Series comparison

 [PULL 00/20] tcg patch queue
-The following changes since commit e93ded1bf6c94ab95015b33e188bc8b0b0c32670:
+The following changes since commit 9c6c079bc6723da8061ccfb44361d67b1dd785dd:
-  Merge tag 'testing-pull-request-2022-08-30' of https://gitlab.com/thuth/qemu into staging (2022-08-31 18:19:03 -0400)
+  Merge tag 'pull-target-arm-20240430' of https://git.linaro.org/people/pmaydell/qemu-arm into staging (2024-04-30 09:58:54 -0700)
 are available in the Git repository at:
-  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20220901
+  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20240501
-for you to fetch changes up to 20011be2e30b8aa8ef1fc258485f00c688703deb:
+for you to fetch changes up to 917d7f8d948d706e275c9f33169b9dd0149ded1e:
-  target/riscv: Make translator stop before the end of a page (2022-09-01 07:43:08 +0100)
+  plugins: Update the documentation block for plugin-gen.c (2024-04-30 16:12:05 -0700)
 ----------------------------------------------------------------
-Respect PROT_EXEC in user-only mode.
+plugins: Rewrite plugin tcg expansion
 Fix s390x, i386 and riscv for translations crossing a page.
 ----------------------------------------------------------------
-Ilya Leoshkevich (4):
+Richard Henderson (20):
-      linux-user: Clear translations on mprotect()
+      tcg: Make tcg/helper-info.h self-contained
-      accel/tcg: Introduce is_same_page()
+      tcg: Pass function pointer to tcg_gen_call*
-      target/s390x: Make translator stop before the end of a page
+      plugins: Zero new qemu_plugin_dyn_cb entries
-      target/i386: Make translator stop before the end of a page
+      plugins: Move function pointer in qemu_plugin_dyn_cb
       plugins: Create TCGHelperInfo for all out-of-line callbacks
       plugins: Use emit_before_op for PLUGIN_GEN_AFTER_INSN
       plugins: Use emit_before_op for PLUGIN_GEN_FROM_TB
       plugins: Add PLUGIN_GEN_AFTER_TB
       plugins: Use emit_before_op for PLUGIN_GEN_FROM_INSN
       plugins: Use emit_before_op for PLUGIN_GEN_FROM_MEM
       plugins: Remove plugin helpers
       tcg: Remove TCG_CALL_PLUGIN
       tcg: Remove INDEX_op_plugin_cb_{start,end}
       plugins: Simplify callback queues
       plugins: Introduce PLUGIN_CB_MEM_REGULAR
       plugins: Replace pr_ops with a proper debug dump flag
       plugins: Split out common cb expanders
       plugins: Merge qemu_plugin_tb_insn_get to plugin-gen.c
       plugins: Inline plugin_gen_empty_callback
       plugins: Update the documentation block for plugin-gen.c
-Richard Henderson (16):
+ accel/tcg/plugin-helpers.h         |    5 -
-      linux-user/arm: Mark the commpage executable
+ include/exec/helper-gen-common.h   |    4 -
-      linux-user/hppa: Allocate page zero as a commpage
+ include/exec/helper-proto-common.h |    4 -
-      linux-user/x86_64: Allocate vsyscall page as a commpage
+ include/exec/plugin-gen.h          |    4 -
-      linux-user: Honor PT_GNU_STACK
+ include/qemu/log.h                 |    1 +
-      tests/tcg/i386: Move smc_code2 to an executable section
+ include/qemu/plugin.h              |   67 +--
-      accel/tcg: Properly implement get_page_addr_code for user-only
+ include/tcg/helper-info.h          |    3 +
-      accel/tcg: Unlock mmap_lock after longjmp
+ include/tcg/tcg-op-common.h        |    4 +-
-      accel/tcg: Make tb_htable_lookup static
+ include/tcg/tcg-opc.h              |    4 +-
-      accel/tcg: Move qemu_ram_addr_from_host_nofail to physmem.c
+ include/tcg/tcg.h                  |   26 +-
-      accel/tcg: Use probe_access_internal for softmmu get_page_addr_code_hostp
+ include/exec/helper-gen.h.inc      |   24 +-
-      accel/tcg: Document the faulting lookup in tb_lookup_cmp
+ accel/tcg/plugin-gen.c             | 1007 +++++++++---------------------------
-      accel/tcg: Remove translator_ldsw
+ plugins/api.c                      |   26 +-
-      accel/tcg: Add pc and host_pc params to gen_intermediate_code
+ plugins/core.c                     |   61 ++-
-      accel/tcg: Add fast path for translator_ld*
+ tcg/tcg-op-ldst.c                  |    6 +-
-      target/riscv: Add MAX_INSN_LEN and insn_len
+ tcg/tcg-op.c                       |    8 +-
-      target/riscv: Make translator stop before the end of a page
+ tcg/tcg.c                          |   78 ++-
+ tcg/tci.c                          |    1 +
- include/elf.h                     |   1 +
+ util/log.c                         |    4 +
- include/exec/cpu-common.h         |   1 +
+files changed, 399 insertions(+), 938 deletions(-)
- include/exec/exec-all.h           |  89 ++++++++----------------
+ delete mode 100644 accel/tcg/plugin-helpers.h
  include/exec/translator.h         |  96 ++++++++++++++++---------
  linux-user/arm/target_cpu.h       |   4 +-
  linux-user/qemu.h                 |   1 +
  accel/tcg/cpu-exec.c              | 143 ++++++++++++++++++++------------------
  accel/tcg/cputlb.c                |  93 +++++++------------------
  accel/tcg/translate-all.c         |  29 ++++----
  accel/tcg/translator.c            | 135 ++++++++++++++++++++++++++---------
  accel/tcg/user-exec.c             |  17 ++++-
  linux-user/elfload.c              |  82 ++++++++++++++++++++--
  linux-user/mmap.c                 |   6 +-
  softmmu/physmem.c                 |  12 ++++
  target/alpha/translate.c          |   5 +-
  target/arm/translate.c            |   5 +-
  target/avr/translate.c            |   5 +-
  target/cris/translate.c           |   5 +-
  target/hexagon/translate.c        |   6 +-
  target/hppa/translate.c           |   5 +-
  target/i386/tcg/translate.c       |  71 +++++++++++--------
  target/loongarch/translate.c      |   6 +-
  target/m68k/translate.c           |   5 +-
  target/microblaze/translate.c     |   5 +-
  target/mips/tcg/translate.c       |   5 +-
  target/nios2/translate.c          |   5 +-
  target/openrisc/translate.c       |   6 +-
  target/ppc/translate.c            |   5 +-
  target/riscv/translate.c          |  32 +++++++--
  target/rx/translate.c             |   5 +-
  target/s390x/tcg/translate.c      |  20 ++++--
  target/sh4/translate.c            |   5 +-
  target/sparc/translate.c          |   5 +-
  target/tricore/translate.c        |   6 +-
  target/xtensa/translate.c         |   6 +-
  tests/tcg/i386/test-i386.c        |   2 +-
  tests/tcg/riscv64/noexec.c        |  79 +++++++++++++++++++++
  tests/tcg/s390x/noexec.c          | 106 ++++++++++++++++++++++++++++
  tests/tcg/x86_64/noexec.c         |  75 ++++++++++++++++++++
  tests/tcg/multiarch/noexec.c.inc  | 139 ++++++++++++++++++++++++++++++++++++
  tests/tcg/riscv64/Makefile.target |   1 +
  tests/tcg/s390x/Makefile.target   |   1 +
  tests/tcg/x86_64/Makefile.target  |   3 +-
 files changed, 966 insertions(+), 367 deletions(-)
  create mode 100644 tests/tcg/riscv64/noexec.c
  create mode 100644 tests/tcg/s390x/noexec.c
  create mode 100644 tests/tcg/x86_64/noexec.c
  create mode 100644 tests/tcg/multiarch/noexec.c.inc

-[PULL 1/4] target/avr: Support probe argument to tlb_fill
+[PULL 01/20] tcg: Make tcg/helper-info.h self-contained
-While there are no target-specific nonfaulting probes,
+Move MAX_CALL_IARGS from tcg.h and include for
-generic code may grow some uses at some point.
+the define of TCG_TARGET_REG_BITS.
-Note that the attrs argument was incorrect -- it should have
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-been MEMTXATTRS_UNSPECIFIED. Just use the simpler interface.
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/avr/helper.c | 46 ++++++++++++++++++++++++++++-----------------
+ include/tcg/helper-info.h | 3 +++
-file changed, 29 insertions(+), 17 deletions(-)
+ include/tcg/tcg.h         | 2 --
  tcg/tci.c                 | 1 +
 files changed, 4 insertions(+), 2 deletions(-)
-diff --git a/target/avr/helper.c b/target/avr/helper.c
+diff --git a/include/tcg/helper-info.h b/include/tcg/helper-info.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/avr/helper.c
+--- a/include/tcg/helper-info.h
-+++ b/target/avr/helper.c
++++ b/include/tcg/helper-info.h
-@@ -XXX,XX +XXX,XX @@ bool avr_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
+@@ -XXX,XX +XXX,XX @@
-                       MMUAccessType access_type, int mmu_idx,
+ #ifdef CONFIG_TCG_INTERPRETER
-                       bool probe, uintptr_t retaddr)
+ #include <ffi.h>
- {
+ #endif
--    int prot = 0;
++#include "tcg-target-reg-bits.h"
--    MemTxAttrs attrs = {};
++
-+    int prot, page_size = TARGET_PAGE_SIZE;
++#define MAX_CALL_IARGS  7
-     uint32_t paddr;
+ /*
-     address &= TARGET_PAGE_MASK;
+  * Describe the calling convention of a given argument type.
+diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
-     if (mmu_idx == MMU_CODE_IDX) {
+index XXXXXXX..XXXXXXX 100644
--        /* access to code in flash */
+--- a/include/tcg/tcg.h
-+        /* Access to code in flash. */
++++ b/include/tcg/tcg.h
-         paddr = OFFSET_CODE + address;
+@@ -XXX,XX +XXX,XX @@
-         prot = PAGE_READ | PAGE_EXEC;
+ /* XXX: make safe guess about sizes */
--        if (paddr + TARGET_PAGE_SIZE > OFFSET_DATA) {
+ #define MAX_OP_PER_INSTR 266
-+        if (paddr >= OFFSET_DATA) {
-+            /*
+-#define MAX_CALL_IARGS  7
 +             * This should not be possible via any architectural operations.
 +             * There is certainly not an exception that we can deliver.
 +             * Accept probing that might come from generic code.
 +             */
 +            if (probe) {
 +                return false;
 +            }
              error_report("execution left flash memory");
              abort();
          }
 -    } else if (address < NUMBER_OF_CPU_REGISTERS + NUMBER_OF_IO_REGISTERS) {
 -        /*
 -         * access to CPU registers, exit and rebuilt this TB to use full access
 -         * incase it touches specially handled registers like SREG or SP
 -         */
 -        AVRCPU *cpu = AVR_CPU(cs);
 -        CPUAVRState *env = &cpu->env;
 -        env->fullacc = 1;
 -        cpu_loop_exit_restore(cs, retaddr);
      } else {
 -        /* access to memory. nothing special */
 +        /* Access to memory. */
          paddr = OFFSET_DATA + address;
          prot = PAGE_READ | PAGE_WRITE;
 +        if (address < NUMBER_OF_CPU_REGISTERS + NUMBER_OF_IO_REGISTERS) {
 +            /*
 +             * Access to CPU registers, exit and rebuilt this TB to use
 +             * full access in case it touches specially handled registers
 +             * like SREG or SP.  For probing, set page_size = 1, in order
 +             * to force tlb_fill to be called for the next access.
 +             */
 +            if (probe) {
 +                page_size = 1;
 +            } else {
 +                AVRCPU *cpu = AVR_CPU(cs);
 +                CPUAVRState *env = &cpu->env;
 +                env->fullacc = 1;
 +                cpu_loop_exit_restore(cs, retaddr);
 +            }
 +        }
      }
 -    tlb_set_page_with_attrs(cs, address, paddr, attrs, prot,
 -                            mmu_idx, TARGET_PAGE_SIZE);
 -
-+    tlb_set_page(cs, address, paddr, prot, mmu_idx, page_size);
+ #define CPU_TEMP_BUF_NLONGS 128
-     return true;
+ #define TCG_STATIC_FRAME_SIZE  (CPU_TEMP_BUF_NLONGS * sizeof(long))
- }
 diff --git a/tcg/tci.c b/tcg/tci.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci.c
 +++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "tcg/tcg.h"
 +#include "tcg/helper-info.h"
  #include "tcg/tcg-ldst.h"
  #include <ffi.h>
 --
 .34.1

-[PULL 4/4] target/avr: Disable interrupts when env->skip set
+[PULL 02/20] tcg: Pass function pointer to tcg_gen_call*
-This bit is not saved across interrupts, so we must
+For normal helpers, read the function pointer from the
-delay delivering the interrupt until the skip has
+structure earlier.  For plugins, this will allow the
-been processed.
+function pointer to come from elsewhere.
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1118
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/avr/helper.c    |  9 +++++++++
+ include/tcg/tcg.h             | 21 +++++++++-------
- target/avr/translate.c | 26 ++++++++++++++++++++++----
+ include/exec/helper-gen.h.inc | 24 ++++++++++++-------
-files changed, 31 insertions(+), 4 deletions(-)
+ tcg/tcg.c                     | 45 +++++++++++++++++++----------------
+files changed, 52 insertions(+), 38 deletions(-)
-diff --git a/target/avr/helper.c b/target/avr/helper.c
 diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/avr/helper.c
+--- a/include/tcg/tcg.h
-+++ b/target/avr/helper.c
++++ b/include/tcg/tcg.h
-@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
+@@ -XXX,XX +XXX,XX @@ typedef struct TCGTargetOpDef {
-     AVRCPU *cpu = AVR_CPU(cs);
-     CPUAVRState *env = &cpu->env;
+ bool tcg_op_supported(TCGOpcode op);
-+    /*
+-void tcg_gen_call0(TCGHelperInfo *, TCGTemp *ret);
-+     * We cannot separate a skip from the next instruction,
+-void tcg_gen_call1(TCGHelperInfo *, TCGTemp *ret, TCGTemp *);
-+     * as the skip would not be preserved across the interrupt.
+-void tcg_gen_call2(TCGHelperInfo *, TCGTemp *ret, TCGTemp *, TCGTemp *);
-+     * Separating the two insn normally only happens at page boundaries.
+-void tcg_gen_call3(TCGHelperInfo *, TCGTemp *ret, TCGTemp *,
-+     */
++void tcg_gen_call0(void *func, TCGHelperInfo *, TCGTemp *ret);
-+    if (env->skip) {
++void tcg_gen_call1(void *func, TCGHelperInfo *, TCGTemp *ret, TCGTemp *);
-+        return false;
++void tcg_gen_call2(void *func, TCGHelperInfo *, TCGTemp *ret,
-+    }
+                    TCGTemp *, TCGTemp *);
-+
+-void tcg_gen_call4(TCGHelperInfo *, TCGTemp *ret, TCGTemp *, TCGTemp *,
-     if (interrupt_request & CPU_INTERRUPT_RESET) {
+-                   TCGTemp *, TCGTemp *);
-         if (cpu_interrupts_enabled(env)) {
+-void tcg_gen_call5(TCGHelperInfo *, TCGTemp *ret, TCGTemp *, TCGTemp *,
-             cs->exception_index = EXCP_RESET;
++void tcg_gen_call3(void *func, TCGHelperInfo *, TCGTemp *ret,
-diff --git a/target/avr/translate.c b/target/avr/translate.c
+                    TCGTemp *, TCGTemp *, TCGTemp *);
 -void tcg_gen_call6(TCGHelperInfo *, TCGTemp *ret, TCGTemp *, TCGTemp *,
 +void tcg_gen_call4(void *func, TCGHelperInfo *, TCGTemp *ret,
                     TCGTemp *, TCGTemp *, TCGTemp *, TCGTemp *);
 -void tcg_gen_call7(TCGHelperInfo *, TCGTemp *ret, TCGTemp *, TCGTemp *,
 +void tcg_gen_call5(void *func, TCGHelperInfo *, TCGTemp *ret,
                     TCGTemp *, TCGTemp *, TCGTemp *, TCGTemp *, TCGTemp *);
 +void tcg_gen_call6(void *func, TCGHelperInfo *, TCGTemp *ret,
 +                   TCGTemp *, TCGTemp *, TCGTemp *, TCGTemp *,
 +                   TCGTemp *, TCGTemp *);
 +void tcg_gen_call7(void *func, TCGHelperInfo *, TCGTemp *ret,
 +                   TCGTemp *, TCGTemp *, TCGTemp *, TCGTemp *,
 +                   TCGTemp *, TCGTemp *, TCGTemp *);
  TCGOp *tcg_emit_op(TCGOpcode opc, unsigned nargs);
  void tcg_op_remove(TCGContext *s, TCGOp *op);
 diff --git a/include/exec/helper-gen.h.inc b/include/exec/helper-gen.h.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/avr/translate.c
+--- a/include/exec/helper-gen.h.inc
-+++ b/target/avr/translate.c
++++ b/include/exec/helper-gen.h.inc
-@@ -XXX,XX +XXX,XX @@ static void avr_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
+@@ -XXX,XX +XXX,XX @@
-     if (skip_label) {
+ extern TCGHelperInfo glue(helper_info_, name);                          \
-         canonicalize_skip(ctx);
+ static inline void glue(gen_helper_, name)(dh_retvar_decl0(ret))        \
-         gen_set_label(skip_label);
+ {                                                                       \
--        if (ctx->base.is_jmp == DISAS_NORETURN) {
+-    tcg_gen_call0(&glue(helper_info_, name), dh_retvar(ret));           \
-+
++    tcg_gen_call0(glue(helper_info_,name).func,                         \
-+        switch (ctx->base.is_jmp) {
++                  &glue(helper_info_,name), dh_retvar(ret));            \
-+        case DISAS_NORETURN:
+ }
-             ctx->base.is_jmp = DISAS_CHAIN;
-+            break;
+ #define DEF_HELPER_FLAGS_1(name, flags, ret, t1)                        \
-+        case DISAS_NEXT:
+@@ -XXX,XX +XXX,XX @@ extern TCGHelperInfo glue(helper_info_, name);                          \
-+            if (ctx->base.tb->flags & TB_FLAGS_SKIP) {
+ static inline void glue(gen_helper_, name)(dh_retvar_decl(ret)          \
-+                ctx->base.is_jmp = DISAS_TOO_MANY;
+     dh_arg_decl(t1, 1))                                                 \
-+            }
+ {                                                                       \
-+            break;
+-    tcg_gen_call1(&glue(helper_info_, name), dh_retvar(ret),            \
-+        default:
++    tcg_gen_call1(glue(helper_info_,name).func,                         \
-+            break;
++                  &glue(helper_info_,name), dh_retvar(ret),             \
                    dh_arg(t1, 1));                                       \
  }
@@ -XXX,XX +XXX,XX @@ extern TCGHelperInfo glue(helper_info_, name);                          \
  static inline void glue(gen_helper_, name)(dh_retvar_decl(ret)          \
      dh_arg_decl(t1, 1), dh_arg_decl(t2, 2))                             \
  {                                                                       \
 -    tcg_gen_call2(&glue(helper_info_, name), dh_retvar(ret),            \
 +    tcg_gen_call2(glue(helper_info_,name).func,                         \
 +                  &glue(helper_info_,name), dh_retvar(ret),             \
                    dh_arg(t1, 1), dh_arg(t2, 2));                        \
  }
@@ -XXX,XX +XXX,XX @@ extern TCGHelperInfo glue(helper_info_, name);                          \
  static inline void glue(gen_helper_, name)(dh_retvar_decl(ret)          \
      dh_arg_decl(t1, 1), dh_arg_decl(t2, 2), dh_arg_decl(t3, 3))         \
  {                                                                       \
 -    tcg_gen_call3(&glue(helper_info_, name), dh_retvar(ret),            \
 +    tcg_gen_call3(glue(helper_info_,name).func,                         \
 +                  &glue(helper_info_,name), dh_retvar(ret),             \
                    dh_arg(t1, 1), dh_arg(t2, 2), dh_arg(t3, 3));         \
  }
@@ -XXX,XX +XXX,XX @@ static inline void glue(gen_helper_, name)(dh_retvar_decl(ret)          \
      dh_arg_decl(t1, 1), dh_arg_decl(t2, 2),                             \
      dh_arg_decl(t3, 3), dh_arg_decl(t4, 4))                             \
  {                                                                       \
 -    tcg_gen_call4(&glue(helper_info_, name), dh_retvar(ret),            \
 +    tcg_gen_call4(glue(helper_info_,name).func,                         \
 +                  &glue(helper_info_,name), dh_retvar(ret),             \
                    dh_arg(t1, 1), dh_arg(t2, 2),                         \
                    dh_arg(t3, 3), dh_arg(t4, 4));                        \
  }
@@ -XXX,XX +XXX,XX @@ static inline void glue(gen_helper_, name)(dh_retvar_decl(ret)          \
      dh_arg_decl(t1, 1), dh_arg_decl(t2, 2), dh_arg_decl(t3, 3),         \
      dh_arg_decl(t4, 4), dh_arg_decl(t5, 5))                             \
  {                                                                       \
 -    tcg_gen_call5(&glue(helper_info_, name), dh_retvar(ret),            \
 +    tcg_gen_call5(glue(helper_info_,name).func,                         \
 +                  &glue(helper_info_,name), dh_retvar(ret),             \
                    dh_arg(t1, 1), dh_arg(t2, 2), dh_arg(t3, 3),          \
                    dh_arg(t4, 4), dh_arg(t5, 5));                        \
  }
@@ -XXX,XX +XXX,XX @@ static inline void glue(gen_helper_, name)(dh_retvar_decl(ret)          \
      dh_arg_decl(t1, 1), dh_arg_decl(t2, 2), dh_arg_decl(t3, 3),         \
      dh_arg_decl(t4, 4), dh_arg_decl(t5, 5), dh_arg_decl(t6, 6))         \
  {                                                                       \
 -    tcg_gen_call6(&glue(helper_info_, name), dh_retvar(ret),            \
 +    tcg_gen_call6(glue(helper_info_,name).func,                         \
 +                  &glue(helper_info_,name), dh_retvar(ret),             \
                    dh_arg(t1, 1), dh_arg(t2, 2), dh_arg(t3, 3),          \
                    dh_arg(t4, 4), dh_arg(t5, 5), dh_arg(t6, 6));         \
  }
@@ -XXX,XX +XXX,XX @@ static inline void glue(gen_helper_, name)(dh_retvar_decl(ret)          \
      dh_arg_decl(t4, 4), dh_arg_decl(t5, 5), dh_arg_decl(t6, 6),         \
      dh_arg_decl(t7, 7))                                                 \
  {                                                                       \
 -    tcg_gen_call7(&glue(helper_info_, name), dh_retvar(ret),            \
 +    tcg_gen_call7(glue(helper_info_,name).func,                         \
 +                  &glue(helper_info_,name), dh_retvar(ret),             \
                    dh_arg(t1, 1), dh_arg(t2, 2), dh_arg(t3, 3),          \
                    dh_arg(t4, 4), dh_arg(t5, 5), dh_arg(t6, 6),          \
                    dh_arg(t7, 7));                                       \
 diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg.c
 +++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ bool tcg_op_supported(TCGOpcode op)
  static TCGOp *tcg_op_alloc(TCGOpcode opc, unsigned nargs);
 -static void tcg_gen_callN(TCGHelperInfo *info, TCGTemp *ret, TCGTemp **args)
 +static void tcg_gen_callN(void *func, TCGHelperInfo *info,
 +                          TCGTemp *ret, TCGTemp **args)
  {
      TCGv_i64 extend_free[MAX_CALL_IARGS];
      int n_extend = 0;
@@ -XXX,XX +XXX,XX @@ static void tcg_gen_callN(TCGHelperInfo *info, TCGTemp *ret, TCGTemp **args)
              g_assert_not_reached();
          }
      }
+-    op->args[pi++] = (uintptr_t)info->func;
-@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
++    op->args[pi++] = (uintptr_t)func;
- {
+     op->args[pi++] = (uintptr_t)info;
-     DisasContext *ctx = container_of(dcbase, DisasContext, base);
+     tcg_debug_assert(pi == total_args);
-     bool nonconst_skip = canonicalize_skip(ctx);
-+    /*
+@@ -XXX,XX +XXX,XX @@ static void tcg_gen_callN(TCGHelperInfo *info, TCGTemp *ret, TCGTemp **args)
-+     * Because we disable interrupts while env->skip is set,
+     }
-+     * we must return to the main loop to re-evaluate afterward.
+ }
-+     */
-+    bool force_exit = ctx->base.tb->flags & TB_FLAGS_SKIP;
+-void tcg_gen_call0(TCGHelperInfo *info, TCGTemp *ret)
++void tcg_gen_call0(void *func, TCGHelperInfo *info, TCGTemp *ret)
-     switch (ctx->base.is_jmp) {
+ {
-     case DISAS_NORETURN:
+-    tcg_gen_callN(info, ret, NULL);
-@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
++    tcg_gen_callN(func, info, ret, NULL);
-     case DISAS_NEXT:
+ }
-     case DISAS_TOO_MANY:
-     case DISAS_CHAIN:
+-void tcg_gen_call1(TCGHelperInfo *info, TCGTemp *ret, TCGTemp *t1)
--        if (!nonconst_skip) {
++void tcg_gen_call1(void *func, TCGHelperInfo *info, TCGTemp *ret, TCGTemp *t1)
-+        if (!nonconst_skip && !force_exit) {
+ {
-             /* Note gen_goto_tb checks singlestep.  */
+-    tcg_gen_callN(info, ret, &t1);
-             gen_goto_tb(ctx, 1, ctx->npc);
++    tcg_gen_callN(func, info, ret, &t1);
-             break;
+ }
-@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
-         tcg_gen_movi_tl(cpu_pc, ctx->npc);
+-void tcg_gen_call2(TCGHelperInfo *info, TCGTemp *ret, TCGTemp *t1, TCGTemp *t2)
-         /* fall through */
++void tcg_gen_call2(void *func, TCGHelperInfo *info, TCGTemp *ret,
-     case DISAS_LOOKUP:
++                   TCGTemp *t1, TCGTemp *t2)
--        tcg_gen_lookup_and_goto_ptr();
+ {
--        break;
+     TCGTemp *args[2] = { t1, t2 };
-+        if (!force_exit) {
+-    tcg_gen_callN(info, ret, args);
-+            tcg_gen_lookup_and_goto_ptr();
++    tcg_gen_callN(func, info, ret, args);
-+            break;
+ }
-+        }
-+        /* fall through */
+-void tcg_gen_call3(TCGHelperInfo *info, TCGTemp *ret, TCGTemp *t1,
-     case DISAS_EXIT:
+-                   TCGTemp *t2, TCGTemp *t3)
-         tcg_gen_exit_tb(NULL, 0);
++void tcg_gen_call3(void *func, TCGHelperInfo *info, TCGTemp *ret,
-         break;
++                   TCGTemp *t1, TCGTemp *t2, TCGTemp *t3)
  {
      TCGTemp *args[3] = { t1, t2, t3 };
 -    tcg_gen_callN(info, ret, args);
 +    tcg_gen_callN(func, info, ret, args);
  }
 -void tcg_gen_call4(TCGHelperInfo *info, TCGTemp *ret, TCGTemp *t1,
 -                   TCGTemp *t2, TCGTemp *t3, TCGTemp *t4)
 +void tcg_gen_call4(void *func, TCGHelperInfo *info, TCGTemp *ret,
 +                   TCGTemp *t1, TCGTemp *t2, TCGTemp *t3, TCGTemp *t4)
  {
      TCGTemp *args[4] = { t1, t2, t3, t4 };
 -    tcg_gen_callN(info, ret, args);
 +    tcg_gen_callN(func, info, ret, args);
  }
 -void tcg_gen_call5(TCGHelperInfo *info, TCGTemp *ret, TCGTemp *t1,
 +void tcg_gen_call5(void *func, TCGHelperInfo *info, TCGTemp *ret, TCGTemp *t1,
                     TCGTemp *t2, TCGTemp *t3, TCGTemp *t4, TCGTemp *t5)
  {
      TCGTemp *args[5] = { t1, t2, t3, t4, t5 };
 -    tcg_gen_callN(info, ret, args);
 +    tcg_gen_callN(func, info, ret, args);
  }
 -void tcg_gen_call6(TCGHelperInfo *info, TCGTemp *ret, TCGTemp *t1, TCGTemp *t2,
 -                   TCGTemp *t3, TCGTemp *t4, TCGTemp *t5, TCGTemp *t6)
 +void tcg_gen_call6(void *func, TCGHelperInfo *info, TCGTemp *ret,
 +                   TCGTemp *t1, TCGTemp *t2, TCGTemp *t3,
 +                   TCGTemp *t4, TCGTemp *t5, TCGTemp *t6)
  {
      TCGTemp *args[6] = { t1, t2, t3, t4, t5, t6 };
 -    tcg_gen_callN(info, ret, args);
 +    tcg_gen_callN(func, info, ret, args);
  }
 -void tcg_gen_call7(TCGHelperInfo *info, TCGTemp *ret, TCGTemp *t1,
 +void tcg_gen_call7(void *func, TCGHelperInfo *info, TCGTemp *ret, TCGTemp *t1,
                     TCGTemp *t2, TCGTemp *t3, TCGTemp *t4,
                     TCGTemp *t5, TCGTemp *t6, TCGTemp *t7)
  {
      TCGTemp *args[7] = { t1, t2, t3, t4, t5, t6, t7 };
 -    tcg_gen_callN(info, ret, args);
 +    tcg_gen_callN(func, info, ret, args);
  }
  static void tcg_reg_alloc_start(TCGContext *s)
 --
 .34.1

