Series comparison

 [PULL 0/4] tcg patch queue
-The following changes since commit 2d20a57453f6a206938cbbf77bed0b378c806c1f:
+The following changes since commit 813bac3d8d70d85cb7835f7945eb9eed84c2d8d0:
-  Merge tag 'pull-fixes-for-7.1-200422-1' of https://github.com/stsquad/qemu into staging (2022-04-20 11:13:08 -0700)
+  Merge tag '2023q3-bsd-user-pull-request' of https://gitlab.com/bsdimp/qemu into staging (2023-08-29 08:58:00 -0400)
 are available in the Git repository at:
-  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20220420
+  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20230829
-for you to fetch changes up to a61532faa5a4d5e021e35b6a4a1e180c72d4a22f:
+for you to fetch changes up to dad2f2f5afbaf58d6056f31dfd4b9edd0854b8ab:
-  tcg: Add tcg_constant_ptr (2022-04-20 12:12:47 -0700)
+  tcg/sparc64: Disable TCG_TARGET_HAS_extr_i64_i32 (2023-08-29 09:57:39 -0700)
 ----------------------------------------------------------------
-Cleanup sysemu/tcg.h usage.
+softmmu: Use async_run_on_cpu in tcg_commit
-Fix indirect lowering vs cond branches
+tcg: Remove vecop_list check from tcg_gen_not_vec
-Remove ATOMIC_MMU_IDX
+tcg/sparc64: Disable TCG_TARGET_HAS_extr_i64_i32
 Add tcg_constant_ptr
 ----------------------------------------------------------------
-Richard Henderson (3):
+Richard Henderson (4):
-      tcg: Fix indirect lowering vs TCG_OPF_COND_BRANCH
+      softmmu: Assert data in bounds in iotlb_to_section
-      accel/tcg: Remove ATOMIC_MMU_IDX
+      softmmu: Use async_run_on_cpu in tcg_commit
-      tcg: Add tcg_constant_ptr
+      tcg: Remove vecop_list check from tcg_gen_not_vec
       tcg/sparc64: Disable TCG_TARGET_HAS_extr_i64_i32
-Thomas Huth (1):
+ include/exec/cpu-common.h    |  1 -
-      Don't include sysemu/tcg.h if it is not necessary
+ tcg/sparc64/tcg-target.h     |  2 +-
+ accel/tcg/cpu-exec-common.c  | 30 --------------------------
- include/tcg/tcg.h                |  4 ++++
+ softmmu/physmem.c            | 50 ++++++++++++++++++++++++++++++++------------
- accel/tcg/cputlb.c               |  1 -
+ tcg/tcg-op-vec.c             |  7 +++----
- accel/tcg/hmp.c                  |  1 -
+ tcg/sparc64/tcg-target.c.inc | 11 ----------
- accel/tcg/tcg-accel-ops-icount.c |  1 -
+files changed, 41 insertions(+), 60 deletions(-)
  accel/tcg/user-exec.c            |  1 -
  bsd-user/main.c                  |  1 -
  hw/virtio/vhost.c                |  1 -
  linux-user/main.c                |  1 -
  monitor/misc.c                   |  1 -
  target/arm/helper.c              |  1 -
  target/s390x/cpu_models_sysemu.c |  1 -
  target/s390x/helper.c            |  1 -
  tcg/tcg.c                        | 34 +++++++++++++++++++++++++++-------
 files changed, 31 insertions(+), 18 deletions(-)

-[PULL 4/4] tcg: Add tcg_constant_ptr
+[PULL 1/4] softmmu: Assert data in bounds in iotlb_to_section
-Similar to tcg_const_ptr, defer to tcg_constant_{i32,i64}.
+Acked-by: Alex Bennée <alex.bennee@linaro.org>
+Suggested-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/tcg/tcg.h | 2 ++
+ softmmu/physmem.c | 10 ++++++++--
-file changed, 2 insertions(+)
+file changed, 8 insertions(+), 2 deletions(-)
-diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
+diff --git a/softmmu/physmem.c b/softmmu/physmem.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/tcg/tcg.h
+--- a/softmmu/physmem.c
-+++ b/include/tcg/tcg.h
++++ b/softmmu/physmem.c
-@@ -XXX,XX +XXX,XX @@ TCGv_vec tcg_constant_vec_matching(TCGv_vec match, unsigned vece, int64_t val);
+@@ -XXX,XX +XXX,XX @@ MemoryRegionSection *iotlb_to_section(CPUState *cpu,
- #if UINTPTR_MAX == UINT32_MAX
+     int asidx = cpu_asidx_from_attrs(cpu, attrs);
- # define tcg_const_ptr(x)        ((TCGv_ptr)tcg_const_i32((intptr_t)(x)))
+     CPUAddressSpace *cpuas = &cpu->cpu_ases[asidx];
- # define tcg_const_local_ptr(x)  ((TCGv_ptr)tcg_const_local_i32((intptr_t)(x)))
+     AddressSpaceDispatch *d = qatomic_rcu_read(&cpuas->memory_dispatch);
-+# define tcg_constant_ptr(x)     ((TCGv_ptr)tcg_constant_i32((intptr_t)(x)))
+-    MemoryRegionSection *sections = d->map.sections;
- #else
++    int section_index = index & ~TARGET_PAGE_MASK;
- # define tcg_const_ptr(x)        ((TCGv_ptr)tcg_const_i64((intptr_t)(x)))
++    MemoryRegionSection *ret;
- # define tcg_const_local_ptr(x)  ((TCGv_ptr)tcg_const_local_i64((intptr_t)(x)))
-+# define tcg_constant_ptr(x)     ((TCGv_ptr)tcg_constant_i64((intptr_t)(x)))
+-    return &sections[index & ~TARGET_PAGE_MASK];
- #endif
++    assert(section_index < d->map.sections_nb);
++    ret = d->map.sections + section_index;
- TCGLabel *gen_new_label(void);
++    assert(ret->mr);
 +    assert(ret->mr->ops);
 +
 +    return ret;
  }
  static void io_mem_init(void)
 --
 .34.1

