_insn(OPC_XORI, d, j, uk12));
  }
-+static Property cpu_common_props[] = {
++/* Emits the `addu16i.d d, j, sk16` instruction.  */
-+#ifndef CONFIG_USER_ONLY
++static void __attribute__((unused))
-+    /*
++tcg_out_opc_addu16i_d(TCGContext *s, TCGReg d, TCGReg j, int32_t sk16)
 +     * Create a memory property for softmmu CPU object,
 +     * so users can wire up its memory. (This can't go in hw/core/cpu.c
 +     * because that file is compiled only once for both user-mode
 +     * and system builds.) The default if no link is set up is to use
 +     * the system address space.
 +     */
 +    DEFINE_PROP_LINK("memory", CPUState, memory, TYPE_MEMORY_REGION,
 +                     MemoryRegion *),
 +#endif
 +    DEFINE_PROP_BOOL("start-powered-off", CPUState, start_powered_off, false),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
 +void cpu_class_init_props(DeviceClass *dc)
 +{
-+    device_class_set_props(dc, cpu_common_props);
++    tcg_out32(s, encode_djsk16_insn(OPC_ADDU16I_D, d, j, sk16));
 +}
 +
- void cpu_exec_initfn(CPUState *cpu)
+ /* Emits the `lu12i.w d, sj20` instruction.  */
- {
+ static void __attribute__((unused))
-     cpu->as = NULL;
+ tcg_out_opc_lu12i_w(TCGContext *s, TCGReg d, int32_t sj20)
 diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/core/cpu-common.c
 +++ b/hw/core/cpu-common.c
@@ -XXX,XX +XXX,XX @@ static int64_t cpu_common_get_arch_id(CPUState *cpu)
      return cpu->cpu_index;
  }
 -static Property cpu_common_props[] = {
 -#ifndef CONFIG_USER_ONLY
 -    /* Create a memory property for softmmu CPU object,
 -     * so users can wire up its memory. (This can't go in hw/core/cpu.c
 -     * because that file is compiled only once for both user-mode
 -     * and system builds.) The default if no link is set up is to use
 -     * the system address space.
 -     */
 -    DEFINE_PROP_LINK("memory", CPUState, memory, TYPE_MEMORY_REGION,
 -                     MemoryRegion *),
 -#endif
 -    DEFINE_PROP_BOOL("start-powered-off", CPUState, start_powered_off, false),
 -    DEFINE_PROP_END_OF_LIST(),
 -};
 -
  static void cpu_class_init(ObjectClass *klass, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(klass);
@@ -XXX,XX +XXX,XX @@ static void cpu_class_init(ObjectClass *klass, void *data)
      dc->realize = cpu_common_realizefn;
      dc->unrealize = cpu_common_unrealizefn;
      dc->reset = cpu_common_reset;
 -    device_class_set_props(dc, cpu_common_props);
 +    cpu_class_init_props(dc);
      /*
       * Reason: CPUs still need special care by board code: wiring up
       * IRQs, adding reset handlers, halting non-first CPUs, ...
 --
-.25.1
+.34.1

-[PULL 10/24] target/m68k: Drop checks for singlestep_enabled
+[PULL v2 11/15] tcg/loongarch64: Introduce tcg_out_addi
-GDB single-stepping is now handled generically.
+Adjust the constraints to allow any int32_t for immediate
 addition.  Split immediate adds into addu16i + addi, which
 covers quite a lot of the immediate space.  For the hole in
 the middle, load the constant into TMP0 instead.
-Acked-by: Laurent Vivier <laurent@vivier.eu>
+Reviewed-by: WANG Xuerui <git@xen0n.name>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/m68k/translate.c | 44 +++++++++--------------------------------
+ tcg/loongarch64/tcg-target-con-set.h |  4 +-
-file changed, 9 insertions(+), 35 deletions(-)
+ tcg/loongarch64/tcg-target-con-str.h |  2 +-
  tcg/loongarch64/tcg-target.c.inc     | 57 ++++++++++++++++++++++++----
 files changed, 53 insertions(+), 10 deletions(-)
-diff --git a/target/m68k/translate.c b/target/m68k/translate.c
+diff --git a/tcg/loongarch64/tcg-target-con-set.h b/tcg/loongarch64/tcg-target-con-set.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/m68k/translate.c
+--- a/tcg/loongarch64/tcg-target-con-set.h
-+++ b/target/m68k/translate.c
++++ b/tcg/loongarch64/tcg-target-con-set.h
-@@ -XXX,XX +XXX,XX @@ static void do_writebacks(DisasContext *s)
+@@ -XXX,XX +XXX,XX @@ C_O1_I1(r, L)
  C_O1_I2(r, r, rC)
  C_O1_I2(r, r, ri)
  C_O1_I2(r, r, rI)
 +C_O1_I2(r, r, rJ)
  C_O1_I2(r, r, rU)
  C_O1_I2(r, r, rW)
  C_O1_I2(r, r, rZ)
  C_O1_I2(r, 0, rZ)
 -C_O1_I2(r, rZ, rN)
 +C_O1_I2(r, rZ, ri)
 +C_O1_I2(r, rZ, rJ)
  C_O1_I2(r, rZ, rZ)
 diff --git a/tcg/loongarch64/tcg-target-con-str.h b/tcg/loongarch64/tcg-target-con-str.h
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/loongarch64/tcg-target-con-str.h
 +++ b/tcg/loongarch64/tcg-target-con-str.h
@@ -XXX,XX +XXX,XX @@ REGS('L', ALL_GENERAL_REGS & ~SOFTMMU_RESERVE_REGS)
   * CONST(letter, TCG_CT_CONST_* bit set)
   */
  CONST('I', TCG_CT_CONST_S12)
 -CONST('N', TCG_CT_CONST_N12)
 +CONST('J', TCG_CT_CONST_S32)
  CONST('U', TCG_CT_CONST_U12)
  CONST('Z', TCG_CT_CONST_ZERO)
  CONST('C', TCG_CT_CONST_C12)
 diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/loongarch64/tcg-target.c.inc
 +++ b/tcg/loongarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const int tcg_target_call_oarg_regs[] = {
  #define TCG_CT_CONST_ZERO  0x100
  #define TCG_CT_CONST_S12   0x200
 -#define TCG_CT_CONST_N12   0x400
 +#define TCG_CT_CONST_S32   0x400
  #define TCG_CT_CONST_U12   0x800
  #define TCG_CT_CONST_C12   0x1000
  #define TCG_CT_CONST_WSZ   0x2000
@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
      if ((ct & TCG_CT_CONST_S12) && val == sextreg(val, 0, 12)) {
          return true;
      }
 -    if ((ct & TCG_CT_CONST_N12) && -val == sextreg(-val, 0, 12)) {
 +    if ((ct & TCG_CT_CONST_S32) && val == (int32_t)val) {
          return true;
      }
      if ((ct & TCG_CT_CONST_U12) && val >= 0 && val <= 0xfff) {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi(TCGContext *s, TCGType type, TCGReg rd,
      }
  }
--static bool is_singlestepping(DisasContext *s)
++static void tcg_out_addi(TCGContext *s, TCGType type, TCGReg rd,
--{
++                         TCGReg rs, tcg_target_long imm)
--    /*
++{
--     * Return true if we are singlestepping either because of
++    tcg_target_long lo12 = sextreg(imm, 0, 12);
--     * architectural singlestep or QEMU gdbstub singlestep. This does
++    tcg_target_long hi16 = sextreg(imm - lo12, 16, 16);
--     * not include the command line '-singlestep' mode which is rather
++
--     * misnamed as it only means "one instruction per TB" and doesn't
++    /*
--     * affect the code we generate.
++     * Note that there's a hole in between hi16 and lo12:
--     */
++     *
--    return s->base.singlestep_enabled || s->ss_active;
++     *       3                   2                   1                   0
--}
++     *     1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
--
++     * ...+-------------------------------+-------+-----------------------+
- /* is_jmp field values */
++     *    |             hi16              |       |          lo12         |
- #define DISAS_JUMP      DISAS_TARGET_0 /* only pc was modified dynamically */
++     * ...+-------------------------------+-------+-----------------------+
- #define DISAS_EXIT      DISAS_TARGET_1 /* cpu state was modified dynamically */
++     *
-@@ -XXX,XX +XXX,XX @@ static void gen_exception(DisasContext *s, uint32_t dest, int nr)
++     * For bits within that hole, it's more efficient to use LU12I and ADD.
-     s->base.is_jmp = DISAS_NORETURN;
++     */
- }
++    if (imm == (hi16 << 16) + lo12) {
++        if (hi16) {
--static void gen_singlestep_exception(DisasContext *s)
++            tcg_out_opc_addu16i_d(s, rd, rs, hi16);
--{
++            rs = rd;
--    /*
++        }
--     * Generate the right kind of exception for singlestep, which is
++        if (type == TCG_TYPE_I32) {
--     * either the architectural singlestep or EXCP_DEBUG for QEMU's
++            tcg_out_opc_addi_w(s, rd, rs, lo12);
--     * gdb singlestepping.
++        } else if (lo12) {
--     */
++            tcg_out_opc_addi_d(s, rd, rs, lo12);
--    if (s->ss_active) {
++        } else {
--        gen_raise_exception(EXCP_TRACE);
++            tcg_out_mov(s, type, rd, rs);
--    } else {
++        }
--        gen_raise_exception(EXCP_DEBUG);
++    } else {
--    }
++        tcg_out_movi(s, type, TCG_REG_TMP0, imm);
--}
++        if (type == TCG_TYPE_I32) {
--
++            tcg_out_opc_add_w(s, rd, rs, TCG_REG_TMP0);
- static inline void gen_addr_fault(DisasContext *s)
++        } else {
 +            tcg_out_opc_add_d(s, rd, rs, TCG_REG_TMP0);
 +        }
 +    }
 +}
 +
  static void tcg_out_ext8u(TCGContext *s, TCGReg ret, TCGReg arg)
  {
-     gen_exception(s, s->base.pc_next, EXCP_ADDRESS);
+     tcg_out_opc_andi(s, ret, arg, 0xff);
-@@ -XXX,XX +XXX,XX @@ static void gen_exit_tb(DisasContext *s)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
- /* Generate a jump to an immediate address.  */
- static void gen_jmp_tb(DisasContext *s, int n, uint32_t dest)
+     case INDEX_op_add_i32:
- {
+         if (c2) {
--    if (unlikely(is_singlestepping(s))) {
+-            tcg_out_opc_addi_w(s, a0, a1, a2);
-+    if (unlikely(s->ss_active)) {
++            tcg_out_addi(s, TCG_TYPE_I32, a0, a1, a2);
          update_cc_op(s);
          tcg_gen_movi_i32(QREG_PC, dest);
 -        gen_singlestep_exception(s);
 +        gen_raise_exception(EXCP_TRACE);
      } else if (translator_use_goto_tb(&s->base, dest)) {
          tcg_gen_goto_tb(n);
          tcg_gen_movi_i32(QREG_PC, dest);
@@ -XXX,XX +XXX,XX @@ static void m68k_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cpu)
      dc->ss_active = (M68K_SR_TRACE(env->sr) == M68K_SR_TRACE_ANY_INS);
      /* If architectural single step active, limit to 1 */
 -    if (is_singlestepping(dc)) {
 +    if (dc->ss_active) {
          dc->base.max_insns = 1;
      }
  }
@@ -XXX,XX +XXX,XX @@ static void m68k_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
          break;
      case DISAS_TOO_MANY:
          update_cc_op(dc);
 -        if (is_singlestepping(dc)) {
 +        if (dc->ss_active) {
              tcg_gen_movi_i32(QREG_PC, dc->pc);
 -            gen_singlestep_exception(dc);
 +            gen_raise_exception(EXCP_TRACE);
          } else {
-             gen_jmp_tb(dc, 0, dc->pc);
+             tcg_out_opc_add_w(s, a0, a1, a2);
          }
          break;
-     case DISAS_JUMP:
+     case INDEX_op_add_i64:
-         /* We updated CC_OP and PC in gen_jmp/gen_jmp_im.  */
+         if (c2) {
--        if (is_singlestepping(dc)) {
+-            tcg_out_opc_addi_d(s, a0, a1, a2);
--            gen_singlestep_exception(dc);
++            tcg_out_addi(s, TCG_TYPE_I64, a0, a1, a2);
 +        if (dc->ss_active) {
 +            gen_raise_exception(EXCP_TRACE);
          } else {
-             tcg_gen_lookup_and_goto_ptr();
+             tcg_out_opc_add_d(s, a0, a1, a2);
          }
-@@ -XXX,XX +XXX,XX @@ static void m68k_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
-          * We updated CC_OP and PC in gen_exit_tb, but also modified
-          * other state that may require returning to the main loop.
+     case INDEX_op_sub_i32:
-          */
+         if (c2) {
--        if (is_singlestepping(dc)) {
+-            tcg_out_opc_addi_w(s, a0, a1, -a2);
--            gen_singlestep_exception(dc);
++            tcg_out_addi(s, TCG_TYPE_I32, a0, a1, -a2);
 +        if (dc->ss_active) {
 +            gen_raise_exception(EXCP_TRACE);
          } else {
-             tcg_gen_exit_tb(NULL, 0);
+             tcg_out_opc_sub_w(s, a0, a1, a2);
          }
+         break;
+     case INDEX_op_sub_i64:
+         if (c2) {
+-            tcg_out_opc_addi_d(s, a0, a1, -a2);
++            tcg_out_addi(s, TCG_TYPE_I64, a0, a1, -a2);
+         } else {
+             tcg_out_opc_sub_d(s, a0, a1, a2);
+         }
+@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
+         return C_O1_I2(r, r, ri);
+     case INDEX_op_add_i32:
++        return C_O1_I2(r, r, ri);
+     case INDEX_op_add_i64:
+-        return C_O1_I2(r, r, rI);
++        return C_O1_I2(r, r, rJ);
+     case INDEX_op_and_i32:
+     case INDEX_op_and_i64:
+@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
+         return C_O1_I2(r, 0, rZ);
+     case INDEX_op_sub_i32:
++        return C_O1_I2(r, rZ, ri);
+     case INDEX_op_sub_i64:
+-        return C_O1_I2(r, rZ, rN);
++        return C_O1_I2(r, rZ, rJ);
+     case INDEX_op_mul_i32:
+     case INDEX_op_mul_i64:
 --
-.25.1
+.34.1

-[PULL 17/24] target/riscv: Remove dead code after exception
+[PULL v2 12/15] tcg/loongarch64: Improve setcond expansion
-We have already set DISAS_NORETURN in generate_exception,
+Split out a helper function, tcg_out_setcond_int, which
-which makes the exit_tb unreachable.
+does not always produce the complete boolean result, but
 returns a set of flags to do so.
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Accept all int32_t as constant input, so that LE/GT can
 adjust the constant to LT.
 Reviewed-by: WANG Xuerui <git@xen0n.name>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/riscv/insn_trans/trans_privileged.c.inc | 6 +-----
+ tcg/loongarch64/tcg-target.c.inc | 165 +++++++++++++++++++++----------
-file changed, 1 insertion(+), 5 deletions(-)
+file changed, 115 insertions(+), 50 deletions(-)
-diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/insn_trans/trans_privileged.c.inc
+diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_privileged.c.inc
+--- a/tcg/loongarch64/tcg-target.c.inc
-+++ b/target/riscv/insn_trans/trans_privileged.c.inc
++++ b/tcg/loongarch64/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool trans_ecall(DisasContext *ctx, arg_ecall *a)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_clzctz(TCGContext *s, LoongArchInsn opc,
- {
+     tcg_out_opc_or(s, a0, TCG_REG_TMP0, a0);
      /* always generates U-level ECALL, fixed in do_interrupt handler */
      generate_exception(ctx, RISCV_EXCP_U_ECALL);
 -    exit_tb(ctx); /* no chaining */
 -    ctx->base.is_jmp = DISAS_NORETURN;
      return true;
  }
-@@ -XXX,XX +XXX,XX @@ static bool trans_ebreak(DisasContext *ctx, arg_ebreak *a)
+-static void tcg_out_setcond(TCGContext *s, TCGCond cond, TCGReg ret,
-         post   = opcode_at(&ctx->base, post_addr);
+-                            TCGReg arg1, TCGReg arg2, bool c2)
 -{
 -    TCGReg tmp;
 +#define SETCOND_INV    TCG_TARGET_NB_REGS
 +#define SETCOND_NEZ    (SETCOND_INV << 1)
 +#define SETCOND_FLAGS  (SETCOND_INV | SETCOND_NEZ)
 -    if (c2) {
 -        tcg_debug_assert(arg2 == 0);
 +static int tcg_out_setcond_int(TCGContext *s, TCGCond cond, TCGReg ret,
 +                               TCGReg arg1, tcg_target_long arg2, bool c2)
 +{
 +    int flags = 0;
 +
 +    switch (cond) {
 +    case TCG_COND_EQ:    /* -> NE  */
 +    case TCG_COND_GE:    /* -> LT  */
 +    case TCG_COND_GEU:   /* -> LTU */
 +    case TCG_COND_GT:    /* -> LE  */
 +    case TCG_COND_GTU:   /* -> LEU */
 +        cond = tcg_invert_cond(cond);
 +        flags ^= SETCOND_INV;
 +        break;
 +    default:
 +        break;
      }
--    if  (pre == 0x01f01013 && ebreak == 0x00100073 && post == 0x40705013) {
+     switch (cond) {
-+    if (pre == 0x01f01013 && ebreak == 0x00100073 && post == 0x40705013) {
+-    case TCG_COND_EQ:
-         generate_exception(ctx, RISCV_EXCP_SEMIHOST);
+-        if (c2) {
-     } else {
+-            tmp = arg1;
-         generate_exception(ctx, RISCV_EXCP_BREAKPOINT);
+-        } else {
 -            tcg_out_opc_sub_d(s, ret, arg1, arg2);
 -            tmp = ret;
 -        }
 -        tcg_out_opc_sltui(s, ret, tmp, 1);
 -        break;
 -    case TCG_COND_NE:
 -        if (c2) {
 -            tmp = arg1;
 -        } else {
 -            tcg_out_opc_sub_d(s, ret, arg1, arg2);
 -            tmp = ret;
 -        }
 -        tcg_out_opc_sltu(s, ret, TCG_REG_ZERO, tmp);
 -        break;
 -    case TCG_COND_LT:
 -        tcg_out_opc_slt(s, ret, arg1, arg2);
 -        break;
 -    case TCG_COND_GE:
 -        tcg_out_opc_slt(s, ret, arg1, arg2);
 -        tcg_out_opc_xori(s, ret, ret, 1);
 -        break;
      case TCG_COND_LE:
 -        tcg_out_setcond(s, TCG_COND_GE, ret, arg2, arg1, false);
 -        break;
 -    case TCG_COND_GT:
 -        tcg_out_setcond(s, TCG_COND_LT, ret, arg2, arg1, false);
 -        break;
 -    case TCG_COND_LTU:
 -        tcg_out_opc_sltu(s, ret, arg1, arg2);
 -        break;
 -    case TCG_COND_GEU:
 -        tcg_out_opc_sltu(s, ret, arg1, arg2);
 -        tcg_out_opc_xori(s, ret, ret, 1);
 -        break;
      case TCG_COND_LEU:
 -        tcg_out_setcond(s, TCG_COND_GEU, ret, arg2, arg1, false);
 +        /*
 +         * If we have a constant input, the most efficient way to implement
 +         * LE is by adding 1 and using LT.  Watch out for wrap around for LEU.
 +         * We don't need to care for this for LE because the constant input
 +         * is still constrained to int32_t, and INT32_MAX+1 is representable
 +         * in the 64-bit temporary register.
 +         */
 +        if (c2) {
 +            if (cond == TCG_COND_LEU) {
 +                /* unsigned <= -1 is true */
 +                if (arg2 == -1) {
 +                    tcg_out_movi(s, TCG_TYPE_REG, ret, !(flags & SETCOND_INV));
 +                    return ret;
 +                }
 +                cond = TCG_COND_LTU;
 +            } else {
 +                cond = TCG_COND_LT;
 +            }
 +            arg2 += 1;
 +        } else {
 +            TCGReg tmp = arg2;
 +            arg2 = arg1;
 +            arg1 = tmp;
 +            cond = tcg_swap_cond(cond);    /* LE -> GE */
 +            cond = tcg_invert_cond(cond);  /* GE -> LT */
 +            flags ^= SETCOND_INV;
 +        }
          break;
 -    case TCG_COND_GTU:
 -        tcg_out_setcond(s, TCG_COND_LTU, ret, arg2, arg1, false);
 +    default:
          break;
 +    }
 +
 +    switch (cond) {
 +    case TCG_COND_NE:
 +        flags |= SETCOND_NEZ;
 +        if (!c2) {
 +            tcg_out_opc_xor(s, ret, arg1, arg2);
 +        } else if (arg2 == 0) {
 +            ret = arg1;
 +        } else if (arg2 >= 0 && arg2 <= 0xfff) {
 +            tcg_out_opc_xori(s, ret, arg1, arg2);
 +        } else {
 +            tcg_out_addi(s, TCG_TYPE_REG, ret, arg1, -arg2);
 +        }
 +        break;
 +
 +    case TCG_COND_LT:
 +    case TCG_COND_LTU:
 +        if (c2) {
 +            if (arg2 >= -0x800 && arg2 <= 0x7ff) {
 +                if (cond == TCG_COND_LT) {
 +                    tcg_out_opc_slti(s, ret, arg1, arg2);
 +                } else {
 +                    tcg_out_opc_sltui(s, ret, arg1, arg2);
 +                }
 +                break;
 +            }
 +            tcg_out_movi(s, TCG_TYPE_REG, TCG_REG_TMP0, arg2);
 +            arg2 = TCG_REG_TMP0;
 +        }
 +        if (cond == TCG_COND_LT) {
 +            tcg_out_opc_slt(s, ret, arg1, arg2);
 +        } else {
 +            tcg_out_opc_sltu(s, ret, arg1, arg2);
 +        }
 +        break;
 +
      default:
          g_assert_not_reached();
          break;
      }
--    exit_tb(ctx); /* no chaining */
++
--    ctx->base.is_jmp = DISAS_NORETURN;
++    return ret | flags;
-     return true;
++}
 +
 +static void tcg_out_setcond(TCGContext *s, TCGCond cond, TCGReg ret,
 +                            TCGReg arg1, tcg_target_long arg2, bool c2)
 +{
 +    int tmpflags = tcg_out_setcond_int(s, cond, ret, arg1, arg2, c2);
 +
 +    if (tmpflags != ret) {
 +        TCGReg tmp = tmpflags & ~SETCOND_FLAGS;
 +
 +        switch (tmpflags & SETCOND_FLAGS) {
 +        case SETCOND_INV:
 +            /* Intermediate result is boolean: simply invert. */
 +            tcg_out_opc_xori(s, ret, tmp, 1);
 +            break;
 +        case SETCOND_NEZ:
 +            /* Intermediate result is zero/non-zero: test != 0. */
 +            tcg_out_opc_sltu(s, ret, TCG_REG_ZERO, tmp);
 +            break;
 +        case SETCOND_NEZ | SETCOND_INV:
 +            /* Intermediate result is zero/non-zero: test == 0. */
 +            tcg_out_opc_sltui(s, ret, tmp, 1);
 +            break;
 +        default:
 +            g_assert_not_reached();
 +        }
 +    }
  }
+ /*
+@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
+     case INDEX_op_ctz_i64:
+         return C_O1_I2(r, r, rW);
+-    case INDEX_op_setcond_i32:
+-    case INDEX_op_setcond_i64:
+-        return C_O1_I2(r, r, rZ);
+-
+     case INDEX_op_deposit_i32:
+     case INDEX_op_deposit_i64:
+         /* Must deposit into the same register as input */
+         return C_O1_I2(r, 0, rZ);
+     case INDEX_op_sub_i32:
++    case INDEX_op_setcond_i32:
+         return C_O1_I2(r, rZ, ri);
+     case INDEX_op_sub_i64:
++    case INDEX_op_setcond_i64:
+         return C_O1_I2(r, rZ, rJ);
+     case INDEX_op_mul_i32:
 --
-.25.1
+.34.1