-[PULL 09/20] accel/tcg: Unlock mmap_lock after longjmp
+[PULL 03/20] plugins: Zero new qemu_plugin_dyn_cb entries
-The mmap_lock is held around tb_gen_code.  While the comment
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 is correct that the lock is dropped when tb_gen_code runs out
 of memory, the lock is *not* dropped when an exception is
 raised reading code for translation.
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/cpu-exec.c  | 12 ++++++------
+ plugins/core.c | 2 +-
- accel/tcg/user-exec.c |  3 ---
+file changed, 1 insertion(+), 1 deletion(-)
 files changed, 6 insertions(+), 9 deletions(-)
-diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
+diff --git a/plugins/core.c b/plugins/core.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cpu-exec.c
+--- a/plugins/core.c
-+++ b/accel/tcg/cpu-exec.c
++++ b/plugins/core.c
-@@ -XXX,XX +XXX,XX @@ void cpu_exec_step_atomic(CPUState *cpu)
+@@ -XXX,XX +XXX,XX @@ static struct qemu_plugin_dyn_cb *plugin_get_dyn_cb(GArray **arr)
-         cpu_tb_exec(cpu, tb, &tb_exit);
+     GArray *cbs = *arr;
-         cpu_exec_exit(cpu);
-     } else {
+     if (!cbs) {
--        /*
+-        cbs = g_array_sized_new(false, false,
--         * The mmap_lock is dropped by tb_gen_code if it runs out of
++        cbs = g_array_sized_new(false, true,
--         * memory.
+                                 sizeof(struct qemu_plugin_dyn_cb), 1);
--         */
+         *arr = cbs;
  #ifndef CONFIG_SOFTMMU
          clear_helper_retaddr();
 -        tcg_debug_assert(!have_mmap_lock());
 +        if (have_mmap_lock()) {
 +            mmap_unlock();
 +        }
  #endif
          if (qemu_mutex_iothread_locked()) {
              qemu_mutex_unlock_iothread();
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
  #ifndef CONFIG_SOFTMMU
          clear_helper_retaddr();
 -        tcg_debug_assert(!have_mmap_lock());
 +        if (have_mmap_lock()) {
 +            mmap_unlock();
 +        }
  #endif
          if (qemu_mutex_iothread_locked()) {
              qemu_mutex_unlock_iothread();
 diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/user-exec.c
 +++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ MMUAccessType adjust_signal_pc(uintptr_t *pc, bool is_write)
           * (and if the translator doesn't handle page boundaries correctly
           * there's little we can do about that here).  Therefore, do not
           * trigger the unwinder.
 -         *
 -         * Like tb_gen_code, release the memory lock before cpu_loop_exit.
           */
 -        mmap_unlock();
          *pc = 0;
          return MMU_INST_FETCH;
      }
 --
 .34.1

-[PULL 3/4] target/avr: Only execute one interrupt at a time
+[PULL 04/20] plugins: Move function pointer in qemu_plugin_dyn_cb
-We cannot deliver two interrupts simultaneously;
+The out-of-line function pointer is mutually exclusive
-the first interrupt handler must execute first.
+with inline expansion, so move it into the union.
 Wrap the pointer in a structure named 'regular' to match
 PLUGIN_CB_REGULAR.
-Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/avr/helper.c | 9 +++------
+ include/qemu/plugin.h  | 4 +++-
-file changed, 3 insertions(+), 6 deletions(-)
+ accel/tcg/plugin-gen.c | 4 ++--
  plugins/core.c         | 8 ++++----
 files changed, 9 insertions(+), 7 deletions(-)
-diff --git a/target/avr/helper.c b/target/avr/helper.c
+diff --git a/include/qemu/plugin.h b/include/qemu/plugin.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/avr/helper.c
+--- a/include/qemu/plugin.h
-+++ b/target/avr/helper.c
++++ b/include/qemu/plugin.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ enum plugin_dyn_cb_subtype {
+  * instance of a callback to be called upon the execution of a particular TB.
- bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
+  */
- {
+ struct qemu_plugin_dyn_cb {
--    bool ret = false;
+-    union qemu_plugin_cb_sig f;
-     AVRCPU *cpu = AVR_CPU(cs);
+     void *userp;
-     CPUAVRState *env = &cpu->env;
+     enum plugin_dyn_cb_subtype type;
+     /* @rw applies to mem callbacks only (both regular and inline) */
-@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
+     enum qemu_plugin_mem_rw rw;
-             avr_cpu_do_interrupt(cs);
+     /* fields specific to each dyn_cb type go here */
+     union {
-             cs->interrupt_request &= ~CPU_INTERRUPT_RESET;
++        struct {
--
++            union qemu_plugin_cb_sig f;
--            ret = true;
++        } regular;
-+            return true;
+         struct {
              qemu_plugin_u64 entry;
              enum qemu_plugin_op op;
 diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/plugin-gen.c
 +++ b/accel/tcg/plugin-gen.c
@@ -XXX,XX +XXX,XX @@ static TCGOp *append_udata_cb(const struct qemu_plugin_dyn_cb *cb,
      }
      /* call */
 -    op = copy_call(&begin_op, op, cb->f.vcpu_udata, cb_idx);
 +    op = copy_call(&begin_op, op, cb->regular.f.vcpu_udata, cb_idx);
      return op;
  }
@@ -XXX,XX +XXX,XX @@ static TCGOp *append_mem_cb(const struct qemu_plugin_dyn_cb *cb,
      if (type == PLUGIN_GEN_CB_MEM) {
          /* call */
 -        op = copy_call(&begin_op, op, cb->f.vcpu_udata, cb_idx);
 +        op = copy_call(&begin_op, op, cb->regular.f.vcpu_udata, cb_idx);
      }
      return op;
 diff --git a/plugins/core.c b/plugins/core.c
 index XXXXXXX..XXXXXXX 100644
 --- a/plugins/core.c
 +++ b/plugins/core.c
@@ -XXX,XX +XXX,XX @@ void plugin_register_dyn_cb__udata(GArray **arr,
      dyn_cb->userp = udata;
      /* Note flags are discarded as unused. */
 -    dyn_cb->f.vcpu_udata = cb;
 +    dyn_cb->regular.f.vcpu_udata = cb;
      dyn_cb->type = PLUGIN_CB_REGULAR;
  }
@@ -XXX,XX +XXX,XX @@ void plugin_register_vcpu_mem_cb(GArray **arr,
      /* Note flags are discarded as unused. */
      dyn_cb->type = PLUGIN_CB_REGULAR;
      dyn_cb->rw = rw;
 -    dyn_cb->f.generic = cb;
 +    dyn_cb->regular.f.vcpu_mem = cb;
  }
  /*
@@ -XXX,XX +XXX,XX @@ void qemu_plugin_vcpu_mem_cb(CPUState *cpu, uint64_t vaddr,
          }
-     }
+         switch (cb->type) {
-     if (interrupt_request & CPU_INTERRUPT_HARD) {
+         case PLUGIN_CB_REGULAR:
-@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
+-            cb->f.vcpu_mem(cpu->cpu_index, make_plugin_meminfo(oi, rw),
-             if (!env->intsrc) {
+-                           vaddr, cb->userp);
-                 cs->interrupt_request &= ~CPU_INTERRUPT_HARD;
++            cb->regular.f.vcpu_mem(cpu->cpu_index, make_plugin_meminfo(oi, rw),
-             }
++                                   vaddr, cb->userp);
--
+             break;
--            ret = true;
+         case PLUGIN_CB_INLINE:
-+            return true;
+             exec_inline_op(cb, cpu->cpu_index);
          }
      }
 -    return ret;
 +    return false;
  }
  void avr_cpu_do_interrupt(CPUState *cs)
 --
 .34.1

-[PULL 20/20] target/riscv: Make translator stop before the end of a page
+[PULL 05/20] plugins: Create TCGHelperInfo for all out-of-line callbacks
-Right now the translator stops right *after* the end of a page, which
+TCGHelperInfo includes the ABI for every function call.
 breaks reporting of fault locations when the last instruction of a
 multi-insn translation block crosses a page boundary.
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1155
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/riscv/translate.c          | 17 +++++--
+ include/qemu/plugin.h |  1 +
- tests/tcg/riscv64/noexec.c        | 79 +++++++++++++++++++++++++++++++
+ plugins/core.c        | 51 ++++++++++++++++++++++++++++++++++++++-----
- tests/tcg/riscv64/Makefile.target |  1 +
+files changed, 46 insertions(+), 6 deletions(-)
 files changed, 93 insertions(+), 4 deletions(-)
  create mode 100644 tests/tcg/riscv64/noexec.c
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
+diff --git a/include/qemu/plugin.h b/include/qemu/plugin.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
+--- a/include/qemu/plugin.h
-+++ b/target/riscv/translate.c
++++ b/include/qemu/plugin.h
-@@ -XXX,XX +XXX,XX @@ static void riscv_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
+@@ -XXX,XX +XXX,XX @@ struct qemu_plugin_dyn_cb {
-     }
+     union {
-     ctx->nftemp = 0;
+         struct {
+             union qemu_plugin_cb_sig f;
-+    /* Only the first insn within a TB is allowed to cross a page boundary. */
++            TCGHelperInfo *info;
-     if (ctx->base.is_jmp == DISAS_NEXT) {
+         } regular;
--        target_ulong page_start;
+         struct {
--
+             qemu_plugin_u64 entry;
--        page_start = ctx->base.pc_first & TARGET_PAGE_MASK;
+diff --git a/plugins/core.c b/plugins/core.c
--        if (ctx->base.pc_next - page_start >= TARGET_PAGE_SIZE) {
+index XXXXXXX..XXXXXXX 100644
-+        if (!is_same_page(&ctx->base, ctx->base.pc_next)) {
+--- a/plugins/core.c
-             ctx->base.is_jmp = DISAS_TOO_MANY;
++++ b/plugins/core.c
-+        } else {
+@@ -XXX,XX +XXX,XX @@ void plugin_register_dyn_cb__udata(GArray **arr,
-+            unsigned page_ofs = ctx->base.pc_next & ~TARGET_PAGE_MASK;
+                                    enum qemu_plugin_cb_flags flags,
                                     void *udata)
  {
 -    struct qemu_plugin_dyn_cb *dyn_cb = plugin_get_dyn_cb(arr);
 +    static TCGHelperInfo info[3] = {
 +        [QEMU_PLUGIN_CB_NO_REGS].flags = TCG_CALL_NO_RWG | TCG_CALL_PLUGIN,
 +        [QEMU_PLUGIN_CB_R_REGS].flags = TCG_CALL_NO_WG | TCG_CALL_PLUGIN,
 +        [QEMU_PLUGIN_CB_RW_REGS].flags = TCG_CALL_PLUGIN,
 +        /*
 +         * Match qemu_plugin_vcpu_udata_cb_t:
 +         *   void (*)(uint32_t, void *)
 +         */
 +        [0 ... 2].typemask = (dh_typemask(void, 0) |
 +                              dh_typemask(i32, 1) |
 +                              dh_typemask(ptr, 2))
 +    };
 +    struct qemu_plugin_dyn_cb *dyn_cb = plugin_get_dyn_cb(arr);
      dyn_cb->userp = udata;
 -    /* Note flags are discarded as unused. */
 -    dyn_cb->regular.f.vcpu_udata = cb;
      dyn_cb->type = PLUGIN_CB_REGULAR;
 +    dyn_cb->regular.f.vcpu_udata = cb;
 +
-+            if (page_ofs > TARGET_PAGE_SIZE - MAX_INSN_LEN) {
++    assert((unsigned)flags < ARRAY_SIZE(info));
-+                uint16_t next_insn = cpu_lduw_code(env, ctx->base.pc_next);
++    dyn_cb->regular.info = &info[flags];
 +                int len = insn_len(next_insn);
 +
 +                if (!is_same_page(&ctx->base, ctx->base.pc_next + len)) {
 +                    ctx->base.is_jmp = DISAS_TOO_MANY;
 +                }
 +            }
          }
      }
  }
-diff --git a/tests/tcg/riscv64/noexec.c b/tests/tcg/riscv64/noexec.c
-new file mode 100644
+ void plugin_register_vcpu_mem_cb(GArray **arr,
-index XXXXXXX..XXXXXXX
+@@ -XXX,XX +XXX,XX @@ void plugin_register_vcpu_mem_cb(GArray **arr,
---- /dev/null
+                                  enum qemu_plugin_mem_rw rw,
-+++ b/tests/tcg/riscv64/noexec.c
+                                  void *udata)
-@@ -XXX,XX +XXX,XX @@
+ {
-+#include "../multiarch/noexec.c.inc"
+-    struct qemu_plugin_dyn_cb *dyn_cb;
-+
++    /*
-+static void *arch_mcontext_pc(const mcontext_t *ctx)
++     * Expect that the underlying type for enum qemu_plugin_meminfo_t
-+{
++     * is either int32_t or uint32_t, aka int or unsigned int.
-+    return (void *)ctx->__gregs[REG_PC];
++     */
-+}
++    QEMU_BUILD_BUG_ON(
-+
++        !__builtin_types_compatible_p(qemu_plugin_meminfo_t, uint32_t) &&
-+static int arch_mcontext_arg(const mcontext_t *ctx)
++        !__builtin_types_compatible_p(qemu_plugin_meminfo_t, int32_t));
-+{
-+    return ctx->__gregs[REG_A0];
+-    dyn_cb = plugin_get_dyn_cb(arr);
-+}
++    static TCGHelperInfo info[3] = {
-+
++        [QEMU_PLUGIN_CB_NO_REGS].flags = TCG_CALL_NO_RWG | TCG_CALL_PLUGIN,
-+static void arch_flush(void *p, int len)
++        [QEMU_PLUGIN_CB_R_REGS].flags = TCG_CALL_NO_WG | TCG_CALL_PLUGIN,
-+{
++        [QEMU_PLUGIN_CB_RW_REGS].flags = TCG_CALL_PLUGIN,
-+    __builtin___clear_cache(p, p + len);
++        /*
-+}
++         * Match qemu_plugin_vcpu_mem_cb_t:
-+
++         *   void (*)(uint32_t, qemu_plugin_meminfo_t, uint64_t, void *)
-+extern char noexec_1[];
++         */
-+extern char noexec_2[];
++        [0 ... 2].typemask =
-+extern char noexec_end[];
++            (dh_typemask(void, 0) |
-+
++             dh_typemask(i32, 1) |
-+asm(".option push\n"
++             (__builtin_types_compatible_p(qemu_plugin_meminfo_t, uint32_t)
-+    ".option norvc\n"
++              ? dh_typemask(i32, 2) : dh_typemask(s32, 2)) |
-+    "noexec_1:\n"
++             dh_typemask(i64, 3) |
-+    "   li a0,1\n"       /* a0 is 0 on entry, set 1. */
++             dh_typemask(ptr, 4))
 +    "noexec_2:\n"
 +    "   li a0,2\n"      /* a0 is 0/1; set 2. */
 +    "   ret\n"
 +    "noexec_end:\n"
 +    ".option pop");
 +
 +int main(void)
 +{
 +    struct noexec_test noexec_tests[] = {
 +        {
 +            .name = "fallthrough",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2,
 +            .entry_ofs = noexec_1 - noexec_2,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = 0,
 +            .expected_arg = 1,
 +        },
 +        {
 +            .name = "jump",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2,
 +            .entry_ofs = 0,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = 0,
 +            .expected_arg = 0,
 +        },
 +        {
 +            .name = "fallthrough [cross]",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2 - 2,
 +            .entry_ofs = noexec_1 - noexec_2 - 2,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = -2,
 +            .expected_arg = 1,
 +        },
 +        {
 +            .name = "jump [cross]",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2 - 2,
 +            .entry_ofs = -2,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = -2,
 +            .expected_arg = 0,
 +        },
 +    };
 +
-+    return test_noexec(noexec_tests,
++    struct qemu_plugin_dyn_cb *dyn_cb = plugin_get_dyn_cb(arr);
-+                       sizeof(noexec_tests) / sizeof(noexec_tests[0]));
+     dyn_cb->userp = udata;
-+}
+-    /* Note flags are discarded as unused. */
-diff --git a/tests/tcg/riscv64/Makefile.target b/tests/tcg/riscv64/Makefile.target
+     dyn_cb->type = PLUGIN_CB_REGULAR;
-index XXXXXXX..XXXXXXX 100644
+     dyn_cb->rw = rw;
---- a/tests/tcg/riscv64/Makefile.target
+     dyn_cb->regular.f.vcpu_mem = cb;
-+++ b/tests/tcg/riscv64/Makefile.target
++
-@@ -XXX,XX +XXX,XX @@
++    assert((unsigned)flags < ARRAY_SIZE(info));
++    dyn_cb->regular.info = &info[flags];
- VPATH += $(SRC_PATH)/tests/tcg/riscv64
+ }
- TESTS += test-div
-+TESTS += noexec
+ /*
 --
 .34.1