-[PULL 2/4] tcg: Fix indirect lowering vs TCG_OPF_COND_BRANCH
+[PULL 2/4] softmmu: Use async_run_on_cpu in tcg_commit
-With TCG_OPF_COND_BRANCH, we extended the lifetimes of
+After system startup, run the update to memory_dispatch
-globals across extended basic blocks.  This means that
+and the tlb_flush on the cpu.  This eliminates a race,
-the liveness computed in pass 1 does not kill globals
+wherein a running cpu sees the memory_dispatch change
-in the same way as normal temps.
+but has not yet seen the tlb_flush.
-Introduce TYPE_EBB to match this lifetime, so that we
+Since the update now happens on the cpu, we need not use
-get correct register allocation for the temps that we
+qatomic_rcu_read to protect the read of memory_dispatch.
 introduce during the indirect lowering pass.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1826
-Fixes: b4cb76e6208 ("tcg: Do not kill globals at conditional branches")
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1834
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1846
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/tcg/tcg.h |  2 ++
+ include/exec/cpu-common.h   |  1 -
- tcg/tcg.c         | 34 +++++++++++++++++++++++++++-------
+ accel/tcg/cpu-exec-common.c | 30 ----------------------------
-files changed, 29 insertions(+), 7 deletions(-)
+ softmmu/physmem.c           | 40 +++++++++++++++++++++++++++----------
 files changed, 29 insertions(+), 42 deletions(-)
-diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
+diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/tcg/tcg.h
+--- a/include/exec/cpu-common.h
-+++ b/include/tcg/tcg.h
++++ b/include/exec/cpu-common.h
-@@ -XXX,XX +XXX,XX @@ typedef enum TCGTempVal {
+@@ -XXX,XX +XXX,XX @@ static inline void cpu_physical_memory_write(hwaddr addr,
- typedef enum TCGTempKind {
+ {
-     /* Temp is dead at the end of all basic blocks. */
+     cpu_physical_memory_rw(addr, (void *)buf, len, true);
-     TEMP_NORMAL,
+ }
-+    /* Temp is live across conditional branch, but dead otherwise. */
+-void cpu_reloading_memory_map(void);
-+    TEMP_EBB,
+ void *cpu_physical_memory_map(hwaddr addr,
-     /* Temp is saved across basic blocks but dead at the end of TBs. */
+                               hwaddr *plen,
-     TEMP_LOCAL,
+                               bool is_write);
-     /* Temp is saved across both basic blocks and translation blocks. */
+diff --git a/accel/tcg/cpu-exec-common.c b/accel/tcg/cpu-exec-common.c
 diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg.c
+--- a/accel/tcg/cpu-exec-common.c
-+++ b/tcg/tcg.c
++++ b/accel/tcg/cpu-exec-common.c
-@@ -XXX,XX +XXX,XX @@ void tcg_temp_free_internal(TCGTemp *ts)
+@@ -XXX,XX +XXX,XX @@ void cpu_loop_exit_noexc(CPUState *cpu)
-     TCGContext *s = tcg_ctx;
+     cpu_loop_exit(cpu);
-     int k, idx;
+ }
--    /* In order to simplify users of tcg_constant_*, silently ignore free. */
+-#if defined(CONFIG_SOFTMMU)
--    if (ts->kind == TEMP_CONST) {
+-void cpu_reloading_memory_map(void)
-+    switch (ts->kind) {
+-{
-+    case TEMP_CONST:
+-    if (qemu_in_vcpu_thread() && current_cpu->running) {
-+        /*
+-        /* The guest can in theory prolong the RCU critical section as long
-+         * In order to simplify users of tcg_constant_*,
+-         * as it feels like. The major problem with this is that because it
-+         * silently ignore free.
+-         * can do multiple reconfigurations of the memory map within the
-+         */
+-         * critical section, we could potentially accumulate an unbounded
-         return;
+-         * collection of memory data structures awaiting reclamation.
-+    case TEMP_NORMAL:
+-         *
-+    case TEMP_LOCAL:
+-         * Because the only thing we're currently protecting with RCU is the
-+        break;
+-         * memory data structures, it's sufficient to break the critical section
-+    default:
+-         * in this callback, which we know will get called every time the
-+        g_assert_not_reached();
+-         * memory map is rearranged.
 -         *
 -         * (If we add anything else in the system that uses RCU to protect
 -         * its data structures, we will need to implement some other mechanism
 -         * to force TCG CPUs to exit the critical section, at which point this
 -         * part of this callback might become unnecessary.)
 -         *
 -         * This pair matches cpu_exec's rcu_read_lock()/rcu_read_unlock(), which
 -         * only protects cpu->as->dispatch. Since we know our caller is about
 -         * to reload it, it's safe to split the critical section.
 -         */
 -        rcu_read_unlock();
 -        rcu_read_lock();
 -    }
 -}
 -#endif
 -
  void cpu_loop_exit(CPUState *cpu)
  {
      /* Undo the setting in cpu_tb_exec.  */
 diff --git a/softmmu/physmem.c b/softmmu/physmem.c
 index XXXXXXX..XXXXXXX 100644
 --- a/softmmu/physmem.c
 +++ b/softmmu/physmem.c
@@ -XXX,XX +XXX,XX @@ address_space_translate_for_iotlb(CPUState *cpu, int asidx, hwaddr orig_addr,
      IOMMUTLBEntry iotlb;
      int iommu_idx;
      hwaddr addr = orig_addr;
 -    AddressSpaceDispatch *d =
 -        qatomic_rcu_read(&cpu->cpu_ases[asidx].memory_dispatch);
 +    AddressSpaceDispatch *d = cpu->cpu_ases[asidx].memory_dispatch;
      for (;;) {
          section = address_space_translate_internal(d, addr, &addr, plen, false);
@@ -XXX,XX +XXX,XX @@ MemoryRegionSection *iotlb_to_section(CPUState *cpu,
  {
      int asidx = cpu_asidx_from_attrs(cpu, attrs);
      CPUAddressSpace *cpuas = &cpu->cpu_ases[asidx];
 -    AddressSpaceDispatch *d = qatomic_rcu_read(&cpuas->memory_dispatch);
 +    AddressSpaceDispatch *d = cpuas->memory_dispatch;
      int section_index = index & ~TARGET_PAGE_MASK;
      MemoryRegionSection *ret;
@@ -XXX,XX +XXX,XX @@ static void tcg_log_global_after_sync(MemoryListener *listener)
      }
- #if defined(CONFIG_DEBUG_TCG)
-@@ -XXX,XX +XXX,XX @@ void tcg_temp_free_internal(TCGTemp *ts)
-     }
- #endif
--    tcg_debug_assert(ts->kind < TEMP_GLOBAL);
-     tcg_debug_assert(ts->temp_allocated != 0);
-     ts->temp_allocated = 0;
-@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_start(TCGContext *s)
-         case TEMP_GLOBAL:
-             break;
-         case TEMP_NORMAL:
-+        case TEMP_EBB:
-             val = TEMP_VAL_DEAD;
-             /* fall through */
-         case TEMP_LOCAL:
-@@ -XXX,XX +XXX,XX @@ static char *tcg_get_arg_str_ptr(TCGContext *s, char *buf, int buf_size,
-     case TEMP_LOCAL:
-         snprintf(buf, buf_size, "loc%d", idx - s->nb_globals);
-         break;
-+    case TEMP_EBB:
-+        snprintf(buf, buf_size, "ebb%d", idx - s->nb_globals);
-+        break;
-     case TEMP_NORMAL:
-         snprintf(buf, buf_size, "tmp%d", idx - s->nb_globals);
-         break;
-@@ -XXX,XX +XXX,XX @@ static void la_bb_end(TCGContext *s, int ng, int nt)
-             state = TS_DEAD | TS_MEM;
-             break;
-         case TEMP_NORMAL:
-+        case TEMP_EBB:
-         case TEMP_CONST:
-             state = TS_DEAD;
-             break;
-@@ -XXX,XX +XXX,XX @@ static void la_global_sync(TCGContext *s, int ng)
  }
- /*
++static void tcg_commit_cpu(CPUState *cpu, run_on_cpu_data data)
-- * liveness analysis: conditional branch: all temps are dead,
++{
-- * globals and local temps should be synced.
++    CPUAddressSpace *cpuas = data.host_ptr;
-+ * liveness analysis: conditional branch: all temps are dead unless
++
-+ * explicitly live-across-conditional-branch, globals and local temps
++    cpuas->memory_dispatch = address_space_to_dispatch(cpuas->as);
-+ * should be synced.
++    tlb_flush(cpu);
-  */
++}
- static void la_bb_sync(TCGContext *s, int ng, int nt)
++
  static void tcg_commit(MemoryListener *listener)
  {
-@@ -XXX,XX +XXX,XX @@ static void la_bb_sync(TCGContext *s, int ng, int nt)
+     CPUAddressSpace *cpuas;
-         case TEMP_NORMAL:
+-    AddressSpaceDispatch *d;
-             s->temps[i].state = TS_DEAD;
++    CPUState *cpu;
-             break;
-+        case TEMP_EBB:
+     assert(tcg_enabled());
-         case TEMP_CONST:
+     /* since each CPU stores ram addresses in its TLB cache, we must
-             continue;
+        reset the modified entries */
-         default:
+     cpuas = container_of(listener, CPUAddressSpace, tcg_as_listener);
-@@ -XXX,XX +XXX,XX @@ static bool liveness_pass_2(TCGContext *s)
+-    cpu_reloading_memory_map();
-             TCGTemp *dts = tcg_temp_alloc(s);
+-    /* The CPU and TLB are protected by the iothread lock.
-             dts->type = its->type;
+-     * We reload the dispatch pointer now because cpu_reloading_memory_map()
-             dts->base_type = its->base_type;
+-     * may have split the RCU critical section.
-+            dts->kind = TEMP_EBB;
++    cpu = cpuas->cpu;
-             its->state_ptr = dts;
++
-         } else {
++    /*
-             its->state_ptr = NULL;
++     * Defer changes to as->memory_dispatch until the cpu is quiescent.
-@@ -XXX,XX +XXX,XX @@ static void temp_free_or_dead(TCGContext *s, TCGTemp *ts, int free_or_dead)
++     * Otherwise we race between (1) other cpu threads and (2) ongoing
-         new_type = TEMP_VAL_MEM;
++     * i/o for the current cpu thread, with data cached by mmu_lookup().
-         break;
++     *
-     case TEMP_NORMAL:
++     * In addition, queueing the work function will kick the cpu back to
-+    case TEMP_EBB:
++     * the main loop, which will end the RCU critical section and reclaim
-         new_type = free_or_dead < 0 ? TEMP_VAL_MEM : TEMP_VAL_DEAD;
++     * the memory data structures.
-         break;
++     *
-     case TEMP_CONST:
++     * That said, the listener is also called during realize, before
-@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_bb_end(TCGContext *s, TCGRegSet allocated_regs)
++     * all of the tcg machinery for run-on is initialized: thus halt_cond.
-             temp_save(s, ts, allocated_regs);
+      */
-             break;
+-    d = address_space_to_dispatch(cpuas->as);
-         case TEMP_NORMAL:
+-    qatomic_rcu_set(&cpuas->memory_dispatch, d);
-+        case TEMP_EBB:
+-    tlb_flush(cpuas->cpu);
-             /* The liveness analysis already ensures that temps are dead.
++    if (cpu->halt_cond) {
-                Keep an tcg_debug_assert for safety. */
++        async_run_on_cpu(cpu, tcg_commit_cpu, RUN_ON_CPU_HOST_PTR(cpuas));
-             tcg_debug_assert(ts->val_type == TEMP_VAL_DEAD);
++    } else {
-@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_bb_end(TCGContext *s, TCGRegSet allocated_regs)
++        tcg_commit_cpu(cpu, RUN_ON_CPU_HOST_PTR(cpuas));
 +    }
  }
- /*
+ static void memory_map_init(void)
 - * At a conditional branch, we assume all temporaries are dead and
 - * all globals and local temps are synced to their location.
 + * At a conditional branch, we assume all temporaries are dead unless
 + * explicitly live-across-conditional-branch; all globals and local
 + * temps are synced to their location.
   */
  static void tcg_reg_alloc_cbranch(TCGContext *s, TCGRegSet allocated_regs)
  {
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_cbranch(TCGContext *s, TCGRegSet allocated_regs)
          case TEMP_NORMAL:
              tcg_debug_assert(ts->val_type == TEMP_VAL_DEAD);
              break;
 +        case TEMP_EBB:
          case TEMP_CONST:
              break;
          default:
 --
 .34.1