-[PULL 07/24] target/hppa: Drop checks for singlestep_enabled
+[PULL v2 13/15] tcg/loongarch64: Implement movcond
-GDB single-stepping is now handled generically.
+Reviewed-by: WANG Xuerui <git@xen0n.name>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/hppa/translate.c | 17 ++++-------------
+ tcg/loongarch64/tcg-target-con-set.h |  1 +
-file changed, 4 insertions(+), 13 deletions(-)
+ tcg/loongarch64/tcg-target.h         |  4 ++--
  tcg/loongarch64/tcg-target.c.inc     | 33 ++++++++++++++++++++++++++++
 files changed, 36 insertions(+), 2 deletions(-)
-diff --git a/target/hppa/translate.c b/target/hppa/translate.c
+diff --git a/tcg/loongarch64/tcg-target-con-set.h b/tcg/loongarch64/tcg-target-con-set.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/hppa/translate.c
+--- a/tcg/loongarch64/tcg-target-con-set.h
-+++ b/target/hppa/translate.c
++++ b/tcg/loongarch64/tcg-target-con-set.h
-@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *ctx, int which,
+@@ -XXX,XX +XXX,XX @@ C_O1_I2(r, 0, rZ)
-     } else {
+ C_O1_I2(r, rZ, ri)
-         copy_iaoq_entry(cpu_iaoq_f, f, cpu_iaoq_b);
+ C_O1_I2(r, rZ, rJ)
-         copy_iaoq_entry(cpu_iaoq_b, b, ctx->iaoq_n_var);
+ C_O1_I2(r, rZ, rZ)
--        if (ctx->base.singlestep_enabled) {
++C_O1_I4(r, rZ, rJ, rZ, rZ)
--            gen_excp_1(EXCP_DEBUG);
+diff --git a/tcg/loongarch64/tcg-target.h b/tcg/loongarch64/tcg-target.h
--        } else {
+index XXXXXXX..XXXXXXX 100644
--            tcg_gen_lookup_and_goto_ptr();
+--- a/tcg/loongarch64/tcg-target.h
--        }
++++ b/tcg/loongarch64/tcg-target.h
-+        tcg_gen_lookup_and_goto_ptr();
+@@ -XXX,XX +XXX,XX @@ typedef enum {
  #define TCG_TARGET_CALL_ARG_I64         TCG_CALL_ARG_NORMAL
  /* optional instructions */
 -#define TCG_TARGET_HAS_movcond_i32      0
 +#define TCG_TARGET_HAS_movcond_i32      1
  #define TCG_TARGET_HAS_div_i32          1
  #define TCG_TARGET_HAS_rem_i32          1
  #define TCG_TARGET_HAS_div2_i32         0
@@ -XXX,XX +XXX,XX @@ typedef enum {
  #define TCG_TARGET_HAS_qemu_st8_i32     0
  /* 64-bit operations */
 -#define TCG_TARGET_HAS_movcond_i64      0
 +#define TCG_TARGET_HAS_movcond_i64      1
  #define TCG_TARGET_HAS_div_i64          1
  #define TCG_TARGET_HAS_rem_i64          1
  #define TCG_TARGET_HAS_div2_i64         0
 diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/loongarch64/tcg-target.c.inc
 +++ b/tcg/loongarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_setcond(TCGContext *s, TCGCond cond, TCGReg ret,
      }
  }
-@@ -XXX,XX +XXX,XX @@ static bool do_rfi(DisasContext *ctx, bool rfi_r)
++static void tcg_out_movcond(TCGContext *s, TCGCond cond, TCGReg ret,
-         gen_helper_rfi(cpu_env);
++                            TCGReg c1, tcg_target_long c2, bool const2,
 +                            TCGReg v1, TCGReg v2)
 +{
 +    int tmpflags = tcg_out_setcond_int(s, cond, TCG_REG_TMP0, c1, c2, const2);
 +    TCGReg t;
 +
 +    /* Standardize the test below to t != 0. */
 +    if (tmpflags & SETCOND_INV) {
 +        t = v1, v1 = v2, v2 = t;
 +    }
 +
 +    t = tmpflags & ~SETCOND_FLAGS;
 +    if (v1 == TCG_REG_ZERO) {
 +        tcg_out_opc_masknez(s, ret, v2, t);
 +    } else if (v2 == TCG_REG_ZERO) {
 +        tcg_out_opc_maskeqz(s, ret, v1, t);
 +    } else {
 +        tcg_out_opc_masknez(s, TCG_REG_TMP2, v2, t); /* t ? 0 : v2 */
 +        tcg_out_opc_maskeqz(s, TCG_REG_TMP1, v1, t); /* t ? v1 : 0 */
 +        tcg_out_opc_or(s, ret, TCG_REG_TMP1, TCG_REG_TMP2);
 +    }
 +}
 +
  /*
   * Branch helpers
   */
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          tcg_out_setcond(s, args[3], a0, a1, a2, c2);
          break;
 +    case INDEX_op_movcond_i32:
 +    case INDEX_op_movcond_i64:
 +        tcg_out_movcond(s, args[5], a0, a1, a2, c2, args[3], args[4]);
 +        break;
 +
      case INDEX_op_ld8s_i32:
      case INDEX_op_ld8s_i64:
          tcg_out_ldst(s, OPC_LD_B, a0, a1, a2);
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
      case INDEX_op_remu_i64:
          return C_O1_I2(r, rZ, rZ);
 +    case INDEX_op_movcond_i32:
 +    case INDEX_op_movcond_i64:
 +        return C_O1_I4(r, rZ, rJ, rZ, rZ);
 +
      default:
          g_assert_not_reached();
      }
-     /* Exit the TB to recognize new interrupts.  */
--    if (ctx->base.singlestep_enabled) {
--        gen_excp_1(EXCP_DEBUG);
--    } else {
--        tcg_gen_exit_tb(NULL, 0);
--    }
-+    tcg_gen_exit_tb(NULL, 0);
-     ctx->base.is_jmp = DISAS_NORETURN;
-     return nullify_end(ctx);
-@@ -XXX,XX +XXX,XX @@ static void hppa_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
-         nullify_save(ctx);
-         /* FALLTHRU */
-     case DISAS_IAQ_N_UPDATED:
--        if (ctx->base.singlestep_enabled) {
--            gen_excp_1(EXCP_DEBUG);
--        } else if (is_jmp != DISAS_IAQ_N_STALE_EXIT) {
-+        if (is_jmp != DISAS_IAQ_N_STALE_EXIT) {
-             tcg_gen_lookup_and_goto_ptr();
-+            break;
-         }
-         /* FALLTHRU */
-     case DISAS_EXIT:
 --
-.25.1
+.34.1

-[PULL 13/24] target/mips: Fix single stepping
+[PULL v2 14/15] tcg/loongarch64: Use tcg_pcrel_diff in tcg_out_ldst
-As per an ancient comment in mips_tr_translate_insn about the
+Take the w^x split into account when computing the
-expectations of gdb, when restarting the insn in a delay slot
+pc-relative distance to an absolute pointer.
 we also re-execute the branch.  Which means that we are
 expected to execute two insns in this case.
-This has been broken since 8b86d6d2580, where we forced max_insns
+Reviewed-by: WANG Xuerui <git@xen0n.name>
-to 1 while single-stepping.  This resulted in an exit from the
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 translator loop after the branch but before the delay slot is
 translated.
 Increase the max_insns to 2 for this case.  In addition, bypass
 the end-of-page check, for when the branch itself ends the page.
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/mips/tcg/translate.c | 25 ++++++++++++++++---------
+ tcg/loongarch64/tcg-target.c.inc | 2 +-
-file changed, 16 insertions(+), 9 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
+diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/mips/tcg/translate.c
+--- a/tcg/loongarch64/tcg-target.c.inc
-+++ b/target/mips/tcg/translate.c
++++ b/tcg/loongarch64/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static void mips_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_ldst(TCGContext *s, LoongArchInsn opc, TCGReg data,
-     ctx->default_tcg_memop_mask = (ctx->insn_flags & (ISA_MIPS_R6 |
+     intptr_t imm12 = sextreg(offset, 0, 12);
-                                   INSN_LOONGSON3A)) ? MO_UNALN : MO_ALIGN;
+     if (offset != imm12) {
-+    /*
+-        intptr_t diff = offset - (uintptr_t)s->code_ptr;
-+     * Execute a branch and its delay slot as a single instruction.
++        intptr_t diff = tcg_pcrel_diff(s, (void *)offset);
-+     * This is what GDB expects and is consistent with what the
-+     * hardware does (e.g. if a delay slot instruction faults, the
+         if (addr == TCG_REG_ZERO && diff == (int32_t)diff) {
-+     * reported PC is the PC of the branch).
+             imm12 = sextreg(diff, 0, 12);
 +     */
 +    if (ctx->base.singlestep_enabled && (ctx->hflags & MIPS_HFLAG_BMASK)) {
 +        ctx->base.max_insns = 2;
 +    }
 +
      LOG_DISAS("\ntb %p idx %d hflags %04x\n", ctx->base.tb, ctx->mem_idx,
                ctx->hflags);
  }
@@ -XXX,XX +XXX,XX @@ static void mips_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
      if (ctx->base.is_jmp != DISAS_NEXT) {
          return;
      }
 +
      /*
 -     * Execute a branch and its delay slot as a single instruction.
 -     * This is what GDB expects and is consistent with what the
 -     * hardware does (e.g. if a delay slot instruction faults, the
 -     * reported PC is the PC of the branch).
 +     * End the TB on (most) page crossings.
 +     * See mips_tr_init_disas_context about single-stepping a branch
 +     * together with its delay slot.
       */
 -    if (ctx->base.singlestep_enabled &&
 -        (ctx->hflags & MIPS_HFLAG_BMASK) == 0) {
 -        ctx->base.is_jmp = DISAS_TOO_MANY;
 -    }
 -    if (ctx->base.pc_next - ctx->page_start >= TARGET_PAGE_SIZE) {
 +    if (ctx->base.pc_next - ctx->page_start >= TARGET_PAGE_SIZE
 +        && !ctx->base.singlestep_enabled) {
          ctx->base.is_jmp = DISAS_TOO_MANY;
      }
  }
 --
-.25.1
+.34.1