-[PULL 18/20] target/i386: Make translator stop before the end of a page
+[PULL 06/20] plugins: Use emit_before_op for PLUGIN_GEN_AFTER_INSN
-From: Ilya Leoshkevich <iii@linux.ibm.com>
+Introduce a new plugin_cb op and migrate one operation.
 By using emit_before_op, we do not need to emit opcodes
 early and modify them later -- we can simply emit the
 final set of opcodes once.
-Right now translator stops right *after* the end of a page, which
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 breaks reporting of fault locations when the last instruction of a
 multi-insn translation block crosses a page boundary.
 An implementation, like the one arm and s390x have, would require an
 i386 length disassembler, which is burdensome to maintain. Another
 alternative would be to single-step at the end of a guest page, but
 this may come with a performance impact.
 Fix by snapshotting disassembly state and restoring it after we figure
 out we crossed a page boundary. This includes rolling back cc_op
 updates and emitted ops.
 Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1143
 Message-Id: <20220817150506.592862-4-iii@linux.ibm.com>
 [rth: Simplify end-of-insn cross-page checks.]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/i386/tcg/translate.c      | 64 ++++++++++++++++-----------
+ include/tcg/tcg-op-common.h |  1 +
- tests/tcg/x86_64/noexec.c        | 75 ++++++++++++++++++++++++++++++++
+ include/tcg/tcg-opc.h       |  1 +
- tests/tcg/x86_64/Makefile.target |  3 +-
+ accel/tcg/plugin-gen.c      | 74 +++++++++++++++++++++----------------
-files changed, 116 insertions(+), 26 deletions(-)
+ tcg/tcg-op.c                |  5 +++
- create mode 100644 tests/tcg/x86_64/noexec.c
+files changed, 50 insertions(+), 31 deletions(-)
-diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
+diff --git a/include/tcg/tcg-op-common.h b/include/tcg/tcg-op-common.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/i386/tcg/translate.c
+--- a/include/tcg/tcg-op-common.h
-+++ b/target/i386/tcg/translate.c
++++ b/include/tcg/tcg-op-common.h
-@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
+@@ -XXX,XX +XXX,XX @@ void tcg_gen_goto_tb(unsigned idx);
-     TCGv_i64 tmp1_i64;
+  */
+ void tcg_gen_lookup_and_goto_ptr(void);
-     sigjmp_buf jmpbuf;
-+    TCGOp *prev_insn_end;
++void tcg_gen_plugin_cb(unsigned from);
- } DisasContext;
+ void tcg_gen_plugin_cb_start(unsigned from, unsigned type, unsigned wr);
+ void tcg_gen_plugin_cb_end(void);
- /* The environment in which user-only runs is constrained. */
-@@ -XXX,XX +XXX,XX @@ static uint64_t advance_pc(CPUX86State *env, DisasContext *s, int num_bytes)
+diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/tcg/tcg-opc.h
 +++ b/include/tcg/tcg-opc.h
@@ -XXX,XX +XXX,XX @@ DEF(exit_tb, 0, 0, 1, TCG_OPF_BB_EXIT | TCG_OPF_BB_END)
  DEF(goto_tb, 0, 0, 1, TCG_OPF_BB_EXIT | TCG_OPF_BB_END)
  DEF(goto_ptr, 0, 1, 0, TCG_OPF_BB_EXIT | TCG_OPF_BB_END)
 +DEF(plugin_cb, 0, 0, 1, TCG_OPF_NOT_PRESENT)
  DEF(plugin_cb_start, 0, 0, 3, TCG_OPF_NOT_PRESENT)
  DEF(plugin_cb_end, 0, 0, 0, TCG_OPF_NOT_PRESENT)
 diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/plugin-gen.c
 +++ b/accel/tcg/plugin-gen.c
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_empty_callback(enum plugin_gen_from from)
  {
-     uint64_t pc = s->pc;
+     switch (from) {
+     case PLUGIN_GEN_AFTER_INSN:
-+    /* This is a subsequent insn that crosses a page boundary.  */
+-        gen_wrapped(from, PLUGIN_GEN_DISABLE_MEM_HELPER,
-+    if (s->base.num_insns > 1 &&
+-                    gen_empty_mem_helper);
-+        !is_same_page(&s->base, s->pc + num_bytes - 1)) {
++        tcg_gen_plugin_cb(from);
-+        siglongjmp(s->jmpbuf, 2);
+         break;
-+    }
+     case PLUGIN_GEN_FROM_INSN:
-+
+         /*
-     s->pc += num_bytes;
+@@ -XXX,XX +XXX,XX @@ static void inject_mem_enable_helper(struct qemu_plugin_tb *ptb,
-     if (unlikely(s->pc - s->pc_start > X86_MAX_INSN_LENGTH)) {
+     inject_mem_helper(begin_op, arr);
-         /* If the instruction's 16th byte is on a different page than the 1st, a
+ }
-@@ -XXX,XX +XXX,XX @@ static target_ulong disas_insn(DisasContext *s, CPUState *cpu)
-     int modrm, reg, rm, mod, op, opreg, val;
+-static void inject_mem_disable_helper(struct qemu_plugin_insn *plugin_insn,
-     target_ulong next_eip, tval;
+-                                      TCGOp *begin_op)
-     target_ulong pc_start = s->base.pc_next;
+-{
-+    bool orig_cc_op_dirty = s->cc_op_dirty;
+-    if (likely(!plugin_insn->mem_helper)) {
-+    CCOp orig_cc_op = s->cc_op;
+-        rm_ops(begin_op);
+-        return;
-     s->pc_start = s->pc = pc_start;
+-    }
-     s->override = -1;
+-    inject_mem_helper(begin_op, NULL);
-@@ -XXX,XX +XXX,XX @@ static target_ulong disas_insn(DisasContext *s, CPUState *cpu)
+-}
-     s->rip_offset = 0; /* for relative ip address */
+-
-     s->vex_l = 0;
+ /* called before finishing a TB with exit_tb, goto_tb or goto_ptr */
-     s->vex_v = 0;
+ void plugin_gen_disable_mem_helpers(void)
 -    if (sigsetjmp(s->jmpbuf, 0) != 0) {
 +    switch (sigsetjmp(s->jmpbuf, 0)) {
 +    case 0:
 +        break;
 +    case 1:
          gen_exception_gpf(s);
          return s->pc;
 +    case 2:
 +        /* Restore state that may affect the next instruction. */
 +        s->cc_op_dirty = orig_cc_op_dirty;
 +        s->cc_op = orig_cc_op;
 +        s->base.num_insns--;
 +        tcg_remove_ops_after(s->prev_insn_end);
 +        s->base.is_jmp = DISAS_TOO_MANY;
 +        return pc_start;
 +    default:
 +        g_assert_not_reached();
      }
      prefixes = 0;
@@ -XXX,XX +XXX,XX @@ static void i386_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu)
  {
-     DisasContext *dc = container_of(dcbase, DisasContext, base);
+@@ -XXX,XX +XXX,XX @@ static void plugin_gen_enable_mem_helper(struct qemu_plugin_tb *ptb,
+     inject_mem_enable_helper(ptb, insn, begin_op);
 +    dc->prev_insn_end = tcg_last_op();
      tcg_gen_insn_start(dc->base.pc_next, dc->cc_op);
  }
-@@ -XXX,XX +XXX,XX @@ static void i386_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
+-static void plugin_gen_disable_mem_helper(struct qemu_plugin_tb *ptb,
- #endif
+-                                          TCGOp *begin_op, int insn_idx)
++static void gen_disable_mem_helper(struct qemu_plugin_tb *ptb,
-     pc_next = disas_insn(dc, cpu);
++                                   struct qemu_plugin_insn *insn)
--
+ {
--    if (dc->flags & (HF_TF_MASK | HF_INHIBIT_IRQ_MASK)) {
+-    struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
--        /* if single step mode, we generate only one instruction and
+-    inject_mem_disable_helper(insn, begin_op);
--           generate an exception */
++    if (insn->mem_helper) {
--        /* if irq were inhibited with HF_INHIBIT_IRQ_MASK, we clear
++        tcg_gen_st_ptr(tcg_constant_ptr(0), tcg_env,
--           the flag and abort the translation to give the irqs a
++                       offsetof(CPUState, plugin_mem_cbs) -
--           chance to happen */
++                       offsetof(ArchCPU, env));
 -        dc->base.is_jmp = DISAS_TOO_MANY;
 -    } else if ((tb_cflags(dc->base.tb) & CF_USE_ICOUNT)
 -               && ((pc_next & TARGET_PAGE_MASK)
 -                   != ((pc_next + TARGET_MAX_INSN_SIZE - 1)
 -                       & TARGET_PAGE_MASK)
 -                   || (pc_next & ~TARGET_PAGE_MASK) == 0)) {
 -        /* Do not cross the boundary of the pages in icount mode,
 -           it can cause an exception. Do it only when boundary is
 -           crossed by the first instruction in the block.
 -           If current instruction already crossed the bound - it's ok,
 -           because an exception hasn't stopped this code.
 -         */
 -        dc->base.is_jmp = DISAS_TOO_MANY;
 -    } else if ((pc_next - dc->base.pc_first) >= (TARGET_PAGE_SIZE - 32)) {
 -        dc->base.is_jmp = DISAS_TOO_MANY;
 -    }
 -
      dc->base.pc_next = pc_next;
 +
 +    if (dc->base.is_jmp == DISAS_NEXT) {
 +        if (dc->flags & (HF_TF_MASK | HF_INHIBIT_IRQ_MASK)) {
 +            /*
 +             * If single step mode, we generate only one instruction and
 +             * generate an exception.
 +             * If irq were inhibited with HF_INHIBIT_IRQ_MASK, we clear
 +             * the flag and abort the translation to give the irqs a
 +             * chance to happen.
 +             */
 +            dc->base.is_jmp = DISAS_TOO_MANY;
 +        } else if (!is_same_page(&dc->base, pc_next)) {
 +            dc->base.is_jmp = DISAS_TOO_MANY;
 +        }
 +    }
  }
- static void i386_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
+ /* #define DEBUG_PLUGIN_GEN_OPS */
-diff --git a/tests/tcg/x86_64/noexec.c b/tests/tcg/x86_64/noexec.c
+@@ -XXX,XX +XXX,XX @@ static void pr_ops(void)
-new file mode 100644
-index XXXXXXX..XXXXXXX
+ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
---- /dev/null
+ {
-+++ b/tests/tcg/x86_64/noexec.c
+-    TCGOp *op;
-@@ -XXX,XX +XXX,XX @@
++    TCGOp *op, *next;
-+#include "../multiarch/noexec.c.inc"
+     int insn_idx = -1;
      pr_ops();
 -    QTAILQ_FOREACH(op, &tcg_ctx->ops, link) {
 +    /*
 +     * While injecting code, we cannot afford to reuse any ebb temps
 +     * that might be live within the existing opcode stream.
 +     * The simplest solution is to release them all and create new.
 +     */
 +    memset(tcg_ctx->free_temps, 0, sizeof(tcg_ctx->free_temps));
 +
-+static void *arch_mcontext_pc(const mcontext_t *ctx)
++    QTAILQ_FOREACH_SAFE(op, &tcg_ctx->ops, link, next) {
          switch (op->opc) {
          case INDEX_op_insn_start:
              insn_idx++;
              break;
 +
 +        case INDEX_op_plugin_cb:
 +        {
 +            enum plugin_gen_from from = op->args[0];
 +            struct qemu_plugin_insn *insn = NULL;
 +
 +            if (insn_idx >= 0) {
 +                insn = g_ptr_array_index(plugin_tb->insns, insn_idx);
 +            }
 +
 +            tcg_ctx->emit_before_op = op;
 +
 +            switch (from) {
 +            case PLUGIN_GEN_AFTER_INSN:
 +                assert(insn != NULL);
 +                gen_disable_mem_helper(plugin_tb, insn);
 +                break;
 +            default:
 +                g_assert_not_reached();
 +            }
 +
 +            tcg_ctx->emit_before_op = NULL;
 +            tcg_op_remove(tcg_ctx, op);
 +            break;
 +        }
 +
          case INDEX_op_plugin_cb_start:
          {
              enum plugin_gen_from from = op->args[0];
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
                  break;
              }
 -            case PLUGIN_GEN_AFTER_INSN:
 -            {
 -                g_assert(insn_idx >= 0);
 -
 -                switch (type) {
 -                case PLUGIN_GEN_DISABLE_MEM_HELPER:
 -                    plugin_gen_disable_mem_helper(plugin_tb, op, insn_idx);
 -                    break;
 -                default:
 -                    g_assert_not_reached();
 -                }
 -                break;
 -            }
              default:
                  g_assert_not_reached();
              }
 diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg-op.c
 +++ b/tcg/tcg-op.c
@@ -XXX,XX +XXX,XX @@ void tcg_gen_mb(TCGBar mb_type)
      }
  }
 +void tcg_gen_plugin_cb(unsigned from)
 +{
-+    return (void *)ctx->gregs[REG_RIP];
++    tcg_gen_op1(INDEX_op_plugin_cb, from);
 +}
 +
-+int arch_mcontext_arg(const mcontext_t *ctx)
+ void tcg_gen_plugin_cb_start(unsigned from, unsigned type, unsigned wr)
-+{
+ {
-+    return ctx->gregs[REG_RDI];
+     tcg_gen_op3(INDEX_op_plugin_cb_start, from, type, wr);
 +}
 +
 +static void arch_flush(void *p, int len)
 +{
 +}
 +
 +extern char noexec_1[];
 +extern char noexec_2[];
 +extern char noexec_end[];
 +
 +asm("noexec_1:\n"
 +    "    movq $1,%rdi\n"    /* %rdi is 0 on entry, set 1. */
 +    "noexec_2:\n"
 +    "    movq $2,%rdi\n"    /* %rdi is 0/1; set 2. */
 +    "    ret\n"
 +    "noexec_end:");
 +
 +int main(void)
 +{
 +    struct noexec_test noexec_tests[] = {
 +        {
 +            .name = "fallthrough",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2,
 +            .entry_ofs = noexec_1 - noexec_2,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = 0,
 +            .expected_arg = 1,
 +        },
 +        {
 +            .name = "jump",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2,
 +            .entry_ofs = 0,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = 0,
 +            .expected_arg = 0,
 +        },
 +        {
 +            .name = "fallthrough [cross]",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2 - 2,
 +            .entry_ofs = noexec_1 - noexec_2 - 2,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = -2,
 +            .expected_arg = 1,
 +        },
 +        {
 +            .name = "jump [cross]",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2 - 2,
 +            .entry_ofs = -2,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = -2,
 +            .expected_arg = 0,
 +        },
 +    };
 +
 +    return test_noexec(noexec_tests,
 +                       sizeof(noexec_tests) / sizeof(noexec_tests[0]));
 +}
 diff --git a/tests/tcg/x86_64/Makefile.target b/tests/tcg/x86_64/Makefile.target
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/tcg/x86_64/Makefile.target
 +++ b/tests/tcg/x86_64/Makefile.target
@@ -XXX,XX +XXX,XX @@ include $(SRC_PATH)/tests/tcg/i386/Makefile.target
  ifeq ($(filter %-linux-user, $(TARGET)),$(TARGET))
  X86_64_TESTS += vsyscall
 +X86_64_TESTS += noexec
  TESTS=$(MULTIARCH_TESTS) $(X86_64_TESTS) test-x86_64
  else
  TESTS=$(MULTIARCH_TESTS)
@@ -XXX,XX +XXX,XX @@ test-x86_64: LDFLAGS+=-lm -lc
  test-x86_64: test-i386.c test-i386.h test-i386-shift.h test-i386-muldiv.h
      $(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
 -vsyscall: $(SRC_PATH)/tests/tcg/x86_64/vsyscall.c
 +%: $(SRC_PATH)/tests/tcg/x86_64/%.c
      $(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
 --
 .34.1