-[PULL 3/4] accel/tcg: Remove ATOMIC_MMU_IDX
+[PULL 3/4] tcg: Remove vecop_list check from tcg_gen_not_vec
-The last use of this macro was removed in f3e182b10013
+The not pattern is always available via generic expansion.
-("accel/tcg: Push trace info building into atomic_common.c.inc")
+See debug block in tcg_can_emit_vecop_list.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Fixes: 11978f6f58 ("tcg: Fix expansion of INDEX_op_not_vec")
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/cputlb.c    | 1 -
+ tcg/tcg-op-vec.c | 7 +++----
- accel/tcg/user-exec.c | 1 -
+file changed, 3 insertions(+), 4 deletions(-)
 files changed, 2 deletions(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+diff --git a/tcg/tcg-op-vec.c b/tcg/tcg-op-vec.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/tcg/tcg-op-vec.c
-+++ b/accel/tcg/cputlb.c
++++ b/tcg/tcg-op-vec.c
-@@ -XXX,XX +XXX,XX @@ void cpu_stq_le_mmu(CPUArchState *env, target_ulong addr, uint64_t val,
+@@ -XXX,XX +XXX,XX @@ static bool do_op2(unsigned vece, TCGv_vec r, TCGv_vec a, TCGOpcode opc)
-     glue(glue(glue(cpu_atomic_ ## X, SUFFIX), END), _mmu)
+ void tcg_gen_not_vec(unsigned vece, TCGv_vec r, TCGv_vec a)
- #define ATOMIC_MMU_CLEANUP
+ {
--#define ATOMIC_MMU_IDX   get_mmuidx(oi)
+-    const TCGOpcode *hold_list = tcg_swap_vecop_list(NULL);
+-
- #include "atomic_common.c.inc"
+-    if (!TCG_TARGET_HAS_not_vec || !do_op2(vece, r, a, INDEX_op_not_vec)) {
++    if (TCG_TARGET_HAS_not_vec) {
-diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
++        vec_gen_op2(INDEX_op_not_vec, 0, r, a);
-index XXXXXXX..XXXXXXX 100644
++    } else {
---- a/accel/tcg/user-exec.c
+         tcg_gen_xor_vec(0, r, a, tcg_constant_vec_matching(r, 0, -1));
-+++ b/accel/tcg/user-exec.c
+     }
-@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
+-    tcg_swap_vecop_list(hold_list);
- #define ATOMIC_NAME(X) \
+ }
-     glue(glue(glue(cpu_atomic_ ## X, SUFFIX), END), _mmu)
- #define ATOMIC_MMU_CLEANUP do { clear_helper_retaddr(); } while (0)
+ void tcg_gen_neg_vec(unsigned vece, TCGv_vec r, TCGv_vec a)
 -#define ATOMIC_MMU_IDX MMU_USER_IDX
  #define DATA_SIZE 1
  #include "atomic_template.h"
 --
 .34.1

