Series comparison

-[PULL 00/20] tcg patch queue
+[PULL 00/11] tcg patch queue
-The following changes since commit e93ded1bf6c94ab95015b33e188bc8b0b0c32670:
+The following changes since commit 75d30fde55485b965a1168a21d016dd07b50ed32:
-  Merge tag 'testing-pull-request-2022-08-30' of https://gitlab.com/thuth/qemu into staging (2022-08-31 18:19:03 -0400)
+  Merge tag 'block-pull-request' of https://gitlab.com/stefanha/qemu into staging (2022-10-30 15:07:25 -0400)
 are available in the Git repository at:
-  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20220901
+  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20221031
-for you to fetch changes up to 20011be2e30b8aa8ef1fc258485f00c688703deb:
+for you to fetch changes up to cb375590983fc3d23600d02ba05a05d34fe44150:
-  target/riscv: Make translator stop before the end of a page (2022-09-01 07:43:08 +0100)
+  target/i386: Expand eflags updates inline (2022-10-31 11:39:10 +1100)
 ----------------------------------------------------------------
-Respect PROT_EXEC in user-only mode.
+Remove sparc32plus support from tcg/sparc.
-Fix s390x, i386 and riscv for translations crossing a page.
+target/i386: Use cpu_unwind_state_data for tpr access.
 target/i386: Expand eflags updates inline
 ----------------------------------------------------------------
-Ilya Leoshkevich (4):
+Icenowy Zheng (1):
-      linux-user: Clear translations on mprotect()
+      tcg/tci: fix logic error when registering helpers via FFI
       accel/tcg: Introduce is_same_page()
       target/s390x: Make translator stop before the end of a page
       target/i386: Make translator stop before the end of a page
-Richard Henderson (16):
+Richard Henderson (10):
-      linux-user/arm: Mark the commpage executable
+      tcg/sparc: Remove support for sparc32plus
-      linux-user/hppa: Allocate page zero as a commpage
+      tcg/sparc64: Rename from tcg/sparc
-      linux-user/x86_64: Allocate vsyscall page as a commpage
+      tcg/sparc64: Remove sparc32plus constraints
-      linux-user: Honor PT_GNU_STACK
+      accel/tcg: Introduce cpu_unwind_state_data
-      tests/tcg/i386: Move smc_code2 to an executable section
+      target/i386: Use cpu_unwind_state_data for tpr access
-      accel/tcg: Properly implement get_page_addr_code for user-only
+      target/openrisc: Always exit after mtspr npc
-      accel/tcg: Unlock mmap_lock after longjmp
+      target/openrisc: Use cpu_unwind_state_data for mfspr
-      accel/tcg: Make tb_htable_lookup static
+      accel/tcg: Remove will_exit argument from cpu_restore_state
-      accel/tcg: Move qemu_ram_addr_from_host_nofail to physmem.c
+      accel/tcg: Remove reset_icount argument from cpu_restore_state_from_tb
-      accel/tcg: Use probe_access_internal for softmmu get_page_addr_code_hostp
+      target/i386: Expand eflags updates inline
       accel/tcg: Document the faulting lookup in tb_lookup_cmp
       accel/tcg: Remove translator_ldsw
       accel/tcg: Add pc and host_pc params to gen_intermediate_code
       accel/tcg: Add fast path for translator_ld*
       target/riscv: Add MAX_INSN_LEN and insn_len
       target/riscv: Make translator stop before the end of a page
- include/elf.h                     |   1 +
+ meson.build                                 |   4 +-
- include/exec/cpu-common.h         |   1 +
+ accel/tcg/internal.h                        |   4 +-
- include/exec/exec-all.h           |  89 ++++++++----------------
+ include/exec/exec-all.h                     |  24 ++-
- include/exec/translator.h         |  96 ++++++++++++++++---------
+ target/i386/helper.h                        |   5 -
- linux-user/arm/target_cpu.h       |   4 +-
+ tcg/{sparc => sparc64}/tcg-target-con-set.h |  16 +-
- linux-user/qemu.h                 |   1 +
+ tcg/{sparc => sparc64}/tcg-target-con-str.h |   3 -
- accel/tcg/cpu-exec.c              | 143 ++++++++++++++++++++------------------
+ tcg/{sparc => sparc64}/tcg-target.h         |  11 --
- accel/tcg/cputlb.c                |  93 +++++++------------------
+ accel/tcg/cpu-exec-common.c                 |   2 +-
- accel/tcg/translate-all.c         |  29 ++++----
+ accel/tcg/tb-maint.c                        |   4 +-
- accel/tcg/translator.c            | 135 ++++++++++++++++++++++++++---------
+ accel/tcg/translate-all.c                   |  91 +++++----
- accel/tcg/user-exec.c             |  17 ++++-
+ target/alpha/helper.c                       |   2 +-
- linux-user/elfload.c              |  82 ++++++++++++++++++++--
+ target/alpha/mem_helper.c                   |   2 +-
- linux-user/mmap.c                 |   6 +-
+ target/arm/op_helper.c                      |   2 +-
- softmmu/physmem.c                 |  12 ++++
+ target/arm/tlb_helper.c                     |   8 +-
- target/alpha/translate.c          |   5 +-
+ target/cris/helper.c                        |   2 +-
- target/arm/translate.c            |   5 +-
+ target/i386/helper.c                        |  21 ++-
- target/avr/translate.c            |   5 +-
+ target/i386/tcg/cc_helper.c                 |  41 -----
- target/cris/translate.c           |   5 +-
+ target/i386/tcg/sysemu/svm_helper.c         |   2 +-
- target/hexagon/translate.c        |   6 +-
+ target/i386/tcg/translate.c                 |  30 ++-
- target/hppa/translate.c           |   5 +-
+ target/m68k/op_helper.c                     |   4 +-
- target/i386/tcg/translate.c       |  71 +++++++++++--------
+ target/microblaze/helper.c                  |   2 +-
- target/loongarch/translate.c      |   6 +-
+ target/nios2/op_helper.c                    |   2 +-
- target/m68k/translate.c           |   5 +-
+ target/openrisc/sys_helper.c                |  17 +-
- target/microblaze/translate.c     |   5 +-
+ target/ppc/excp_helper.c                    |   2 +-
- target/mips/tcg/translate.c       |   5 +-
+ target/s390x/tcg/excp_helper.c              |   2 +-
- target/nios2/translate.c          |   5 +-
+ target/tricore/op_helper.c                  |   2 +-
- target/openrisc/translate.c       |   6 +-
+ target/xtensa/helper.c                      |   6 +-
- target/ppc/translate.c            |   5 +-
+ tcg/tcg.c                                   |  81 +-------
- target/riscv/translate.c          |  32 +++++++--
+ tcg/{sparc => sparc64}/tcg-target.c.inc     | 275 ++++++++--------------------
- target/rx/translate.c             |   5 +-
+ MAINTAINERS                                 |   2 +-
- target/s390x/tcg/translate.c      |  20 ++++--
+files changed, 232 insertions(+), 437 deletions(-)
- target/sh4/translate.c            |   5 +-
+ rename tcg/{sparc => sparc64}/tcg-target-con-set.h (69%)
- target/sparc/translate.c          |   5 +-
+ rename tcg/{sparc => sparc64}/tcg-target-con-str.h (77%)
- target/tricore/translate.c        |   6 +-
+ rename tcg/{sparc => sparc64}/tcg-target.h (95%)
- target/xtensa/translate.c         |   6 +-
+ rename tcg/{sparc => sparc64}/tcg-target.c.inc (91%)
  tests/tcg/i386/test-i386.c        |   2 +-
  tests/tcg/riscv64/noexec.c        |  79 +++++++++++++++++++++
  tests/tcg/s390x/noexec.c          | 106 ++++++++++++++++++++++++++++
  tests/tcg/x86_64/noexec.c         |  75 ++++++++++++++++++++
  tests/tcg/multiarch/noexec.c.inc  | 139 ++++++++++++++++++++++++++++++++++++
  tests/tcg/riscv64/Makefile.target |   1 +
  tests/tcg/s390x/Makefile.target   |   1 +
  tests/tcg/x86_64/Makefile.target  |   3 +-
 files changed, 966 insertions(+), 367 deletions(-)
  create mode 100644 tests/tcg/riscv64/noexec.c
  create mode 100644 tests/tcg/s390x/noexec.c
  create mode 100644 tests/tcg/x86_64/noexec.c
  create mode 100644 tests/tcg/multiarch/noexec.c.inc

-[PULL 01/20] linux-user/arm: Mark the commpage executable
+Deleted patch
-We're about to start validating PAGE_EXEC, which means
-that we've got to mark the commpage executable.  We had
-been placing the commpage outside of reserved_va, which
-was incorrect and lead to an abort.
-Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- linux-user/arm/target_cpu.h | 4 ++--
- linux-user/elfload.c        | 6 +++++-
-files changed, 7 insertions(+), 3 deletions(-)
-diff --git a/linux-user/arm/target_cpu.h b/linux-user/arm/target_cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/arm/target_cpu.h
-+++ b/linux-user/arm/target_cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline unsigned long arm_max_reserved_va(CPUState *cs)
-     } else {
-         /*
-          * We need to be able to map the commpage.
--         * See validate_guest_space in linux-user/elfload.c.
-+         * See init_guest_commpage in linux-user/elfload.c.
-          */
--        return 0xffff0000ul;
-+        return 0xfffffffful;
-     }
- }
- #define MAX_RESERVED_VA  arm_max_reserved_va
-diff --git a/linux-user/elfload.c b/linux-user/elfload.c
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/elfload.c
-+++ b/linux-user/elfload.c
-@@ -XXX,XX +XXX,XX @@ enum {
- static bool init_guest_commpage(void)
- {
--    void *want = g2h_untagged(HI_COMMPAGE & -qemu_host_page_size);
-+    abi_ptr commpage = HI_COMMPAGE & -qemu_host_page_size;
-+    void *want = g2h_untagged(commpage);
-     void *addr = mmap(want, qemu_host_page_size, PROT_READ | PROT_WRITE,
-                       MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
-@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)
-         perror("Protecting guest commpage");
-         exit(EXIT_FAILURE);
-     }
-+
-+    page_set_flags(commpage, commpage + qemu_host_page_size,
-+                   PAGE_READ | PAGE_EXEC | PAGE_VALID);
-     return true;
- }
---
-.34.1

-[PULL 3/4] target/avr: Only execute one interrupt at a time
+[PULL 01/11] tcg/sparc: Remove support for sparc32plus
-We cannot deliver two interrupts simultaneously;
+Since 9b9c37c36439, we have only supported sparc64 cpus.
-the first interrupt handler must execute first.
+Debian and Gentoo now only support 64-bit sparc64 userland,
 so it is time to drop the 32-bit sparc64 userland: sparc32plus.
-Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/avr/helper.c | 9 +++------
+ tcg/sparc/tcg-target.h     |  11 ---
-file changed, 3 insertions(+), 6 deletions(-)
+ tcg/tcg.c                  |  75 +----------------
  tcg/sparc/tcg-target.c.inc | 166 +++++++------------------------------
 files changed, 33 insertions(+), 219 deletions(-)
-diff --git a/target/avr/helper.c b/target/avr/helper.c
+diff --git a/tcg/sparc/tcg-target.h b/tcg/sparc/tcg-target.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/avr/helper.c
+--- a/tcg/sparc/tcg-target.h
-+++ b/target/avr/helper.c
++++ b/tcg/sparc/tcg-target.h
 @@ -XXX,XX +XXX,XX @@
+ #ifndef SPARC_TCG_TARGET_H
- bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
+ #define SPARC_TCG_TARGET_H
 -#define TCG_TARGET_REG_BITS 64
 -
  #define TCG_TARGET_INSN_UNIT_SIZE 4
  #define TCG_TARGET_TLB_DISPLACEMENT_BITS 32
  #define TCG_TARGET_NB_REGS 32
@@ -XXX,XX +XXX,XX @@ typedef enum {
  /* used for function call generation */
  #define TCG_REG_CALL_STACK TCG_REG_O6
 -#ifdef __arch64__
  #define TCG_TARGET_STACK_BIAS           2047
  #define TCG_TARGET_STACK_ALIGN          16
  #define TCG_TARGET_CALL_STACK_OFFSET    (128 + 6*8 + TCG_TARGET_STACK_BIAS)
 -#else
 -#define TCG_TARGET_STACK_BIAS           0
 -#define TCG_TARGET_STACK_ALIGN          8
 -#define TCG_TARGET_CALL_STACK_OFFSET    (64 + 4 + 6*4)
 -#endif
 -
 -#ifdef __arch64__
  #define TCG_TARGET_EXTEND_ARGS 1
 -#endif
  #if defined(__VIS__) && __VIS__ >= 0x300
  #define use_vis3_instructions  1
 diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg.c
 +++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args)
      }
  #endif
 -#if defined(__sparc__) && !defined(__arch64__) \
 -    && !defined(CONFIG_TCG_INTERPRETER)
 -    /* We have 64-bit values in one register, but need to pass as two
 -       separate parameters.  Split them.  */
 -    int orig_typemask = typemask;
 -    int orig_nargs = nargs;
 -    TCGv_i64 retl, reth;
 -    TCGTemp *split_args[MAX_OPC_PARAM];
 -
 -    retl = NULL;
 -    reth = NULL;
 -    typemask = 0;
 -    for (i = real_args = 0; i < nargs; ++i) {
 -        int argtype = extract32(orig_typemask, (i + 1) * 3, 3);
 -        bool is_64bit = (argtype & ~1) == dh_typecode_i64;
 -
 -        if (is_64bit) {
 -            TCGv_i64 orig = temp_tcgv_i64(args[i]);
 -            TCGv_i32 h = tcg_temp_new_i32();
 -            TCGv_i32 l = tcg_temp_new_i32();
 -            tcg_gen_extr_i64_i32(l, h, orig);
 -            split_args[real_args++] = tcgv_i32_temp(h);
 -            typemask |= dh_typecode_i32 << (real_args * 3);
 -            split_args[real_args++] = tcgv_i32_temp(l);
 -            typemask |= dh_typecode_i32 << (real_args * 3);
 -        } else {
 -            split_args[real_args++] = args[i];
 -            typemask |= argtype << (real_args * 3);
 -        }
 -    }
 -    nargs = real_args;
 -    args = split_args;
 -#elif defined(TCG_TARGET_EXTEND_ARGS) && TCG_TARGET_REG_BITS == 64
 +#if defined(TCG_TARGET_EXTEND_ARGS) && TCG_TARGET_REG_BITS == 64
      for (i = 0; i < nargs; ++i) {
          int argtype = extract32(typemask, (i + 1) * 3, 3);
          bool is_32bit = (argtype & ~1) == dh_typecode_i32;
@@ -XXX,XX +XXX,XX @@ void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args)
      pi = 0;
      if (ret != NULL) {
 -#if defined(__sparc__) && !defined(__arch64__) \
 -    && !defined(CONFIG_TCG_INTERPRETER)
 -        if ((typemask & 6) == dh_typecode_i64) {
 -            /* The 32-bit ABI is going to return the 64-bit value in
 -               the %o0/%o1 register pair.  Prepare for this by using
 -               two return temporaries, and reassemble below.  */
 -            retl = tcg_temp_new_i64();
 -            reth = tcg_temp_new_i64();
 -            op->args[pi++] = tcgv_i64_arg(reth);
 -            op->args[pi++] = tcgv_i64_arg(retl);
 -            nb_rets = 2;
 -        } else {
 -            op->args[pi++] = temp_arg(ret);
 -            nb_rets = 1;
 -        }
 -#else
          if (TCG_TARGET_REG_BITS < 64 && (typemask & 6) == dh_typecode_i64) {
  #if HOST_BIG_ENDIAN
              op->args[pi++] = temp_arg(ret + 1);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args)
              op->args[pi++] = temp_arg(ret);
              nb_rets = 1;
          }
 -#endif
      } else {
          nb_rets = 0;
      }
@@ -XXX,XX +XXX,XX @@ void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args)
      tcg_debug_assert(TCGOP_CALLI(op) == real_args);
      tcg_debug_assert(pi <= ARRAY_SIZE(op->args));
 -#if defined(__sparc__) && !defined(__arch64__) \
 -    && !defined(CONFIG_TCG_INTERPRETER)
 -    /* Free all of the parts we allocated above.  */
 -    for (i = real_args = 0; i < orig_nargs; ++i) {
 -        int argtype = extract32(orig_typemask, (i + 1) * 3, 3);
 -        bool is_64bit = (argtype & ~1) == dh_typecode_i64;
 -
 -        if (is_64bit) {
 -            tcg_temp_free_internal(args[real_args++]);
 -            tcg_temp_free_internal(args[real_args++]);
 -        } else {
 -            real_args++;
 -        }
 -    }
 -    if ((orig_typemask & 6) == dh_typecode_i64) {
 -        /* The 32-bit ABI returned two 32-bit pieces.  Re-assemble them.
 -           Note that describing these as TCGv_i64 eliminates an unnecessary
 -           zero-extension that tcg_gen_concat_i32_i64 would create.  */
 -        tcg_gen_concat32_i64(temp_tcgv_i64(ret), retl, reth);
 -        tcg_temp_free_i64(retl);
 -        tcg_temp_free_i64(reth);
 -    }
 -#elif defined(TCG_TARGET_EXTEND_ARGS) && TCG_TARGET_REG_BITS == 64
 +#if defined(TCG_TARGET_EXTEND_ARGS) && TCG_TARGET_REG_BITS == 64
      for (i = 0; i < nargs; ++i) {
          int argtype = extract32(typemask, (i + 1) * 3, 3);
          bool is_32bit = (argtype & ~1) == dh_typecode_i32;
 diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/sparc/tcg-target.c.inc
 +++ b/tcg/sparc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@
   * THE SOFTWARE.
   */
 +/* We only support generating code for 64-bit mode.  */
 +#ifndef __arch64__
 +#error "unsupported code generation mode"
 +#endif
 +
  #include "../tcg-pool.c.inc"
  #ifdef CONFIG_DEBUG_TCG
@@ -XXX,XX +XXX,XX @@ static const char * const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
  };
  #endif
 -#ifdef __arch64__
 -# define SPARC64 1
 -#else
 -# define SPARC64 0
 -#endif
 -
  #define TCG_CT_CONST_S11  0x100
  #define TCG_CT_CONST_S13  0x200
  #define TCG_CT_CONST_ZERO 0x400
@@ -XXX,XX +XXX,XX @@ static const char * const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
   * high bits of the %i and %l registers garbage at all times.
   */
  #define ALL_GENERAL_REGS     MAKE_64BIT_MASK(0, 32)
 -#if SPARC64
  # define ALL_GENERAL_REGS64  ALL_GENERAL_REGS
 -#else
 -# define ALL_GENERAL_REGS64  MAKE_64BIT_MASK(0, 16)
 -#endif
  #define ALL_QLDST_REGS       (ALL_GENERAL_REGS & ~SOFTMMU_RESERVE_REGS)
  #define ALL_QLDST_REGS64     (ALL_GENERAL_REGS64 & ~SOFTMMU_RESERVE_REGS)
@@ -XXX,XX +XXX,XX @@ static bool check_fit_i32(int32_t val, unsigned int bits)
  }
  #define check_fit_tl    check_fit_i64
 -#if SPARC64
 -# define check_fit_ptr  check_fit_i64
 -#else
 -# define check_fit_ptr  check_fit_i32
 -#endif
 +#define check_fit_ptr   check_fit_i64
  static bool patch_reloc(tcg_insn_unit *src_rw, int type,
                          intptr_t value, intptr_t addend)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_sety(TCGContext *s, TCGReg rs)
      tcg_out32(s, WRY | INSN_RS1(TCG_REG_G0) | INSN_RS2(rs));
  }
 -static void tcg_out_rdy(TCGContext *s, TCGReg rd)
 -{
 -    tcg_out32(s, RDY | INSN_RD(rd));
 -}
 -
  static void tcg_out_div32(TCGContext *s, TCGReg rd, TCGReg rs1,
                            int32_t val2, int val2const, int uns)
  {
--    bool ret = false;
+@@ -XXX,XX +XXX,XX @@ static void emit_extend(TCGContext *s, TCGReg r, int op)
-     AVRCPU *cpu = AVR_CPU(cs);
+         tcg_out_arithi(s, r, r, 16, SHIFT_SRL);
-     CPUAVRState *env = &cpu->env;
+         break;
+     case MO_32:
-@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
+-        if (SPARC64) {
-             avr_cpu_do_interrupt(cs);
+-            tcg_out_arith(s, r, r, 0, SHIFT_SRL);
+-        }
-             cs->interrupt_request &= ~CPU_INTERRUPT_RESET;
++        tcg_out_arith(s, r, r, 0, SHIFT_SRL);
--
+         break;
--            ret = true;
+     case MO_64:
-+            return true;
+         break;
@@ -XXX,XX +XXX,XX @@ static void build_trampolines(TCGContext *s)
      };
      int i;
 -    TCGReg ra;
      for (i = 0; i < ARRAY_SIZE(qemu_ld_helpers); ++i) {
          if (qemu_ld_helpers[i] == NULL) {
@@ -XXX,XX +XXX,XX @@ static void build_trampolines(TCGContext *s)
          }
+         qemu_ld_trampoline[i] = tcg_splitwx_to_rx(s->code_ptr);
+-        if (SPARC64 || TARGET_LONG_BITS == 32) {
+-            ra = TCG_REG_O3;
+-        } else {
+-            /* Install the high part of the address.  */
+-            tcg_out_arithi(s, TCG_REG_O1, TCG_REG_O2, 32, SHIFT_SRLX);
+-            ra = TCG_REG_O4;
+-        }
+-
+         /* Set the retaddr operand.  */
+-        tcg_out_mov(s, TCG_TYPE_PTR, ra, TCG_REG_O7);
++        tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_O3, TCG_REG_O7);
+         /* Tail call.  */
+         tcg_out_jmpl_const(s, qemu_ld_helpers[i], true, true);
+         /* delay slot -- set the env argument */
+@@ -XXX,XX +XXX,XX @@ static void build_trampolines(TCGContext *s)
+         }
+         qemu_st_trampoline[i] = tcg_splitwx_to_rx(s->code_ptr);
+-        if (SPARC64) {
+-            emit_extend(s, TCG_REG_O2, i);
+-            ra = TCG_REG_O4;
+-        } else {
+-            ra = TCG_REG_O1;
+-            if (TARGET_LONG_BITS == 64) {
+-                /* Install the high part of the address.  */
+-                tcg_out_arithi(s, ra, ra + 1, 32, SHIFT_SRLX);
+-                ra += 2;
+-            } else {
+-                ra += 1;
+-            }
+-            if ((i & MO_SIZE) == MO_64) {
+-                /* Install the high part of the data.  */
+-                tcg_out_arithi(s, ra, ra + 1, 32, SHIFT_SRLX);
+-                ra += 2;
+-            } else {
+-                emit_extend(s, ra, i);
+-                ra += 1;
+-            }
+-            /* Skip the oi argument.  */
+-            ra += 1;
+-        }
+-
++        emit_extend(s, TCG_REG_O2, i);
++
+         /* Set the retaddr operand.  */
+-        if (ra >= TCG_REG_O6) {
+-            tcg_out_st(s, TCG_TYPE_PTR, TCG_REG_O7, TCG_REG_CALL_STACK,
+-                       TCG_TARGET_CALL_STACK_OFFSET);
+-        } else {
+-            tcg_out_mov(s, TCG_TYPE_PTR, ra, TCG_REG_O7);
+-        }
++        tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_O4, TCG_REG_O7);
+         /* Tail call.  */
+         tcg_out_jmpl_const(s, qemu_st_helpers[i], true, true);
+@@ -XXX,XX +XXX,XX @@ static void build_trampolines(TCGContext *s)
+             qemu_unalign_st_trampoline = tcg_splitwx_to_rx(s->code_ptr);
+         }
+-        if (!SPARC64 && TARGET_LONG_BITS == 64) {
+-            /* Install the high part of the address.  */
+-            tcg_out_arithi(s, TCG_REG_O1, TCG_REG_O2, 32, SHIFT_SRLX);
+-        }
+-
+         /* Tail call.  */
+         tcg_out_jmpl_const(s, helper, true, true);
+         /* delay slot -- set the env argument */
+@@ -XXX,XX +XXX,XX @@ static TCGReg tcg_out_tlb_load(TCGContext *s, TCGReg addr, int mem_index,
+     tcg_out_cmp(s, r0, r2, 0);
+     /* If the guest address must be zero-extended, do so now.  */
+-    if (SPARC64 && TARGET_LONG_BITS == 32) {
++    if (TARGET_LONG_BITS == 32) {
+         tcg_out_arithi(s, r0, addr, 0, SHIFT_SRL);
+         return r0;
      }
-     if (interrupt_request & CPU_INTERRUPT_HARD) {
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data, TCGReg addr,
-@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-             if (!env->intsrc) {
+ #ifdef CONFIG_SOFTMMU
-                 cs->interrupt_request &= ~CPU_INTERRUPT_HARD;
+     unsigned memi = get_mmuidx(oi);
-             }
+-    TCGReg addrz, param;
--
++    TCGReg addrz;
--            ret = true;
+     const tcg_insn_unit *func;
-+            return true;
-         }
+     addrz = tcg_out_tlb_load(s, addr, memi, memop,
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data, TCGReg addr,
      /* TLB Miss.  */
 -    param = TCG_REG_O1;
 -    if (!SPARC64 && TARGET_LONG_BITS == 64) {
 -        /* Skip the high-part; we'll perform the extract in the trampoline.  */
 -        param++;
 -    }
 -    tcg_out_mov(s, TCG_TYPE_REG, param++, addrz);
 +    tcg_out_mov(s, TCG_TYPE_REG, TCG_REG_O1, addrz);
      /* We use the helpers to extend SB and SW data, leaving the case
         of SL needing explicit extending below.  */
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data, TCGReg addr,
      tcg_debug_assert(func != NULL);
      tcg_out_call_nodelay(s, func, false);
      /* delay slot */
 -    tcg_out_movi(s, TCG_TYPE_I32, param, oi);
 +    tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_O2, oi);
 -    /* Recall that all of the helpers return 64-bit results.
 -       Which complicates things for sparcv8plus.  */
 -    if (SPARC64) {
 -        /* We let the helper sign-extend SB and SW, but leave SL for here.  */
 -        if (is_64 && (memop & MO_SSIZE) == MO_SL) {
 -            tcg_out_arithi(s, data, TCG_REG_O0, 0, SHIFT_SRA);
 -        } else {
 -            tcg_out_mov(s, TCG_TYPE_REG, data, TCG_REG_O0);
 -        }
 +    /* We let the helper sign-extend SB and SW, but leave SL for here.  */
 +    if (is_64 && (memop & MO_SSIZE) == MO_SL) {
 +        tcg_out_arithi(s, data, TCG_REG_O0, 0, SHIFT_SRA);
      } else {
 -        if ((memop & MO_SIZE) == MO_64) {
 -            tcg_out_arithi(s, TCG_REG_O0, TCG_REG_O0, 32, SHIFT_SLLX);
 -            tcg_out_arithi(s, TCG_REG_O1, TCG_REG_O1, 0, SHIFT_SRL);
 -            tcg_out_arith(s, data, TCG_REG_O0, TCG_REG_O1, ARITH_OR);
 -        } else if (is_64) {
 -            /* Re-extend from 32-bit rather than reassembling when we
 -               know the high register must be an extension.  */
 -            tcg_out_arithi(s, data, TCG_REG_O1, 0,
 -                           memop & MO_SIGN ? SHIFT_SRA : SHIFT_SRL);
 -        } else {
 -            tcg_out_mov(s, TCG_TYPE_I32, data, TCG_REG_O1);
 -        }
 +        tcg_out_mov(s, TCG_TYPE_REG, data, TCG_REG_O0);
      }
--    return ret;
-+    return false;
+     *label_ptr |= INSN_OFF19(tcg_ptr_byte_diff(s->code_ptr, label_ptr));
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data, TCGReg addr,
      unsigned s_bits = memop & MO_SIZE;
      unsigned t_bits;
 -    if (SPARC64 && TARGET_LONG_BITS == 32) {
 +    if (TARGET_LONG_BITS == 32) {
          tcg_out_arithi(s, TCG_REG_T1, addr, 0, SHIFT_SRL);
          addr = TCG_REG_T1;
      }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data, TCGReg addr,
           * operation in the delay slot, and failure need only invoke the
           * handler for SIGBUS.
           */
 -        TCGReg arg_low = TCG_REG_O1 + (!SPARC64 && TARGET_LONG_BITS == 64);
          tcg_out_call_nodelay(s, qemu_unalign_ld_trampoline, false);
          /* delay slot -- move to low part of argument reg */
 -        tcg_out_mov_delay(s, arg_low, addr);
 +        tcg_out_mov_delay(s, TCG_REG_O1, addr);
      } else {
          /* Underalignment: load by pieces of minimum alignment. */
          int ld_opc, a_size, s_size, i;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data, TCGReg addr,
  #ifdef CONFIG_SOFTMMU
      unsigned memi = get_mmuidx(oi);
 -    TCGReg addrz, param;
 +    TCGReg addrz;
      const tcg_insn_unit *func;
      addrz = tcg_out_tlb_load(s, addr, memi, memop,
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data, TCGReg addr,
      /* TLB Miss.  */
 -    param = TCG_REG_O1;
 -    if (!SPARC64 && TARGET_LONG_BITS == 64) {
 -        /* Skip the high-part; we'll perform the extract in the trampoline.  */
 -        param++;
 -    }
 -    tcg_out_mov(s, TCG_TYPE_REG, param++, addrz);
 -    if (!SPARC64 && (memop & MO_SIZE) == MO_64) {
 -        /* Skip the high-part; we'll perform the extract in the trampoline.  */
 -        param++;
 -    }
 -    tcg_out_mov(s, TCG_TYPE_REG, param++, data);
 +    tcg_out_mov(s, TCG_TYPE_REG, TCG_REG_O1, addrz);
 +    tcg_out_mov(s, TCG_TYPE_REG, TCG_REG_O2, data);
      func = qemu_st_trampoline[memop & (MO_BSWAP | MO_SIZE)];
      tcg_debug_assert(func != NULL);
      tcg_out_call_nodelay(s, func, false);
      /* delay slot */
 -    tcg_out_movi(s, TCG_TYPE_I32, param, oi);
 +    tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_O3, oi);
      *label_ptr |= INSN_OFF19(tcg_ptr_byte_diff(s->code_ptr, label_ptr));
  #else
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data, TCGReg addr,
      unsigned s_bits = memop & MO_SIZE;
      unsigned t_bits;
 -    if (SPARC64 && TARGET_LONG_BITS == 32) {
 +    if (TARGET_LONG_BITS == 32) {
          tcg_out_arithi(s, TCG_REG_T1, addr, 0, SHIFT_SRL);
          addr = TCG_REG_T1;
      }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data, TCGReg addr,
           * operation in the delay slot, and failure need only invoke the
           * handler for SIGBUS.
           */
 -        TCGReg arg_low = TCG_REG_O1 + (!SPARC64 && TARGET_LONG_BITS == 64);
          tcg_out_call_nodelay(s, qemu_unalign_st_trampoline, false);
          /* delay slot -- move to low part of argument reg */
 -        tcg_out_mov_delay(s, arg_low, addr);
 +        tcg_out_mov_delay(s, TCG_REG_O1, addr);
      } else {
          /* Underalignment: store by pieces of minimum alignment. */
          int st_opc, a_size, s_size, i;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_muls2_i32:
          c = ARITH_SMUL;
      do_mul2:
 -        /* The 32-bit multiply insns produce a full 64-bit result.  If the
 -           destination register can hold it, we can avoid the slower RDY.  */
 +        /* The 32-bit multiply insns produce a full 64-bit result. */
          tcg_out_arithc(s, a0, a2, args[3], const_args[3], c);
 -        if (SPARC64 || a0 <= TCG_REG_O7) {
 -            tcg_out_arithi(s, a1, a0, 32, SHIFT_SRLX);
 -        } else {
 -            tcg_out_rdy(s, a1);
 -        }
 +        tcg_out_arithi(s, a1, a0, 32, SHIFT_SRLX);
          break;
      case INDEX_op_qemu_ld_i32:
@@ -XXX,XX +XXX,XX @@ static void tcg_target_init(TCGContext *s)
      tcg_regset_set_reg(s->reserved_regs, TCG_REG_T2); /* for internal use */
  }
- void avr_cpu_do_interrupt(CPUState *cs)
+-#if SPARC64
 -# define ELF_HOST_MACHINE  EM_SPARCV9
 -#else
 -# define ELF_HOST_MACHINE  EM_SPARC32PLUS
 -# define ELF_HOST_FLAGS    EF_SPARC_32PLUS
 -#endif
 +#define ELF_HOST_MACHINE  EM_SPARCV9
  typedef struct {
      DebugFrameHeader h;
 -    uint8_t fde_def_cfa[SPARC64 ? 4 : 2];
 +    uint8_t fde_def_cfa[4];
      uint8_t fde_win_save;
      uint8_t fde_ret_save[3];
  } DebugFrame;
@@ -XXX,XX +XXX,XX @@ static const DebugFrame debug_frame = {
      .h.fde.len = sizeof(DebugFrame) - offsetof(DebugFrame, h.fde.cie_offset),
      .fde_def_cfa = {
 -#if SPARC64
 , 30,                         /* DW_CFA_def_cfa i6, 2047 */
          (2047 & 0x7f) | 0x80, (2047 >> 7)
 -#else
 -        13, 30                          /* DW_CFA_def_cfa_register i6 */
 -#endif
      },
      .fde_win_save = 0x2d,               /* DW_CFA_GNU_window_save */
      .fde_ret_save = { 9, 15, 31 },      /* DW_CFA_register o7, i7 */
 --
 .34.1

-[PULL 4/4] target/avr: Disable interrupts when env->skip set
+[PULL 02/11] tcg/sparc64: Rename from tcg/sparc
-This bit is not saved across interrupts, so we must
+Emphasize that we only support full 64-bit code generation.
 delay delivering the interrupt until the skip has
 been processed.
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1118
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/avr/helper.c    |  9 +++++++++
+ meson.build                                 | 4 +---
- target/avr/translate.c | 26 ++++++++++++++++++++++----
+ tcg/{sparc => sparc64}/tcg-target-con-set.h | 0
-files changed, 31 insertions(+), 4 deletions(-)
+ tcg/{sparc => sparc64}/tcg-target-con-str.h | 0
  tcg/{sparc => sparc64}/tcg-target.h         | 0
  tcg/{sparc => sparc64}/tcg-target.c.inc     | 0
  MAINTAINERS                                 | 2 +-
 files changed, 2 insertions(+), 4 deletions(-)
  rename tcg/{sparc => sparc64}/tcg-target-con-set.h (100%)
  rename tcg/{sparc => sparc64}/tcg-target-con-str.h (100%)
  rename tcg/{sparc => sparc64}/tcg-target.h (100%)
  rename tcg/{sparc => sparc64}/tcg-target.c.inc (100%)
-diff --git a/target/avr/helper.c b/target/avr/helper.c
+diff --git a/meson.build b/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/target/avr/helper.c
+--- a/meson.build
-+++ b/target/avr/helper.c
++++ b/meson.build
-@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
+@@ -XXX,XX +XXX,XX @@ qapi_trace_events = []
-     AVRCPU *cpu = AVR_CPU(cs);
+ bsd_oses = ['gnu/kfreebsd', 'freebsd', 'netbsd', 'openbsd', 'dragonfly', 'darwin']
-     CPUAVRState *env = &cpu->env;
+ supported_oses = ['windows', 'freebsd', 'netbsd', 'openbsd', 'darwin', 'sunos', 'linux']
+ supported_cpus = ['ppc', 'ppc64', 's390x', 'riscv', 'x86', 'x86_64',
-+    /*
+-  'arm', 'aarch64', 'loongarch64', 'mips', 'mips64', 'sparc', 'sparc64']
-+     * We cannot separate a skip from the next instruction,
++  'arm', 'aarch64', 'loongarch64', 'mips', 'mips64', 'sparc64']
-+     * as the skip would not be preserved across the interrupt.
-+     * Separating the two insn normally only happens at page boundaries.
+ cpu = host_machine.cpu_family()
-+     */
-+    if (env->skip) {
+@@ -XXX,XX +XXX,XX @@ if get_option('tcg').allowed()
-+        return false;
+   endif
-+    }
+   if get_option('tcg_interpreter')
-+
+     tcg_arch = 'tci'
-     if (interrupt_request & CPU_INTERRUPT_RESET) {
+-  elif host_arch == 'sparc64'
-         if (cpu_interrupts_enabled(env)) {
+-    tcg_arch = 'sparc'
-             cs->exception_index = EXCP_RESET;
+   elif host_arch == 'x86_64'
-diff --git a/target/avr/translate.c b/target/avr/translate.c
+     tcg_arch = 'i386'
    elif host_arch == 'ppc64'
 diff --git a/tcg/sparc/tcg-target-con-set.h b/tcg/sparc64/tcg-target-con-set.h
 similarity index 100%
 rename from tcg/sparc/tcg-target-con-set.h
 rename to tcg/sparc64/tcg-target-con-set.h
 diff --git a/tcg/sparc/tcg-target-con-str.h b/tcg/sparc64/tcg-target-con-str.h
 similarity index 100%
 rename from tcg/sparc/tcg-target-con-str.h
 rename to tcg/sparc64/tcg-target-con-str.h
 diff --git a/tcg/sparc/tcg-target.h b/tcg/sparc64/tcg-target.h
 similarity index 100%
 rename from tcg/sparc/tcg-target.h
 rename to tcg/sparc64/tcg-target.h
 diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
 similarity index 100%
 rename from tcg/sparc/tcg-target.c.inc
 rename to tcg/sparc64/tcg-target.c.inc
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
---- a/target/avr/translate.c
+--- a/MAINTAINERS
-+++ b/target/avr/translate.c
++++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ static void avr_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ L: qemu-s390x@nongnu.org
-     if (skip_label) {
-         canonicalize_skip(ctx);
+ SPARC TCG target
-         gen_set_label(skip_label);
+ S: Odd Fixes
--        if (ctx->base.is_jmp == DISAS_NORETURN) {
+-F: tcg/sparc/
-+
++F: tcg/sparc64/
-+        switch (ctx->base.is_jmp) {
+ F: disas/sparc.c
-+        case DISAS_NORETURN:
-             ctx->base.is_jmp = DISAS_CHAIN;
+ TCI TCG target
 +            break;
 +        case DISAS_NEXT:
 +            if (ctx->base.tb->flags & TB_FLAGS_SKIP) {
 +                ctx->base.is_jmp = DISAS_TOO_MANY;
 +            }
 +            break;
 +        default:
 +            break;
          }
      }
@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
  {
      DisasContext *ctx = container_of(dcbase, DisasContext, base);
      bool nonconst_skip = canonicalize_skip(ctx);
 +    /*
 +     * Because we disable interrupts while env->skip is set,
 +     * we must return to the main loop to re-evaluate afterward.
 +     */
 +    bool force_exit = ctx->base.tb->flags & TB_FLAGS_SKIP;
      switch (ctx->base.is_jmp) {
      case DISAS_NORETURN:
@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
      case DISAS_NEXT:
      case DISAS_TOO_MANY:
      case DISAS_CHAIN:
 -        if (!nonconst_skip) {
 +        if (!nonconst_skip && !force_exit) {
              /* Note gen_goto_tb checks singlestep.  */
              gen_goto_tb(ctx, 1, ctx->npc);
              break;
@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
          tcg_gen_movi_tl(cpu_pc, ctx->npc);
          /* fall through */
      case DISAS_LOOKUP:
 -        tcg_gen_lookup_and_goto_ptr();
 -        break;
 +        if (!force_exit) {
 +            tcg_gen_lookup_and_goto_ptr();
 +            break;
 +        }
 +        /* fall through */
      case DISAS_EXIT:
          tcg_gen_exit_tb(NULL, 0);
          break;
 --
 .34.1