-[PULL 16/20] accel/tcg: Add fast path for translator_ld*
+[PULL 07/20] plugins: Use emit_before_op for PLUGIN_GEN_FROM_TB
-Cache the translation from guest to host address, so we may
+By having the qemu_plugin_cb_flags be recorded in the TCGHelperInfo,
-use direct loads when we hit on the primary translation page.
+we no longer need to distinguish PLUGIN_CB_REGULAR from
 PLUGIN_CB_REGULAR_R, so place all TB callbacks in the same queue.
-Look up the second translation page only once, during translation.
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 This obviates another lookup of the second page within tb_gen_code
 after translation.
 Fixes a bug in that plugin_insn_append should be passed the bytes
 in the original memory order, not bswapped by pieces.
 Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/translator.h |  63 +++++++++++--------
+ accel/tcg/plugin-gen.c | 96 +++++++++++++++++++++++++-----------------
- accel/tcg/translate-all.c |  23 +++----
+ plugins/api.c          |  6 +--
- accel/tcg/translator.c    | 126 +++++++++++++++++++++++++++++---------
+files changed, 58 insertions(+), 44 deletions(-)
 files changed, 141 insertions(+), 71 deletions(-)
-diff --git a/include/exec/translator.h b/include/exec/translator.h
+diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/translator.h
+--- a/accel/tcg/plugin-gen.c
-+++ b/include/exec/translator.h
++++ b/accel/tcg/plugin-gen.c
-@@ -XXX,XX +XXX,XX @@ typedef enum DisasJumpType {
+@@ -XXX,XX +XXX,XX @@ static void plugin_gen_empty_callback(enum plugin_gen_from from)
   * Architecture-agnostic disassembly context.
   */
  typedef struct DisasContextBase {
 -    const TranslationBlock *tb;
 +    TranslationBlock *tb;
      target_ulong pc_first;
      target_ulong pc_next;
      DisasJumpType is_jmp;
      int num_insns;
      int max_insns;
      bool singlestep_enabled;
 -#ifdef CONFIG_USER_ONLY
 -    /*
 -     * Guest address of the last byte of the last protected page.
 -     *
 -     * Pages containing the translated instructions are made non-writable in
 -     * order to achieve consistency in case another thread is modifying the
 -     * code while translate_insn() fetches the instruction bytes piecemeal.
 -     * Such writer threads are blocked on mmap_lock() in page_unprotect().
 -     */
 -    target_ulong page_protect_end;
 -#endif
 +    void *host_addr[2];
  } DisasContextBase;
  /**
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
   * the relevant information at translation time.
   */
 -#define GEN_TRANSLATOR_LD(fullname, type, load_fn, swap_fn)             \
 -    type fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase, \
 -                           abi_ptr pc, bool do_swap);                   \
 -    static inline type fullname(CPUArchState *env,                      \
 -                                DisasContextBase *dcbase, abi_ptr pc)   \
 -    {                                                                   \
 -        return fullname ## _swap(env, dcbase, pc, false);               \
 +uint8_t translator_ldub(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
 +uint16_t translator_lduw(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
 +uint32_t translator_ldl(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
 +uint64_t translator_ldq(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
 +
 +static inline uint16_t
 +translator_lduw_swap(CPUArchState *env, DisasContextBase *db,
 +                     abi_ptr pc, bool do_swap)
 +{
 +    uint16_t ret = translator_lduw(env, db, pc);
 +    if (do_swap) {
 +        ret = bswap16(ret);
      }
 +    return ret;
 +}
 -#define FOR_EACH_TRANSLATOR_LD(F)                                       \
 -    F(translator_ldub, uint8_t, cpu_ldub_code, /* no swap */)           \
 -    F(translator_lduw, uint16_t, cpu_lduw_code, bswap16)                \
 -    F(translator_ldl, uint32_t, cpu_ldl_code, bswap32)                  \
 -    F(translator_ldq, uint64_t, cpu_ldq_code, bswap64)
 +static inline uint32_t
 +translator_ldl_swap(CPUArchState *env, DisasContextBase *db,
 +                    abi_ptr pc, bool do_swap)
 +{
 +    uint32_t ret = translator_ldl(env, db, pc);
 +    if (do_swap) {
 +        ret = bswap32(ret);
 +    }
 +    return ret;
 +}
 -FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
 -
 -#undef GEN_TRANSLATOR_LD
 +static inline uint64_t
 +translator_ldq_swap(CPUArchState *env, DisasContextBase *db,
 +                    abi_ptr pc, bool do_swap)
 +{
 +    uint64_t ret = translator_ldq_swap(env, db, pc, false);
 +    if (do_swap) {
 +        ret = bswap64(ret);
 +    }
 +    return ret;
 +}
  /*
   * Return whether addr is on the same page as where disassembly started.
 diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translate-all.c
 +++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
  {
-     CPUArchState *env = cpu->env_ptr;
+     switch (from) {
-     TranslationBlock *tb, *existing_tb;
+     case PLUGIN_GEN_AFTER_INSN:
--    tb_page_addr_t phys_pc, phys_page2;
++    case PLUGIN_GEN_FROM_TB:
--    target_ulong virt_page2;
+         tcg_gen_plugin_cb(from);
-+    tb_page_addr_t phys_pc;
+         break;
-     tcg_insn_unit *gen_code_buf;
+     case PLUGIN_GEN_FROM_INSN:
-     int gen_code_size, search_size, max_insns;
+@@ -XXX,XX +XXX,XX @@ static void plugin_gen_empty_callback(enum plugin_gen_from from)
- #ifdef CONFIG_PROFILER
+          */
-@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
+         gen_wrapped(from, PLUGIN_GEN_ENABLE_MEM_HELPER,
-     tb->flags = flags;
+                     gen_empty_mem_helper);
-     tb->cflags = cflags;
+-        /* fall through */
-     tb->trace_vcpu_dstate = *cpu->trace_dstate;
+-    case PLUGIN_GEN_FROM_TB:
-+    tb->page_addr[0] = phys_pc;
+         gen_wrapped(from, PLUGIN_GEN_CB_UDATA, gen_empty_udata_cb_no_rwg);
-+    tb->page_addr[1] = -1;
+         gen_wrapped(from, PLUGIN_GEN_CB_UDATA_R, gen_empty_udata_cb_no_wg);
-     tcg_ctx->tb_cflags = cflags;
+         gen_wrapped(from, PLUGIN_GEN_CB_INLINE, gen_empty_inline_cb);
-  tb_overflow:
+@@ -XXX,XX +XXX,XX @@ void plugin_gen_disable_mem_helpers(void)
+                    offsetof(CPUState, plugin_mem_cbs) - offsetof(ArchCPU, env));
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
      }
      /*
 -     * If the TB is not associated with a physical RAM page then
 -     * it must be a temporary one-insn TB, and we have nothing to do
 -     * except fill in the page_addr[] fields. Return early before
 -     * attempting to link to other TBs or add to the lookup table.
 +     * If the TB is not associated with a physical RAM page then it must be
 +     * a temporary one-insn TB, and we have nothing left to do. Return early
 +     * before attempting to link to other TBs or add to the lookup table.
       */
 -    if (phys_pc == -1) {
 -        tb->page_addr[0] = tb->page_addr[1] = -1;
 +    if (tb->page_addr[0] == -1) {
          return tb;
      }
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
       */
      tcg_tb_insert(tb);
 -    /* check next page if needed */
 -    virt_page2 = (pc + tb->size - 1) & TARGET_PAGE_MASK;
 -    phys_page2 = -1;
 -    if ((pc & TARGET_PAGE_MASK) != virt_page2) {
 -        phys_page2 = get_page_addr_code(env, virt_page2);
 -    }
      /*
       * No explicit memory barrier is required -- tb_link_page() makes the
       * TB visible in a consistent state.
       */
 -    existing_tb = tb_link_page(tb, phys_pc, phys_page2);
 +    existing_tb = tb_link_page(tb, tb->page_addr[0], tb->page_addr[1]);
      /* if the TB already exists, discard what we just translated */
      if (unlikely(existing_tb != tb)) {
          uintptr_t orig_aligned = (uintptr_t)gen_code_buf;
 diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translator.c
 +++ b/accel/tcg/translator.c
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest)
      return ((db->pc_first ^ dest) & TARGET_PAGE_MASK) == 0;
  }
--static inline void translator_page_protect(DisasContextBase *dcbase,
+-static void plugin_gen_tb_udata(const struct qemu_plugin_tb *ptb,
--                                           target_ulong pc)
+-                                TCGOp *begin_op)
 -{
--#ifdef CONFIG_USER_ONLY
+-    inject_udata_cb(ptb->cbs[PLUGIN_CB_REGULAR], begin_op);
 -    dcbase->page_protect_end = pc | ~TARGET_PAGE_MASK;
 -    page_protect(pc);
 -#endif
 -}
 -
- void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
+-static void plugin_gen_tb_udata_r(const struct qemu_plugin_tb *ptb,
-                      target_ulong pc, void *host_pc,
+-                                  TCGOp *begin_op)
-                      const TranslatorOps *ops, DisasContextBase *db)
+-{
-@@ -XXX,XX +XXX,XX @@ void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
+-    inject_udata_cb(ptb->cbs[PLUGIN_CB_REGULAR_R], begin_op);
-     db->num_insns = 0;
+-}
-     db->max_insns = max_insns;
+-
-     db->singlestep_enabled = cflags & CF_SINGLE_STEP;
+-static void plugin_gen_tb_inline(const struct qemu_plugin_tb *ptb,
--    translator_page_protect(db, db->pc_next);
+-                                 TCGOp *begin_op)
-+    db->host_addr[0] = host_pc;
+-{
-+    db->host_addr[1] = NULL;
+-    inject_inline_cb(ptb->cbs[PLUGIN_CB_INLINE], begin_op, op_ok);
 -}
 -
  static void plugin_gen_insn_udata(const struct qemu_plugin_tb *ptb,
                                    TCGOp *begin_op, int insn_idx)
  {
@@ -XXX,XX +XXX,XX @@ static void gen_disable_mem_helper(struct qemu_plugin_tb *ptb,
      }
  }
 +static void gen_udata_cb(struct qemu_plugin_dyn_cb *cb)
 +{
 +    TCGv_i32 cpu_index = tcg_temp_ebb_new_i32();
 +
-+#ifdef CONFIG_USER_ONLY
++    tcg_gen_ld_i32(cpu_index, tcg_env,
-+    page_protect(pc);
++                   -offsetof(ArchCPU, env) + offsetof(CPUState, cpu_index));
-+#endif
++    tcg_gen_call2(cb->regular.f.vcpu_udata, cb->regular.info, NULL,
++                  tcgv_i32_temp(cpu_index),
-     ops->init_disas_context(db, cpu);
++                  tcgv_ptr_temp(tcg_constant_ptr(cb->userp)));
-     tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
++    tcg_temp_free_i32(cpu_index);
@@ -XXX,XX +XXX,XX @@ void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
  #endif
  }
 -static inline void translator_maybe_page_protect(DisasContextBase *dcbase,
 -                                                 target_ulong pc, size_t len)
 +static void *translator_access(CPUArchState *env, DisasContextBase *db,
 +                               target_ulong pc, size_t len)
  {
 -#ifdef CONFIG_USER_ONLY
 -    target_ulong end = pc + len - 1;
 +    void *host;
 +    target_ulong base, end;
 +    TranslationBlock *tb;
 -    if (end > dcbase->page_protect_end) {
 -        translator_page_protect(dcbase, end);
 +    tb = db->tb;
 +
 +    /* Use slow path if first page is MMIO. */
 +    if (unlikely(tb->page_addr[0] == -1)) {
 +        return NULL;
      }
 +
 +    end = pc + len - 1;
 +    if (likely(is_same_page(db, end))) {
 +        host = db->host_addr[0];
 +        base = db->pc_first;
 +    } else {
 +        host = db->host_addr[1];
 +        base = TARGET_PAGE_ALIGN(db->pc_first);
 +        if (host == NULL) {
 +            tb->page_addr[1] =
 +                get_page_addr_code_hostp(env, base, &db->host_addr[1]);
 +#ifdef CONFIG_USER_ONLY
 +            page_protect(end);
  #endif
 +            /* We cannot handle MMIO as second page. */
 +            assert(tb->page_addr[1] != -1);
 +            host = db->host_addr[1];
 +        }
 +
 +        /* Use slow path when crossing pages. */
 +        if (is_same_page(db, pc)) {
 +            return NULL;
 +        }
 +    }
 +
 +    tcg_debug_assert(pc >= base);
 +    return host + (pc - base);
  }
 -#define GEN_TRANSLATOR_LD(fullname, type, load_fn, swap_fn)             \
 -    type fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase, \
 -                           abi_ptr pc, bool do_swap)                    \
 -    {                                                                   \
 -        translator_maybe_page_protect(dcbase, pc, sizeof(type));        \
 -        type ret = load_fn(env, pc);                                    \
 -        if (do_swap) {                                                  \
 -            ret = swap_fn(ret);                                         \
 -        }                                                               \
 -        plugin_insn_append(pc, &ret, sizeof(ret));                      \
 -        return ret;                                                     \
 +uint8_t translator_ldub(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
 +{
 +    uint8_t ret;
 +    void *p = translator_access(env, db, pc, sizeof(ret));
 +
 +    if (p) {
 +        plugin_insn_append(pc, p, sizeof(ret));
 +        return ldub_p(p);
      }
 +    ret = cpu_ldub_code(env, pc);
 +    plugin_insn_append(pc, &ret, sizeof(ret));
 +    return ret;
 +}
 -FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
 +uint16_t translator_lduw(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
 +{
 +    uint16_t ret, plug;
 +    void *p = translator_access(env, db, pc, sizeof(ret));
 -#undef GEN_TRANSLATOR_LD
 +    if (p) {
 +        plugin_insn_append(pc, p, sizeof(ret));
 +        return lduw_p(p);
 +    }
 +    ret = cpu_lduw_code(env, pc);
 +    plug = tswap16(ret);
 +    plugin_insn_append(pc, &plug, sizeof(ret));
 +    return ret;
 +}
 +
-+uint32_t translator_ldl(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
++static void gen_inline_cb(struct qemu_plugin_dyn_cb *cb)
 +{
-+    uint32_t ret, plug;
++    GArray *arr = cb->inline_insn.entry.score->data;
-+    void *p = translator_access(env, db, pc, sizeof(ret));
++    size_t offset = cb->inline_insn.entry.offset;
 +    TCGv_i32 cpu_index = tcg_temp_ebb_new_i32();
 +    TCGv_i64 val = tcg_temp_ebb_new_i64();
 +    TCGv_ptr ptr = tcg_temp_ebb_new_ptr();
 +
-+    if (p) {
++    tcg_gen_ld_i32(cpu_index, tcg_env,
-+        plugin_insn_append(pc, p, sizeof(ret));
++                   -offsetof(ArchCPU, env) + offsetof(CPUState, cpu_index));
-+        return ldl_p(p);
++    tcg_gen_muli_i32(cpu_index, cpu_index, g_array_get_element_size(arr));
-+    }
++    tcg_gen_ext_i32_ptr(ptr, cpu_index);
-+    ret = cpu_ldl_code(env, pc);
++    tcg_temp_free_i32(cpu_index);
-+    plug = tswap32(ret);
++
-+    plugin_insn_append(pc, &plug, sizeof(ret));
++    tcg_gen_addi_ptr(ptr, ptr, (intptr_t)arr->data);
-+    return ret;
++    tcg_gen_ld_i64(val, ptr, offset);
 +    tcg_gen_addi_i64(val, val, cb->inline_insn.imm);
 +    tcg_gen_st_i64(val, ptr, offset);
 +
 +    tcg_temp_free_i64(val);
 +    tcg_temp_free_ptr(ptr);
 +}
 +
-+uint64_t translator_ldq(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
+ /* #define DEBUG_PLUGIN_GEN_OPS */
-+{
+ static void pr_ops(void)
-+    uint64_t ret, plug;
+ {
-+    void *p = translator_access(env, db, pc, sizeof(ret));
+@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
          {
              enum plugin_gen_from from = op->args[0];
              struct qemu_plugin_insn *insn = NULL;
 +            const GArray *cbs;
 +            int i, n;
              if (insn_idx >= 0) {
                  insn = g_ptr_array_index(plugin_tb->insns, insn_idx);
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
                  assert(insn != NULL);
                  gen_disable_mem_helper(plugin_tb, insn);
                  break;
 +
-+    if (p) {
++            case PLUGIN_GEN_FROM_TB:
-+        plugin_insn_append(pc, p, sizeof(ret));
++                assert(insn == NULL);
-+        return ldq_p(p);
++
-+    }
++                cbs = plugin_tb->cbs[PLUGIN_CB_REGULAR];
-+    ret = cpu_ldq_code(env, pc);
++                for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
-+    plug = tswap64(ret);
++                    struct qemu_plugin_dyn_cb *cb =
-+    plugin_insn_append(pc, &plug, sizeof(ret));
++                        &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
-+    return ret;
++                    gen_udata_cb(cb);
-+}
++                }
 +
 +                cbs = plugin_tb->cbs[PLUGIN_CB_INLINE];
 +                for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
 +                    struct qemu_plugin_dyn_cb *cb =
 +                        &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
 +                    gen_inline_cb(cb);
 +                }
 +                break;
 +
              default:
                  g_assert_not_reached();
              }
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
              enum plugin_gen_cb type = op->args[1];
              switch (from) {
 -            case PLUGIN_GEN_FROM_TB:
 -            {
 -                g_assert(insn_idx == -1);
 -
 -                switch (type) {
 -                case PLUGIN_GEN_CB_UDATA:
 -                    plugin_gen_tb_udata(plugin_tb, op);
 -                    break;
 -                case PLUGIN_GEN_CB_UDATA_R:
 -                    plugin_gen_tb_udata_r(plugin_tb, op);
 -                    break;
 -                case PLUGIN_GEN_CB_INLINE:
 -                    plugin_gen_tb_inline(plugin_tb, op);
 -                    break;
 -                default:
 -                    g_assert_not_reached();
 -                }
 -                break;
 -            }
              case PLUGIN_GEN_FROM_INSN:
              {
                  g_assert(insn_idx >= 0);
 diff --git a/plugins/api.c b/plugins/api.c
 index XXXXXXX..XXXXXXX 100644
 --- a/plugins/api.c
 +++ b/plugins/api.c
@@ -XXX,XX +XXX,XX @@ void qemu_plugin_register_vcpu_tb_exec_cb(struct qemu_plugin_tb *tb,
                                            void *udata)
  {
      if (!tb->mem_only) {
 -        int index = flags == QEMU_PLUGIN_CB_R_REGS ||
 -                    flags == QEMU_PLUGIN_CB_RW_REGS ?
 -                    PLUGIN_CB_REGULAR_R : PLUGIN_CB_REGULAR;
 -
 -        plugin_register_dyn_cb__udata(&tb->cbs[index],
 +        plugin_register_dyn_cb__udata(&tb->cbs[PLUGIN_CB_REGULAR],
                                        cb, flags, udata);
      }
  }
 --
 .34.1