-[PULL 1/4] Don't include sysemu/tcg.h if it is not necessary
+[PULL 4/4] tcg/sparc64: Disable TCG_TARGET_HAS_extr_i64_i32
-From: Thomas Huth <thuth@redhat.com>
+Since a59a29312660 ("tcg/sparc64: Remove sparc32plus constraints")
 we no longer distinguish registers with 32 vs 64 bits.
 Therefore we can remove support for the backend-specific
 type change opcodes.
-This header only defines the tcg_allowed variable and the tcg_enabled()
-function - which are not required in many files that include this
-header. Drop the #include statement there.
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-Reviewed-by: Markus Armbruster <armbru@redhat.com>
-Message-Id: <20220315144107.1012530-1-thuth@redhat.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/hmp.c                  | 1 -
+ tcg/sparc64/tcg-target.h     |  2 +-
- accel/tcg/tcg-accel-ops-icount.c | 1 -
+ tcg/sparc64/tcg-target.c.inc | 11 -----------
- bsd-user/main.c                  | 1 -
+files changed, 1 insertion(+), 12 deletions(-)
  hw/virtio/vhost.c                | 1 -
  linux-user/main.c                | 1 -
  monitor/misc.c                   | 1 -
  target/arm/helper.c              | 1 -
  target/s390x/cpu_models_sysemu.c | 1 -
  target/s390x/helper.c            | 1 -
 files changed, 9 deletions(-)
-diff --git a/accel/tcg/hmp.c b/accel/tcg/hmp.c
+diff --git a/tcg/sparc64/tcg-target.h b/tcg/sparc64/tcg-target.h
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/hmp.c
+--- a/tcg/sparc64/tcg-target.h
-+++ b/accel/tcg/hmp.c
++++ b/tcg/sparc64/tcg-target.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ extern bool use_vis3_instructions;
- #include "qapi/qapi-commands-machine.h"
+ #define TCG_TARGET_HAS_mulsh_i32        0
- #include "exec/exec-all.h"
+ #define TCG_TARGET_HAS_qemu_st8_i32     0
- #include "monitor/monitor.h"
--#include "sysemu/tcg.h"
+-#define TCG_TARGET_HAS_extr_i64_i32     1
++#define TCG_TARGET_HAS_extr_i64_i32     0
- static void hmp_tcg_register(void)
+ #define TCG_TARGET_HAS_div_i64          1
  #define TCG_TARGET_HAS_rem_i64          0
  #define TCG_TARGET_HAS_rot_i64          0
 diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/sparc64/tcg-target.c.inc
 +++ b/tcg/sparc64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg rd, TCGReg rs)
      tcg_out_ext32u(s, rd, rs);
  }
 -static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg rd, TCGReg rs)
 -{
 -    tcg_out_mov(s, TCG_TYPE_I32, rd, rs);
 -}
 -
  static bool tcg_out_xchg(TCGContext *s, TCGType type, TCGReg r1, TCGReg r2)
  {
-diff --git a/accel/tcg/tcg-accel-ops-icount.c b/accel/tcg/tcg-accel-ops-icount.c
+     return false;
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
---- a/accel/tcg/tcg-accel-ops-icount.c
+     case INDEX_op_divu_i64:
-+++ b/accel/tcg/tcg-accel-ops-icount.c
+         c = ARITH_UDIVX;
-@@ -XXX,XX +XXX,XX @@
+         goto gen_arith;
-  */
+-    case INDEX_op_extrh_i64_i32:
+-        tcg_out_arithi(s, a0, a1, 32, SHIFT_SRLX);
- #include "qemu/osdep.h"
+-        break;
--#include "sysemu/tcg.h"
- #include "sysemu/replay.h"
+     case INDEX_op_brcond_i64:
- #include "sysemu/cpu-timers.h"
+         tcg_out_brcond_i64(s, a2, a0, a1, const_args[1], arg_label(args[3]));
- #include "qemu/main-loop.h"
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
-diff --git a/bsd-user/main.c b/bsd-user/main.c
+     case INDEX_op_ext32u_i64:
-index XXXXXXX..XXXXXXX 100644
+     case INDEX_op_ext_i32_i64:
---- a/bsd-user/main.c
+     case INDEX_op_extu_i32_i64:
-+++ b/bsd-user/main.c
+-    case INDEX_op_extrl_i64_i32:
-@@ -XXX,XX +XXX,XX @@
+     default:
- #include "qemu-common.h"
+         g_assert_not_reached();
- #include "qemu/units.h"
+     }
- #include "qemu/accel.h"
+@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
--#include "sysemu/tcg.h"
+     case INDEX_op_ext32u_i64:
- #include "qemu-version.h"
+     case INDEX_op_ext_i32_i64:
- #include <machine/trap.h>
+     case INDEX_op_extu_i32_i64:
+-    case INDEX_op_extrl_i64_i32:
-diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
+-    case INDEX_op_extrh_i64_i32:
-index XXXXXXX..XXXXXXX 100644
+     case INDEX_op_qemu_ld_a32_i32:
---- a/hw/virtio/vhost.c
+     case INDEX_op_qemu_ld_a64_i32:
-+++ b/hw/virtio/vhost.c
+     case INDEX_op_qemu_ld_a32_i64:
@@ -XXX,XX +XXX,XX @@
  #include "migration/blocker.h"
  #include "migration/qemu-file-types.h"
  #include "sysemu/dma.h"
 -#include "sysemu/tcg.h"
  #include "trace.h"
  /* enabled until disconnected backend stabilizes */
 diff --git a/linux-user/main.c b/linux-user/main.c
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/main.c
 +++ b/linux-user/main.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu-common.h"
  #include "qemu/units.h"
  #include "qemu/accel.h"
 -#include "sysemu/tcg.h"
  #include "qemu-version.h"
  #include <sys/syscall.h>
  #include <sys/resource.h>
 diff --git a/monitor/misc.c b/monitor/misc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/monitor/misc.c
 +++ b/monitor/misc.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/util.h"
  #include "sysemu/blockdev.h"
  #include "sysemu/sysemu.h"
 -#include "sysemu/tcg.h"
  #include "sysemu/tpm.h"
  #include "qapi/qmp/qdict.h"
  #include "qapi/qmp/qerror.h"
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/cpus.h"
  #include "sysemu/cpu-timers.h"
  #include "sysemu/kvm.h"
 -#include "sysemu/tcg.h"
  #include "qemu/range.h"
  #include "qapi/qapi-commands-machine-target.h"
  #include "qapi/error.h"
 diff --git a/target/s390x/cpu_models_sysemu.c b/target/s390x/cpu_models_sysemu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/cpu_models_sysemu.c
 +++ b/target/s390x/cpu_models_sysemu.c
@@ -XXX,XX +XXX,XX @@
  #include "s390x-internal.h"
  #include "kvm/kvm_s390x.h"
  #include "sysemu/kvm.h"
 -#include "sysemu/tcg.h"
  #include "qapi/error.h"
  #include "qapi/visitor.h"
  #include "qapi/qmp/qerror.h"
 diff --git a/target/s390x/helper.c b/target/s390x/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/helper.c
 +++ b/target/s390x/helper.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/s390x/pv.h"
  #include "sysemu/hw_accel.h"
  #include "sysemu/runstate.h"
 -#include "sysemu/tcg.h"
  void s390x_tod_timer(void *opaque)
  {
 --
 .34.1