-[PULL 20/20] target/riscv: Make translator stop before the end of a page
+[PULL 03/11] tcg/sparc64: Remove sparc32plus constraints
-Right now the translator stops right *after* the end of a page, which
+With sparc64 we need not distinguish between registers that
-breaks reporting of fault locations when the last instruction of a
+can hold 32-bit values and those that can hold 64-bit values.
 multi-insn translation block crosses a page boundary.
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1155
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/riscv/translate.c          | 17 +++++--
+ tcg/sparc64/tcg-target-con-set.h |  16 +----
- tests/tcg/riscv64/noexec.c        | 79 +++++++++++++++++++++++++++++++
+ tcg/sparc64/tcg-target-con-str.h |   3 -
- tests/tcg/riscv64/Makefile.target |  1 +
+ tcg/sparc64/tcg-target.c.inc     | 109 ++++++++++++-------------------
-files changed, 93 insertions(+), 4 deletions(-)
+files changed, 44 insertions(+), 84 deletions(-)
  create mode 100644 tests/tcg/riscv64/noexec.c
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
+diff --git a/tcg/sparc64/tcg-target-con-set.h b/tcg/sparc64/tcg-target-con-set.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
+--- a/tcg/sparc64/tcg-target-con-set.h
-+++ b/target/riscv/translate.c
++++ b/tcg/sparc64/tcg-target-con-set.h
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
      }
      ctx->nftemp = 0;
 +    /* Only the first insn within a TB is allowed to cross a page boundary. */
      if (ctx->base.is_jmp == DISAS_NEXT) {
 -        target_ulong page_start;
 -
 -        page_start = ctx->base.pc_first & TARGET_PAGE_MASK;
 -        if (ctx->base.pc_next - page_start >= TARGET_PAGE_SIZE) {
 +        if (!is_same_page(&ctx->base, ctx->base.pc_next)) {
              ctx->base.is_jmp = DISAS_TOO_MANY;
 +        } else {
 +            unsigned page_ofs = ctx->base.pc_next & ~TARGET_PAGE_MASK;
 +
 +            if (page_ofs > TARGET_PAGE_SIZE - MAX_INSN_LEN) {
 +                uint16_t next_insn = cpu_lduw_code(env, ctx->base.pc_next);
 +                int len = insn_len(next_insn);
 +
 +                if (!is_same_page(&ctx->base, ctx->base.pc_next + len)) {
 +                    ctx->base.is_jmp = DISAS_TOO_MANY;
 +                }
 +            }
          }
      }
  }
 diff --git a/tests/tcg/riscv64/noexec.c b/tests/tcg/riscv64/noexec.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/tcg/riscv64/noexec.c
 @@ -XXX,XX +XXX,XX @@
-+#include "../multiarch/noexec.c.inc"
+  */
-+
+ C_O0_I1(r)
-+static void *arch_mcontext_pc(const mcontext_t *ctx)
+ C_O0_I2(rZ, r)
-+{
+-C_O0_I2(RZ, r)
-+    return (void *)ctx->__gregs[REG_PC];
+ C_O0_I2(rZ, rJ)
-+}
+-C_O0_I2(RZ, RJ)
-+
+-C_O0_I2(sZ, A)
-+static int arch_mcontext_arg(const mcontext_t *ctx)
+-C_O0_I2(SZ, A)
-+{
+-C_O1_I1(r, A)
-+    return ctx->__gregs[REG_A0];
+-C_O1_I1(R, A)
-+}
++C_O0_I2(sZ, s)
-+
++C_O1_I1(r, s)
-+static void arch_flush(void *p, int len)
+ C_O1_I1(r, r)
-+{
+-C_O1_I1(r, R)
-+    __builtin___clear_cache(p, p + len);
+-C_O1_I1(R, r)
-+}
+-C_O1_I1(R, R)
-+
+-C_O1_I2(R, R, R)
-+extern char noexec_1[];
++C_O1_I2(r, r, r)
-+extern char noexec_2[];
+ C_O1_I2(r, rZ, rJ)
-+extern char noexec_end[];
+-C_O1_I2(R, RZ, RJ)
-+
+ C_O1_I4(r, rZ, rJ, rI, 0)
-+asm(".option push\n"
+-C_O1_I4(R, RZ, RJ, RI, 0)
-+    ".option norvc\n"
+ C_O2_I2(r, r, rZ, rJ)
-+    "noexec_1:\n"
+-C_O2_I4(R, R, RZ, RZ, RJ, RI)
-+    "   li a0,1\n"       /* a0 is 0 on entry, set 1. */
+ C_O2_I4(r, r, rZ, rZ, rJ, rJ)
-+    "noexec_2:\n"
+diff --git a/tcg/sparc64/tcg-target-con-str.h b/tcg/sparc64/tcg-target-con-str.h
 +    "   li a0,2\n"      /* a0 is 0/1; set 2. */
 +    "   ret\n"
 +    "noexec_end:\n"
 +    ".option pop");
 +
 +int main(void)
 +{
 +    struct noexec_test noexec_tests[] = {
 +        {
 +            .name = "fallthrough",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2,
 +            .entry_ofs = noexec_1 - noexec_2,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = 0,
 +            .expected_arg = 1,
 +        },
 +        {
 +            .name = "jump",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2,
 +            .entry_ofs = 0,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = 0,
 +            .expected_arg = 0,
 +        },
 +        {
 +            .name = "fallthrough [cross]",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2 - 2,
 +            .entry_ofs = noexec_1 - noexec_2 - 2,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = -2,
 +            .expected_arg = 1,
 +        },
 +        {
 +            .name = "jump [cross]",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2 - 2,
 +            .entry_ofs = -2,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = -2,
 +            .expected_arg = 0,
 +        },
 +    };
 +
 +    return test_noexec(noexec_tests,
 +                       sizeof(noexec_tests) / sizeof(noexec_tests[0]));
 +}
 diff --git a/tests/tcg/riscv64/Makefile.target b/tests/tcg/riscv64/Makefile.target
 index XXXXXXX..XXXXXXX 100644
---- a/tests/tcg/riscv64/Makefile.target
+--- a/tcg/sparc64/tcg-target-con-str.h
-+++ b/tests/tcg/riscv64/Makefile.target
++++ b/tcg/sparc64/tcg-target-con-str.h
 @@ -XXX,XX +XXX,XX @@
+  * REGS(letter, register_mask)
- VPATH += $(SRC_PATH)/tests/tcg/riscv64
+  */
- TESTS += test-div
+ REGS('r', ALL_GENERAL_REGS)
-+TESTS += noexec
+-REGS('R', ALL_GENERAL_REGS64)
  REGS('s', ALL_QLDST_REGS)
 -REGS('S', ALL_QLDST_REGS64)
 -REGS('A', TARGET_LONG_BITS == 64 ? ALL_QLDST_REGS64 : ALL_QLDST_REGS)
  /*
   * Define constraint letters for constants:
 diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/sparc64/tcg-target.c.inc
 +++ b/tcg/sparc64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char * const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
  #else
  #define SOFTMMU_RESERVE_REGS 0
  #endif
 -
 -/*
 - * Note that sparcv8plus can only hold 64 bit quantities in %g and %o
 - * registers.  These are saved manually by the kernel in full 64-bit
 - * slots.  The %i and %l registers are saved by the register window
 - * mechanism, which only allocates space for 32 bits.  Given that this
 - * window spill/fill can happen on any signal, we must consider the
 - * high bits of the %i and %l registers garbage at all times.
 - */
  #define ALL_GENERAL_REGS     MAKE_64BIT_MASK(0, 32)
 -# define ALL_GENERAL_REGS64  ALL_GENERAL_REGS
  #define ALL_QLDST_REGS       (ALL_GENERAL_REGS & ~SOFTMMU_RESERVE_REGS)
 -#define ALL_QLDST_REGS64     (ALL_GENERAL_REGS64 & ~SOFTMMU_RESERVE_REGS)
  /* Define some temporary registers.  T2 is used for constant generation.  */
  #define TCG_REG_T1  TCG_REG_G1
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
          return C_O0_I1(r);
      case INDEX_op_ld8u_i32:
 +    case INDEX_op_ld8u_i64:
      case INDEX_op_ld8s_i32:
 +    case INDEX_op_ld8s_i64:
      case INDEX_op_ld16u_i32:
 +    case INDEX_op_ld16u_i64:
      case INDEX_op_ld16s_i32:
 +    case INDEX_op_ld16s_i64:
      case INDEX_op_ld_i32:
 +    case INDEX_op_ld32u_i64:
 +    case INDEX_op_ld32s_i64:
 +    case INDEX_op_ld_i64:
      case INDEX_op_neg_i32:
 +    case INDEX_op_neg_i64:
      case INDEX_op_not_i32:
 +    case INDEX_op_not_i64:
 +    case INDEX_op_ext32s_i64:
 +    case INDEX_op_ext32u_i64:
 +    case INDEX_op_ext_i32_i64:
 +    case INDEX_op_extu_i32_i64:
 +    case INDEX_op_extrl_i64_i32:
 +    case INDEX_op_extrh_i64_i32:
          return C_O1_I1(r, r);
      case INDEX_op_st8_i32:
 +    case INDEX_op_st8_i64:
      case INDEX_op_st16_i32:
 +    case INDEX_op_st16_i64:
      case INDEX_op_st_i32:
 +    case INDEX_op_st32_i64:
 +    case INDEX_op_st_i64:
          return C_O0_I2(rZ, r);
      case INDEX_op_add_i32:
 +    case INDEX_op_add_i64:
      case INDEX_op_mul_i32:
 +    case INDEX_op_mul_i64:
      case INDEX_op_div_i32:
 +    case INDEX_op_div_i64:
      case INDEX_op_divu_i32:
 +    case INDEX_op_divu_i64:
      case INDEX_op_sub_i32:
 +    case INDEX_op_sub_i64:
      case INDEX_op_and_i32:
 +    case INDEX_op_and_i64:
      case INDEX_op_andc_i32:
 +    case INDEX_op_andc_i64:
      case INDEX_op_or_i32:
 +    case INDEX_op_or_i64:
      case INDEX_op_orc_i32:
 +    case INDEX_op_orc_i64:
      case INDEX_op_xor_i32:
 +    case INDEX_op_xor_i64:
      case INDEX_op_shl_i32:
 +    case INDEX_op_shl_i64:
      case INDEX_op_shr_i32:
 +    case INDEX_op_shr_i64:
      case INDEX_op_sar_i32:
 +    case INDEX_op_sar_i64:
      case INDEX_op_setcond_i32:
 +    case INDEX_op_setcond_i64:
          return C_O1_I2(r, rZ, rJ);
      case INDEX_op_brcond_i32:
 +    case INDEX_op_brcond_i64:
          return C_O0_I2(rZ, rJ);
      case INDEX_op_movcond_i32:
 +    case INDEX_op_movcond_i64:
          return C_O1_I4(r, rZ, rJ, rI, 0);
      case INDEX_op_add2_i32:
 +    case INDEX_op_add2_i64:
      case INDEX_op_sub2_i32:
 +    case INDEX_op_sub2_i64:
          return C_O2_I4(r, r, rZ, rZ, rJ, rJ);
      case INDEX_op_mulu2_i32:
      case INDEX_op_muls2_i32:
          return C_O2_I2(r, r, rZ, rJ);
 -
 -    case INDEX_op_ld8u_i64:
 -    case INDEX_op_ld8s_i64:
 -    case INDEX_op_ld16u_i64:
 -    case INDEX_op_ld16s_i64:
 -    case INDEX_op_ld32u_i64:
 -    case INDEX_op_ld32s_i64:
 -    case INDEX_op_ld_i64:
 -    case INDEX_op_ext_i32_i64:
 -    case INDEX_op_extu_i32_i64:
 -        return C_O1_I1(R, r);
 -
 -    case INDEX_op_st8_i64:
 -    case INDEX_op_st16_i64:
 -    case INDEX_op_st32_i64:
 -    case INDEX_op_st_i64:
 -        return C_O0_I2(RZ, r);
 -
 -    case INDEX_op_add_i64:
 -    case INDEX_op_mul_i64:
 -    case INDEX_op_div_i64:
 -    case INDEX_op_divu_i64:
 -    case INDEX_op_sub_i64:
 -    case INDEX_op_and_i64:
 -    case INDEX_op_andc_i64:
 -    case INDEX_op_or_i64:
 -    case INDEX_op_orc_i64:
 -    case INDEX_op_xor_i64:
 -    case INDEX_op_shl_i64:
 -    case INDEX_op_shr_i64:
 -    case INDEX_op_sar_i64:
 -    case INDEX_op_setcond_i64:
 -        return C_O1_I2(R, RZ, RJ);
 -
 -    case INDEX_op_neg_i64:
 -    case INDEX_op_not_i64:
 -    case INDEX_op_ext32s_i64:
 -    case INDEX_op_ext32u_i64:
 -        return C_O1_I1(R, R);
 -
 -    case INDEX_op_extrl_i64_i32:
 -    case INDEX_op_extrh_i64_i32:
 -        return C_O1_I1(r, R);
 -
 -    case INDEX_op_brcond_i64:
 -        return C_O0_I2(RZ, RJ);
 -    case INDEX_op_movcond_i64:
 -        return C_O1_I4(R, RZ, RJ, RI, 0);
 -    case INDEX_op_add2_i64:
 -    case INDEX_op_sub2_i64:
 -        return C_O2_I4(R, R, RZ, RZ, RJ, RI);
      case INDEX_op_muluh_i64:
 -        return C_O1_I2(R, R, R);
 +        return C_O1_I2(r, r, r);
      case INDEX_op_qemu_ld_i32:
 -        return C_O1_I1(r, A);
      case INDEX_op_qemu_ld_i64:
 -        return C_O1_I1(R, A);
 +        return C_O1_I1(r, s);
      case INDEX_op_qemu_st_i32:
 -        return C_O0_I2(sZ, A);
      case INDEX_op_qemu_st_i64:
 -        return C_O0_I2(SZ, A);
 +        return C_O0_I2(sZ, s);
      default:
          g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ static void tcg_target_init(TCGContext *s)
  #endif
      tcg_target_available_regs[TCG_TYPE_I32] = ALL_GENERAL_REGS;
 -    tcg_target_available_regs[TCG_TYPE_I64] = ALL_GENERAL_REGS64;
 +    tcg_target_available_regs[TCG_TYPE_I64] = ALL_GENERAL_REGS;
      tcg_target_call_clobber_regs = 0;
      tcg_regset_set_reg(tcg_target_call_clobber_regs, TCG_REG_G1);
 --
 .34.1

-[PULL 1/4] target/avr: Support probe argument to tlb_fill
+[PULL 04/11] tcg/tci: fix logic error when registering helpers via FFI
-While there are no target-specific nonfaulting probes,
+From: Icenowy Zheng <uwu@icenowy.me>
 generic code may grow some uses at some point.
-Note that the attrs argument was incorrect -- it should have
+When registering helpers via FFI for TCI, the inner loop that iterates
-been MEMTXATTRS_UNSPECIFIED. Just use the simpler interface.
+parameters of the helper reuses (and thus pollutes) the same variable
 used by the outer loop that iterates all helpers, thus made some helpers
 unregistered.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Fix this logic error by using a dedicated temporary variable for the
 inner loop.
 Fixes: 22f15579fa ("tcg: Build ffi data structures for helpers")
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Icenowy Zheng <uwu@icenowy.me>
 Message-Id: <20221028072145.1593205-1-uwu@icenowy.me>
 [rth: Move declaration of j to the for loop itself]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/avr/helper.c | 46 ++++++++++++++++++++++++++++-----------------
+ tcg/tcg.c | 6 +++---
-file changed, 29 insertions(+), 17 deletions(-)
+file changed, 3 insertions(+), 3 deletions(-)
-diff --git a/target/avr/helper.c b/target/avr/helper.c
+diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/avr/helper.c
+--- a/tcg/tcg.c
-+++ b/target/avr/helper.c
++++ b/tcg/tcg.c
-@@ -XXX,XX +XXX,XX @@ bool avr_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
+@@ -XXX,XX +XXX,XX @@ static void tcg_context_init(unsigned max_cpus)
-                       MMUAccessType access_type, int mmu_idx,
-                       bool probe, uintptr_t retaddr)
+         if (nargs != 0) {
- {
+             ca->cif.arg_types = ca->args;
--    int prot = 0;
+-            for (i = 0; i < nargs; ++i) {
--    MemTxAttrs attrs = {};
+-                int typecode = extract32(typemask, (i + 1) * 3, 3);
-+    int prot, page_size = TARGET_PAGE_SIZE;
+-                ca->args[i] = typecode_to_ffi[typecode];
-     uint32_t paddr;
++            for (int j = 0; j < nargs; ++j) {
++                int typecode = extract32(typemask, (j + 1) * 3, 3);
-     address &= TARGET_PAGE_MASK;
++                ca->args[j] = typecode_to_ffi[typecode];
+             }
      if (mmu_idx == MMU_CODE_IDX) {
 -        /* access to code in flash */
 +        /* Access to code in flash. */
          paddr = OFFSET_CODE + address;
          prot = PAGE_READ | PAGE_EXEC;
 -        if (paddr + TARGET_PAGE_SIZE > OFFSET_DATA) {
 +        if (paddr >= OFFSET_DATA) {
 +            /*
 +             * This should not be possible via any architectural operations.
 +             * There is certainly not an exception that we can deliver.
 +             * Accept probing that might come from generic code.
 +             */
 +            if (probe) {
 +                return false;
 +            }
              error_report("execution left flash memory");
              abort();
          }
--    } else if (address < NUMBER_OF_CPU_REGISTERS + NUMBER_OF_IO_REGISTERS) {
--        /*
--         * access to CPU registers, exit and rebuilt this TB to use full access
--         * incase it touches specially handled registers like SREG or SP
--         */
--        AVRCPU *cpu = AVR_CPU(cs);
--        CPUAVRState *env = &cpu->env;
--        env->fullacc = 1;
--        cpu_loop_exit_restore(cs, retaddr);
-     } else {
--        /* access to memory. nothing special */
-+        /* Access to memory. */
-         paddr = OFFSET_DATA + address;
-         prot = PAGE_READ | PAGE_WRITE;
-+        if (address < NUMBER_OF_CPU_REGISTERS + NUMBER_OF_IO_REGISTERS) {
-+            /*
-+             * Access to CPU registers, exit and rebuilt this TB to use
-+             * full access in case it touches specially handled registers
-+             * like SREG or SP.  For probing, set page_size = 1, in order
-+             * to force tlb_fill to be called for the next access.
-+             */
-+            if (probe) {
-+                page_size = 1;
-+            } else {
-+                AVRCPU *cpu = AVR_CPU(cs);
-+                CPUAVRState *env = &cpu->env;
-+                env->fullacc = 1;
-+                cpu_loop_exit_restore(cs, retaddr);
-+            }
-+        }
-     }
--    tlb_set_page_with_attrs(cs, address, paddr, attrs, prot,
--                            mmu_idx, TARGET_PAGE_SIZE);
--
-+    tlb_set_page(cs, address, paddr, prot, mmu_idx, page_size);
-     return true;
- }
 --
 .34.1

-[PULL 15/20] accel/tcg: Add pc and host_pc params to gen_intermediate_code
+[PULL 05/11] accel/tcg: Introduce cpu_unwind_state_data
-Pass these along to translator_loop -- pc may be used instead
+Add a way to examine the unwind data without actually
-of tb->pc, and host_pc is currently unused.  Adjust all targets
+restoring the data back into env.
 at one time.
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Claudio Fontana <cfontana@suse.de>
 Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/exec-all.h       |  1 -
+ accel/tcg/internal.h      |  4 +--
- include/exec/translator.h     | 24 ++++++++++++++++++++----
+ include/exec/exec-all.h   | 21 ++++++++---
- accel/tcg/translate-all.c     |  6 ++++--
+ accel/tcg/translate-all.c | 74 ++++++++++++++++++++++++++-------------
- accel/tcg/translator.c        |  9 +++++----
+files changed, 68 insertions(+), 31 deletions(-)
  target/alpha/translate.c      |  5 +++--
  target/arm/translate.c        |  5 +++--
  target/avr/translate.c        |  5 +++--
  target/cris/translate.c       |  5 +++--
  target/hexagon/translate.c    |  6 ++++--
  target/hppa/translate.c       |  5 +++--
  target/i386/tcg/translate.c   |  5 +++--
  target/loongarch/translate.c  |  6 ++++--
  target/m68k/translate.c       |  5 +++--
  target/microblaze/translate.c |  5 +++--
  target/mips/tcg/translate.c   |  5 +++--
  target/nios2/translate.c      |  5 +++--
  target/openrisc/translate.c   |  6 ++++--
  target/ppc/translate.c        |  5 +++--
  target/riscv/translate.c      |  5 +++--
  target/rx/translate.c         |  5 +++--
  target/s390x/tcg/translate.c  |  5 +++--
  target/sh4/translate.c        |  5 +++--
  target/sparc/translate.c      |  5 +++--
  target/tricore/translate.c    |  6 ++++--
  target/xtensa/translate.c     |  6 ++++--
 files changed, 97 insertions(+), 53 deletions(-)
+diff --git a/accel/tcg/internal.h b/accel/tcg/internal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/internal.h
++++ b/accel/tcg/internal.h
+@@ -XXX,XX +XXX,XX @@ void tb_reset_jump(TranslationBlock *tb, int n);
+ TranslationBlock *tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
+                                tb_page_addr_t phys_page2);
+ bool tb_invalidate_phys_page_unwind(tb_page_addr_t addr, uintptr_t pc);
+-int cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
+-                              uintptr_t searched_pc, bool reset_icount);
++void cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
++                               uintptr_t host_pc, bool reset_icount);
+ /* Return the current PC from CPU, which may be cached in TB. */
+ static inline target_ulong log_pc(CPUState *cpu, const TranslationBlock *tb)
 diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/exec/exec-all.h
 +++ b/include/exec/exec-all.h
 @@ -XXX,XX +XXX,XX @@ typedef ram_addr_t tb_page_addr_t;
  #define TB_PAGE_ADDR_FMT RAM_ADDR_FMT
  #endif
--void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns);
- void restore_state_to_opc(CPUArchState *env, TranslationBlock *tb,
-                           target_ulong *data);
-diff --git a/include/exec/translator.h b/include/exec/translator.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/exec/translator.h
-+++ b/include/exec/translator.h
-@@ -XXX,XX +XXX,XX @@
- #include "exec/translate-all.h"
- #include "tcg/tcg.h"
 +/**
-+ * gen_intermediate_code
++ * cpu_unwind_state_data:
-+ * @cpu: cpu context
++ * @cpu: the cpu context
-+ * @tb: translation block
++ * @host_pc: the host pc within the translation
-+ * @max_insns: max number of instructions to translate
++ * @data: output data
 + * @pc: guest virtual program counter address
 + * @host_pc: host physical program counter address
 + *
-+ * This function must be provided by the target, which should create
++ * Attempt to load the the unwind state for a host pc occurring in
-+ * the target-specific DisasContext, and then invoke translator_loop.
++ * translated code.  If @host_pc is not in translated code, the
 + * function returns false; otherwise @data is loaded.
 + * This is the same unwind info as given to restore_state_to_opc.
 + */
-+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
++bool cpu_unwind_state_data(CPUState *cpu, uintptr_t host_pc, uint64_t *data);
-+                           target_ulong pc, void *host_pc);
++
  /**
-  * DisasJumpType:
+  * cpu_restore_state:
-@@ -XXX,XX +XXX,XX @@ typedef struct TranslatorOps {
+- * @cpu: the vCPU state is to be restore to
+- * @searched_pc: the host PC the fault occurred at
- /**
++ * @cpu: the cpu context
-  * translator_loop:
++ * @host_pc: the host pc within the translation
-- * @ops: Target-specific operations.
+  * @will_exit: true if the TB executed will be interrupted after some
-- * @db: Disassembly context.
+                cpu adjustments. Required for maintaining the correct
-  * @cpu: Target vCPU.
+                icount valus
-  * @tb: Translation block.
+  * @return: true if state was restored, false otherwise
   * @max_insns: Maximum number of insns to translate.
 + * @pc: guest virtual program counter address
 + * @host_pc: host physical program counter address
 + * @ops: Target-specific operations.
 + * @db: Disassembly context.
   *
-  * Generic translator loop.
+  * Attempt to restore the state for a fault occurring in translated
-  *
+- * code. If the searched_pc is not in translated code no state is
-@@ -XXX,XX +XXX,XX @@ typedef struct TranslatorOps {
++ * code. If @host_pc is not in translated code no state is
-  * - When single-stepping is enabled (system-wide or on the current vCPU).
+  * restored and the function returns false.
   * - When too many instructions have been translated.
   */
--void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
+-bool cpu_restore_state(CPUState *cpu, uintptr_t searched_pc, bool will_exit);
--                     CPUState *cpu, TranslationBlock *tb, int max_insns);
++bool cpu_restore_state(CPUState *cpu, uintptr_t host_pc, bool will_exit);
-+void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
-+                     target_ulong pc, void *host_pc,
+ G_NORETURN void cpu_loop_exit_noexc(CPUState *cpu);
-+                     const TranslatorOps *ops, DisasContextBase *db);
+ G_NORETURN void cpu_loop_exit(CPUState *cpu);
  void translator_loop_temp_check(DisasContextBase *db);
 diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translate-all.c
 +++ b/accel/tcg/translate-all.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static int encode_search(TranslationBlock *tb, uint8_t *block)
+     return p - block;
- #include "exec/cputlb.h"
+ }
- #include "exec/translate-all.h"
-+#include "exec/translator.h"
+-/* The cpu state corresponding to 'searched_pc' is restored.
- #include "qemu/bitmap.h"
+- * When reset_icount is true, current TB will be interrupted and
- #include "qemu/qemu-print.h"
+- * icount should be recalculated.
- #include "qemu/timer.h"
+- */
-@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
+-int cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
-     TCGProfile *prof = &tcg_ctx->prof;
+-                              uintptr_t searched_pc, bool reset_icount)
-     int64_t ti;
++static int cpu_unwind_data_from_tb(TranslationBlock *tb, uintptr_t host_pc,
 +                                   uint64_t *data)
  {
 -    uint64_t data[TARGET_INSN_START_WORDS];
 -    uintptr_t host_pc = (uintptr_t)tb->tc.ptr;
 +    uintptr_t iter_pc = (uintptr_t)tb->tc.ptr;
      const uint8_t *p = tb->tc.ptr + tb->tc.size;
      int i, j, num_insns = tb->icount;
 -#ifdef CONFIG_PROFILER
 -    TCGProfile *prof = &tcg_ctx->prof;
 -    int64_t ti = profile_getclock();
 -#endif
 -    searched_pc -= GETPC_ADJ;
 +    host_pc -= GETPC_ADJ;
 -    if (searched_pc < host_pc) {
 +    if (host_pc < iter_pc) {
          return -1;
      }
 -    memset(data, 0, sizeof(data));
 +    memset(data, 0, sizeof(uint64_t) * TARGET_INSN_START_WORDS);
      if (!TARGET_TB_PCREL) {
          data[0] = tb_pc(tb);
      }
 -    /* Reconstruct the stored insn data while looking for the point at
 -       which the end of the insn exceeds the searched_pc.  */
 +    /*
 +     * Reconstruct the stored insn data while looking for the point
 +     * at which the end of the insn exceeds host_pc.
 +     */
      for (i = 0; i < num_insns; ++i) {
          for (j = 0; j < TARGET_INSN_START_WORDS; ++j) {
              data[j] += decode_sleb128(&p);
          }
 -        host_pc += decode_sleb128(&p);
 -        if (host_pc > searched_pc) {
 -            goto found;
 +        iter_pc += decode_sleb128(&p);
 +        if (iter_pc > host_pc) {
 +            return num_insns - i;
          }
      }
      return -1;
 +}
 +
 +/*
 + * The cpu state corresponding to 'host_pc' is restored.
 + * When reset_icount is true, current TB will be interrupted and
 + * icount should be recalculated.
 + */
 +void cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
 +                               uintptr_t host_pc, bool reset_icount)
 +{
 +    uint64_t data[TARGET_INSN_START_WORDS];
 +#ifdef CONFIG_PROFILER
 +    TCGProfile *prof = &tcg_ctx->prof;
 +    int64_t ti = profile_getclock();
 +#endif
 +    int insns_left = cpu_unwind_data_from_tb(tb, host_pc, data);
 +
 +    if (insns_left < 0) {
 +        return;
 +    }
 - found:
      if (reset_icount && (tb_cflags(tb) & CF_USE_ICOUNT)) {
          assert(icount_enabled());
 -        /* Reset the cycle counter to the start of the block
 -           and shift if to the number of actually executed instructions */
 -        cpu_neg(cpu)->icount_decr.u16.low += num_insns - i;
 +        /*
 +         * Reset the cycle counter to the start of the block and
 +         * shift if to the number of actually executed instructions.
 +         */
 +        cpu_neg(cpu)->icount_decr.u16.low += insns_left;
      }
      cpu->cc->tcg_ops->restore_state_to_opc(cpu, tb, data);
@@ -XXX,XX +XXX,XX @@ int cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
                  prof->restore_time + profile_getclock() - ti);
      qatomic_set(&prof->restore_count, prof->restore_count + 1);
  #endif
-+    void *host_pc;
+-    return 0;
      assert_memory_lock();
      qemu_thread_jit_write();
 -    phys_pc = get_page_addr_code(env, pc);
 +    phys_pc = get_page_addr_code_hostp(env, pc, &host_pc);
      if (phys_pc == -1) {
          /* Generate a one-shot TB with 1 insn in it */
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
      tcg_func_start(tcg_ctx);
      tcg_ctx->cpu = env_cpu(env);
 -    gen_intermediate_code(cpu, tb, max_insns);
 +    gen_intermediate_code(cpu, tb, max_insns, pc, host_pc);
      assert(tb->size != 0);
      tcg_ctx->cpu = NULL;
      max_insns = tb->icount;
 diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translator.c
 +++ b/accel/tcg/translator.c
@@ -XXX,XX +XXX,XX @@ static inline void translator_page_protect(DisasContextBase *dcbase,
  #endif
  }
--void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
+ bool cpu_restore_state(CPUState *cpu, uintptr_t host_pc, bool will_exit)
--                     CPUState *cpu, TranslationBlock *tb, int max_insns)
+@@ -XXX,XX +XXX,XX @@ bool cpu_restore_state(CPUState *cpu, uintptr_t host_pc, bool will_exit)
-+void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
+     return false;
-+                     target_ulong pc, void *host_pc,
+ }
-+                     const TranslatorOps *ops, DisasContextBase *db)
 +bool cpu_unwind_state_data(CPUState *cpu, uintptr_t host_pc, uint64_t *data)
 +{
 +    if (in_code_gen_buffer((const void *)(host_pc - tcg_splitwx_diff))) {
 +        TranslationBlock *tb = tcg_tb_lookup(host_pc);
 +        if (tb) {
 +            return cpu_unwind_data_from_tb(tb, host_pc, data) >= 0;
 +        }
 +    }
 +    return false;
 +}
 +
  void page_init(void)
  {
-     uint32_t cflags = tb_cflags(tb);
+     page_size_init();
      bool plugin_enabled;
      /* Initialize DisasContext */
      db->tb = tb;
 -    db->pc_first = tb->pc;
 -    db->pc_next = db->pc_first;
 +    db->pc_first = pc;
 +    db->pc_next = pc;
      db->is_jmp = DISAS_NEXT;
      db->num_insns = 0;
      db->max_insns = max_insns;
 diff --git a/target/alpha/translate.c b/target/alpha/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/alpha/translate.c
 +++ b/target/alpha/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps alpha_tr_ops = {
      .disas_log          = alpha_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&alpha_tr_ops, &dc.base, cpu, tb, max_insns);
 +    translator_loop(cpu, tb, max_insns, pc, host_pc, &alpha_tr_ops, &dc.base);
  }
  void restore_state_to_opc(CPUAlphaState *env, TranslationBlock *tb,
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps thumb_translator_ops = {
  };
  /* generate intermediate code for basic block 'tb'.  */
 -void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc = { };
      const TranslatorOps *ops = &arm_translator_ops;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
      }
  #endif
 -    translator_loop(ops, &dc.base, cpu, tb, max_insns);
 +    translator_loop(cpu, tb, max_insns, pc, host_pc, ops, &dc.base);
  }
  void restore_state_to_opc(CPUARMState *env, TranslationBlock *tb,
 diff --git a/target/avr/translate.c b/target/avr/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/avr/translate.c
 +++ b/target/avr/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps avr_tr_ops = {
      .disas_log          = avr_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc = { };
 -    translator_loop(&avr_tr_ops, &dc.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &avr_tr_ops, &dc.base);
  }
  void restore_state_to_opc(CPUAVRState *env, TranslationBlock *tb,
 diff --git a/target/cris/translate.c b/target/cris/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/cris/translate.c
 +++ b/target/cris/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps cris_tr_ops = {
      .disas_log          = cris_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&cris_tr_ops, &dc.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &cris_tr_ops, &dc.base);
  }
  void cris_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 diff --git a/target/hexagon/translate.c b/target/hexagon/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hexagon/translate.c
 +++ b/target/hexagon/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps hexagon_tr_ops = {
      .disas_log          = hexagon_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&hexagon_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc,
 +                    &hexagon_tr_ops, &ctx.base);
  }
  #define NAME_LEN               64
 diff --git a/target/hppa/translate.c b/target/hppa/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hppa/translate.c
 +++ b/target/hppa/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps hppa_tr_ops = {
      .disas_log          = hppa_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&hppa_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &hppa_tr_ops, &ctx.base);
  }
  void restore_state_to_opc(CPUHPPAState *env, TranslationBlock *tb,
 diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/translate.c
 +++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps i386_tr_ops = {
  };
  /* generate intermediate code for basic block 'tb'.  */
 -void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&i386_tr_ops, &dc.base, cpu, tb, max_insns);
 +    translator_loop(cpu, tb, max_insns, pc, host_pc, &i386_tr_ops, &dc.base);
  }
  void restore_state_to_opc(CPUX86State *env, TranslationBlock *tb,
 diff --git a/target/loongarch/translate.c b/target/loongarch/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/loongarch/translate.c
 +++ b/target/loongarch/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps loongarch_tr_ops = {
      .disas_log          = loongarch_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&loongarch_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc,
 +                    &loongarch_tr_ops, &ctx.base);
  }
  void loongarch_translate_init(void)
 diff --git a/target/m68k/translate.c b/target/m68k/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/m68k/translate.c
 +++ b/target/m68k/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps m68k_tr_ops = {
      .disas_log          = m68k_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&m68k_tr_ops, &dc.base, cpu, tb, max_insns);
 +    translator_loop(cpu, tb, max_insns, pc, host_pc, &m68k_tr_ops, &dc.base);
  }
  static double floatx80_to_double(CPUM68KState *env, uint16_t high, uint64_t low)
 diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/microblaze/translate.c
 +++ b/target/microblaze/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps mb_tr_ops = {
      .disas_log          = mb_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&mb_tr_ops, &dc.base, cpu, tb, max_insns);
 +    translator_loop(cpu, tb, max_insns, pc, host_pc, &mb_tr_ops, &dc.base);
  }
  void mb_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/tcg/translate.c
 +++ b/target/mips/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps mips_tr_ops = {
      .disas_log          = mips_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&mips_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &mips_tr_ops, &ctx.base);
  }
  void mips_tcg_init(void)
 diff --git a/target/nios2/translate.c b/target/nios2/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/nios2/translate.c
 +++ b/target/nios2/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps nios2_tr_ops = {
      .disas_log          = nios2_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&nios2_tr_ops, &dc.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &nios2_tr_ops, &dc.base);
  }
  void nios2_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/openrisc/translate.c
 +++ b/target/openrisc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps openrisc_tr_ops = {
      .disas_log          = openrisc_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&openrisc_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc,
 +                    &openrisc_tr_ops, &ctx.base);
  }
  void openrisc_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 diff --git a/target/ppc/translate.c b/target/ppc/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/ppc/translate.c
 +++ b/target/ppc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps ppc_tr_ops = {
      .disas_log          = ppc_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&ppc_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &ppc_tr_ops, &ctx.base);
  }
  void restore_state_to_opc(CPUPPCState *env, TranslationBlock *tb,
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps riscv_tr_ops = {
      .disas_log          = riscv_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&riscv_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &riscv_tr_ops, &ctx.base);
  }
  void riscv_translate_init(void)
 diff --git a/target/rx/translate.c b/target/rx/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/rx/translate.c
 +++ b/target/rx/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps rx_tr_ops = {
      .disas_log          = rx_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&rx_tr_ops, &dc.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &rx_tr_ops, &dc.base);
  }
  void restore_state_to_opc(CPURXState *env, TranslationBlock *tb,
 diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/tcg/translate.c
 +++ b/target/s390x/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps s390x_tr_ops = {
      .disas_log          = s390x_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&s390x_tr_ops, &dc.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &s390x_tr_ops, &dc.base);
  }
  void restore_state_to_opc(CPUS390XState *env, TranslationBlock *tb,
 diff --git a/target/sh4/translate.c b/target/sh4/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sh4/translate.c
 +++ b/target/sh4/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps sh4_tr_ops = {
      .disas_log          = sh4_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&sh4_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &sh4_tr_ops, &ctx.base);
  }
  void restore_state_to_opc(CPUSH4State *env, TranslationBlock *tb,
 diff --git a/target/sparc/translate.c b/target/sparc/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sparc/translate.c
 +++ b/target/sparc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps sparc_tr_ops = {
      .disas_log          = sparc_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc = {};
 -    translator_loop(&sparc_tr_ops, &dc.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &sparc_tr_ops, &dc.base);
  }
  void sparc_tcg_init(void)
 diff --git a/target/tricore/translate.c b/target/tricore/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tricore/translate.c
 +++ b/target/tricore/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps tricore_tr_ops = {
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&tricore_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc,
 +                    &tricore_tr_ops, &ctx.base);
  }
  void
 diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/xtensa/translate.c
 +++ b/target/xtensa/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps xtensa_translator_ops = {
      .disas_log          = xtensa_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc = {};
 -    translator_loop(&xtensa_translator_ops, &dc.base, cpu, tb, max_insns);
 +    translator_loop(cpu, tb, max_insns, pc, host_pc,
 +                    &xtensa_translator_ops, &dc.base);
  }
  void xtensa_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 --
 .34.1