-[PULL 06/24] target/arm: Drop checks for singlestep_enabled
+[PULL v2 15/15] tcg/loongarch64: Reorg goto_tb implementation
-GDB single-stepping is now handled generically.
+The old implementation replaces two insns, swapping between
+        b       <dest>
+        nop
+and
+        pcaddu18i tmp, <dest>
+        jirl      zero, tmp, <dest> & 0xffff
+There is a race condition in which a thread could be stopped at
+the jirl, i.e. with the top of the address loaded, and when
+restarted we have re-linked to a different TB, so that the top
+half no longer matches the bottom half.
+Note that while we never directly re-link to a different TB, we
+can link, unlink, and link again all while the stopped thread
+remains stopped.
+The new implementation replaces only one insn, swapping between
+        b       <dest>
+and
+        pcadd   tmp, <jmp_addr>
+falling through to load the address from tmp, and branch.
+Reviewed-by: WANG Xuerui <git@xen0n.name>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/arm/translate-a64.c | 10 ++--------
+ tcg/loongarch64/tcg-target.h     |  7 +---
- target/arm/translate.c     | 36 ++++++------------------------------
+ tcg/loongarch64/tcg-target.c.inc | 72 ++++++++++++++------------------
-files changed, 8 insertions(+), 38 deletions(-)
+files changed, 33 insertions(+), 46 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/tcg/loongarch64/tcg-target.h b/tcg/loongarch64/tcg-target.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/tcg/loongarch64/tcg-target.h
-+++ b/target/arm/translate-a64.c
++++ b/tcg/loongarch64/tcg-target.h
-@@ -XXX,XX +XXX,XX @@ static inline void gen_goto_tb(DisasContext *s, int n, uint64_t dest)
+@@ -XXX,XX +XXX,XX @@
-         gen_a64_set_pc_im(dest);
-         if (s->ss_active) {
+ #define TCG_TARGET_INSN_UNIT_SIZE 4
-             gen_step_complete_exception(s);
+ #define TCG_TARGET_NB_REGS 32
--        } else if (s->base.singlestep_enabled) {
+-/*
--            gen_exception_internal(EXCP_DEBUG);
+- * PCADDU18I + JIRL sequence can give 20 + 16 + 2 = 38 bits
-         } else {
+- * signed offset, which is +/- 128 GiB.
-             tcg_gen_lookup_and_goto_ptr();
+- */
-             s->base.is_jmp = DISAS_NORETURN;
+-#define MAX_CODE_GEN_BUFFER_SIZE  (128 * GiB)
-@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
++
- {
++#define MAX_CODE_GEN_BUFFER_SIZE  ((size_t)-1)
-     DisasContext *dc = container_of(dcbase, DisasContext, base);
+ typedef enum {
--    if (unlikely(dc->base.singlestep_enabled || dc->ss_active)) {
+     TCG_REG_ZERO,
-+    if (unlikely(dc->ss_active)) {
+diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
          /* Note that this means single stepping WFI doesn't halt the CPU.
           * For conditional branch insns this is harmless unreachable code as
           * gen_goto_tb() has already handled emitting the debug exception
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
              /* fall through */
          case DISAS_EXIT:
          case DISAS_JUMP:
 -            if (dc->base.singlestep_enabled) {
 -                gen_exception_internal(EXCP_DEBUG);
 -            } else {
 -                gen_step_complete_exception(dc);
 -            }
 +            gen_step_complete_exception(dc);
              break;
          case DISAS_NORETURN:
              break;
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
+--- a/tcg/loongarch64/tcg-target.c.inc
-+++ b/target/arm/translate.c
++++ b/tcg/loongarch64/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal(int excp)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args)
-     tcg_temp_free_i32(tcg_excp);
+ #endif
  }
--static void gen_step_complete_exception(DisasContext *s)
+-/* LoongArch uses `andi zero, zero, 0` as NOP.  */
-+static void gen_singlestep_exception(DisasContext *s)
+-#define NOP OPC_ANDI
- {
+-static void tcg_out_nop(TCGContext *s)
      /* We just completed step of an insn. Move from Active-not-pending
       * to Active-pending, and then also take the swstep exception.
@@ -XXX,XX +XXX,XX @@ static void gen_step_complete_exception(DisasContext *s)
      s->base.is_jmp = DISAS_NORETURN;
  }
 -static void gen_singlestep_exception(DisasContext *s)
 -{
--    /* Generate the right kind of exception for singlestep, which is
+-    tcg_out32(s, NOP);
 -     * either the architectural singlestep or EXCP_DEBUG for QEMU's
 -     * gdb singlestepping.
 -     */
 -    if (s->ss_active) {
 -        gen_step_complete_exception(s);
 -    } else {
 -        gen_exception_internal(EXCP_DEBUG);
 -    }
 -}
 -
--static inline bool is_singlestepping(DisasContext *s)
+-void tb_target_set_jmp_target(const TranslationBlock *tb, int n,
 -                              uintptr_t jmp_rx, uintptr_t jmp_rw)
 -{
--    /* Return true if we are singlestepping either because of
+-    tcg_insn_unit i1, i2;
--     * architectural singlestep or QEMU gdbstub singlestep. This does
+-    ptrdiff_t upper, lower;
--     * not include the command line '-singlestep' mode which is rather
+-    uintptr_t addr = tb->jmp_target_addr[n];
--     * misnamed as it only means "one instruction per TB" and doesn't
+-    ptrdiff_t offset = (ptrdiff_t)(addr - jmp_rx) >> 2;
--     * affect the code we generate.
+-
--     */
+-    if (offset == sextreg(offset, 0, 26)) {
--    return s->base.singlestep_enabled || s->ss_active;
+-        i1 = encode_sd10k16_insn(OPC_B, offset);
 -        i2 = NOP;
 -    } else {
 -        tcg_debug_assert(offset == sextreg(offset, 0, 36));
 -        lower = (int16_t)offset;
 -        upper = (offset - lower) >> 16;
 -
 -        i1 = encode_dsj20_insn(OPC_PCADDU18I, TCG_REG_TMP0, upper);
 -        i2 = encode_djsk16_insn(OPC_JIRL, TCG_REG_ZERO, TCG_REG_TMP0, lower);
 -    }
 -    uint64_t pair = ((uint64_t)i2 << 32) | i1;
 -    qatomic_set((uint64_t *)jmp_rw, pair);
 -    flush_idcache_range(jmp_rx, jmp_rw, 8);
 -}
 -
- void clear_eci_state(DisasContext *s)
+ /*
   * Entry-points
   */
@@ -XXX,XX +XXX,XX @@ static void tcg_out_exit_tb(TCGContext *s, uintptr_t a0)
  static void tcg_out_goto_tb(TCGContext *s, int which)
  {
      /*
-@@ -XXX,XX +XXX,XX @@ static inline void gen_bx_excret_final_code(DisasContext *s)
+-     * Ensure that patch area is 8-byte aligned so that an
-     /* Is the new PC value in the magic range indicating exception return? */
+-     * atomic write can be used to patch the target address.
-     tcg_gen_brcondi_i32(TCG_COND_GEU, cpu_R[15], min_magic, excret_label);
++     * Direct branch, or load indirect address, to be patched
-     /* No: end the TB as we would for a DISAS_JMP */
++     * by tb_target_set_jmp_target.  Check indirect load offset
--    if (is_singlestepping(s)) {
++     * in range early, regardless of direct branch distance,
-+    if (s->ss_active) {
++     * via assert within tcg_out_opc_pcaddu2i.
-         gen_singlestep_exception(s);
+      */
-     } else {
+-    if ((uintptr_t)s->code_ptr & 7) {
-         tcg_gen_exit_tb(NULL, 0);
+-        tcg_out_nop(s);
-@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *s, int n, target_ulong dest)
+-    }
- /* Jump, specifying which TB number to use if we gen_goto_tb() */
++    uintptr_t i_addr = get_jmp_target_addr(s, which);
- static inline void gen_jmp_tb(DisasContext *s, uint32_t dest, int tbno)
++    intptr_t i_disp = tcg_pcrel_diff(s, (void *)i_addr);
- {
++
--    if (unlikely(is_singlestepping(s))) {
+     set_jmp_insn_offset(s, which);
-+    if (unlikely(s->ss_active)) {
+-    /*
-         /* An indirect jump so that we still trigger the debug exception.  */
+-     * actual branch destination will be patched by
-         gen_set_pc_im(s, dest);
+-     * tb_target_set_jmp_target later
-         s->base.is_jmp = DISAS_JUMP;
+-     */
-@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
+-    tcg_out_opc_pcaddu18i(s, TCG_REG_TMP0, 0);
-     dc->page_start = dc->base.pc_first & TARGET_PAGE_MASK;
++    tcg_out_opc_pcaddu2i(s, TCG_REG_TMP0, i_disp >> 2);
++
-     /* If architectural single step active, limit to 1.  */
++    /* Finish the load and indirect branch. */
--    if (is_singlestepping(dc)) {
++    tcg_out_ld(s, TCG_TYPE_PTR, TCG_REG_TMP0, TCG_REG_TMP0, 0);
-+    if (dc->ss_active) {
+     tcg_out_opc_jirl(s, TCG_REG_ZERO, TCG_REG_TMP0, 0);
-         dc->base.max_insns = 1;
+     set_jmp_reset_offset(s, which);
-     }
+ }
-@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
++void tb_target_set_jmp_target(const TranslationBlock *tb, int n,
-          * insn codepath itself.
++                              uintptr_t jmp_rx, uintptr_t jmp_rw)
-          */
++{
-         gen_bx_excret_final_code(dc);
++    uintptr_t d_addr = tb->jmp_target_addr[n];
--    } else if (unlikely(is_singlestepping(dc))) {
++    ptrdiff_t d_disp = (ptrdiff_t)(d_addr - jmp_rx) >> 2;
-+    } else if (unlikely(dc->ss_active)) {
++    tcg_insn_unit insn;
-         /* Unconditional and "condition passed" instruction codepath. */
++
-         switch (dc->base.is_jmp) {
++    /* Either directly branch, or load slot address for indirect branch. */
-         case DISAS_SWI:
++    if (d_disp == sextreg(d_disp, 0, 26)) {
-@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
++        insn = encode_sd10k16_insn(OPC_B, d_disp);
-         /* "Condition failed" instruction codepath for the branch/trap insn */
++    } else {
-         gen_set_label(dc->condlabel);
++        uintptr_t i_addr = (uintptr_t)&tb->jmp_target_addr[n];
-         gen_set_condexec(dc);
++        intptr_t i_disp = i_addr - jmp_rx;
--        if (unlikely(is_singlestepping(dc))) {
++        insn = encode_dsj20_insn(OPC_PCADDU2I, TCG_REG_TMP0, i_disp >> 2);
-+        if (unlikely(dc->ss_active)) {
++    }
-             gen_set_pc_im(dc, dc->base.pc_next);
++
-             gen_singlestep_exception(dc);
++    qatomic_set((tcg_insn_unit *)jmp_rw, insn);
-         } else {
++    flush_idcache_range(jmp_rx, jmp_rw, 4);
 +}
 +
  static void tcg_out_op(TCGContext *s, TCGOpcode opc,
                         const TCGArg args[TCG_MAX_OP_ARGS],
                         const int const_args[TCG_MAX_OP_ARGS])
 --
-.25.1
+.34.1

-[PULL 08/24] target/i386: Check CF_NO_GOTO_TB for dc->jmp_opt
+Deleted patch
-We were using singlestep_enabled as a proxy for whether
-translator_use_goto_tb would always return false.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/i386/tcg/translate.c | 5 +++--
-file changed, 3 insertions(+), 2 deletions(-)
-diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/i386/tcg/translate.c
-+++ b/target/i386/tcg/translate.c
-@@ -XXX,XX +XXX,XX @@ static void i386_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cpu)
-     DisasContext *dc = container_of(dcbase, DisasContext, base);
-     CPUX86State *env = cpu->env_ptr;
-     uint32_t flags = dc->base.tb->flags;
-+    uint32_t cflags = tb_cflags(dc->base.tb);
-     int cpl = (flags >> HF_CPL_SHIFT) & 3;
-     int iopl = (flags >> IOPL_SHIFT) & 3;
-@@ -XXX,XX +XXX,XX @@ static void i386_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cpu)
-     dc->cpuid_ext3_features = env->features[FEAT_8000_0001_ECX];
-     dc->cpuid_7_0_ebx_features = env->features[FEAT_7_0_EBX];
-     dc->cpuid_xsave_features = env->features[FEAT_XSAVE];
--    dc->jmp_opt = !(dc->base.singlestep_enabled ||
-+    dc->jmp_opt = !((cflags & CF_NO_GOTO_TB) ||
-                     (flags & (HF_TF_MASK | HF_INHIBIT_IRQ_MASK)));
-     /*
-      * If jmp_opt, we want to handle each string instruction individually.
-      * For icount also disable repz optimization so that each iteration
-      * is accounted separately.
-      */
--    dc->repz_opt = !dc->jmp_opt && !(tb_cflags(dc->base.tb) & CF_USE_ICOUNT);
-+    dc->repz_opt = !dc->jmp_opt && !(cflags & CF_USE_ICOUNT);
-     dc->T0 = tcg_temp_new();
-     dc->T1 = tcg_temp_new();
---
-.25.1

-[PULL 09/24] target/i386: Drop check for singlestep_enabled
+Deleted patch
-GDB single-stepping is now handled generically.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/i386/helper.h          | 1 -
- target/i386/tcg/misc_helper.c | 8 --------
- target/i386/tcg/translate.c   | 4 +---
-files changed, 1 insertion(+), 12 deletions(-)
-diff --git a/target/i386/helper.h b/target/i386/helper.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/i386/helper.h
-+++ b/target/i386/helper.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_2(syscall, void, env, int)
- DEF_HELPER_2(sysret, void, env, int)
- #endif
- DEF_HELPER_FLAGS_2(pause, TCG_CALL_NO_WG, noreturn, env, int)
--DEF_HELPER_FLAGS_1(debug, TCG_CALL_NO_WG, noreturn, env)
- DEF_HELPER_1(reset_rf, void, env)
- DEF_HELPER_FLAGS_3(raise_interrupt, TCG_CALL_NO_WG, noreturn, env, int, int)
- DEF_HELPER_FLAGS_2(raise_exception, TCG_CALL_NO_WG, noreturn, env, int)
-diff --git a/target/i386/tcg/misc_helper.c b/target/i386/tcg/misc_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/i386/tcg/misc_helper.c
-+++ b/target/i386/tcg/misc_helper.c
-@@ -XXX,XX +XXX,XX @@ void QEMU_NORETURN helper_pause(CPUX86State *env, int next_eip_addend)
-     do_pause(env);
- }
--void QEMU_NORETURN helper_debug(CPUX86State *env)
--{
--    CPUState *cs = env_cpu(env);
--
--    cs->exception_index = EXCP_DEBUG;
--    cpu_loop_exit(cs);
--}
--
- uint64_t helper_rdpkru(CPUX86State *env, uint32_t ecx)
- {
-     if ((env->cr[4] & CR4_PKE_MASK) == 0) {
-diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/i386/tcg/translate.c
-+++ b/target/i386/tcg/translate.c
-@@ -XXX,XX +XXX,XX @@ do_gen_eob_worker(DisasContext *s, bool inhibit, bool recheck_tf, bool jr)
-     if (s->base.tb->flags & HF_RF_MASK) {
-         gen_helper_reset_rf(cpu_env);
-     }
--    if (s->base.singlestep_enabled) {
--        gen_helper_debug(cpu_env);
--    } else if (recheck_tf) {
-+    if (recheck_tf) {
-         gen_helper_rechecking_single_step(cpu_env);
-         tcg_gen_exit_tb(NULL, 0);
-     } else if (s->flags & HF_TF_MASK) {
---
-.25.1

-[PULL 11/24] target/microblaze: Check CF_NO_GOTO_TB for DISAS_JUMP
+Deleted patch
-We were using singlestep_enabled as a proxy for whether
-translator_use_goto_tb would always return false.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/microblaze/translate.c | 4 ++--
-file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/microblaze/translate.c
-+++ b/target/microblaze/translate.c
-@@ -XXX,XX +XXX,XX @@ static void mb_tr_tb_stop(DisasContextBase *dcb, CPUState *cs)
-         break;
-     case DISAS_JUMP:
--        if (dc->jmp_dest != -1 && !cs->singlestep_enabled) {
-+        if (dc->jmp_dest != -1 && !(tb_cflags(dc->base.tb) & CF_NO_GOTO_TB)) {
-             /* Direct jump. */
-             tcg_gen_discard_i32(cpu_btarget);
-@@ -XXX,XX +XXX,XX @@ static void mb_tr_tb_stop(DisasContextBase *dcb, CPUState *cs)
-             return;
-         }
--        /* Indirect jump (or direct jump w/ singlestep) */
-+        /* Indirect jump (or direct jump w/ goto_tb disabled) */
-         tcg_gen_mov_i32(cpu_pc, cpu_btarget);
-         tcg_gen_discard_i32(cpu_btarget);
---
-.25.1

-[PULL 12/24] target/microblaze: Drop checks for singlestep_enabled
+Deleted patch
-GDB single-stepping is now handled generically.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/microblaze/translate.c | 14 ++------------
-file changed, 2 insertions(+), 12 deletions(-)
-diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/microblaze/translate.c
-+++ b/target/microblaze/translate.c
-@@ -XXX,XX +XXX,XX @@ static void gen_raise_hw_excp(DisasContext *dc, uint32_t esr_ec)
- static void gen_goto_tb(DisasContext *dc, int n, target_ulong dest)
- {
--    if (dc->base.singlestep_enabled) {
--        TCGv_i32 tmp = tcg_const_i32(EXCP_DEBUG);
--        tcg_gen_movi_i32(cpu_pc, dest);
--        gen_helper_raise_exception(cpu_env, tmp);
--        tcg_temp_free_i32(tmp);
--    } else if (translator_use_goto_tb(&dc->base, dest)) {
-+    if (translator_use_goto_tb(&dc->base, dest)) {
-         tcg_gen_goto_tb(n);
-         tcg_gen_movi_i32(cpu_pc, dest);
-         tcg_gen_exit_tb(dc->base.tb, n);
-@@ -XXX,XX +XXX,XX @@ static void mb_tr_tb_stop(DisasContextBase *dcb, CPUState *cs)
-         /* Indirect jump (or direct jump w/ goto_tb disabled) */
-         tcg_gen_mov_i32(cpu_pc, cpu_btarget);
-         tcg_gen_discard_i32(cpu_btarget);
--
--        if (unlikely(cs->singlestep_enabled)) {
--            gen_raise_exception(dc, EXCP_DEBUG);
--        } else {
--            tcg_gen_lookup_and_goto_ptr();
--        }
-+        tcg_gen_lookup_and_goto_ptr();
-         return;
-     default:
---
-.25.1

The following changes since commit 6587b0c1331d427b0939c37e763842550ed581db:

Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2021-10-15' into staging (2021-10-15 14:16:28 -0700)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20211016

for you to fetch changes up to 995b87dedc78b0467f5f18bbc3546072ba97516a:

Revert "cpu: Move cpu_common_props to hw/core/cpu.c" (2021-10-15 16:39:15 -0700)

----------------------------------------------------------------
Move gdb singlestep to generic code
Fix cpu_common_props

----------------------------------------------------------------
Richard Henderson (24):
      accel/tcg: Handle gdb singlestep in cpu_tb_exec
      target/alpha: Drop checks for singlestep_enabled
      target/avr: Drop checks for singlestep_enabled
      target/cris: Drop checks for singlestep_enabled
      target/hexagon: Drop checks for singlestep_enabled
      target/arm: Drop checks for singlestep_enabled
      target/hppa: Drop checks for singlestep_enabled
      target/i386: Check CF_NO_GOTO_TB for dc->jmp_opt
      target/i386: Drop check for singlestep_enabled
      target/m68k: Drop checks for singlestep_enabled
      target/microblaze: Check CF_NO_GOTO_TB for DISAS_JUMP
      target/microblaze: Drop checks for singlestep_enabled
      target/mips: Fix single stepping
      target/mips: Drop exit checks for singlestep_enabled
      target/openrisc: Drop checks for singlestep_enabled
      target/ppc: Drop exit checks for singlestep_enabled
      target/riscv: Remove dead code after exception
      target/riscv: Remove exit_tb and lookup_and_goto_ptr
      target/rx: Drop checks for singlestep_enabled
      target/s390x: Drop check for singlestep_enabled
      target/sh4: Drop check for singlestep_enabled
      target/tricore: Drop check for singlestep_enabled
      target/xtensa: Drop check for singlestep_enabled
      Revert "cpu: Move cpu_common_props to hw/core/cpu.c"

GDB single-stepping is now handled generically.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/alpha/translate.c | 13 +++----------
 1 file changed, 3 insertions(+), 10 deletions(-)

diff --git a/target/alpha/translate.c b/target/alpha/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/translate.c
+++ b/target/alpha/translate.c
@@ -XXX,XX +XXX,XX @@ static void alpha_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
         tcg_gen_movi_i64(cpu_pc, ctx->base.pc_next);
         /* FALLTHRU */
     case DISAS_PC_UPDATED:
-        if (!ctx->base.singlestep_enabled) {
-            tcg_gen_lookup_and_goto_ptr();
-            break;
-        }
-        /* FALLTHRU */
+        tcg_gen_lookup_and_goto_ptr();
+        break;
     case DISAS_PC_UPDATED_NOCHAIN:
-        if (ctx->base.singlestep_enabled) {
-            gen_excp_1(EXCP_DEBUG, 0);
-        } else {
-            tcg_gen_exit_tb(NULL, 0);
-        }
+        tcg_gen_exit_tb(NULL, 0);
         break;
     default:
         g_assert_not_reached();
-- 
2.25.1

GDB single-stepping is now handled generically.

Tested-by: Michael Rolnik <mrolnik@gmail.com>
Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/translate.c | 19 ++++---------------
 1 file changed, 4 insertions(+), 15 deletions(-)

diff --git a/target/avr/translate.c b/target/avr/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/translate.c
+++ b/target/avr/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
         tcg_gen_exit_tb(tb, n);
     } else {
         tcg_gen_movi_i32(cpu_pc, dest);
-        if (ctx->base.singlestep_enabled) {
-            gen_helper_debug(cpu_env);
-        } else {
-            tcg_gen_lookup_and_goto_ptr();
-        }
+        tcg_gen_lookup_and_goto_ptr();
     }
     ctx->base.is_jmp = DISAS_NORETURN;
 }
@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
         tcg_gen_movi_tl(cpu_pc, ctx->npc);
         /* fall through */
     case DISAS_LOOKUP:
-        if (!ctx->base.singlestep_enabled) {
-            tcg_gen_lookup_and_goto_ptr();
-            break;
-        }
-        /* fall through */
+        tcg_gen_lookup_and_goto_ptr();
+        break;
     case DISAS_EXIT:
-        if (ctx->base.singlestep_enabled) {
-            gen_helper_debug(cpu_env);
-        } else {
-            tcg_gen_exit_tb(NULL, 0);
-        }
+        tcg_gen_exit_tb(NULL, 0);
         break;
     default:
         g_assert_not_reached();
-- 
2.25.1

GDB single-stepping is now handled generically.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/hexagon/translate.c | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/target/hexagon/translate.c b/target/hexagon/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/translate.c
+++ b/target/hexagon/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_end_tb(DisasContext *ctx)
 {
     gen_exec_counters(ctx);
     tcg_gen_mov_tl(hex_gpr[HEX_REG_PC], hex_next_PC);
-    if (ctx->base.singlestep_enabled) {
-        gen_exception_raw(EXCP_DEBUG);
-    } else {
-        tcg_gen_exit_tb(NULL, 0);
-    }
+    tcg_gen_exit_tb(NULL, 0);
     ctx->base.is_jmp = DISAS_NORETURN;
 }
 
@@ -XXX,XX +XXX,XX @@ static void hexagon_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
     case DISAS_TOO_MANY:
         gen_exec_counters(ctx);
         tcg_gen_movi_tl(hex_gpr[HEX_REG_PC], ctx->base.pc_next);
-        if (ctx->base.singlestep_enabled) {
-            gen_exception_raw(EXCP_DEBUG);
-        } else {
-            tcg_gen_exit_tb(NULL, 0);
-        }
+        tcg_gen_exit_tb(NULL, 0);
         break;
     case DISAS_NORETURN:
         break;
-- 
2.25.1

GDB single-stepping is now handled generically.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/translate-a64.c | 10 ++--------
 target/arm/translate.c     | 36 ++++++------------------------------
 2 files changed, 8 insertions(+), 38 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static inline void gen_goto_tb(DisasContext *s, int n, uint64_t dest)
         gen_a64_set_pc_im(dest);
         if (s->ss_active) {
             gen_step_complete_exception(s);
-        } else if (s->base.singlestep_enabled) {
-            gen_exception_internal(EXCP_DEBUG);
         } else {
             tcg_gen_lookup_and_goto_ptr();
             s->base.is_jmp = DISAS_NORETURN;
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
 {
     DisasContext *dc = container_of(dcbase, DisasContext, base);
 