-[PULL 15/20] accel/tcg: Add pc and host_pc params to gen_intermediate_code
+[PULL 08/20] plugins: Add PLUGIN_GEN_AFTER_TB
-Pass these along to translator_loop -- pc may be used instead
+Delay test of plugin_tb->mem_helper until the inject pass.
 of tb->pc, and host_pc is currently unused.  Adjust all targets
 at one time.
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/exec-all.h       |  1 -
+ accel/tcg/plugin-gen.c | 37 ++++++++++++++++---------------------
- include/exec/translator.h     | 24 ++++++++++++++++++++----
+file changed, 16 insertions(+), 21 deletions(-)
  accel/tcg/translate-all.c     |  6 ++++--
  accel/tcg/translator.c        |  9 +++++----
  target/alpha/translate.c      |  5 +++--
  target/arm/translate.c        |  5 +++--
  target/avr/translate.c        |  5 +++--
  target/cris/translate.c       |  5 +++--
  target/hexagon/translate.c    |  6 ++++--
  target/hppa/translate.c       |  5 +++--
  target/i386/tcg/translate.c   |  5 +++--
  target/loongarch/translate.c  |  6 ++++--
  target/m68k/translate.c       |  5 +++--
  target/microblaze/translate.c |  5 +++--
  target/mips/tcg/translate.c   |  5 +++--
  target/nios2/translate.c      |  5 +++--
  target/openrisc/translate.c   |  6 ++++--
  target/ppc/translate.c        |  5 +++--
  target/riscv/translate.c      |  5 +++--
  target/rx/translate.c         |  5 +++--
  target/s390x/tcg/translate.c  |  5 +++--
  target/sh4/translate.c        |  5 +++--
  target/sparc/translate.c      |  5 +++--
  target/tricore/translate.c    |  6 ++++--
  target/xtensa/translate.c     |  6 ++++--
 files changed, 97 insertions(+), 53 deletions(-)
-diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
+diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/exec-all.h
+--- a/accel/tcg/plugin-gen.c
-+++ b/include/exec/exec-all.h
++++ b/accel/tcg/plugin-gen.c
-@@ -XXX,XX +XXX,XX @@ typedef ram_addr_t tb_page_addr_t;
+@@ -XXX,XX +XXX,XX @@ enum plugin_gen_from {
- #define TB_PAGE_ADDR_FMT RAM_ADDR_FMT
+     PLUGIN_GEN_FROM_INSN,
- #endif
+     PLUGIN_GEN_FROM_MEM,
+     PLUGIN_GEN_AFTER_INSN,
--void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns);
++    PLUGIN_GEN_AFTER_TB,
- void restore_state_to_opc(CPUArchState *env, TranslationBlock *tb,
+     PLUGIN_GEN_N_FROMS,
-                           target_ulong *data);
+ };
-diff --git a/include/exec/translator.h b/include/exec/translator.h
+@@ -XXX,XX +XXX,XX @@ static void inject_mem_enable_helper(struct qemu_plugin_tb *ptb,
-index XXXXXXX..XXXXXXX 100644
+ /* called before finishing a TB with exit_tb, goto_tb or goto_ptr */
---- a/include/exec/translator.h
+ void plugin_gen_disable_mem_helpers(void)
-+++ b/include/exec/translator.h
+ {
-@@ -XXX,XX +XXX,XX @@
+-    /*
- #include "exec/translate-all.h"
+-     * We could emit the clearing unconditionally and be done. However, this can
- #include "tcg/tcg.h"
+-     * be wasteful if for instance plugins don't track memory accesses, or if
+-     * most TBs don't use helpers. Instead, emit the clearing iff the TB calls
-+/**
+-     * helpers that might access guest memory.
-+ * gen_intermediate_code
+-     *
-+ * @cpu: cpu context
+-     * Note: we do not reset plugin_tb->mem_helper here; a TB might have several
-+ * @tb: translation block
+-     * exit points, and we want to emit the clearing from all of them.
-+ * @max_insns: max number of instructions to translate
+-     */
-+ * @pc: guest virtual program counter address
+-    if (!tcg_ctx->plugin_tb->mem_helper) {
-+ * @host_pc: host physical program counter address
+-        return;
-+ *
++    if (tcg_ctx->plugin_insn) {
-+ * This function must be provided by the target, which should create
++        tcg_gen_plugin_cb(PLUGIN_GEN_AFTER_TB);
-+ * the target-specific DisasContext, and then invoke translator_loop.
+     }
-+ */
+-    tcg_gen_st_ptr(tcg_constant_ptr(NULL), tcg_env,
-+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
+-                   offsetof(CPUState, plugin_mem_cbs) - offsetof(ArchCPU, env));
 +                           target_ulong pc, void *host_pc);
  /**
   * DisasJumpType:
@@ -XXX,XX +XXX,XX @@ typedef struct TranslatorOps {
  /**
   * translator_loop:
 - * @ops: Target-specific operations.
 - * @db: Disassembly context.
   * @cpu: Target vCPU.
   * @tb: Translation block.
   * @max_insns: Maximum number of insns to translate.
 + * @pc: guest virtual program counter address
 + * @host_pc: host physical program counter address
 + * @ops: Target-specific operations.
 + * @db: Disassembly context.
   *
   * Generic translator loop.
   *
@@ -XXX,XX +XXX,XX @@ typedef struct TranslatorOps {
   * - When single-stepping is enabled (system-wide or on the current vCPU).
   * - When too many instructions have been translated.
   */
 -void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
 -                     CPUState *cpu, TranslationBlock *tb, int max_insns);
 +void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
 +                     target_ulong pc, void *host_pc,
 +                     const TranslatorOps *ops, DisasContextBase *db);
  void translator_loop_temp_check(DisasContextBase *db);
 diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translate-all.c
 +++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/cputlb.h"
  #include "exec/translate-all.h"
 +#include "exec/translator.h"
  #include "qemu/bitmap.h"
  #include "qemu/qemu-print.h"
  #include "qemu/timer.h"
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
      TCGProfile *prof = &tcg_ctx->prof;
      int64_t ti;
  #endif
 +    void *host_pc;
      assert_memory_lock();
      qemu_thread_jit_write();
 -    phys_pc = get_page_addr_code(env, pc);
 +    phys_pc = get_page_addr_code_hostp(env, pc, &host_pc);
      if (phys_pc == -1) {
          /* Generate a one-shot TB with 1 insn in it */
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
      tcg_func_start(tcg_ctx);
      tcg_ctx->cpu = env_cpu(env);
 -    gen_intermediate_code(cpu, tb, max_insns);
 +    gen_intermediate_code(cpu, tb, max_insns, pc, host_pc);
      assert(tb->size != 0);
      tcg_ctx->cpu = NULL;
      max_insns = tb->icount;
 diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translator.c
 +++ b/accel/tcg/translator.c
@@ -XXX,XX +XXX,XX @@ static inline void translator_page_protect(DisasContextBase *dcbase,
  #endif
  }
--void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
+ static void plugin_gen_insn_udata(const struct qemu_plugin_tb *ptb,
--                     CPUState *cpu, TranslationBlock *tb, int max_insns)
+@@ -XXX,XX +XXX,XX @@ static void plugin_gen_enable_mem_helper(struct qemu_plugin_tb *ptb,
-+void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
+     inject_mem_enable_helper(ptb, insn, begin_op);
-+                     target_ulong pc, void *host_pc,
+ }
-+                     const TranslatorOps *ops, DisasContextBase *db)
 -static void gen_disable_mem_helper(struct qemu_plugin_tb *ptb,
 -                                   struct qemu_plugin_insn *insn)
 +static void gen_disable_mem_helper(void)
  {
-     uint32_t cflags = tb_cflags(tb);
+-    if (insn->mem_helper) {
-     bool plugin_enabled;
+-        tcg_gen_st_ptr(tcg_constant_ptr(0), tcg_env,
+-                       offsetof(CPUState, plugin_mem_cbs) -
-     /* Initialize DisasContext */
+-                       offsetof(ArchCPU, env));
-     db->tb = tb;
+-    }
--    db->pc_first = tb->pc;
++    tcg_gen_st_ptr(tcg_constant_ptr(0), tcg_env,
--    db->pc_next = db->pc_first;
++                   offsetof(CPUState, plugin_mem_cbs) -
-+    db->pc_first = pc;
++                   offsetof(ArchCPU, env));
 +    db->pc_next = pc;
      db->is_jmp = DISAS_NEXT;
      db->num_insns = 0;
      db->max_insns = max_insns;
 diff --git a/target/alpha/translate.c b/target/alpha/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/alpha/translate.c
 +++ b/target/alpha/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps alpha_tr_ops = {
      .disas_log          = alpha_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&alpha_tr_ops, &dc.base, cpu, tb, max_insns);
 +    translator_loop(cpu, tb, max_insns, pc, host_pc, &alpha_tr_ops, &dc.base);
  }
- void restore_state_to_opc(CPUAlphaState *env, TranslationBlock *tb,
+ static void gen_udata_cb(struct qemu_plugin_dyn_cb *cb)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
-index XXXXXXX..XXXXXXX 100644
+             tcg_ctx->emit_before_op = op;
---- a/target/arm/translate.c
-+++ b/target/arm/translate.c
+             switch (from) {
-@@ -XXX,XX +XXX,XX @@ static const TranslatorOps thumb_translator_ops = {
++            case PLUGIN_GEN_AFTER_TB:
- };
++                if (plugin_tb->mem_helper) {
++                    gen_disable_mem_helper();
- /* generate intermediate code for basic block 'tb'.  */
++                }
--void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
++                break;
-+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
++
-+                           target_ulong pc, void *host_pc)
+             case PLUGIN_GEN_AFTER_INSN:
- {
+                 assert(insn != NULL);
-     DisasContext dc = { };
+-                gen_disable_mem_helper(plugin_tb, insn);
-     const TranslatorOps *ops = &arm_translator_ops;
++                if (insn->mem_helper) {
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
++                    gen_disable_mem_helper();
-     }
++                }
- #endif
+                 break;
--    translator_loop(ops, &dc.base, cpu, tb, max_insns);
+             case PLUGIN_GEN_FROM_TB:
 +    translator_loop(cpu, tb, max_insns, pc, host_pc, ops, &dc.base);
  }
  void restore_state_to_opc(CPUARMState *env, TranslationBlock *tb,
 diff --git a/target/avr/translate.c b/target/avr/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/avr/translate.c
 +++ b/target/avr/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps avr_tr_ops = {
      .disas_log          = avr_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc = { };
 -    translator_loop(&avr_tr_ops, &dc.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &avr_tr_ops, &dc.base);
  }
  void restore_state_to_opc(CPUAVRState *env, TranslationBlock *tb,
 diff --git a/target/cris/translate.c b/target/cris/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/cris/translate.c
 +++ b/target/cris/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps cris_tr_ops = {
      .disas_log          = cris_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&cris_tr_ops, &dc.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &cris_tr_ops, &dc.base);
  }
  void cris_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 diff --git a/target/hexagon/translate.c b/target/hexagon/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hexagon/translate.c
 +++ b/target/hexagon/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps hexagon_tr_ops = {
      .disas_log          = hexagon_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&hexagon_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc,
 +                    &hexagon_tr_ops, &ctx.base);
  }
  #define NAME_LEN               64
 diff --git a/target/hppa/translate.c b/target/hppa/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hppa/translate.c
 +++ b/target/hppa/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps hppa_tr_ops = {
      .disas_log          = hppa_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&hppa_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &hppa_tr_ops, &ctx.base);
  }
  void restore_state_to_opc(CPUHPPAState *env, TranslationBlock *tb,
 diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/translate.c
 +++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps i386_tr_ops = {
  };
  /* generate intermediate code for basic block 'tb'.  */
 -void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&i386_tr_ops, &dc.base, cpu, tb, max_insns);
 +    translator_loop(cpu, tb, max_insns, pc, host_pc, &i386_tr_ops, &dc.base);
  }
  void restore_state_to_opc(CPUX86State *env, TranslationBlock *tb,
 diff --git a/target/loongarch/translate.c b/target/loongarch/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/loongarch/translate.c
 +++ b/target/loongarch/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps loongarch_tr_ops = {
      .disas_log          = loongarch_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&loongarch_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc,
 +                    &loongarch_tr_ops, &ctx.base);
  }
  void loongarch_translate_init(void)
 diff --git a/target/m68k/translate.c b/target/m68k/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/m68k/translate.c
 +++ b/target/m68k/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps m68k_tr_ops = {
      .disas_log          = m68k_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&m68k_tr_ops, &dc.base, cpu, tb, max_insns);
 +    translator_loop(cpu, tb, max_insns, pc, host_pc, &m68k_tr_ops, &dc.base);
  }
  static double floatx80_to_double(CPUM68KState *env, uint16_t high, uint64_t low)
 diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/microblaze/translate.c
 +++ b/target/microblaze/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps mb_tr_ops = {
      .disas_log          = mb_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&mb_tr_ops, &dc.base, cpu, tb, max_insns);
 +    translator_loop(cpu, tb, max_insns, pc, host_pc, &mb_tr_ops, &dc.base);
  }
  void mb_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/tcg/translate.c
 +++ b/target/mips/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps mips_tr_ops = {
      .disas_log          = mips_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&mips_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &mips_tr_ops, &ctx.base);
  }
  void mips_tcg_init(void)
 diff --git a/target/nios2/translate.c b/target/nios2/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/nios2/translate.c
 +++ b/target/nios2/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps nios2_tr_ops = {
      .disas_log          = nios2_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&nios2_tr_ops, &dc.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &nios2_tr_ops, &dc.base);
  }
  void nios2_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/openrisc/translate.c
 +++ b/target/openrisc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps openrisc_tr_ops = {
      .disas_log          = openrisc_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&openrisc_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc,
 +                    &openrisc_tr_ops, &ctx.base);
  }
  void openrisc_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 diff --git a/target/ppc/translate.c b/target/ppc/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/ppc/translate.c
 +++ b/target/ppc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps ppc_tr_ops = {
      .disas_log          = ppc_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&ppc_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &ppc_tr_ops, &ctx.base);
  }
  void restore_state_to_opc(CPUPPCState *env, TranslationBlock *tb,
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps riscv_tr_ops = {
      .disas_log          = riscv_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&riscv_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &riscv_tr_ops, &ctx.base);
  }
  void riscv_translate_init(void)
 diff --git a/target/rx/translate.c b/target/rx/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/rx/translate.c
 +++ b/target/rx/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps rx_tr_ops = {
      .disas_log          = rx_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&rx_tr_ops, &dc.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &rx_tr_ops, &dc.base);
  }
  void restore_state_to_opc(CPURXState *env, TranslationBlock *tb,
 diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/tcg/translate.c
 +++ b/target/s390x/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps s390x_tr_ops = {
      .disas_log          = s390x_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&s390x_tr_ops, &dc.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &s390x_tr_ops, &dc.base);
  }
  void restore_state_to_opc(CPUS390XState *env, TranslationBlock *tb,
 diff --git a/target/sh4/translate.c b/target/sh4/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sh4/translate.c
 +++ b/target/sh4/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps sh4_tr_ops = {
      .disas_log          = sh4_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&sh4_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &sh4_tr_ops, &ctx.base);
  }
  void restore_state_to_opc(CPUSH4State *env, TranslationBlock *tb,
 diff --git a/target/sparc/translate.c b/target/sparc/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sparc/translate.c
 +++ b/target/sparc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps sparc_tr_ops = {
      .disas_log          = sparc_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc = {};
 -    translator_loop(&sparc_tr_ops, &dc.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &sparc_tr_ops, &dc.base);
  }
  void sparc_tcg_init(void)
 diff --git a/target/tricore/translate.c b/target/tricore/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tricore/translate.c
 +++ b/target/tricore/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps tricore_tr_ops = {
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&tricore_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc,
 +                    &tricore_tr_ops, &ctx.base);
  }
  void
 diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/xtensa/translate.c
 +++ b/target/xtensa/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps xtensa_translator_ops = {
      .disas_log          = xtensa_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc = {};
 -    translator_loop(&xtensa_translator_ops, &dc.base, cpu, tb, max_insns);
 +    translator_loop(cpu, tb, max_insns, pc, host_pc,
 +                    &xtensa_translator_ops, &dc.base);
  }
  void xtensa_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 --
 .34.1

-[PULL 01/20] linux-user/arm: Mark the commpage executable
+[PULL 09/20] plugins: Use emit_before_op for PLUGIN_GEN_FROM_INSN
-We're about to start validating PAGE_EXEC, which means
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 that we've got to mark the commpage executable.  We had
 been placing the commpage outside of reserved_va, which
 was incorrect and lead to an abort.
 Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- linux-user/arm/target_cpu.h | 4 ++--
+ include/qemu/plugin.h  |   1 -
- linux-user/elfload.c        | 6 +++++-
+ accel/tcg/plugin-gen.c | 286 ++++++++++-------------------------------
-files changed, 7 insertions(+), 3 deletions(-)
+ plugins/api.c          |   8 +-
 files changed, 67 insertions(+), 228 deletions(-)
-diff --git a/linux-user/arm/target_cpu.h b/linux-user/arm/target_cpu.h
+diff --git a/include/qemu/plugin.h b/include/qemu/plugin.h
 index XXXXXXX..XXXXXXX 100644
---- a/linux-user/arm/target_cpu.h
+--- a/include/qemu/plugin.h
-+++ b/linux-user/arm/target_cpu.h
++++ b/include/qemu/plugin.h
-@@ -XXX,XX +XXX,XX @@ static inline unsigned long arm_max_reserved_va(CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ enum plugin_dyn_cb_type {
-     } else {
-         /*
+ enum plugin_dyn_cb_subtype {
-          * We need to be able to map the commpage.
+     PLUGIN_CB_REGULAR,
--         * See validate_guest_space in linux-user/elfload.c.
+-    PLUGIN_CB_REGULAR_R,
-+         * See init_guest_commpage in linux-user/elfload.c.
+     PLUGIN_CB_INLINE,
-          */
+     PLUGIN_N_CB_SUBTYPES,
--        return 0xffff0000ul;
+ };
-+        return 0xfffffffful;
+diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/plugin-gen.c
 +++ b/accel/tcg/plugin-gen.c
@@ -XXX,XX +XXX,XX @@ void HELPER(plugin_vcpu_mem_cb)(unsigned int vcpu_index,
                                  void *userdata)
  { }
 -static void gen_empty_udata_cb(void (*gen_helper)(TCGv_i32, TCGv_ptr))
 -{
 -    TCGv_i32 cpu_index = tcg_temp_ebb_new_i32();
 -    TCGv_ptr udata = tcg_temp_ebb_new_ptr();
 -
 -    tcg_gen_movi_ptr(udata, 0);
 -    tcg_gen_ld_i32(cpu_index, tcg_env,
 -                   -offsetof(ArchCPU, env) + offsetof(CPUState, cpu_index));
 -    gen_helper(cpu_index, udata);
 -
 -    tcg_temp_free_ptr(udata);
 -    tcg_temp_free_i32(cpu_index);
 -}
 -
 -static void gen_empty_udata_cb_no_wg(void)
 -{
 -    gen_empty_udata_cb(gen_helper_plugin_vcpu_udata_cb_no_wg);
 -}
 -
 -static void gen_empty_udata_cb_no_rwg(void)
 -{
 -    gen_empty_udata_cb(gen_helper_plugin_vcpu_udata_cb_no_rwg);
 -}
 -
  /*
   * For now we only support addi_i64.
   * When we support more ops, we can generate one empty inline cb for each.
@@ -XXX,XX +XXX,XX @@ static void gen_empty_mem_cb(TCGv_i64 addr, uint32_t info)
      tcg_temp_free_i32(cpu_index);
  }
 -/*
 - * Share the same function for enable/disable. When enabling, the NULL
 - * pointer will be overwritten later.
 - */
 -static void gen_empty_mem_helper(void)
 -{
 -    TCGv_ptr ptr = tcg_temp_ebb_new_ptr();
 -
 -    tcg_gen_movi_ptr(ptr, 0);
 -    tcg_gen_st_ptr(ptr, tcg_env, offsetof(CPUState, plugin_mem_cbs) -
 -                                 offsetof(ArchCPU, env));
 -    tcg_temp_free_ptr(ptr);
 -}
 -
  static void gen_plugin_cb_start(enum plugin_gen_from from,
                                  enum plugin_gen_cb type, unsigned wr)
  {
      tcg_gen_plugin_cb_start(from, type, wr);
  }
 -static void gen_wrapped(enum plugin_gen_from from,
 -                        enum plugin_gen_cb type, void (*func)(void))
 -{
 -    gen_plugin_cb_start(from, type, 0);
 -    func();
 -    tcg_gen_plugin_cb_end();
 -}
 -
  static void plugin_gen_empty_callback(enum plugin_gen_from from)
  {
      switch (from) {
      case PLUGIN_GEN_AFTER_INSN:
      case PLUGIN_GEN_FROM_TB:
 -        tcg_gen_plugin_cb(from);
 -        break;
      case PLUGIN_GEN_FROM_INSN:
 -        /*
 -         * Note: plugin_gen_inject() relies on ENABLE_MEM_HELPER being
 -         * the first callback of an instruction
 -         */
 -        gen_wrapped(from, PLUGIN_GEN_ENABLE_MEM_HELPER,
 -                    gen_empty_mem_helper);
 -        gen_wrapped(from, PLUGIN_GEN_CB_UDATA, gen_empty_udata_cb_no_rwg);
 -        gen_wrapped(from, PLUGIN_GEN_CB_UDATA_R, gen_empty_udata_cb_no_wg);
 -        gen_wrapped(from, PLUGIN_GEN_CB_INLINE, gen_empty_inline_cb);
 +        tcg_gen_plugin_cb(from);
          break;
      default:
          g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ static TCGOp *copy_mul_i32(TCGOp **begin_op, TCGOp *op, uint32_t v)
      return op;
  }
 -static TCGOp *copy_st_ptr(TCGOp **begin_op, TCGOp *op)
 -{
 -    if (UINTPTR_MAX == UINT32_MAX) {
 -        /* st_i32 */
 -        op = copy_op(begin_op, op, INDEX_op_st_i32);
 -    } else {
 -        /* st_i64 */
 -        op = copy_st_i64(begin_op, op);
 -    }
 -    return op;
 -}
 -
  static TCGOp *copy_call(TCGOp **begin_op, TCGOp *op, void *func, int *cb_idx)
  {
      TCGOp *old_op;
@@ -XXX,XX +XXX,XX @@ static TCGOp *copy_call(TCGOp **begin_op, TCGOp *op, void *func, int *cb_idx)
      return op;
  }
 -/*
 - * When we append/replace ops here we are sensitive to changing patterns of
 - * TCGOps generated by the tcg_gen_FOO calls when we generated the
 - * empty callbacks. This will assert very quickly in a debug build as
 - * we assert the ops we are replacing are the correct ones.
 - */
 -static TCGOp *append_udata_cb(const struct qemu_plugin_dyn_cb *cb,
 -                              TCGOp *begin_op, TCGOp *op, int *cb_idx)
 -{
 -    /* const_ptr */
 -    op = copy_const_ptr(&begin_op, op, cb->userp);
 -
 -    /* copy the ld_i32, but note that we only have to copy it once */
 -    if (*cb_idx == -1) {
 -        op = copy_op(&begin_op, op, INDEX_op_ld_i32);
 -    } else {
 -        begin_op = QTAILQ_NEXT(begin_op, link);
 -        tcg_debug_assert(begin_op && begin_op->opc == INDEX_op_ld_i32);
 -    }
 -
 -    /* call */
 -    op = copy_call(&begin_op, op, cb->regular.f.vcpu_udata, cb_idx);
 -
 -    return op;
 -}
 -
  static TCGOp *append_inline_cb(const struct qemu_plugin_dyn_cb *cb,
                                 TCGOp *begin_op, TCGOp *op,
                                 int *unused)
@@ -XXX,XX +XXX,XX @@ typedef TCGOp *(*inject_fn)(const struct qemu_plugin_dyn_cb *cb,
                              TCGOp *begin_op, TCGOp *op, int *intp);
  typedef bool (*op_ok_fn)(const TCGOp *op, const struct qemu_plugin_dyn_cb *cb);
 -static bool op_ok(const TCGOp *op, const struct qemu_plugin_dyn_cb *cb)
 -{
 -    return true;
 -}
 -
  static bool op_rw(const TCGOp *op, const struct qemu_plugin_dyn_cb *cb)
  {
      int w;
@@ -XXX,XX +XXX,XX @@ static void inject_cb_type(const GArray *cbs, TCGOp *begin_op,
      rm_ops_range(begin_op, end_op);
  }
 -static void
 -inject_udata_cb(const GArray *cbs, TCGOp *begin_op)
 -{
 -    inject_cb_type(cbs, begin_op, append_udata_cb, op_ok);
 -}
 -
  static void
  inject_inline_cb(const GArray *cbs, TCGOp *begin_op, op_ok_fn ok)
  {
@@ -XXX,XX +XXX,XX @@ inject_mem_cb(const GArray *cbs, TCGOp *begin_op)
      inject_cb_type(cbs, begin_op, append_mem_cb, op_rw);
  }
 -/* we could change the ops in place, but we can reuse more code by copying */
 -static void inject_mem_helper(TCGOp *begin_op, GArray *arr)
 -{
 -    TCGOp *orig_op = begin_op;
 -    TCGOp *end_op;
 -    TCGOp *op;
 -
 -    end_op = find_op(begin_op, INDEX_op_plugin_cb_end);
 -    tcg_debug_assert(end_op);
 -
 -    /* const ptr */
 -    op = copy_const_ptr(&begin_op, end_op, arr);
 -
 -    /* st_ptr */
 -    op = copy_st_ptr(&begin_op, op);
 -
 -    rm_ops_range(orig_op, end_op);
 -}
 -
 -/*
 - * Tracking memory accesses performed from helpers requires extra work.
 - * If an instruction is emulated with helpers, we do two things:
 - * (1) copy the CB descriptors, and keep track of it so that they can be
 - * freed later on, and (2) point CPUState.plugin_mem_cbs to the descriptors, so
 - * that we can read them at run-time (i.e. when the helper executes).
 - * This run-time access is performed from qemu_plugin_vcpu_mem_cb.
 - *
 - * Note that plugin_gen_disable_mem_helpers undoes (2). Since it
 - * is possible that the code we generate after the instruction is
 - * dead, we also add checks before generating tb_exit etc.
 - */
 -static void inject_mem_enable_helper(struct qemu_plugin_tb *ptb,
 -                                     struct qemu_plugin_insn *plugin_insn,
 -                                     TCGOp *begin_op)
 -{
 -    GArray *cbs[2];
 -    GArray *arr;
 -    size_t n_cbs, i;
 -
 -    cbs[0] = plugin_insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_REGULAR];
 -    cbs[1] = plugin_insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_INLINE];
 -
 -    n_cbs = 0;
 -    for (i = 0; i < ARRAY_SIZE(cbs); i++) {
 -        n_cbs += cbs[i]->len;
 -    }
 -
 -    plugin_insn->mem_helper = plugin_insn->calls_helpers && n_cbs;
 -    if (likely(!plugin_insn->mem_helper)) {
 -        rm_ops(begin_op);
 -        return;
 -    }
 -    ptb->mem_helper = true;
 -
 -    arr = g_array_sized_new(false, false,
 -                            sizeof(struct qemu_plugin_dyn_cb), n_cbs);
 -
 -    for (i = 0; i < ARRAY_SIZE(cbs); i++) {
 -        g_array_append_vals(arr, cbs[i]->data, cbs[i]->len);
 -    }
 -
 -    qemu_plugin_add_dyn_cb_arr(arr);
 -    inject_mem_helper(begin_op, arr);
 -}
 -
  /* called before finishing a TB with exit_tb, goto_tb or goto_ptr */
  void plugin_gen_disable_mem_helpers(void)
  {
@@ -XXX,XX +XXX,XX @@ void plugin_gen_disable_mem_helpers(void)
      }
  }
- #define MAX_RESERVED_VA  arm_max_reserved_va
-diff --git a/linux-user/elfload.c b/linux-user/elfload.c
+-static void plugin_gen_insn_udata(const struct qemu_plugin_tb *ptb,
 -                                  TCGOp *begin_op, int insn_idx)
 -{
 -    struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
 -
 -    inject_udata_cb(insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_REGULAR], begin_op);
 -}
 -
 -static void plugin_gen_insn_udata_r(const struct qemu_plugin_tb *ptb,
 -                                    TCGOp *begin_op, int insn_idx)
 -{
 -    struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
 -
 -    inject_udata_cb(insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_REGULAR_R], begin_op);
 -}
 -
 -static void plugin_gen_insn_inline(const struct qemu_plugin_tb *ptb,
 -                                   TCGOp *begin_op, int insn_idx)
 -{
 -    struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
 -    inject_inline_cb(insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_INLINE],
 -                     begin_op, op_ok);
 -}
 -
  static void plugin_gen_mem_regular(const struct qemu_plugin_tb *ptb,
                                     TCGOp *begin_op, int insn_idx)
  {
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_mem_inline(const struct qemu_plugin_tb *ptb,
      inject_inline_cb(cbs, begin_op, op_rw);
  }
 -static void plugin_gen_enable_mem_helper(struct qemu_plugin_tb *ptb,
 -                                         TCGOp *begin_op, int insn_idx)
 +static void gen_enable_mem_helper(struct qemu_plugin_tb *ptb,
 +                                  struct qemu_plugin_insn *insn)
  {
 -    struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
 -    inject_mem_enable_helper(ptb, insn, begin_op);
 +    GArray *cbs[2];
 +    GArray *arr;
 +    size_t n_cbs;
 +
 +    /*
 +     * Tracking memory accesses performed from helpers requires extra work.
 +     * If an instruction is emulated with helpers, we do two things:
 +     * (1) copy the CB descriptors, and keep track of it so that they can be
 +     * freed later on, and (2) point CPUState.plugin_mem_cbs to the
 +     * descriptors, so that we can read them at run-time
 +     * (i.e. when the helper executes).
 +     * This run-time access is performed from qemu_plugin_vcpu_mem_cb.
 +     *
 +     * Note that plugin_gen_disable_mem_helpers undoes (2). Since it
 +     * is possible that the code we generate after the instruction is
 +     * dead, we also add checks before generating tb_exit etc.
 +     */
 +    if (!insn->calls_helpers) {
 +        return;
 +    }
 +
 +    cbs[0] = insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_REGULAR];
 +    cbs[1] = insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_INLINE];
 +    n_cbs = cbs[0]->len + cbs[1]->len;
 +
 +    if (n_cbs == 0) {
 +        insn->mem_helper = false;
 +        return;
 +    }
 +    insn->mem_helper = true;
 +    ptb->mem_helper = true;
 +
 +    arr = g_array_sized_new(false, false,
 +                            sizeof(struct qemu_plugin_dyn_cb), n_cbs);
 +    g_array_append_vals(arr, cbs[0]->data, cbs[0]->len);
 +    g_array_append_vals(arr, cbs[1]->data, cbs[1]->len);
 +
 +    qemu_plugin_add_dyn_cb_arr(arr);
 +
 +    tcg_gen_st_ptr(tcg_constant_ptr((intptr_t)arr), tcg_env,
 +                   offsetof(CPUState, plugin_mem_cbs) -
 +                   offsetof(ArchCPU, env));
  }
  static void gen_disable_mem_helper(void)
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
                  }
                  break;
 +            case PLUGIN_GEN_FROM_INSN:
 +                assert(insn != NULL);
 +
 +                gen_enable_mem_helper(plugin_tb, insn);
 +
 +                cbs = insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_REGULAR];
 +                for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
 +                    struct qemu_plugin_dyn_cb *cb =
 +                        &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
 +                    gen_udata_cb(cb);
 +                }
 +
 +                cbs = insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_INLINE];
 +                for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
 +                    struct qemu_plugin_dyn_cb *cb =
 +                        &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
 +                    gen_inline_cb(cb);
 +                }
 +                break;
 +
              default:
                  g_assert_not_reached();
              }
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
              enum plugin_gen_cb type = op->args[1];
              switch (from) {
 -            case PLUGIN_GEN_FROM_INSN:
 -            {
 -                g_assert(insn_idx >= 0);
 -
 -                switch (type) {
 -                case PLUGIN_GEN_CB_UDATA:
 -                    plugin_gen_insn_udata(plugin_tb, op, insn_idx);
 -                    break;
 -                case PLUGIN_GEN_CB_UDATA_R:
 -                    plugin_gen_insn_udata_r(plugin_tb, op, insn_idx);
 -                    break;
 -                case PLUGIN_GEN_CB_INLINE:
 -                    plugin_gen_insn_inline(plugin_tb, op, insn_idx);
 -                    break;
 -                case PLUGIN_GEN_ENABLE_MEM_HELPER:
 -                    plugin_gen_enable_mem_helper(plugin_tb, op, insn_idx);
 -                    break;
 -                default:
 -                    g_assert_not_reached();
 -                }
 -                break;
 -            }
              case PLUGIN_GEN_FROM_MEM:
              {
                  g_assert(insn_idx >= 0);
 diff --git a/plugins/api.c b/plugins/api.c
 index XXXXXXX..XXXXXXX 100644
---- a/linux-user/elfload.c
+--- a/plugins/api.c
-+++ b/linux-user/elfload.c
++++ b/plugins/api.c
-@@ -XXX,XX +XXX,XX @@ enum {
+@@ -XXX,XX +XXX,XX @@ void qemu_plugin_register_vcpu_insn_exec_cb(struct qemu_plugin_insn *insn,
+                                             void *udata)
- static bool init_guest_commpage(void)
+ {
- {
+     if (!insn->mem_only) {
--    void *want = g2h_untagged(HI_COMMPAGE & -qemu_host_page_size);
+-        int index = flags == QEMU_PLUGIN_CB_R_REGS ||
-+    abi_ptr commpage = HI_COMMPAGE & -qemu_host_page_size;
+-                    flags == QEMU_PLUGIN_CB_RW_REGS ?
-+    void *want = g2h_untagged(commpage);
+-                    PLUGIN_CB_REGULAR_R : PLUGIN_CB_REGULAR;
-     void *addr = mmap(want, qemu_host_page_size, PROT_READ | PROT_WRITE,
+-
-                       MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
+-        plugin_register_dyn_cb__udata(&insn->cbs[PLUGIN_CB_INSN][index],
+-                                      cb, flags, udata);
-@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)
++        plugin_register_dyn_cb__udata(
-         perror("Protecting guest commpage");
++            &insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_REGULAR], cb, flags, udata);
          exit(EXIT_FAILURE);
      }
-+
+ }
 +    page_set_flags(commpage, commpage + qemu_host_page_size,
 +                   PAGE_READ | PAGE_EXEC | PAGE_VALID);
      return true;
  }
 --
 .34.1