-[PULL 17/20] target/s390x: Make translator stop before the end of a page
+[PULL 06/11] target/i386: Use cpu_unwind_state_data for tpr access
-From: Ilya Leoshkevich <iii@linux.ibm.com>
+Avoid cpu_restore_state, and modifying env->eip out from
 underneath the translator with TARGET_TB_PCREL.  There is
 some slight duplication from x86_restore_state_to_opc,
 but it's just a few lines.
-Right now translator stops right *after* the end of a page, which
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1269
-breaks reporting of fault locations when the last instruction of a
+Reviewed-by: Claudio Fontana <cfontana@suse.de>
 multi-insn translation block crosses a page boundary.
 Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20220817150506.592862-3-iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/s390x/tcg/translate.c     |  15 +++-
+ target/i386/helper.c | 21 +++++++++++++++++++--
- tests/tcg/s390x/noexec.c         | 106 +++++++++++++++++++++++
+file changed, 19 insertions(+), 2 deletions(-)
  tests/tcg/multiarch/noexec.c.inc | 139 +++++++++++++++++++++++++++++++
  tests/tcg/s390x/Makefile.target  |   1 +
 files changed, 257 insertions(+), 4 deletions(-)
  create mode 100644 tests/tcg/s390x/noexec.c
  create mode 100644 tests/tcg/multiarch/noexec.c.inc
-diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
+diff --git a/target/i386/helper.c b/target/i386/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/s390x/tcg/translate.c
+--- a/target/i386/helper.c
-+++ b/target/s390x/tcg/translate.c
++++ b/target/i386/helper.c
-@@ -XXX,XX +XXX,XX @@ static void s390x_tr_insn_start(DisasContextBase *dcbase, CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ void cpu_x86_inject_mce(Monitor *mon, X86CPU *cpu, int bank,
-     dc->insn_start = tcg_last_op();
+     }
  }
-+static target_ulong get_next_pc(CPUS390XState *env, DisasContext *s,
++static target_ulong get_memio_eip(CPUX86State *env)
 +                                uint64_t pc)
 +{
-+    uint64_t insn = ld_code2(env, s, pc);
++    uint64_t data[TARGET_INSN_START_WORDS];
 +    CPUState *cs = env_cpu(env);
 +
-+    return pc + get_ilen((insn >> 8) & 0xff);
++    if (!cpu_unwind_state_data(cs, cs->mem_io_pc, data)) {
-+}
++        return env->eip;
 +
  static void s390x_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
  {
      CPUS390XState *env = cs->env_ptr;
@@ -XXX,XX +XXX,XX @@ static void s390x_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
      dc->base.is_jmp = translate_one(env, dc);
      if (dc->base.is_jmp == DISAS_NEXT) {
 -        uint64_t page_start;
 -
 -        page_start = dc->base.pc_first & TARGET_PAGE_MASK;
 -        if (dc->base.pc_next - page_start >= TARGET_PAGE_SIZE || dc->ex_value) {
 +        if (!is_same_page(dcbase, dc->base.pc_next) ||
 +            !is_same_page(dcbase, get_next_pc(env, dc, dc->base.pc_next)) ||
 +            dc->ex_value) {
              dc->base.is_jmp = DISAS_TOO_MANY;
          }
      }
 diff --git a/tests/tcg/s390x/noexec.c b/tests/tcg/s390x/noexec.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/tcg/s390x/noexec.c
@@ -XXX,XX +XXX,XX @@
 +#include "../multiarch/noexec.c.inc"
 +
 +static void *arch_mcontext_pc(const mcontext_t *ctx)
 +{
 +    return (void *)ctx->psw.addr;
 +}
 +
 +static int arch_mcontext_arg(const mcontext_t *ctx)
 +{
 +    return ctx->gregs[2];
 +}
 +
 +static void arch_flush(void *p, int len)
 +{
 +}
 +
 +extern char noexec_1[];
 +extern char noexec_2[];
 +extern char noexec_end[];
 +
 +asm("noexec_1:\n"
 +    "   lgfi %r2,1\n"       /* %r2 is 0 on entry, set 1. */
 +    "noexec_2:\n"
 +    "   lgfi %r2,2\n"       /* %r2 is 0/1; set 2. */
 +    "   br %r14\n"          /* return */
 +    "noexec_end:");
 +
 +extern char exrl_1[];
 +extern char exrl_2[];
 +extern char exrl_end[];
 +
 +asm("exrl_1:\n"
 +    "   exrl %r0, exrl_2\n"
 +    "   br %r14\n"
 +    "exrl_2:\n"
 +    "   lgfi %r2,2\n"
 +    "exrl_end:");
 +
 +int main(void)
 +{
 +    struct noexec_test noexec_tests[] = {
 +        {
 +            .name = "fallthrough",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2,
 +            .entry_ofs = noexec_1 - noexec_2,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = 0,
 +            .expected_arg = 1,
 +        },
 +        {
 +            .name = "jump",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2,
 +            .entry_ofs = 0,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = 0,
 +            .expected_arg = 0,
 +        },
 +        {
 +            .name = "exrl",
 +            .test_code = exrl_1,
 +            .test_len = exrl_end - exrl_1,
 +            .page_ofs = exrl_1 - exrl_2,
 +            .entry_ofs = exrl_1 - exrl_2,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = exrl_1 - exrl_2,
 +            .expected_arg = 0,
 +        },
 +        {
 +            .name = "fallthrough [cross]",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2 - 2,
 +            .entry_ofs = noexec_1 - noexec_2 - 2,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = -2,
 +            .expected_arg = 1,
 +        },
 +        {
 +            .name = "jump [cross]",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2 - 2,
 +            .entry_ofs = -2,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = -2,
 +            .expected_arg = 0,
 +        },
 +        {
 +            .name = "exrl [cross]",
 +            .test_code = exrl_1,
 +            .test_len = exrl_end - exrl_1,
 +            .page_ofs = exrl_1 - exrl_2 - 2,
 +            .entry_ofs = exrl_1 - exrl_2 - 2,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = exrl_1 - exrl_2 - 2,
 +            .expected_arg = 0,
 +        },
 +    };
 +
 +    return test_noexec(noexec_tests,
 +                       sizeof(noexec_tests) / sizeof(noexec_tests[0]));
 +}
 diff --git a/tests/tcg/multiarch/noexec.c.inc b/tests/tcg/multiarch/noexec.c.inc
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/tcg/multiarch/noexec.c.inc
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Common code for arch-specific MMU_INST_FETCH fault testing.
 + */
 +
 +#define _GNU_SOURCE
 +
 +#include <assert.h>
 +#include <signal.h>
 +#include <stdio.h>
 +#include <stdlib.h>
 +#include <string.h>
 +#include <errno.h>
 +#include <unistd.h>
 +#include <sys/mman.h>
 +#include <sys/ucontext.h>
 +
 +/* Forward declarations. */
 +
 +static void *arch_mcontext_pc(const mcontext_t *ctx);
 +static int arch_mcontext_arg(const mcontext_t *ctx);
 +static void arch_flush(void *p, int len);
 +
 +/* Testing infrastructure. */
 +
 +struct noexec_test {
 +    const char *name;
 +    const char *test_code;
 +    int test_len;
 +    int page_ofs;
 +    int entry_ofs;
 +    int expected_si_ofs;
 +    int expected_pc_ofs;
 +    int expected_arg;
 +};
 +
 +static void *page_base;
 +static int page_size;
 +static const struct noexec_test *current_noexec_test;
 +
 +static void handle_err(const char *syscall)
 +{
 +    printf("[  FAILED  ] %s: %s\n", syscall, strerror(errno));
 +    exit(EXIT_FAILURE);
 +}
 +
 +static void handle_segv(int sig, siginfo_t *info, void *ucontext)
 +{
 +    const struct noexec_test *test = current_noexec_test;
 +    const mcontext_t *mc = &((ucontext_t *)ucontext)->uc_mcontext;
 +    void *expected_si;
 +    void *expected_pc;
 +    void *pc;
 +    int arg;
 +
 +    if (test == NULL) {
 +        printf("[  FAILED  ] unexpected SEGV\n");
 +        exit(EXIT_FAILURE);
 +    }
 +    current_noexec_test = NULL;
 +
 +    expected_si = page_base + test->expected_si_ofs;
 +    if (info->si_addr != expected_si) {
 +        printf("[  FAILED  ] wrong si_addr (%p != %p)\n",
 +               info->si_addr, expected_si);
 +        exit(EXIT_FAILURE);
 +    }
 +
-+    pc = arch_mcontext_pc(mc);
++    /* Per x86_restore_state_to_opc. */
-+    expected_pc = page_base + test->expected_pc_ofs;
++    if (TARGET_TB_PCREL) {
-+    if (pc != expected_pc) {
++        return (env->eip & TARGET_PAGE_MASK) | data[0];
-+        printf("[  FAILED  ] wrong pc (%p != %p)\n", pc, expected_pc);
++    } else {
-+        exit(EXIT_FAILURE);
++        return data[0] - env->segs[R_CS].base;
 +    }
 +
 +    arg = arch_mcontext_arg(mc);
 +    if (arg != test->expected_arg) {
 +        printf("[  FAILED  ] wrong arg (%d != %d)\n", arg, test->expected_arg);
 +        exit(EXIT_FAILURE);
 +    }
 +
 +    if (mprotect(page_base, page_size,
 +                 PROT_READ | PROT_WRITE | PROT_EXEC) < 0) {
 +        handle_err("mprotect");
 +    }
 +}
 +
-+static void test_noexec_1(const struct noexec_test *test)
+ void cpu_report_tpr_access(CPUX86State *env, TPRAccess access)
-+{
+ {
-+    void *start = page_base + test->page_ofs;
+     X86CPU *cpu = env_archcpu(env);
-+    void (*fn)(int arg) = page_base + test->entry_ofs;
+@@ -XXX,XX +XXX,XX @@ void cpu_report_tpr_access(CPUX86State *env, TPRAccess access)
-+
-+    memcpy(start, test->test_code, test->test_len);
+         cpu_interrupt(cs, CPU_INTERRUPT_TPR);
-+    arch_flush(start, test->test_len);
+     } else if (tcg_enabled()) {
-+
+-        cpu_restore_state(cs, cs->mem_io_pc, false);
-+    /* Trigger TB creation in order to test invalidation. */
++        target_ulong eip = get_memio_eip(env);
-+    fn(0);
-+
+-        apic_handle_tpr_access_report(cpu->apic_state, env->eip, access);
-+    if (mprotect(page_base, page_size, PROT_NONE) < 0) {
++        apic_handle_tpr_access_report(cpu->apic_state, eip, access);
-+        handle_err("mprotect");
+     }
-+    }
+ }
-+
+ #endif /* !CONFIG_USER_ONLY */
 +    /* Trigger SEGV and check that handle_segv() ran. */
 +    current_noexec_test = test;
 +    fn(0);
 +    assert(current_noexec_test == NULL);
 +}
 +
 +static int test_noexec(struct noexec_test *tests, size_t n_tests)
 +{
 +    struct sigaction act;
 +    size_t i;
 +
 +    memset(&act, 0, sizeof(act));
 +    act.sa_sigaction = handle_segv;
 +    act.sa_flags = SA_SIGINFO;
 +    if (sigaction(SIGSEGV, &act, NULL) < 0) {
 +        handle_err("sigaction");
 +    }
 +
 +    page_size = getpagesize();
 +    page_base = mmap(NULL, 2 * page_size,
 +                     PROT_READ | PROT_WRITE | PROT_EXEC,
 +                     MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
 +    if (page_base == MAP_FAILED) {
 +        handle_err("mmap");
 +    }
 +    page_base += page_size;
 +
 +    for (i = 0; i < n_tests; i++) {
 +        struct noexec_test *test = &tests[i];
 +
 +        printf("[ RUN      ] %s\n", test->name);
 +        test_noexec_1(test);
 +        printf("[       OK ]\n");
 +    }
 +
 +    printf("[  PASSED  ]\n");
 +    return EXIT_SUCCESS;
 +}
 diff --git a/tests/tcg/s390x/Makefile.target b/tests/tcg/s390x/Makefile.target
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/tcg/s390x/Makefile.target
 +++ b/tests/tcg/s390x/Makefile.target
@@ -XXX,XX +XXX,XX @@ TESTS+=shift
  TESTS+=trap
  TESTS+=signals-s390x
  TESTS+=branch-relative-long
 +TESTS+=noexec
  Z14_TESTS=vfminmax
  vfminmax: LDFLAGS+=-lm
 --
 .34.1

-[PULL 2/4] target/avr: Call avr_cpu_do_interrupt directly
+[PULL 07/11] target/openrisc: Always exit after mtspr npc
-There is no need to go through cc->tcg_ops when
+We have called cpu_restore_state asserting will_exit.
-we know what value that must have.
+Do not go back on that promise.  This affects icount.
-Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/avr/helper.c | 5 ++---
+ target/openrisc/sys_helper.c | 2 +-
-file changed, 2 insertions(+), 3 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/avr/helper.c b/target/avr/helper.c
+diff --git a/target/openrisc/sys_helper.c b/target/openrisc/sys_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/avr/helper.c
+--- a/target/openrisc/sys_helper.c
-+++ b/target/avr/helper.c
++++ b/target/openrisc/sys_helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ void HELPER(mtspr)(CPUOpenRISCState *env, target_ulong spr, target_ulong rb)
- bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
+         if (env->pc != rb) {
- {
+             env->pc = rb;
-     bool ret = false;
+             env->dflag = 0;
--    CPUClass *cc = CPU_GET_CLASS(cs);
+-            cpu_loop_exit(cs);
-     AVRCPU *cpu = AVR_CPU(cs);
+         }
-     CPUAVRState *env = &cpu->env;
++        cpu_loop_exit(cs);
+         break;
-     if (interrupt_request & CPU_INTERRUPT_RESET) {
-         if (cpu_interrupts_enabled(env)) {
+     case TO_SPR(0, 17): /* SR */
              cs->exception_index = EXCP_RESET;
 -            cc->tcg_ops->do_interrupt(cs);
 +            avr_cpu_do_interrupt(cs);
              cs->interrupt_request &= ~CPU_INTERRUPT_RESET;
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
          if (cpu_interrupts_enabled(env) && env->intsrc != 0) {
              int index = ctz32(env->intsrc);
              cs->exception_index = EXCP_INT(index);
 -            cc->tcg_ops->do_interrupt(cs);
 +            avr_cpu_do_interrupt(cs);
              env->intsrc &= env->intsrc - 1; /* clear the interrupt */
              if (!env->intsrc) {
 --
 .34.1

-[PULL 02/20] linux-user/hppa: Allocate page zero as a commpage
+Deleted patch
-We're about to start validating PAGE_EXEC, which means that we've
-got to mark page zero executable.  We had been special casing this
-entirely within translate.
-Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- linux-user/elfload.c | 34 +++++++++++++++++++++++++++++++---
-file changed, 31 insertions(+), 3 deletions(-)
-diff --git a/linux-user/elfload.c b/linux-user/elfload.c
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/elfload.c
-+++ b/linux-user/elfload.c
-@@ -XXX,XX +XXX,XX @@ static inline void init_thread(struct target_pt_regs *regs,
-     regs->gr[31] = infop->entry;
- }
-+#define LO_COMMPAGE  0
-+
-+static bool init_guest_commpage(void)
-+{
-+    void *want = g2h_untagged(LO_COMMPAGE);
-+    void *addr = mmap(want, qemu_host_page_size, PROT_NONE,
-+                      MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
-+
-+    if (addr == MAP_FAILED) {
-+        perror("Allocating guest commpage");
-+        exit(EXIT_FAILURE);
-+    }
-+    if (addr != want) {
-+        return false;
-+    }
-+
-+    /*
-+     * On Linux, page zero is normally marked execute only + gateway.
-+     * Normal read or write is supposed to fail (thus PROT_NONE above),
-+     * but specific offsets have kernel code mapped to raise permissions
-+     * and implement syscalls.  Here, simply mark the page executable.
-+     * Special case the entry points during translation (see do_page_zero).
-+     */
-+    page_set_flags(LO_COMMPAGE, LO_COMMPAGE + TARGET_PAGE_SIZE,
-+                   PAGE_EXEC | PAGE_VALID);
-+    return true;
-+}
-+
- #endif /* TARGET_HPPA */
- #ifdef TARGET_XTENSA
-@@ -XXX,XX +XXX,XX @@ static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
- }
- #if defined(HI_COMMPAGE)
--#define LO_COMMPAGE 0
-+#define LO_COMMPAGE -1
- #elif defined(LO_COMMPAGE)
- #define HI_COMMPAGE 0
- #else
- #define HI_COMMPAGE 0
--#define LO_COMMPAGE 0
-+#define LO_COMMPAGE -1
- #define init_guest_commpage() true
- #endif
-@@ -XXX,XX +XXX,XX @@ static void pgb_static(const char *image_name, abi_ulong orig_loaddr,
-         } else {
-             offset = -(HI_COMMPAGE & -align);
-         }
--    } else if (LO_COMMPAGE != 0) {
-+    } else if (LO_COMMPAGE != -1) {
-         loaddr = MIN(loaddr, LO_COMMPAGE & -align);
-     }
---
-.34.1

-[PULL 03/20] linux-user/x86_64: Allocate vsyscall page as a commpage
+Deleted patch
-We're about to start validating PAGE_EXEC, which means that we've
-got to mark the vsyscall page executable.  We had been special
-casing this entirely within translate.
-Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- linux-user/elfload.c | 23 +++++++++++++++++++++++
-file changed, 23 insertions(+)
-diff --git a/linux-user/elfload.c b/linux-user/elfload.c
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/elfload.c
-+++ b/linux-user/elfload.c
-@@ -XXX,XX +XXX,XX @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *en
-     (*regs)[26] = tswapreg(env->segs[R_GS].selector & 0xffff);
- }
-+#if ULONG_MAX >= TARGET_VSYSCALL_PAGE
-+#define INIT_GUEST_COMMPAGE
-+static bool init_guest_commpage(void)
-+{
-+    /*
-+     * The vsyscall page is at a high negative address aka kernel space,
-+     * which means that we cannot actually allocate it with target_mmap.
-+     * We still should be able to use page_set_flags, unless the user
-+     * has specified -R reserved_va, which would trigger an assert().
-+     */
-+    if (reserved_va != 0 &&
-+        TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE >= reserved_va) {
-+        error_report("Cannot allocate vsyscall page");
-+        exit(EXIT_FAILURE);
-+    }
-+    page_set_flags(TARGET_VSYSCALL_PAGE,
-+                   TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE,
-+                   PAGE_EXEC | PAGE_VALID);
-+    return true;
-+}
-+#endif
- #else
- #define ELF_START_MMAP 0x80000000
-@@ -XXX,XX +XXX,XX @@ static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
- #else
- #define HI_COMMPAGE 0
- #define LO_COMMPAGE -1
-+#ifndef INIT_GUEST_COMMPAGE
- #define init_guest_commpage() true
- #endif
-+#endif
- static void pgb_fail_in_use(const char *image_name)
- {
---
-.34.1

-[PULL 04/20] linux-user: Honor PT_GNU_STACK
+Deleted patch
-Map the stack executable if required by default or on demand.
-Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/elf.h        |  1 +
- linux-user/qemu.h    |  1 +
- linux-user/elfload.c | 19 ++++++++++++++++++-
-files changed, 20 insertions(+), 1 deletion(-)
-diff --git a/include/elf.h b/include/elf.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/elf.h
-+++ b/include/elf.h
-@@ -XXX,XX +XXX,XX @@ typedef int64_t  Elf64_Sxword;
- #define PT_LOPROC  0x70000000
- #define PT_HIPROC  0x7fffffff
-+#define PT_GNU_STACK      (PT_LOOS + 0x474e551)
- #define PT_GNU_PROPERTY   (PT_LOOS + 0x474e553)
- #define PT_MIPS_REGINFO   0x70000000
-diff --git a/linux-user/qemu.h b/linux-user/qemu.h
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/qemu.h
-+++ b/linux-user/qemu.h
-@@ -XXX,XX +XXX,XX @@ struct image_info {
-         uint32_t        elf_flags;
-         int             personality;
-         abi_ulong       alignment;
-+        bool            exec_stack;
-         /* Generic semihosting knows about these pointers. */
-         abi_ulong       arg_strings;   /* strings for argv */
-diff --git a/linux-user/elfload.c b/linux-user/elfload.c
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/elfload.c
-+++ b/linux-user/elfload.c
-@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)
- #define ELF_ARCH        EM_386
- #define ELF_PLATFORM get_elf_platform()
-+#define EXSTACK_DEFAULT true
- static const char *get_elf_platform(void)
- {
-@@ -XXX,XX +XXX,XX @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *en
- #define ELF_ARCH        EM_ARM
- #define ELF_CLASS       ELFCLASS32
-+#define EXSTACK_DEFAULT true
- static inline void init_thread(struct target_pt_regs *regs,
-                                struct image_info *infop)
-@@ -XXX,XX +XXX,XX @@ static inline void init_thread(struct target_pt_regs *regs,
- #else
- #define ELF_CLASS       ELFCLASS32
-+#define EXSTACK_DEFAULT true
- #endif
-@@ -XXX,XX +XXX,XX @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUPPCState *en
- #define ELF_CLASS   ELFCLASS64
- #define ELF_ARCH    EM_LOONGARCH
-+#define EXSTACK_DEFAULT true
- #define elf_check_arch(x) ((x) == EM_LOONGARCH)
-@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap(void)
- #define ELF_CLASS   ELFCLASS32
- #endif
- #define ELF_ARCH    EM_MIPS
-+#define EXSTACK_DEFAULT true
- #ifdef TARGET_ABI_MIPSN32
- #define elf_check_abi(x) ((x) & EF_MIPS_ABI2)
-@@ -XXX,XX +XXX,XX @@ static inline void init_thread(struct target_pt_regs *regs,
- #define bswaptls(ptr) bswap32s(ptr)
- #endif
-+#ifndef EXSTACK_DEFAULT
-+#define EXSTACK_DEFAULT false
-+#endif
-+
- #include "elf.h"
- /* We must delay the following stanzas until after "elf.h". */
-@@ -XXX,XX +XXX,XX @@ static abi_ulong setup_arg_pages(struct linux_binprm *bprm,
-                                  struct image_info *info)
- {
-     abi_ulong size, error, guard;
-+    int prot;
-     size = guest_stack_size;
-     if (size < STACK_LOWER_LIMIT) {
-@@ -XXX,XX +XXX,XX @@ static abi_ulong setup_arg_pages(struct linux_binprm *bprm,
-         guard = qemu_real_host_page_size();
-     }
--    error = target_mmap(0, size + guard, PROT_READ | PROT_WRITE,
-+    prot = PROT_READ | PROT_WRITE;
-+    if (info->exec_stack) {
-+        prot |= PROT_EXEC;
-+    }
-+    error = target_mmap(0, size + guard, prot,
-                         MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
-     if (error == -1) {
-         perror("mmap stack");
-@@ -XXX,XX +XXX,XX @@ static void load_elf_image(const char *image_name, int image_fd,
-      */
-     loaddr = -1, hiaddr = 0;
-     info->alignment = 0;
-+    info->exec_stack = EXSTACK_DEFAULT;
-     for (i = 0; i < ehdr->e_phnum; ++i) {
-         struct elf_phdr *eppnt = phdr + i;
-         if (eppnt->p_type == PT_LOAD) {
-@@ -XXX,XX +XXX,XX @@ static void load_elf_image(const char *image_name, int image_fd,
-             if (!parse_elf_properties(image_fd, info, eppnt, bprm_buf, &err)) {
-                 goto exit_errmsg;
-             }
-+        } else if (eppnt->p_type == PT_GNU_STACK) {
-+            info->exec_stack = eppnt->p_flags & PF_X;
-         }
-     }
---
-.34.1

-[PULL 05/20] linux-user: Clear translations on mprotect()
+Deleted patch
-From: Ilya Leoshkevich <iii@linux.ibm.com>
-Currently it's possible to execute pages that do not have PAGE_EXEC
-if there is an existing translation block. Fix by invalidating TBs
-that touch the affected pages.
-Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Message-Id: <20220817150506.592862-2-iii@linux.ibm.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- linux-user/mmap.c | 6 ++++--
-file changed, 4 insertions(+), 2 deletions(-)
-diff --git a/linux-user/mmap.c b/linux-user/mmap.c
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/mmap.c
-+++ b/linux-user/mmap.c
-@@ -XXX,XX +XXX,XX @@ int target_mprotect(abi_ulong start, abi_ulong len, int target_prot)
-             goto error;
-         }
-     }
-+
-     page_set_flags(start, start + len, page_flags);
--    mmap_unlock();
--    return 0;
-+    tb_invalidate_phys_range(start, start + len);
-+    ret = 0;
-+
- error:
-     mmap_unlock();
-     return ret;
---
-.34.1

-[PULL 06/20] tests/tcg/i386: Move smc_code2 to an executable section
+Deleted patch
-We're about to start validating PAGE_EXEC, which means
-that we've got to put this code into a section that is
-both writable and executable.
-Note that this test did not run on hardware beforehand either.
-Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tests/tcg/i386/test-i386.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/tests/tcg/i386/test-i386.c b/tests/tcg/i386/test-i386.c
-index XXXXXXX..XXXXXXX 100644
---- a/tests/tcg/i386/test-i386.c
-+++ b/tests/tcg/i386/test-i386.c
-@@ -XXX,XX +XXX,XX @@ uint8_t code[] = {
-xc3, /* ret */
- };
--asm(".section \".data\"\n"
-+asm(".section \".data_x\",\"awx\"\n"
-     "smc_code2:\n"
-     "movl 4(%esp), %eax\n"
-     "movl %eax, smc_patch_addr2 + 1\n"
---
-.34.1

-[PULL 07/20] accel/tcg: Introduce is_same_page()
+Deleted patch
-From: Ilya Leoshkevich <iii@linux.ibm.com>
-Introduce a function that checks whether a given address is on the same
-page as where disassembly started. Having it improves readability of
-the following patches.
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Message-Id: <20220811095534.241224-3-iii@linux.ibm.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-[rth: Make the DisasContextBase parameter const.]
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/exec/translator.h | 10 ++++++++++
-file changed, 10 insertions(+)
-diff --git a/include/exec/translator.h b/include/exec/translator.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/exec/translator.h
-+++ b/include/exec/translator.h
-@@ -XXX,XX +XXX,XX @@ FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
- #undef GEN_TRANSLATOR_LD
-+/*
-+ * Return whether addr is on the same page as where disassembly started.
-+ * Translators can use this to enforce the rule that only single-insn
-+ * translation blocks are allowed to cross page boundaries.
-+ */
-+static inline bool is_same_page(const DisasContextBase *db, target_ulong addr)
-+{
-+    return ((addr ^ db->pc_first) & TARGET_PAGE_MASK) == 0;
-+}
-+
- #endif /* EXEC__TRANSLATOR_H */
---
-.34.1

-[PULL 10/20] accel/tcg: Make tb_htable_lookup static
+[PULL 08/11] target/openrisc: Use cpu_unwind_state_data for mfspr
-The function is not used outside of cpu-exec.c.  Move it and
+Since we do not plan to exit, use cpu_unwind_state_data
-its subroutines up in the file, before the first use.
+and extract exactly the data requested.
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+This is a bug fix, in that we no longer clobber dflag.
-Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Consider:
         l.j       L2         // branch
         l.mfspr   r1, ppc    // delay
 L1:     boom
 L2:     l.lwa     r3, (r4)
 Here, dflag would be set by cpu_restore_state (because that is the current
 state of the cpu), but but not cleared by tb_stop on exiting the TB
 (because DisasContext has recorded the current value as zero).
 The next TB begins at L2 with dflag incorrectly set.  If the load has a
 tlb miss, then the exception will be delivered as per a delay slot:
 with DSX set in the status register and PC decremented (delay slots
 restart by re-executing the branch). This will cause the return from
 interrupt to go to L1, and boom!
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/exec-all.h |   3 -
+ target/openrisc/sys_helper.c | 11 +++++++++--
- accel/tcg/cpu-exec.c    | 122 ++++++++++++++++++++--------------------
+file changed, 9 insertions(+), 2 deletions(-)
 files changed, 61 insertions(+), 64 deletions(-)
-diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
+diff --git a/target/openrisc/sys_helper.c b/target/openrisc/sys_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/exec-all.h
+--- a/target/openrisc/sys_helper.c
-+++ b/include/exec/exec-all.h
++++ b/target/openrisc/sys_helper.c
-@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs);
+@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(mfspr)(CPUOpenRISCState *env, target_ulong rd,
- #endif
+                            target_ulong spr)
- void tb_flush(CPUState *cpu);
+ {
- void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr);
+ #ifndef CONFIG_USER_ONLY
--TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
++    uint64_t data[TARGET_INSN_START_WORDS];
--                                   target_ulong cs_base, uint32_t flags,
+     MachineState *ms = MACHINE(qdev_get_machine());
--                                   uint32_t cflags);
+     OpenRISCCPU *cpu = env_archcpu(env);
- void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr);
+     CPUState *cs = env_cpu(env);
+@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(mfspr)(CPUOpenRISCState *env, target_ulong rd,
- /* GETPC is the true target of the return instruction that we'll execute.  */
+         return env->evbar;
-diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
-index XXXXXXX..XXXXXXX 100644
+     case TO_SPR(0, 16): /* NPC (equals PC) */
---- a/accel/tcg/cpu-exec.c
+-        cpu_restore_state(cs, GETPC(), false);
-+++ b/accel/tcg/cpu-exec.c
++        if (cpu_unwind_state_data(cs, GETPC(), data)) {
-@@ -XXX,XX +XXX,XX @@ uint32_t curr_cflags(CPUState *cpu)
++            return data[0];
-     return cflags;
++        }
- }
+         return env->pc;
-+struct tb_desc {
+     case TO_SPR(0, 17): /* SR */
-+    target_ulong pc;
+         return cpu_get_sr(env);
-+    target_ulong cs_base;
-+    CPUArchState *env;
+     case TO_SPR(0, 18): /* PPC */
-+    tb_page_addr_t phys_page1;
+-        cpu_restore_state(cs, GETPC(), false);
-+    uint32_t flags;
++        if (cpu_unwind_state_data(cs, GETPC(), data)) {
-+    uint32_t cflags;
++            if (data[1] & 2) {
-+    uint32_t trace_vcpu_dstate;
++                return data[0] - 4;
 +};
 +
 +static bool tb_lookup_cmp(const void *p, const void *d)
 +{
 +    const TranslationBlock *tb = p;
 +    const struct tb_desc *desc = d;
 +
 +    if (tb->pc == desc->pc &&
 +        tb->page_addr[0] == desc->phys_page1 &&
 +        tb->cs_base == desc->cs_base &&
 +        tb->flags == desc->flags &&
 +        tb->trace_vcpu_dstate == desc->trace_vcpu_dstate &&
 +        tb_cflags(tb) == desc->cflags) {
 +        /* check next page if needed */
 +        if (tb->page_addr[1] == -1) {
 +            return true;
 +        } else {
 +            tb_page_addr_t phys_page2;
 +            target_ulong virt_page2;
 +
 +            virt_page2 = (desc->pc & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
 +            phys_page2 = get_page_addr_code(desc->env, virt_page2);
 +            if (tb->page_addr[1] == phys_page2) {
 +                return true;
 +            }
 +        }
-+    }
+         return env->ppc;
-+    return false;
-+}
+     case TO_SPR(0, 32): /* EPCR */
 +
 +static TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
 +                                          target_ulong cs_base, uint32_t flags,
 +                                          uint32_t cflags)
 +{
 +    tb_page_addr_t phys_pc;
 +    struct tb_desc desc;
 +    uint32_t h;
 +
 +    desc.env = cpu->env_ptr;
 +    desc.cs_base = cs_base;
 +    desc.flags = flags;
 +    desc.cflags = cflags;
 +    desc.trace_vcpu_dstate = *cpu->trace_dstate;
 +    desc.pc = pc;
 +    phys_pc = get_page_addr_code(desc.env, pc);
 +    if (phys_pc == -1) {
 +        return NULL;
 +    }
 +    desc.phys_page1 = phys_pc & TARGET_PAGE_MASK;
 +    h = tb_hash_func(phys_pc, pc, flags, cflags, *cpu->trace_dstate);
 +    return qht_lookup_custom(&tb_ctx.htable, &desc, h, tb_lookup_cmp);
 +}
 +
  /* Might cause an exception, so have a longjmp destination ready */
  static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
                                            target_ulong cs_base,
@@ -XXX,XX +XXX,XX @@ void cpu_exec_step_atomic(CPUState *cpu)
      end_exclusive();
  }
 -struct tb_desc {
 -    target_ulong pc;
 -    target_ulong cs_base;
 -    CPUArchState *env;
 -    tb_page_addr_t phys_page1;
 -    uint32_t flags;
 -    uint32_t cflags;
 -    uint32_t trace_vcpu_dstate;
 -};
 -
 -static bool tb_lookup_cmp(const void *p, const void *d)
 -{
 -    const TranslationBlock *tb = p;
 -    const struct tb_desc *desc = d;
 -
 -    if (tb->pc == desc->pc &&
 -        tb->page_addr[0] == desc->phys_page1 &&
 -        tb->cs_base == desc->cs_base &&
 -        tb->flags == desc->flags &&
 -        tb->trace_vcpu_dstate == desc->trace_vcpu_dstate &&
 -        tb_cflags(tb) == desc->cflags) {
 -        /* check next page if needed */
 -        if (tb->page_addr[1] == -1) {
 -            return true;
 -        } else {
 -            tb_page_addr_t phys_page2;
 -            target_ulong virt_page2;
 -
 -            virt_page2 = (desc->pc & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
 -            phys_page2 = get_page_addr_code(desc->env, virt_page2);
 -            if (tb->page_addr[1] == phys_page2) {
 -                return true;
 -            }
 -        }
 -    }
 -    return false;
 -}
 -
 -TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
 -                                   target_ulong cs_base, uint32_t flags,
 -                                   uint32_t cflags)
 -{
 -    tb_page_addr_t phys_pc;
 -    struct tb_desc desc;
 -    uint32_t h;
 -
 -    desc.env = cpu->env_ptr;
 -    desc.cs_base = cs_base;
 -    desc.flags = flags;
 -    desc.cflags = cflags;
 -    desc.trace_vcpu_dstate = *cpu->trace_dstate;
 -    desc.pc = pc;
 -    phys_pc = get_page_addr_code(desc.env, pc);
 -    if (phys_pc == -1) {
 -        return NULL;
 -    }
 -    desc.phys_page1 = phys_pc & TARGET_PAGE_MASK;
 -    h = tb_hash_func(phys_pc, pc, flags, cflags, *cpu->trace_dstate);
 -    return qht_lookup_custom(&tb_ctx.htable, &desc, h, tb_lookup_cmp);
 -}
 -
  void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr)
  {
      if (TCG_TARGET_HAS_direct_jump) {
 --
 .34.1

-[PULL 08/20] accel/tcg: Properly implement get_page_addr_code for user-only
+[PULL 09/11] accel/tcg: Remove will_exit argument from cpu_restore_state
-The current implementation is a no-op, simply returning addr.
+The value passed is always true, and if the target's
-This is incorrect, because we ought to be checking the page
+synchronize_from_tb hook is non-trivial, not exiting
-permissions for execution.
+may be erroneous.
-Make get_page_addr_code inline for both implementations.
+Reviewed-by: Claudio Fontana <cfontana@suse.de>
 Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/exec-all.h | 85 ++++++++++++++---------------------------
+ include/exec/exec-all.h             |  5 +----
- accel/tcg/cputlb.c      |  5 ---
+ accel/tcg/cpu-exec-common.c         |  2 +-
- accel/tcg/user-exec.c   | 14 +++++++
+ accel/tcg/translate-all.c           | 12 ++----------
-files changed, 42 insertions(+), 62 deletions(-)
+ target/alpha/helper.c               |  2 +-
  target/alpha/mem_helper.c           |  2 +-
  target/arm/op_helper.c              |  2 +-
  target/arm/tlb_helper.c             |  8 ++++----
  target/cris/helper.c                |  2 +-
  target/i386/tcg/sysemu/svm_helper.c |  2 +-
  target/m68k/op_helper.c             |  4 ++--
  target/microblaze/helper.c          |  2 +-
  target/nios2/op_helper.c            |  2 +-
  target/openrisc/sys_helper.c        |  4 ++--
  target/ppc/excp_helper.c            |  2 +-
  target/s390x/tcg/excp_helper.c      |  2 +-
  target/tricore/op_helper.c          |  2 +-
  target/xtensa/helper.c              |  6 +++---
 files changed, 25 insertions(+), 36 deletions(-)
 diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/exec/exec-all.h
 +++ b/include/exec/exec-all.h
-@@ -XXX,XX +XXX,XX @@ struct MemoryRegionSection *iotlb_to_section(CPUState *cpu,
+@@ -XXX,XX +XXX,XX @@ bool cpu_unwind_state_data(CPUState *cpu, uintptr_t host_pc, uint64_t *data);
-                                              hwaddr index, MemTxAttrs attrs);
+  * cpu_restore_state:
   * @cpu: the cpu context
   * @host_pc: the host pc within the translation
 - * @will_exit: true if the TB executed will be interrupted after some
 -               cpu adjustments. Required for maintaining the correct
 -               icount valus
   * @return: true if state was restored, false otherwise
   *
   * Attempt to restore the state for a fault occurring in translated
   * code. If @host_pc is not in translated code no state is
   * restored and the function returns false.
   */
 -bool cpu_restore_state(CPUState *cpu, uintptr_t host_pc, bool will_exit);
 +bool cpu_restore_state(CPUState *cpu, uintptr_t host_pc);
  G_NORETURN void cpu_loop_exit_noexc(CPUState *cpu);
  G_NORETURN void cpu_loop_exit(CPUState *cpu);
 diff --git a/accel/tcg/cpu-exec-common.c b/accel/tcg/cpu-exec-common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cpu-exec-common.c
 +++ b/accel/tcg/cpu-exec-common.c
@@ -XXX,XX +XXX,XX @@ void cpu_loop_exit(CPUState *cpu)
  void cpu_loop_exit_restore(CPUState *cpu, uintptr_t pc)
  {
      if (pc) {
 -        cpu_restore_state(cpu, pc, true);
 +        cpu_restore_state(cpu, pc);
      }
      cpu_loop_exit(cpu);
  }
 diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translate-all.c
 +++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ void cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
  #endif
+ }
--#if defined(CONFIG_USER_ONLY)
--void mmap_lock(void);
+-bool cpu_restore_state(CPUState *cpu, uintptr_t host_pc, bool will_exit)
--void mmap_unlock(void);
++bool cpu_restore_state(CPUState *cpu, uintptr_t host_pc)
--bool have_mmap_lock(void);
+ {
 -    /*
 -     * The pc update associated with restore without exit will
 -     * break the relative pc adjustments performed by TARGET_TB_PCREL.
 -     */
 -    if (TARGET_TB_PCREL) {
 -        assert(will_exit);
 -    }
 -
- /**
+     /*
-- * get_page_addr_code() - user-mode version
+      * The host_pc has to be in the rx region of the code buffer.
-+ * get_page_addr_code_hostp()
+      * If it is not we will not be able to resolve it here.
-  * @env: CPUArchState
+@@ -XXX,XX +XXX,XX @@ bool cpu_restore_state(CPUState *cpu, uintptr_t host_pc, bool will_exit)
-  * @addr: guest virtual address of guest code
+     if (in_code_gen_buffer((const void *)(host_pc - tcg_splitwx_diff))) {
-  *
+         TranslationBlock *tb = tcg_tb_lookup(host_pc);
-- * Returns @addr.
+         if (tb) {
-+ * See get_page_addr_code() (full-system version) for documentation on the
+-            cpu_restore_state_from_tb(cpu, tb, host_pc, will_exit);
-+ * return value.
++            cpu_restore_state_from_tb(cpu, tb, host_pc, true);
-+ *
+             return true;
-+ * Sets *@hostp (when @hostp is non-NULL) as follows.
+         }
-+ * If the return value is -1, sets *@hostp to NULL. Otherwise, sets *@hostp
+     }
-+ * to the host address where @addr's content is kept.
+diff --git a/target/alpha/helper.c b/target/alpha/helper.c
-+ *
+index XXXXXXX..XXXXXXX 100644
-+ * Note: this function can trigger an exception.
+--- a/target/alpha/helper.c
-+ */
++++ b/target/alpha/helper.c
-+tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
+@@ -XXX,XX +XXX,XX @@ G_NORETURN void dynamic_excp(CPUAlphaState *env, uintptr_t retaddr,
-+                                        void **hostp);
+     cs->exception_index = excp;
-+
+     env->error_code = error;
-+/**
+     if (retaddr) {
-+ * get_page_addr_code()
+-        cpu_restore_state(cs, retaddr, true);
-+ * @env: CPUArchState
++        cpu_restore_state(cs, retaddr);
-+ * @addr: guest virtual address of guest code
+         /* Floating-point exceptions (our only users) point to the next PC.  */
-+ *
+         env->pc += 4;
-+ * If we cannot translate and execute from the entire RAM page, or if
+     }
-+ * the region is not backed by RAM, returns -1. Otherwise, returns the
+diff --git a/target/alpha/mem_helper.c b/target/alpha/mem_helper.c
-+ * ram_addr_t corresponding to the guest code at @addr.
+index XXXXXXX..XXXXXXX 100644
-+ *
+--- a/target/alpha/mem_helper.c
-+ * Note: this function can trigger an exception.
++++ b/target/alpha/mem_helper.c
-  */
+@@ -XXX,XX +XXX,XX @@ static void do_unaligned_access(CPUAlphaState *env, vaddr addr, uintptr_t retadd
- static inline tb_page_addr_t get_page_addr_code(CPUArchState *env,
+     uint64_t pc;
-                                                 target_ulong addr)
+     uint32_t insn;
- {
--    return addr;
+-    cpu_restore_state(env_cpu(env), retaddr, true);
-+    return get_page_addr_code_hostp(env, addr, NULL);
++    cpu_restore_state(env_cpu(env), retaddr);
- }
+     pc = env->pc;
--/**
+     insn = cpu_ldl_code(env, pc);
-- * get_page_addr_code_hostp() - user-mode version
+diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
-- * @env: CPUArchState
+index XXXXXXX..XXXXXXX 100644
-- * @addr: guest virtual address of guest code
+--- a/target/arm/op_helper.c
-- *
++++ b/target/arm/op_helper.c
-- * Returns @addr.
+@@ -XXX,XX +XXX,XX @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
-- *
+      * we must restore CPU state here before setting the syndrome
-- * If @hostp is non-NULL, sets *@hostp to the host address where @addr's content
+      * the caller passed us, and cannot use cpu_loop_exit_restore().
-- * is kept.
+      */
-- */
+-    cpu_restore_state(cs, ra, true);
--static inline tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env,
++    cpu_restore_state(cs, ra);
--                                                      target_ulong addr,
+     raise_exception(env, excp, syndrome, target_el);
--                                                      void **hostp)
+ }
--{
--    if (hostp) {
+diff --git a/target/arm/tlb_helper.c b/target/arm/tlb_helper.c
--        *hostp = g2h_untagged(addr);
+index XXXXXXX..XXXXXXX 100644
--    }
+--- a/target/arm/tlb_helper.c
--    return addr;
++++ b/target/arm/tlb_helper.c
--}
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
-+#if defined(CONFIG_USER_ONLY)
+     ARMMMUFaultInfo fi = {};
-+void mmap_lock(void);
-+void mmap_unlock(void);
+     /* now we have a real cpu fault */
-+bool have_mmap_lock(void);
+-    cpu_restore_state(cs, retaddr, true);
++    cpu_restore_state(cs, retaddr);
- /**
-  * adjust_signal_pc:
+     fi.type = ARMFault_Alignment;
-@@ -XXX,XX +XXX,XX @@ G_NORETURN void cpu_loop_exit_sigbus(CPUState *cpu, target_ulong addr,
+     arm_deliver_fault(cpu, vaddr, access_type, mmu_idx, &fi);
- static inline void mmap_lock(void) {}
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
- static inline void mmap_unlock(void) {}
+     ARMMMUFaultInfo fi = {};
--/**
+     /* now we have a real cpu fault */
-- * get_page_addr_code() - full-system version
+-    cpu_restore_state(cs, retaddr, true);
-- * @env: CPUArchState
++    cpu_restore_state(cs, retaddr);
-- * @addr: guest virtual address of guest code
-- *
+     fi.ea = arm_extabort_type(response);
-- * If we cannot translate and execute from the entire RAM page, or if
+     fi.type = ARMFault_SyncExternal;
-- * the region is not backed by RAM, returns -1. Otherwise, returns the
+@@ -XXX,XX +XXX,XX @@ bool arm_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
-- * ram_addr_t corresponding to the guest code at @addr.
+         return false;
-- *
+     } else {
-- * Note: this function can trigger an exception.
+         /* now we have a real cpu fault */
-- */
+-        cpu_restore_state(cs, retaddr, true);
--tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr);
++        cpu_restore_state(cs, retaddr);
--
+         arm_deliver_fault(cpu, address, access_type, mmu_idx, fi);
--/**
+     }
-- * get_page_addr_code_hostp() - full-system version
+ }
-- * @env: CPUArchState
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_record_sigsegv(CPUState *cs, vaddr addr,
-- * @addr: guest virtual address of guest code
+      * We report both ESR and FAR to signal handlers.
-- *
+      * For now, it's easiest to deliver the fault normally.
-- * See get_page_addr_code() (full-system version) for documentation on the
+      */
-- * return value.
+-    cpu_restore_state(cs, ra, true);
-- *
++    cpu_restore_state(cs, ra);
-- * Sets *@hostp (when @hostp is non-NULL) as follows.
+     arm_deliver_fault(cpu, addr, access_type, MMU_USER_IDX, &fi);
-- * If the return value is -1, sets *@hostp to NULL. Otherwise, sets *@hostp
+ }
-- * to the host address where @addr's content is kept.
-- *
+diff --git a/target/cris/helper.c b/target/cris/helper.c
-- * Note: this function can trigger an exception.
+index XXXXXXX..XXXXXXX 100644
-- */
+--- a/target/cris/helper.c
--tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
++++ b/target/cris/helper.c
--                                        void **hostp);
+@@ -XXX,XX +XXX,XX @@ bool cris_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
--
+     cs->exception_index = EXCP_BUSFAULT;
- void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length);
+     env->fault_vector = res.bf_vec;
- void tlb_set_dirty(CPUState *cpu, target_ulong vaddr);
+     if (retaddr) {
+-        if (cpu_restore_state(cs, retaddr, true)) {
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
++        if (cpu_restore_state(cs, retaddr)) {
-index XXXXXXX..XXXXXXX 100644
+             /* Evaluate flags after retranslation. */
---- a/accel/tcg/cputlb.c
+             helper_top_evaluate_flags(env);
-+++ b/accel/tcg/cputlb.c
+         }
-@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
+diff --git a/target/i386/tcg/sysemu/svm_helper.c b/target/i386/tcg/sysemu/svm_helper.c
-     return qemu_ram_addr_from_host_nofail(p);
+index XXXXXXX..XXXXXXX 100644
- }
+--- a/target/i386/tcg/sysemu/svm_helper.c
++++ b/target/i386/tcg/sysemu/svm_helper.c
--tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr)
+@@ -XXX,XX +XXX,XX @@ void cpu_vmexit(CPUX86State *env, uint32_t exit_code, uint64_t exit_info_1,
--{
+ {
--    return get_page_addr_code_hostp(env, addr, NULL);
+     CPUState *cs = env_cpu(env);
--}
--
+-    cpu_restore_state(cs, retaddr, true);
- static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
++    cpu_restore_state(cs, retaddr);
-                            CPUIOTLBEntry *iotlbentry, uintptr_t retaddr)
- {
+     qemu_log_mask(CPU_LOG_TB_IN_ASM, "vmexit(%08x, %016" PRIx64 ", %016"
-diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
+                   PRIx64 ", " TARGET_FMT_lx ")!\n",
-index XXXXXXX..XXXXXXX 100644
+diff --git a/target/m68k/op_helper.c b/target/m68k/op_helper.c
---- a/accel/tcg/user-exec.c
+index XXXXXXX..XXXXXXX 100644
-+++ b/accel/tcg/user-exec.c
+--- a/target/m68k/op_helper.c
-@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
++++ b/target/m68k/op_helper.c
-     return size ? g2h(env_cpu(env), addr) : NULL;
+@@ -XXX,XX +XXX,XX @@ void m68k_cpu_transaction_failed(CPUState *cs, hwaddr physaddr, vaddr addr,
- }
+     M68kCPU *cpu = M68K_CPU(cs);
+     CPUM68KState *env = &cpu->env;
-+tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
-+                                        void **hostp)
+-    cpu_restore_state(cs, retaddr, true);
-+{
++    cpu_restore_state(cs, retaddr);
-+    int flags;
-+
+     if (m68k_feature(env, M68K_FEATURE_M68040)) {
-+    flags = probe_access_internal(env, addr, 1, MMU_INST_FETCH, false, 0);
+         env->mmu.mmusr = 0;
-+    g_assert(flags == 0);
+@@ -XXX,XX +XXX,XX @@ raise_exception_format2(CPUM68KState *env, int tt, int ilen, uintptr_t raddr)
-+
+     cs->exception_index = tt;
-+    if (hostp) {
-+        *hostp = g2h_untagged(addr);
+     /* Recover PC and CC_OP for the beginning of the insn.  */
-+    }
+-    cpu_restore_state(cs, raddr, true);
-+    return addr;
++    cpu_restore_state(cs, raddr);
-+}
-+
+     /* Flags are current in env->cc_*, or are undefined. */
- /* The softmmu versions of these helpers are in cputlb.c.  */
+     env->cc_op = CC_OP_FLAGS;
+diff --git a/target/microblaze/helper.c b/target/microblaze/helper.c
- /*
+index XXXXXXX..XXXXXXX 100644
 --- a/target/microblaze/helper.c
 +++ b/target/microblaze/helper.c
@@ -XXX,XX +XXX,XX @@ void mb_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
      uint32_t esr, iflags;
      /* Recover the pc and iflags from the corresponding insn_start.  */
 -    cpu_restore_state(cs, retaddr, true);
 +    cpu_restore_state(cs, retaddr);
      iflags = cpu->env.iflags;
      qemu_log_mask(CPU_LOG_INT,
 diff --git a/target/nios2/op_helper.c b/target/nios2/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/nios2/op_helper.c
 +++ b/target/nios2/op_helper.c
@@ -XXX,XX +XXX,XX @@ void nios2_cpu_loop_exit_advance(CPUNios2State *env, uintptr_t retaddr)
       * Do this here, rather than in restore_state_to_opc(),
       * lest we affect QEMU internal exceptions, like EXCP_DEBUG.
       */
 -    cpu_restore_state(cs, retaddr, true);
 +    cpu_restore_state(cs, retaddr);
      env->pc += 4;
      cpu_loop_exit(cs);
  }
 diff --git a/target/openrisc/sys_helper.c b/target/openrisc/sys_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/openrisc/sys_helper.c
 +++ b/target/openrisc/sys_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(mtspr)(CPUOpenRISCState *env, target_ulong spr, target_ulong rb)
          break;
      case TO_SPR(0, 16): /* NPC */
 -        cpu_restore_state(cs, GETPC(), true);
 +        cpu_restore_state(cs, GETPC());
          /* ??? Mirror or1ksim in not trashing delayed branch state
             when "jumping" to the current instruction.  */
          if (env->pc != rb) {
@@ -XXX,XX +XXX,XX @@ void HELPER(mtspr)(CPUOpenRISCState *env, target_ulong spr, target_ulong rb)
      case TO_SPR(8, 0):  /* PMR */
          env->pmr = rb;
          if (env->pmr & PMR_DME || env->pmr & PMR_SME) {
 -            cpu_restore_state(cs, GETPC(), true);
 +            cpu_restore_state(cs, GETPC());
              env->pc += 4;
              cs->halted = 1;
              raise_exception(cpu, EXCP_HALTED);
 diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/ppc/excp_helper.c
 +++ b/target/ppc/excp_helper.c
@@ -XXX,XX +XXX,XX @@ void ppc_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
      uint32_t insn;
      /* Restore state and reload the insn we executed, for filling in DSISR.  */
 -    cpu_restore_state(cs, retaddr, true);
 +    cpu_restore_state(cs, retaddr);
      insn = cpu_ldl_code(env, env->nip);
      switch (env->mmu_model) {
 diff --git a/target/s390x/tcg/excp_helper.c b/target/s390x/tcg/excp_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/tcg/excp_helper.c
 +++ b/target/s390x/tcg/excp_helper.c
@@ -XXX,XX +XXX,XX @@ G_NORETURN void tcg_s390_program_interrupt(CPUS390XState *env,
  {
      CPUState *cs = env_cpu(env);
 -    cpu_restore_state(cs, ra, true);
 +    cpu_restore_state(cs, ra);
      qemu_log_mask(CPU_LOG_INT, "program interrupt at %#" PRIx64 "\n",
                    env->psw.addr);
      trigger_pgm_exception(env, code);
 diff --git a/target/tricore/op_helper.c b/target/tricore/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tricore/op_helper.c
 +++ b/target/tricore/op_helper.c
@@ -XXX,XX +XXX,XX @@ void raise_exception_sync_internal(CPUTriCoreState *env, uint32_t class, int tin
  {
      CPUState *cs = env_cpu(env);
      /* in case we come from a helper-call we need to restore the PC */
 -    cpu_restore_state(cs, pc, true);
 +    cpu_restore_state(cs, pc);
      /* Tin is loaded into d[15] */
      env->gpr_d[15] = tin;
 diff --git a/target/xtensa/helper.c b/target/xtensa/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/xtensa/helper.c
 +++ b/target/xtensa/helper.c
@@ -XXX,XX +XXX,XX @@ void xtensa_cpu_do_unaligned_access(CPUState *cs,
      assert(xtensa_option_enabled(env->config,
                                   XTENSA_OPTION_UNALIGNED_EXCEPTION));
 -    cpu_restore_state(CPU(cpu), retaddr, true);
 +    cpu_restore_state(CPU(cpu), retaddr);
      HELPER(exception_cause_vaddr)(env,
                                    env->pc, LOAD_STORE_ALIGNMENT_CAUSE,
                                    addr);
@@ -XXX,XX +XXX,XX @@ bool xtensa_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
      } else if (probe) {
          return false;
      } else {
 -        cpu_restore_state(cs, retaddr, true);
 +        cpu_restore_state(cs, retaddr);
          HELPER(exception_cause_vaddr)(env, env->pc, ret, address);
      }
  }
@@ -XXX,XX +XXX,XX @@ void xtensa_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr, vaddr addr,
      XtensaCPU *cpu = XTENSA_CPU(cs);
      CPUXtensaState *env = &cpu->env;
 -    cpu_restore_state(cs, retaddr, true);
 +    cpu_restore_state(cs, retaddr);
      HELPER(exception_cause_vaddr)(env, env->pc,
                                    access_type == MMU_INST_FETCH ?
                                    INSTR_PIF_ADDR_ERROR_CAUSE :
 --
 .34.1