-    if (unlikely(dc->base.singlestep_enabled || dc->ss_active)) {
+    if (unlikely(dc->ss_active)) {
         /* Note that this means single stepping WFI doesn't halt the CPU.
          * For conditional branch insns this is harmless unreachable code as
          * gen_goto_tb() has already handled emitting the debug exception
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
             /* fall through */
         case DISAS_EXIT:
         case DISAS_JUMP:
-            if (dc->base.singlestep_enabled) {
-                gen_exception_internal(EXCP_DEBUG);
-            } else {
-                gen_step_complete_exception(dc);
-            }
+            gen_step_complete_exception(dc);
             break;
         case DISAS_NORETURN:
             break;
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal(int excp)
     tcg_temp_free_i32(tcg_excp);
 }
 
-static void gen_step_complete_exception(DisasContext *s)
+static void gen_singlestep_exception(DisasContext *s)
 {
     /* We just completed step of an insn. Move from Active-not-pending
      * to Active-pending, and then also take the swstep exception.
@@ -XXX,XX +XXX,XX @@ static void gen_step_complete_exception(DisasContext *s)
     s->base.is_jmp = DISAS_NORETURN;
 }
 
-static void gen_singlestep_exception(DisasContext *s)
-{
-    /* Generate the right kind of exception for singlestep, which is
-     * either the architectural singlestep or EXCP_DEBUG for QEMU's
-     * gdb singlestepping.
-     */
-    if (s->ss_active) {
-        gen_step_complete_exception(s);
-    } else {
-        gen_exception_internal(EXCP_DEBUG);
-    }
-}
-
-static inline bool is_singlestepping(DisasContext *s)
-{
-    /* Return true if we are singlestepping either because of
-     * architectural singlestep or QEMU gdbstub singlestep. This does
-     * not include the command line '-singlestep' mode which is rather
-     * misnamed as it only means "one instruction per TB" and doesn't
-     * affect the code we generate.
-     */
-    return s->base.singlestep_enabled || s->ss_active;
-}
-
 void clear_eci_state(DisasContext *s)
 {
     /*
@@ -XXX,XX +XXX,XX @@ static inline void gen_bx_excret_final_code(DisasContext *s)
     /* Is the new PC value in the magic range indicating exception return? */
     tcg_gen_brcondi_i32(TCG_COND_GEU, cpu_R[15], min_magic, excret_label);
     /* No: end the TB as we would for a DISAS_JMP */
-    if (is_singlestepping(s)) {
+    if (s->ss_active) {
         gen_singlestep_exception(s);
     } else {
         tcg_gen_exit_tb(NULL, 0);
@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *s, int n, target_ulong dest)
 /* Jump, specifying which TB number to use if we gen_goto_tb() */
 static inline void gen_jmp_tb(DisasContext *s, uint32_t dest, int tbno)
 {
-    if (unlikely(is_singlestepping(s))) {
+    if (unlikely(s->ss_active)) {
         /* An indirect jump so that we still trigger the debug exception.  */
         gen_set_pc_im(s, dest);
         s->base.is_jmp = DISAS_JUMP;
@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     dc->page_start = dc->base.pc_first & TARGET_PAGE_MASK;
 
     /* If architectural single step active, limit to 1.  */
-    if (is_singlestepping(dc)) {
+    if (dc->ss_active) {
         dc->base.max_insns = 1;
     }
 
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
          * insn codepath itself.
          */
         gen_bx_excret_final_code(dc);
-    } else if (unlikely(is_singlestepping(dc))) {
+    } else if (unlikely(dc->ss_active)) {
         /* Unconditional and "condition passed" instruction codepath. */
         switch (dc->base.is_jmp) {
         case DISAS_SWI:
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
         /* "Condition failed" instruction codepath for the branch/trap insn */
         gen_set_label(dc->condlabel);
         gen_set_condexec(dc);
-        if (unlikely(is_singlestepping(dc))) {
+        if (unlikely(dc->ss_active)) {
             gen_set_pc_im(dc, dc->base.pc_next);
             gen_singlestep_exception(dc);
         } else {
-- 
2.25.1

GDB single-stepping is now handled generically.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/hppa/translate.c | 17 ++++-------------
 1 file changed, 4 insertions(+), 13 deletions(-)

diff --git a/target/hppa/translate.c b/target/hppa/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/translate.c
+++ b/target/hppa/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *ctx, int which,
     } else {
         copy_iaoq_entry(cpu_iaoq_f, f, cpu_iaoq_b);
         copy_iaoq_entry(cpu_iaoq_b, b, ctx->iaoq_n_var);
-        if (ctx->base.singlestep_enabled) {
-            gen_excp_1(EXCP_DEBUG);
-        } else {
-            tcg_gen_lookup_and_goto_ptr();
-        }
+        tcg_gen_lookup_and_goto_ptr();
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static bool do_rfi(DisasContext *ctx, bool rfi_r)
         gen_helper_rfi(cpu_env);
     }
     /* Exit the TB to recognize new interrupts.  */
-    if (ctx->base.singlestep_enabled) {
-        gen_excp_1(EXCP_DEBUG);
-    } else {
-        tcg_gen_exit_tb(NULL, 0);
-    }
+    tcg_gen_exit_tb(NULL, 0);
     ctx->base.is_jmp = DISAS_NORETURN;
 
     return nullify_end(ctx);
@@ -XXX,XX +XXX,XX @@ static void hppa_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
         nullify_save(ctx);
         /* FALLTHRU */
     case DISAS_IAQ_N_UPDATED:
-        if (ctx->base.singlestep_enabled) {
-            gen_excp_1(EXCP_DEBUG);
-        } else if (is_jmp != DISAS_IAQ_N_STALE_EXIT) {
+        if (is_jmp != DISAS_IAQ_N_STALE_EXIT) {
             tcg_gen_lookup_and_goto_ptr();
+            break;
         }
         /* FALLTHRU */
     case DISAS_EXIT:
-- 
2.25.1

We were using singlestep_enabled as a proxy for whether
translator_use_goto_tb would always return false.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/i386/tcg/translate.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static void i386_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cpu)
     DisasContext *dc = container_of(dcbase, DisasContext, base);
     CPUX86State *env = cpu->env_ptr;
     uint32_t flags = dc->base.tb->flags;
+    uint32_t cflags = tb_cflags(dc->base.tb);
     int cpl = (flags >> HF_CPL_SHIFT) & 3;
     int iopl = (flags >> IOPL_SHIFT) & 3;
 
@@ -XXX,XX +XXX,XX @@ static void i386_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cpu)
     dc->cpuid_ext3_features = env->features[FEAT_8000_0001_ECX];
     dc->cpuid_7_0_ebx_features = env->features[FEAT_7_0_EBX];
     dc->cpuid_xsave_features = env->features[FEAT_XSAVE];
-    dc->jmp_opt = !(dc->base.singlestep_enabled ||
+    dc->jmp_opt = !((cflags & CF_NO_GOTO_TB) ||
                     (flags & (HF_TF_MASK | HF_INHIBIT_IRQ_MASK)));
     /*
      * If jmp_opt, we want to handle each string instruction individually.
      * For icount also disable repz optimization so that each iteration
      * is accounted separately.
      */
-    dc->repz_opt = !dc->jmp_opt && !(tb_cflags(dc->base.tb) & CF_USE_ICOUNT);
+    dc->repz_opt = !dc->jmp_opt && !(cflags & CF_USE_ICOUNT);
 
     dc->T0 = tcg_temp_new();
     dc->T1 = tcg_temp_new();
-- 
2.25.1

GDB single-stepping is now handled generically.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/i386/helper.h          | 1 -
 target/i386/tcg/misc_helper.c | 8 --------
 target/i386/tcg/translate.c   | 4 +---
 3 files changed, 1 insertion(+), 12 deletions(-)

diff --git a/target/i386/helper.h b/target/i386/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/helper.h
+++ b/target/i386/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_2(syscall, void, env, int)
 DEF_HELPER_2(sysret, void, env, int)
 #endif
 DEF_HELPER_FLAGS_2(pause, TCG_CALL_NO_WG, noreturn, env, int)
-DEF_HELPER_FLAGS_1(debug, TCG_CALL_NO_WG, noreturn, env)
 DEF_HELPER_1(reset_rf, void, env)
 DEF_HELPER_FLAGS_3(raise_interrupt, TCG_CALL_NO_WG, noreturn, env, int, int)
 DEF_HELPER_FLAGS_2(raise_exception, TCG_CALL_NO_WG, noreturn, env, int)
diff --git a/target/i386/tcg/misc_helper.c b/target/i386/tcg/misc_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/misc_helper.c
+++ b/target/i386/tcg/misc_helper.c
@@ -XXX,XX +XXX,XX @@ void QEMU_NORETURN helper_pause(CPUX86State *env, int next_eip_addend)
     do_pause(env);
 }
 
-void QEMU_NORETURN helper_debug(CPUX86State *env)
-{
-    CPUState *cs = env_cpu(env);
-
-    cs->exception_index = EXCP_DEBUG;
-    cpu_loop_exit(cs);
-}
-
 uint64_t helper_rdpkru(CPUX86State *env, uint32_t ecx)
 {
     if ((env->cr[4] & CR4_PKE_MASK) == 0) {
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ do_gen_eob_worker(DisasContext *s, bool inhibit, bool recheck_tf, bool jr)
     if (s->base.tb->flags & HF_RF_MASK) {
         gen_helper_reset_rf(cpu_env);
     }
-    if (s->base.singlestep_enabled) {
-        gen_helper_debug(cpu_env);
-    } else if (recheck_tf) {
+    if (recheck_tf) {
         gen_helper_rechecking_single_step(cpu_env);
         tcg_gen_exit_tb(NULL, 0);
     } else if (s->flags & HF_TF_MASK) {
-- 
2.25.1

GDB single-stepping is now handled generically.

Acked-by: Laurent Vivier <laurent@vivier.eu>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/m68k/translate.c | 44 +++++++++--------------------------------
 1 file changed, 9 insertions(+), 35 deletions(-)

diff --git a/target/m68k/translate.c b/target/m68k/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/translate.c
+++ b/target/m68k/translate.c
@@ -XXX,XX +XXX,XX @@ static void do_writebacks(DisasContext *s)
     }
 }
 
-static bool is_singlestepping(DisasContext *s)
-{
-    /*
-     * Return true if we are singlestepping either because of
-     * architectural singlestep or QEMU gdbstub singlestep. This does
-     * not include the command line '-singlestep' mode which is rather
-     * misnamed as it only means "one instruction per TB" and doesn't
-     * affect the code we generate.
-     */
-    return s->base.singlestep_enabled || s->ss_active;
-}
-
 /* is_jmp field values */
 #define DISAS_JUMP      DISAS_TARGET_0 /* only pc was modified dynamically */
 #define DISAS_EXIT      DISAS_TARGET_1 /* cpu state was modified dynamically */
@@ -XXX,XX +XXX,XX @@ static void gen_exception(DisasContext *s, uint32_t dest, int nr)
     s->base.is_jmp = DISAS_NORETURN;
 }
 
-static void gen_singlestep_exception(DisasContext *s)
-{
-    /*
-     * Generate the right kind of exception for singlestep, which is
-     * either the architectural singlestep or EXCP_DEBUG for QEMU's
-     * gdb singlestepping.
-     */
-    if (s->ss_active) {
-        gen_raise_exception(EXCP_TRACE);
-    } else {
-        gen_raise_exception(EXCP_DEBUG);
-    }
-}
-
 static inline void gen_addr_fault(DisasContext *s)
 {
     gen_exception(s, s->base.pc_next, EXCP_ADDRESS);
@@ -XXX,XX +XXX,XX @@ static void gen_exit_tb(DisasContext *s)
 /* Generate a jump to an immediate address.  */
 static void gen_jmp_tb(DisasContext *s, int n, uint32_t dest)
 {
-    if (unlikely(is_singlestepping(s))) {
+    if (unlikely(s->ss_active)) {
         update_cc_op(s);
         tcg_gen_movi_i32(QREG_PC, dest);
-        gen_singlestep_exception(s);
+        gen_raise_exception(EXCP_TRACE);
     } else if (translator_use_goto_tb(&s->base, dest)) {
         tcg_gen_goto_tb(n);
         tcg_gen_movi_i32(QREG_PC, dest);
@@ -XXX,XX +XXX,XX @@ static void m68k_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cpu)
 
     dc->ss_active = (M68K_SR_TRACE(env->sr) == M68K_SR_TRACE_ANY_INS);
     /* If architectural single step active, limit to 1 */
-    if (is_singlestepping(dc)) {
+    if (dc->ss_active) {
         dc->base.max_insns = 1;
     }
 }
@@ -XXX,XX +XXX,XX @@ static void m68k_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
         break;
     case DISAS_TOO_MANY:
         update_cc_op(dc);
-        if (is_singlestepping(dc)) {
+        if (dc->ss_active) {
             tcg_gen_movi_i32(QREG_PC, dc->pc);
-            gen_singlestep_exception(dc);
+            gen_raise_exception(EXCP_TRACE);
         } else {
             gen_jmp_tb(dc, 0, dc->pc);
         }
         break;
     case DISAS_JUMP:
         /* We updated CC_OP and PC in gen_jmp/gen_jmp_im.  */
-        if (is_singlestepping(dc)) {
-            gen_singlestep_exception(dc);
+        if (dc->ss_active) {
+            gen_raise_exception(EXCP_TRACE);
         } else {
             tcg_gen_lookup_and_goto_ptr();
         }
@@ -XXX,XX +XXX,XX @@ static void m68k_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
          * We updated CC_OP and PC in gen_exit_tb, but also modified
          * other state that may require returning to the main loop.
          */
-        if (is_singlestepping(dc)) {
-            gen_singlestep_exception(dc);
+        if (dc->ss_active) {
+            gen_raise_exception(EXCP_TRACE);
         } else {
             tcg_gen_exit_tb(NULL, 0);
         }
-- 
2.25.1

We were using singlestep_enabled as a proxy for whether
translator_use_goto_tb would always return false.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/microblaze/translate.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -XXX,XX +XXX,XX @@ static void mb_tr_tb_stop(DisasContextBase *dcb, CPUState *cs)
         break;
 
     case DISAS_JUMP:
-        if (dc->jmp_dest != -1 && !cs->singlestep_enabled) {
+        if (dc->jmp_dest != -1 && !(tb_cflags(dc->base.tb) & CF_NO_GOTO_TB)) {
             /* Direct jump. */
             tcg_gen_discard_i32(cpu_btarget);
 
@@ -XXX,XX +XXX,XX @@ static void mb_tr_tb_stop(DisasContextBase *dcb, CPUState *cs)
             return;
         }
 
-        /* Indirect jump (or direct jump w/ singlestep) */
+        /* Indirect jump (or direct jump w/ goto_tb disabled) */
         tcg_gen_mov_i32(cpu_pc, cpu_btarget);
         tcg_gen_discard_i32(cpu_btarget);
 
-- 
2.25.1

GDB single-stepping is now handled generically.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/microblaze/translate.c | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)

diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_raise_hw_excp(DisasContext *dc, uint32_t esr_ec)
 
 static void gen_goto_tb(DisasContext *dc, int n, target_ulong dest)
 {
-    if (dc->base.singlestep_enabled) {
-        TCGv_i32 tmp = tcg_const_i32(EXCP_DEBUG);
-        tcg_gen_movi_i32(cpu_pc, dest);
-        gen_helper_raise_exception(cpu_env, tmp);
-        tcg_temp_free_i32(tmp);
-    } else if (translator_use_goto_tb(&dc->base, dest)) {
+    if (translator_use_goto_tb(&dc->base, dest)) {
         tcg_gen_goto_tb(n);
         tcg_gen_movi_i32(cpu_pc, dest);
         tcg_gen_exit_tb(dc->base.tb, n);
@@ -XXX,XX +XXX,XX @@ static void mb_tr_tb_stop(DisasContextBase *dcb, CPUState *cs)
         /* Indirect jump (or direct jump w/ goto_tb disabled) */
         tcg_gen_mov_i32(cpu_pc, cpu_btarget);
         tcg_gen_discard_i32(cpu_btarget);
-
-        if (unlikely(cs->singlestep_enabled)) {
-            gen_raise_exception(dc, EXCP_DEBUG);
-        } else {
-            tcg_gen_lookup_and_goto_ptr();
-        }
+        tcg_gen_lookup_and_goto_ptr();
         return;
 
     default:
-- 
2.25.1

As per an ancient comment in mips_tr_translate_insn about the
expectations of gdb, when restarting the insn in a delay slot
we also re-execute the branch.  Which means that we are
expected to execute two insns in this case.

This has been broken since 8b86d6d2580, where we forced max_insns
to 1 while single-stepping.  This resulted in an exit from the
translator loop after the branch but before the delay slot is
translated.

Increase the max_insns to 2 for this case.  In addition, bypass
the end-of-page check, for when the branch itself ends the page.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/mips/tcg/translate.c | 25 ++++++++++++++++---------
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/translate.c
+++ b/target/mips/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static void mips_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     ctx->default_tcg_memop_mask = (ctx->insn_flags & (ISA_MIPS_R6 |
                                   INSN_LOONGSON3A)) ? MO_UNALN : MO_ALIGN;
 
+    /*
+     * Execute a branch and its delay slot as a single instruction.
+     * This is what GDB expects and is consistent with what the
+     * hardware does (e.g. if a delay slot instruction faults, the
+     * reported PC is the PC of the branch).
+     */
+    if (ctx->base.singlestep_enabled && (ctx->hflags & MIPS_HFLAG_BMASK)) {
+        ctx->base.max_insns = 2;
+    }
+
     LOG_DISAS("\ntb %p idx %d hflags %04x\n", ctx->base.tb, ctx->mem_idx,
               ctx->hflags);
 }
@@ -XXX,XX +XXX,XX @@ static void mips_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
     if (ctx->base.is_jmp != DISAS_NEXT) {
         return;
     }
+
     /*
-     * Execute a branch and its delay slot as a single instruction.
-     * This is what GDB expects and is consistent with what the
-     * hardware does (e.g. if a delay slot instruction faults, the
-     * reported PC is the PC of the branch).
+     * End the TB on (most) page crossings.
+     * See mips_tr_init_disas_context about single-stepping a branch
+     * together with its delay slot.
      */
-    if (ctx->base.singlestep_enabled &&
-        (ctx->hflags & MIPS_HFLAG_BMASK) == 0) {
-        ctx->base.is_jmp = DISAS_TOO_MANY;
-    }
-    if (ctx->base.pc_next - ctx->page_start >= TARGET_PAGE_SIZE) {
+    if (ctx->base.pc_next - ctx->page_start >= TARGET_PAGE_SIZE
+        && !ctx->base.singlestep_enabled) {
         ctx->base.is_jmp = DISAS_TOO_MANY;
     }
 }
-- 
2.25.1

GDB single-stepping is now handled generically.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/mips/tcg/translate.c | 50 +++++++++++++------------------------
 1 file changed, 18 insertions(+), 32 deletions(-)

diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/translate.c
+++ b/target/mips/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
         tcg_gen_exit_tb(ctx->base.tb, n);
     } else {
         gen_save_pc(dest);
-        if (ctx->base.singlestep_enabled) {
-            save_cpu_state(ctx, 0);
-            gen_helper_raise_exception_debug(cpu_env);
-        } else {
-            tcg_gen_lookup_and_goto_ptr();
-        }
+        tcg_gen_lookup_and_goto_ptr();
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void gen_branch(DisasContext *ctx, int insn_bytes)
             } else {
                 tcg_gen_mov_tl(cpu_PC, btarget);
             }
-            if (ctx->base.singlestep_enabled) {
-                save_cpu_state(ctx, 0);
-                gen_helper_raise_exception_debug(cpu_env);
-            }
             tcg_gen_lookup_and_goto_ptr();
             break;
         default:
@@ -XXX,XX +XXX,XX @@ static void mips_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
 {
     DisasContext *ctx = container_of(dcbase, DisasContext, base);
 