-[PULL 02/20] linux-user/hppa: Allocate page zero as a commpage
+[PULL 10/20] plugins: Use emit_before_op for PLUGIN_GEN_FROM_MEM
-We're about to start validating PAGE_EXEC, which means that we've
+Introduce a new plugin_mem_cb op to hold the address temp
-got to mark page zero executable.  We had been special casing this
+and meminfo computed by tcg-op-ldst.c.  Because this now
-entirely within translate.
+has its own opcode, we no longer need PLUGIN_GEN_FROM_MEM.
-Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- linux-user/elfload.c | 34 +++++++++++++++++++++++++++++++---
+ include/exec/plugin-gen.h   |   4 -
-file changed, 31 insertions(+), 3 deletions(-)
+ include/tcg/tcg-op-common.h |   1 +
  include/tcg/tcg-opc.h       |   1 +
  accel/tcg/plugin-gen.c      | 408 ++++--------------------------------
  tcg/tcg-op-ldst.c           |   6 +-
  tcg/tcg-op.c                |   5 +
 files changed, 54 insertions(+), 371 deletions(-)
-diff --git a/linux-user/elfload.c b/linux-user/elfload.c
+diff --git a/include/exec/plugin-gen.h b/include/exec/plugin-gen.h
 index XXXXXXX..XXXXXXX 100644
---- a/linux-user/elfload.c
+--- a/include/exec/plugin-gen.h
-+++ b/linux-user/elfload.c
++++ b/include/exec/plugin-gen.h
-@@ -XXX,XX +XXX,XX @@ static inline void init_thread(struct target_pt_regs *regs,
+@@ -XXX,XX +XXX,XX @@ void plugin_gen_insn_start(CPUState *cpu, const struct DisasContextBase *db);
-     regs->gr[31] = infop->entry;
+ void plugin_gen_insn_end(void);
  void plugin_gen_disable_mem_helpers(void);
 -void plugin_gen_empty_mem_callback(TCGv_i64 addr, uint32_t info);
  #else /* !CONFIG_PLUGIN */
@@ -XXX,XX +XXX,XX @@ static inline void plugin_gen_tb_end(CPUState *cpu, size_t num_insns)
  static inline void plugin_gen_disable_mem_helpers(void)
  { }
 -static inline void plugin_gen_empty_mem_callback(TCGv_i64 addr, uint32_t info)
 -{ }
 -
  #endif /* CONFIG_PLUGIN */
  #endif /* QEMU_PLUGIN_GEN_H */
 diff --git a/include/tcg/tcg-op-common.h b/include/tcg/tcg-op-common.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/tcg/tcg-op-common.h
 +++ b/include/tcg/tcg-op-common.h
@@ -XXX,XX +XXX,XX @@ void tcg_gen_goto_tb(unsigned idx);
  void tcg_gen_lookup_and_goto_ptr(void);
  void tcg_gen_plugin_cb(unsigned from);
 +void tcg_gen_plugin_mem_cb(TCGv_i64 addr, unsigned meminfo);
  void tcg_gen_plugin_cb_start(unsigned from, unsigned type, unsigned wr);
  void tcg_gen_plugin_cb_end(void);
 diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/tcg/tcg-opc.h
 +++ b/include/tcg/tcg-opc.h
@@ -XXX,XX +XXX,XX @@ DEF(goto_tb, 0, 0, 1, TCG_OPF_BB_EXIT | TCG_OPF_BB_END)
  DEF(goto_ptr, 0, 1, 0, TCG_OPF_BB_EXIT | TCG_OPF_BB_END)
  DEF(plugin_cb, 0, 0, 1, TCG_OPF_NOT_PRESENT)
 +DEF(plugin_mem_cb, 0, 1, 1, TCG_OPF_NOT_PRESENT)
  DEF(plugin_cb_start, 0, 0, 3, TCG_OPF_NOT_PRESENT)
  DEF(plugin_cb_end, 0, 0, 0, TCG_OPF_NOT_PRESENT)
 diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/plugin-gen.c
 +++ b/accel/tcg/plugin-gen.c
@@ -XXX,XX +XXX,XX @@
  enum plugin_gen_from {
      PLUGIN_GEN_FROM_TB,
      PLUGIN_GEN_FROM_INSN,
 -    PLUGIN_GEN_FROM_MEM,
      PLUGIN_GEN_AFTER_INSN,
      PLUGIN_GEN_AFTER_TB,
      PLUGIN_GEN_N_FROMS,
@@ -XXX,XX +XXX,XX @@ void HELPER(plugin_vcpu_mem_cb)(unsigned int vcpu_index,
                                  void *userdata)
  { }
 -/*
 - * For now we only support addi_i64.
 - * When we support more ops, we can generate one empty inline cb for each.
 - */
 -static void gen_empty_inline_cb(void)
 -{
 -    TCGv_i32 cpu_index = tcg_temp_ebb_new_i32();
 -    TCGv_ptr cpu_index_as_ptr = tcg_temp_ebb_new_ptr();
 -    TCGv_i64 val = tcg_temp_ebb_new_i64();
 -    TCGv_ptr ptr = tcg_temp_ebb_new_ptr();
 -
 -    tcg_gen_ld_i32(cpu_index, tcg_env,
 -                   -offsetof(ArchCPU, env) + offsetof(CPUState, cpu_index));
 -    /* second operand will be replaced by immediate value */
 -    tcg_gen_mul_i32(cpu_index, cpu_index, cpu_index);
 -    tcg_gen_ext_i32_ptr(cpu_index_as_ptr, cpu_index);
 -
 -    tcg_gen_movi_ptr(ptr, 0);
 -    tcg_gen_add_ptr(ptr, ptr, cpu_index_as_ptr);
 -    tcg_gen_ld_i64(val, ptr, 0);
 -    /* second operand will be replaced by immediate value */
 -    tcg_gen_add_i64(val, val, val);
 -
 -    tcg_gen_st_i64(val, ptr, 0);
 -    tcg_temp_free_ptr(ptr);
 -    tcg_temp_free_i64(val);
 -    tcg_temp_free_ptr(cpu_index_as_ptr);
 -    tcg_temp_free_i32(cpu_index);
 -}
 -
 -static void gen_empty_mem_cb(TCGv_i64 addr, uint32_t info)
 -{
 -    TCGv_i32 cpu_index = tcg_temp_ebb_new_i32();
 -    TCGv_i32 meminfo = tcg_temp_ebb_new_i32();
 -    TCGv_ptr udata = tcg_temp_ebb_new_ptr();
 -
 -    tcg_gen_movi_i32(meminfo, info);
 -    tcg_gen_movi_ptr(udata, 0);
 -    tcg_gen_ld_i32(cpu_index, tcg_env,
 -                   -offsetof(ArchCPU, env) + offsetof(CPUState, cpu_index));
 -
 -    gen_helper_plugin_vcpu_mem_cb(cpu_index, meminfo, addr, udata);
 -
 -    tcg_temp_free_ptr(udata);
 -    tcg_temp_free_i32(meminfo);
 -    tcg_temp_free_i32(cpu_index);
 -}
 -
 -static void gen_plugin_cb_start(enum plugin_gen_from from,
 -                                enum plugin_gen_cb type, unsigned wr)
 -{
 -    tcg_gen_plugin_cb_start(from, type, wr);
 -}
 -
  static void plugin_gen_empty_callback(enum plugin_gen_from from)
  {
      switch (from) {
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_empty_callback(enum plugin_gen_from from)
      }
  }
-+#define LO_COMMPAGE  0
+-void plugin_gen_empty_mem_callback(TCGv_i64 addr, uint32_t info)
 -{
 -    enum qemu_plugin_mem_rw rw = get_plugin_meminfo_rw(info);
 -
 -    gen_plugin_cb_start(PLUGIN_GEN_FROM_MEM, PLUGIN_GEN_CB_MEM, rw);
 -    gen_empty_mem_cb(addr, info);
 -    tcg_gen_plugin_cb_end();
 -
 -    gen_plugin_cb_start(PLUGIN_GEN_FROM_MEM, PLUGIN_GEN_CB_INLINE, rw);
 -    gen_empty_inline_cb();
 -    tcg_gen_plugin_cb_end();
 -}
 -
 -static TCGOp *find_op(TCGOp *op, TCGOpcode opc)
 -{
 -    while (op) {
 -        if (op->opc == opc) {
 -            return op;
 -        }
 -        op = QTAILQ_NEXT(op, link);
 -    }
 -    return NULL;
 -}
 -
 -static TCGOp *rm_ops_range(TCGOp *begin, TCGOp *end)
 -{
 -    TCGOp *ret = QTAILQ_NEXT(end, link);
 -
 -    QTAILQ_REMOVE_SEVERAL(&tcg_ctx->ops, begin, end, link);
 -    return ret;
 -}
 -
 -/* remove all ops until (and including) plugin_cb_end */
 -static TCGOp *rm_ops(TCGOp *op)
 -{
 -    TCGOp *end_op = find_op(op, INDEX_op_plugin_cb_end);
 -
 -    tcg_debug_assert(end_op);
 -    return rm_ops_range(op, end_op);
 -}
 -
 -static TCGOp *copy_op_nocheck(TCGOp **begin_op, TCGOp *op)
 -{
 -    TCGOp *old_op = QTAILQ_NEXT(*begin_op, link);
 -    unsigned nargs = old_op->nargs;
 -
 -    *begin_op = old_op;
 -    op = tcg_op_insert_after(tcg_ctx, op, old_op->opc, nargs);
 -    memcpy(op->args, old_op->args, sizeof(op->args[0]) * nargs);
 -
 -    return op;
 -}
 -
 -static TCGOp *copy_op(TCGOp **begin_op, TCGOp *op, TCGOpcode opc)
 -{
 -    op = copy_op_nocheck(begin_op, op);
 -    tcg_debug_assert((*begin_op)->opc == opc);
 -    return op;
 -}
 -
 -static TCGOp *copy_const_ptr(TCGOp **begin_op, TCGOp *op, void *ptr)
 -{
 -    if (UINTPTR_MAX == UINT32_MAX) {
 -        /* mov_i32 */
 -        op = copy_op(begin_op, op, INDEX_op_mov_i32);
 -        op->args[1] = tcgv_i32_arg(tcg_constant_i32((uintptr_t)ptr));
 -    } else {
 -        /* mov_i64 */
 -        op = copy_op(begin_op, op, INDEX_op_mov_i64);
 -        op->args[1] = tcgv_i64_arg(tcg_constant_i64((uintptr_t)ptr));
 -    }
 -    return op;
 -}
 -
 -static TCGOp *copy_ld_i32(TCGOp **begin_op, TCGOp *op)
 -{
 -    return copy_op(begin_op, op, INDEX_op_ld_i32);
 -}
 -
 -static TCGOp *copy_ext_i32_ptr(TCGOp **begin_op, TCGOp *op)
 -{
 -    if (UINTPTR_MAX == UINT32_MAX) {
 -        op = copy_op(begin_op, op, INDEX_op_mov_i32);
 -    } else {
 -        op = copy_op(begin_op, op, INDEX_op_ext_i32_i64);
 -    }
 -    return op;
 -}
 -
 -static TCGOp *copy_add_ptr(TCGOp **begin_op, TCGOp *op)
 -{
 -    if (UINTPTR_MAX == UINT32_MAX) {
 -        op = copy_op(begin_op, op, INDEX_op_add_i32);
 -    } else {
 -        op = copy_op(begin_op, op, INDEX_op_add_i64);
 -    }
 -    return op;
 -}
 -
 -static TCGOp *copy_ld_i64(TCGOp **begin_op, TCGOp *op)
 -{
 -    if (TCG_TARGET_REG_BITS == 32) {
 -        /* 2x ld_i32 */
 -        op = copy_ld_i32(begin_op, op);
 -        op = copy_ld_i32(begin_op, op);
 -    } else {
 -        /* ld_i64 */
 -        op = copy_op(begin_op, op, INDEX_op_ld_i64);
 -    }
 -    return op;
 -}
 -
 -static TCGOp *copy_st_i64(TCGOp **begin_op, TCGOp *op)
 -{
 -    if (TCG_TARGET_REG_BITS == 32) {
 -        /* 2x st_i32 */
 -        op = copy_op(begin_op, op, INDEX_op_st_i32);
 -        op = copy_op(begin_op, op, INDEX_op_st_i32);
 -    } else {
 -        /* st_i64 */
 -        op = copy_op(begin_op, op, INDEX_op_st_i64);
 -    }
 -    return op;
 -}
 -
 -static TCGOp *copy_add_i64(TCGOp **begin_op, TCGOp *op, uint64_t v)
 -{
 -    if (TCG_TARGET_REG_BITS == 32) {
 -        /* all 32-bit backends must implement add2_i32 */
 -        g_assert(TCG_TARGET_HAS_add2_i32);
 -        op = copy_op(begin_op, op, INDEX_op_add2_i32);
 -        op->args[4] = tcgv_i32_arg(tcg_constant_i32(v));
 -        op->args[5] = tcgv_i32_arg(tcg_constant_i32(v >> 32));
 -    } else {
 -        op = copy_op(begin_op, op, INDEX_op_add_i64);
 -        op->args[2] = tcgv_i64_arg(tcg_constant_i64(v));
 -    }
 -    return op;
 -}
 -
 -static TCGOp *copy_mul_i32(TCGOp **begin_op, TCGOp *op, uint32_t v)
 -{
 -    op = copy_op(begin_op, op, INDEX_op_mul_i32);
 -    op->args[2] = tcgv_i32_arg(tcg_constant_i32(v));
 -    return op;
 -}
 -
 -static TCGOp *copy_call(TCGOp **begin_op, TCGOp *op, void *func, int *cb_idx)
 -{
 -    TCGOp *old_op;
 -    int func_idx;
 -
 -    /* copy all ops until the call */
 -    do {
 -        op = copy_op_nocheck(begin_op, op);
 -    } while (op->opc != INDEX_op_call);
 -
 -    /* fill in the op call */
 -    old_op = *begin_op;
 -    TCGOP_CALLI(op) = TCGOP_CALLI(old_op);
 -    TCGOP_CALLO(op) = TCGOP_CALLO(old_op);
 -    tcg_debug_assert(op->life == 0);
 -
 -    func_idx = TCGOP_CALLO(op) + TCGOP_CALLI(op);
 -    *cb_idx = func_idx;
 -    op->args[func_idx] = (uintptr_t)func;
 -
 -    return op;
 -}
 -
 -static TCGOp *append_inline_cb(const struct qemu_plugin_dyn_cb *cb,
 -                               TCGOp *begin_op, TCGOp *op,
 -                               int *unused)
 -{
 -    char *ptr = cb->inline_insn.entry.score->data->data;
 -    size_t elem_size = g_array_get_element_size(
 -        cb->inline_insn.entry.score->data);
 -    size_t offset = cb->inline_insn.entry.offset;
 -
 -    op = copy_ld_i32(&begin_op, op);
 -    op = copy_mul_i32(&begin_op, op, elem_size);
 -    op = copy_ext_i32_ptr(&begin_op, op);
 -    op = copy_const_ptr(&begin_op, op, ptr + offset);
 -    op = copy_add_ptr(&begin_op, op);
 -    op = copy_ld_i64(&begin_op, op);
 -    op = copy_add_i64(&begin_op, op, cb->inline_insn.imm);
 -    op = copy_st_i64(&begin_op, op);
 -    return op;
 -}
 -
 -static TCGOp *append_mem_cb(const struct qemu_plugin_dyn_cb *cb,
 -                            TCGOp *begin_op, TCGOp *op, int *cb_idx)
 -{
 -    enum plugin_gen_cb type = begin_op->args[1];
 -
 -    tcg_debug_assert(type == PLUGIN_GEN_CB_MEM);
 -
 -    /* const_i32 == mov_i32 ("info", so it remains as is) */
 -    op = copy_op(&begin_op, op, INDEX_op_mov_i32);
 -
 -    /* const_ptr */
 -    op = copy_const_ptr(&begin_op, op, cb->userp);
 -
 -    /* copy the ld_i32, but note that we only have to copy it once */
 -    if (*cb_idx == -1) {
 -        op = copy_op(&begin_op, op, INDEX_op_ld_i32);
 -    } else {
 -        begin_op = QTAILQ_NEXT(begin_op, link);
 -        tcg_debug_assert(begin_op && begin_op->opc == INDEX_op_ld_i32);
 -    }
 -
 -    if (type == PLUGIN_GEN_CB_MEM) {
 -        /* call */
 -        op = copy_call(&begin_op, op, cb->regular.f.vcpu_udata, cb_idx);
 -    }
 -
 -    return op;
 -}
 -
 -typedef TCGOp *(*inject_fn)(const struct qemu_plugin_dyn_cb *cb,
 -                            TCGOp *begin_op, TCGOp *op, int *intp);
 -typedef bool (*op_ok_fn)(const TCGOp *op, const struct qemu_plugin_dyn_cb *cb);
 -
 -static bool op_rw(const TCGOp *op, const struct qemu_plugin_dyn_cb *cb)
 -{
 -    int w;
 -
 -    w = op->args[2];
 -    return !!(cb->rw & (w + 1));
 -}
 -
 -static void inject_cb_type(const GArray *cbs, TCGOp *begin_op,
 -                           inject_fn inject, op_ok_fn ok)
 -{
 -    TCGOp *end_op;
 -    TCGOp *op;
 -    int cb_idx = -1;
 -    int i;
 -
 -    if (!cbs || cbs->len == 0) {
 -        rm_ops(begin_op);
 -        return;
 -    }
 -
 -    end_op = find_op(begin_op, INDEX_op_plugin_cb_end);
 -    tcg_debug_assert(end_op);
 -
 -    op = end_op;
 -    for (i = 0; i < cbs->len; i++) {
 -        struct qemu_plugin_dyn_cb *cb =
 -            &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
 -
 -        if (!ok(begin_op, cb)) {
 -            continue;
 -        }
 -        op = inject(cb, begin_op, op, &cb_idx);
 -    }
 -    rm_ops_range(begin_op, end_op);
 -}
 -
 -static void
 -inject_inline_cb(const GArray *cbs, TCGOp *begin_op, op_ok_fn ok)
 -{
 -    inject_cb_type(cbs, begin_op, append_inline_cb, ok);
 -}
 -
 -static void
 -inject_mem_cb(const GArray *cbs, TCGOp *begin_op)
 -{
 -    inject_cb_type(cbs, begin_op, append_mem_cb, op_rw);
 -}
 -
  /* called before finishing a TB with exit_tb, goto_tb or goto_ptr */
  void plugin_gen_disable_mem_helpers(void)
  {
@@ -XXX,XX +XXX,XX @@ void plugin_gen_disable_mem_helpers(void)
      }
  }
 -static void plugin_gen_mem_regular(const struct qemu_plugin_tb *ptb,
 -                                   TCGOp *begin_op, int insn_idx)
 -{
 -    struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
 -    inject_mem_cb(insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_REGULAR], begin_op);
 -}
 -
 -static void plugin_gen_mem_inline(const struct qemu_plugin_tb *ptb,
 -                                  TCGOp *begin_op, int insn_idx)
 -{
 -    const GArray *cbs;
 -    struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
 -
 -    cbs = insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_INLINE];
 -    inject_inline_cb(cbs, begin_op, op_rw);
 -}
 -
  static void gen_enable_mem_helper(struct qemu_plugin_tb *ptb,
                                    struct qemu_plugin_insn *insn)
  {
@@ -XXX,XX +XXX,XX @@ static void gen_inline_cb(struct qemu_plugin_dyn_cb *cb)
      tcg_temp_free_ptr(ptr);
  }
 +static void gen_mem_cb(struct qemu_plugin_dyn_cb *cb,
 +                       qemu_plugin_meminfo_t meminfo, TCGv_i64 addr)
 +{
 +    TCGv_i32 cpu_index = tcg_temp_ebb_new_i32();
 +
-+static bool init_guest_commpage(void)
++    tcg_gen_ld_i32(cpu_index, tcg_env,
-+{
++                   -offsetof(ArchCPU, env) + offsetof(CPUState, cpu_index));
-+    void *want = g2h_untagged(LO_COMMPAGE);
++    tcg_gen_call4(cb->regular.f.vcpu_mem, cb->regular.info, NULL,
-+    void *addr = mmap(want, qemu_host_page_size, PROT_NONE,
++                  tcgv_i32_temp(cpu_index),
-+                      MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
++                  tcgv_i32_temp(tcg_constant_i32(meminfo)),
-+
++                  tcgv_i64_temp(addr),
-+    if (addr == MAP_FAILED) {
++                  tcgv_ptr_temp(tcg_constant_ptr(cb->userp)));
-+        perror("Allocating guest commpage");
++    tcg_temp_free_i32(cpu_index);
 +        exit(EXIT_FAILURE);
 +    }
 +    if (addr != want) {
 +        return false;
 +    }
 +
 +    /*
 +     * On Linux, page zero is normally marked execute only + gateway.
 +     * Normal read or write is supposed to fail (thus PROT_NONE above),
 +     * but specific offsets have kernel code mapped to raise permissions
 +     * and implement syscalls.  Here, simply mark the page executable.
 +     * Special case the entry points during translation (see do_page_zero).
 +     */
 +    page_set_flags(LO_COMMPAGE, LO_COMMPAGE + TARGET_PAGE_SIZE,
 +                   PAGE_EXEC | PAGE_VALID);
 +    return true;
 +}
 +
- #endif /* TARGET_HPPA */
+ /* #define DEBUG_PLUGIN_GEN_OPS */
+ static void pr_ops(void)
- #ifdef TARGET_XTENSA
+ {
-@@ -XXX,XX +XXX,XX @@ static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
+@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
              break;
          }
 -        case INDEX_op_plugin_cb_start:
 +        case INDEX_op_plugin_mem_cb:
          {
 -            enum plugin_gen_from from = op->args[0];
 -            enum plugin_gen_cb type = op->args[1];
 +            TCGv_i64 addr = temp_tcgv_i64(arg_temp(op->args[0]));
 +            qemu_plugin_meminfo_t meminfo = op->args[1];
 +            struct qemu_plugin_insn *insn;
 +            const GArray *cbs;
 +            int i, n, rw;
 -            switch (from) {
 -            case PLUGIN_GEN_FROM_MEM:
 -            {
 -                g_assert(insn_idx >= 0);
 +            assert(insn_idx >= 0);
 +            insn = g_ptr_array_index(plugin_tb->insns, insn_idx);
 +            rw = qemu_plugin_mem_is_store(meminfo) ? 2 : 1;
 -                switch (type) {
 -                case PLUGIN_GEN_CB_MEM:
 -                    plugin_gen_mem_regular(plugin_tb, op, insn_idx);
 -                    break;
 -                case PLUGIN_GEN_CB_INLINE:
 -                    plugin_gen_mem_inline(plugin_tb, op, insn_idx);
 -                    break;
 -                default:
 -                    g_assert_not_reached();
 +            tcg_ctx->emit_before_op = op;
 +
 +            cbs = insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_REGULAR];
 +            for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
 +                struct qemu_plugin_dyn_cb *cb =
 +                    &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
 +                if (cb->rw & rw) {
 +                    gen_mem_cb(cb, meminfo, addr);
                  }
 +            }
 -                break;
 -            }
 -            default:
 -                g_assert_not_reached();
 +            cbs = insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_INLINE];
 +            for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
 +                struct qemu_plugin_dyn_cb *cb =
 +                    &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
 +                if (cb->rw & rw) {
 +                    gen_inline_cb(cb);
 +                }
              }
 +
 +            tcg_ctx->emit_before_op = NULL;
 +            tcg_op_remove(tcg_ctx, op);
              break;
          }
 +
          default:
              /* plugins don't care about any other ops */
              break;
 diff --git a/tcg/tcg-op-ldst.c b/tcg/tcg-op-ldst.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg-op-ldst.c
 +++ b/tcg/tcg-op-ldst.c
@@ -XXX,XX +XXX,XX @@ plugin_gen_mem_callbacks(TCGv_i64 copy_addr, TCGTemp *orig_addr, MemOpIdx oi,
                  copy_addr = tcg_temp_ebb_new_i64();
                  tcg_gen_extu_i32_i64(copy_addr, temp_tcgv_i32(orig_addr));
              }
 -            plugin_gen_empty_mem_callback(copy_addr, info);
 +            tcg_gen_plugin_mem_cb(copy_addr, info);
              tcg_temp_free_i64(copy_addr);
          } else {
              if (copy_addr) {
 -                plugin_gen_empty_mem_callback(copy_addr, info);
 +                tcg_gen_plugin_mem_cb(copy_addr, info);
                  tcg_temp_free_i64(copy_addr);
              } else {
 -                plugin_gen_empty_mem_callback(temp_tcgv_i64(orig_addr), info);
 +                tcg_gen_plugin_mem_cb(temp_tcgv_i64(orig_addr), info);
              }
          }
      }
 diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg-op.c
 +++ b/tcg/tcg-op.c
@@ -XXX,XX +XXX,XX @@ void tcg_gen_plugin_cb(unsigned from)
      tcg_gen_op1(INDEX_op_plugin_cb, from);
  }
- #if defined(HI_COMMPAGE)
++void tcg_gen_plugin_mem_cb(TCGv_i64 addr, unsigned meminfo)
--#define LO_COMMPAGE 0
++{
-+#define LO_COMMPAGE -1
++    tcg_gen_op2(INDEX_op_plugin_mem_cb, tcgv_i64_arg(addr), meminfo);
- #elif defined(LO_COMMPAGE)
++}
- #define HI_COMMPAGE 0
++
- #else
+ void tcg_gen_plugin_cb_start(unsigned from, unsigned type, unsigned wr)
- #define HI_COMMPAGE 0
+ {
--#define LO_COMMPAGE 0
+     tcg_gen_op3(INDEX_op_plugin_cb_start, from, type, wr);
 +#define LO_COMMPAGE -1
  #define init_guest_commpage() true
  #endif
@@ -XXX,XX +XXX,XX @@ static void pgb_static(const char *image_name, abi_ulong orig_loaddr,
          } else {
              offset = -(HI_COMMPAGE & -align);
          }
 -    } else if (LO_COMMPAGE != 0) {
 +    } else if (LO_COMMPAGE != -1) {
          loaddr = MIN(loaddr, LO_COMMPAGE & -align);
      }
 --
 .34.1