-[PULL 09/20] accel/tcg: Unlock mmap_lock after longjmp
+Deleted patch
-The mmap_lock is held around tb_gen_code.  While the comment
-is correct that the lock is dropped when tb_gen_code runs out
-of memory, the lock is *not* dropped when an exception is
-raised reading code for translation.
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- accel/tcg/cpu-exec.c  | 12 ++++++------
- accel/tcg/user-exec.c |  3 ---
-files changed, 6 insertions(+), 9 deletions(-)
-diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cpu-exec.c
-+++ b/accel/tcg/cpu-exec.c
-@@ -XXX,XX +XXX,XX @@ void cpu_exec_step_atomic(CPUState *cpu)
-         cpu_tb_exec(cpu, tb, &tb_exit);
-         cpu_exec_exit(cpu);
-     } else {
--        /*
--         * The mmap_lock is dropped by tb_gen_code if it runs out of
--         * memory.
--         */
- #ifndef CONFIG_SOFTMMU
-         clear_helper_retaddr();
--        tcg_debug_assert(!have_mmap_lock());
-+        if (have_mmap_lock()) {
-+            mmap_unlock();
-+        }
- #endif
-         if (qemu_mutex_iothread_locked()) {
-             qemu_mutex_unlock_iothread();
-@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
- #ifndef CONFIG_SOFTMMU
-         clear_helper_retaddr();
--        tcg_debug_assert(!have_mmap_lock());
-+        if (have_mmap_lock()) {
-+            mmap_unlock();
-+        }
- #endif
-         if (qemu_mutex_iothread_locked()) {
-             qemu_mutex_unlock_iothread();
-diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/user-exec.c
-+++ b/accel/tcg/user-exec.c
-@@ -XXX,XX +XXX,XX @@ MMUAccessType adjust_signal_pc(uintptr_t *pc, bool is_write)
-          * (and if the translator doesn't handle page boundaries correctly
-          * there's little we can do about that here).  Therefore, do not
-          * trigger the unwinder.
--         *
--         * Like tb_gen_code, release the memory lock before cpu_loop_exit.
-          */
--        mmap_unlock();
-         *pc = 0;
-         return MMU_INST_FETCH;
-     }
---
-.34.1

-[PULL 11/20] accel/tcg: Move qemu_ram_addr_from_host_nofail to physmem.c
+Deleted patch
-The base qemu_ram_addr_from_host function is already in
-softmmu/physmem.c; move the nofail version to be adjacent.
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/exec/cpu-common.h |  1 +
- accel/tcg/cputlb.c        | 12 ------------
- softmmu/physmem.c         | 12 ++++++++++++
-files changed, 13 insertions(+), 12 deletions(-)
-diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/exec/cpu-common.h
-+++ b/include/exec/cpu-common.h
-@@ -XXX,XX +XXX,XX @@ typedef uintptr_t ram_addr_t;
- void qemu_ram_remap(ram_addr_t addr, ram_addr_t length);
- /* This should not be used by devices.  */
- ram_addr_t qemu_ram_addr_from_host(void *ptr);
-+ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr);
- RAMBlock *qemu_ram_block_by_name(const char *name);
- RAMBlock *qemu_ram_block_from_host(void *ptr, bool round_offset,
-                                    ram_addr_t *offset);
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
-+++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@ void tlb_set_page(CPUState *cpu, target_ulong vaddr,
-                             prot, mmu_idx, size);
- }
--static inline ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr)
--{
--    ram_addr_t ram_addr;
--
--    ram_addr = qemu_ram_addr_from_host(ptr);
--    if (ram_addr == RAM_ADDR_INVALID) {
--        error_report("Bad ram pointer %p", ptr);
--        abort();
--    }
--    return ram_addr;
--}
--
- /*
-  * Note: tlb_fill() can trigger a resize of the TLB. This means that all of the
-  * caller's prior references to the TLB table (e.g. CPUTLBEntry pointers) must
-diff --git a/softmmu/physmem.c b/softmmu/physmem.c
-index XXXXXXX..XXXXXXX 100644
---- a/softmmu/physmem.c
-+++ b/softmmu/physmem.c
-@@ -XXX,XX +XXX,XX @@ ram_addr_t qemu_ram_addr_from_host(void *ptr)
-     return block->offset + offset;
- }
-+ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr)
-+{
-+    ram_addr_t ram_addr;
-+
-+    ram_addr = qemu_ram_addr_from_host(ptr);
-+    if (ram_addr == RAM_ADDR_INVALID) {
-+        error_report("Bad ram pointer %p", ptr);
-+        abort();
-+    }
-+    return ram_addr;
-+}
-+
- static MemTxResult flatview_read(FlatView *fv, hwaddr addr,
-                                  MemTxAttrs attrs, void *buf, hwaddr len);
- static MemTxResult flatview_write(FlatView *fv, hwaddr addr, MemTxAttrs attrs,
---
-.34.1

-[PULL 12/20] accel/tcg: Use probe_access_internal for softmmu get_page_addr_code_hostp
+Deleted patch
-Simplify the implementation of get_page_addr_code_hostp
-by reusing the existing probe_access infrastructure.
-Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- accel/tcg/cputlb.c | 76 ++++++++++++++++------------------------------
-file changed, 26 insertions(+), 50 deletions(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
-+++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@ static bool victim_tlb_hit(CPUArchState *env, size_t mmu_idx, size_t index,
-   victim_tlb_hit(env, mmu_idx, index, offsetof(CPUTLBEntry, TY), \
-                  (ADDR) & TARGET_PAGE_MASK)
--/*
-- * Return a ram_addr_t for the virtual address for execution.
-- *
-- * Return -1 if we can't translate and execute from an entire page
-- * of RAM.  This will force us to execute by loading and translating
-- * one insn at a time, without caching.
-- *
-- * NOTE: This function will trigger an exception if the page is
-- * not executable.
-- */
--tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
--                                        void **hostp)
--{
--    uintptr_t mmu_idx = cpu_mmu_index(env, true);
--    uintptr_t index = tlb_index(env, mmu_idx, addr);
--    CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
--    void *p;
--
--    if (unlikely(!tlb_hit(entry->addr_code, addr))) {
--        if (!VICTIM_TLB_HIT(addr_code, addr)) {
--            tlb_fill(env_cpu(env), addr, 0, MMU_INST_FETCH, mmu_idx, 0);
--            index = tlb_index(env, mmu_idx, addr);
--            entry = tlb_entry(env, mmu_idx, addr);
--
--            if (unlikely(entry->addr_code & TLB_INVALID_MASK)) {
--                /*
--                 * The MMU protection covers a smaller range than a target
--                 * page, so we must redo the MMU check for every insn.
--                 */
--                return -1;
--            }
--        }
--        assert(tlb_hit(entry->addr_code, addr));
--    }
--
--    if (unlikely(entry->addr_code & TLB_MMIO)) {
--        /* The region is not backed by RAM.  */
--        if (hostp) {
--            *hostp = NULL;
--        }
--        return -1;
--    }
--
--    p = (void *)((uintptr_t)addr + entry->addend);
--    if (hostp) {
--        *hostp = p;
--    }
--    return qemu_ram_addr_from_host_nofail(p);
--}
--
- static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
-                            CPUIOTLBEntry *iotlbentry, uintptr_t retaddr)
- {
-@@ -XXX,XX +XXX,XX @@ void *tlb_vaddr_to_host(CPUArchState *env, abi_ptr addr,
-     return flags ? NULL : host;
- }
-+/*
-+ * Return a ram_addr_t for the virtual address for execution.
-+ *
-+ * Return -1 if we can't translate and execute from an entire page
-+ * of RAM.  This will force us to execute by loading and translating
-+ * one insn at a time, without caching.
-+ *
-+ * NOTE: This function will trigger an exception if the page is
-+ * not executable.
-+ */
-+tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
-+                                        void **hostp)
-+{
-+    void *p;
-+
-+    (void)probe_access_internal(env, addr, 1, MMU_INST_FETCH,
-+                                cpu_mmu_index(env, true), false, &p, 0);
-+    if (p == NULL) {
-+        return -1;
-+    }
-+    if (hostp) {
-+        *hostp = p;
-+    }
-+    return qemu_ram_addr_from_host_nofail(p);
-+}
-+
- #ifdef CONFIG_PLUGIN
- /*
-  * Perform a TLB lookup and populate the qemu_plugin_hwaddr structure.
---
-.34.1

-[PULL 13/20] accel/tcg: Document the faulting lookup in tb_lookup_cmp
+Deleted patch
-It was non-obvious to me why we can raise an exception in
-the middle of a comparison function, but it works.
-While nearby, use TARGET_PAGE_ALIGN instead of open-coding.
-Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- accel/tcg/cpu-exec.c | 11 ++++++++++-
-file changed, 10 insertions(+), 1 deletion(-)
-diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cpu-exec.c
-+++ b/accel/tcg/cpu-exec.c
-@@ -XXX,XX +XXX,XX @@ static bool tb_lookup_cmp(const void *p, const void *d)
-             tb_page_addr_t phys_page2;
-             target_ulong virt_page2;
--            virt_page2 = (desc->pc & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
-+            /*
-+             * We know that the first page matched, and an otherwise valid TB
-+             * encountered an incomplete instruction at the end of that page,
-+             * therefore we know that generating a new TB from the current PC
-+             * must also require reading from the next page -- even if the
-+             * second pages do not match, and therefore the resulting insn
-+             * is different for the new TB.  Therefore any exception raised
-+             * here by the faulting lookup is not premature.
-+             */
-+            virt_page2 = TARGET_PAGE_ALIGN(desc->pc);
-             phys_page2 = get_page_addr_code(desc->env, virt_page2);
-             if (tb->page_addr[1] == phys_page2) {
-                 return true;
---
-.34.1

-[PULL 14/20] accel/tcg: Remove translator_ldsw
+Deleted patch
-The only user can easily use translator_lduw and
-adjust the type to signed during the return.
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/exec/translator.h   | 1 -
- target/i386/tcg/translate.c | 2 +-
-files changed, 1 insertion(+), 2 deletions(-)
-diff --git a/include/exec/translator.h b/include/exec/translator.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/exec/translator.h
-+++ b/include/exec/translator.h
-@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
- #define FOR_EACH_TRANSLATOR_LD(F)                                       \
-     F(translator_ldub, uint8_t, cpu_ldub_code, /* no swap */)           \
--    F(translator_ldsw, int16_t, cpu_ldsw_code, bswap16)                 \
-     F(translator_lduw, uint16_t, cpu_lduw_code, bswap16)                \
-     F(translator_ldl, uint32_t, cpu_ldl_code, bswap32)                  \
-     F(translator_ldq, uint64_t, cpu_ldq_code, bswap64)
-diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/i386/tcg/translate.c
-+++ b/target/i386/tcg/translate.c
-@@ -XXX,XX +XXX,XX @@ static inline uint8_t x86_ldub_code(CPUX86State *env, DisasContext *s)
- static inline int16_t x86_ldsw_code(CPUX86State *env, DisasContext *s)
- {
--    return translator_ldsw(env, &s->base, advance_pc(env, s, 2));
-+    return translator_lduw(env, &s->base, advance_pc(env, s, 2));
- }
- static inline uint16_t x86_lduw_code(CPUX86State *env, DisasContext *s)
---
-.34.1

-[PULL 16/20] accel/tcg: Add fast path for translator_ld*
+[PULL 10/11] accel/tcg: Remove reset_icount argument from cpu_restore_state_from_tb
-Cache the translation from guest to host address, so we may
+The value passed is always true.
 use direct loads when we hit on the primary translation page.
-Look up the second translation page only once, during translation.
+Reviewed-by: Claudio Fontana <cfontana@suse.de>
 This obviates another lookup of the second page within tb_gen_code
 after translation.
 Fixes a bug in that plugin_insn_append should be passed the bytes
 in the original memory order, not bswapped by pieces.
 Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/translator.h |  63 +++++++++++--------
+ accel/tcg/internal.h      |  2 +-
- accel/tcg/translate-all.c |  23 +++----
+ accel/tcg/tb-maint.c      |  4 ++--
- accel/tcg/translator.c    | 126 +++++++++++++++++++++++++++++---------
+ accel/tcg/translate-all.c | 15 +++++++--------
-files changed, 141 insertions(+), 71 deletions(-)
+files changed, 10 insertions(+), 11 deletions(-)
-diff --git a/include/exec/translator.h b/include/exec/translator.h
+diff --git a/accel/tcg/internal.h b/accel/tcg/internal.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/translator.h
+--- a/accel/tcg/internal.h
-+++ b/include/exec/translator.h
++++ b/accel/tcg/internal.h
-@@ -XXX,XX +XXX,XX @@ typedef enum DisasJumpType {
+@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
-  * Architecture-agnostic disassembly context.
+                                tb_page_addr_t phys_page2);
-  */
+ bool tb_invalidate_phys_page_unwind(tb_page_addr_t addr, uintptr_t pc);
- typedef struct DisasContextBase {
+ void cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
--    const TranslationBlock *tb;
+-                               uintptr_t host_pc, bool reset_icount);
-+    TranslationBlock *tb;
++                               uintptr_t host_pc);
-     target_ulong pc_first;
-     target_ulong pc_next;
+ /* Return the current PC from CPU, which may be cached in TB. */
-     DisasJumpType is_jmp;
+ static inline target_ulong log_pc(CPUState *cpu, const TranslationBlock *tb)
-     int num_insns;
+diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
-     int max_insns;
+index XXXXXXX..XXXXXXX 100644
-     bool singlestep_enabled;
+--- a/accel/tcg/tb-maint.c
--#ifdef CONFIG_USER_ONLY
++++ b/accel/tcg/tb-maint.c
--    /*
+@@ -XXX,XX +XXX,XX @@ tb_invalidate_phys_page_range__locked(struct page_collection *pages,
--     * Guest address of the last byte of the last protected page.
+                  * restore the CPU state.
--     *
+                  */
--     * Pages containing the translated instructions are made non-writable in
+                 current_tb_modified = true;
--     * order to achieve consistency in case another thread is modifying the
+-                cpu_restore_state_from_tb(cpu, current_tb, retaddr, true);
--     * code while translate_insn() fetches the instruction bytes piecemeal.
++                cpu_restore_state_from_tb(cpu, current_tb, retaddr);
--     * Such writer threads are blocked on mmap_lock() in page_unprotect().
+             }
--     */
+ #endif /* TARGET_HAS_PRECISE_SMC */
--    target_ulong page_protect_end;
+             tb_phys_invalidate__locked(tb);
--#endif
+@@ -XXX,XX +XXX,XX @@ bool tb_invalidate_phys_page_unwind(tb_page_addr_t addr, uintptr_t pc)
-+    void *host_addr[2];
+              * function to partially restore the CPU state.
- } DisasContextBase;
+              */
+             current_tb_modified = true;
- /**
+-            cpu_restore_state_from_tb(cpu, current_tb, pc, true);
-@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
++            cpu_restore_state_from_tb(cpu, current_tb, pc);
-  * the relevant information at translation time.
+         }
-  */
+ #endif /* TARGET_HAS_PRECISE_SMC */
+         tb_phys_invalidate(tb, addr);
 -#define GEN_TRANSLATOR_LD(fullname, type, load_fn, swap_fn)             \
 -    type fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase, \
 -                           abi_ptr pc, bool do_swap);                   \
 -    static inline type fullname(CPUArchState *env,                      \
 -                                DisasContextBase *dcbase, abi_ptr pc)   \
 -    {                                                                   \
 -        return fullname ## _swap(env, dcbase, pc, false);               \
 +uint8_t translator_ldub(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
 +uint16_t translator_lduw(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
 +uint32_t translator_ldl(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
 +uint64_t translator_ldq(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
 +
 +static inline uint16_t
 +translator_lduw_swap(CPUArchState *env, DisasContextBase *db,
 +                     abi_ptr pc, bool do_swap)
 +{
 +    uint16_t ret = translator_lduw(env, db, pc);
 +    if (do_swap) {
 +        ret = bswap16(ret);
      }
 +    return ret;
 +}
 -#define FOR_EACH_TRANSLATOR_LD(F)                                       \
 -    F(translator_ldub, uint8_t, cpu_ldub_code, /* no swap */)           \
 -    F(translator_lduw, uint16_t, cpu_lduw_code, bswap16)                \
 -    F(translator_ldl, uint32_t, cpu_ldl_code, bswap32)                  \
 -    F(translator_ldq, uint64_t, cpu_ldq_code, bswap64)
 +static inline uint32_t
 +translator_ldl_swap(CPUArchState *env, DisasContextBase *db,
 +                    abi_ptr pc, bool do_swap)
 +{
 +    uint32_t ret = translator_ldl(env, db, pc);
 +    if (do_swap) {
 +        ret = bswap32(ret);
 +    }
 +    return ret;
 +}
 -FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
 -
 -#undef GEN_TRANSLATOR_LD
 +static inline uint64_t
 +translator_ldq_swap(CPUArchState *env, DisasContextBase *db,
 +                    abi_ptr pc, bool do_swap)
 +{
 +    uint64_t ret = translator_ldq_swap(env, db, pc, false);
 +    if (do_swap) {
 +        ret = bswap64(ret);
 +    }
 +    return ret;
 +}
  /*
   * Return whether addr is on the same page as where disassembly started.
 diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translate-all.c
 +++ b/accel/tcg/translate-all.c
-@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
+@@ -XXX,XX +XXX,XX @@ static int cpu_unwind_data_from_tb(TranslationBlock *tb, uintptr_t host_pc,
  }
  /*
 - * The cpu state corresponding to 'host_pc' is restored.
 - * When reset_icount is true, current TB will be interrupted and
 - * icount should be recalculated.
 + * The cpu state corresponding to 'host_pc' is restored in
 + * preparation for exiting the TB.
   */
  void cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
 -                               uintptr_t host_pc, bool reset_icount)
 +                               uintptr_t host_pc)
  {
-     CPUArchState *env = cpu->env_ptr;
+     uint64_t data[TARGET_INSN_START_WORDS];
      TranslationBlock *tb, *existing_tb;
 -    tb_page_addr_t phys_pc, phys_page2;
 -    target_ulong virt_page2;
 +    tb_page_addr_t phys_pc;
      tcg_insn_unit *gen_code_buf;
      int gen_code_size, search_size, max_insns;
  #ifdef CONFIG_PROFILER
-@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
+@@ -XXX,XX +XXX,XX @@ void cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
-     tb->flags = flags;
+         return;
      tb->cflags = cflags;
      tb->trace_vcpu_dstate = *cpu->trace_dstate;
 +    tb->page_addr[0] = phys_pc;
 +    tb->page_addr[1] = -1;
      tcg_ctx->tb_cflags = cflags;
   tb_overflow:
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
      }
+-    if (reset_icount && (tb_cflags(tb) & CF_USE_ICOUNT)) {
++    if (tb_cflags(tb) & CF_USE_ICOUNT) {
+         assert(icount_enabled());
+         /*
+          * Reset the cycle counter to the start of the block and
+@@ -XXX,XX +XXX,XX @@ bool cpu_restore_state(CPUState *cpu, uintptr_t host_pc)
+     if (in_code_gen_buffer((const void *)(host_pc - tcg_splitwx_diff))) {
+         TranslationBlock *tb = tcg_tb_lookup(host_pc);
+         if (tb) {
+-            cpu_restore_state_from_tb(cpu, tb, host_pc, true);
++            cpu_restore_state_from_tb(cpu, tb, host_pc);
+             return true;
+         }
+     }
+@@ -XXX,XX +XXX,XX @@ void tb_check_watchpoint(CPUState *cpu, uintptr_t retaddr)
+     tb = tcg_tb_lookup(retaddr);
+     if (tb) {
+         /* We can use retranslation to find the PC.  */
+-        cpu_restore_state_from_tb(cpu, tb, retaddr, true);
++        cpu_restore_state_from_tb(cpu, tb, retaddr);
+         tb_phys_invalidate(tb, -1);
+     } else {
+         /* The exception probably happened in a helper.  The CPU state should
+@@ -XXX,XX +XXX,XX @@ void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr)
+         cpu_abort(cpu, "cpu_io_recompile: could not find TB for pc=%p",
+                   (void *)retaddr);
+     }
+-    cpu_restore_state_from_tb(cpu, tb, retaddr, true);
++    cpu_restore_state_from_tb(cpu, tb, retaddr);
      /*
--     * If the TB is not associated with a physical RAM page then
+      * Some guests must re-execute the branch when re-executing a delay
 -     * it must be a temporary one-insn TB, and we have nothing to do
 -     * except fill in the page_addr[] fields. Return early before
 -     * attempting to link to other TBs or add to the lookup table.
 +     * If the TB is not associated with a physical RAM page then it must be
 +     * a temporary one-insn TB, and we have nothing left to do. Return early
 +     * before attempting to link to other TBs or add to the lookup table.
       */
 -    if (phys_pc == -1) {
 -        tb->page_addr[0] = tb->page_addr[1] = -1;
 +    if (tb->page_addr[0] == -1) {
          return tb;
      }
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
       */
      tcg_tb_insert(tb);
 -    /* check next page if needed */
 -    virt_page2 = (pc + tb->size - 1) & TARGET_PAGE_MASK;
 -    phys_page2 = -1;
 -    if ((pc & TARGET_PAGE_MASK) != virt_page2) {
 -        phys_page2 = get_page_addr_code(env, virt_page2);
 -    }
      /*
       * No explicit memory barrier is required -- tb_link_page() makes the
       * TB visible in a consistent state.
       */
 -    existing_tb = tb_link_page(tb, phys_pc, phys_page2);
 +    existing_tb = tb_link_page(tb, tb->page_addr[0], tb->page_addr[1]);
      /* if the TB already exists, discard what we just translated */
      if (unlikely(existing_tb != tb)) {
          uintptr_t orig_aligned = (uintptr_t)gen_code_buf;
 diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translator.c
 +++ b/accel/tcg/translator.c
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest)
      return ((db->pc_first ^ dest) & TARGET_PAGE_MASK) == 0;
  }
 -static inline void translator_page_protect(DisasContextBase *dcbase,
 -                                           target_ulong pc)
 -{
 -#ifdef CONFIG_USER_ONLY
 -    dcbase->page_protect_end = pc | ~TARGET_PAGE_MASK;
 -    page_protect(pc);
 -#endif
 -}
 -
  void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
                       target_ulong pc, void *host_pc,
                       const TranslatorOps *ops, DisasContextBase *db)
@@ -XXX,XX +XXX,XX @@ void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
      db->num_insns = 0;
      db->max_insns = max_insns;
      db->singlestep_enabled = cflags & CF_SINGLE_STEP;
 -    translator_page_protect(db, db->pc_next);
 +    db->host_addr[0] = host_pc;
 +    db->host_addr[1] = NULL;
 +
 +#ifdef CONFIG_USER_ONLY
 +    page_protect(pc);
 +#endif
      ops->init_disas_context(db, cpu);
      tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
@@ -XXX,XX +XXX,XX @@ void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
  #endif
  }
 -static inline void translator_maybe_page_protect(DisasContextBase *dcbase,
 -                                                 target_ulong pc, size_t len)
 +static void *translator_access(CPUArchState *env, DisasContextBase *db,
 +                               target_ulong pc, size_t len)
  {
 -#ifdef CONFIG_USER_ONLY
 -    target_ulong end = pc + len - 1;
 +    void *host;
 +    target_ulong base, end;
 +    TranslationBlock *tb;
 -    if (end > dcbase->page_protect_end) {
 -        translator_page_protect(dcbase, end);
 +    tb = db->tb;
 +
 +    /* Use slow path if first page is MMIO. */
 +    if (unlikely(tb->page_addr[0] == -1)) {
 +        return NULL;
      }
 +
 +    end = pc + len - 1;
 +    if (likely(is_same_page(db, end))) {
 +        host = db->host_addr[0];
 +        base = db->pc_first;
 +    } else {
 +        host = db->host_addr[1];
 +        base = TARGET_PAGE_ALIGN(db->pc_first);
 +        if (host == NULL) {
 +            tb->page_addr[1] =
 +                get_page_addr_code_hostp(env, base, &db->host_addr[1]);
 +#ifdef CONFIG_USER_ONLY
 +            page_protect(end);
  #endif
 +            /* We cannot handle MMIO as second page. */
 +            assert(tb->page_addr[1] != -1);
 +            host = db->host_addr[1];
 +        }
 +
 +        /* Use slow path when crossing pages. */
 +        if (is_same_page(db, pc)) {
 +            return NULL;
 +        }
 +    }
 +
 +    tcg_debug_assert(pc >= base);
 +    return host + (pc - base);
  }
 -#define GEN_TRANSLATOR_LD(fullname, type, load_fn, swap_fn)             \
 -    type fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase, \
 -                           abi_ptr pc, bool do_swap)                    \
 -    {                                                                   \
 -        translator_maybe_page_protect(dcbase, pc, sizeof(type));        \
 -        type ret = load_fn(env, pc);                                    \
 -        if (do_swap) {                                                  \
 -            ret = swap_fn(ret);                                         \
 -        }                                                               \
 -        plugin_insn_append(pc, &ret, sizeof(ret));                      \
 -        return ret;                                                     \
 +uint8_t translator_ldub(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
 +{
 +    uint8_t ret;
 +    void *p = translator_access(env, db, pc, sizeof(ret));
 +
 +    if (p) {
 +        plugin_insn_append(pc, p, sizeof(ret));
 +        return ldub_p(p);
      }
 +    ret = cpu_ldub_code(env, pc);
 +    plugin_insn_append(pc, &ret, sizeof(ret));
 +    return ret;
 +}
 -FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
 +uint16_t translator_lduw(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
 +{
 +    uint16_t ret, plug;
 +    void *p = translator_access(env, db, pc, sizeof(ret));
 -#undef GEN_TRANSLATOR_LD
 +    if (p) {
 +        plugin_insn_append(pc, p, sizeof(ret));
 +        return lduw_p(p);
 +    }
 +    ret = cpu_lduw_code(env, pc);
 +    plug = tswap16(ret);
 +    plugin_insn_append(pc, &plug, sizeof(ret));
 +    return ret;
 +}
 +
 +uint32_t translator_ldl(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
 +{
 +    uint32_t ret, plug;
 +    void *p = translator_access(env, db, pc, sizeof(ret));
 +
 +    if (p) {
 +        plugin_insn_append(pc, p, sizeof(ret));
 +        return ldl_p(p);
 +    }
 +    ret = cpu_ldl_code(env, pc);
 +    plug = tswap32(ret);
 +    plugin_insn_append(pc, &plug, sizeof(ret));
 +    return ret;
 +}
 +
 +uint64_t translator_ldq(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
 +{
 +    uint64_t ret, plug;
 +    void *p = translator_access(env, db, pc, sizeof(ret));
 +
 +    if (p) {
 +        plugin_insn_append(pc, p, sizeof(ret));
 +        return ldq_p(p);
 +    }
 +    ret = cpu_ldq_code(env, pc);
 +    plug = tswap64(ret);
 +    plugin_insn_append(pc, &plug, sizeof(ret));
 +    return ret;
 +}
 --
 .34.1