-    if (ctx->base.singlestep_enabled && ctx->base.is_jmp != DISAS_NORETURN) {
-        save_cpu_state(ctx, ctx->base.is_jmp != DISAS_EXIT);
-        gen_helper_raise_exception_debug(cpu_env);
-    } else {
-        switch (ctx->base.is_jmp) {
-        case DISAS_STOP:
-            gen_save_pc(ctx->base.pc_next);
-            tcg_gen_lookup_and_goto_ptr();
-            break;
-        case DISAS_NEXT:
-        case DISAS_TOO_MANY:
-            save_cpu_state(ctx, 0);
-            gen_goto_tb(ctx, 0, ctx->base.pc_next);
-            break;
-        case DISAS_EXIT:
-            tcg_gen_exit_tb(NULL, 0);
-            break;
-        case DISAS_NORETURN:
-            break;
-        default:
-            g_assert_not_reached();
-        }
+    switch (ctx->base.is_jmp) {
+    case DISAS_STOP:
+        gen_save_pc(ctx->base.pc_next);
+        tcg_gen_lookup_and_goto_ptr();
+        break;
+    case DISAS_NEXT:
+    case DISAS_TOO_MANY:
+        save_cpu_state(ctx, 0);
+        gen_goto_tb(ctx, 0, ctx->base.pc_next);
+        break;
+    case DISAS_EXIT:
+        tcg_gen_exit_tb(NULL, 0);
+        break;
+    case DISAS_NORETURN:
+        break;
+    default:
+        g_assert_not_reached();
     }
 }
 
-- 
2.25.1

GDB single-stepping is now handled generically.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/openrisc/translate.c | 18 +++---------------
 1 file changed, 3 insertions(+), 15 deletions(-)

diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/translate.c
+++ b/target/openrisc/translate.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
             /* The jump destination is indirect/computed; use jmp_pc.  */
             tcg_gen_mov_tl(cpu_pc, jmp_pc);
             tcg_gen_discard_tl(jmp_pc);
-            if (unlikely(dc->base.singlestep_enabled)) {
-                gen_exception(dc, EXCP_DEBUG);
-            } else {
-                tcg_gen_lookup_and_goto_ptr();
-            }
+            tcg_gen_lookup_and_goto_ptr();
             break;
         }
         /* The jump destination is direct; use jmp_pc_imm.
@@ -XXX,XX +XXX,XX @@ static void openrisc_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
             break;
         }
         tcg_gen_movi_tl(cpu_pc, jmp_dest);
-        if (unlikely(dc->base.singlestep_enabled)) {
-            gen_exception(dc, EXCP_DEBUG);
-        } else {
-            tcg_gen_lookup_and_goto_ptr();
-        }
+        tcg_gen_lookup_and_goto_ptr();
         break;
 
     case DISAS_EXIT:
-        if (unlikely(dc->base.singlestep_enabled)) {
-            gen_exception(dc, EXCP_DEBUG);
-        } else {
-            tcg_gen_exit_tb(NULL, 0);
-        }
+        tcg_gen_exit_tb(NULL, 0);
         break;
     default:
         g_assert_not_reached();
-- 
2.25.1

GDB single-stepping is now handled generically.
Reuse gen_debug_exception to handle architectural debug exceptions.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/ppc/translate.c | 38 ++++++++------------------------------
 1 file changed, 8 insertions(+), 30 deletions(-)

diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -XXX,XX +XXX,XX @@
 
 #define CPU_SINGLE_STEP 0x1
 #define CPU_BRANCH_STEP 0x2
-#define GDBSTUB_SINGLE_STEP 0x4
 
 /* Include definitions for instructions classes and implementations flags */
 /* #define PPC_DEBUG_DISAS */
@@ -XXX,XX +XXX,XX @@ static uint32_t gen_prep_dbgex(DisasContext *ctx)
 
 static void gen_debug_exception(DisasContext *ctx)
 {
-    gen_helper_raise_exception(cpu_env, tcg_constant_i32(EXCP_DEBUG));
+    gen_helper_raise_exception(cpu_env, tcg_constant_i32(gen_prep_dbgex(ctx)));
     ctx->base.is_jmp = DISAS_NORETURN;
 }
 
@@ -XXX,XX +XXX,XX @@ static inline bool use_goto_tb(DisasContext *ctx, target_ulong dest)
 
 static void gen_lookup_and_goto_ptr(DisasContext *ctx)
 {
-    int sse = ctx->singlestep_enabled;
-    if (unlikely(sse)) {
-        if (sse & GDBSTUB_SINGLE_STEP) {
-            gen_debug_exception(ctx);
-        } else if (sse & (CPU_SINGLE_STEP | CPU_BRANCH_STEP)) {
-            gen_helper_raise_exception(cpu_env, tcg_constant_i32(gen_prep_dbgex(ctx)));
-        } else {
-            tcg_gen_exit_tb(NULL, 0);
-        }
+    if (unlikely(ctx->singlestep_enabled)) {
+        gen_debug_exception(ctx);
     } else {
         tcg_gen_lookup_and_goto_ptr();
     }
@@ -XXX,XX +XXX,XX @@ static void ppc_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     ctx->singlestep_enabled = 0;
     if ((hflags >> HFLAGS_SE) & 1) {
         ctx->singlestep_enabled |= CPU_SINGLE_STEP;
+        ctx->base.max_insns = 1;
     }
     if ((hflags >> HFLAGS_BE) & 1) {
         ctx->singlestep_enabled |= CPU_BRANCH_STEP;
     }
-    if (unlikely(ctx->base.singlestep_enabled)) {
-        ctx->singlestep_enabled |= GDBSTUB_SINGLE_STEP;
-    }
-
-    if (ctx->singlestep_enabled & (CPU_SINGLE_STEP | GDBSTUB_SINGLE_STEP)) {
-        ctx->base.max_insns = 1;
-    }
 }
 
 static void ppc_tr_tb_start(DisasContextBase *db, CPUState *cs)
@@ -XXX,XX +XXX,XX @@ static void ppc_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
     DisasContext *ctx = container_of(dcbase, DisasContext, base);
     DisasJumpType is_jmp = ctx->base.is_jmp;
     target_ulong nip = ctx->base.pc_next;
-    int sse;
 
     if (is_jmp == DISAS_NORETURN) {
         /* We have already exited the TB. */
@@ -XXX,XX +XXX,XX @@ static void ppc_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
     }
 
     /* Honor single stepping. */
-    sse = ctx->singlestep_enabled & (CPU_SINGLE_STEP | GDBSTUB_SINGLE_STEP);
-    if (unlikely(sse)) {
+    if (unlikely(ctx->singlestep_enabled & CPU_SINGLE_STEP)
+        && (nip <= 0x100 || nip > 0xf00)) {
         switch (is_jmp) {
         case DISAS_TOO_MANY:
         case DISAS_EXIT_UPDATE:
@@ -XXX,XX +XXX,XX @@ static void ppc_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
             g_assert_not_reached();
         }
 
-        if (sse & GDBSTUB_SINGLE_STEP) {
-            gen_debug_exception(ctx);
-            return;
-        }
-        /* else CPU_SINGLE_STEP... */
-        if (nip <= 0x100 || nip > 0xf00) {
-            gen_helper_raise_exception(cpu_env, tcg_constant_i32(gen_prep_dbgex(ctx)));
-            return;
-        }
+        gen_debug_exception(ctx);
+        return;
     }
 
     switch (is_jmp) {
-- 
2.25.1

We have already set DISAS_NORETURN in generate_exception,
which makes the exit_tb unreachable.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/riscv/insn_trans/trans_privileged.c.inc | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/insn_trans/trans_privileged.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_privileged.c.inc
+++ b/target/riscv/insn_trans/trans_privileged.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_ecall(DisasContext *ctx, arg_ecall *a)
 {
     /* always generates U-level ECALL, fixed in do_interrupt handler */
     generate_exception(ctx, RISCV_EXCP_U_ECALL);
-    exit_tb(ctx); /* no chaining */
-    ctx->base.is_jmp = DISAS_NORETURN;
     return true;
 }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_ebreak(DisasContext *ctx, arg_ebreak *a)
         post   = opcode_at(&ctx->base, post_addr);
     }
 
-    if  (pre == 0x01f01013 && ebreak == 0x00100073 && post == 0x40705013) {
+    if (pre == 0x01f01013 && ebreak == 0x00100073 && post == 0x40705013) {
         generate_exception(ctx, RISCV_EXCP_SEMIHOST);
     } else {
         generate_exception(ctx, RISCV_EXCP_BREAKPOINT);
     }
-    exit_tb(ctx); /* no chaining */
-    ctx->base.is_jmp = DISAS_NORETURN;
     return true;
 }
 
-- 
2.25.1

GDB single-stepping is now handled generically, which means
we don't need to do anything in the wrappers.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/riscv/translate.c                      | 27 +------------------
 .../riscv/insn_trans/trans_privileged.c.inc   |  4 +--
 target/riscv/insn_trans/trans_rvi.c.inc       |  8 +++---
 target/riscv/insn_trans/trans_rvv.c.inc       |  2 +-
 4 files changed, 7 insertions(+), 34 deletions(-)

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void generate_exception_mtval(DisasContext *ctx, int excp)
     ctx->base.is_jmp = DISAS_NORETURN;
 }
 
-static void gen_exception_debug(void)
-{
-    gen_helper_raise_exception(cpu_env, tcg_constant_i32(EXCP_DEBUG));
-}
-
-/* Wrapper around tcg_gen_exit_tb that handles single stepping */
-static void exit_tb(DisasContext *ctx)
-{
-    if (ctx->base.singlestep_enabled) {
-        gen_exception_debug();
-    } else {
-        tcg_gen_exit_tb(NULL, 0);
-    }
-}
-
-/* Wrapper around tcg_gen_lookup_and_goto_ptr that handles single stepping */
-static void lookup_and_goto_ptr(DisasContext *ctx)
-{
-    if (ctx->base.singlestep_enabled) {
-        gen_exception_debug();
-    } else {
-        tcg_gen_lookup_and_goto_ptr();
-    }
-}
-
 static void gen_exception_illegal(DisasContext *ctx)
 {
     generate_exception(ctx, RISCV_EXCP_ILLEGAL_INST);
@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
         tcg_gen_exit_tb(ctx->base.tb, n);
     } else {
         tcg_gen_movi_tl(cpu_pc, dest);
-        lookup_and_goto_ptr(ctx);
+        tcg_gen_lookup_and_goto_ptr();
     }
 }
 
diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/insn_trans/trans_privileged.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_privileged.c.inc
+++ b/target/riscv/insn_trans/trans_privileged.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_sret(DisasContext *ctx, arg_sret *a)
 
     if (has_ext(ctx, RVS)) {
         gen_helper_sret(cpu_pc, cpu_env, cpu_pc);
-        exit_tb(ctx); /* no chaining */
+        tcg_gen_exit_tb(NULL, 0); /* no chaining */
         ctx->base.is_jmp = DISAS_NORETURN;
     } else {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_mret(DisasContext *ctx, arg_mret *a)
 #ifndef CONFIG_USER_ONLY
     tcg_gen_movi_tl(cpu_pc, ctx->base.pc_next);
     gen_helper_mret(cpu_pc, cpu_env, cpu_pc);
-    exit_tb(ctx); /* no chaining */
+    tcg_gen_exit_tb(NULL, 0); /* no chaining */
     ctx->base.is_jmp = DISAS_NORETURN;
     return true;
 #else
diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/insn_trans/trans_rvi.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvi.c.inc
+++ b/target/riscv/insn_trans/trans_rvi.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_jalr(DisasContext *ctx, arg_jalr *a)
     if (a->rd != 0) {
         tcg_gen_movi_tl(cpu_gpr[a->rd], ctx->pc_succ_insn);
     }
-
-    /* No chaining with JALR. */
-    lookup_and_goto_ptr(ctx);
+    tcg_gen_lookup_and_goto_ptr();
 
     if (misaligned) {
         gen_set_label(misaligned);
@@ -XXX,XX +XXX,XX @@ static bool trans_fence_i(DisasContext *ctx, arg_fence_i *a)
      * however we need to end the translation block
      */
     tcg_gen_movi_tl(cpu_pc, ctx->pc_succ_insn);
-    exit_tb(ctx);
+    tcg_gen_exit_tb(NULL, 0);
     ctx->base.is_jmp = DISAS_NORETURN;
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool do_csr_post(DisasContext *ctx)
 {
     /* We may have changed important cpu state -- exit to main loop. */
     tcg_gen_movi_tl(cpu_pc, ctx->pc_succ_insn);
-    exit_tb(ctx);
+    tcg_gen_exit_tb(NULL, 0);
     ctx->base.is_jmp = DISAS_NORETURN;
     return true;
 }
diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_vsetvl(DisasContext *ctx, arg_vsetvl *a)
     gen_set_gpr(ctx, a->rd, dst);
 
     tcg_gen_movi_tl(cpu_pc, ctx->pc_succ_insn);
-    lookup_and_goto_ptr(ctx);
+    tcg_gen_lookup_and_goto_ptr();
     ctx->base.is_jmp = DISAS_NORETURN;
     return true;
 }
-- 
2.25.1

GDB single-stepping is now handled generically.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/rx/helper.h    |  1 -
 target/rx/op_helper.c |  8 --------
 target/rx/translate.c | 12 ++----------
 3 files changed, 2 insertions(+), 19 deletions(-)

diff --git a/target/rx/helper.h b/target/rx/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/helper.h
+++ b/target/rx/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_1(raise_illegal_instruction, noreturn, env)
 DEF_HELPER_1(raise_access_fault, noreturn, env)
 DEF_HELPER_1(raise_privilege_violation, noreturn, env)
 DEF_HELPER_1(wait, noreturn, env)
-DEF_HELPER_1(debug, noreturn, env)
 DEF_HELPER_2(rxint, noreturn, env, i32)
 DEF_HELPER_1(rxbrk, noreturn, env)
 DEF_HELPER_FLAGS_3(fadd, TCG_CALL_NO_WG, f32, env, f32, f32)
diff --git a/target/rx/op_helper.c b/target/rx/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/op_helper.c
+++ b/target/rx/op_helper.c
@@ -XXX,XX +XXX,XX @@ void QEMU_NORETURN helper_wait(CPURXState *env)
     raise_exception(env, EXCP_HLT, 0);
 }
 
-void QEMU_NORETURN helper_debug(CPURXState *env)
-{
-    CPUState *cs = env_cpu(env);
-
-    cs->exception_index = EXCP_DEBUG;
-    cpu_loop_exit(cs);
-}
-
 void QEMU_NORETURN helper_rxint(CPURXState *env, uint32_t vec)
 {
     raise_exception(env, 0x100 + vec, 0);
diff --git a/target/rx/translate.c b/target/rx/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/translate.c
+++ b/target/rx/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *dc, int n, target_ulong dest)
         tcg_gen_exit_tb(dc->base.tb, n);
     } else {
         tcg_gen_movi_i32(cpu_pc, dest);
-        if (dc->base.singlestep_enabled) {
-            gen_helper_debug(cpu_env);
-        } else {
-            tcg_gen_lookup_and_goto_ptr();
-        }
+        tcg_gen_lookup_and_goto_ptr();
     }
     dc->base.is_jmp = DISAS_NORETURN;
 }
@@ -XXX,XX +XXX,XX @@ static void rx_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
         gen_goto_tb(ctx, 0, dcbase->pc_next);
         break;
     case DISAS_JUMP:
-        if (ctx->base.singlestep_enabled) {
-            gen_helper_debug(cpu_env);
-        } else {
-            tcg_gen_lookup_and_goto_ptr();
-        }
+        tcg_gen_lookup_and_goto_ptr();
         break;
     case DISAS_UPDATE:
         tcg_gen_movi_i32(cpu_pc, ctx->base.pc_next);
-- 
2.25.1

GDB single-stepping is now handled generically.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/s390x/tcg/translate.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ struct DisasContext {
     uint64_t pc_tmp;
     uint32_t ilen;
     enum cc_op cc_op;
-    bool do_debug;
 };
 
 /* Information carried about a condition to be evaluated.  */
@@ -XXX,XX +XXX,XX @@ static void s390x_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
 
     dc->cc_op = CC_OP_DYNAMIC;
     dc->ex_value = dc->base.tb->cs_base;
-    dc->do_debug = dc->base.singlestep_enabled;
 }
 
 static void s390x_tr_tb_start(DisasContextBase *db, CPUState *cs)
@@ -XXX,XX +XXX,XX @@ static void s390x_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
         /* FALLTHRU */
     case DISAS_PC_CC_UPDATED:
         /* Exit the TB, either by raising a debug exception or by return.  */
-        if (dc->do_debug) {
-            gen_exception(EXCP_DEBUG);
-        } else if ((dc->base.tb->flags & FLAG_MASK_PER) ||
-                   dc->base.is_jmp == DISAS_PC_STALE_NOCHAIN) {
+        if ((dc->base.tb->flags & FLAG_MASK_PER) ||
+             dc->base.is_jmp == DISAS_PC_STALE_NOCHAIN) {
             tcg_gen_exit_tb(NULL, 0);
         } else {
             tcg_gen_lookup_and_goto_ptr();
-- 
2.25.1

GDB single-stepping is now handled generically.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/sh4/helper.h    |  1 -
 target/sh4/op_helper.c |  5 -----
 target/sh4/translate.c | 14 +++-----------
 3 files changed, 3 insertions(+), 17 deletions(-)

diff --git a/target/sh4/helper.h b/target/sh4/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/helper.h
+++ b/target/sh4/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_1(raise_illegal_instruction, noreturn, env)
 DEF_HELPER_1(raise_slot_illegal_instruction, noreturn, env)
 DEF_HELPER_1(raise_fpu_disable, noreturn, env)
 DEF_HELPER_1(raise_slot_fpu_disable, noreturn, env)
-DEF_HELPER_1(debug, noreturn, env)
 DEF_HELPER_1(sleep, noreturn, env)
 DEF_HELPER_2(trapa, noreturn, env, i32)
 DEF_HELPER_1(exclusive, noreturn, env)
diff --git a/target/sh4/op_helper.c b/target/sh4/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/op_helper.c
+++ b/target/sh4/op_helper.c
@@ -XXX,XX +XXX,XX @@ void helper_raise_slot_fpu_disable(CPUSH4State *env)
     raise_exception(env, 0x820, 0);
 }
 
-void helper_debug(CPUSH4State *env)
-{
-    raise_exception(env, EXCP_DEBUG, 0);
-}
-
 void helper_sleep(CPUSH4State *env)
 {
     CPUState *cs = env_cpu(env);
diff --git a/target/sh4/translate.c b/target/sh4/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/translate.c
+++ b/target/sh4/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
         tcg_gen_exit_tb(ctx->base.tb, n);
     } else {
         tcg_gen_movi_i32(cpu_pc, dest);
-        if (ctx->base.singlestep_enabled) {
-            gen_helper_debug(cpu_env);
-        } else if (use_exit_tb(ctx)) {
+        if (use_exit_tb(ctx)) {
             tcg_gen_exit_tb(NULL, 0);
         } else {
             tcg_gen_lookup_and_goto_ptr();
@@ -XXX,XX +XXX,XX @@ static void gen_jump(DisasContext * ctx)
 	   delayed jump as immediate jump are conditinal jumps */
 	tcg_gen_mov_i32(cpu_pc, cpu_delayed_pc);
         tcg_gen_discard_i32(cpu_delayed_pc);
-        if (ctx->base.singlestep_enabled) {
-            gen_helper_debug(cpu_env);
-        } else if (use_exit_tb(ctx)) {
+        if (use_exit_tb(ctx)) {
             tcg_gen_exit_tb(NULL, 0);
         } else {
             tcg_gen_lookup_and_goto_ptr();
@@ -XXX,XX +XXX,XX @@ static void sh4_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
     switch (ctx->base.is_jmp) {
     case DISAS_STOP:
         gen_save_cpu_state(ctx, true);
-        if (ctx->base.singlestep_enabled) {
-            gen_helper_debug(cpu_env);
-        } else {
-            tcg_gen_exit_tb(NULL, 0);
-        }
+        tcg_gen_exit_tb(NULL, 0);
         break;
     case DISAS_NEXT:
     case DISAS_TOO_MANY:
-- 
2.25.1