The following changes since commit 2d20a57453f6a206938cbbf77bed0b378c806c1f:

Merge tag 'pull-fixes-for-7.1-200422-1' of https://github.com/stsquad/qemu into staging (2022-04-20 11:13:08 -0700)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20220420

for you to fetch changes up to a61532faa5a4d5e021e35b6a4a1e180c72d4a22f:

tcg: Add tcg_constant_ptr (2022-04-20 12:12:47 -0700)

----------------------------------------------------------------
Cleanup sysemu/tcg.h usage.
Fix indirect lowering vs cond branches
Remove ATOMIC_MMU_IDX
Add tcg_constant_ptr

----------------------------------------------------------------
Richard Henderson (3):
      tcg: Fix indirect lowering vs TCG_OPF_COND_BRANCH
      accel/tcg: Remove ATOMIC_MMU_IDX
      tcg: Add tcg_constant_ptr

Thomas Huth (1):
      Don't include sysemu/tcg.h if it is not necessary

From: Thomas Huth <thuth@redhat.com>

This header only defines the tcg_allowed variable and the tcg_enabled()
function - which are not required in many files that include this
header. Drop the #include statement there.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <20220315144107.1012530-1-thuth@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/hmp.c                  | 1 -
 accel/tcg/tcg-accel-ops-icount.c | 1 -
 bsd-user/main.c                  | 1 -
 hw/virtio/vhost.c                | 1 -
 linux-user/main.c                | 1 -
 monitor/misc.c                   | 1 -
 target/arm/helper.c              | 1 -
 target/s390x/cpu_models_sysemu.c | 1 -
 target/s390x/helper.c            | 1 -
 9 files changed, 9 deletions(-)

diff --git a/accel/tcg/hmp.c b/accel/tcg/hmp.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/hmp.c
+++ b/accel/tcg/hmp.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/qapi-commands-machine.h"
 #include "exec/exec-all.h"
 #include "monitor/monitor.h"
-#include "sysemu/tcg.h"
 
 static void hmp_tcg_register(void)
 {
diff --git a/accel/tcg/tcg-accel-ops-icount.c b/accel/tcg/tcg-accel-ops-icount.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-accel-ops-icount.c
+++ b/accel/tcg/tcg-accel-ops-icount.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-#include "sysemu/tcg.h"
 #include "sysemu/replay.h"
 #include "sysemu/cpu-timers.h"
 #include "qemu/main-loop.h"
diff --git a/bsd-user/main.c b/bsd-user/main.c
index XXXXXXX..XXXXXXX 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "qemu/units.h"
 #include "qemu/accel.h"
-#include "sysemu/tcg.h"
 #include "qemu-version.h"
 #include <machine/trap.h>
 
diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -XXX,XX +XXX,XX @@
 #include "migration/blocker.h"
 #include "migration/qemu-file-types.h"
 #include "sysemu/dma.h"
-#include "sysemu/tcg.h"
 #include "trace.h"
 
 /* enabled until disconnected backend stabilizes */
diff --git a/linux-user/main.c b/linux-user/main.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "qemu/units.h"
 #include "qemu/accel.h"
-#include "sysemu/tcg.h"
 #include "qemu-version.h"
 #include <sys/syscall.h>
 #include <sys/resource.h>
diff --git a/monitor/misc.c b/monitor/misc.c
index XXXXXXX..XXXXXXX 100644
--- a/monitor/misc.c
+++ b/monitor/misc.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/util.h"
 #include "sysemu/blockdev.h"
 #include "sysemu/sysemu.h"
-#include "sysemu/tcg.h"
 #include "sysemu/tpm.h"
 #include "qapi/qmp/qdict.h"
 #include "qapi/qmp/qerror.h"
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/cpus.h"
 #include "sysemu/cpu-timers.h"
 #include "sysemu/kvm.h"
-#include "sysemu/tcg.h"
 #include "qemu/range.h"
 #include "qapi/qapi-commands-machine-target.h"
 #include "qapi/error.h"
diff --git a/target/s390x/cpu_models_sysemu.c b/target/s390x/cpu_models_sysemu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/cpu_models_sysemu.c
+++ b/target/s390x/cpu_models_sysemu.c
@@ -XXX,XX +XXX,XX @@
 #include "s390x-internal.h"
 #include "kvm/kvm_s390x.h"
 #include "sysemu/kvm.h"
-#include "sysemu/tcg.h"
 #include "qapi/error.h"
 #include "qapi/visitor.h"
 #include "qapi/qmp/qerror.h"
diff --git a/target/s390x/helper.c b/target/s390x/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/helper.c
+++ b/target/s390x/helper.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/s390x/pv.h"
 #include "sysemu/hw_accel.h"
 #include "sysemu/runstate.h"
-#include "sysemu/tcg.h"
 
 void s390x_tod_timer(void *opaque)
 {
-- 
2.34.1

With TCG_OPF_COND_BRANCH, we extended the lifetimes of
globals across extended basic blocks.  This means that
the liveness computed in pass 1 does not kill globals
in the same way as normal temps.