-[PULL 18/20] target/i386: Make translator stop before the end of a page
+[PULL 11/11] target/i386: Expand eflags updates inline
-From: Ilya Leoshkevich <iii@linux.ibm.com>
+The helpers for reset_rf, cli, sti, clac, stac are
 completely trivial; implement them inline.
-Right now translator stops right *after* the end of a page, which
+Drop some nearby #if 0 code.
 breaks reporting of fault locations when the last instruction of a
 multi-insn translation block crosses a page boundary.
-An implementation, like the one arm and s390x have, would require an
+Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
-i386 length disassembler, which is burdensome to maintain. Another
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 alternative would be to single-step at the end of a guest page, but
 this may come with a performance impact.
 Fix by snapshotting disassembly state and restoring it after we figure
 out we crossed a page boundary. This includes rolling back cc_op
 updates and emitted ops.
 Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1143
 Message-Id: <20220817150506.592862-4-iii@linux.ibm.com>
 [rth: Simplify end-of-insn cross-page checks.]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/i386/tcg/translate.c      | 64 ++++++++++++++++-----------
+ target/i386/helper.h        |  5 -----
- tests/tcg/x86_64/noexec.c        | 75 ++++++++++++++++++++++++++++++++
+ target/i386/tcg/cc_helper.c | 41 -------------------------------------
- tests/tcg/x86_64/Makefile.target |  3 +-
+ target/i386/tcg/translate.c | 30 ++++++++++++++++++++++-----
-files changed, 116 insertions(+), 26 deletions(-)
+files changed, 25 insertions(+), 51 deletions(-)
  create mode 100644 tests/tcg/x86_64/noexec.c
+diff --git a/target/i386/helper.h b/target/i386/helper.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/i386/helper.h
++++ b/target/i386/helper.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_2(syscall, void, env, int)
+ DEF_HELPER_2(sysret, void, env, int)
+ #endif
+ DEF_HELPER_FLAGS_2(pause, TCG_CALL_NO_WG, noreturn, env, int)
+-DEF_HELPER_1(reset_rf, void, env)
+ DEF_HELPER_FLAGS_3(raise_interrupt, TCG_CALL_NO_WG, noreturn, env, int, int)
+ DEF_HELPER_FLAGS_2(raise_exception, TCG_CALL_NO_WG, noreturn, env, int)
+-DEF_HELPER_1(cli, void, env)
+-DEF_HELPER_1(sti, void, env)
+-DEF_HELPER_1(clac, void, env)
+-DEF_HELPER_1(stac, void, env)
+ DEF_HELPER_3(boundw, void, env, tl, int)
+ DEF_HELPER_3(boundl, void, env, tl, int)
+diff --git a/target/i386/tcg/cc_helper.c b/target/i386/tcg/cc_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/i386/tcg/cc_helper.c
++++ b/target/i386/tcg/cc_helper.c
+@@ -XXX,XX +XXX,XX @@ void helper_clts(CPUX86State *env)
+     env->cr[0] &= ~CR0_TS_MASK;
+     env->hflags &= ~HF_TS_MASK;
+ }
+-
+-void helper_reset_rf(CPUX86State *env)
+-{
+-    env->eflags &= ~RF_MASK;
+-}
+-
+-void helper_cli(CPUX86State *env)
+-{
+-    env->eflags &= ~IF_MASK;
+-}
+-
+-void helper_sti(CPUX86State *env)
+-{
+-    env->eflags |= IF_MASK;
+-}
+-
+-void helper_clac(CPUX86State *env)
+-{
+-    env->eflags &= ~AC_MASK;
+-}
+-
+-void helper_stac(CPUX86State *env)
+-{
+-    env->eflags |= AC_MASK;
+-}
+-
+-#if 0
+-/* vm86plus instructions */
+-void helper_cli_vm(CPUX86State *env)
+-{
+-    env->eflags &= ~VIF_MASK;
+-}
+-
+-void helper_sti_vm(CPUX86State *env)
+-{
+-    env->eflags |= VIF_MASK;
+-    if (env->eflags & VIP_MASK) {
+-        raise_exception_ra(env, EXCP0D_GPF, GETPC());
+-    }
+-}
+-#endif
 diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/translate.c
 +++ b/target/i386/tcg/translate.c
-@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
+@@ -XXX,XX +XXX,XX @@ static void gen_reset_hflag(DisasContext *s, uint32_t mask)
-     TCGv_i64 tmp1_i64;
+     }
+ }
-     sigjmp_buf jmpbuf;
-+    TCGOp *prev_insn_end;
++static void gen_set_eflags(DisasContext *s, target_ulong mask)
- } DisasContext;
++{
++    TCGv t = tcg_temp_new();
  /* The environment in which user-only runs is constrained. */
@@ -XXX,XX +XXX,XX @@ static uint64_t advance_pc(CPUX86State *env, DisasContext *s, int num_bytes)
  {
      uint64_t pc = s->pc;
 +    /* This is a subsequent insn that crosses a page boundary.  */
 +    if (s->base.num_insns > 1 &&
 +        !is_same_page(&s->base, s->pc + num_bytes - 1)) {
 +        siglongjmp(s->jmpbuf, 2);
 +    }
 +
-     s->pc += num_bytes;
++    tcg_gen_ld_tl(t, cpu_env, offsetof(CPUX86State, eflags));
-     if (unlikely(s->pc - s->pc_start > X86_MAX_INSN_LENGTH)) {
++    tcg_gen_ori_tl(t, t, mask);
-         /* If the instruction's 16th byte is on a different page than the 1st, a
++    tcg_gen_st_tl(t, cpu_env, offsetof(CPUX86State, eflags));
-@@ -XXX,XX +XXX,XX @@ static target_ulong disas_insn(DisasContext *s, CPUState *cpu)
++    tcg_temp_free(t);
      int modrm, reg, rm, mod, op, opreg, val;
      target_ulong next_eip, tval;
      target_ulong pc_start = s->base.pc_next;
 +    bool orig_cc_op_dirty = s->cc_op_dirty;
 +    CCOp orig_cc_op = s->cc_op;
      s->pc_start = s->pc = pc_start;
      s->override = -1;
@@ -XXX,XX +XXX,XX @@ static target_ulong disas_insn(DisasContext *s, CPUState *cpu)
      s->rip_offset = 0; /* for relative ip address */
      s->vex_l = 0;
      s->vex_v = 0;
 -    if (sigsetjmp(s->jmpbuf, 0) != 0) {
 +    switch (sigsetjmp(s->jmpbuf, 0)) {
 +    case 0:
 +        break;
 +    case 1:
          gen_exception_gpf(s);
          return s->pc;
 +    case 2:
 +        /* Restore state that may affect the next instruction. */
 +        s->cc_op_dirty = orig_cc_op_dirty;
 +        s->cc_op = orig_cc_op;
 +        s->base.num_insns--;
 +        tcg_remove_ops_after(s->prev_insn_end);
 +        s->base.is_jmp = DISAS_TOO_MANY;
 +        return pc_start;
 +    default:
 +        g_assert_not_reached();
      }
      prefixes = 0;
@@ -XXX,XX +XXX,XX @@ static void i386_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu)
  {
      DisasContext *dc = container_of(dcbase, DisasContext, base);
 +    dc->prev_insn_end = tcg_last_op();
      tcg_gen_insn_start(dc->base.pc_next, dc->cc_op);
  }
@@ -XXX,XX +XXX,XX @@ static void i386_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
  #endif
      pc_next = disas_insn(dc, cpu);
 -
 -    if (dc->flags & (HF_TF_MASK | HF_INHIBIT_IRQ_MASK)) {
 -        /* if single step mode, we generate only one instruction and
 -           generate an exception */
 -        /* if irq were inhibited with HF_INHIBIT_IRQ_MASK, we clear
 -           the flag and abort the translation to give the irqs a
 -           chance to happen */
 -        dc->base.is_jmp = DISAS_TOO_MANY;
 -    } else if ((tb_cflags(dc->base.tb) & CF_USE_ICOUNT)
 -               && ((pc_next & TARGET_PAGE_MASK)
 -                   != ((pc_next + TARGET_MAX_INSN_SIZE - 1)
 -                       & TARGET_PAGE_MASK)
 -                   || (pc_next & ~TARGET_PAGE_MASK) == 0)) {
 -        /* Do not cross the boundary of the pages in icount mode,
 -           it can cause an exception. Do it only when boundary is
 -           crossed by the first instruction in the block.
 -           If current instruction already crossed the bound - it's ok,
 -           because an exception hasn't stopped this code.
 -         */
 -        dc->base.is_jmp = DISAS_TOO_MANY;
 -    } else if ((pc_next - dc->base.pc_first) >= (TARGET_PAGE_SIZE - 32)) {
 -        dc->base.is_jmp = DISAS_TOO_MANY;
 -    }
 -
      dc->base.pc_next = pc_next;
 +
 +    if (dc->base.is_jmp == DISAS_NEXT) {
 +        if (dc->flags & (HF_TF_MASK | HF_INHIBIT_IRQ_MASK)) {
 +            /*
 +             * If single step mode, we generate only one instruction and
 +             * generate an exception.
 +             * If irq were inhibited with HF_INHIBIT_IRQ_MASK, we clear
 +             * the flag and abort the translation to give the irqs a
 +             * chance to happen.
 +             */
 +            dc->base.is_jmp = DISAS_TOO_MANY;
 +        } else if (!is_same_page(&dc->base, pc_next)) {
 +            dc->base.is_jmp = DISAS_TOO_MANY;
 +        }
 +    }
  }
  static void i386_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
 diff --git a/tests/tcg/x86_64/noexec.c b/tests/tcg/x86_64/noexec.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/tcg/x86_64/noexec.c
@@ -XXX,XX +XXX,XX @@
 +#include "../multiarch/noexec.c.inc"
 +
 +static void *arch_mcontext_pc(const mcontext_t *ctx)
 +{
 +    return (void *)ctx->gregs[REG_RIP];
 +}
 +
-+int arch_mcontext_arg(const mcontext_t *ctx)
++static void gen_reset_eflags(DisasContext *s, target_ulong mask)
 +{
-+    return ctx->gregs[REG_RDI];
++    TCGv t = tcg_temp_new();
 +
 +    tcg_gen_ld_tl(t, cpu_env, offsetof(CPUX86State, eflags));
 +    tcg_gen_andi_tl(t, t, ~mask);
 +    tcg_gen_st_tl(t, cpu_env, offsetof(CPUX86State, eflags));
 +    tcg_temp_free(t);
 +}
 +
-+static void arch_flush(void *p, int len)
+ /* Clear BND registers during legacy branches.  */
-+{
+ static void gen_bnd_jmp(DisasContext *s)
-+}
+ {
-+
+@@ -XXX,XX +XXX,XX @@ do_gen_eob_worker(DisasContext *s, bool inhibit, bool recheck_tf, bool jr)
-+extern char noexec_1[];
+     }
-+extern char noexec_2[];
-+extern char noexec_end[];
+     if (s->base.tb->flags & HF_RF_MASK) {
-+
+-        gen_helper_reset_rf(cpu_env);
-+asm("noexec_1:\n"
++        gen_reset_eflags(s, RF_MASK);
-+    "    movq $1,%rdi\n"    /* %rdi is 0 on entry, set 1. */
+     }
-+    "noexec_2:\n"
+     if (recheck_tf) {
-+    "    movq $2,%rdi\n"    /* %rdi is 0/1; set 2. */
+         gen_helper_rechecking_single_step(cpu_env);
-+    "    ret\n"
+@@ -XXX,XX +XXX,XX @@ static bool disas_insn(DisasContext *s, CPUState *cpu)
-+    "noexec_end:");
+ #endif
-+
+     case 0xfa: /* cli */
-+int main(void)
+         if (check_iopl(s)) {
-+{
+-            gen_helper_cli(cpu_env);
-+    struct noexec_test noexec_tests[] = {
++            gen_reset_eflags(s, IF_MASK);
-+        {
+         }
-+            .name = "fallthrough",
+         break;
-+            .test_code = noexec_1,
+     case 0xfb: /* sti */
-+            .test_len = noexec_end - noexec_1,
+         if (check_iopl(s)) {
-+            .page_ofs = noexec_1 - noexec_2,
+-            gen_helper_sti(cpu_env);
-+            .entry_ofs = noexec_1 - noexec_2,
++            gen_set_eflags(s, IF_MASK);
-+            .expected_si_ofs = 0,
+             /* interruptions are enabled only the first insn after sti */
-+            .expected_pc_ofs = 0,
+             gen_update_eip_next(s);
-+            .expected_arg = 1,
+             gen_eob_inhibit_irq(s, true);
-+        },
+@@ -XXX,XX +XXX,XX @@ static bool disas_insn(DisasContext *s, CPUState *cpu)
-+        {
+                 || CPL(s) != 0) {
-+            .name = "jump",
+                 goto illegal_op;
-+            .test_code = noexec_1,
+             }
-+            .test_len = noexec_end - noexec_1,
+-            gen_helper_clac(cpu_env);
-+            .page_ofs = noexec_1 - noexec_2,
++            gen_reset_eflags(s, AC_MASK);
-+            .entry_ofs = 0,
+             s->base.is_jmp = DISAS_EOB_NEXT;
-+            .expected_si_ofs = 0,
+             break;
-+            .expected_pc_ofs = 0,
-+            .expected_arg = 0,
+@@ -XXX,XX +XXX,XX @@ static bool disas_insn(DisasContext *s, CPUState *cpu)
-+        },
+                 || CPL(s) != 0) {
-+        {
+                 goto illegal_op;
-+            .name = "fallthrough [cross]",
+             }
-+            .test_code = noexec_1,
+-            gen_helper_stac(cpu_env);
-+            .test_len = noexec_end - noexec_1,
++            gen_set_eflags(s, AC_MASK);
-+            .page_ofs = noexec_1 - noexec_2 - 2,
+             s->base.is_jmp = DISAS_EOB_NEXT;
-+            .entry_ofs = noexec_1 - noexec_2 - 2,
+             break;
-+            .expected_si_ofs = 0,
 +            .expected_pc_ofs = -2,
 +            .expected_arg = 1,
 +        },
 +        {
 +            .name = "jump [cross]",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2 - 2,
 +            .entry_ofs = -2,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = -2,
 +            .expected_arg = 0,
 +        },
 +    };
 +
 +    return test_noexec(noexec_tests,
 +                       sizeof(noexec_tests) / sizeof(noexec_tests[0]));
 +}
 diff --git a/tests/tcg/x86_64/Makefile.target b/tests/tcg/x86_64/Makefile.target
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/tcg/x86_64/Makefile.target
 +++ b/tests/tcg/x86_64/Makefile.target
@@ -XXX,XX +XXX,XX @@ include $(SRC_PATH)/tests/tcg/i386/Makefile.target
  ifeq ($(filter %-linux-user, $(TARGET)),$(TARGET))
  X86_64_TESTS += vsyscall
 +X86_64_TESTS += noexec
  TESTS=$(MULTIARCH_TESTS) $(X86_64_TESTS) test-x86_64
  else
  TESTS=$(MULTIARCH_TESTS)
@@ -XXX,XX +XXX,XX @@ test-x86_64: LDFLAGS+=-lm -lc
  test-x86_64: test-i386.c test-i386.h test-i386-shift.h test-i386-muldiv.h
      $(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
 -vsyscall: $(SRC_PATH)/tests/tcg/x86_64/vsyscall.c
 +%: $(SRC_PATH)/tests/tcg/x86_64/%.c
      $(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
 --
 .34.1

-[PULL 19/20] target/riscv: Add MAX_INSN_LEN and insn_len
+Deleted patch
-These will be useful in properly ending the TB.
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/riscv/translate.c | 10 +++++++++-
-file changed, 9 insertions(+), 1 deletion(-)
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
-+++ b/target/riscv/translate.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
- /* Include decoders for factored-out extensions */
- #include "decode-XVentanaCondOps.c.inc"
-+/* The specification allows for longer insns, but not supported by qemu. */
-+#define MAX_INSN_LEN  4
-+
-+static inline int insn_len(uint16_t first_word)
-+{
-+    return (first_word & 3) == 3 ? 4 : 2;
-+}
-+
- static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
- {
-     /*
-@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
-     };
-     /* Check for compressed insn */
--    if (extract16(opcode, 0, 2) != 3) {
-+    if (insn_len(opcode) == 2) {
-         if (!has_ext(ctx, RVC)) {
-             gen_exception_illegal(ctx);
-         } else {
---
-.34.1

The following changes since commit e93ded1bf6c94ab95015b33e188bc8b0b0c32670:

Merge tag 'testing-pull-request-2022-08-30' of https://gitlab.com/thuth/qemu into staging (2022-08-31 18:19:03 -0400)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20220901

for you to fetch changes up to 20011be2e30b8aa8ef1fc258485f00c688703deb:

target/riscv: Make translator stop before the end of a page (2022-09-01 07:43:08 +0100)

----------------------------------------------------------------
Respect PROT_EXEC in user-only mode.
Fix s390x, i386 and riscv for translations crossing a page.

----------------------------------------------------------------
Ilya Leoshkevich (4):
      linux-user: Clear translations on mprotect()
      accel/tcg: Introduce is_same_page()
      target/s390x: Make translator stop before the end of a page
      target/i386: Make translator stop before the end of a page

Richard Henderson (16):
      linux-user/arm: Mark the commpage executable
      linux-user/hppa: Allocate page zero as a commpage
      linux-user/x86_64: Allocate vsyscall page as a commpage
      linux-user: Honor PT_GNU_STACK
      tests/tcg/i386: Move smc_code2 to an executable section
      accel/tcg: Properly implement get_page_addr_code for user-only
      accel/tcg: Unlock mmap_lock after longjmp
      accel/tcg: Make tb_htable_lookup static
      accel/tcg: Move qemu_ram_addr_from_host_nofail to physmem.c
      accel/tcg: Use probe_access_internal for softmmu get_page_addr_code_hostp
      accel/tcg: Document the faulting lookup in tb_lookup_cmp
      accel/tcg: Remove translator_ldsw
      accel/tcg: Add pc and host_pc params to gen_intermediate_code
      accel/tcg: Add fast path for translator_ld*
      target/riscv: Add MAX_INSN_LEN and insn_len
      target/riscv: Make translator stop before the end of a page

include/elf.h                     |   1 +
 include/exec/cpu-common.h         |   1 +
 include/exec/exec-all.h           |  89 ++++++++----------------
 include/exec/translator.h         |  96 ++++++++++++++++---------
 linux-user/arm/target_cpu.h       |   4 +-
 linux-user/qemu.h                 |   1 +
 accel/tcg/cpu-exec.c              | 143 ++++++++++++++++++++------------------
 accel/tcg/cputlb.c                |  93 +++++++------------------
 accel/tcg/translate-all.c         |  29 ++++----
 accel/tcg/translator.c            | 135 ++++++++++++++++++++++++++---------
 accel/tcg/user-exec.c             |  17 ++++-
 linux-user/elfload.c              |  82 ++++++++++++++++++++--
 linux-user/mmap.c                 |   6 +-
 softmmu/physmem.c                 |  12 ++++
 target/alpha/translate.c          |   5 +-
 target/arm/translate.c            |   5 +-
 target/avr/translate.c            |   5 +-
 target/cris/translate.c           |   5 +-
 target/hexagon/translate.c        |   6 +-
 target/hppa/translate.c           |   5 +-
 target/i386/tcg/translate.c       |  71 +++++++++++--------
 target/loongarch/translate.c      |   6 +-
 target/m68k/translate.c           |   5 +-
 target/microblaze/translate.c     |   5 +-
 target/mips/tcg/translate.c       |   5 +-
 target/nios2/translate.c          |   5 +-
 target/openrisc/translate.c       |   6 +-
 target/ppc/translate.c            |   5 +-
 target/riscv/translate.c          |  32 +++++++--
 target/rx/translate.c             |   5 +-
 target/s390x/tcg/translate.c      |  20 ++++--
 target/sh4/translate.c            |   5 +-
 target/sparc/translate.c          |   5 +-
 target/tricore/translate.c        |   6 +-
 target/xtensa/translate.c         |   6 +-
 tests/tcg/i386/test-i386.c        |   2 +-
 tests/tcg/riscv64/noexec.c        |  79 +++++++++++++++++++++
 tests/tcg/s390x/noexec.c          | 106 ++++++++++++++++++++++++++++
 tests/tcg/x86_64/noexec.c         |  75 ++++++++++++++++++++
 tests/tcg/multiarch/noexec.c.inc  | 139 ++++++++++++++++++++++++++++++++++++
 tests/tcg/riscv64/Makefile.target |   1 +
 tests/tcg/s390x/Makefile.target   |   1 +
 tests/tcg/x86_64/Makefile.target  |   3 +-
 43 files changed, 966 insertions(+), 367 deletions(-)
 create mode 100644 tests/tcg/riscv64/noexec.c
 create mode 100644 tests/tcg/s390x/noexec.c
 create mode 100644 tests/tcg/x86_64/noexec.c
 create mode 100644 tests/tcg/multiarch/noexec.c.inc

We're about to start validating PAGE_EXEC, which means
that we've got to mark the commpage executable.  We had
been placing the commpage outside of reserved_va, which
was incorrect and lead to an abort.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/arm/target_cpu.h | 4 ++--
 linux-user/elfload.c        | 6 +++++-
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/linux-user/arm/target_cpu.h b/linux-user/arm/target_cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/arm/target_cpu.h
+++ b/linux-user/arm/target_cpu.h
@@ -XXX,XX +XXX,XX @@ static inline unsigned long arm_max_reserved_va(CPUState *cs)
     } else {
         /*
          * We need to be able to map the commpage.
-         * See validate_guest_space in linux-user/elfload.c.
+         * See init_guest_commpage in linux-user/elfload.c.
          */
-        return 0xffff0000ul;
+        return 0xfffffffful;
     }
 }
 #define MAX_RESERVED_VA  arm_max_reserved_va
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ enum {
 
 static bool init_guest_commpage(void)
 {
-    void *want = g2h_untagged(HI_COMMPAGE & -qemu_host_page_size);
+    abi_ptr commpage = HI_COMMPAGE & -qemu_host_page_size;
+    void *want = g2h_untagged(commpage);
     void *addr = mmap(want, qemu_host_page_size, PROT_READ | PROT_WRITE,
                       MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
 
@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)
         perror("Protecting guest commpage");
         exit(EXIT_FAILURE);
     }
+
+    page_set_flags(commpage, commpage + qemu_host_page_size,
+                   PAGE_READ | PAGE_EXEC | PAGE_VALID);
     return true;
 }
 
-- 
2.34.1

While there are no target-specific nonfaulting probes,
generic code may grow some uses at some point.

Note that the attrs argument was incorrect -- it should have
been MEMTXATTRS_UNSPECIFIED. Just use the simpler interface.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/helper.c | 46 ++++++++++++++++++++++++++++-----------------
 1 file changed, 29 insertions(+), 17 deletions(-)

diff --git a/target/avr/helper.c b/target/avr/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/helper.c
+++ b/target/avr/helper.c
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                       MMUAccessType access_type, int mmu_idx,
                       bool probe, uintptr_t retaddr)
 {
-    int prot = 0;
-    MemTxAttrs attrs = {};
+    int prot, page_size = TARGET_PAGE_SIZE;
     uint32_t paddr;
 
     address &= TARGET_PAGE_MASK;
 
     if (mmu_idx == MMU_CODE_IDX) {
-        /* access to code in flash */
+        /* Access to code in flash. */
         paddr = OFFSET_CODE + address;
         prot = PAGE_READ | PAGE_EXEC;
-        if (paddr + TARGET_PAGE_SIZE > OFFSET_DATA) {
+        if (paddr >= OFFSET_DATA) {
+            /*
+             * This should not be possible via any architectural operations.
+             * There is certainly not an exception that we can deliver.
+             * Accept probing that might come from generic code.
+             */
+            if (probe) {
+                return false;
+            }
             error_report("execution left flash memory");
             abort();
         }
-    } else if (address < NUMBER_OF_CPU_REGISTERS + NUMBER_OF_IO_REGISTERS) {
-        /*
-         * access to CPU registers, exit and rebuilt this TB to use full access
-         * incase it touches specially handled registers like SREG or SP
-         */
-        AVRCPU *cpu = AVR_CPU(cs);
-        CPUAVRState *env = &cpu->env;
-        env->fullacc = 1;
-        cpu_loop_exit_restore(cs, retaddr);
     } else {
-        /* access to memory. nothing special */
+        /* Access to memory. */
         paddr = OFFSET_DATA + address;
         prot = PAGE_READ | PAGE_WRITE;
+        if (address < NUMBER_OF_CPU_REGISTERS + NUMBER_OF_IO_REGISTERS) {
+            /*
+             * Access to CPU registers, exit and rebuilt this TB to use
+             * full access in case it touches specially handled registers
+             * like SREG or SP.  For probing, set page_size = 1, in order
+             * to force tlb_fill to be called for the next access.
+             */
+            if (probe) {
+                page_size = 1;
+            } else {
+                AVRCPU *cpu = AVR_CPU(cs);
+                CPUAVRState *env = &cpu->env;
+                env->fullacc = 1;
+                cpu_loop_exit_restore(cs, retaddr);
+            }
+        }
     }
 
-    tlb_set_page_with_attrs(cs, address, paddr, attrs, prot,
-                            mmu_idx, TARGET_PAGE_SIZE);
-
+    tlb_set_page(cs, address, paddr, prot, mmu_idx, page_size);
     return true;
 }
 
-- 
2.34.1

There is no need to go through cc->tcg_ops when
we know what value that must have.

Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/helper.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/target/avr/helper.c b/target/avr/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/helper.c
+++ b/target/avr/helper.c
@@ -XXX,XX +XXX,XX @@
 bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 {
     bool ret = false;
-    CPUClass *cc = CPU_GET_CLASS(cs);
     AVRCPU *cpu = AVR_CPU(cs);
     CPUAVRState *env = &cpu->env;
 
     if (interrupt_request & CPU_INTERRUPT_RESET) {
         if (cpu_interrupts_enabled(env)) {
             cs->exception_index = EXCP_RESET;
-            cc->tcg_ops->do_interrupt(cs);
+            avr_cpu_do_interrupt(cs);
 
             cs->interrupt_request &= ~CPU_INTERRUPT_RESET;
 
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
         if (cpu_interrupts_enabled(env) && env->intsrc != 0) {
             int index = ctz32(env->intsrc);
             cs->exception_index = EXCP_INT(index);
-            cc->tcg_ops->do_interrupt(cs);
+            avr_cpu_do_interrupt(cs);
 
             env->intsrc &= env->intsrc - 1; /* clear the interrupt */
             if (!env->intsrc) {
-- 
2.34.1

We're about to start validating PAGE_EXEC, which means that we've
got to mark page zero executable.  We had been special casing this
entirely within translate.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 34 +++++++++++++++++++++++++++++++---
 1 file changed, 31 insertions(+), 3 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ static inline void init_thread(struct target_pt_regs *regs,
     regs->gr[31] = infop->entry;
 }
 
+#define LO_COMMPAGE  0
+
+static bool init_guest_commpage(void)
+{
+    void *want = g2h_untagged(LO_COMMPAGE);
+    void *addr = mmap(want, qemu_host_page_size, PROT_NONE,
+                      MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
+
+    if (addr == MAP_FAILED) {
+        perror("Allocating guest commpage");
+        exit(EXIT_FAILURE);
+    }
+    if (addr != want) {
+        return false;
+    }
+
+    /*
+     * On Linux, page zero is normally marked execute only + gateway.
+     * Normal read or write is supposed to fail (thus PROT_NONE above),
+     * but specific offsets have kernel code mapped to raise permissions
+     * and implement syscalls.  Here, simply mark the page executable.
+     * Special case the entry points during translation (see do_page_zero).
+     */
+    page_set_flags(LO_COMMPAGE, LO_COMMPAGE + TARGET_PAGE_SIZE,
+                   PAGE_EXEC | PAGE_VALID);
+    return true;
+}
+
 #endif /* TARGET_HPPA */
 
 #ifdef TARGET_XTENSA
@@ -XXX,XX +XXX,XX @@ static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
 }
 
 #if defined(HI_COMMPAGE)
-#define LO_COMMPAGE 0
+#define LO_COMMPAGE -1
 #elif defined(LO_COMMPAGE)
 #define HI_COMMPAGE 0
 #else
 #define HI_COMMPAGE 0
-#define LO_COMMPAGE 0
+#define LO_COMMPAGE -1
 #define init_guest_commpage() true
 #endif
 
@@ -XXX,XX +XXX,XX @@ static void pgb_static(const char *image_name, abi_ulong orig_loaddr,
         } else {
             offset = -(HI_COMMPAGE & -align);
         }
-    } else if (LO_COMMPAGE != 0) {
+    } else if (LO_COMMPAGE != -1) {
         loaddr = MIN(loaddr, LO_COMMPAGE & -align);
     }
 
-- 
2.34.1

We're about to start validating PAGE_EXEC, which means that we've
got to mark the vsyscall page executable.  We had been special
casing this entirely within translate.

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *en
     (*regs)[26] = tswapreg(env->segs[R_GS].selector & 0xffff);
 }
 
+#if ULONG_MAX >= TARGET_VSYSCALL_PAGE
+#define INIT_GUEST_COMMPAGE
+static bool init_guest_commpage(void)
+{
+    /*
+     * The vsyscall page is at a high negative address aka kernel space,
+     * which means that we cannot actually allocate it with target_mmap.
+     * We still should be able to use page_set_flags, unless the user
+     * has specified -R reserved_va, which would trigger an assert().
+     */
+    if (reserved_va != 0 &&
+        TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE >= reserved_va) {
+        error_report("Cannot allocate vsyscall page");
+        exit(EXIT_FAILURE);
+    }
+    page_set_flags(TARGET_VSYSCALL_PAGE,
+                   TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE,
+                   PAGE_EXEC | PAGE_VALID);
+    return true;
+}
+#endif
 #else
 
 #define ELF_START_MMAP 0x80000000
@@ -XXX,XX +XXX,XX @@ static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
 #else
 #define HI_COMMPAGE 0
 #define LO_COMMPAGE -1
+#ifndef INIT_GUEST_COMMPAGE
 #define init_guest_commpage() true
 #endif
+#endif
 
 static void pgb_fail_in_use(const char *image_name)
 {
-- 
2.34.1

We cannot deliver two interrupts simultaneously;
the first interrupt handler must execute first.

Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/helper.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

This bit is not saved across interrupts, so we must
delay delivering the interrupt until the skip has
been processed.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1118
Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/helper.c    |  9 +++++++++
 target/avr/translate.c | 26 ++++++++++++++++++++++----
 2 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/target/avr/helper.c b/target/avr/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/helper.c
+++ b/target/avr/helper.c
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
     AVRCPU *cpu = AVR_CPU(cs);
     CPUAVRState *env = &cpu->env;
 
+    /*
+     * We cannot separate a skip from the next instruction,
+     * as the skip would not be preserved across the interrupt.
+     * Separating the two insn normally only happens at page boundaries.
+     */
+    if (env->skip) {
+        return false;
+    }
+
     if (interrupt_request & CPU_INTERRUPT_RESET) {
         if (cpu_interrupts_enabled(env)) {
             cs->exception_index = EXCP_RESET;
diff --git a/target/avr/translate.c b/target/avr/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/translate.c
+++ b/target/avr/translate.c
@@ -XXX,XX +XXX,XX @@ static void avr_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
     if (skip_label) {
         canonicalize_skip(ctx);
         gen_set_label(skip_label);
-        if (ctx->base.is_jmp == DISAS_NORETURN) {
+
+        switch (ctx->base.is_jmp) {
+        case DISAS_NORETURN:
             ctx->base.is_jmp = DISAS_CHAIN;
+            break;
+        case DISAS_NEXT:
+            if (ctx->base.tb->flags & TB_FLAGS_SKIP) {
+                ctx->base.is_jmp = DISAS_TOO_MANY;
+            }
+            break;
+        default:
+            break;
         }
     }
 
@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
 {
     DisasContext *ctx = container_of(dcbase, DisasContext, base);
     bool nonconst_skip = canonicalize_skip(ctx);
+    /*
+     * Because we disable interrupts while env->skip is set,
+     * we must return to the main loop to re-evaluate afterward.
+     */
+    bool force_exit = ctx->base.tb->flags & TB_FLAGS_SKIP;
 
     switch (ctx->base.is_jmp) {
     case DISAS_NORETURN:
@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
     case DISAS_NEXT:
     case DISAS_TOO_MANY:
     case DISAS_CHAIN:
-        if (!nonconst_skip) {
+        if (!nonconst_skip && !force_exit) {
             /* Note gen_goto_tb checks singlestep.  */
             gen_goto_tb(ctx, 1, ctx->npc);
             break;
@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
         tcg_gen_movi_tl(cpu_pc, ctx->npc);
         /* fall through */
     case DISAS_LOOKUP:
-        tcg_gen_lookup_and_goto_ptr();
-        break;
+        if (!force_exit) {
+            tcg_gen_lookup_and_goto_ptr();
+            break;
+        }
+        /* fall through */
     case DISAS_EXIT:
         tcg_gen_exit_tb(NULL, 0);
         break;
-- 
2.34.1

Map the stack executable if required by default or on demand.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/elf.h        |  1 +
 linux-user/qemu.h    |  1 +
 linux-user/elfload.c | 19 ++++++++++++++++++-
 3 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/include/elf.h b/include/elf.h
index XXXXXXX..XXXXXXX 100644
--- a/include/elf.h
+++ b/include/elf.h
@@ -XXX,XX +XXX,XX @@ typedef int64_t  Elf64_Sxword;
 #define PT_LOPROC  0x70000000
 #define PT_HIPROC  0x7fffffff
 
+#define PT_GNU_STACK      (PT_LOOS + 0x474e551)
 #define PT_GNU_PROPERTY   (PT_LOOS + 0x474e553)
 
 #define PT_MIPS_REGINFO   0x70000000
diff --git a/linux-user/qemu.h b/linux-user/qemu.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/qemu.h
+++ b/linux-user/qemu.h
@@ -XXX,XX +XXX,XX @@ struct image_info {
         uint32_t        elf_flags;
         int             personality;
         abi_ulong       alignment;
+        bool            exec_stack;
 
         /* Generic semihosting knows about these pointers. */
         abi_ulong       arg_strings;   /* strings for argv */
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)
 #define ELF_ARCH        EM_386
 
 #define ELF_PLATFORM get_elf_platform()
+#define EXSTACK_DEFAULT true
 
 static const char *get_elf_platform(void)
 {
@@ -XXX,XX +XXX,XX @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *en
 
 #define ELF_ARCH        EM_ARM
 #define ELF_CLASS       ELFCLASS32
+#define EXSTACK_DEFAULT true
 
 static inline void init_thread(struct target_pt_regs *regs,
                                struct image_info *infop)
@@ -XXX,XX +XXX,XX @@ static inline void init_thread(struct target_pt_regs *regs,
 #else
 
 #define ELF_CLASS       ELFCLASS32
+#define EXSTACK_DEFAULT true
 
 #endif
 
@@ -XXX,XX +XXX,XX @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUPPCState *en
 
 #define ELF_CLASS   ELFCLASS64
 #define ELF_ARCH    EM_LOONGARCH
+#define EXSTACK_DEFAULT true
 
 #define elf_check_arch(x) ((x) == EM_LOONGARCH)
 
@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap(void)
 #define ELF_CLASS   ELFCLASS32
 #endif
 #define ELF_ARCH    EM_MIPS
+#define EXSTACK_DEFAULT true
 
 #ifdef TARGET_ABI_MIPSN32
 #define elf_check_abi(x) ((x) & EF_MIPS_ABI2)
@@ -XXX,XX +XXX,XX @@ static inline void init_thread(struct target_pt_regs *regs,
 #define bswaptls(ptr) bswap32s(ptr)
 #endif
 
+#ifndef EXSTACK_DEFAULT
+#define EXSTACK_DEFAULT false
+#endif
+
 #include "elf.h"
 
 /* We must delay the following stanzas until after "elf.h". */
@@ -XXX,XX +XXX,XX @@ static abi_ulong setup_arg_pages(struct linux_binprm *bprm,
                                  struct image_info *info)
 {
     abi_ulong size, error, guard;
+    int prot;
 
     size = guest_stack_size;
     if (size < STACK_LOWER_LIMIT) {
@@ -XXX,XX +XXX,XX @@ static abi_ulong setup_arg_pages(struct linux_binprm *bprm,
         guard = qemu_real_host_page_size();
     }
 
-    error = target_mmap(0, size + guard, PROT_READ | PROT_WRITE,
+    prot = PROT_READ | PROT_WRITE;
+    if (info->exec_stack) {
+        prot |= PROT_EXEC;
+    }
+    error = target_mmap(0, size + guard, prot,
                         MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
     if (error == -1) {
         perror("mmap stack");
@@ -XXX,XX +XXX,XX @@ static void load_elf_image(const char *image_name, int image_fd,
      */
     loaddr = -1, hiaddr = 0;
     info->alignment = 0;
+    info->exec_stack = EXSTACK_DEFAULT;
     for (i = 0; i < ehdr->e_phnum; ++i) {
         struct elf_phdr *eppnt = phdr + i;
         if (eppnt->p_type == PT_LOAD) {
@@ -XXX,XX +XXX,XX @@ static void load_elf_image(const char *image_name, int image_fd,
             if (!parse_elf_properties(image_fd, info, eppnt, bprm_buf, &err)) {
                 goto exit_errmsg;
             }
+        } else if (eppnt->p_type == PT_GNU_STACK) {
+            info->exec_stack = eppnt->p_flags & PF_X;
         }
     }
 
-- 
2.34.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

Introduce a function that checks whether a given address is on the same
page as where disassembly started. Having it improves readability of
the following patches.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20220811095534.241224-3-iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
[rth: Make the DisasContextBase parameter const.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/translator.h | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/include/exec/translator.h b/include/exec/translator.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/translator.h
+++ b/include/exec/translator.h
@@ -XXX,XX +XXX,XX @@ FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
 
 #undef GEN_TRANSLATOR_LD
 
+/*
+ * Return whether addr is on the same page as where disassembly started.
+ * Translators can use this to enforce the rule that only single-insn
+ * translation blocks are allowed to cross page boundaries.
+ */
+static inline bool is_same_page(const DisasContextBase *db, target_ulong addr)
+{
+    return ((addr ^ db->pc_first) & TARGET_PAGE_MASK) == 0;
+}
+
 #endif /* EXEC__TRANSLATOR_H */
-- 
2.34.1

The current implementation is a no-op, simply returning addr.
This is incorrect, because we ought to be checking the page
permissions for execution.

Make get_page_addr_code inline for both implementations.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/exec-all.h | 85 ++++++++++++++---------------------------
 accel/tcg/cputlb.c      |  5 ---
 accel/tcg/user-exec.c   | 14 +++++++
 3 files changed, 42 insertions(+), 62 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ struct MemoryRegionSection *iotlb_to_section(CPUState *cpu,
                                              hwaddr index, MemTxAttrs attrs);
 #endif
 
-#if defined(CONFIG_USER_ONLY)
-void mmap_lock(void);
-void mmap_unlock(void);
-bool have_mmap_lock(void);
-
 /**
- * get_page_addr_code() - user-mode version
+ * get_page_addr_code_hostp()
  * @env: CPUArchState
  * @addr: guest virtual address of guest code
  *
- * Returns @addr.
+ * See get_page_addr_code() (full-system version) for documentation on the
+ * return value.
+ *
+ * Sets *@hostp (when @hostp is non-NULL) as follows.
+ * If the return value is -1, sets *@hostp to NULL. Otherwise, sets *@hostp
+ * to the host address where @addr's content is kept.
+ *
+ * Note: this function can trigger an exception.
+ */
+tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
+                                        void **hostp);
+
+/**
+ * get_page_addr_code()
+ * @env: CPUArchState
+ * @addr: guest virtual address of guest code
+ *
+ * If we cannot translate and execute from the entire RAM page, or if
+ * the region is not backed by RAM, returns -1. Otherwise, returns the
+ * ram_addr_t corresponding to the guest code at @addr.
+ *
+ * Note: this function can trigger an exception.
  */
 static inline tb_page_addr_t get_page_addr_code(CPUArchState *env,
                                                 target_ulong addr)
 {
-    return addr;
+    return get_page_addr_code_hostp(env, addr, NULL);
 }
 
-/**
- * get_page_addr_code_hostp() - user-mode version
- * @env: CPUArchState
- * @addr: guest virtual address of guest code
- *
- * Returns @addr.
- *
- * If @hostp is non-NULL, sets *@hostp to the host address where @addr's content
- * is kept.
- */
-static inline tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env,
-                                                      target_ulong addr,
-                                                      void **hostp)
-{
-    if (hostp) {
-        *hostp = g2h_untagged(addr);
-    }
-    return addr;
-}
+#if defined(CONFIG_USER_ONLY)
+void mmap_lock(void);
+void mmap_unlock(void);
+bool have_mmap_lock(void);
 
 /**
  * adjust_signal_pc:
@@ -XXX,XX +XXX,XX @@ G_NORETURN void cpu_loop_exit_sigbus(CPUState *cpu, target_ulong addr,
 static inline void mmap_lock(void) {}
 static inline void mmap_unlock(void) {}
 
-/**
- * get_page_addr_code() - full-system version
- * @env: CPUArchState
- * @addr: guest virtual address of guest code
- *
- * If we cannot translate and execute from the entire RAM page, or if
- * the region is not backed by RAM, returns -1. Otherwise, returns the
- * ram_addr_t corresponding to the guest code at @addr.
- *
- * Note: this function can trigger an exception.
- */
-tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr);
-
-/**
- * get_page_addr_code_hostp() - full-system version
- * @env: CPUArchState
- * @addr: guest virtual address of guest code
- *
- * See get_page_addr_code() (full-system version) for documentation on the
- * return value.
- *
- * Sets *@hostp (when @hostp is non-NULL) as follows.
- * If the return value is -1, sets *@hostp to NULL. Otherwise, sets *@hostp
- * to the host address where @addr's content is kept.
- *
- * Note: this function can trigger an exception.
- */
-tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
-                                        void **hostp);
-
 void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length);
 void tlb_set_dirty(CPUState *cpu, target_ulong vaddr);
 
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
     return qemu_ram_addr_from_host_nofail(p);
 }
 
-tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr)
-{
-    return get_page_addr_code_hostp(env, addr, NULL);
-}
-
 static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
                            CPUIOTLBEntry *iotlbentry, uintptr_t retaddr)
 {
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
     return size ? g2h(env_cpu(env), addr) : NULL;
 }
 
+tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
+                                        void **hostp)
+{
+    int flags;
+
+    flags = probe_access_internal(env, addr, 1, MMU_INST_FETCH, false, 0);
+    g_assert(flags == 0);
+
+    if (hostp) {
+        *hostp = g2h_untagged(addr);
+    }
+    return addr;
+}
+
 /* The softmmu versions of these helpers are in cputlb.c.  */
 
 /*
-- 
2.34.1

The mmap_lock is held around tb_gen_code.  While the comment
is correct that the lock is dropped when tb_gen_code runs out
of memory, the lock is *not* dropped when an exception is
raised reading code for translation.