GDB single-stepping is now handled generically.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/tricore/helper.h    |  1 -
 target/tricore/op_helper.c |  7 -------
 target/tricore/translate.c | 14 +-------------
 3 files changed, 1 insertion(+), 21 deletions(-)

diff --git a/target/tricore/helper.h b/target/tricore/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/helper.h
+++ b/target/tricore/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_2(psw_write, void, env, i32)
 DEF_HELPER_1(psw_read, i32, env)
 /* Exceptions */
 DEF_HELPER_3(raise_exception_sync, noreturn, env, i32, i32)
-DEF_HELPER_2(qemu_excp, noreturn, env, i32)
diff --git a/target/tricore/op_helper.c b/target/tricore/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/op_helper.c
+++ b/target/tricore/op_helper.c
@@ -XXX,XX +XXX,XX @@ static void raise_exception_sync_helper(CPUTriCoreState *env, uint32_t class,
     raise_exception_sync_internal(env, class, tin, pc, 0);
 }
 
-void helper_qemu_excp(CPUTriCoreState *env, uint32_t excp)
-{
-    CPUState *cs = env_cpu(env);
-    cs->exception_index = excp;
-    cpu_loop_exit(cs);
-}
-
 /* Addressing mode helper */
 
 static uint16_t reverse16(uint16_t val)
diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -XXX,XX +XXX,XX @@ static inline void gen_save_pc(target_ulong pc)
     tcg_gen_movi_tl(cpu_PC, pc);
 }
 
-static void generate_qemu_excp(DisasContext *ctx, int excp)
-{
-    TCGv_i32 tmp = tcg_const_i32(excp);
-    gen_helper_qemu_excp(cpu_env, tmp);
-    ctx->base.is_jmp = DISAS_NORETURN;
-    tcg_temp_free(tmp);
-}
-
 static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
 {
     if (translator_use_goto_tb(&ctx->base, dest)) {
@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
         tcg_gen_exit_tb(ctx->base.tb, n);
     } else {
         gen_save_pc(dest);
-        if (ctx->base.singlestep_enabled) {
-            generate_qemu_excp(ctx, EXCP_DEBUG);
-        } else {
-            tcg_gen_lookup_and_goto_ptr();
-        }
+        tcg_gen_lookup_and_goto_ptr();
     }
 }
 
-- 
2.25.1

GDB single-stepping is now handled generically.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/xtensa/translate.c | 25 ++++++++-----------------
 1 file changed, 8 insertions(+), 17 deletions(-)

diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/translate.c
+++ b/target/xtensa/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_jump_slot(DisasContext *dc, TCGv dest, int slot)
     if (dc->icount) {
         tcg_gen_mov_i32(cpu_SR[ICOUNT], dc->next_icount);
     }
-    if (dc->base.singlestep_enabled) {
-        gen_exception(dc, EXCP_DEBUG);
+    if (dc->op_flags & XTENSA_OP_POSTPROCESS) {
+        slot = gen_postprocess(dc, slot);
+    }
+    if (slot >= 0) {
+        tcg_gen_goto_tb(slot);
+        tcg_gen_exit_tb(dc->base.tb, slot);
     } else {
-        if (dc->op_flags & XTENSA_OP_POSTPROCESS) {
-            slot = gen_postprocess(dc, slot);
-        }
-        if (slot >= 0) {
-            tcg_gen_goto_tb(slot);
-            tcg_gen_exit_tb(dc->base.tb, slot);
-        } else {
-            tcg_gen_exit_tb(NULL, 0);
-        }
+        tcg_gen_exit_tb(NULL, 0);
     }
     dc->base.is_jmp = DISAS_NORETURN;
 }
@@ -XXX,XX +XXX,XX @@ static void xtensa_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
     case DISAS_NORETURN:
         break;
     case DISAS_TOO_MANY:
-        if (dc->base.singlestep_enabled) {
-            tcg_gen_movi_i32(cpu_pc, dc->pc);
-            gen_exception(dc, EXCP_DEBUG);
-        } else {
-            gen_jumpi(dc, dc->pc, 0);
-        }
+        gen_jumpi(dc, dc->pc, 0);
         break;
     default:
         g_assert_not_reached();
-- 
2.25.1

This reverts commit 1b36e4f5a5de585210ea95f2257839c2312be28f.

Despite a comment saying why cpu_common_props cannot be placed in
a file that is compiled once, it was moved anyway.  Revert that.

Since then, Property is not defined in hw/core/cpu.h, so it is now
easier to declare a function to install the properties rather than
the Property array itself.

Cc: Eduardo Habkost <ehabkost@redhat.com>
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h |  1 +
 cpu.c                 | 21 +++++++++++++++++++++
 hw/core/cpu-common.c  | 17 +----------------
 3 files changed, 23 insertions(+), 16 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ void QEMU_NORETURN cpu_abort(CPUState *cpu, const char *fmt, ...)
     GCC_FMT_ATTR(2, 3);
 
 /* $(top_srcdir)/cpu.c */
+void cpu_class_init_props(DeviceClass *dc);
 void cpu_exec_initfn(CPUState *cpu);
 void cpu_exec_realizefn(CPUState *cpu, Error **errp);
 void cpu_exec_unrealizefn(CPUState *cpu);
diff --git a/cpu.c b/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/cpu.c
+++ b/cpu.c
@@ -XXX,XX +XXX,XX @@ void cpu_exec_unrealizefn(CPUState *cpu)
     cpu_list_remove(cpu);
 }
 
+static Property cpu_common_props[] = {
+#ifndef CONFIG_USER_ONLY
+    /*
+     * Create a memory property for softmmu CPU object,
+     * so users can wire up its memory. (This can't go in hw/core/cpu.c
+     * because that file is compiled only once for both user-mode
+     * and system builds.) The default if no link is set up is to use
+     * the system address space.
+     */
+    DEFINE_PROP_LINK("memory", CPUState, memory, TYPE_MEMORY_REGION,
+                     MemoryRegion *),
+#endif
+    DEFINE_PROP_BOOL("start-powered-off", CPUState, start_powered_off, false),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+void cpu_class_init_props(DeviceClass *dc)
+{
+    device_class_set_props(dc, cpu_common_props);
+}
+
 void cpu_exec_initfn(CPUState *cpu)
 {
     cpu->as = NULL;
diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/cpu-common.c
+++ b/hw/core/cpu-common.c
@@ -XXX,XX +XXX,XX @@ static int64_t cpu_common_get_arch_id(CPUState *cpu)
     return cpu->cpu_index;
 }
 
-static Property cpu_common_props[] = {
-#ifndef CONFIG_USER_ONLY
-    /* Create a memory property for softmmu CPU object,
-     * so users can wire up its memory. (This can't go in hw/core/cpu.c
-     * because that file is compiled only once for both user-mode
-     * and system builds.) The default if no link is set up is to use
-     * the system address space.
-     */
-    DEFINE_PROP_LINK("memory", CPUState, memory, TYPE_MEMORY_REGION,
-                     MemoryRegion *),
-#endif
-    DEFINE_PROP_BOOL("start-powered-off", CPUState, start_powered_off, false),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
 static void cpu_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -XXX,XX +XXX,XX @@ static void cpu_class_init(ObjectClass *klass, void *data)
     dc->realize = cpu_common_realizefn;
     dc->unrealize = cpu_common_unrealizefn;
     dc->reset = cpu_common_reset;
-    device_class_set_props(dc, cpu_common_props);
+    cpu_class_init_props(dc);
     /*
      * Reason: CPUs still need special care by board code: wiring up
      * IRQs, adding reset handlers, halting non-first CPUs, ...
-- 
2.25.1

Second try's the charm today, right?

The following changes since commit 00b1faea41d283e931256aa78aa975a369ec3ae6:

Merge tag 'pull-target-arm-20230123' of https://git.linaro.org/people/pmaydell/qemu-arm into staging (2023-01-23 13:40:28 +0000)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20230123

for you to fetch changes up to 709bcd7da3f6b4655d910634a0d520fa1439df38:

tcg/loongarch64: Reorg goto_tb implementation (2023-01-23 16:00:13 -1000)

----------------------------------------------------------------
common-user: Re-enable ppc32 host
tcg: Avoid recursion in tcg_gen_mulu2_i32
tcg: Mark tcg helpers noinline to avoid an issue with LTO
tcg/arm: Use register pair allocation for qemu_{ld,st}_i64
disas: Enable loongarch disassembler, and fixes
tcg/loongarch64: Improve move immediate
tcg/loongarch64: Improve add immediate
tcg/loongarch64: Improve setcond
tcg/loongarch64: Implement movcond
tcg/loongarch64: Use tcg_pcrel_diff in tcg_out_ldst
tcg/loongarch64: Reorg goto_tb implementation

----------------------------------------------------------------
Richard Henderson (14):
      tcg: Avoid recursion in tcg_gen_mulu2_i32
      tcg/arm: Use register pair allocation for qemu_{ld,st}_i64
      common-user/host/ppc: Implement safe-syscall.inc.S
      linux-user: Implment host/ppc/host-signal.h
      tcg: Mark tcg helpers noinline to avoid an issue with LTO
      target/loongarch: Enable the disassembler for host tcg
      target/loongarch: Disassemble jirl properly
      target/loongarch: Disassemble pcadd* addresses
      tcg/loongarch64: Update tcg-insn-defs.c.inc
      tcg/loongarch64: Introduce tcg_out_addi
      tcg/loongarch64: Improve setcond expansion
      tcg/loongarch64: Implement movcond
      tcg/loongarch64: Use tcg_pcrel_diff in tcg_out_ldst
      tcg/loongarch64: Reorg goto_tb implementation

Rui Wang (1):
      tcg/loongarch64: Optimize immediate loading

include/exec/helper-proto.h                    |  32 ++-
 include/tcg/tcg.h                              |   7 -
 linux-user/include/host/ppc/host-signal.h      |  39 +++
 tcg/arm/tcg-target-con-set.h                   |   7 +-
 tcg/arm/tcg-target-con-str.h                   |   2 +
 tcg/loongarch64/tcg-target-con-set.h           |   5 +-
 tcg/loongarch64/tcg-target-con-str.h           |   2 +-
 tcg/loongarch64/tcg-target.h                   |  11 +-
 target/loongarch/insns.decode                  |   3 +-
 disas.c                                        |   2 +
 target/loongarch/disas.c                       |  39 ++-
 tcg/tcg-op.c                                   |   4 +-
 target/loongarch/insn_trans/trans_branch.c.inc |   2 +-
 tcg/arm/tcg-target.c.inc                       |  28 +-
 tcg/loongarch64/tcg-insn-defs.c.inc            |  10 +-
 tcg/loongarch64/tcg-target.c.inc               | 364 ++++++++++++++++---------
 common-user/host/ppc/safe-syscall.inc.S        | 107 ++++++++
 target/loongarch/meson.build                   |   3 +-
 18 files changed, 497 insertions(+), 170 deletions(-)
 create mode 100644 linux-user/include/host/ppc/host-signal.h
 create mode 100644 common-user/host/ppc/safe-syscall.inc.S

We have a test for one of TCG_TARGET_HAS_mulu2_i32 or
TCG_TARGET_HAS_muluh_i32 being defined, but the test
became non-functional when we changed to always define
all of these macros.

Replace this with a build-time test in tcg_gen_mulu2_i32.

Fixes: 25c4d9cc845 ("tcg: Always define all of the TCGOpcode enum members.")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1435
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg.h | 7 -------
 tcg/tcg-op.c      | 4 +++-
 2 files changed, 3 insertions(+), 8 deletions(-)

diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ typedef uint64_t TCGRegSet;
 #define TCG_TARGET_HAS_rem_i64          0
 #endif
 
-/* For 32-bit targets, some sort of unsigned widening multiply is required.  */
-#if TCG_TARGET_REG_BITS == 32 \
-    && !(defined(TCG_TARGET_HAS_mulu2_i32) \
-         || defined(TCG_TARGET_HAS_muluh_i32))
-# error "Missing unsigned widening multiply"
-#endif
-
 #if !defined(TCG_TARGET_HAS_v64) \
     && !defined(TCG_TARGET_HAS_v128) \
     && !defined(TCG_TARGET_HAS_v256)
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -XXX,XX +XXX,XX @@ void tcg_gen_mulu2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 arg1, TCGv_i32 arg2)
         tcg_gen_op3_i32(INDEX_op_muluh_i32, rh, arg1, arg2);
         tcg_gen_mov_i32(rl, t);
         tcg_temp_free_i32(t);
-    } else {
+    } else if (TCG_TARGET_REG_BITS == 64) {
         TCGv_i64 t0 = tcg_temp_new_i64();
         TCGv_i64 t1 = tcg_temp_new_i64();
         tcg_gen_extu_i32_i64(t0, arg1);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_mulu2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 arg1, TCGv_i32 arg2)
         tcg_gen_extr_i64_i32(rl, rh, t0);
         tcg_temp_free_i64(t0);
         tcg_temp_free_i64(t1);
+    } else {
+        qemu_build_not_reached();
     }
 }
 
-- 
2.34.1

Although we still can't use ldrd and strd for all operations,
increase the chances by getting the register allocation correct.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/arm/tcg-target-con-set.h |  7 ++++---
 tcg/arm/tcg-target-con-str.h |  2 ++
 tcg/arm/tcg-target.c.inc     | 28 ++++++++++++++++++----------
 3 files changed, 24 insertions(+), 13 deletions(-)

diff --git a/tcg/arm/tcg-target-con-set.h b/tcg/arm/tcg-target-con-set.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target-con-set.h
+++ b/tcg/arm/tcg-target-con-set.h
@@ -XXX,XX +XXX,XX @@ C_O0_I2(r, rIN)
 C_O0_I2(s, s)
 C_O0_I2(w, r)
 C_O0_I3(s, s, s)
+C_O0_I3(S, p, s)
 C_O0_I4(r, r, rI, rI)
-C_O0_I4(s, s, s, s)
+C_O0_I4(S, p, s, s)
 C_O1_I1(r, l)
 C_O1_I1(r, r)
 C_O1_I1(w, r)
@@ -XXX,XX +XXX,XX @@ C_O1_I2(w, w, wZ)
 C_O1_I3(w, w, w, w)
 C_O1_I4(r, r, r, rI, rI)
 C_O1_I4(r, r, rIN, rIK, 0)
-C_O2_I1(r, r, l)
-C_O2_I2(r, r, l, l)
+C_O2_I1(e, p, l)
+C_O2_I2(e, p, l, l)
 C_O2_I2(r, r, r, r)
 C_O2_I4(r, r, r, r, rIN, rIK)
 C_O2_I4(r, r, rI, rI, rIN, rIK)
diff --git a/tcg/arm/tcg-target-con-str.h b/tcg/arm/tcg-target-con-str.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target-con-str.h
+++ b/tcg/arm/tcg-target-con-str.h
@@ -XXX,XX +XXX,XX @@
  * Define constraint letters for register sets:
  * REGS(letter, register_mask)
  */
+REGS('e', ALL_GENERAL_REGS & 0x5555) /* even regs */
 REGS('r', ALL_GENERAL_REGS)
 REGS('l', ALL_QLOAD_REGS)
 REGS('s', ALL_QSTORE_REGS)
+REGS('S', ALL_QSTORE_REGS & 0x5555)  /* even qstore */
 REGS('w', ALL_VECTOR_REGS)
 
 /*
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_index(TCGContext *s, MemOp opc,
         tcg_out_ld32_r(s, COND_AL, datalo, addrlo, addend);
         break;
     case MO_UQ:
+        /* We used pair allocation for datalo, so already should be aligned. */
+        tcg_debug_assert((datalo & 1) == 0);
+        tcg_debug_assert(datahi == datalo + 1);
         /* LDRD requires alignment; double-check that. */
-        if (get_alignment_bits(opc) >= MO_64
-            && (datalo & 1) == 0 && datahi == datalo + 1) {
+        if (get_alignment_bits(opc) >= MO_64) {
             /*
              * Rm (the second address op) must not overlap Rt or Rt + 1.
              * Since datalo is aligned, we can simplify the test via alignment.
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp opc, TCGReg datalo,
         tcg_out_ld32_12(s, COND_AL, datalo, addrlo, 0);
         break;
     case MO_UQ:
+        /* We used pair allocation for datalo, so already should be aligned. */
+        tcg_debug_assert((datalo & 1) == 0);
+        tcg_debug_assert(datahi == datalo + 1);
         /* LDRD requires alignment; double-check that. */
-        if (get_alignment_bits(opc) >= MO_64
-            && (datalo & 1) == 0 && datahi == datalo + 1) {
+        if (get_alignment_bits(opc) >= MO_64) {
             tcg_out_ldrd_8(s, COND_AL, datalo, addrlo, 0);
         } else if (datalo == addrlo) {
             tcg_out_ld32_12(s, COND_AL, datahi, addrlo, 4);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_index(TCGContext *s, ARMCond cond, MemOp opc,
         tcg_out_st32_r(s, cond, datalo, addrlo, addend);
         break;
     case MO_64:
+        /* We used pair allocation for datalo, so already should be aligned. */
+        tcg_debug_assert((datalo & 1) == 0);
+        tcg_debug_assert(datahi == datalo + 1);
         /* STRD requires alignment; double-check that. */
-        if (get_alignment_bits(opc) >= MO_64
-            && (datalo & 1) == 0 && datahi == datalo + 1) {
+        if (get_alignment_bits(opc) >= MO_64) {
             tcg_out_strd_r(s, cond, datalo, addrlo, addend);
         } else if (scratch_addend) {
             tcg_out_st32_rwb(s, cond, datalo, addend, addrlo);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, MemOp opc, TCGReg datalo,
         tcg_out_st32_12(s, COND_AL, datalo, addrlo, 0);
         break;
     case MO_64:
+        /* We used pair allocation for datalo, so already should be aligned. */
+        tcg_debug_assert((datalo & 1) == 0);
+        tcg_debug_assert(datahi == datalo + 1);
         /* STRD requires alignment; double-check that. */
-        if (get_alignment_bits(opc) >= MO_64
-            && (datalo & 1) == 0 && datahi == datalo + 1) {
+        if (get_alignment_bits(opc) >= MO_64) {
             tcg_out_strd_8(s, COND_AL, datalo, addrlo, 0);
         } else {
             tcg_out_st32_12(s, COND_AL, datalo, addrlo, 0);
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_qemu_ld_i32:
         return TARGET_LONG_BITS == 32 ? C_O1_I1(r, l) : C_O1_I2(r, l, l);
     case INDEX_op_qemu_ld_i64:
-        return TARGET_LONG_BITS == 32 ? C_O2_I1(r, r, l) : C_O2_I2(r, r, l, l);
+        return TARGET_LONG_BITS == 32 ? C_O2_I1(e, p, l) : C_O2_I2(e, p, l, l);
     case INDEX_op_qemu_st_i32:
         return TARGET_LONG_BITS == 32 ? C_O0_I2(s, s) : C_O0_I3(s, s, s);
     case INDEX_op_qemu_st_i64:
-        return TARGET_LONG_BITS == 32 ? C_O0_I3(s, s, s) : C_O0_I4(s, s, s, s);
+        return TARGET_LONG_BITS == 32 ? C_O0_I3(S, p, s) : C_O0_I4(S, p, s, s);
 
     case INDEX_op_st_vec:
         return C_O0_I2(w, r);
-- 
2.34.1

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Message-Id: <20220729172141.1789105-2-richard.henderson@linaro.org>
---
 common-user/host/ppc/safe-syscall.inc.S | 107 ++++++++++++++++++++++++
 1 file changed, 107 insertions(+)
 create mode 100644 common-user/host/ppc/safe-syscall.inc.S