-[PULL 2/4] target/avr: Call avr_cpu_do_interrupt directly
+[PULL 11/20] plugins: Remove plugin helpers
-There is no need to go through cc->tcg_ops when
+These placeholder helpers are no longer required.
 we know what value that must have.
-Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/avr/helper.c | 5 ++---
+ accel/tcg/plugin-helpers.h         |  5 -----
-file changed, 2 insertions(+), 3 deletions(-)
+ include/exec/helper-gen-common.h   |  4 ----
  include/exec/helper-proto-common.h |  4 ----
  accel/tcg/plugin-gen.c             | 20 --------------------
 files changed, 33 deletions(-)
  delete mode 100644 accel/tcg/plugin-helpers.h
-diff --git a/target/avr/helper.c b/target/avr/helper.c
+diff --git a/accel/tcg/plugin-helpers.h b/accel/tcg/plugin-helpers.h
 deleted file mode 100644
 index XXXXXXX..XXXXXXX
 --- a/accel/tcg/plugin-helpers.h
 +++ /dev/null
@@ -XXX,XX +XXX,XX @@
 -#ifdef CONFIG_PLUGIN
 -DEF_HELPER_FLAGS_2(plugin_vcpu_udata_cb_no_wg, TCG_CALL_NO_WG | TCG_CALL_PLUGIN, void, i32, ptr)
 -DEF_HELPER_FLAGS_2(plugin_vcpu_udata_cb_no_rwg, TCG_CALL_NO_RWG | TCG_CALL_PLUGIN, void, i32, ptr)
 -DEF_HELPER_FLAGS_4(plugin_vcpu_mem_cb, TCG_CALL_NO_RWG | TCG_CALL_PLUGIN, void, i32, i32, i64, ptr)
 -#endif
 diff --git a/include/exec/helper-gen-common.h b/include/exec/helper-gen-common.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/avr/helper.c
+--- a/include/exec/helper-gen-common.h
-+++ b/target/avr/helper.c
++++ b/include/exec/helper-gen-common.h
 @@ -XXX,XX +XXX,XX @@
- bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
+ #include "exec/helper-gen.h.inc"
  #undef  HELPER_H
 -#define HELPER_H "accel/tcg/plugin-helpers.h"
 -#include "exec/helper-gen.h.inc"
 -#undef  HELPER_H
 -
  #endif /* HELPER_GEN_COMMON_H */
 diff --git a/include/exec/helper-proto-common.h b/include/exec/helper-proto-common.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/exec/helper-proto-common.h
 +++ b/include/exec/helper-proto-common.h
@@ -XXX,XX +XXX,XX @@
  #include "exec/helper-proto.h.inc"
  #undef  HELPER_H
 -#define HELPER_H "accel/tcg/plugin-helpers.h"
 -#include "exec/helper-proto.h.inc"
 -#undef  HELPER_H
 -
  #endif /* HELPER_PROTO_COMMON_H */
 diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/plugin-gen.c
 +++ b/accel/tcg/plugin-gen.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/exec-all.h"
  #include "exec/plugin-gen.h"
  #include "exec/translator.h"
 -#include "exec/helper-proto-common.h"
 -
 -#define HELPER_H  "accel/tcg/plugin-helpers.h"
 -#include "exec/helper-info.c.inc"
 -#undef  HELPER_H
  /*
   * plugin_cb_start TCG op args[]:
@@ -XXX,XX +XXX,XX @@ enum plugin_gen_cb {
      PLUGIN_GEN_N_CBS,
  };
 -/*
 - * These helpers are stubs that get dynamically switched out for calls
 - * direct to the plugin if they are subscribed to.
 - */
 -void HELPER(plugin_vcpu_udata_cb_no_wg)(uint32_t cpu_index, void *udata)
 -{ }
 -
 -void HELPER(plugin_vcpu_udata_cb_no_rwg)(uint32_t cpu_index, void *udata)
 -{ }
 -
 -void HELPER(plugin_vcpu_mem_cb)(unsigned int vcpu_index,
 -                                qemu_plugin_meminfo_t info, uint64_t vaddr,
 -                                void *userdata)
 -{ }
 -
  static void plugin_gen_empty_callback(enum plugin_gen_from from)
  {
-     bool ret = false;
+     switch (from) {
 -    CPUClass *cc = CPU_GET_CLASS(cs);
      AVRCPU *cpu = AVR_CPU(cs);
      CPUAVRState *env = &cpu->env;
      if (interrupt_request & CPU_INTERRUPT_RESET) {
          if (cpu_interrupts_enabled(env)) {
              cs->exception_index = EXCP_RESET;
 -            cc->tcg_ops->do_interrupt(cs);
 +            avr_cpu_do_interrupt(cs);
              cs->interrupt_request &= ~CPU_INTERRUPT_RESET;
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
          if (cpu_interrupts_enabled(env) && env->intsrc != 0) {
              int index = ctz32(env->intsrc);
              cs->exception_index = EXCP_INT(index);
 -            cc->tcg_ops->do_interrupt(cs);
 +            avr_cpu_do_interrupt(cs);
              env->intsrc &= env->intsrc - 1; /* clear the interrupt */
              if (!env->intsrc) {
 --
 .34.1

-[PULL 03/20] linux-user/x86_64: Allocate vsyscall page as a commpage
+Deleted patch
-We're about to start validating PAGE_EXEC, which means that we've
-got to mark the vsyscall page executable.  We had been special
-casing this entirely within translate.
-Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- linux-user/elfload.c | 23 +++++++++++++++++++++++
-file changed, 23 insertions(+)
-diff --git a/linux-user/elfload.c b/linux-user/elfload.c
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/elfload.c
-+++ b/linux-user/elfload.c
-@@ -XXX,XX +XXX,XX @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *en
-     (*regs)[26] = tswapreg(env->segs[R_GS].selector & 0xffff);
- }
-+#if ULONG_MAX >= TARGET_VSYSCALL_PAGE
-+#define INIT_GUEST_COMMPAGE
-+static bool init_guest_commpage(void)
-+{
-+    /*
-+     * The vsyscall page is at a high negative address aka kernel space,
-+     * which means that we cannot actually allocate it with target_mmap.
-+     * We still should be able to use page_set_flags, unless the user
-+     * has specified -R reserved_va, which would trigger an assert().
-+     */
-+    if (reserved_va != 0 &&
-+        TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE >= reserved_va) {
-+        error_report("Cannot allocate vsyscall page");
-+        exit(EXIT_FAILURE);
-+    }
-+    page_set_flags(TARGET_VSYSCALL_PAGE,
-+                   TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE,
-+                   PAGE_EXEC | PAGE_VALID);
-+    return true;
-+}
-+#endif
- #else
- #define ELF_START_MMAP 0x80000000
-@@ -XXX,XX +XXX,XX @@ static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
- #else
- #define HI_COMMPAGE 0
- #define LO_COMMPAGE -1
-+#ifndef INIT_GUEST_COMMPAGE
- #define init_guest_commpage() true
- #endif
-+#endif
- static void pgb_fail_in_use(const char *image_name)
- {
---
-.34.1