Acked-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c  | 12 ++++++------
 accel/tcg/user-exec.c |  3 ---
 2 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ void cpu_exec_step_atomic(CPUState *cpu)
         cpu_tb_exec(cpu, tb, &tb_exit);
         cpu_exec_exit(cpu);
     } else {
-        /*
-         * The mmap_lock is dropped by tb_gen_code if it runs out of
-         * memory.
-         */
 #ifndef CONFIG_SOFTMMU
         clear_helper_retaddr();
-        tcg_debug_assert(!have_mmap_lock());
+        if (have_mmap_lock()) {
+            mmap_unlock();
+        }
 #endif
         if (qemu_mutex_iothread_locked()) {
             qemu_mutex_unlock_iothread();
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
 
 #ifndef CONFIG_SOFTMMU
         clear_helper_retaddr();
-        tcg_debug_assert(!have_mmap_lock());
+        if (have_mmap_lock()) {
+            mmap_unlock();
+        }
 #endif
         if (qemu_mutex_iothread_locked()) {
             qemu_mutex_unlock_iothread();
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ MMUAccessType adjust_signal_pc(uintptr_t *pc, bool is_write)
          * (and if the translator doesn't handle page boundaries correctly
          * there's little we can do about that here).  Therefore, do not
          * trigger the unwinder.
-         *
-         * Like tb_gen_code, release the memory lock before cpu_loop_exit.
          */
-        mmap_unlock();
         *pc = 0;
         return MMU_INST_FETCH;
     }
-- 
2.34.1

The function is not used outside of cpu-exec.c.  Move it and
its subroutines up in the file, before the first use.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/exec-all.h |   3 -
 accel/tcg/cpu-exec.c    | 122 ++++++++++++++++++++--------------------
 2 files changed, 61 insertions(+), 64 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs);
 #endif
 void tb_flush(CPUState *cpu);
 void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr);
-TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
-                                   target_ulong cs_base, uint32_t flags,
-                                   uint32_t cflags);
 void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr);
 
 /* GETPC is the true target of the return instruction that we'll execute.  */
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ uint32_t curr_cflags(CPUState *cpu)
     return cflags;
 }
 
+struct tb_desc {
+    target_ulong pc;
+    target_ulong cs_base;
+    CPUArchState *env;
+    tb_page_addr_t phys_page1;
+    uint32_t flags;
+    uint32_t cflags;
+    uint32_t trace_vcpu_dstate;
+};
+
+static bool tb_lookup_cmp(const void *p, const void *d)
+{
+    const TranslationBlock *tb = p;
+    const struct tb_desc *desc = d;
+
+    if (tb->pc == desc->pc &&
+        tb->page_addr[0] == desc->phys_page1 &&
+        tb->cs_base == desc->cs_base &&
+        tb->flags == desc->flags &&
+        tb->trace_vcpu_dstate == desc->trace_vcpu_dstate &&
+        tb_cflags(tb) == desc->cflags) {
+        /* check next page if needed */
+        if (tb->page_addr[1] == -1) {
+            return true;
+        } else {
+            tb_page_addr_t phys_page2;
+            target_ulong virt_page2;
+
+            virt_page2 = (desc->pc & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
+            phys_page2 = get_page_addr_code(desc->env, virt_page2);
+            if (tb->page_addr[1] == phys_page2) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+
+static TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
+                                          target_ulong cs_base, uint32_t flags,
+                                          uint32_t cflags)
+{
+    tb_page_addr_t phys_pc;
+    struct tb_desc desc;
+    uint32_t h;
+
+    desc.env = cpu->env_ptr;
+    desc.cs_base = cs_base;
+    desc.flags = flags;
+    desc.cflags = cflags;
+    desc.trace_vcpu_dstate = *cpu->trace_dstate;
+    desc.pc = pc;
+    phys_pc = get_page_addr_code(desc.env, pc);
+    if (phys_pc == -1) {
+        return NULL;
+    }
+    desc.phys_page1 = phys_pc & TARGET_PAGE_MASK;
+    h = tb_hash_func(phys_pc, pc, flags, cflags, *cpu->trace_dstate);
+    return qht_lookup_custom(&tb_ctx.htable, &desc, h, tb_lookup_cmp);
+}
+
 /* Might cause an exception, so have a longjmp destination ready */
 static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
                                           target_ulong cs_base,
@@ -XXX,XX +XXX,XX @@ void cpu_exec_step_atomic(CPUState *cpu)
     end_exclusive();
 }
 
-struct tb_desc {
-    target_ulong pc;
-    target_ulong cs_base;
-    CPUArchState *env;
-    tb_page_addr_t phys_page1;
-    uint32_t flags;
-    uint32_t cflags;
-    uint32_t trace_vcpu_dstate;
-};
-
-static bool tb_lookup_cmp(const void *p, const void *d)
-{
-    const TranslationBlock *tb = p;
-    const struct tb_desc *desc = d;
-
-    if (tb->pc == desc->pc &&
-        tb->page_addr[0] == desc->phys_page1 &&
-        tb->cs_base == desc->cs_base &&
-        tb->flags == desc->flags &&
-        tb->trace_vcpu_dstate == desc->trace_vcpu_dstate &&
-        tb_cflags(tb) == desc->cflags) {
-        /* check next page if needed */
-        if (tb->page_addr[1] == -1) {
-            return true;
-        } else {
-            tb_page_addr_t phys_page2;
-            target_ulong virt_page2;
-
-            virt_page2 = (desc->pc & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
-            phys_page2 = get_page_addr_code(desc->env, virt_page2);
-            if (tb->page_addr[1] == phys_page2) {
-                return true;
-            }
-        }
-    }
-    return false;
-}
-
-TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
-                                   target_ulong cs_base, uint32_t flags,
-                                   uint32_t cflags)
-{
-    tb_page_addr_t phys_pc;
-    struct tb_desc desc;
-    uint32_t h;
-
-    desc.env = cpu->env_ptr;
-    desc.cs_base = cs_base;
-    desc.flags = flags;
-    desc.cflags = cflags;
-    desc.trace_vcpu_dstate = *cpu->trace_dstate;
-    desc.pc = pc;
-    phys_pc = get_page_addr_code(desc.env, pc);
-    if (phys_pc == -1) {
-        return NULL;
-    }
-    desc.phys_page1 = phys_pc & TARGET_PAGE_MASK;
-    h = tb_hash_func(phys_pc, pc, flags, cflags, *cpu->trace_dstate);
-    return qht_lookup_custom(&tb_ctx.htable, &desc, h, tb_lookup_cmp);
-}
-
 void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr)
 {
     if (TCG_TARGET_HAS_direct_jump) {
-- 
2.34.1

The base qemu_ram_addr_from_host function is already in
softmmu/physmem.c; move the nofail version to be adjacent.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-common.h |  1 +
 accel/tcg/cputlb.c        | 12 ------------
 softmmu/physmem.c         | 12 ++++++++++++
 3 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -XXX,XX +XXX,XX @@ typedef uintptr_t ram_addr_t;
 void qemu_ram_remap(ram_addr_t addr, ram_addr_t length);
 /* This should not be used by devices.  */
 ram_addr_t qemu_ram_addr_from_host(void *ptr);
+ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr);
 RAMBlock *qemu_ram_block_by_name(const char *name);
 RAMBlock *qemu_ram_block_from_host(void *ptr, bool round_offset,
                                    ram_addr_t *offset);
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ void tlb_set_page(CPUState *cpu, target_ulong vaddr,
                             prot, mmu_idx, size);
 }
 
-static inline ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr)
-{
-    ram_addr_t ram_addr;
-
-    ram_addr = qemu_ram_addr_from_host(ptr);
-    if (ram_addr == RAM_ADDR_INVALID) {
-        error_report("Bad ram pointer %p", ptr);
-        abort();
-    }
-    return ram_addr;
-}
-
 /*
  * Note: tlb_fill() can trigger a resize of the TLB. This means that all of the
  * caller's prior references to the TLB table (e.g. CPUTLBEntry pointers) must
diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -XXX,XX +XXX,XX @@ ram_addr_t qemu_ram_addr_from_host(void *ptr)
     return block->offset + offset;
 }
 
+ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr)
+{
+    ram_addr_t ram_addr;
+
+    ram_addr = qemu_ram_addr_from_host(ptr);
+    if (ram_addr == RAM_ADDR_INVALID) {
+        error_report("Bad ram pointer %p", ptr);
+        abort();
+    }
+    return ram_addr;
+}
+
 static MemTxResult flatview_read(FlatView *fv, hwaddr addr,
                                  MemTxAttrs attrs, void *buf, hwaddr len);
 static MemTxResult flatview_write(FlatView *fv, hwaddr addr, MemTxAttrs attrs,
-- 
2.34.1

Simplify the implementation of get_page_addr_code_hostp
by reusing the existing probe_access infrastructure.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 76 ++++++++++++++++------------------------------
 1 file changed, 26 insertions(+), 50 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static bool victim_tlb_hit(CPUArchState *env, size_t mmu_idx, size_t index,
   victim_tlb_hit(env, mmu_idx, index, offsetof(CPUTLBEntry, TY), \
                  (ADDR) & TARGET_PAGE_MASK)
 
-/*
- * Return a ram_addr_t for the virtual address for execution.
- *
- * Return -1 if we can't translate and execute from an entire page
- * of RAM.  This will force us to execute by loading and translating
- * one insn at a time, without caching.
- *
- * NOTE: This function will trigger an exception if the page is
- * not executable.
- */
-tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
-                                        void **hostp)
-{
-    uintptr_t mmu_idx = cpu_mmu_index(env, true);
-    uintptr_t index = tlb_index(env, mmu_idx, addr);
-    CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
-    void *p;
-
-    if (unlikely(!tlb_hit(entry->addr_code, addr))) {
-        if (!VICTIM_TLB_HIT(addr_code, addr)) {
-            tlb_fill(env_cpu(env), addr, 0, MMU_INST_FETCH, mmu_idx, 0);
-            index = tlb_index(env, mmu_idx, addr);
-            entry = tlb_entry(env, mmu_idx, addr);
-
-            if (unlikely(entry->addr_code & TLB_INVALID_MASK)) {
-                /*
-                 * The MMU protection covers a smaller range than a target
-                 * page, so we must redo the MMU check for every insn.
-                 */
-                return -1;
-            }
-        }
-        assert(tlb_hit(entry->addr_code, addr));
-    }
-
-    if (unlikely(entry->addr_code & TLB_MMIO)) {
-        /* The region is not backed by RAM.  */
-        if (hostp) {
-            *hostp = NULL;
-        }
-        return -1;
-    }
-
-    p = (void *)((uintptr_t)addr + entry->addend);
-    if (hostp) {
-        *hostp = p;
-    }
-    return qemu_ram_addr_from_host_nofail(p);
-}
-
 static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
                            CPUIOTLBEntry *iotlbentry, uintptr_t retaddr)
 {
@@ -XXX,XX +XXX,XX @@ void *tlb_vaddr_to_host(CPUArchState *env, abi_ptr addr,
     return flags ? NULL : host;
 }
 
+/*
+ * Return a ram_addr_t for the virtual address for execution.
+ *
+ * Return -1 if we can't translate and execute from an entire page
+ * of RAM.  This will force us to execute by loading and translating
+ * one insn at a time, without caching.
+ *
+ * NOTE: This function will trigger an exception if the page is
+ * not executable.
+ */
+tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
+                                        void **hostp)
+{
+    void *p;
+
+    (void)probe_access_internal(env, addr, 1, MMU_INST_FETCH,
+                                cpu_mmu_index(env, true), false, &p, 0);
+    if (p == NULL) {
+        return -1;
+    }
+    if (hostp) {
+        *hostp = p;
+    }
+    return qemu_ram_addr_from_host_nofail(p);
+}
+
 #ifdef CONFIG_PLUGIN
 /*
  * Perform a TLB lookup and populate the qemu_plugin_hwaddr structure.
-- 
2.34.1

It was non-obvious to me why we can raise an exception in
the middle of a comparison function, but it works.
While nearby, use TARGET_PAGE_ALIGN instead of open-coding.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static bool tb_lookup_cmp(const void *p, const void *d)
             tb_page_addr_t phys_page2;
             target_ulong virt_page2;
 
-            virt_page2 = (desc->pc & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
+            /*
+             * We know that the first page matched, and an otherwise valid TB
+             * encountered an incomplete instruction at the end of that page,
+             * therefore we know that generating a new TB from the current PC
+             * must also require reading from the next page -- even if the
+             * second pages do not match, and therefore the resulting insn
+             * is different for the new TB.  Therefore any exception raised
+             * here by the faulting lookup is not premature.
+             */
+            virt_page2 = TARGET_PAGE_ALIGN(desc->pc);
             phys_page2 = get_page_addr_code(desc->env, virt_page2);
             if (tb->page_addr[1] == phys_page2) {
                 return true;
-- 
2.34.1

The only user can easily use translator_lduw and
adjust the type to signed during the return.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/translator.h   | 1 -
 target/i386/tcg/translate.c | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/include/exec/translator.h b/include/exec/translator.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/translator.h
+++ b/include/exec/translator.h
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
 
 #define FOR_EACH_TRANSLATOR_LD(F)                                       \
     F(translator_ldub, uint8_t, cpu_ldub_code, /* no swap */)           \
-    F(translator_ldsw, int16_t, cpu_ldsw_code, bswap16)                 \
     F(translator_lduw, uint16_t, cpu_lduw_code, bswap16)                \
     F(translator_ldl, uint32_t, cpu_ldl_code, bswap32)                  \
     F(translator_ldq, uint64_t, cpu_ldq_code, bswap64)
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static inline uint8_t x86_ldub_code(CPUX86State *env, DisasContext *s)
 
 static inline int16_t x86_ldsw_code(CPUX86State *env, DisasContext *s)
 {
-    return translator_ldsw(env, &s->base, advance_pc(env, s, 2));
+    return translator_lduw(env, &s->base, advance_pc(env, s, 2));
 }
 
 static inline uint16_t x86_lduw_code(CPUX86State *env, DisasContext *s)
-- 
2.34.1

Pass these along to translator_loop -- pc may be used instead
of tb->pc, and host_pc is currently unused.  Adjust all targets
at one time.

Acked-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/exec-all.h       |  1 -
 include/exec/translator.h     | 24 ++++++++++++++++++++----
 accel/tcg/translate-all.c     |  6 ++++--
 accel/tcg/translator.c        |  9 +++++----
 target/alpha/translate.c      |  5 +++--
 target/arm/translate.c        |  5 +++--
 target/avr/translate.c        |  5 +++--
 target/cris/translate.c       |  5 +++--
 target/hexagon/translate.c    |  6 ++++--
 target/hppa/translate.c       |  5 +++--
 target/i386/tcg/translate.c   |  5 +++--
 target/loongarch/translate.c  |  6 ++++--
 target/m68k/translate.c       |  5 +++--
 target/microblaze/translate.c |  5 +++--
 target/mips/tcg/translate.c   |  5 +++--
 target/nios2/translate.c      |  5 +++--
 target/openrisc/translate.c   |  6 ++++--
 target/ppc/translate.c        |  5 +++--
 target/riscv/translate.c      |  5 +++--
 target/rx/translate.c         |  5 +++--
 target/s390x/tcg/translate.c  |  5 +++--
 target/sh4/translate.c        |  5 +++--
 target/sparc/translate.c      |  5 +++--
 target/tricore/translate.c    |  6 ++++--
 target/xtensa/translate.c     |  6 ++++--
 25 files changed, 97 insertions(+), 53 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ typedef ram_addr_t tb_page_addr_t;
 #define TB_PAGE_ADDR_FMT RAM_ADDR_FMT
 #endif
 
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns);
 void restore_state_to_opc(CPUArchState *env, TranslationBlock *tb,
                           target_ulong *data);
 
diff --git a/include/exec/translator.h b/include/exec/translator.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/translator.h
+++ b/include/exec/translator.h
@@ -XXX,XX +XXX,XX @@
 #include "exec/translate-all.h"
 #include "tcg/tcg.h"
 
+/**
+ * gen_intermediate_code
+ * @cpu: cpu context
+ * @tb: translation block
+ * @max_insns: max number of instructions to translate
+ * @pc: guest virtual program counter address
+ * @host_pc: host physical program counter address
+ *
+ * This function must be provided by the target, which should create
+ * the target-specific DisasContext, and then invoke translator_loop.
+ */
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc);
 
 /**
  * DisasJumpType:
@@ -XXX,XX +XXX,XX @@ typedef struct TranslatorOps {
 
 /**
  * translator_loop:
- * @ops: Target-specific operations.
- * @db: Disassembly context.
  * @cpu: Target vCPU.
  * @tb: Translation block.
  * @max_insns: Maximum number of insns to translate.
+ * @pc: guest virtual program counter address
+ * @host_pc: host physical program counter address
+ * @ops: Target-specific operations.
+ * @db: Disassembly context.
  *
  * Generic translator loop.
  *
@@ -XXX,XX +XXX,XX @@ typedef struct TranslatorOps {
  * - When single-stepping is enabled (system-wide or on the current vCPU).
  * - When too many instructions have been translated.
  */
-void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
-                     CPUState *cpu, TranslationBlock *tb, int max_insns);
+void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                     target_ulong pc, void *host_pc,
+                     const TranslatorOps *ops, DisasContextBase *db);
 
 void translator_loop_temp_check(DisasContextBase *db);
 
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@
 
 #include "exec/cputlb.h"
 #include "exec/translate-all.h"
+#include "exec/translator.h"
 #include "qemu/bitmap.h"
 #include "qemu/qemu-print.h"
 #include "qemu/timer.h"
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     TCGProfile *prof = &tcg_ctx->prof;
     int64_t ti;
 #endif
+    void *host_pc;
 
     assert_memory_lock();
     qemu_thread_jit_write();
 
-    phys_pc = get_page_addr_code(env, pc);
+    phys_pc = get_page_addr_code_hostp(env, pc, &host_pc);
 
     if (phys_pc == -1) {
         /* Generate a one-shot TB with 1 insn in it */
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     tcg_func_start(tcg_ctx);
 
     tcg_ctx->cpu = env_cpu(env);
-    gen_intermediate_code(cpu, tb, max_insns);
+    gen_intermediate_code(cpu, tb, max_insns, pc, host_pc);
     assert(tb->size != 0);
     tcg_ctx->cpu = NULL;
     max_insns = tb->icount;
diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translator.c
+++ b/accel/tcg/translator.c
@@ -XXX,XX +XXX,XX @@ static inline void translator_page_protect(DisasContextBase *dcbase,
 #endif
 }
 
-void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
-                     CPUState *cpu, TranslationBlock *tb, int max_insns)
+void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                     target_ulong pc, void *host_pc,
+                     const TranslatorOps *ops, DisasContextBase *db)
 {
     uint32_t cflags = tb_cflags(tb);
     bool plugin_enabled;
 
     /* Initialize DisasContext */
     db->tb = tb;
-    db->pc_first = tb->pc;
-    db->pc_next = db->pc_first;
+    db->pc_first = pc;
+    db->pc_next = pc;
     db->is_jmp = DISAS_NEXT;
     db->num_insns = 0;
     db->max_insns = max_insns;
diff --git a/target/alpha/translate.c b/target/alpha/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/translate.c
+++ b/target/alpha/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps alpha_tr_ops = {
     .disas_log          = alpha_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
-    translator_loop(&alpha_tr_ops, &dc.base, cpu, tb, max_insns);
+    translator_loop(cpu, tb, max_insns, pc, host_pc, &alpha_tr_ops, &dc.base);
 }
 
 void restore_state_to_opc(CPUAlphaState *env, TranslationBlock *tb,
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps thumb_translator_ops = {
 };
 
 /* generate intermediate code for basic block 'tb'.  */
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc = { };
     const TranslatorOps *ops = &arm_translator_ops;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
     }
 #endif
 
-    translator_loop(ops, &dc.base, cpu, tb, max_insns);
+    translator_loop(cpu, tb, max_insns, pc, host_pc, ops, &dc.base);
 }
 
 void restore_state_to_opc(CPUARMState *env, TranslationBlock *tb,
diff --git a/target/avr/translate.c b/target/avr/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/translate.c
+++ b/target/avr/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps avr_tr_ops = {
     .disas_log          = avr_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc = { };
-    translator_loop(&avr_tr_ops, &dc.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &avr_tr_ops, &dc.base);
 }
 
 void restore_state_to_opc(CPUAVRState *env, TranslationBlock *tb,
diff --git a/target/cris/translate.c b/target/cris/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/translate.c
+++ b/target/cris/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps cris_tr_ops = {
     .disas_log          = cris_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
-    translator_loop(&cris_tr_ops, &dc.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &cris_tr_ops, &dc.base);
 }
 
 void cris_cpu_dump_state(CPUState *cs, FILE *f, int flags)
diff --git a/target/hexagon/translate.c b/target/hexagon/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/translate.c
+++ b/target/hexagon/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps hexagon_tr_ops = {
     .disas_log          = hexagon_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
 
-    translator_loop(&hexagon_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc,
+                    &hexagon_tr_ops, &ctx.base);
 }
 
 #define NAME_LEN               64
diff --git a/target/hppa/translate.c b/target/hppa/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/translate.c
+++ b/target/hppa/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps hppa_tr_ops = {
     .disas_log          = hppa_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
-    translator_loop(&hppa_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &hppa_tr_ops, &ctx.base);
 }
 
 void restore_state_to_opc(CPUHPPAState *env, TranslationBlock *tb,
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps i386_tr_ops = {
 };
 
 /* generate intermediate code for basic block 'tb'.  */
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
 
-    translator_loop(&i386_tr_ops, &dc.base, cpu, tb, max_insns);
+    translator_loop(cpu, tb, max_insns, pc, host_pc, &i386_tr_ops, &dc.base);
 }
 
 void restore_state_to_opc(CPUX86State *env, TranslationBlock *tb,
diff --git a/target/loongarch/translate.c b/target/loongarch/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/translate.c
+++ b/target/loongarch/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps loongarch_tr_ops = {
     .disas_log          = loongarch_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
 
-    translator_loop(&loongarch_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc,
+                    &loongarch_tr_ops, &ctx.base);
 }
 
 void loongarch_translate_init(void)
diff --git a/target/m68k/translate.c b/target/m68k/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/translate.c
+++ b/target/m68k/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps m68k_tr_ops = {
     .disas_log          = m68k_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
-    translator_loop(&m68k_tr_ops, &dc.base, cpu, tb, max_insns);
+    translator_loop(cpu, tb, max_insns, pc, host_pc, &m68k_tr_ops, &dc.base);
 }
 
 static double floatx80_to_double(CPUM68KState *env, uint16_t high, uint64_t low)
diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps mb_tr_ops = {
     .disas_log          = mb_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
-    translator_loop(&mb_tr_ops, &dc.base, cpu, tb, max_insns);
+    translator_loop(cpu, tb, max_insns, pc, host_pc, &mb_tr_ops, &dc.base);
 }
 
 void mb_cpu_dump_state(CPUState *cs, FILE *f, int flags)
diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/translate.c
+++ b/target/mips/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps mips_tr_ops = {
     .disas_log          = mips_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
 
-    translator_loop(&mips_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &mips_tr_ops, &ctx.base);
 }
 
 void mips_tcg_init(void)
diff --git a/target/nios2/translate.c b/target/nios2/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/translate.c
+++ b/target/nios2/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps nios2_tr_ops = {
     .disas_log          = nios2_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
-    translator_loop(&nios2_tr_ops, &dc.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &nios2_tr_ops, &dc.base);
 }
 
 void nios2_cpu_dump_state(CPUState *cs, FILE *f, int flags)
diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/translate.c
+++ b/target/openrisc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps openrisc_tr_ops = {
     .disas_log          = openrisc_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
 
-    translator_loop(&openrisc_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc,
+                    &openrisc_tr_ops, &ctx.base);
 }
 
 void openrisc_cpu_dump_state(CPUState *cs, FILE *f, int flags)
diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps ppc_tr_ops = {
     .disas_log          = ppc_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
 
-    translator_loop(&ppc_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &ppc_tr_ops, &ctx.base);
 }
 
 void restore_state_to_opc(CPUPPCState *env, TranslationBlock *tb,
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps riscv_tr_ops = {
     .disas_log          = riscv_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
 
-    translator_loop(&riscv_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &riscv_tr_ops, &ctx.base);
 }
 
 void riscv_translate_init(void)
diff --git a/target/rx/translate.c b/target/rx/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/translate.c
+++ b/target/rx/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps rx_tr_ops = {
     .disas_log          = rx_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
 
-    translator_loop(&rx_tr_ops, &dc.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &rx_tr_ops, &dc.base);
 }
 
 void restore_state_to_opc(CPURXState *env, TranslationBlock *tb,
diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps s390x_tr_ops = {
     .disas_log          = s390x_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
 
-    translator_loop(&s390x_tr_ops, &dc.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &s390x_tr_ops, &dc.base);
 }
 
 void restore_state_to_opc(CPUS390XState *env, TranslationBlock *tb,
diff --git a/target/sh4/translate.c b/target/sh4/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/translate.c
+++ b/target/sh4/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps sh4_tr_ops = {
     .disas_log          = sh4_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
 
-    translator_loop(&sh4_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &sh4_tr_ops, &ctx.base);
 }
 
 void restore_state_to_opc(CPUSH4State *env, TranslationBlock *tb,
diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps sparc_tr_ops = {
     .disas_log          = sparc_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc = {};
 
-    translator_loop(&sparc_tr_ops, &dc.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &sparc_tr_ops, &dc.base);
 }
 
 void sparc_tcg_init(void)
diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps tricore_tr_ops = {
 };
 
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
-    translator_loop(&tricore_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc,
+                    &tricore_tr_ops, &ctx.base);
 }
 
 void
diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/translate.c
+++ b/target/xtensa/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps xtensa_translator_ops = {
     .disas_log          = xtensa_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc = {};
-    translator_loop(&xtensa_translator_ops, &dc.base, cpu, tb, max_insns);
+    translator_loop(cpu, tb, max_insns, pc, host_pc,
+                    &xtensa_translator_ops, &dc.base);
 }
 
 void xtensa_cpu_dump_state(CPUState *cs, FILE *f, int flags)
-- 
2.34.1

Cache the translation from guest to host address, so we may
use direct loads when we hit on the primary translation page.

Look up the second translation page only once, during translation.
This obviates another lookup of the second page within tb_gen_code
after translation.

Fixes a bug in that plugin_insn_append should be passed the bytes
in the original memory order, not bswapped by pieces.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/translator.h |  63 +++++++++++--------
 accel/tcg/translate-all.c |  23 +++----
 accel/tcg/translator.c    | 126 +++++++++++++++++++++++++++++---------
 3 files changed, 141 insertions(+), 71 deletions(-)

diff --git a/include/exec/translator.h b/include/exec/translator.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/translator.h
+++ b/include/exec/translator.h
@@ -XXX,XX +XXX,XX @@ typedef enum DisasJumpType {
  * Architecture-agnostic disassembly context.
  */
 typedef struct DisasContextBase {
-    const TranslationBlock *tb;
+    TranslationBlock *tb;
     target_ulong pc_first;
     target_ulong pc_next;
     DisasJumpType is_jmp;
     int num_insns;
     int max_insns;
     bool singlestep_enabled;
-#ifdef CONFIG_USER_ONLY
-    /*
-     * Guest address of the last byte of the last protected page.
-     *
-     * Pages containing the translated instructions are made non-writable in
-     * order to achieve consistency in case another thread is modifying the
-     * code while translate_insn() fetches the instruction bytes piecemeal.
-     * Such writer threads are blocked on mmap_lock() in page_unprotect().
-     */
-    target_ulong page_protect_end;
-#endif
+    void *host_addr[2];
 } DisasContextBase;
 
 /**
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
  * the relevant information at translation time.
  */
 
-#define GEN_TRANSLATOR_LD(fullname, type, load_fn, swap_fn)             \
-    type fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase, \
-                           abi_ptr pc, bool do_swap);                   \
-    static inline type fullname(CPUArchState *env,                      \
-                                DisasContextBase *dcbase, abi_ptr pc)   \
-    {                                                                   \
-        return fullname ## _swap(env, dcbase, pc, false);               \
+uint8_t translator_ldub(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
+uint16_t translator_lduw(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
+uint32_t translator_ldl(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
+uint64_t translator_ldq(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
+
+static inline uint16_t
+translator_lduw_swap(CPUArchState *env, DisasContextBase *db,
+                     abi_ptr pc, bool do_swap)
+{
+    uint16_t ret = translator_lduw(env, db, pc);
+    if (do_swap) {
+        ret = bswap16(ret);
     }
+    return ret;
+}
 
-#define FOR_EACH_TRANSLATOR_LD(F)                                       \
-    F(translator_ldub, uint8_t, cpu_ldub_code, /* no swap */)           \
-    F(translator_lduw, uint16_t, cpu_lduw_code, bswap16)                \
-    F(translator_ldl, uint32_t, cpu_ldl_code, bswap32)                  \
-    F(translator_ldq, uint64_t, cpu_ldq_code, bswap64)
+static inline uint32_t
+translator_ldl_swap(CPUArchState *env, DisasContextBase *db,
+                    abi_ptr pc, bool do_swap)
+{
+    uint32_t ret = translator_ldl(env, db, pc);
+    if (do_swap) {
+        ret = bswap32(ret);
+    }
+    return ret;
+}
 
-FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
-
-#undef GEN_TRANSLATOR_LD
+static inline uint64_t
+translator_ldq_swap(CPUArchState *env, DisasContextBase *db,
+                    abi_ptr pc, bool do_swap)
+{
+    uint64_t ret = translator_ldq_swap(env, db, pc, false);
+    if (do_swap) {
+        ret = bswap64(ret);
+    }
+    return ret;
+}
 
 /*
  * Return whether addr is on the same page as where disassembly started.
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
 {
     CPUArchState *env = cpu->env_ptr;
     TranslationBlock *tb, *existing_tb;
-    tb_page_addr_t phys_pc, phys_page2;
-    target_ulong virt_page2;
+    tb_page_addr_t phys_pc;
     tcg_insn_unit *gen_code_buf;
     int gen_code_size, search_size, max_insns;
 #ifdef CONFIG_PROFILER
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     tb->flags = flags;
     tb->cflags = cflags;
     tb->trace_vcpu_dstate = *cpu->trace_dstate;
+    tb->page_addr[0] = phys_pc;
+    tb->page_addr[1] = -1;
     tcg_ctx->tb_cflags = cflags;
  tb_overflow:
 
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     }
 
     /*
-     * If the TB is not associated with a physical RAM page then
-     * it must be a temporary one-insn TB, and we have nothing to do
-     * except fill in the page_addr[] fields. Return early before
-     * attempting to link to other TBs or add to the lookup table.
+     * If the TB is not associated with a physical RAM page then it must be
+     * a temporary one-insn TB, and we have nothing left to do. Return early
+     * before attempting to link to other TBs or add to the lookup table.
      */
-    if (phys_pc == -1) {
-        tb->page_addr[0] = tb->page_addr[1] = -1;
+    if (tb->page_addr[0] == -1) {
         return tb;
     }
 
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
      */
     tcg_tb_insert(tb);
 
-    /* check next page if needed */
-    virt_page2 = (pc + tb->size - 1) & TARGET_PAGE_MASK;
-    phys_page2 = -1;
-    if ((pc & TARGET_PAGE_MASK) != virt_page2) {
-        phys_page2 = get_page_addr_code(env, virt_page2);
-    }
     /*
      * No explicit memory barrier is required -- tb_link_page() makes the
      * TB visible in a consistent state.
      */
-    existing_tb = tb_link_page(tb, phys_pc, phys_page2);
+    existing_tb = tb_link_page(tb, tb->page_addr[0], tb->page_addr[1]);
     /* if the TB already exists, discard what we just translated */
     if (unlikely(existing_tb != tb)) {
         uintptr_t orig_aligned = (uintptr_t)gen_code_buf;
diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translator.c
+++ b/accel/tcg/translator.c
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest)
     return ((db->pc_first ^ dest) & TARGET_PAGE_MASK) == 0;
 }
 
-static inline void translator_page_protect(DisasContextBase *dcbase,
-                                           target_ulong pc)
-{
-#ifdef CONFIG_USER_ONLY
-    dcbase->page_protect_end = pc | ~TARGET_PAGE_MASK;
-    page_protect(pc);
-#endif
-}
-
 void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
                      target_ulong pc, void *host_pc,
                      const TranslatorOps *ops, DisasContextBase *db)
@@ -XXX,XX +XXX,XX @@ void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
     db->num_insns = 0;
     db->max_insns = max_insns;
     db->singlestep_enabled = cflags & CF_SINGLE_STEP;
-    translator_page_protect(db, db->pc_next);
+    db->host_addr[0] = host_pc;
+    db->host_addr[1] = NULL;
+
+#ifdef CONFIG_USER_ONLY
+    page_protect(pc);
+#endif
 
     ops->init_disas_context(db, cpu);
     tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
@@ -XXX,XX +XXX,XX @@ void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
 #endif
 }
 
-static inline void translator_maybe_page_protect(DisasContextBase *dcbase,
-                                                 target_ulong pc, size_t len)
+static void *translator_access(CPUArchState *env, DisasContextBase *db,
+                               target_ulong pc, size_t len)
 {
-#ifdef CONFIG_USER_ONLY
-    target_ulong end = pc + len - 1;
+    void *host;
+    target_ulong base, end;
+    TranslationBlock *tb;
 
-    if (end > dcbase->page_protect_end) {
-        translator_page_protect(dcbase, end);
+    tb = db->tb;
+
+    /* Use slow path if first page is MMIO. */
+    if (unlikely(tb->page_addr[0] == -1)) {
+        return NULL;
     }
+
+    end = pc + len - 1;
+    if (likely(is_same_page(db, end))) {
+        host = db->host_addr[0];
+        base = db->pc_first;
+    } else {
+        host = db->host_addr[1];
+        base = TARGET_PAGE_ALIGN(db->pc_first);
+        if (host == NULL) {
+            tb->page_addr[1] =
+                get_page_addr_code_hostp(env, base, &db->host_addr[1]);
+#ifdef CONFIG_USER_ONLY
+            page_protect(end);
 #endif
+            /* We cannot handle MMIO as second page. */
+            assert(tb->page_addr[1] != -1);
+            host = db->host_addr[1];
+        }
+
+        /* Use slow path when crossing pages. */
+        if (is_same_page(db, pc)) {
+            return NULL;
+        }
+    }
+
+    tcg_debug_assert(pc >= base);
+    return host + (pc - base);
 }
 
-#define GEN_TRANSLATOR_LD(fullname, type, load_fn, swap_fn)             \
-    type fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase, \
-                           abi_ptr pc, bool do_swap)                    \
-    {                                                                   \
-        translator_maybe_page_protect(dcbase, pc, sizeof(type));        \
-        type ret = load_fn(env, pc);                                    \
-        if (do_swap) {                                                  \
-            ret = swap_fn(ret);                                         \
-        }                                                               \
-        plugin_insn_append(pc, &ret, sizeof(ret));                      \
-        return ret;                                                     \
+uint8_t translator_ldub(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
+{
+    uint8_t ret;
+    void *p = translator_access(env, db, pc, sizeof(ret));
+
+    if (p) {
+        plugin_insn_append(pc, p, sizeof(ret));
+        return ldub_p(p);
     }
+    ret = cpu_ldub_code(env, pc);
+    plugin_insn_append(pc, &ret, sizeof(ret));
+    return ret;
+}
 
-FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
+uint16_t translator_lduw(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
+{
+    uint16_t ret, plug;
+    void *p = translator_access(env, db, pc, sizeof(ret));
 
-#undef GEN_TRANSLATOR_LD
+    if (p) {
+        plugin_insn_append(pc, p, sizeof(ret));
+        return lduw_p(p);
+    }
+    ret = cpu_lduw_code(env, pc);
+    plug = tswap16(ret);
+    plugin_insn_append(pc, &plug, sizeof(ret));
+    return ret;
+}
+
+uint32_t translator_ldl(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
+{
+    uint32_t ret, plug;
+    void *p = translator_access(env, db, pc, sizeof(ret));
+
+    if (p) {
+        plugin_insn_append(pc, p, sizeof(ret));
+        return ldl_p(p);
+    }
+    ret = cpu_ldl_code(env, pc);
+    plug = tswap32(ret);
+    plugin_insn_append(pc, &plug, sizeof(ret));
+    return ret;
+}
+
+uint64_t translator_ldq(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
+{
+    uint64_t ret, plug;
+    void *p = translator_access(env, db, pc, sizeof(ret));
+
+    if (p) {
+        plugin_insn_append(pc, p, sizeof(ret));
+        return ldq_p(p);
+    }
+    ret = cpu_ldq_code(env, pc);
+    plug = tswap64(ret);
+    plugin_insn_append(pc, &plug, sizeof(ret));
+    return ret;
+}
-- 
2.34.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

Right now translator stops right *after* the end of a page, which
breaks reporting of fault locations when the last instruction of a
multi-insn translation block crosses a page boundary.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220817150506.592862-3-iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/s390x/tcg/translate.c     |  15 +++-
 tests/tcg/s390x/noexec.c         | 106 +++++++++++++++++++++++
 tests/tcg/multiarch/noexec.c.inc | 139 +++++++++++++++++++++++++++++++
 tests/tcg/s390x/Makefile.target  |   1 +
 4 files changed, 257 insertions(+), 4 deletions(-)
 create mode 100644 tests/tcg/s390x/noexec.c
 create mode 100644 tests/tcg/multiarch/noexec.c.inc

diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static void s390x_tr_insn_start(DisasContextBase *dcbase, CPUState *cs)
     dc->insn_start = tcg_last_op();
 }
 
+static target_ulong get_next_pc(CPUS390XState *env, DisasContext *s,
+                                uint64_t pc)
+{
+    uint64_t insn = ld_code2(env, s, pc);
+
+    return pc + get_ilen((insn >> 8) & 0xff);
+}
+
 static void s390x_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
 {
     CPUS390XState *env = cs->env_ptr;
@@ -XXX,XX +XXX,XX @@ static void s390x_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
 
     dc->base.is_jmp = translate_one(env, dc);
     if (dc->base.is_jmp == DISAS_NEXT) {
-        uint64_t page_start;
-
-        page_start = dc->base.pc_first & TARGET_PAGE_MASK;
-        if (dc->base.pc_next - page_start >= TARGET_PAGE_SIZE || dc->ex_value) {
+        if (!is_same_page(dcbase, dc->base.pc_next) ||
+            !is_same_page(dcbase, get_next_pc(env, dc, dc->base.pc_next)) ||
+            dc->ex_value) {
             dc->base.is_jmp = DISAS_TOO_MANY;
         }
     }
diff --git a/tests/tcg/s390x/noexec.c b/tests/tcg/s390x/noexec.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/s390x/noexec.c
@@ -XXX,XX +XXX,XX @@
+#include "../multiarch/noexec.c.inc"
+
+static void *arch_mcontext_pc(const mcontext_t *ctx)
+{
+    return (void *)ctx->psw.addr;
+}
+
+static int arch_mcontext_arg(const mcontext_t *ctx)
+{
+    return ctx->gregs[2];
+}
+
+static void arch_flush(void *p, int len)
+{
+}
+
+extern char noexec_1[];
+extern char noexec_2[];
+extern char noexec_end[];
+
+asm("noexec_1:\n"
+    "   lgfi %r2,1\n"       /* %r2 is 0 on entry, set 1. */
+    "noexec_2:\n"
+    "   lgfi %r2,2\n"       /* %r2 is 0/1; set 2. */
+    "   br %r14\n"          /* return */
+    "noexec_end:");
+
+extern char exrl_1[];
+extern char exrl_2[];
+extern char exrl_end[];
+
+asm("exrl_1:\n"
+    "   exrl %r0, exrl_2\n"
+    "   br %r14\n"
+    "exrl_2:\n"
+    "   lgfi %r2,2\n"
+    "exrl_end:");
+
+int main(void)
+{
+    struct noexec_test noexec_tests[] = {
+        {
+            .name = "fallthrough",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2,
+            .entry_ofs = noexec_1 - noexec_2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = 0,
+            .expected_arg = 1,
+        },
+        {
+            .name = "jump",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2,
+            .entry_ofs = 0,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = 0,
+            .expected_arg = 0,
+        },
+        {
+            .name = "exrl",
+            .test_code = exrl_1,
+            .test_len = exrl_end - exrl_1,
+            .page_ofs = exrl_1 - exrl_2,
+            .entry_ofs = exrl_1 - exrl_2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = exrl_1 - exrl_2,
+            .expected_arg = 0,
+        },
+        {
+            .name = "fallthrough [cross]",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2 - 2,
+            .entry_ofs = noexec_1 - noexec_2 - 2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = -2,
+            .expected_arg = 1,
+        },
+        {
+            .name = "jump [cross]",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2 - 2,
+            .entry_ofs = -2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = -2,
+            .expected_arg = 0,
+        },
+        {
+            .name = "exrl [cross]",
+            .test_code = exrl_1,
+            .test_len = exrl_end - exrl_1,
+            .page_ofs = exrl_1 - exrl_2 - 2,
+            .entry_ofs = exrl_1 - exrl_2 - 2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = exrl_1 - exrl_2 - 2,
+            .expected_arg = 0,
+        },
+    };
+
+    return test_noexec(noexec_tests,
+                       sizeof(noexec_tests) / sizeof(noexec_tests[0]));
+}
diff --git a/tests/tcg/multiarch/noexec.c.inc b/tests/tcg/multiarch/noexec.c.inc
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/multiarch/noexec.c.inc
@@ -XXX,XX +XXX,XX @@
+/*
+ * Common code for arch-specific MMU_INST_FETCH fault testing.
+ */
+
+#define _GNU_SOURCE
+
+#include <assert.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <unistd.h>
+#include <sys/mman.h>
+#include <sys/ucontext.h>
+
+/* Forward declarations. */
+
+static void *arch_mcontext_pc(const mcontext_t *ctx);
+static int arch_mcontext_arg(const mcontext_t *ctx);
+static void arch_flush(void *p, int len);
+
+/* Testing infrastructure. */
+
+struct noexec_test {
+    const char *name;
+    const char *test_code;
+    int test_len;
+    int page_ofs;
+    int entry_ofs;
+    int expected_si_ofs;
+    int expected_pc_ofs;
+    int expected_arg;
+};
+
+static void *page_base;
+static int page_size;
+static const struct noexec_test *current_noexec_test;
+
+static void handle_err(const char *syscall)
+{
+    printf("[  FAILED  ] %s: %s\n", syscall, strerror(errno));
+    exit(EXIT_FAILURE);
+}
+
+static void handle_segv(int sig, siginfo_t *info, void *ucontext)
+{
+    const struct noexec_test *test = current_noexec_test;
+    const mcontext_t *mc = &((ucontext_t *)ucontext)->uc_mcontext;
+    void *expected_si;
+    void *expected_pc;
+    void *pc;
+    int arg;
+
+    if (test == NULL) {
+        printf("[  FAILED  ] unexpected SEGV\n");
+        exit(EXIT_FAILURE);
+    }
+    current_noexec_test = NULL;
+
+    expected_si = page_base + test->expected_si_ofs;
+    if (info->si_addr != expected_si) {
+        printf("[  FAILED  ] wrong si_addr (%p != %p)\n",
+               info->si_addr, expected_si);
+        exit(EXIT_FAILURE);
+    }
+
+    pc = arch_mcontext_pc(mc);
+    expected_pc = page_base + test->expected_pc_ofs;
+    if (pc != expected_pc) {
+        printf("[  FAILED  ] wrong pc (%p != %p)\n", pc, expected_pc);
+        exit(EXIT_FAILURE);
+    }
+
+    arg = arch_mcontext_arg(mc);
+    if (arg != test->expected_arg) {
+        printf("[  FAILED  ] wrong arg (%d != %d)\n", arg, test->expected_arg);
+        exit(EXIT_FAILURE);
+    }
+
+    if (mprotect(page_base, page_size,
+                 PROT_READ | PROT_WRITE | PROT_EXEC) < 0) {
+        handle_err("mprotect");
+    }
+}
+
+static void test_noexec_1(const struct noexec_test *test)
+{
+    void *start = page_base + test->page_ofs;
+    void (*fn)(int arg) = page_base + test->entry_ofs;
+
+    memcpy(start, test->test_code, test->test_len);
+    arch_flush(start, test->test_len);
+
+    /* Trigger TB creation in order to test invalidation. */
+    fn(0);
+
+    if (mprotect(page_base, page_size, PROT_NONE) < 0) {
+        handle_err("mprotect");
+    }
+
+    /* Trigger SEGV and check that handle_segv() ran. */
+    current_noexec_test = test;
+    fn(0);
+    assert(current_noexec_test == NULL);
+}
+
+static int test_noexec(struct noexec_test *tests, size_t n_tests)
+{
+    struct sigaction act;
+    size_t i;
+
+    memset(&act, 0, sizeof(act));
+    act.sa_sigaction = handle_segv;
+    act.sa_flags = SA_SIGINFO;
+    if (sigaction(SIGSEGV, &act, NULL) < 0) {
+        handle_err("sigaction");
+    }
+
+    page_size = getpagesize();
+    page_base = mmap(NULL, 2 * page_size,
+                     PROT_READ | PROT_WRITE | PROT_EXEC,
+                     MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
+    if (page_base == MAP_FAILED) {
+        handle_err("mmap");
+    }
+    page_base += page_size;
+
+    for (i = 0; i < n_tests; i++) {
+        struct noexec_test *test = &tests[i];
+
+        printf("[ RUN      ] %s\n", test->name);
+        test_noexec_1(test);
+        printf("[       OK ]\n");
+    }
+
+    printf("[  PASSED  ]\n");
+    return EXIT_SUCCESS;
+}
diff --git a/tests/tcg/s390x/Makefile.target b/tests/tcg/s390x/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/s390x/Makefile.target
+++ b/tests/tcg/s390x/Makefile.target
@@ -XXX,XX +XXX,XX @@ TESTS+=shift
 TESTS+=trap
 TESTS+=signals-s390x
 TESTS+=branch-relative-long
+TESTS+=noexec
 
 Z14_TESTS=vfminmax
 vfminmax: LDFLAGS+=-lm
-- 
2.34.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

Right now translator stops right *after* the end of a page, which
breaks reporting of fault locations when the last instruction of a
multi-insn translation block crosses a page boundary.

An implementation, like the one arm and s390x have, would require an
i386 length disassembler, which is burdensome to maintain. Another
alternative would be to single-step at the end of a guest page, but
this may come with a performance impact.