Introduce TYPE_EBB to match this lifetime, so that we
get correct register allocation for the temps that we
introduce during the indirect lowering pass.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Fixes: b4cb76e6208 ("tcg: Do not kill globals at conditional branches")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg.h |  2 ++
 tcg/tcg.c         | 34 +++++++++++++++++++++++++++-------
 2 files changed, 29 insertions(+), 7 deletions(-)

diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ typedef enum TCGTempVal {
 typedef enum TCGTempKind {
     /* Temp is dead at the end of all basic blocks. */
     TEMP_NORMAL,
+    /* Temp is live across conditional branch, but dead otherwise. */
+    TEMP_EBB,
     /* Temp is saved across basic blocks but dead at the end of TBs. */
     TEMP_LOCAL,
     /* Temp is saved across both basic blocks and translation blocks. */
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ void tcg_temp_free_internal(TCGTemp *ts)
     TCGContext *s = tcg_ctx;
     int k, idx;
 
-    /* In order to simplify users of tcg_constant_*, silently ignore free. */
-    if (ts->kind == TEMP_CONST) {
+    switch (ts->kind) {
+    case TEMP_CONST:
+        /*
+         * In order to simplify users of tcg_constant_*,
+         * silently ignore free.
+         */
         return;
+    case TEMP_NORMAL:
+    case TEMP_LOCAL:
+        break;
+    default:
+        g_assert_not_reached();
     }
 
 #if defined(CONFIG_DEBUG_TCG)
@@ -XXX,XX +XXX,XX @@ void tcg_temp_free_internal(TCGTemp *ts)
     }
 #endif
 
-    tcg_debug_assert(ts->kind < TEMP_GLOBAL);
     tcg_debug_assert(ts->temp_allocated != 0);
     ts->temp_allocated = 0;
 
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_start(TCGContext *s)
         case TEMP_GLOBAL:
             break;
         case TEMP_NORMAL:
+        case TEMP_EBB:
             val = TEMP_VAL_DEAD;
             /* fall through */
         case TEMP_LOCAL:
@@ -XXX,XX +XXX,XX @@ static char *tcg_get_arg_str_ptr(TCGContext *s, char *buf, int buf_size,
     case TEMP_LOCAL:
         snprintf(buf, buf_size, "loc%d", idx - s->nb_globals);
         break;
+    case TEMP_EBB:
+        snprintf(buf, buf_size, "ebb%d", idx - s->nb_globals);
+        break;
     case TEMP_NORMAL:
         snprintf(buf, buf_size, "tmp%d", idx - s->nb_globals);
         break;
@@ -XXX,XX +XXX,XX @@ static void la_bb_end(TCGContext *s, int ng, int nt)
             state = TS_DEAD | TS_MEM;
             break;
         case TEMP_NORMAL:
+        case TEMP_EBB:
         case TEMP_CONST:
             state = TS_DEAD;
             break;
@@ -XXX,XX +XXX,XX @@ static void la_global_sync(TCGContext *s, int ng)
 }
 
 /*
- * liveness analysis: conditional branch: all temps are dead,
- * globals and local temps should be synced.
+ * liveness analysis: conditional branch: all temps are dead unless
+ * explicitly live-across-conditional-branch, globals and local temps
+ * should be synced.
  */
 static void la_bb_sync(TCGContext *s, int ng, int nt)
 {
@@ -XXX,XX +XXX,XX @@ static void la_bb_sync(TCGContext *s, int ng, int nt)
         case TEMP_NORMAL:
             s->temps[i].state = TS_DEAD;
             break;
+        case TEMP_EBB:
         case TEMP_CONST:
             continue;
         default:
@@ -XXX,XX +XXX,XX @@ static bool liveness_pass_2(TCGContext *s)
             TCGTemp *dts = tcg_temp_alloc(s);
             dts->type = its->type;
             dts->base_type = its->base_type;
+            dts->kind = TEMP_EBB;
             its->state_ptr = dts;
         } else {
             its->state_ptr = NULL;
@@ -XXX,XX +XXX,XX @@ static void temp_free_or_dead(TCGContext *s, TCGTemp *ts, int free_or_dead)
         new_type = TEMP_VAL_MEM;
         break;
     case TEMP_NORMAL:
+    case TEMP_EBB:
         new_type = free_or_dead < 0 ? TEMP_VAL_MEM : TEMP_VAL_DEAD;
         break;
     case TEMP_CONST:
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_bb_end(TCGContext *s, TCGRegSet allocated_regs)
             temp_save(s, ts, allocated_regs);
             break;
         case TEMP_NORMAL:
+        case TEMP_EBB:
             /* The liveness analysis already ensures that temps are dead.
                Keep an tcg_debug_assert for safety. */
             tcg_debug_assert(ts->val_type == TEMP_VAL_DEAD);
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_bb_end(TCGContext *s, TCGRegSet allocated_regs)
 }
 
 /*
- * At a conditional branch, we assume all temporaries are dead and
- * all globals and local temps are synced to their location.
+ * At a conditional branch, we assume all temporaries are dead unless
+ * explicitly live-across-conditional-branch; all globals and local
+ * temps are synced to their location.
  */
 static void tcg_reg_alloc_cbranch(TCGContext *s, TCGRegSet allocated_regs)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_cbranch(TCGContext *s, TCGRegSet allocated_regs)
         case TEMP_NORMAL:
             tcg_debug_assert(ts->val_type == TEMP_VAL_DEAD);
             break;
+        case TEMP_EBB:
         case TEMP_CONST:
             break;
         default:
-- 
2.34.1

The last use of this macro was removed in f3e182b10013
("accel/tcg: Push trace info building into atomic_common.c.inc")

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c    | 1 -
 accel/tcg/user-exec.c | 1 -
 2 files changed, 2 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ void cpu_stq_le_mmu(CPUArchState *env, target_ulong addr, uint64_t val,
     glue(glue(glue(cpu_atomic_ ## X, SUFFIX), END), _mmu)
 
 #define ATOMIC_MMU_CLEANUP
-#define ATOMIC_MMU_IDX   get_mmuidx(oi)
 