diff --git a/common-user/host/ppc/safe-syscall.inc.S b/common-user/host/ppc/safe-syscall.inc.S
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/common-user/host/ppc/safe-syscall.inc.S
@@ -XXX,XX +XXX,XX @@
+/*
+ * safe-syscall.inc.S : host-specific assembly fragment
+ * to handle signals occurring at the same time as system calls.
+ * This is intended to be included by common-user/safe-syscall.S
+ *
+ * Copyright (C) 2022 Linaro, Ltd.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+/*
+ * Standardize on the _CALL_FOO symbols used by GCC:
+ * Apple XCode does not define _CALL_DARWIN.
+ * Clang defines _CALL_ELF (64-bit) but not _CALL_SYSV (32-bit).
+ */
+#if !defined(_CALL_SYSV) && \
+    !defined(_CALL_DARWIN) && \
+    !defined(_CALL_AIX) && \
+    !defined(_CALL_ELF)
+# if defined(__APPLE__)
+#  define _CALL_DARWIN
+# elif defined(__ELF__) && TCG_TARGET_REG_BITS == 32
+#  define _CALL_SYSV
+# else
+#  error "Unknown ABI"
+# endif
+#endif 
+
+#ifndef _CALL_SYSV
+# error "Unsupported ABI"
+#endif
+
+
+        .global safe_syscall_base
+        .global safe_syscall_start
+        .global safe_syscall_end
+        .type   safe_syscall_base, @function
+
+        .text
+
+        /*
+         * This is the entry point for making a system call. The calling
+         * convention here is that of a C varargs function with the
+         * first argument an 'int *' to the signal_pending flag, the
+         * second one the system call number (as a 'long'), and all further
+         * arguments being syscall arguments (also 'long').
+         */
+safe_syscall_base:
+        .cfi_startproc
+        stwu    1, -8(1)
+        .cfi_def_cfa_offset 8
+        stw     30, 4(1)
+        .cfi_offset 30, -4
+
+        /*
+         * We enter with r3 == &signal_pending
+         *               r4 == syscall number
+         *               r5 ... r10 == syscall arguments
+         *               and return the result in r3
+         * and the syscall instruction needs
+         *               r0 == syscall number
+         *               r3 ... r8 == syscall arguments
+         *               and returns the result in r3
+         * Shuffle everything around appropriately.
+         */
+        mr      30, 3           /* signal_pending */
+        mr      0, 4            /* syscall number */
+        mr      3, 5            /* syscall arguments */
+        mr      4, 6
+        mr      5, 7
+        mr      6, 8
+        mr      7, 9
+        mr      8, 10
+
+        /*
+         * This next sequence of code works in conjunction with the
+         * rewind_if_safe_syscall_function(). If a signal is taken
+         * and the interrupted PC is anywhere between 'safe_syscall_start'
+         * and 'safe_syscall_end' then we rewind it to 'safe_syscall_start'.
+         * The code sequence must therefore be able to cope with this, and
+         * the syscall instruction must be the final one in the sequence.
+         */
+safe_syscall_start:
+        /* if signal_pending is non-zero, don't do the call */
+        lwz     12, 0(30)
+        cmpwi   0, 12, 0
+        bne-    2f
+        sc
+safe_syscall_end:
+        /* code path when we did execute the syscall */
+        lwz     30, 4(1)        /* restore r30 */
+        addi    1, 1, 8         /* restore stack */
+        .cfi_restore 30
+        .cfi_def_cfa_offset 0
+        bnslr+                  /* return on success */
+        b       safe_syscall_set_errno_tail
+
+        /* code path when we didn't execute the syscall */
+2:      lwz     30, 4(1)
+        addi    1, 1, 8
+        addi    3, 0, QEMU_ERESTARTSYS
+        b       safe_syscall_set_errno_tail
+
+        .cfi_endproc
+
+        .size   safe_syscall_base, .-safe_syscall_base
-- 
2.34.1

This commit re-enables ppc32 as a linux-user host,
as existance of the directory is noted by configure.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1097
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Message-Id: <20220729172141.1789105-3-richard.henderson@linaro.org>
---
 linux-user/include/host/ppc/host-signal.h | 39 +++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 linux-user/include/host/ppc/host-signal.h

diff --git a/linux-user/include/host/ppc/host-signal.h b/linux-user/include/host/ppc/host-signal.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/linux-user/include/host/ppc/host-signal.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * host-signal.h: signal info dependent on the host architecture
+ *
+ * Copyright (c) 2022 Linaro Ltd.
+ *
+ * This work is licensed under the terms of the GNU LGPL, version 2.1 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef PPC_HOST_SIGNAL_H
+#define PPC_HOST_SIGNAL_H
+
+#include <asm/ptrace.h>
+
+/* The third argument to a SA_SIGINFO handler is ucontext_t. */
+typedef ucontext_t host_sigcontext;
+
+static inline uintptr_t host_signal_pc(host_sigcontext *uc)
+{
+    return uc->uc_mcontext.regs->nip;
+}
+
+static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
+{
+    uc->uc_mcontext.regs->nip = pc;
+}
+
+static inline void *host_signal_mask(host_sigcontext *uc)
+{
+    return &uc->uc_sigmask;
+}
+
+static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
+{
+    return uc->uc_mcontext.regs->trap != 0x400
+        && (uc->uc_mcontext.regs->dsisr & 0x02000000);
+}
+
+#endif
-- 
2.34.1

Marking helpers __attribute__((noinline)) prevents an issue
with GCC's ipa-split pass under --enable-lto.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1454
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Idan Horowitz <idan.horowitz@gmail.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/helper-proto.h | 32 ++++++++++++++++++++++++--------
 1 file changed, 24 insertions(+), 8 deletions(-)

diff --git a/include/exec/helper-proto.h b/include/exec/helper-proto.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/helper-proto.h
+++ b/include/exec/helper-proto.h
@@ -XXX,XX +XXX,XX @@
 
 #include "exec/helper-head.h"
 
+/*
+ * Work around an issue with --enable-lto, in which GCC's ipa-split pass
+ * decides to split out the noreturn code paths that raise an exception,
+ * taking the __builtin_return_address() along into the new function,
+ * where it no longer computes a value that returns to TCG generated code.
+ * Despite the name, the noinline attribute affects splitter, so this
+ * prevents the optimization in question.  Given that helpers should not
+ * otherwise be called directly, this should have any other visible effect.
+ *
+ * See https://gitlab.com/qemu-project/qemu/-/issues/1454
+ */
+#define DEF_HELPER_ATTR  __attribute__((noinline))
+
 #define DEF_HELPER_FLAGS_0(name, flags, ret) \
-dh_ctype(ret) HELPER(name) (void);
+dh_ctype(ret) HELPER(name) (void) DEF_HELPER_ATTR;
 
 #define DEF_HELPER_FLAGS_1(name, flags, ret, t1) \
-dh_ctype(ret) HELPER(name) (dh_ctype(t1));
+dh_ctype(ret) HELPER(name) (dh_ctype(t1)) DEF_HELPER_ATTR;
 
 #define DEF_HELPER_FLAGS_2(name, flags, ret, t1, t2) \
-dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2));
+dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2)) DEF_HELPER_ATTR;
 
 #define DEF_HELPER_FLAGS_3(name, flags, ret, t1, t2, t3) \
-dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3));
+dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), \
+                            dh_ctype(t3)) DEF_HELPER_ATTR;
 
 #define DEF_HELPER_FLAGS_4(name, flags, ret, t1, t2, t3, t4) \
 dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3), \
-                                   dh_ctype(t4));
+                            dh_ctype(t4)) DEF_HELPER_ATTR;
 
 #define DEF_HELPER_FLAGS_5(name, flags, ret, t1, t2, t3, t4, t5) \
 dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3), \
-                            dh_ctype(t4), dh_ctype(t5));
+                            dh_ctype(t4), dh_ctype(t5)) DEF_HELPER_ATTR;
 
 #define DEF_HELPER_FLAGS_6(name, flags, ret, t1, t2, t3, t4, t5, t6) \
 dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3), \
-                            dh_ctype(t4), dh_ctype(t5), dh_ctype(t6));
+                            dh_ctype(t4), dh_ctype(t5), \
+                            dh_ctype(t6)) DEF_HELPER_ATTR;
 
 #define DEF_HELPER_FLAGS_7(name, flags, ret, t1, t2, t3, t4, t5, t6, t7) \
 dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3), \
                             dh_ctype(t4), dh_ctype(t5), dh_ctype(t6), \
-                            dh_ctype(t7));
+                            dh_ctype(t7)) DEF_HELPER_ATTR;
 
 #define IN_HELPER_PROTO
 
@@ -XXX,XX +XXX,XX @@ dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3), \
 #undef DEF_HELPER_FLAGS_5
 #undef DEF_HELPER_FLAGS_6
 #undef DEF_HELPER_FLAGS_7
+#undef DEF_HELPER_ATTR
 
 #endif /* HELPER_PROTO_H */
-- 
2.34.1

Reuse the decodetree based disassembler from
target/loongarch/ for tcg/loongarch64/.

The generation of decode-insns.c.inc into ./libcommon.fa.p/ could
eventually result in conflict, if any other host requires the same
trick, but this is good enough for now.

Reviewed-by: WANG Xuerui <git@xen0n.name>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 disas.c                      | 2 ++
 target/loongarch/meson.build | 3 ++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/disas.c b/disas.c
index XXXXXXX..XXXXXXX 100644
--- a/disas.c
+++ b/disas.c
@@ -XXX,XX +XXX,XX @@ static void initialize_debug_host(CPUDebug *s)
     s->info.cap_insn_split = 6;
 #elif defined(__hppa__)
     s->info.print_insn = print_insn_hppa;
+#elif defined(__loongarch__)
+    s->info.print_insn = print_insn_loongarch;
 #endif
 }
 
diff --git a/target/loongarch/meson.build b/target/loongarch/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/meson.build
+++ b/target/loongarch/meson.build
@@ -XXX,XX +XXX,XX @@ gen = decodetree.process('insns.decode')
 loongarch_ss = ss.source_set()
 loongarch_ss.add(files(
   'cpu.c',
-  'disas.c',
 ))
 loongarch_tcg_ss = ss.source_set()
 loongarch_tcg_ss.add(gen)
@@ -XXX,XX +XXX,XX @@ loongarch_softmmu_ss.add(files(
   'iocsr_helper.c',
 ))
 
+common_ss.add(when: 'CONFIG_LOONGARCH_DIS', if_true: [files('disas.c'), gen])
+
 loongarch_ss.add_all(when: 'CONFIG_TCG', if_true: [loongarch_tcg_ss])
 
 target_arch += {'loongarch': loongarch_ss}
-- 
2.34.1

While jirl shares the same instruction format as bne etc,
it is not assembled the same.  In particular, rd is printed
first not second and the immediate is not pc-relative.

Decode into the arg_rr_i structure, which prints correctly.
This changes the "offs" member to "imm", to update translate.

Reviewed-by: WANG Xuerui <git@xen0n.name>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/loongarch/insns.decode                  | 3 ++-
 target/loongarch/disas.c                       | 2 +-
 target/loongarch/insn_trans/trans_branch.c.inc | 2 +-
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/target/loongarch/insns.decode b/target/loongarch/insns.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/insns.decode
+++ b/target/loongarch/insns.decode
@@ -XXX,XX +XXX,XX @@
 @rr_ui12                 .... ...... imm:12 rj:5 rd:5    &rr_i
 @rr_i14s2         .... ....  .............. rj:5 rd:5    &rr_i imm=%i14s2
 @rr_i16                     .... .. imm:s16 rj:5 rd:5    &rr_i
+@rr_i16s2         .... ..  ................ rj:5 rd:5    &rr_i imm=%offs16
 @hint_r_i12           .... ...... imm:s12 rj:5 hint:5    &hint_r_i
 @rrr_sa2p1        .... ........ ... .. rk:5 rj:5 rd:5    &rrr_sa  sa=%sa2p1
 @rrr_sa2        .... ........ ... sa:2 rk:5 rj:5 rd:5    &rrr_sa
@@ -XXX,XX +XXX,XX @@ beqz            0100 00 ................ ..... .....     @r_offs21
 bnez            0100 01 ................ ..... .....     @r_offs21
 bceqz           0100 10 ................ 00 ... .....    @c_offs21
 bcnez           0100 10 ................ 01 ... .....    @c_offs21
-jirl            0100 11 ................ ..... .....     @rr_offs16
+jirl            0100 11 ................ ..... .....     @rr_i16s2
 b               0101 00 ..........................       @offs26
 bl              0101 01 ..........................       @offs26
 beq             0101 10 ................ ..... .....     @rr_offs16
diff --git a/target/loongarch/disas.c b/target/loongarch/disas.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/disas.c
+++ b/target/loongarch/disas.c
@@ -XXX,XX +XXX,XX @@ INSN(beqz,         r_offs)
 INSN(bnez,         r_offs)
 INSN(bceqz,        c_offs)
 INSN(bcnez,        c_offs)
-INSN(jirl,         rr_offs)
+INSN(jirl,         rr_i)
 INSN(b,            offs)
 INSN(bl,           offs)
 INSN(beq,          rr_offs)
diff --git a/target/loongarch/insn_trans/trans_branch.c.inc b/target/loongarch/insn_trans/trans_branch.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/insn_trans/trans_branch.c.inc
+++ b/target/loongarch/insn_trans/trans_branch.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_jirl(DisasContext *ctx, arg_jirl *a)
     TCGv dest = gpr_dst(ctx, a->rd, EXT_NONE);
     TCGv src1 = gpr_src(ctx, a->rj, EXT_NONE);
 
-    tcg_gen_addi_tl(cpu_pc, src1, a->offs);
+    tcg_gen_addi_tl(cpu_pc, src1, a->imm);
     tcg_gen_movi_tl(dest, ctx->base.pc_next + 4);
     gen_set_gpr(a->rd, dest, EXT_NONE);
     tcg_gen_lookup_and_goto_ptr();
-- 
2.34.1

Print both the raw field and the resolved pc-relative
address, as we do for branches.

Reviewed-by: WANG Xuerui <git@xen0n.name>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/loongarch/disas.c | 37 +++++++++++++++++++++++++++++++++----
 1 file changed, 33 insertions(+), 4 deletions(-)

diff --git a/target/loongarch/disas.c b/target/loongarch/disas.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/disas.c
+++ b/target/loongarch/disas.c
@@ -XXX,XX +XXX,XX @@ INSN(fsel,         fffc)
 INSN(addu16i_d,    rr_i)
 INSN(lu12i_w,      r_i)
 INSN(lu32i_d,      r_i)
-INSN(pcaddi,       r_i)
-INSN(pcalau12i,    r_i)
-INSN(pcaddu12i,    r_i)
-INSN(pcaddu18i,    r_i)
 INSN(ll_w,         rr_i)
 INSN(sc_w,         rr_i)
 INSN(ll_d,         rr_i)
@@ -XXX,XX +XXX,XX @@ static bool trans_fcmp_cond_##suffix(DisasContext *ctx, \
 
 FCMP_INSN(s)
 FCMP_INSN(d)
+
+#define PCADD_INSN(name)                                        \
+static bool trans_##name(DisasContext *ctx, arg_##name *a)      \
+{                                                               \
+    output(ctx, #name, "r%d, %d # 0x%" PRIx64,                  \
+           a->rd, a->imm, gen_##name(ctx->pc, a->imm));         \
+    return true;                                                \
+}
+
+static uint64_t gen_pcaddi(uint64_t pc, int imm)
+{
+    return pc + (imm << 2);
+}
+
+static uint64_t gen_pcalau12i(uint64_t pc, int imm)
+{
+    return (pc + (imm << 12)) & ~0xfff;
+}
+
+static uint64_t gen_pcaddu12i(uint64_t pc, int imm)
+{
+    return pc + (imm << 12);
+}
+
+static uint64_t gen_pcaddu18i(uint64_t pc, int imm)
+{
+    return pc + ((uint64_t)(imm) << 18);
+}
+
+PCADD_INSN(pcaddi)
+PCADD_INSN(pcalau12i)
+PCADD_INSN(pcaddu12i)
+PCADD_INSN(pcaddu18i)
-- 
2.34.1

From: Rui Wang <wangrui@loongson.cn>

diff:
  Imm                 Before                  After
  0000000000000000    addi.w  rd, zero, 0     addi.w  rd, zero, 0
                      lu52i.d rd, zero, 0
  00000000fffff800    lu12i.w rd, -1          addi.w  rd, zero, -2048
                      ori     rd, rd, 2048    lu32i.d rd, 0
                      lu32i.d rd, 0

Reviewed-by: WANG Xuerui <git@xen0n.name>
Signed-off-by: Rui Wang <wangrui@loongson.cn>
Message-Id: <20221107144713.845550-1-wangrui@loongson.cn>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/loongarch64/tcg-target.c.inc | 35 +++++++++++---------------------
 1 file changed, 12 insertions(+), 23 deletions(-)

Regenerate with ADDU16I included:

$ cd loongarch-opcodes/scripts/go
   $ go run ./genqemutcgdefs > $QEMU/tcg/loongarch64/tcg-insn-defs.c.inc

Reviewed-by: WANG Xuerui <git@xen0n.name>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/loongarch64/tcg-insn-defs.c.inc | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/tcg/loongarch64/tcg-insn-defs.c.inc b/tcg/loongarch64/tcg-insn-defs.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/loongarch64/tcg-insn-defs.c.inc
+++ b/tcg/loongarch64/tcg-insn-defs.c.inc
@@ -XXX,XX +XXX,XX @@
  *
  * This file is auto-generated by genqemutcgdefs from
  * https://github.com/loongson-community/loongarch-opcodes,
- * from commit 961f0c60f5b63e574d785995600c71ad5413fdc4.
+ * from commit 25ca7effe9d88101c1cf96c4005423643386d81f.
  * DO NOT EDIT.
  */
 
@@ -XXX,XX +XXX,XX @@ typedef enum {
     OPC_ANDI = 0x03400000,
     OPC_ORI = 0x03800000,
     OPC_XORI = 0x03c00000,
+    OPC_ADDU16I_D = 0x10000000,
     OPC_LU12I_W = 0x14000000,
     OPC_CU32I_D = 0x16000000,
     OPC_PCADDU2I = 0x18000000,
@@ -XXX,XX +XXX,XX @@ tcg_out_opc_xori(TCGContext *s, TCGReg d, TCGReg j, uint32_t uk12)
     tcg_out32(s, encode_djuk12_insn(OPC_XORI, d, j, uk12));
 }
 
+/* Emits the `addu16i.d d, j, sk16` instruction.  */
+static void __attribute__((unused))
+tcg_out_opc_addu16i_d(TCGContext *s, TCGReg d, TCGReg j, int32_t sk16)
+{
+    tcg_out32(s, encode_djsk16_insn(OPC_ADDU16I_D, d, j, sk16));
+}
+
 /* Emits the `lu12i.w d, sj20` instruction.  */
 static void __attribute__((unused))
 tcg_out_opc_lu12i_w(TCGContext *s, TCGReg d, int32_t sj20)
-- 
2.34.1

Adjust the constraints to allow any int32_t for immediate
addition.  Split immediate adds into addu16i + addi, which
covers quite a lot of the immediate space.  For the hole in
the middle, load the constant into TMP0 instead.