Fix by snapshotting disassembly state and restoring it after we figure
out we crossed a page boundary. This includes rolling back cc_op
updates and emitted ops.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1143
Message-Id: <20220817150506.592862-4-iii@linux.ibm.com>
[rth: Simplify end-of-insn cross-page checks.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/i386/tcg/translate.c      | 64 ++++++++++++++++-----------
 tests/tcg/x86_64/noexec.c        | 75 ++++++++++++++++++++++++++++++++
 tests/tcg/x86_64/Makefile.target |  3 +-
 3 files changed, 116 insertions(+), 26 deletions(-)
 create mode 100644 tests/tcg/x86_64/noexec.c

diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     TCGv_i64 tmp1_i64;
 
     sigjmp_buf jmpbuf;
+    TCGOp *prev_insn_end;
 } DisasContext;
 
 /* The environment in which user-only runs is constrained. */
@@ -XXX,XX +XXX,XX @@ static uint64_t advance_pc(CPUX86State *env, DisasContext *s, int num_bytes)
 {
     uint64_t pc = s->pc;
 
+    /* This is a subsequent insn that crosses a page boundary.  */
+    if (s->base.num_insns > 1 &&
+        !is_same_page(&s->base, s->pc + num_bytes - 1)) {
+        siglongjmp(s->jmpbuf, 2);
+    }
+
     s->pc += num_bytes;
     if (unlikely(s->pc - s->pc_start > X86_MAX_INSN_LENGTH)) {
         /* If the instruction's 16th byte is on a different page than the 1st, a
@@ -XXX,XX +XXX,XX @@ static target_ulong disas_insn(DisasContext *s, CPUState *cpu)
     int modrm, reg, rm, mod, op, opreg, val;
     target_ulong next_eip, tval;
     target_ulong pc_start = s->base.pc_next;
+    bool orig_cc_op_dirty = s->cc_op_dirty;
+    CCOp orig_cc_op = s->cc_op;
 
     s->pc_start = s->pc = pc_start;
     s->override = -1;
@@ -XXX,XX +XXX,XX @@ static target_ulong disas_insn(DisasContext *s, CPUState *cpu)
     s->rip_offset = 0; /* for relative ip address */
     s->vex_l = 0;
     s->vex_v = 0;
-    if (sigsetjmp(s->jmpbuf, 0) != 0) {
+    switch (sigsetjmp(s->jmpbuf, 0)) {
+    case 0:
+        break;
+    case 1:
         gen_exception_gpf(s);
         return s->pc;
+    case 2:
+        /* Restore state that may affect the next instruction. */
+        s->cc_op_dirty = orig_cc_op_dirty;
+        s->cc_op = orig_cc_op;
+        s->base.num_insns--;
+        tcg_remove_ops_after(s->prev_insn_end);
+        s->base.is_jmp = DISAS_TOO_MANY;
+        return pc_start;
+    default:
+        g_assert_not_reached();
     }
 
     prefixes = 0;
@@ -XXX,XX +XXX,XX @@ static void i386_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu)
 {
     DisasContext *dc = container_of(dcbase, DisasContext, base);
 
+    dc->prev_insn_end = tcg_last_op();
     tcg_gen_insn_start(dc->base.pc_next, dc->cc_op);
 }
 
@@ -XXX,XX +XXX,XX @@ static void i386_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
 #endif
 
     pc_next = disas_insn(dc, cpu);
-
-    if (dc->flags & (HF_TF_MASK | HF_INHIBIT_IRQ_MASK)) {
-        /* if single step mode, we generate only one instruction and
-           generate an exception */
-        /* if irq were inhibited with HF_INHIBIT_IRQ_MASK, we clear
-           the flag and abort the translation to give the irqs a
-           chance to happen */
-        dc->base.is_jmp = DISAS_TOO_MANY;
-    } else if ((tb_cflags(dc->base.tb) & CF_USE_ICOUNT)
-               && ((pc_next & TARGET_PAGE_MASK)
-                   != ((pc_next + TARGET_MAX_INSN_SIZE - 1)
-                       & TARGET_PAGE_MASK)
-                   || (pc_next & ~TARGET_PAGE_MASK) == 0)) {
-        /* Do not cross the boundary of the pages in icount mode,
-           it can cause an exception. Do it only when boundary is
-           crossed by the first instruction in the block.
-           If current instruction already crossed the bound - it's ok,
-           because an exception hasn't stopped this code.
-         */
-        dc->base.is_jmp = DISAS_TOO_MANY;
-    } else if ((pc_next - dc->base.pc_first) >= (TARGET_PAGE_SIZE - 32)) {
-        dc->base.is_jmp = DISAS_TOO_MANY;
-    }
-
     dc->base.pc_next = pc_next;
+
+    if (dc->base.is_jmp == DISAS_NEXT) {
+        if (dc->flags & (HF_TF_MASK | HF_INHIBIT_IRQ_MASK)) {
+            /*
+             * If single step mode, we generate only one instruction and
+             * generate an exception.
+             * If irq were inhibited with HF_INHIBIT_IRQ_MASK, we clear
+             * the flag and abort the translation to give the irqs a
+             * chance to happen.
+             */
+            dc->base.is_jmp = DISAS_TOO_MANY;
+        } else if (!is_same_page(&dc->base, pc_next)) {
+            dc->base.is_jmp = DISAS_TOO_MANY;
+        }
+    }
 }
 
 static void i386_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
diff --git a/tests/tcg/x86_64/noexec.c b/tests/tcg/x86_64/noexec.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/x86_64/noexec.c
@@ -XXX,XX +XXX,XX @@
+#include "../multiarch/noexec.c.inc"
+
+static void *arch_mcontext_pc(const mcontext_t *ctx)
+{
+    return (void *)ctx->gregs[REG_RIP];
+}
+
+int arch_mcontext_arg(const mcontext_t *ctx)
+{
+    return ctx->gregs[REG_RDI];
+}
+
+static void arch_flush(void *p, int len)
+{
+}
+
+extern char noexec_1[];
+extern char noexec_2[];
+extern char noexec_end[];
+
+asm("noexec_1:\n"
+    "    movq $1,%rdi\n"    /* %rdi is 0 on entry, set 1. */
+    "noexec_2:\n"
+    "    movq $2,%rdi\n"    /* %rdi is 0/1; set 2. */
+    "    ret\n"
+    "noexec_end:");
+
+int main(void)
+{
+    struct noexec_test noexec_tests[] = {
+        {
+            .name = "fallthrough",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2,
+            .entry_ofs = noexec_1 - noexec_2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = 0,
+            .expected_arg = 1,
+        },
+        {
+            .name = "jump",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2,
+            .entry_ofs = 0,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = 0,
+            .expected_arg = 0,
+        },
+        {
+            .name = "fallthrough [cross]",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2 - 2,
+            .entry_ofs = noexec_1 - noexec_2 - 2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = -2,
+            .expected_arg = 1,
+        },
+        {
+            .name = "jump [cross]",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2 - 2,
+            .entry_ofs = -2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = -2,
+            .expected_arg = 0,
+        },
+    };
+
+    return test_noexec(noexec_tests,
+                       sizeof(noexec_tests) / sizeof(noexec_tests[0]));
+}
diff --git a/tests/tcg/x86_64/Makefile.target b/tests/tcg/x86_64/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/x86_64/Makefile.target
+++ b/tests/tcg/x86_64/Makefile.target
@@ -XXX,XX +XXX,XX @@ include $(SRC_PATH)/tests/tcg/i386/Makefile.target
 
 ifeq ($(filter %-linux-user, $(TARGET)),$(TARGET))
 X86_64_TESTS += vsyscall
+X86_64_TESTS += noexec
 TESTS=$(MULTIARCH_TESTS) $(X86_64_TESTS) test-x86_64
 else
 TESTS=$(MULTIARCH_TESTS)
@@ -XXX,XX +XXX,XX @@ test-x86_64: LDFLAGS+=-lm -lc
 test-x86_64: test-i386.c test-i386.h test-i386-shift.h test-i386-muldiv.h
 	$(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
 
-vsyscall: $(SRC_PATH)/tests/tcg/x86_64/vsyscall.c
+%: $(SRC_PATH)/tests/tcg/x86_64/%.c
 	$(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
-- 
2.34.1

These will be useful in properly ending the TB.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/riscv/translate.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
 /* Include decoders for factored-out extensions */
 #include "decode-XVentanaCondOps.c.inc"
 
+/* The specification allows for longer insns, but not supported by qemu. */
+#define MAX_INSN_LEN  4
+
+static inline int insn_len(uint16_t first_word)
+{
+    return (first_word & 3) == 3 ? 4 : 2;
+}
+
 static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
 {
     /*
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
     };
 
     /* Check for compressed insn */
-    if (extract16(opcode, 0, 2) != 3) {
+    if (insn_len(opcode) == 2) {
         if (!has_ext(ctx, RVC)) {
             gen_exception_illegal(ctx);
         } else {
-- 
2.34.1

Right now the translator stops right *after* the end of a page, which
breaks reporting of fault locations when the last instruction of a
multi-insn translation block crosses a page boundary.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1155
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/riscv/translate.c          | 17 +++++--
 tests/tcg/riscv64/noexec.c        | 79 +++++++++++++++++++++++++++++++
 tests/tcg/riscv64/Makefile.target |  1 +
 3 files changed, 93 insertions(+), 4 deletions(-)
 create mode 100644 tests/tcg/riscv64/noexec.c

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
     }
     ctx->nftemp = 0;
 
+    /* Only the first insn within a TB is allowed to cross a page boundary. */
     if (ctx->base.is_jmp == DISAS_NEXT) {
-        target_ulong page_start;
-
-        page_start = ctx->base.pc_first & TARGET_PAGE_MASK;
-        if (ctx->base.pc_next - page_start >= TARGET_PAGE_SIZE) {
+        if (!is_same_page(&ctx->base, ctx->base.pc_next)) {
             ctx->base.is_jmp = DISAS_TOO_MANY;
+        } else {
+            unsigned page_ofs = ctx->base.pc_next & ~TARGET_PAGE_MASK;
+
+            if (page_ofs > TARGET_PAGE_SIZE - MAX_INSN_LEN) {
+                uint16_t next_insn = cpu_lduw_code(env, ctx->base.pc_next);
+                int len = insn_len(next_insn);
+
+                if (!is_same_page(&ctx->base, ctx->base.pc_next + len)) {
+                    ctx->base.is_jmp = DISAS_TOO_MANY;
+                }
+            }
         }
     }
 }
diff --git a/tests/tcg/riscv64/noexec.c b/tests/tcg/riscv64/noexec.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/riscv64/noexec.c
@@ -XXX,XX +XXX,XX @@
+#include "../multiarch/noexec.c.inc"
+
+static void *arch_mcontext_pc(const mcontext_t *ctx)
+{
+    return (void *)ctx->__gregs[REG_PC];
+}
+
+static int arch_mcontext_arg(const mcontext_t *ctx)
+{
+    return ctx->__gregs[REG_A0];
+}
+
+static void arch_flush(void *p, int len)
+{
+    __builtin___clear_cache(p, p + len);
+}
+
+extern char noexec_1[];
+extern char noexec_2[];
+extern char noexec_end[];
+
+asm(".option push\n"
+    ".option norvc\n"
+    "noexec_1:\n"
+    "   li a0,1\n"       /* a0 is 0 on entry, set 1. */
+    "noexec_2:\n"
+    "   li a0,2\n"      /* a0 is 0/1; set 2. */
+    "   ret\n"
+    "noexec_end:\n"
+    ".option pop");
+
+int main(void)
+{
+    struct noexec_test noexec_tests[] = {
+        {
+            .name = "fallthrough",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2,
+            .entry_ofs = noexec_1 - noexec_2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = 0,
+            .expected_arg = 1,
+        },
+        {
+            .name = "jump",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2,
+            .entry_ofs = 0,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = 0,
+            .expected_arg = 0,
+        },
+        {
+            .name = "fallthrough [cross]",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2 - 2,
+            .entry_ofs = noexec_1 - noexec_2 - 2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = -2,
+            .expected_arg = 1,
+        },
+        {
+            .name = "jump [cross]",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2 - 2,
+            .entry_ofs = -2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = -2,
+            .expected_arg = 0,
+        },
+    };
+
+    return test_noexec(noexec_tests,
+                       sizeof(noexec_tests) / sizeof(noexec_tests[0]));
+}
diff --git a/tests/tcg/riscv64/Makefile.target b/tests/tcg/riscv64/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/riscv64/Makefile.target
+++ b/tests/tcg/riscv64/Makefile.target
@@ -XXX,XX +XXX,XX @@
 
 VPATH += $(SRC_PATH)/tests/tcg/riscv64
 TESTS += test-div
+TESTS += noexec
-- 
2.34.1

The following changes since commit 75d30fde55485b965a1168a21d016dd07b50ed32:

Merge tag 'block-pull-request' of https://gitlab.com/stefanha/qemu into staging (2022-10-30 15:07:25 -0400)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20221031

for you to fetch changes up to cb375590983fc3d23600d02ba05a05d34fe44150:

target/i386: Expand eflags updates inline (2022-10-31 11:39:10 +1100)

----------------------------------------------------------------
Remove sparc32plus support from tcg/sparc.
target/i386: Use cpu_unwind_state_data for tpr access.
target/i386: Expand eflags updates inline

----------------------------------------------------------------
Icenowy Zheng (1):
      tcg/tci: fix logic error when registering helpers via FFI

Richard Henderson (10):
      tcg/sparc: Remove support for sparc32plus
      tcg/sparc64: Rename from tcg/sparc
      tcg/sparc64: Remove sparc32plus constraints
      accel/tcg: Introduce cpu_unwind_state_data
      target/i386: Use cpu_unwind_state_data for tpr access
      target/openrisc: Always exit after mtspr npc
      target/openrisc: Use cpu_unwind_state_data for mfspr
      accel/tcg: Remove will_exit argument from cpu_restore_state
      accel/tcg: Remove reset_icount argument from cpu_restore_state_from_tb
      target/i386: Expand eflags updates inline

meson.build                                 |   4 +-
 accel/tcg/internal.h                        |   4 +-
 include/exec/exec-all.h                     |  24 ++-
 target/i386/helper.h                        |   5 -
 tcg/{sparc => sparc64}/tcg-target-con-set.h |  16 +-
 tcg/{sparc => sparc64}/tcg-target-con-str.h |   3 -
 tcg/{sparc => sparc64}/tcg-target.h         |  11 --
 accel/tcg/cpu-exec-common.c                 |   2 +-
 accel/tcg/tb-maint.c                        |   4 +-
 accel/tcg/translate-all.c                   |  91 +++++----
 target/alpha/helper.c                       |   2 +-
 target/alpha/mem_helper.c                   |   2 +-
 target/arm/op_helper.c                      |   2 +-
 target/arm/tlb_helper.c                     |   8 +-
 target/cris/helper.c                        |   2 +-
 target/i386/helper.c                        |  21 ++-
 target/i386/tcg/cc_helper.c                 |  41 -----
 target/i386/tcg/sysemu/svm_helper.c         |   2 +-
 target/i386/tcg/translate.c                 |  30 ++-
 target/m68k/op_helper.c                     |   4 +-
 target/microblaze/helper.c                  |   2 +-
 target/nios2/op_helper.c                    |   2 +-
 target/openrisc/sys_helper.c                |  17 +-
 target/ppc/excp_helper.c                    |   2 +-
 target/s390x/tcg/excp_helper.c              |   2 +-
 target/tricore/op_helper.c                  |   2 +-
 target/xtensa/helper.c                      |   6 +-
 tcg/tcg.c                                   |  81 +-------
 tcg/{sparc => sparc64}/tcg-target.c.inc     | 275 ++++++++--------------------
 MAINTAINERS                                 |   2 +-
 30 files changed, 232 insertions(+), 437 deletions(-)
 rename tcg/{sparc => sparc64}/tcg-target-con-set.h (69%)
 rename tcg/{sparc => sparc64}/tcg-target-con-str.h (77%)
 rename tcg/{sparc => sparc64}/tcg-target.h (95%)
 rename tcg/{sparc => sparc64}/tcg-target.c.inc (91%)

Since 9b9c37c36439, we have only supported sparc64 cpus.
Debian and Gentoo now only support 64-bit sparc64 userland,
so it is time to drop the 32-bit sparc64 userland: sparc32plus.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/sparc/tcg-target.h     |  11 ---
 tcg/tcg.c                  |  75 +----------------
 tcg/sparc/tcg-target.c.inc | 166 +++++++------------------------------
 3 files changed, 33 insertions(+), 219 deletions(-)

diff --git a/tcg/sparc/tcg-target.h b/tcg/sparc/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc/tcg-target.h
+++ b/tcg/sparc/tcg-target.h
@@ -XXX,XX +XXX,XX @@
 #ifndef SPARC_TCG_TARGET_H
 #define SPARC_TCG_TARGET_H
 
-#define TCG_TARGET_REG_BITS 64
-
 #define TCG_TARGET_INSN_UNIT_SIZE 4
 #define TCG_TARGET_TLB_DISPLACEMENT_BITS 32
 #define TCG_TARGET_NB_REGS 32
@@ -XXX,XX +XXX,XX @@ typedef enum {
 /* used for function call generation */
 #define TCG_REG_CALL_STACK TCG_REG_O6
 
-#ifdef __arch64__
 #define TCG_TARGET_STACK_BIAS           2047
 #define TCG_TARGET_STACK_ALIGN          16
 #define TCG_TARGET_CALL_STACK_OFFSET    (128 + 6*8 + TCG_TARGET_STACK_BIAS)
-#else
-#define TCG_TARGET_STACK_BIAS           0
-#define TCG_TARGET_STACK_ALIGN          8
-#define TCG_TARGET_CALL_STACK_OFFSET    (64 + 4 + 6*4)
-#endif
-
-#ifdef __arch64__
 #define TCG_TARGET_EXTEND_ARGS 1
-#endif
 
 #if defined(__VIS__) && __VIS__ >= 0x300
 #define use_vis3_instructions  1
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args)
     }
 #endif
 
-#if defined(__sparc__) && !defined(__arch64__) \
-    && !defined(CONFIG_TCG_INTERPRETER)
-    /* We have 64-bit values in one register, but need to pass as two
-       separate parameters.  Split them.  */
-    int orig_typemask = typemask;
-    int orig_nargs = nargs;
-    TCGv_i64 retl, reth;
-    TCGTemp *split_args[MAX_OPC_PARAM];
-
-    retl = NULL;
-    reth = NULL;
-    typemask = 0;
-    for (i = real_args = 0; i < nargs; ++i) {
-        int argtype = extract32(orig_typemask, (i + 1) * 3, 3);
-        bool is_64bit = (argtype & ~1) == dh_typecode_i64;
-
-        if (is_64bit) {
-            TCGv_i64 orig = temp_tcgv_i64(args[i]);
-            TCGv_i32 h = tcg_temp_new_i32();
-            TCGv_i32 l = tcg_temp_new_i32();
-            tcg_gen_extr_i64_i32(l, h, orig);
-            split_args[real_args++] = tcgv_i32_temp(h);
-            typemask |= dh_typecode_i32 << (real_args * 3);
-            split_args[real_args++] = tcgv_i32_temp(l);
-            typemask |= dh_typecode_i32 << (real_args * 3);
-        } else {
-            split_args[real_args++] = args[i];
-            typemask |= argtype << (real_args * 3);
-        }
-    }
-    nargs = real_args;
-    args = split_args;
-#elif defined(TCG_TARGET_EXTEND_ARGS) && TCG_TARGET_REG_BITS == 64
+#if defined(TCG_TARGET_EXTEND_ARGS) && TCG_TARGET_REG_BITS == 64
     for (i = 0; i < nargs; ++i) {
         int argtype = extract32(typemask, (i + 1) * 3, 3);
         bool is_32bit = (argtype & ~1) == dh_typecode_i32;
@@ -XXX,XX +XXX,XX @@ void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args)
 
     pi = 0;
     if (ret != NULL) {
-#if defined(__sparc__) && !defined(__arch64__) \
-    && !defined(CONFIG_TCG_INTERPRETER)
-        if ((typemask & 6) == dh_typecode_i64) {
-            /* The 32-bit ABI is going to return the 64-bit value in
-               the %o0/%o1 register pair.  Prepare for this by using
-               two return temporaries, and reassemble below.  */
-            retl = tcg_temp_new_i64();
-            reth = tcg_temp_new_i64();
-            op->args[pi++] = tcgv_i64_arg(reth);
-            op->args[pi++] = tcgv_i64_arg(retl);
-            nb_rets = 2;
-        } else {
-            op->args[pi++] = temp_arg(ret);
-            nb_rets = 1;
-        }
-#else
         if (TCG_TARGET_REG_BITS < 64 && (typemask & 6) == dh_typecode_i64) {
 #if HOST_BIG_ENDIAN
             op->args[pi++] = temp_arg(ret + 1);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args)
             op->args[pi++] = temp_arg(ret);
             nb_rets = 1;
         }
-#endif
     } else {
         nb_rets = 0;
     }
@@ -XXX,XX +XXX,XX @@ void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args)
     tcg_debug_assert(TCGOP_CALLI(op) == real_args);
     tcg_debug_assert(pi <= ARRAY_SIZE(op->args));
 
-#if defined(__sparc__) && !defined(__arch64__) \
-    && !defined(CONFIG_TCG_INTERPRETER)
-    /* Free all of the parts we allocated above.  */
-    for (i = real_args = 0; i < orig_nargs; ++i) {
-        int argtype = extract32(orig_typemask, (i + 1) * 3, 3);
-        bool is_64bit = (argtype & ~1) == dh_typecode_i64;
-
-        if (is_64bit) {
-            tcg_temp_free_internal(args[real_args++]);
-            tcg_temp_free_internal(args[real_args++]);
-        } else {
-            real_args++;
-        }
-    }
-    if ((orig_typemask & 6) == dh_typecode_i64) {
-        /* The 32-bit ABI returned two 32-bit pieces.  Re-assemble them.
-           Note that describing these as TCGv_i64 eliminates an unnecessary
-           zero-extension that tcg_gen_concat_i32_i64 would create.  */
-        tcg_gen_concat32_i64(temp_tcgv_i64(ret), retl, reth);
-        tcg_temp_free_i64(retl);
-        tcg_temp_free_i64(reth);
-    }
-#elif defined(TCG_TARGET_EXTEND_ARGS) && TCG_TARGET_REG_BITS == 64
+#if defined(TCG_TARGET_EXTEND_ARGS) && TCG_TARGET_REG_BITS == 64
     for (i = 0; i < nargs; ++i) {
         int argtype = extract32(typemask, (i + 1) * 3, 3);
         bool is_32bit = (argtype & ~1) == dh_typecode_i32;
diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc/tcg-target.c.inc
+++ b/tcg/sparc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@
  * THE SOFTWARE.
  */
 
+/* We only support generating code for 64-bit mode.  */
+#ifndef __arch64__
+#error "unsupported code generation mode"
+#endif
+
 #include "../tcg-pool.c.inc"
 
 #ifdef CONFIG_DEBUG_TCG
@@ -XXX,XX +XXX,XX @@ static const char * const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
 };
 #endif
 
-#ifdef __arch64__
-# define SPARC64 1
-#else
-# define SPARC64 0
-#endif
-
 #define TCG_CT_CONST_S11  0x100
 #define TCG_CT_CONST_S13  0x200
 #define TCG_CT_CONST_ZERO 0x400
@@ -XXX,XX +XXX,XX @@ static const char * const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
  * high bits of the %i and %l registers garbage at all times.
  */
 #define ALL_GENERAL_REGS     MAKE_64BIT_MASK(0, 32)
-#if SPARC64
 # define ALL_GENERAL_REGS64  ALL_GENERAL_REGS
-#else
-# define ALL_GENERAL_REGS64  MAKE_64BIT_MASK(0, 16)
-#endif
 #define ALL_QLDST_REGS       (ALL_GENERAL_REGS & ~SOFTMMU_RESERVE_REGS)
 #define ALL_QLDST_REGS64     (ALL_GENERAL_REGS64 & ~SOFTMMU_RESERVE_REGS)
 
@@ -XXX,XX +XXX,XX @@ static bool check_fit_i32(int32_t val, unsigned int bits)
 }
 
 #define check_fit_tl    check_fit_i64
-#if SPARC64
-# define check_fit_ptr  check_fit_i64
-#else
-# define check_fit_ptr  check_fit_i32
-#endif
+#define check_fit_ptr   check_fit_i64
 
 static bool patch_reloc(tcg_insn_unit *src_rw, int type,
                         intptr_t value, intptr_t addend)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_sety(TCGContext *s, TCGReg rs)
     tcg_out32(s, WRY | INSN_RS1(TCG_REG_G0) | INSN_RS2(rs));
 }
 
-static void tcg_out_rdy(TCGContext *s, TCGReg rd)
-{
-    tcg_out32(s, RDY | INSN_RD(rd));
-}
-
 static void tcg_out_div32(TCGContext *s, TCGReg rd, TCGReg rs1,
                           int32_t val2, int val2const, int uns)
 {
@@ -XXX,XX +XXX,XX @@ static void emit_extend(TCGContext *s, TCGReg r, int op)
         tcg_out_arithi(s, r, r, 16, SHIFT_SRL);
         break;
     case MO_32:
-        if (SPARC64) {
-            tcg_out_arith(s, r, r, 0, SHIFT_SRL);
-        }
+        tcg_out_arith(s, r, r, 0, SHIFT_SRL);
         break;
     case MO_64:
         break;
@@ -XXX,XX +XXX,XX @@ static void build_trampolines(TCGContext *s)
     };
 
     int i;
-    TCGReg ra;
 
     for (i = 0; i < ARRAY_SIZE(qemu_ld_helpers); ++i) {
         if (qemu_ld_helpers[i] == NULL) {
@@ -XXX,XX +XXX,XX @@ static void build_trampolines(TCGContext *s)
         }
         qemu_ld_trampoline[i] = tcg_splitwx_to_rx(s->code_ptr);
 
-        if (SPARC64 || TARGET_LONG_BITS == 32) {
-            ra = TCG_REG_O3;
-        } else {
-            /* Install the high part of the address.  */
-            tcg_out_arithi(s, TCG_REG_O1, TCG_REG_O2, 32, SHIFT_SRLX);
-            ra = TCG_REG_O4;
-        }
-
         /* Set the retaddr operand.  */
-        tcg_out_mov(s, TCG_TYPE_PTR, ra, TCG_REG_O7);
+        tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_O3, TCG_REG_O7);
         /* Tail call.  */
         tcg_out_jmpl_const(s, qemu_ld_helpers[i], true, true);
         /* delay slot -- set the env argument */
@@ -XXX,XX +XXX,XX @@ static void build_trampolines(TCGContext *s)
         }
         qemu_st_trampoline[i] = tcg_splitwx_to_rx(s->code_ptr);
 
-        if (SPARC64) {
-            emit_extend(s, TCG_REG_O2, i);
-            ra = TCG_REG_O4;
-        } else {
-            ra = TCG_REG_O1;
-            if (TARGET_LONG_BITS == 64) {
-                /* Install the high part of the address.  */
-                tcg_out_arithi(s, ra, ra + 1, 32, SHIFT_SRLX);
-                ra += 2;
-            } else {
-                ra += 1;
-            }
-            if ((i & MO_SIZE) == MO_64) {
-                /* Install the high part of the data.  */
-                tcg_out_arithi(s, ra, ra + 1, 32, SHIFT_SRLX);
-                ra += 2;
-            } else {
-                emit_extend(s, ra, i);
-                ra += 1;
-            }
-            /* Skip the oi argument.  */
-            ra += 1;
-        }
-                
+        emit_extend(s, TCG_REG_O2, i);
+
         /* Set the retaddr operand.  */
-        if (ra >= TCG_REG_O6) {
-            tcg_out_st(s, TCG_TYPE_PTR, TCG_REG_O7, TCG_REG_CALL_STACK,
-                       TCG_TARGET_CALL_STACK_OFFSET);
-        } else {
-            tcg_out_mov(s, TCG_TYPE_PTR, ra, TCG_REG_O7);
-        }
+        tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_O4, TCG_REG_O7);
 
         /* Tail call.  */
         tcg_out_jmpl_const(s, qemu_st_helpers[i], true, true);
@@ -XXX,XX +XXX,XX @@ static void build_trampolines(TCGContext *s)
             qemu_unalign_st_trampoline = tcg_splitwx_to_rx(s->code_ptr);
         }
 
-        if (!SPARC64 && TARGET_LONG_BITS == 64) {
-            /* Install the high part of the address.  */
-            tcg_out_arithi(s, TCG_REG_O1, TCG_REG_O2, 32, SHIFT_SRLX);
-        }
-
         /* Tail call.  */
         tcg_out_jmpl_const(s, helper, true, true);
         /* delay slot -- set the env argument */
@@ -XXX,XX +XXX,XX @@ static TCGReg tcg_out_tlb_load(TCGContext *s, TCGReg addr, int mem_index,
     tcg_out_cmp(s, r0, r2, 0);
 
     /* If the guest address must be zero-extended, do so now.  */
-    if (SPARC64 && TARGET_LONG_BITS == 32) {
+    if (TARGET_LONG_BITS == 32) {
         tcg_out_arithi(s, r0, addr, 0, SHIFT_SRL);
         return r0;
     }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data, TCGReg addr,
 
 #ifdef CONFIG_SOFTMMU
     unsigned memi = get_mmuidx(oi);
-    TCGReg addrz, param;
+    TCGReg addrz;
     const tcg_insn_unit *func;
 
     addrz = tcg_out_tlb_load(s, addr, memi, memop,
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data, TCGReg addr,
 
     /* TLB Miss.  */
 
-    param = TCG_REG_O1;
-    if (!SPARC64 && TARGET_LONG_BITS == 64) {
-        /* Skip the high-part; we'll perform the extract in the trampoline.  */
-        param++;
-    }
-    tcg_out_mov(s, TCG_TYPE_REG, param++, addrz);
+    tcg_out_mov(s, TCG_TYPE_REG, TCG_REG_O1, addrz);
 
     /* We use the helpers to extend SB and SW data, leaving the case
        of SL needing explicit extending below.  */
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data, TCGReg addr,
     tcg_debug_assert(func != NULL);
     tcg_out_call_nodelay(s, func, false);
     /* delay slot */
-    tcg_out_movi(s, TCG_TYPE_I32, param, oi);
+    tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_O2, oi);
 
-    /* Recall that all of the helpers return 64-bit results.
-       Which complicates things for sparcv8plus.  */
-    if (SPARC64) {
-        /* We let the helper sign-extend SB and SW, but leave SL for here.  */
-        if (is_64 && (memop & MO_SSIZE) == MO_SL) {
-            tcg_out_arithi(s, data, TCG_REG_O0, 0, SHIFT_SRA);
-        } else {
-            tcg_out_mov(s, TCG_TYPE_REG, data, TCG_REG_O0);
-        }
+    /* We let the helper sign-extend SB and SW, but leave SL for here.  */
+    if (is_64 && (memop & MO_SSIZE) == MO_SL) {
+        tcg_out_arithi(s, data, TCG_REG_O0, 0, SHIFT_SRA);
     } else {
-        if ((memop & MO_SIZE) == MO_64) {
-            tcg_out_arithi(s, TCG_REG_O0, TCG_REG_O0, 32, SHIFT_SLLX);
-            tcg_out_arithi(s, TCG_REG_O1, TCG_REG_O1, 0, SHIFT_SRL);
-            tcg_out_arith(s, data, TCG_REG_O0, TCG_REG_O1, ARITH_OR);
-        } else if (is_64) {
-            /* Re-extend from 32-bit rather than reassembling when we
-               know the high register must be an extension.  */
-            tcg_out_arithi(s, data, TCG_REG_O1, 0,
-                           memop & MO_SIGN ? SHIFT_SRA : SHIFT_SRL);
-        } else {
-            tcg_out_mov(s, TCG_TYPE_I32, data, TCG_REG_O1);
-        }
+        tcg_out_mov(s, TCG_TYPE_REG, data, TCG_REG_O0);
     }
 
     *label_ptr |= INSN_OFF19(tcg_ptr_byte_diff(s->code_ptr, label_ptr));
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data, TCGReg addr,
     unsigned s_bits = memop & MO_SIZE;
     unsigned t_bits;
 
-    if (SPARC64 && TARGET_LONG_BITS == 32) {
+    if (TARGET_LONG_BITS == 32) {
         tcg_out_arithi(s, TCG_REG_T1, addr, 0, SHIFT_SRL);
         addr = TCG_REG_T1;
     }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data, TCGReg addr,
          * operation in the delay slot, and failure need only invoke the
          * handler for SIGBUS.
          */
-        TCGReg arg_low = TCG_REG_O1 + (!SPARC64 && TARGET_LONG_BITS == 64);
         tcg_out_call_nodelay(s, qemu_unalign_ld_trampoline, false);
         /* delay slot -- move to low part of argument reg */
-        tcg_out_mov_delay(s, arg_low, addr);
+        tcg_out_mov_delay(s, TCG_REG_O1, addr);
     } else {
         /* Underalignment: load by pieces of minimum alignment. */
         int ld_opc, a_size, s_size, i;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data, TCGReg addr,
 
 #ifdef CONFIG_SOFTMMU
     unsigned memi = get_mmuidx(oi);
-    TCGReg addrz, param;
+    TCGReg addrz;
     const tcg_insn_unit *func;
 
     addrz = tcg_out_tlb_load(s, addr, memi, memop,
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data, TCGReg addr,
 
     /* TLB Miss.  */
 
-    param = TCG_REG_O1;
-    if (!SPARC64 && TARGET_LONG_BITS == 64) {
-        /* Skip the high-part; we'll perform the extract in the trampoline.  */
-        param++;
-    }
-    tcg_out_mov(s, TCG_TYPE_REG, param++, addrz);
-    if (!SPARC64 && (memop & MO_SIZE) == MO_64) {
-        /* Skip the high-part; we'll perform the extract in the trampoline.  */
-        param++;
-    }
-    tcg_out_mov(s, TCG_TYPE_REG, param++, data);
+    tcg_out_mov(s, TCG_TYPE_REG, TCG_REG_O1, addrz);
+    tcg_out_mov(s, TCG_TYPE_REG, TCG_REG_O2, data);
 
     func = qemu_st_trampoline[memop & (MO_BSWAP | MO_SIZE)];
     tcg_debug_assert(func != NULL);
     tcg_out_call_nodelay(s, func, false);
     /* delay slot */
-    tcg_out_movi(s, TCG_TYPE_I32, param, oi);
+    tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_O3, oi);
 
     *label_ptr |= INSN_OFF19(tcg_ptr_byte_diff(s->code_ptr, label_ptr));
 #else
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data, TCGReg addr,
     unsigned s_bits = memop & MO_SIZE;
     unsigned t_bits;
 
-    if (SPARC64 && TARGET_LONG_BITS == 32) {
+    if (TARGET_LONG_BITS == 32) {
         tcg_out_arithi(s, TCG_REG_T1, addr, 0, SHIFT_SRL);
         addr = TCG_REG_T1;
     }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data, TCGReg addr,
          * operation in the delay slot, and failure need only invoke the
          * handler for SIGBUS.
          */
-        TCGReg arg_low = TCG_REG_O1 + (!SPARC64 && TARGET_LONG_BITS == 64);
         tcg_out_call_nodelay(s, qemu_unalign_st_trampoline, false);
         /* delay slot -- move to low part of argument reg */
-        tcg_out_mov_delay(s, arg_low, addr);
+        tcg_out_mov_delay(s, TCG_REG_O1, addr);
     } else {
         /* Underalignment: store by pieces of minimum alignment. */
         int st_opc, a_size, s_size, i;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_muls2_i32:
         c = ARITH_SMUL;
     do_mul2:
-        /* The 32-bit multiply insns produce a full 64-bit result.  If the
-           destination register can hold it, we can avoid the slower RDY.  */
+        /* The 32-bit multiply insns produce a full 64-bit result. */
         tcg_out_arithc(s, a0, a2, args[3], const_args[3], c);
-        if (SPARC64 || a0 <= TCG_REG_O7) {
-            tcg_out_arithi(s, a1, a0, 32, SHIFT_SRLX);
-        } else {
-            tcg_out_rdy(s, a1);
-        }
+        tcg_out_arithi(s, a1, a0, 32, SHIFT_SRLX);
         break;
 
     case INDEX_op_qemu_ld_i32:
@@ -XXX,XX +XXX,XX @@ static void tcg_target_init(TCGContext *s)
     tcg_regset_set_reg(s->reserved_regs, TCG_REG_T2); /* for internal use */
 }
 
-#if SPARC64
-# define ELF_HOST_MACHINE  EM_SPARCV9
-#else
-# define ELF_HOST_MACHINE  EM_SPARC32PLUS
-# define ELF_HOST_FLAGS    EF_SPARC_32PLUS
-#endif
+#define ELF_HOST_MACHINE  EM_SPARCV9
 
 typedef struct {
     DebugFrameHeader h;
-    uint8_t fde_def_cfa[SPARC64 ? 4 : 2];
+    uint8_t fde_def_cfa[4];
     uint8_t fde_win_save;
     uint8_t fde_ret_save[3];
 } DebugFrame;
@@ -XXX,XX +XXX,XX @@ static const DebugFrame debug_frame = {
     .h.fde.len = sizeof(DebugFrame) - offsetof(DebugFrame, h.fde.cie_offset),
 
     .fde_def_cfa = {
-#if SPARC64
         12, 30,                         /* DW_CFA_def_cfa i6, 2047 */
         (2047 & 0x7f) | 0x80, (2047 >> 7)
-#else
-        13, 30                          /* DW_CFA_def_cfa_register i6 */
-#endif
     },
     .fde_win_save = 0x2d,               /* DW_CFA_GNU_window_save */
     .fde_ret_save = { 9, 15, 31 },      /* DW_CFA_register o7, i7 */
-- 
2.34.1

Emphasize that we only support full 64-bit code generation.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 meson.build                                 | 4 +---
 tcg/{sparc => sparc64}/tcg-target-con-set.h | 0
 tcg/{sparc => sparc64}/tcg-target-con-str.h | 0
 tcg/{sparc => sparc64}/tcg-target.h         | 0
 tcg/{sparc => sparc64}/tcg-target.c.inc     | 0
 MAINTAINERS                                 | 2 +-
 6 files changed, 2 insertions(+), 4 deletions(-)
 rename tcg/{sparc => sparc64}/tcg-target-con-set.h (100%)
 rename tcg/{sparc => sparc64}/tcg-target-con-str.h (100%)
 rename tcg/{sparc => sparc64}/tcg-target.h (100%)
 rename tcg/{sparc => sparc64}/tcg-target.c.inc (100%)

diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ qapi_trace_events = []
 bsd_oses = ['gnu/kfreebsd', 'freebsd', 'netbsd', 'openbsd', 'dragonfly', 'darwin']
 supported_oses = ['windows', 'freebsd', 'netbsd', 'openbsd', 'darwin', 'sunos', 'linux']
 supported_cpus = ['ppc', 'ppc64', 's390x', 'riscv', 'x86', 'x86_64',
-  'arm', 'aarch64', 'loongarch64', 'mips', 'mips64', 'sparc', 'sparc64']
+  'arm', 'aarch64', 'loongarch64', 'mips', 'mips64', 'sparc64']
 
 cpu = host_machine.cpu_family()
 
@@ -XXX,XX +XXX,XX @@ if get_option('tcg').allowed()
   endif
   if get_option('tcg_interpreter')
     tcg_arch = 'tci'
-  elif host_arch == 'sparc64'
-    tcg_arch = 'sparc'
   elif host_arch == 'x86_64'
     tcg_arch = 'i386'
   elif host_arch == 'ppc64'
diff --git a/tcg/sparc/tcg-target-con-set.h b/tcg/sparc64/tcg-target-con-set.h
similarity index 100%
rename from tcg/sparc/tcg-target-con-set.h
rename to tcg/sparc64/tcg-target-con-set.h
diff --git a/tcg/sparc/tcg-target-con-str.h b/tcg/sparc64/tcg-target-con-str.h
similarity index 100%
rename from tcg/sparc/tcg-target-con-str.h
rename to tcg/sparc64/tcg-target-con-str.h
diff --git a/tcg/sparc/tcg-target.h b/tcg/sparc64/tcg-target.h
similarity index 100%
rename from tcg/sparc/tcg-target.h
rename to tcg/sparc64/tcg-target.h
diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
similarity index 100%
rename from tcg/sparc/tcg-target.c.inc
rename to tcg/sparc64/tcg-target.c.inc
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ L: qemu-s390x@nongnu.org
 
 SPARC TCG target
 S: Odd Fixes
-F: tcg/sparc/
+F: tcg/sparc64/
 F: disas/sparc.c
 
 TCI TCG target
-- 
2.34.1

With sparc64 we need not distinguish between registers that
can hold 32-bit values and those that can hold 64-bit values.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/sparc64/tcg-target-con-set.h |  16 +----
 tcg/sparc64/tcg-target-con-str.h |   3 -
 tcg/sparc64/tcg-target.c.inc     | 109 ++++++++++++-------------------
 3 files changed, 44 insertions(+), 84 deletions(-)

diff --git a/tcg/sparc64/tcg-target-con-set.h b/tcg/sparc64/tcg-target-con-set.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc64/tcg-target-con-set.h
+++ b/tcg/sparc64/tcg-target-con-set.h
@@ -XXX,XX +XXX,XX @@
  */
 C_O0_I1(r)
 C_O0_I2(rZ, r)
-C_O0_I2(RZ, r)
 C_O0_I2(rZ, rJ)
-C_O0_I2(RZ, RJ)
-C_O0_I2(sZ, A)
-C_O0_I2(SZ, A)
-C_O1_I1(r, A)
-C_O1_I1(R, A)
+C_O0_I2(sZ, s)
+C_O1_I1(r, s)
 C_O1_I1(r, r)
-C_O1_I1(r, R)
-C_O1_I1(R, r)
-C_O1_I1(R, R)
-C_O1_I2(R, R, R)
+C_O1_I2(r, r, r)
 C_O1_I2(r, rZ, rJ)
-C_O1_I2(R, RZ, RJ)
 C_O1_I4(r, rZ, rJ, rI, 0)
-C_O1_I4(R, RZ, RJ, RI, 0)
 C_O2_I2(r, r, rZ, rJ)
-C_O2_I4(R, R, RZ, RZ, RJ, RI)
 C_O2_I4(r, r, rZ, rZ, rJ, rJ)
diff --git a/tcg/sparc64/tcg-target-con-str.h b/tcg/sparc64/tcg-target-con-str.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc64/tcg-target-con-str.h
+++ b/tcg/sparc64/tcg-target-con-str.h
@@ -XXX,XX +XXX,XX @@
  * REGS(letter, register_mask)
  */
 REGS('r', ALL_GENERAL_REGS)
-REGS('R', ALL_GENERAL_REGS64)
 REGS('s', ALL_QLDST_REGS)
-REGS('S', ALL_QLDST_REGS64)
-REGS('A', TARGET_LONG_BITS == 64 ? ALL_QLDST_REGS64 : ALL_QLDST_REGS)
 