 #include "atomic_common.c.inc"
 
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
 #define ATOMIC_NAME(X) \
     glue(glue(glue(cpu_atomic_ ## X, SUFFIX), END), _mmu)
 #define ATOMIC_MMU_CLEANUP do { clear_helper_retaddr(); } while (0)
-#define ATOMIC_MMU_IDX MMU_USER_IDX
 
 #define DATA_SIZE 1
 #include "atomic_template.h"
-- 
2.34.1

Similar to tcg_const_ptr, defer to tcg_constant_{i32,i64}.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ TCGv_vec tcg_constant_vec_matching(TCGv_vec match, unsigned vece, int64_t val);
 #if UINTPTR_MAX == UINT32_MAX
 # define tcg_const_ptr(x)        ((TCGv_ptr)tcg_const_i32((intptr_t)(x)))
 # define tcg_const_local_ptr(x)  ((TCGv_ptr)tcg_const_local_i32((intptr_t)(x)))
+# define tcg_constant_ptr(x)     ((TCGv_ptr)tcg_constant_i32((intptr_t)(x)))
 #else
 # define tcg_const_ptr(x)        ((TCGv_ptr)tcg_const_i64((intptr_t)(x)))
 # define tcg_const_local_ptr(x)  ((TCGv_ptr)tcg_const_local_i64((intptr_t)(x)))
+# define tcg_constant_ptr(x)     ((TCGv_ptr)tcg_constant_i64((intptr_t)(x)))
 #endif
 
 TCGLabel *gen_new_label(void);
-- 
2.34.1

The following changes since commit 813bac3d8d70d85cb7835f7945eb9eed84c2d8d0:

Merge tag '2023q3-bsd-user-pull-request' of https://gitlab.com/bsdimp/qemu into staging (2023-08-29 08:58:00 -0400)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20230829

for you to fetch changes up to dad2f2f5afbaf58d6056f31dfd4b9edd0854b8ab:

tcg/sparc64: Disable TCG_TARGET_HAS_extr_i64_i32 (2023-08-29 09:57:39 -0700)

----------------------------------------------------------------
softmmu: Use async_run_on_cpu in tcg_commit
tcg: Remove vecop_list check from tcg_gen_not_vec
tcg/sparc64: Disable TCG_TARGET_HAS_extr_i64_i32

----------------------------------------------------------------
Richard Henderson (4):
      softmmu: Assert data in bounds in iotlb_to_section
      softmmu: Use async_run_on_cpu in tcg_commit
      tcg: Remove vecop_list check from tcg_gen_not_vec
      tcg/sparc64: Disable TCG_TARGET_HAS_extr_i64_i32

include/exec/cpu-common.h    |  1 -
 tcg/sparc64/tcg-target.h     |  2 +-
 accel/tcg/cpu-exec-common.c  | 30 --------------------------
 softmmu/physmem.c            | 50 ++++++++++++++++++++++++++++++++------------
 tcg/tcg-op-vec.c             |  7 +++----
 tcg/sparc64/tcg-target.c.inc | 11 ----------
 6 files changed, 41 insertions(+), 60 deletions(-)

Acked-by: Alex Bennée <alex.bennee@linaro.org>
Suggested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 softmmu/physmem.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -XXX,XX +XXX,XX @@ MemoryRegionSection *iotlb_to_section(CPUState *cpu,
     int asidx = cpu_asidx_from_attrs(cpu, attrs);
     CPUAddressSpace *cpuas = &cpu->cpu_ases[asidx];
     AddressSpaceDispatch *d = qatomic_rcu_read(&cpuas->memory_dispatch);
-    MemoryRegionSection *sections = d->map.sections;
+    int section_index = index & ~TARGET_PAGE_MASK;
+    MemoryRegionSection *ret;
 
-    return &sections[index & ~TARGET_PAGE_MASK];
+    assert(section_index < d->map.sections_nb);
+    ret = d->map.sections + section_index;
+    assert(ret->mr);
+    assert(ret->mr->ops);
+
+    return ret;
 }
 
 static void io_mem_init(void)
-- 
2.34.1

After system startup, run the update to memory_dispatch
and the tlb_flush on the cpu.  This eliminates a race,
wherein a running cpu sees the memory_dispatch change
but has not yet seen the tlb_flush.

Since the update now happens on the cpu, we need not use
qatomic_rcu_read to protect the read of memory_dispatch.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1826
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1834
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1846
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-common.h   |  1 -
 accel/tcg/cpu-exec-common.c | 30 ----------------------------
 softmmu/physmem.c           | 40 +++++++++++++++++++++++++++----------
 3 files changed, 29 insertions(+), 42 deletions(-)

diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -XXX,XX +XXX,XX @@ static inline void cpu_physical_memory_write(hwaddr addr,
 {
     cpu_physical_memory_rw(addr, (void *)buf, len, true);
 }
-void cpu_reloading_memory_map(void);
 void *cpu_physical_memory_map(hwaddr addr,
                               hwaddr *plen,
                               bool is_write);
diff --git a/accel/tcg/cpu-exec-common.c b/accel/tcg/cpu-exec-common.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec-common.c
+++ b/accel/tcg/cpu-exec-common.c
@@ -XXX,XX +XXX,XX @@ void cpu_loop_exit_noexc(CPUState *cpu)
     cpu_loop_exit(cpu);
 }
 
-#if defined(CONFIG_SOFTMMU)
-void cpu_reloading_memory_map(void)
-{
-    if (qemu_in_vcpu_thread() && current_cpu->running) {
-        /* The guest can in theory prolong the RCU critical section as long
-         * as it feels like. The major problem with this is that because it
-         * can do multiple reconfigurations of the memory map within the
-         * critical section, we could potentially accumulate an unbounded
-         * collection of memory data structures awaiting reclamation.
-         *
-         * Because the only thing we're currently protecting with RCU is the
-         * memory data structures, it's sufficient to break the critical section
-         * in this callback, which we know will get called every time the
-         * memory map is rearranged.
-         *
-         * (If we add anything else in the system that uses RCU to protect
-         * its data structures, we will need to implement some other mechanism
-         * to force TCG CPUs to exit the critical section, at which point this
-         * part of this callback might become unnecessary.)
-         *
-         * This pair matches cpu_exec's rcu_read_lock()/rcu_read_unlock(), which
-         * only protects cpu->as->dispatch. Since we know our caller is about
-         * to reload it, it's safe to split the critical section.
-         */
-        rcu_read_unlock();
-        rcu_read_lock();
-    }
-}
-#endif
-
 void cpu_loop_exit(CPUState *cpu)
 {
     /* Undo the setting in cpu_tb_exec.  */
diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -XXX,XX +XXX,XX @@ address_space_translate_for_iotlb(CPUState *cpu, int asidx, hwaddr orig_addr,
     IOMMUTLBEntry iotlb;
     int iommu_idx;
     hwaddr addr = orig_addr;
-    AddressSpaceDispatch *d =
-        qatomic_rcu_read(&cpu->cpu_ases[asidx].memory_dispatch);
+    AddressSpaceDispatch *d = cpu->cpu_ases[asidx].memory_dispatch;
 