Reviewed-by: WANG Xuerui <git@xen0n.name>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/loongarch64/tcg-target-con-set.h |  4 +-
 tcg/loongarch64/tcg-target-con-str.h |  2 +-
 tcg/loongarch64/tcg-target.c.inc     | 57 ++++++++++++++++++++++++----
 3 files changed, 53 insertions(+), 10 deletions(-)

diff --git a/tcg/loongarch64/tcg-target-con-set.h b/tcg/loongarch64/tcg-target-con-set.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/loongarch64/tcg-target-con-set.h
+++ b/tcg/loongarch64/tcg-target-con-set.h
@@ -XXX,XX +XXX,XX @@ C_O1_I1(r, L)
 C_O1_I2(r, r, rC)
 C_O1_I2(r, r, ri)
 C_O1_I2(r, r, rI)
+C_O1_I2(r, r, rJ)
 C_O1_I2(r, r, rU)
 C_O1_I2(r, r, rW)
 C_O1_I2(r, r, rZ)
 C_O1_I2(r, 0, rZ)
-C_O1_I2(r, rZ, rN)
+C_O1_I2(r, rZ, ri)
+C_O1_I2(r, rZ, rJ)
 C_O1_I2(r, rZ, rZ)
diff --git a/tcg/loongarch64/tcg-target-con-str.h b/tcg/loongarch64/tcg-target-con-str.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/loongarch64/tcg-target-con-str.h
+++ b/tcg/loongarch64/tcg-target-con-str.h
@@ -XXX,XX +XXX,XX @@ REGS('L', ALL_GENERAL_REGS & ~SOFTMMU_RESERVE_REGS)
  * CONST(letter, TCG_CT_CONST_* bit set)
  */
 CONST('I', TCG_CT_CONST_S12)
-CONST('N', TCG_CT_CONST_N12)
+CONST('J', TCG_CT_CONST_S32)
 CONST('U', TCG_CT_CONST_U12)
 CONST('Z', TCG_CT_CONST_ZERO)
 CONST('C', TCG_CT_CONST_C12)
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const int tcg_target_call_oarg_regs[] = {
 
 #define TCG_CT_CONST_ZERO  0x100
 #define TCG_CT_CONST_S12   0x200
-#define TCG_CT_CONST_N12   0x400
+#define TCG_CT_CONST_S32   0x400
 #define TCG_CT_CONST_U12   0x800
 #define TCG_CT_CONST_C12   0x1000
 #define TCG_CT_CONST_WSZ   0x2000
@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
     if ((ct & TCG_CT_CONST_S12) && val == sextreg(val, 0, 12)) {
         return true;
     }
-    if ((ct & TCG_CT_CONST_N12) && -val == sextreg(-val, 0, 12)) {
+    if ((ct & TCG_CT_CONST_S32) && val == (int32_t)val) {
         return true;
     }
     if ((ct & TCG_CT_CONST_U12) && val >= 0 && val <= 0xfff) {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi(TCGContext *s, TCGType type, TCGReg rd,
     }
 }
 
+static void tcg_out_addi(TCGContext *s, TCGType type, TCGReg rd,
+                         TCGReg rs, tcg_target_long imm)
+{
+    tcg_target_long lo12 = sextreg(imm, 0, 12);
+    tcg_target_long hi16 = sextreg(imm - lo12, 16, 16);
+
+    /*
+     * Note that there's a hole in between hi16 and lo12:
+     *
+     *       3                   2                   1                   0
+     *     1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
+     * ...+-------------------------------+-------+-----------------------+
+     *    |             hi16              |       |          lo12         |
+     * ...+-------------------------------+-------+-----------------------+
+     *
+     * For bits within that hole, it's more efficient to use LU12I and ADD.
+     */
+    if (imm == (hi16 << 16) + lo12) {
+        if (hi16) {
+            tcg_out_opc_addu16i_d(s, rd, rs, hi16);
+            rs = rd;
+        }
+        if (type == TCG_TYPE_I32) {
+            tcg_out_opc_addi_w(s, rd, rs, lo12);
+        } else if (lo12) {
+            tcg_out_opc_addi_d(s, rd, rs, lo12);
+        } else {
+            tcg_out_mov(s, type, rd, rs);
+        }
+    } else {
+        tcg_out_movi(s, type, TCG_REG_TMP0, imm);
+        if (type == TCG_TYPE_I32) {
+            tcg_out_opc_add_w(s, rd, rs, TCG_REG_TMP0);
+        } else {
+            tcg_out_opc_add_d(s, rd, rs, TCG_REG_TMP0);
+        }
+    }
+}
+
 static void tcg_out_ext8u(TCGContext *s, TCGReg ret, TCGReg arg)
 {
     tcg_out_opc_andi(s, ret, arg, 0xff);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
 
     case INDEX_op_add_i32:
         if (c2) {
-            tcg_out_opc_addi_w(s, a0, a1, a2);
+            tcg_out_addi(s, TCG_TYPE_I32, a0, a1, a2);
         } else {
             tcg_out_opc_add_w(s, a0, a1, a2);
         }
         break;
     case INDEX_op_add_i64:
         if (c2) {
-            tcg_out_opc_addi_d(s, a0, a1, a2);
+            tcg_out_addi(s, TCG_TYPE_I64, a0, a1, a2);
         } else {
             tcg_out_opc_add_d(s, a0, a1, a2);
         }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
 
     case INDEX_op_sub_i32:
         if (c2) {
-            tcg_out_opc_addi_w(s, a0, a1, -a2);
+            tcg_out_addi(s, TCG_TYPE_I32, a0, a1, -a2);
         } else {
             tcg_out_opc_sub_w(s, a0, a1, a2);
         }
         break;
     case INDEX_op_sub_i64:
         if (c2) {
-            tcg_out_opc_addi_d(s, a0, a1, -a2);
+            tcg_out_addi(s, TCG_TYPE_I64, a0, a1, -a2);
         } else {
             tcg_out_opc_sub_d(s, a0, a1, a2);
         }
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
         return C_O1_I2(r, r, ri);
 
     case INDEX_op_add_i32:
+        return C_O1_I2(r, r, ri);
     case INDEX_op_add_i64:
-        return C_O1_I2(r, r, rI);
+        return C_O1_I2(r, r, rJ);
 
     case INDEX_op_and_i32:
     case INDEX_op_and_i64:
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
         return C_O1_I2(r, 0, rZ);
 
     case INDEX_op_sub_i32:
+        return C_O1_I2(r, rZ, ri);
     case INDEX_op_sub_i64:
-        return C_O1_I2(r, rZ, rN);
+        return C_O1_I2(r, rZ, rJ);
 
     case INDEX_op_mul_i32:
     case INDEX_op_mul_i64:
-- 
2.34.1

Split out a helper function, tcg_out_setcond_int, which
does not always produce the complete boolean result, but
returns a set of flags to do so.

Accept all int32_t as constant input, so that LE/GT can
adjust the constant to LT.

Reviewed-by: WANG Xuerui <git@xen0n.name>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/loongarch64/tcg-target.c.inc | 165 +++++++++++++++++++++----------
 1 file changed, 115 insertions(+), 50 deletions(-)

diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_clzctz(TCGContext *s, LoongArchInsn opc,
     tcg_out_opc_or(s, a0, TCG_REG_TMP0, a0);
 }
 
-static void tcg_out_setcond(TCGContext *s, TCGCond cond, TCGReg ret,
-                            TCGReg arg1, TCGReg arg2, bool c2)
-{
-    TCGReg tmp;
+#define SETCOND_INV    TCG_TARGET_NB_REGS
+#define SETCOND_NEZ    (SETCOND_INV << 1)
+#define SETCOND_FLAGS  (SETCOND_INV | SETCOND_NEZ)
 
-    if (c2) {
-        tcg_debug_assert(arg2 == 0);
+static int tcg_out_setcond_int(TCGContext *s, TCGCond cond, TCGReg ret,
+                               TCGReg arg1, tcg_target_long arg2, bool c2)
+{
+    int flags = 0;
+
+    switch (cond) {
+    case TCG_COND_EQ:    /* -> NE  */
+    case TCG_COND_GE:    /* -> LT  */
+    case TCG_COND_GEU:   /* -> LTU */
+    case TCG_COND_GT:    /* -> LE  */
+    case TCG_COND_GTU:   /* -> LEU */
+        cond = tcg_invert_cond(cond);
+        flags ^= SETCOND_INV;
+        break;
+    default:
+        break;
     }
 
     switch (cond) {
-    case TCG_COND_EQ:
-        if (c2) {
-            tmp = arg1;
-        } else {
-            tcg_out_opc_sub_d(s, ret, arg1, arg2);
-            tmp = ret;
-        }
-        tcg_out_opc_sltui(s, ret, tmp, 1);
-        break;
-    case TCG_COND_NE:
-        if (c2) {
-            tmp = arg1;
-        } else {
-            tcg_out_opc_sub_d(s, ret, arg1, arg2);
-            tmp = ret;
-        }
-        tcg_out_opc_sltu(s, ret, TCG_REG_ZERO, tmp);
-        break;
-    case TCG_COND_LT:
-        tcg_out_opc_slt(s, ret, arg1, arg2);
-        break;
-    case TCG_COND_GE:
-        tcg_out_opc_slt(s, ret, arg1, arg2);
-        tcg_out_opc_xori(s, ret, ret, 1);
-        break;
     case TCG_COND_LE:
-        tcg_out_setcond(s, TCG_COND_GE, ret, arg2, arg1, false);
-        break;
-    case TCG_COND_GT:
-        tcg_out_setcond(s, TCG_COND_LT, ret, arg2, arg1, false);
-        break;
-    case TCG_COND_LTU:
-        tcg_out_opc_sltu(s, ret, arg1, arg2);
-        break;
-    case TCG_COND_GEU:
-        tcg_out_opc_sltu(s, ret, arg1, arg2);
-        tcg_out_opc_xori(s, ret, ret, 1);
-        break;
     case TCG_COND_LEU:
-        tcg_out_setcond(s, TCG_COND_GEU, ret, arg2, arg1, false);
+        /*
+         * If we have a constant input, the most efficient way to implement
+         * LE is by adding 1 and using LT.  Watch out for wrap around for LEU.
+         * We don't need to care for this for LE because the constant input
+         * is still constrained to int32_t, and INT32_MAX+1 is representable
+         * in the 64-bit temporary register.
+         */
+        if (c2) {
+            if (cond == TCG_COND_LEU) {
+                /* unsigned <= -1 is true */
+                if (arg2 == -1) {
+                    tcg_out_movi(s, TCG_TYPE_REG, ret, !(flags & SETCOND_INV));
+                    return ret;
+                }
+                cond = TCG_COND_LTU;
+            } else {
+                cond = TCG_COND_LT;
+            }
+            arg2 += 1;
+        } else {
+            TCGReg tmp = arg2;
+            arg2 = arg1;
+            arg1 = tmp;
+            cond = tcg_swap_cond(cond);    /* LE -> GE */
+            cond = tcg_invert_cond(cond);  /* GE -> LT */
+            flags ^= SETCOND_INV;
+        }
         break;
-    case TCG_COND_GTU:
-        tcg_out_setcond(s, TCG_COND_LTU, ret, arg2, arg1, false);
+    default:
         break;
+    }
+
+    switch (cond) {
+    case TCG_COND_NE:
+        flags |= SETCOND_NEZ;
+        if (!c2) {
+            tcg_out_opc_xor(s, ret, arg1, arg2);
+        } else if (arg2 == 0) {
+            ret = arg1;
+        } else if (arg2 >= 0 && arg2 <= 0xfff) {
+            tcg_out_opc_xori(s, ret, arg1, arg2);
+        } else {
+            tcg_out_addi(s, TCG_TYPE_REG, ret, arg1, -arg2);
+        }
+        break;
+
+    case TCG_COND_LT:
+    case TCG_COND_LTU:
+        if (c2) {
+            if (arg2 >= -0x800 && arg2 <= 0x7ff) {
+                if (cond == TCG_COND_LT) {
+                    tcg_out_opc_slti(s, ret, arg1, arg2);
+                } else {
+                    tcg_out_opc_sltui(s, ret, arg1, arg2);
+                }
+                break;
+            }
+            tcg_out_movi(s, TCG_TYPE_REG, TCG_REG_TMP0, arg2);
+            arg2 = TCG_REG_TMP0;
+        }
+        if (cond == TCG_COND_LT) {
+            tcg_out_opc_slt(s, ret, arg1, arg2);
+        } else {
+            tcg_out_opc_sltu(s, ret, arg1, arg2);
+        }
+        break;
+
     default:
         g_assert_not_reached();
         break;
     }
+
+    return ret | flags;
+}
+
+static void tcg_out_setcond(TCGContext *s, TCGCond cond, TCGReg ret,
+                            TCGReg arg1, tcg_target_long arg2, bool c2)
+{
+    int tmpflags = tcg_out_setcond_int(s, cond, ret, arg1, arg2, c2);
+
+    if (tmpflags != ret) {
+        TCGReg tmp = tmpflags & ~SETCOND_FLAGS;
+
+        switch (tmpflags & SETCOND_FLAGS) {
+        case SETCOND_INV:
+            /* Intermediate result is boolean: simply invert. */
+            tcg_out_opc_xori(s, ret, tmp, 1);
+            break;
+        case SETCOND_NEZ:
+            /* Intermediate result is zero/non-zero: test != 0. */
+            tcg_out_opc_sltu(s, ret, TCG_REG_ZERO, tmp);
+            break;
+        case SETCOND_NEZ | SETCOND_INV:
+            /* Intermediate result is zero/non-zero: test == 0. */
+            tcg_out_opc_sltui(s, ret, tmp, 1);
+            break;
+        default:
+            g_assert_not_reached();
+        }
+    }
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_ctz_i64:
         return C_O1_I2(r, r, rW);
 
-    case INDEX_op_setcond_i32:
-    case INDEX_op_setcond_i64:
-        return C_O1_I2(r, r, rZ);
-
     case INDEX_op_deposit_i32:
     case INDEX_op_deposit_i64:
         /* Must deposit into the same register as input */
         return C_O1_I2(r, 0, rZ);
 
     case INDEX_op_sub_i32:
+    case INDEX_op_setcond_i32:
         return C_O1_I2(r, rZ, ri);
     case INDEX_op_sub_i64:
+    case INDEX_op_setcond_i64:
         return C_O1_I2(r, rZ, rJ);
 
     case INDEX_op_mul_i32:
-- 
2.34.1

Reviewed-by: WANG Xuerui <git@xen0n.name>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/loongarch64/tcg-target-con-set.h |  1 +
 tcg/loongarch64/tcg-target.h         |  4 ++--
 tcg/loongarch64/tcg-target.c.inc     | 33 ++++++++++++++++++++++++++++
 3 files changed, 36 insertions(+), 2 deletions(-)

The old implementation replaces two insns, swapping between

b       <dest>
        nop
and
        pcaddu18i tmp, <dest>
        jirl      zero, tmp, <dest> & 0xffff

There is a race condition in which a thread could be stopped at
the jirl, i.e. with the top of the address loaded, and when
restarted we have re-linked to a different TB, so that the top
half no longer matches the bottom half.

Note that while we never directly re-link to a different TB, we
can link, unlink, and link again all while the stopped thread
remains stopped.

The new implementation replaces only one insn, swapping between

b       <dest>
and
        pcadd   tmp, <jmp_addr>

falling through to load the address from tmp, and branch.

Reviewed-by: WANG Xuerui <git@xen0n.name>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/loongarch64/tcg-target.h     |  7 +---
 tcg/loongarch64/tcg-target.c.inc | 72 ++++++++++++++------------------
 2 files changed, 33 insertions(+), 46 deletions(-)

diff --git a/tcg/loongarch64/tcg-target.h b/tcg/loongarch64/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/loongarch64/tcg-target.h
+++ b/tcg/loongarch64/tcg-target.h
@@ -XXX,XX +XXX,XX @@
 
 #define TCG_TARGET_INSN_UNIT_SIZE 4
 #define TCG_TARGET_NB_REGS 32
-/*
- * PCADDU18I + JIRL sequence can give 20 + 16 + 2 = 38 bits
- * signed offset, which is +/- 128 GiB.
- */
-#define MAX_CODE_GEN_BUFFER_SIZE  (128 * GiB)
+
+#define MAX_CODE_GEN_BUFFER_SIZE  ((size_t)-1)
 
 typedef enum {
     TCG_REG_ZERO,
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args)
 #endif
 }
 
-/* LoongArch uses `andi zero, zero, 0` as NOP.  */
-#define NOP OPC_ANDI
-static void tcg_out_nop(TCGContext *s)
-{
-    tcg_out32(s, NOP);
-}
-
-void tb_target_set_jmp_target(const TranslationBlock *tb, int n,
-                              uintptr_t jmp_rx, uintptr_t jmp_rw)
-{
-    tcg_insn_unit i1, i2;
-    ptrdiff_t upper, lower;
-    uintptr_t addr = tb->jmp_target_addr[n];
-    ptrdiff_t offset = (ptrdiff_t)(addr - jmp_rx) >> 2;
-
-    if (offset == sextreg(offset, 0, 26)) {
-        i1 = encode_sd10k16_insn(OPC_B, offset);
-        i2 = NOP;
-    } else {
-        tcg_debug_assert(offset == sextreg(offset, 0, 36));
-        lower = (int16_t)offset;
-        upper = (offset - lower) >> 16;
-
-        i1 = encode_dsj20_insn(OPC_PCADDU18I, TCG_REG_TMP0, upper);
-        i2 = encode_djsk16_insn(OPC_JIRL, TCG_REG_ZERO, TCG_REG_TMP0, lower);
-    }
-    uint64_t pair = ((uint64_t)i2 << 32) | i1;
-    qatomic_set((uint64_t *)jmp_rw, pair);
-    flush_idcache_range(jmp_rx, jmp_rw, 8);
-}
-
 /*
  * Entry-points
  */
@@ -XXX,XX +XXX,XX @@ static void tcg_out_exit_tb(TCGContext *s, uintptr_t a0)
 static void tcg_out_goto_tb(TCGContext *s, int which)
 {
     /*
-     * Ensure that patch area is 8-byte aligned so that an
-     * atomic write can be used to patch the target address.
+     * Direct branch, or load indirect address, to be patched
+     * by tb_target_set_jmp_target.  Check indirect load offset
+     * in range early, regardless of direct branch distance,
+     * via assert within tcg_out_opc_pcaddu2i.
      */
-    if ((uintptr_t)s->code_ptr & 7) {
-        tcg_out_nop(s);
-    }
+    uintptr_t i_addr = get_jmp_target_addr(s, which);
+    intptr_t i_disp = tcg_pcrel_diff(s, (void *)i_addr);
+
     set_jmp_insn_offset(s, which);
-    /*
-     * actual branch destination will be patched by
-     * tb_target_set_jmp_target later
-     */
-    tcg_out_opc_pcaddu18i(s, TCG_REG_TMP0, 0);
+    tcg_out_opc_pcaddu2i(s, TCG_REG_TMP0, i_disp >> 2);
+
+    /* Finish the load and indirect branch. */
+    tcg_out_ld(s, TCG_TYPE_PTR, TCG_REG_TMP0, TCG_REG_TMP0, 0);
     tcg_out_opc_jirl(s, TCG_REG_ZERO, TCG_REG_TMP0, 0);
     set_jmp_reset_offset(s, which);
 }
 
+void tb_target_set_jmp_target(const TranslationBlock *tb, int n,
+                              uintptr_t jmp_rx, uintptr_t jmp_rw)
+{
+    uintptr_t d_addr = tb->jmp_target_addr[n];
+    ptrdiff_t d_disp = (ptrdiff_t)(d_addr - jmp_rx) >> 2;
+    tcg_insn_unit insn;
+
+    /* Either directly branch, or load slot address for indirect branch. */
+    if (d_disp == sextreg(d_disp, 0, 26)) {
+        insn = encode_sd10k16_insn(OPC_B, d_disp);
+    } else {
+        uintptr_t i_addr = (uintptr_t)&tb->jmp_target_addr[n];
+        intptr_t i_disp = i_addr - jmp_rx;
+        insn = encode_dsj20_insn(OPC_PCADDU2I, TCG_REG_TMP0, i_disp >> 2);
+    }
+
+    qatomic_set((tcg_insn_unit *)jmp_rw, insn);
+    flush_idcache_range(jmp_rx, jmp_rw, 4);
+}
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
-- 
2.34.1