 /*
  * Define constraint letters for constants:
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char * const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
 #else
 #define SOFTMMU_RESERVE_REGS 0
 #endif
-
-/*
- * Note that sparcv8plus can only hold 64 bit quantities in %g and %o
- * registers.  These are saved manually by the kernel in full 64-bit
- * slots.  The %i and %l registers are saved by the register window
- * mechanism, which only allocates space for 32 bits.  Given that this
- * window spill/fill can happen on any signal, we must consider the
- * high bits of the %i and %l registers garbage at all times.
- */
 #define ALL_GENERAL_REGS     MAKE_64BIT_MASK(0, 32)
-# define ALL_GENERAL_REGS64  ALL_GENERAL_REGS
 #define ALL_QLDST_REGS       (ALL_GENERAL_REGS & ~SOFTMMU_RESERVE_REGS)
-#define ALL_QLDST_REGS64     (ALL_GENERAL_REGS64 & ~SOFTMMU_RESERVE_REGS)
 
 /* Define some temporary registers.  T2 is used for constant generation.  */
 #define TCG_REG_T1  TCG_REG_G1
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
         return C_O0_I1(r);
 
     case INDEX_op_ld8u_i32:
+    case INDEX_op_ld8u_i64:
     case INDEX_op_ld8s_i32:
+    case INDEX_op_ld8s_i64:
     case INDEX_op_ld16u_i32:
+    case INDEX_op_ld16u_i64:
     case INDEX_op_ld16s_i32:
+    case INDEX_op_ld16s_i64:
     case INDEX_op_ld_i32:
+    case INDEX_op_ld32u_i64:
+    case INDEX_op_ld32s_i64:
+    case INDEX_op_ld_i64:
     case INDEX_op_neg_i32:
+    case INDEX_op_neg_i64:
     case INDEX_op_not_i32:
+    case INDEX_op_not_i64:
+    case INDEX_op_ext32s_i64:
+    case INDEX_op_ext32u_i64:
+    case INDEX_op_ext_i32_i64:
+    case INDEX_op_extu_i32_i64:
+    case INDEX_op_extrl_i64_i32:
+    case INDEX_op_extrh_i64_i32:
         return C_O1_I1(r, r);
 
     case INDEX_op_st8_i32:
+    case INDEX_op_st8_i64:
     case INDEX_op_st16_i32:
+    case INDEX_op_st16_i64:
     case INDEX_op_st_i32:
+    case INDEX_op_st32_i64:
+    case INDEX_op_st_i64:
         return C_O0_I2(rZ, r);
 
     case INDEX_op_add_i32:
+    case INDEX_op_add_i64:
     case INDEX_op_mul_i32:
+    case INDEX_op_mul_i64:
     case INDEX_op_div_i32:
+    case INDEX_op_div_i64:
     case INDEX_op_divu_i32:
+    case INDEX_op_divu_i64:
     case INDEX_op_sub_i32:
+    case INDEX_op_sub_i64:
     case INDEX_op_and_i32:
+    case INDEX_op_and_i64:
     case INDEX_op_andc_i32:
+    case INDEX_op_andc_i64:
     case INDEX_op_or_i32:
+    case INDEX_op_or_i64:
     case INDEX_op_orc_i32:
+    case INDEX_op_orc_i64:
     case INDEX_op_xor_i32:
+    case INDEX_op_xor_i64:
     case INDEX_op_shl_i32:
+    case INDEX_op_shl_i64:
     case INDEX_op_shr_i32:
+    case INDEX_op_shr_i64:
     case INDEX_op_sar_i32:
+    case INDEX_op_sar_i64:
     case INDEX_op_setcond_i32:
+    case INDEX_op_setcond_i64:
         return C_O1_I2(r, rZ, rJ);
 
     case INDEX_op_brcond_i32:
+    case INDEX_op_brcond_i64:
         return C_O0_I2(rZ, rJ);
     case INDEX_op_movcond_i32:
+    case INDEX_op_movcond_i64:
         return C_O1_I4(r, rZ, rJ, rI, 0);
     case INDEX_op_add2_i32:
+    case INDEX_op_add2_i64:
     case INDEX_op_sub2_i32:
+    case INDEX_op_sub2_i64:
         return C_O2_I4(r, r, rZ, rZ, rJ, rJ);
     case INDEX_op_mulu2_i32:
     case INDEX_op_muls2_i32:
         return C_O2_I2(r, r, rZ, rJ);
-
-    case INDEX_op_ld8u_i64:
-    case INDEX_op_ld8s_i64:
-    case INDEX_op_ld16u_i64:
-    case INDEX_op_ld16s_i64:
-    case INDEX_op_ld32u_i64:
-    case INDEX_op_ld32s_i64:
-    case INDEX_op_ld_i64:
-    case INDEX_op_ext_i32_i64:
-    case INDEX_op_extu_i32_i64:
-        return C_O1_I1(R, r);
-
-    case INDEX_op_st8_i64:
-    case INDEX_op_st16_i64:
-    case INDEX_op_st32_i64:
-    case INDEX_op_st_i64:
-        return C_O0_I2(RZ, r);
-
-    case INDEX_op_add_i64:
-    case INDEX_op_mul_i64:
-    case INDEX_op_div_i64:
-    case INDEX_op_divu_i64:
-    case INDEX_op_sub_i64:
-    case INDEX_op_and_i64:
-    case INDEX_op_andc_i64:
-    case INDEX_op_or_i64:
-    case INDEX_op_orc_i64:
-    case INDEX_op_xor_i64:
-    case INDEX_op_shl_i64:
-    case INDEX_op_shr_i64:
-    case INDEX_op_sar_i64:
-    case INDEX_op_setcond_i64:
-        return C_O1_I2(R, RZ, RJ);
-
-    case INDEX_op_neg_i64:
-    case INDEX_op_not_i64:
-    case INDEX_op_ext32s_i64:
-    case INDEX_op_ext32u_i64:
-        return C_O1_I1(R, R);
-
-    case INDEX_op_extrl_i64_i32:
-    case INDEX_op_extrh_i64_i32:
-        return C_O1_I1(r, R);
-
-    case INDEX_op_brcond_i64:
-        return C_O0_I2(RZ, RJ);
-    case INDEX_op_movcond_i64:
-        return C_O1_I4(R, RZ, RJ, RI, 0);
-    case INDEX_op_add2_i64:
-    case INDEX_op_sub2_i64:
-        return C_O2_I4(R, R, RZ, RZ, RJ, RI);
     case INDEX_op_muluh_i64:
-        return C_O1_I2(R, R, R);
+        return C_O1_I2(r, r, r);
 
     case INDEX_op_qemu_ld_i32:
-        return C_O1_I1(r, A);
     case INDEX_op_qemu_ld_i64:
-        return C_O1_I1(R, A);
+        return C_O1_I1(r, s);
     case INDEX_op_qemu_st_i32:
-        return C_O0_I2(sZ, A);
     case INDEX_op_qemu_st_i64:
-        return C_O0_I2(SZ, A);
+        return C_O0_I2(sZ, s);
 
     default:
         g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ static void tcg_target_init(TCGContext *s)
 #endif
 
     tcg_target_available_regs[TCG_TYPE_I32] = ALL_GENERAL_REGS;
-    tcg_target_available_regs[TCG_TYPE_I64] = ALL_GENERAL_REGS64;
+    tcg_target_available_regs[TCG_TYPE_I64] = ALL_GENERAL_REGS;
 
     tcg_target_call_clobber_regs = 0;
     tcg_regset_set_reg(tcg_target_call_clobber_regs, TCG_REG_G1);
-- 
2.34.1

From: Icenowy Zheng <uwu@icenowy.me>

When registering helpers via FFI for TCI, the inner loop that iterates
parameters of the helper reuses (and thus pollutes) the same variable
used by the outer loop that iterates all helpers, thus made some helpers
unregistered.

Fix this logic error by using a dedicated temporary variable for the
inner loop.

Fixes: 22f15579fa ("tcg: Build ffi data structures for helpers")
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Icenowy Zheng <uwu@icenowy.me>
Message-Id: <20221028072145.1593205-1-uwu@icenowy.me>
[rth: Move declaration of j to the for loop itself]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static void tcg_context_init(unsigned max_cpus)
 
         if (nargs != 0) {
             ca->cif.arg_types = ca->args;
-            for (i = 0; i < nargs; ++i) {
-                int typecode = extract32(typemask, (i + 1) * 3, 3);
-                ca->args[i] = typecode_to_ffi[typecode];
+            for (int j = 0; j < nargs; ++j) {
+                int typecode = extract32(typemask, (j + 1) * 3, 3);
+                ca->args[j] = typecode_to_ffi[typecode];
             }
         }
 
-- 
2.34.1

Add a way to examine the unwind data without actually
restoring the data back into env.

Reviewed-by: Claudio Fontana <cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/internal.h      |  4 +--
 include/exec/exec-all.h   | 21 ++++++++---
 accel/tcg/translate-all.c | 74 ++++++++++++++++++++++++++-------------
 3 files changed, 68 insertions(+), 31 deletions(-)

diff --git a/accel/tcg/internal.h b/accel/tcg/internal.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/internal.h
+++ b/accel/tcg/internal.h
@@ -XXX,XX +XXX,XX @@ void tb_reset_jump(TranslationBlock *tb, int n);
 TranslationBlock *tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
                                tb_page_addr_t phys_page2);
 bool tb_invalidate_phys_page_unwind(tb_page_addr_t addr, uintptr_t pc);
-int cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
-                              uintptr_t searched_pc, bool reset_icount);
+void cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
+                               uintptr_t host_pc, bool reset_icount);
 
 /* Return the current PC from CPU, which may be cached in TB. */
 static inline target_ulong log_pc(CPUState *cpu, const TranslationBlock *tb)
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ typedef ram_addr_t tb_page_addr_t;
 #define TB_PAGE_ADDR_FMT RAM_ADDR_FMT
 #endif
 
+/**
+ * cpu_unwind_state_data:
+ * @cpu: the cpu context
+ * @host_pc: the host pc within the translation
+ * @data: output data
+ *
+ * Attempt to load the the unwind state for a host pc occurring in
+ * translated code.  If @host_pc is not in translated code, the
+ * function returns false; otherwise @data is loaded.
+ * This is the same unwind info as given to restore_state_to_opc.
+ */
+bool cpu_unwind_state_data(CPUState *cpu, uintptr_t host_pc, uint64_t *data);
+
 /**
  * cpu_restore_state:
- * @cpu: the vCPU state is to be restore to
- * @searched_pc: the host PC the fault occurred at
+ * @cpu: the cpu context
+ * @host_pc: the host pc within the translation
  * @will_exit: true if the TB executed will be interrupted after some
                cpu adjustments. Required for maintaining the correct
                icount valus
  * @return: true if state was restored, false otherwise
  *
  * Attempt to restore the state for a fault occurring in translated
- * code. If the searched_pc is not in translated code no state is
+ * code. If @host_pc is not in translated code no state is
  * restored and the function returns false.
  */
-bool cpu_restore_state(CPUState *cpu, uintptr_t searched_pc, bool will_exit);
+bool cpu_restore_state(CPUState *cpu, uintptr_t host_pc, bool will_exit);
 
 G_NORETURN void cpu_loop_exit_noexc(CPUState *cpu);
 G_NORETURN void cpu_loop_exit(CPUState *cpu);
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ static int encode_search(TranslationBlock *tb, uint8_t *block)
     return p - block;
 }
 
-/* The cpu state corresponding to 'searched_pc' is restored.
- * When reset_icount is true, current TB will be interrupted and
- * icount should be recalculated.
- */
-int cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
-                              uintptr_t searched_pc, bool reset_icount)
+static int cpu_unwind_data_from_tb(TranslationBlock *tb, uintptr_t host_pc,
+                                   uint64_t *data)
 {
-    uint64_t data[TARGET_INSN_START_WORDS];
-    uintptr_t host_pc = (uintptr_t)tb->tc.ptr;
+    uintptr_t iter_pc = (uintptr_t)tb->tc.ptr;
     const uint8_t *p = tb->tc.ptr + tb->tc.size;
     int i, j, num_insns = tb->icount;
-#ifdef CONFIG_PROFILER
-    TCGProfile *prof = &tcg_ctx->prof;
-    int64_t ti = profile_getclock();
-#endif
 
-    searched_pc -= GETPC_ADJ;
+    host_pc -= GETPC_ADJ;
 
-    if (searched_pc < host_pc) {
+    if (host_pc < iter_pc) {
         return -1;
     }
 
-    memset(data, 0, sizeof(data));
+    memset(data, 0, sizeof(uint64_t) * TARGET_INSN_START_WORDS);
     if (!TARGET_TB_PCREL) {
         data[0] = tb_pc(tb);
     }
 
-    /* Reconstruct the stored insn data while looking for the point at
-       which the end of the insn exceeds the searched_pc.  */
+    /*
+     * Reconstruct the stored insn data while looking for the point
+     * at which the end of the insn exceeds host_pc.
+     */
     for (i = 0; i < num_insns; ++i) {
         for (j = 0; j < TARGET_INSN_START_WORDS; ++j) {
             data[j] += decode_sleb128(&p);
         }
-        host_pc += decode_sleb128(&p);
-        if (host_pc > searched_pc) {
-            goto found;
+        iter_pc += decode_sleb128(&p);
+        if (iter_pc > host_pc) {
+            return num_insns - i;
         }
     }
     return -1;
+}
+
+/*
+ * The cpu state corresponding to 'host_pc' is restored.
+ * When reset_icount is true, current TB will be interrupted and
+ * icount should be recalculated.
+ */
+void cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
+                               uintptr_t host_pc, bool reset_icount)
+{
+    uint64_t data[TARGET_INSN_START_WORDS];
+#ifdef CONFIG_PROFILER
+    TCGProfile *prof = &tcg_ctx->prof;
+    int64_t ti = profile_getclock();
+#endif
+    int insns_left = cpu_unwind_data_from_tb(tb, host_pc, data);
+
+    if (insns_left < 0) {
+        return;
+    }
 
- found:
     if (reset_icount && (tb_cflags(tb) & CF_USE_ICOUNT)) {
         assert(icount_enabled());
-        /* Reset the cycle counter to the start of the block
-           and shift if to the number of actually executed instructions */
-        cpu_neg(cpu)->icount_decr.u16.low += num_insns - i;
+        /*
+         * Reset the cycle counter to the start of the block and
+         * shift if to the number of actually executed instructions.
+         */
+        cpu_neg(cpu)->icount_decr.u16.low += insns_left;
     }
 
     cpu->cc->tcg_ops->restore_state_to_opc(cpu, tb, data);
@@ -XXX,XX +XXX,XX @@ int cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
                 prof->restore_time + profile_getclock() - ti);
     qatomic_set(&prof->restore_count, prof->restore_count + 1);
 #endif
-    return 0;
 }
 
 bool cpu_restore_state(CPUState *cpu, uintptr_t host_pc, bool will_exit)
@@ -XXX,XX +XXX,XX @@ bool cpu_restore_state(CPUState *cpu, uintptr_t host_pc, bool will_exit)
     return false;
 }
 
+bool cpu_unwind_state_data(CPUState *cpu, uintptr_t host_pc, uint64_t *data)
+{
+    if (in_code_gen_buffer((const void *)(host_pc - tcg_splitwx_diff))) {
+        TranslationBlock *tb = tcg_tb_lookup(host_pc);
+        if (tb) {
+            return cpu_unwind_data_from_tb(tb, host_pc, data) >= 0;
+        }
+    }
+    return false;
+}
+
 void page_init(void)
 {
     page_size_init();
-- 
2.34.1

Avoid cpu_restore_state, and modifying env->eip out from
underneath the translator with TARGET_TB_PCREL.  There is
some slight duplication from x86_restore_state_to_opc,
but it's just a few lines.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1269
Reviewed-by: Claudio Fontana <cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/i386/helper.c | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/target/i386/helper.c b/target/i386/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/helper.c
+++ b/target/i386/helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_x86_inject_mce(Monitor *mon, X86CPU *cpu, int bank,
     }
 }
 
+static target_ulong get_memio_eip(CPUX86State *env)
+{
+    uint64_t data[TARGET_INSN_START_WORDS];
+    CPUState *cs = env_cpu(env);
+
+    if (!cpu_unwind_state_data(cs, cs->mem_io_pc, data)) {
+        return env->eip;
+    }
+
+    /* Per x86_restore_state_to_opc. */
+    if (TARGET_TB_PCREL) {
+        return (env->eip & TARGET_PAGE_MASK) | data[0];
+    } else {
+        return data[0] - env->segs[R_CS].base;
+    }
+}
+
 void cpu_report_tpr_access(CPUX86State *env, TPRAccess access)
 {
     X86CPU *cpu = env_archcpu(env);
@@ -XXX,XX +XXX,XX @@ void cpu_report_tpr_access(CPUX86State *env, TPRAccess access)
 
         cpu_interrupt(cs, CPU_INTERRUPT_TPR);
     } else if (tcg_enabled()) {
-        cpu_restore_state(cs, cs->mem_io_pc, false);
+        target_ulong eip = get_memio_eip(env);
 
-        apic_handle_tpr_access_report(cpu->apic_state, env->eip, access);
+        apic_handle_tpr_access_report(cpu->apic_state, eip, access);
     }
 }
 #endif /* !CONFIG_USER_ONLY */
-- 
2.34.1

Since we do not plan to exit, use cpu_unwind_state_data
and extract exactly the data requested.

This is a bug fix, in that we no longer clobber dflag.

Consider:

l.j       L2         // branch
        l.mfspr   r1, ppc    // delay

L1:     boom
L2:     l.lwa     r3, (r4)

Here, dflag would be set by cpu_restore_state (because that is the current
state of the cpu), but but not cleared by tb_stop on exiting the TB
(because DisasContext has recorded the current value as zero).

The next TB begins at L2 with dflag incorrectly set.  If the load has a
tlb miss, then the exception will be delivered as per a delay slot:
with DSX set in the status register and PC decremented (delay slots
restart by re-executing the branch). This will cause the return from
interrupt to go to L1, and boom!

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/openrisc/sys_helper.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/target/openrisc/sys_helper.c b/target/openrisc/sys_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/sys_helper.c
+++ b/target/openrisc/sys_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(mfspr)(CPUOpenRISCState *env, target_ulong rd,
                            target_ulong spr)
 {
 #ifndef CONFIG_USER_ONLY
+    uint64_t data[TARGET_INSN_START_WORDS];
     MachineState *ms = MACHINE(qdev_get_machine());
     OpenRISCCPU *cpu = env_archcpu(env);
     CPUState *cs = env_cpu(env);
@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(mfspr)(CPUOpenRISCState *env, target_ulong rd,
         return env->evbar;
 
     case TO_SPR(0, 16): /* NPC (equals PC) */
-        cpu_restore_state(cs, GETPC(), false);
+        if (cpu_unwind_state_data(cs, GETPC(), data)) {
+            return data[0];
+        }
         return env->pc;
 
     case TO_SPR(0, 17): /* SR */
         return cpu_get_sr(env);
 
     case TO_SPR(0, 18): /* PPC */
-        cpu_restore_state(cs, GETPC(), false);
+        if (cpu_unwind_state_data(cs, GETPC(), data)) {
+            if (data[1] & 2) {
+                return data[0] - 4;
+            }
+        }
         return env->ppc;
 
     case TO_SPR(0, 32): /* EPCR */
-- 
2.34.1

The value passed is always true, and if the target's
synchronize_from_tb hook is non-trivial, not exiting
may be erroneous.

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ bool cpu_unwind_state_data(CPUState *cpu, uintptr_t host_pc, uint64_t *data);
  * cpu_restore_state:
  * @cpu: the cpu context
  * @host_pc: the host pc within the translation
- * @will_exit: true if the TB executed will be interrupted after some
-               cpu adjustments. Required for maintaining the correct
-               icount valus
  * @return: true if state was restored, false otherwise
  *
  * Attempt to restore the state for a fault occurring in translated
  * code. If @host_pc is not in translated code no state is
  * restored and the function returns false.
  */
-bool cpu_restore_state(CPUState *cpu, uintptr_t host_pc, bool will_exit);
+bool cpu_restore_state(CPUState *cpu, uintptr_t host_pc);
 
 G_NORETURN void cpu_loop_exit_noexc(CPUState *cpu);
 G_NORETURN void cpu_loop_exit(CPUState *cpu);
diff --git a/accel/tcg/cpu-exec-common.c b/accel/tcg/cpu-exec-common.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec-common.c
+++ b/accel/tcg/cpu-exec-common.c
@@ -XXX,XX +XXX,XX @@ void cpu_loop_exit(CPUState *cpu)
 void cpu_loop_exit_restore(CPUState *cpu, uintptr_t pc)
 {
     if (pc) {
-        cpu_restore_state(cpu, pc, true);
+        cpu_restore_state(cpu, pc);
     }
     cpu_loop_exit(cpu);
 }
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ void cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
 #endif
 }
 
-bool cpu_restore_state(CPUState *cpu, uintptr_t host_pc, bool will_exit)
+bool cpu_restore_state(CPUState *cpu, uintptr_t host_pc)
 {
-    /*
-     * The pc update associated with restore without exit will
-     * break the relative pc adjustments performed by TARGET_TB_PCREL.
-     */
-    if (TARGET_TB_PCREL) {
-        assert(will_exit);
-    }
-
     /*
      * The host_pc has to be in the rx region of the code buffer.
      * If it is not we will not be able to resolve it here.
@@ -XXX,XX +XXX,XX @@ bool cpu_restore_state(CPUState *cpu, uintptr_t host_pc, bool will_exit)
     if (in_code_gen_buffer((const void *)(host_pc - tcg_splitwx_diff))) {
         TranslationBlock *tb = tcg_tb_lookup(host_pc);
         if (tb) {
-            cpu_restore_state_from_tb(cpu, tb, host_pc, will_exit);
+            cpu_restore_state_from_tb(cpu, tb, host_pc, true);
             return true;
         }
     }
diff --git a/target/alpha/helper.c b/target/alpha/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/helper.c
+++ b/target/alpha/helper.c
@@ -XXX,XX +XXX,XX @@ G_NORETURN void dynamic_excp(CPUAlphaState *env, uintptr_t retaddr,
     cs->exception_index = excp;
     env->error_code = error;
     if (retaddr) {
-        cpu_restore_state(cs, retaddr, true);
+        cpu_restore_state(cs, retaddr);
         /* Floating-point exceptions (our only users) point to the next PC.  */
         env->pc += 4;
     }
diff --git a/target/alpha/mem_helper.c b/target/alpha/mem_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/mem_helper.c
+++ b/target/alpha/mem_helper.c
@@ -XXX,XX +XXX,XX @@ static void do_unaligned_access(CPUAlphaState *env, vaddr addr, uintptr_t retadd
     uint64_t pc;
     uint32_t insn;
 
-    cpu_restore_state(env_cpu(env), retaddr, true);
+    cpu_restore_state(env_cpu(env), retaddr);
 
     pc = env->pc;
     insn = cpu_ldl_code(env, pc);
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
      * we must restore CPU state here before setting the syndrome
      * the caller passed us, and cannot use cpu_loop_exit_restore().
      */
-    cpu_restore_state(cs, ra, true);
+    cpu_restore_state(cs, ra);
     raise_exception(env, excp, syndrome, target_el);
 }
 
diff --git a/target/arm/tlb_helper.c b/target/arm/tlb_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tlb_helper.c
+++ b/target/arm/tlb_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
     ARMMMUFaultInfo fi = {};
 
     /* now we have a real cpu fault */
-    cpu_restore_state(cs, retaddr, true);
+    cpu_restore_state(cs, retaddr);
 
     fi.type = ARMFault_Alignment;
     arm_deliver_fault(cpu, vaddr, access_type, mmu_idx, &fi);
@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
     ARMMMUFaultInfo fi = {};
 
     /* now we have a real cpu fault */
-    cpu_restore_state(cs, retaddr, true);
+    cpu_restore_state(cs, retaddr);
 
     fi.ea = arm_extabort_type(response);
     fi.type = ARMFault_SyncExternal;
@@ -XXX,XX +XXX,XX @@ bool arm_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
         return false;
     } else {
         /* now we have a real cpu fault */
-        cpu_restore_state(cs, retaddr, true);
+        cpu_restore_state(cs, retaddr);
         arm_deliver_fault(cpu, address, access_type, mmu_idx, fi);
     }
 }
@@ -XXX,XX +XXX,XX @@ void arm_cpu_record_sigsegv(CPUState *cs, vaddr addr,
      * We report both ESR and FAR to signal handlers.
      * For now, it's easiest to deliver the fault normally.
      */
-    cpu_restore_state(cs, ra, true);
+    cpu_restore_state(cs, ra);
     arm_deliver_fault(cpu, addr, access_type, MMU_USER_IDX, &fi);
 }
 
diff --git a/target/cris/helper.c b/target/cris/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/helper.c
+++ b/target/cris/helper.c
@@ -XXX,XX +XXX,XX @@ bool cris_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
     cs->exception_index = EXCP_BUSFAULT;
     env->fault_vector = res.bf_vec;
     if (retaddr) {
-        if (cpu_restore_state(cs, retaddr, true)) {
+        if (cpu_restore_state(cs, retaddr)) {
             /* Evaluate flags after retranslation. */
             helper_top_evaluate_flags(env);
         }
diff --git a/target/i386/tcg/sysemu/svm_helper.c b/target/i386/tcg/sysemu/svm_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/sysemu/svm_helper.c
+++ b/target/i386/tcg/sysemu/svm_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_vmexit(CPUX86State *env, uint32_t exit_code, uint64_t exit_info_1,
 {
     CPUState *cs = env_cpu(env);
 
-    cpu_restore_state(cs, retaddr, true);
+    cpu_restore_state(cs, retaddr);
 
     qemu_log_mask(CPU_LOG_TB_IN_ASM, "vmexit(%08x, %016" PRIx64 ", %016"
                   PRIx64 ", " TARGET_FMT_lx ")!\n",
diff --git a/target/m68k/op_helper.c b/target/m68k/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/op_helper.c
+++ b/target/m68k/op_helper.c
@@ -XXX,XX +XXX,XX @@ void m68k_cpu_transaction_failed(CPUState *cs, hwaddr physaddr, vaddr addr,
     M68kCPU *cpu = M68K_CPU(cs);
     CPUM68KState *env = &cpu->env;
 
-    cpu_restore_state(cs, retaddr, true);
+    cpu_restore_state(cs, retaddr);
 
     if (m68k_feature(env, M68K_FEATURE_M68040)) {
         env->mmu.mmusr = 0;
@@ -XXX,XX +XXX,XX @@ raise_exception_format2(CPUM68KState *env, int tt, int ilen, uintptr_t raddr)
     cs->exception_index = tt;
 
     /* Recover PC and CC_OP for the beginning of the insn.  */
-    cpu_restore_state(cs, raddr, true);
+    cpu_restore_state(cs, raddr);
 
     /* Flags are current in env->cc_*, or are undefined. */
     env->cc_op = CC_OP_FLAGS;
diff --git a/target/microblaze/helper.c b/target/microblaze/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/helper.c
+++ b/target/microblaze/helper.c
@@ -XXX,XX +XXX,XX @@ void mb_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
     uint32_t esr, iflags;
 
     /* Recover the pc and iflags from the corresponding insn_start.  */
-    cpu_restore_state(cs, retaddr, true);
+    cpu_restore_state(cs, retaddr);
     iflags = cpu->env.iflags;
 
     qemu_log_mask(CPU_LOG_INT,
diff --git a/target/nios2/op_helper.c b/target/nios2/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/op_helper.c
+++ b/target/nios2/op_helper.c
@@ -XXX,XX +XXX,XX @@ void nios2_cpu_loop_exit_advance(CPUNios2State *env, uintptr_t retaddr)
      * Do this here, rather than in restore_state_to_opc(),
      * lest we affect QEMU internal exceptions, like EXCP_DEBUG.
      */
-    cpu_restore_state(cs, retaddr, true);
+    cpu_restore_state(cs, retaddr);
     env->pc += 4;
     cpu_loop_exit(cs);
 }
diff --git a/target/openrisc/sys_helper.c b/target/openrisc/sys_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/sys_helper.c
+++ b/target/openrisc/sys_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(mtspr)(CPUOpenRISCState *env, target_ulong spr, target_ulong rb)
         break;
 
     case TO_SPR(0, 16): /* NPC */
-        cpu_restore_state(cs, GETPC(), true);
+        cpu_restore_state(cs, GETPC());
         /* ??? Mirror or1ksim in not trashing delayed branch state
            when "jumping" to the current instruction.  */
         if (env->pc != rb) {
@@ -XXX,XX +XXX,XX @@ void HELPER(mtspr)(CPUOpenRISCState *env, target_ulong spr, target_ulong rb)
     case TO_SPR(8, 0):  /* PMR */
         env->pmr = rb;
         if (env->pmr & PMR_DME || env->pmr & PMR_SME) {
-            cpu_restore_state(cs, GETPC(), true);
+            cpu_restore_state(cs, GETPC());
             env->pc += 4;
             cs->halted = 1;
             raise_exception(cpu, EXCP_HALTED);
diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -XXX,XX +XXX,XX @@ void ppc_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
     uint32_t insn;
 
     /* Restore state and reload the insn we executed, for filling in DSISR.  */
-    cpu_restore_state(cs, retaddr, true);
+    cpu_restore_state(cs, retaddr);
     insn = cpu_ldl_code(env, env->nip);
 
     switch (env->mmu_model) {
diff --git a/target/s390x/tcg/excp_helper.c b/target/s390x/tcg/excp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/tcg/excp_helper.c
+++ b/target/s390x/tcg/excp_helper.c
@@ -XXX,XX +XXX,XX @@ G_NORETURN void tcg_s390_program_interrupt(CPUS390XState *env,
 {
     CPUState *cs = env_cpu(env);
 
-    cpu_restore_state(cs, ra, true);
+    cpu_restore_state(cs, ra);
     qemu_log_mask(CPU_LOG_INT, "program interrupt at %#" PRIx64 "\n",
                   env->psw.addr);
     trigger_pgm_exception(env, code);
diff --git a/target/tricore/op_helper.c b/target/tricore/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/op_helper.c
+++ b/target/tricore/op_helper.c
@@ -XXX,XX +XXX,XX @@ void raise_exception_sync_internal(CPUTriCoreState *env, uint32_t class, int tin
 {
     CPUState *cs = env_cpu(env);
     /* in case we come from a helper-call we need to restore the PC */
-    cpu_restore_state(cs, pc, true);
+    cpu_restore_state(cs, pc);
 
     /* Tin is loaded into d[15] */
     env->gpr_d[15] = tin;
diff --git a/target/xtensa/helper.c b/target/xtensa/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/helper.c
+++ b/target/xtensa/helper.c
@@ -XXX,XX +XXX,XX @@ void xtensa_cpu_do_unaligned_access(CPUState *cs,
 
     assert(xtensa_option_enabled(env->config,
                                  XTENSA_OPTION_UNALIGNED_EXCEPTION));
-    cpu_restore_state(CPU(cpu), retaddr, true);
+    cpu_restore_state(CPU(cpu), retaddr);
     HELPER(exception_cause_vaddr)(env,
                                   env->pc, LOAD_STORE_ALIGNMENT_CAUSE,
                                   addr);
@@ -XXX,XX +XXX,XX @@ bool xtensa_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
     } else if (probe) {
         return false;
     } else {
-        cpu_restore_state(cs, retaddr, true);
+        cpu_restore_state(cs, retaddr);
         HELPER(exception_cause_vaddr)(env, env->pc, ret, address);
     }
 }
@@ -XXX,XX +XXX,XX @@ void xtensa_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr, vaddr addr,
     XtensaCPU *cpu = XTENSA_CPU(cs);
     CPUXtensaState *env = &cpu->env;
 
-    cpu_restore_state(cs, retaddr, true);
+    cpu_restore_state(cs, retaddr);
     HELPER(exception_cause_vaddr)(env, env->pc,
                                   access_type == MMU_INST_FETCH ?
                                   INSTR_PIF_ADDR_ERROR_CAUSE :
-- 
2.34.1

The value passed is always true.

Reviewed-by: Claudio Fontana <cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/internal.h      |  2 +-
 accel/tcg/tb-maint.c      |  4 ++--
 accel/tcg/translate-all.c | 15 +++++++--------
 3 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/accel/tcg/internal.h b/accel/tcg/internal.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/internal.h
+++ b/accel/tcg/internal.h
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
                                tb_page_addr_t phys_page2);
 bool tb_invalidate_phys_page_unwind(tb_page_addr_t addr, uintptr_t pc);
 void cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
-                               uintptr_t host_pc, bool reset_icount);
+                               uintptr_t host_pc);
 
 /* Return the current PC from CPU, which may be cached in TB. */
 static inline target_ulong log_pc(CPUState *cpu, const TranslationBlock *tb)
diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -XXX,XX +XXX,XX @@ tb_invalidate_phys_page_range__locked(struct page_collection *pages,
                  * restore the CPU state.
                  */
                 current_tb_modified = true;
-                cpu_restore_state_from_tb(cpu, current_tb, retaddr, true);
+                cpu_restore_state_from_tb(cpu, current_tb, retaddr);
             }
 #endif /* TARGET_HAS_PRECISE_SMC */
             tb_phys_invalidate__locked(tb);
@@ -XXX,XX +XXX,XX @@ bool tb_invalidate_phys_page_unwind(tb_page_addr_t addr, uintptr_t pc)
              * function to partially restore the CPU state.
              */
             current_tb_modified = true;
-            cpu_restore_state_from_tb(cpu, current_tb, pc, true);
+            cpu_restore_state_from_tb(cpu, current_tb, pc);
         }
 #endif /* TARGET_HAS_PRECISE_SMC */
         tb_phys_invalidate(tb, addr);
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ static int cpu_unwind_data_from_tb(TranslationBlock *tb, uintptr_t host_pc,
 }
 
 /*
- * The cpu state corresponding to 'host_pc' is restored.
- * When reset_icount is true, current TB will be interrupted and
- * icount should be recalculated.
+ * The cpu state corresponding to 'host_pc' is restored in
+ * preparation for exiting the TB.
  */
 void cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
-                               uintptr_t host_pc, bool reset_icount)
+                               uintptr_t host_pc)
 {
     uint64_t data[TARGET_INSN_START_WORDS];
 #ifdef CONFIG_PROFILER
@@ -XXX,XX +XXX,XX @@ void cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
         return;
     }
 
-    if (reset_icount && (tb_cflags(tb) & CF_USE_ICOUNT)) {
+    if (tb_cflags(tb) & CF_USE_ICOUNT) {
         assert(icount_enabled());
         /*
          * Reset the cycle counter to the start of the block and
@@ -XXX,XX +XXX,XX @@ bool cpu_restore_state(CPUState *cpu, uintptr_t host_pc)
     if (in_code_gen_buffer((const void *)(host_pc - tcg_splitwx_diff))) {
         TranslationBlock *tb = tcg_tb_lookup(host_pc);
         if (tb) {
-            cpu_restore_state_from_tb(cpu, tb, host_pc, true);
+            cpu_restore_state_from_tb(cpu, tb, host_pc);
             return true;
         }
     }
@@ -XXX,XX +XXX,XX @@ void tb_check_watchpoint(CPUState *cpu, uintptr_t retaddr)
     tb = tcg_tb_lookup(retaddr);
     if (tb) {
         /* We can use retranslation to find the PC.  */
-        cpu_restore_state_from_tb(cpu, tb, retaddr, true);
+        cpu_restore_state_from_tb(cpu, tb, retaddr);
         tb_phys_invalidate(tb, -1);
     } else {
         /* The exception probably happened in a helper.  The CPU state should
@@ -XXX,XX +XXX,XX @@ void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr)
         cpu_abort(cpu, "cpu_io_recompile: could not find TB for pc=%p",
                   (void *)retaddr);
     }
-    cpu_restore_state_from_tb(cpu, tb, retaddr, true);
+    cpu_restore_state_from_tb(cpu, tb, retaddr);
 
     /*
      * Some guests must re-execute the branch when re-executing a delay
-- 
2.34.1

The helpers for reset_rf, cli, sti, clac, stac are
completely trivial; implement them inline.

Drop some nearby #if 0 code.

Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/i386/helper.h        |  5 -----
 target/i386/tcg/cc_helper.c | 41 -------------------------------------
 target/i386/tcg/translate.c | 30 ++++++++++++++++++++++-----
 3 files changed, 25 insertions(+), 51 deletions(-)

diff --git a/target/i386/helper.h b/target/i386/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/helper.h
+++ b/target/i386/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_2(syscall, void, env, int)
 DEF_HELPER_2(sysret, void, env, int)
 #endif
 DEF_HELPER_FLAGS_2(pause, TCG_CALL_NO_WG, noreturn, env, int)
-DEF_HELPER_1(reset_rf, void, env)
 DEF_HELPER_FLAGS_3(raise_interrupt, TCG_CALL_NO_WG, noreturn, env, int, int)
 DEF_HELPER_FLAGS_2(raise_exception, TCG_CALL_NO_WG, noreturn, env, int)
-DEF_HELPER_1(cli, void, env)
-DEF_HELPER_1(sti, void, env)
-DEF_HELPER_1(clac, void, env)
-DEF_HELPER_1(stac, void, env)
 DEF_HELPER_3(boundw, void, env, tl, int)
 DEF_HELPER_3(boundl, void, env, tl, int)
 
diff --git a/target/i386/tcg/cc_helper.c b/target/i386/tcg/cc_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/cc_helper.c
+++ b/target/i386/tcg/cc_helper.c
@@ -XXX,XX +XXX,XX @@ void helper_clts(CPUX86State *env)
     env->cr[0] &= ~CR0_TS_MASK;
     env->hflags &= ~HF_TS_MASK;
 }
-
-void helper_reset_rf(CPUX86State *env)
-{
-    env->eflags &= ~RF_MASK;
-}
-
-void helper_cli(CPUX86State *env)
-{
-    env->eflags &= ~IF_MASK;
-}
-
-void helper_sti(CPUX86State *env)
-{
-    env->eflags |= IF_MASK;
-}
-
-void helper_clac(CPUX86State *env)
-{
-    env->eflags &= ~AC_MASK;
-}
-
-void helper_stac(CPUX86State *env)
-{
-    env->eflags |= AC_MASK;
-}
-
-#if 0
-/* vm86plus instructions */
-void helper_cli_vm(CPUX86State *env)
-{
-    env->eflags &= ~VIF_MASK;
-}
-
-void helper_sti_vm(CPUX86State *env)
-{
-    env->eflags |= VIF_MASK;
-    if (env->eflags & VIP_MASK) {
-        raise_exception_ra(env, EXCP0D_GPF, GETPC());
-    }
-}
-#endif
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_reset_hflag(DisasContext *s, uint32_t mask)
     }
 }
 
+static void gen_set_eflags(DisasContext *s, target_ulong mask)
+{
+    TCGv t = tcg_temp_new();
+
+    tcg_gen_ld_tl(t, cpu_env, offsetof(CPUX86State, eflags));
+    tcg_gen_ori_tl(t, t, mask);
+    tcg_gen_st_tl(t, cpu_env, offsetof(CPUX86State, eflags));
+    tcg_temp_free(t);
+}
+
+static void gen_reset_eflags(DisasContext *s, target_ulong mask)
+{
+    TCGv t = tcg_temp_new();
+
+    tcg_gen_ld_tl(t, cpu_env, offsetof(CPUX86State, eflags));
+    tcg_gen_andi_tl(t, t, ~mask);
+    tcg_gen_st_tl(t, cpu_env, offsetof(CPUX86State, eflags));
+    tcg_temp_free(t);
+}
+
 /* Clear BND registers during legacy branches.  */
 static void gen_bnd_jmp(DisasContext *s)
 {
@@ -XXX,XX +XXX,XX @@ do_gen_eob_worker(DisasContext *s, bool inhibit, bool recheck_tf, bool jr)
     }
 
     if (s->base.tb->flags & HF_RF_MASK) {
-        gen_helper_reset_rf(cpu_env);
+        gen_reset_eflags(s, RF_MASK);
     }
     if (recheck_tf) {
         gen_helper_rechecking_single_step(cpu_env);
@@ -XXX,XX +XXX,XX @@ static bool disas_insn(DisasContext *s, CPUState *cpu)
 #endif
     case 0xfa: /* cli */
         if (check_iopl(s)) {
-            gen_helper_cli(cpu_env);
+            gen_reset_eflags(s, IF_MASK);
         }
         break;
     case 0xfb: /* sti */
         if (check_iopl(s)) {
-            gen_helper_sti(cpu_env);
+            gen_set_eflags(s, IF_MASK);
             /* interruptions are enabled only the first insn after sti */
             gen_update_eip_next(s);
             gen_eob_inhibit_irq(s, true);
@@ -XXX,XX +XXX,XX @@ static bool disas_insn(DisasContext *s, CPUState *cpu)
                 || CPL(s) != 0) {
                 goto illegal_op;
             }
-            gen_helper_clac(cpu_env);
+            gen_reset_eflags(s, AC_MASK);
             s->base.is_jmp = DISAS_EOB_NEXT;
             break;
 
@@ -XXX,XX +XXX,XX @@ static bool disas_insn(DisasContext *s, CPUState *cpu)
                 || CPL(s) != 0) {
                 goto illegal_op;
             }
-            gen_helper_stac(cpu_env);
+            gen_set_eflags(s, AC_MASK);
             s->base.is_jmp = DISAS_EOB_NEXT;
             break;
 
-- 
2.34.1