     for (;;) {
         section = address_space_translate_internal(d, addr, &addr, plen, false);
@@ -XXX,XX +XXX,XX @@ MemoryRegionSection *iotlb_to_section(CPUState *cpu,
 {
     int asidx = cpu_asidx_from_attrs(cpu, attrs);
     CPUAddressSpace *cpuas = &cpu->cpu_ases[asidx];
-    AddressSpaceDispatch *d = qatomic_rcu_read(&cpuas->memory_dispatch);
+    AddressSpaceDispatch *d = cpuas->memory_dispatch;
     int section_index = index & ~TARGET_PAGE_MASK;
     MemoryRegionSection *ret;
 
@@ -XXX,XX +XXX,XX @@ static void tcg_log_global_after_sync(MemoryListener *listener)
     }
 }
 
+static void tcg_commit_cpu(CPUState *cpu, run_on_cpu_data data)
+{
+    CPUAddressSpace *cpuas = data.host_ptr;
+
+    cpuas->memory_dispatch = address_space_to_dispatch(cpuas->as);
+    tlb_flush(cpu);
+}
+
 static void tcg_commit(MemoryListener *listener)
 {
     CPUAddressSpace *cpuas;
-    AddressSpaceDispatch *d;
+    CPUState *cpu;
 
     assert(tcg_enabled());
     /* since each CPU stores ram addresses in its TLB cache, we must
        reset the modified entries */
     cpuas = container_of(listener, CPUAddressSpace, tcg_as_listener);
-    cpu_reloading_memory_map();
-    /* The CPU and TLB are protected by the iothread lock.
-     * We reload the dispatch pointer now because cpu_reloading_memory_map()
-     * may have split the RCU critical section.
+    cpu = cpuas->cpu;
+
+    /*
+     * Defer changes to as->memory_dispatch until the cpu is quiescent.
+     * Otherwise we race between (1) other cpu threads and (2) ongoing
+     * i/o for the current cpu thread, with data cached by mmu_lookup().
+     *
+     * In addition, queueing the work function will kick the cpu back to
+     * the main loop, which will end the RCU critical section and reclaim
+     * the memory data structures.
+     *
+     * That said, the listener is also called during realize, before
+     * all of the tcg machinery for run-on is initialized: thus halt_cond.
      */
-    d = address_space_to_dispatch(cpuas->as);
-    qatomic_rcu_set(&cpuas->memory_dispatch, d);
-    tlb_flush(cpuas->cpu);
+    if (cpu->halt_cond) {
+        async_run_on_cpu(cpu, tcg_commit_cpu, RUN_ON_CPU_HOST_PTR(cpuas));
+    } else {
+        tcg_commit_cpu(cpu, RUN_ON_CPU_HOST_PTR(cpuas));
+    }
 }
 
 static void memory_map_init(void)
-- 
2.34.1

The not pattern is always available via generic expansion.
See debug block in tcg_can_emit_vecop_list.

Fixes: 11978f6f58 ("tcg: Fix expansion of INDEX_op_not_vec")
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op-vec.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/tcg/tcg-op-vec.c b/tcg/tcg-op-vec.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op-vec.c
+++ b/tcg/tcg-op-vec.c
@@ -XXX,XX +XXX,XX @@ static bool do_op2(unsigned vece, TCGv_vec r, TCGv_vec a, TCGOpcode opc)
 
 void tcg_gen_not_vec(unsigned vece, TCGv_vec r, TCGv_vec a)
 {
-    const TCGOpcode *hold_list = tcg_swap_vecop_list(NULL);
-
-    if (!TCG_TARGET_HAS_not_vec || !do_op2(vece, r, a, INDEX_op_not_vec)) {
+    if (TCG_TARGET_HAS_not_vec) {
+        vec_gen_op2(INDEX_op_not_vec, 0, r, a);
+    } else {
         tcg_gen_xor_vec(0, r, a, tcg_constant_vec_matching(r, 0, -1));
     }
-    tcg_swap_vecop_list(hold_list);
 }
 
 void tcg_gen_neg_vec(unsigned vece, TCGv_vec r, TCGv_vec a)
-- 
2.34.1

Since a59a29312660 ("tcg/sparc64: Remove sparc32plus constraints")
we no longer distinguish registers with 32 vs 64 bits.
Therefore we can remove support for the backend-specific
type change opcodes.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/sparc64/tcg-target.h     |  2 +-
 tcg/sparc64/tcg-target.c.inc | 11 -----------
 2 files changed, 1 insertion(+), 12 deletions(-)

diff --git a/tcg/sparc64/tcg-target.h b/tcg/sparc64/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc64/tcg-target.h
+++ b/tcg/sparc64/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_mulsh_i32        0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
-#define TCG_TARGET_HAS_extr_i64_i32     1
+#define TCG_TARGET_HAS_extr_i64_i32     0
 #define TCG_TARGET_HAS_div_i64          1
 #define TCG_TARGET_HAS_rem_i64          0
 #define TCG_TARGET_HAS_rot_i64          0
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg rd, TCGReg rs)
     tcg_out_ext32u(s, rd, rs);
 }
 
-static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg rd, TCGReg rs)
-{
-    tcg_out_mov(s, TCG_TYPE_I32, rd, rs);
-}
-
 static bool tcg_out_xchg(TCGContext *s, TCGType type, TCGReg r1, TCGReg r2)
 {
     return false;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_divu_i64:
         c = ARITH_UDIVX;
         goto gen_arith;
-    case INDEX_op_extrh_i64_i32:
-        tcg_out_arithi(s, a0, a1, 32, SHIFT_SRLX);
-        break;
 
     case INDEX_op_brcond_i64:
         tcg_out_brcond_i64(s, a2, a0, a1, const_args[1], arg_label(args[3]));
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext32u_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
-    case INDEX_op_extrl_i64_i32:
     default:
         g_assert_not_reached();
     }
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_ext32u_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
-    case INDEX_op_extrl_i64_i32:
-    case INDEX_op_extrh_i64_i32:
     case INDEX_op_qemu_ld_a32_i32:
     case INDEX_op_qemu_ld_a64_i32:
     case INDEX_op_qemu_ld_a32_i64:
-- 
2.34.1