-[PULL 04/20] linux-user: Honor PT_GNU_STACK
+Deleted patch
-Map the stack executable if required by default or on demand.
-Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/elf.h        |  1 +
- linux-user/qemu.h    |  1 +
- linux-user/elfload.c | 19 ++++++++++++++++++-
-files changed, 20 insertions(+), 1 deletion(-)
-diff --git a/include/elf.h b/include/elf.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/elf.h
-+++ b/include/elf.h
-@@ -XXX,XX +XXX,XX @@ typedef int64_t  Elf64_Sxword;
- #define PT_LOPROC  0x70000000
- #define PT_HIPROC  0x7fffffff
-+#define PT_GNU_STACK      (PT_LOOS + 0x474e551)
- #define PT_GNU_PROPERTY   (PT_LOOS + 0x474e553)
- #define PT_MIPS_REGINFO   0x70000000
-diff --git a/linux-user/qemu.h b/linux-user/qemu.h
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/qemu.h
-+++ b/linux-user/qemu.h
-@@ -XXX,XX +XXX,XX @@ struct image_info {
-         uint32_t        elf_flags;
-         int             personality;
-         abi_ulong       alignment;
-+        bool            exec_stack;
-         /* Generic semihosting knows about these pointers. */
-         abi_ulong       arg_strings;   /* strings for argv */
-diff --git a/linux-user/elfload.c b/linux-user/elfload.c
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/elfload.c
-+++ b/linux-user/elfload.c
-@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)
- #define ELF_ARCH        EM_386
- #define ELF_PLATFORM get_elf_platform()
-+#define EXSTACK_DEFAULT true
- static const char *get_elf_platform(void)
- {
-@@ -XXX,XX +XXX,XX @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *en
- #define ELF_ARCH        EM_ARM
- #define ELF_CLASS       ELFCLASS32
-+#define EXSTACK_DEFAULT true
- static inline void init_thread(struct target_pt_regs *regs,
-                                struct image_info *infop)
-@@ -XXX,XX +XXX,XX @@ static inline void init_thread(struct target_pt_regs *regs,
- #else
- #define ELF_CLASS       ELFCLASS32
-+#define EXSTACK_DEFAULT true
- #endif
-@@ -XXX,XX +XXX,XX @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUPPCState *en
- #define ELF_CLASS   ELFCLASS64
- #define ELF_ARCH    EM_LOONGARCH
-+#define EXSTACK_DEFAULT true
- #define elf_check_arch(x) ((x) == EM_LOONGARCH)
-@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap(void)
- #define ELF_CLASS   ELFCLASS32
- #endif
- #define ELF_ARCH    EM_MIPS
-+#define EXSTACK_DEFAULT true
- #ifdef TARGET_ABI_MIPSN32
- #define elf_check_abi(x) ((x) & EF_MIPS_ABI2)
-@@ -XXX,XX +XXX,XX @@ static inline void init_thread(struct target_pt_regs *regs,
- #define bswaptls(ptr) bswap32s(ptr)
- #endif
-+#ifndef EXSTACK_DEFAULT
-+#define EXSTACK_DEFAULT false
-+#endif
-+
- #include "elf.h"
- /* We must delay the following stanzas until after "elf.h". */
-@@ -XXX,XX +XXX,XX @@ static abi_ulong setup_arg_pages(struct linux_binprm *bprm,
-                                  struct image_info *info)
- {
-     abi_ulong size, error, guard;
-+    int prot;
-     size = guest_stack_size;
-     if (size < STACK_LOWER_LIMIT) {
-@@ -XXX,XX +XXX,XX @@ static abi_ulong setup_arg_pages(struct linux_binprm *bprm,
-         guard = qemu_real_host_page_size();
-     }
--    error = target_mmap(0, size + guard, PROT_READ | PROT_WRITE,
-+    prot = PROT_READ | PROT_WRITE;
-+    if (info->exec_stack) {
-+        prot |= PROT_EXEC;
-+    }
-+    error = target_mmap(0, size + guard, prot,
-                         MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
-     if (error == -1) {
-         perror("mmap stack");
-@@ -XXX,XX +XXX,XX @@ static void load_elf_image(const char *image_name, int image_fd,
-      */
-     loaddr = -1, hiaddr = 0;
-     info->alignment = 0;
-+    info->exec_stack = EXSTACK_DEFAULT;
-     for (i = 0; i < ehdr->e_phnum; ++i) {
-         struct elf_phdr *eppnt = phdr + i;
-         if (eppnt->p_type == PT_LOAD) {
-@@ -XXX,XX +XXX,XX @@ static void load_elf_image(const char *image_name, int image_fd,
-             if (!parse_elf_properties(image_fd, info, eppnt, bprm_buf, &err)) {
-                 goto exit_errmsg;
-             }
-+        } else if (eppnt->p_type == PT_GNU_STACK) {
-+            info->exec_stack = eppnt->p_flags & PF_X;
-         }
-     }
---
-.34.1

-[PULL 05/20] linux-user: Clear translations on mprotect()
+Deleted patch
-From: Ilya Leoshkevich <iii@linux.ibm.com>
-Currently it's possible to execute pages that do not have PAGE_EXEC
-if there is an existing translation block. Fix by invalidating TBs
-that touch the affected pages.
-Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Message-Id: <20220817150506.592862-2-iii@linux.ibm.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- linux-user/mmap.c | 6 ++++--
-file changed, 4 insertions(+), 2 deletions(-)
-diff --git a/linux-user/mmap.c b/linux-user/mmap.c
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/mmap.c
-+++ b/linux-user/mmap.c
-@@ -XXX,XX +XXX,XX @@ int target_mprotect(abi_ulong start, abi_ulong len, int target_prot)
-             goto error;
-         }
-     }
-+
-     page_set_flags(start, start + len, page_flags);
--    mmap_unlock();
--    return 0;
-+    tb_invalidate_phys_range(start, start + len);
-+    ret = 0;
-+
- error:
-     mmap_unlock();
-     return ret;
---
-.34.1

-[PULL 19/20] target/riscv: Add MAX_INSN_LEN and insn_len
+[PULL 12/20] tcg: Remove TCG_CALL_PLUGIN
-These will be useful in properly ending the TB.
+Since we no longer emit plugin helpers during the initial code
 translation phase, we don't need to specially mark plugin helpers.
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/riscv/translate.c | 10 +++++++++-
+ include/tcg/tcg.h |  2 --
-file changed, 9 insertions(+), 1 deletion(-)
+ plugins/core.c    | 10 ++++------
  tcg/tcg.c         |  4 +---
 files changed, 5 insertions(+), 11 deletions(-)
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
+diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
+--- a/include/tcg/tcg.h
-+++ b/target/riscv/translate.c
++++ b/include/tcg/tcg.h
-@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
+@@ -XXX,XX +XXX,XX @@ typedef TCGv_ptr TCGv_env;
- /* Include decoders for factored-out extensions */
+ #define TCG_CALL_NO_SIDE_EFFECTS    0x0004
- #include "decode-XVentanaCondOps.c.inc"
+ /* Helper is G_NORETURN.  */
+ #define TCG_CALL_NO_RETURN          0x0008
-+/* The specification allows for longer insns, but not supported by qemu. */
+-/* Helper is part of Plugins.  */
-+#define MAX_INSN_LEN  4
+-#define TCG_CALL_PLUGIN             0x0010
-+
-+static inline int insn_len(uint16_t first_word)
+ /* convenience version of most used call flags */
-+{
+ #define TCG_CALL_NO_RWG         TCG_CALL_NO_READ_GLOBALS
-+    return (first_word & 3) == 3 ? 4 : 2;
+diff --git a/plugins/core.c b/plugins/core.c
-+}
+index XXXXXXX..XXXXXXX 100644
-+
+--- a/plugins/core.c
- static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
++++ b/plugins/core.c
@@ -XXX,XX +XXX,XX @@ void plugin_register_dyn_cb__udata(GArray **arr,
                                     void *udata)
  {
-     /*
+     static TCGHelperInfo info[3] = {
-@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
+-        [QEMU_PLUGIN_CB_NO_REGS].flags = TCG_CALL_NO_RWG | TCG_CALL_PLUGIN,
-     };
+-        [QEMU_PLUGIN_CB_R_REGS].flags = TCG_CALL_NO_WG | TCG_CALL_PLUGIN,
+-        [QEMU_PLUGIN_CB_RW_REGS].flags = TCG_CALL_PLUGIN,
-     /* Check for compressed insn */
++        [QEMU_PLUGIN_CB_NO_REGS].flags = TCG_CALL_NO_RWG,
--    if (extract16(opcode, 0, 2) != 3) {
++        [QEMU_PLUGIN_CB_R_REGS].flags = TCG_CALL_NO_WG,
-+    if (insn_len(opcode) == 2) {
+         /*
-         if (!has_ext(ctx, RVC)) {
+          * Match qemu_plugin_vcpu_udata_cb_t:
-             gen_exception_illegal(ctx);
+          *   void (*)(uint32_t, void *)
-         } else {
+@@ -XXX,XX +XXX,XX @@ void plugin_register_vcpu_mem_cb(GArray **arr,
          !__builtin_types_compatible_p(qemu_plugin_meminfo_t, int32_t));
      static TCGHelperInfo info[3] = {
 -        [QEMU_PLUGIN_CB_NO_REGS].flags = TCG_CALL_NO_RWG | TCG_CALL_PLUGIN,
 -        [QEMU_PLUGIN_CB_R_REGS].flags = TCG_CALL_NO_WG | TCG_CALL_PLUGIN,
 -        [QEMU_PLUGIN_CB_RW_REGS].flags = TCG_CALL_PLUGIN,
 +        [QEMU_PLUGIN_CB_NO_REGS].flags = TCG_CALL_NO_RWG,
 +        [QEMU_PLUGIN_CB_R_REGS].flags = TCG_CALL_NO_WG,
          /*
           * Match qemu_plugin_vcpu_mem_cb_t:
           *   void (*)(uint32_t, qemu_plugin_meminfo_t, uint64_t, void *)
 diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg.c
 +++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static void tcg_gen_callN(void *func, TCGHelperInfo *info,
  #ifdef CONFIG_PLUGIN
      /* Flag helpers that may affect guest state */
 -    if (tcg_ctx->plugin_insn &&
 -        !(info->flags & TCG_CALL_PLUGIN) &&
 -        !(info->flags & TCG_CALL_NO_SIDE_EFFECTS)) {
 +    if (tcg_ctx->plugin_insn && !(info->flags & TCG_CALL_NO_SIDE_EFFECTS)) {
          tcg_ctx->plugin_insn->calls_helpers = true;
      }
  #endif
 --
 .34.1

-[PULL 14/20] accel/tcg: Remove translator_ldsw
+[PULL 13/20] tcg: Remove INDEX_op_plugin_cb_{start,end}
-The only user can easily use translator_lduw and
+These opcodes are no longer used.
 adjust the type to signed during the return.
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/translator.h   | 1 -
+ include/tcg/tcg-op-common.h |  2 --
- target/i386/tcg/translate.c | 2 +-
+ include/tcg/tcg-opc.h       |  2 --
-files changed, 1 insertion(+), 2 deletions(-)
+ accel/tcg/plugin-gen.c      | 18 ------------------
  tcg/tcg-op.c                | 10 ----------
 files changed, 32 deletions(-)
-diff --git a/include/exec/translator.h b/include/exec/translator.h
+diff --git a/include/tcg/tcg-op-common.h b/include/tcg/tcg-op-common.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/translator.h
+--- a/include/tcg/tcg-op-common.h
-+++ b/include/exec/translator.h
++++ b/include/tcg/tcg-op-common.h
-@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
+@@ -XXX,XX +XXX,XX @@ void tcg_gen_lookup_and_goto_ptr(void);
- #define FOR_EACH_TRANSLATOR_LD(F)                                       \
+ void tcg_gen_plugin_cb(unsigned from);
-     F(translator_ldub, uint8_t, cpu_ldub_code, /* no swap */)           \
+ void tcg_gen_plugin_mem_cb(TCGv_i64 addr, unsigned meminfo);
--    F(translator_ldsw, int16_t, cpu_ldsw_code, bswap16)                 \
+-void tcg_gen_plugin_cb_start(unsigned from, unsigned type, unsigned wr);
-     F(translator_lduw, uint16_t, cpu_lduw_code, bswap16)                \
+-void tcg_gen_plugin_cb_end(void);
-     F(translator_ldl, uint32_t, cpu_ldl_code, bswap32)                  \
-     F(translator_ldq, uint64_t, cpu_ldq_code, bswap64)
+ /* 32 bit ops */
-diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
 diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/i386/tcg/translate.c
+--- a/include/tcg/tcg-opc.h
-+++ b/target/i386/tcg/translate.c
++++ b/include/tcg/tcg-opc.h
-@@ -XXX,XX +XXX,XX @@ static inline uint8_t x86_ldub_code(CPUX86State *env, DisasContext *s)
+@@ -XXX,XX +XXX,XX @@ DEF(goto_ptr, 0, 1, 0, TCG_OPF_BB_EXIT | TCG_OPF_BB_END)
- static inline int16_t x86_ldsw_code(CPUX86State *env, DisasContext *s)
+ DEF(plugin_cb, 0, 0, 1, TCG_OPF_NOT_PRESENT)
- {
+ DEF(plugin_mem_cb, 0, 1, 1, TCG_OPF_NOT_PRESENT)
--    return translator_ldsw(env, &s->base, advance_pc(env, s, 2));
+-DEF(plugin_cb_start, 0, 0, 3, TCG_OPF_NOT_PRESENT)
-+    return translator_lduw(env, &s->base, advance_pc(env, s, 2));
+-DEF(plugin_cb_end, 0, 0, 0, TCG_OPF_NOT_PRESENT)
  /* Replicate ld/st ops for 32 and 64-bit guest addresses. */
  DEF(qemu_ld_a32_i32, 1, 1, 1,
 diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/plugin-gen.c
 +++ b/accel/tcg/plugin-gen.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/plugin-gen.h"
  #include "exec/translator.h"
 -/*
 - * plugin_cb_start TCG op args[]:
 - * 0: enum plugin_gen_from
 - * 1: enum plugin_gen_cb
 - * 2: set to 1 for mem callback that is a write, 0 otherwise.
 - */
 -
  enum plugin_gen_from {
      PLUGIN_GEN_FROM_TB,
      PLUGIN_GEN_FROM_INSN,
      PLUGIN_GEN_AFTER_INSN,
      PLUGIN_GEN_AFTER_TB,
 -    PLUGIN_GEN_N_FROMS,
 -};
 -
 -enum plugin_gen_cb {
 -    PLUGIN_GEN_CB_UDATA,
 -    PLUGIN_GEN_CB_UDATA_R,
 -    PLUGIN_GEN_CB_INLINE,
 -    PLUGIN_GEN_CB_MEM,
 -    PLUGIN_GEN_ENABLE_MEM_HELPER,
 -    PLUGIN_GEN_DISABLE_MEM_HELPER,
 -    PLUGIN_GEN_N_CBS,
  };
  static void plugin_gen_empty_callback(enum plugin_gen_from from)
 diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg-op.c
 +++ b/tcg/tcg-op.c
@@ -XXX,XX +XXX,XX @@ void tcg_gen_plugin_mem_cb(TCGv_i64 addr, unsigned meminfo)
      tcg_gen_op2(INDEX_op_plugin_mem_cb, tcgv_i64_arg(addr), meminfo);
  }
- static inline uint16_t x86_lduw_code(CPUX86State *env, DisasContext *s)
+-void tcg_gen_plugin_cb_start(unsigned from, unsigned type, unsigned wr)
 -{
 -    tcg_gen_op3(INDEX_op_plugin_cb_start, from, type, wr);
 -}
 -
 -void tcg_gen_plugin_cb_end(void)
 -{
 -    tcg_emit_op(INDEX_op_plugin_cb_end, 0);
 -}
 -
  /* 32 bit ops */
  void tcg_gen_discard_i32(TCGv_i32 arg)
 --
 .34.1

-[PULL 10/20] accel/tcg: Make tb_htable_lookup static
+[PULL 14/20] plugins: Simplify callback queues
-The function is not used outside of cpu-exec.c.  Move it and
+We have qemu_plugin_dyn_cb.type to differentiate the various
-its subroutines up in the file, before the first use.
+callback types, so we do not need to keep them in separate queues.
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/exec-all.h |   3 -
+ include/qemu/plugin.h  | 35 ++++++----------
- accel/tcg/cpu-exec.c    | 122 ++++++++++++++++++++--------------------
+ accel/tcg/plugin-gen.c | 90 ++++++++++++++++++++++--------------------
-files changed, 61 insertions(+), 64 deletions(-)
+ plugins/api.c          | 18 +++------
 files changed, 65 insertions(+), 78 deletions(-)
-diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
+diff --git a/include/qemu/plugin.h b/include/qemu/plugin.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/exec-all.h
+--- a/include/qemu/plugin.h
-+++ b/include/exec/exec-all.h
++++ b/include/qemu/plugin.h
-@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs);
+@@ -XXX,XX +XXX,XX @@ union qemu_plugin_cb_sig {
- #endif
+ };
- void tb_flush(CPUState *cpu);
- void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr);
+ enum plugin_dyn_cb_type {
--TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
+-    PLUGIN_CB_INSN,
--                                   target_ulong cs_base, uint32_t flags,
+-    PLUGIN_CB_MEM,
--                                   uint32_t cflags);
+-    PLUGIN_N_CB_TYPES,
  void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr);
  /* GETPC is the true target of the return instruction that we'll execute.  */
 diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cpu-exec.c
 +++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ uint32_t curr_cflags(CPUState *cpu)
      return cflags;
  }
 +struct tb_desc {
 +    target_ulong pc;
 +    target_ulong cs_base;
 +    CPUArchState *env;
 +    tb_page_addr_t phys_page1;
 +    uint32_t flags;
 +    uint32_t cflags;
 +    uint32_t trace_vcpu_dstate;
 +};
 +
 +static bool tb_lookup_cmp(const void *p, const void *d)
 +{
 +    const TranslationBlock *tb = p;
 +    const struct tb_desc *desc = d;
 +
 +    if (tb->pc == desc->pc &&
 +        tb->page_addr[0] == desc->phys_page1 &&
 +        tb->cs_base == desc->cs_base &&
 +        tb->flags == desc->flags &&
 +        tb->trace_vcpu_dstate == desc->trace_vcpu_dstate &&
 +        tb_cflags(tb) == desc->cflags) {
 +        /* check next page if needed */
 +        if (tb->page_addr[1] == -1) {
 +            return true;
 +        } else {
 +            tb_page_addr_t phys_page2;
 +            target_ulong virt_page2;
 +
 +            virt_page2 = (desc->pc & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
 +            phys_page2 = get_page_addr_code(desc->env, virt_page2);
 +            if (tb->page_addr[1] == phys_page2) {
 +                return true;
 +            }
 +        }
 +    }
 +    return false;
 +}
 +
 +static TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
 +                                          target_ulong cs_base, uint32_t flags,
 +                                          uint32_t cflags)
 +{
 +    tb_page_addr_t phys_pc;
 +    struct tb_desc desc;
 +    uint32_t h;
 +
 +    desc.env = cpu->env_ptr;
 +    desc.cs_base = cs_base;
 +    desc.flags = flags;
 +    desc.cflags = cflags;
 +    desc.trace_vcpu_dstate = *cpu->trace_dstate;
 +    desc.pc = pc;
 +    phys_pc = get_page_addr_code(desc.env, pc);
 +    if (phys_pc == -1) {
 +        return NULL;
 +    }
 +    desc.phys_page1 = phys_pc & TARGET_PAGE_MASK;
 +    h = tb_hash_func(phys_pc, pc, flags, cflags, *cpu->trace_dstate);
 +    return qht_lookup_custom(&tb_ctx.htable, &desc, h, tb_lookup_cmp);
 +}
 +
  /* Might cause an exception, so have a longjmp destination ready */
  static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
                                            target_ulong cs_base,
@@ -XXX,XX +XXX,XX @@ void cpu_exec_step_atomic(CPUState *cpu)
      end_exclusive();
  }
 -struct tb_desc {
 -    target_ulong pc;
 -    target_ulong cs_base;
 -    CPUArchState *env;
 -    tb_page_addr_t phys_page1;
 -    uint32_t flags;
 -    uint32_t cflags;
 -    uint32_t trace_vcpu_dstate;
 -};
 -
--static bool tb_lookup_cmp(const void *p, const void *d)
+-enum plugin_dyn_cb_subtype {
--{
+     PLUGIN_CB_REGULAR,
--    const TranslationBlock *tb = p;
+     PLUGIN_CB_INLINE,
--    const struct tb_desc *desc = d;
+-    PLUGIN_N_CB_SUBTYPES,
--
+ };
--    if (tb->pc == desc->pc &&
--        tb->page_addr[0] == desc->phys_page1 &&
+ /*
--        tb->cs_base == desc->cs_base &&
+@@ -XXX,XX +XXX,XX @@ enum plugin_dyn_cb_subtype {
--        tb->flags == desc->flags &&
+  */
--        tb->trace_vcpu_dstate == desc->trace_vcpu_dstate &&
+ struct qemu_plugin_dyn_cb {
--        tb_cflags(tb) == desc->cflags) {
+     void *userp;
--        /* check next page if needed */
+-    enum plugin_dyn_cb_subtype type;
--        if (tb->page_addr[1] == -1) {
++    enum plugin_dyn_cb_type type;
--            return true;
+     /* @rw applies to mem callbacks only (both regular and inline) */
--        } else {
+     enum qemu_plugin_mem_rw rw;
--            tb_page_addr_t phys_page2;
+     /* fields specific to each dyn_cb type go here */
--            target_ulong virt_page2;
+@@ -XXX,XX +XXX,XX @@ struct qemu_plugin_insn {
--
+     GByteArray *data;
--            virt_page2 = (desc->pc & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
+     uint64_t vaddr;
--            phys_page2 = get_page_addr_code(desc->env, virt_page2);
+     void *haddr;
--            if (tb->page_addr[1] == phys_page2) {
+-    GArray *cbs[PLUGIN_N_CB_TYPES][PLUGIN_N_CB_SUBTYPES];
--                return true;
++    GArray *insn_cbs;
--            }
++    GArray *mem_cbs;
      bool calls_helpers;
      /* if set, the instruction calls helpers that might access guest memory */
@@ -XXX,XX +XXX,XX @@ static inline void qemu_plugin_insn_cleanup_fn(gpointer data)
  static inline struct qemu_plugin_insn *qemu_plugin_insn_alloc(void)
  {
 -    int i, j;
      struct qemu_plugin_insn *insn = g_new0(struct qemu_plugin_insn, 1);
 -    insn->data = g_byte_array_sized_new(4);
 -    for (i = 0; i < PLUGIN_N_CB_TYPES; i++) {
 -        for (j = 0; j < PLUGIN_N_CB_SUBTYPES; j++) {
 -            insn->cbs[i][j] = g_array_new(false, false,
 -                                          sizeof(struct qemu_plugin_dyn_cb));
 -        }
 -    }
--    return false;
++    insn->data = g_byte_array_sized_new(4);
--}
+     return insn;
  }
@@ -XXX,XX +XXX,XX @@ struct qemu_plugin_tb {
      /* if set, the TB calls helpers that might access guest memory */
      bool mem_helper;
 -    GArray *cbs[PLUGIN_N_CB_SUBTYPES];
 +    GArray *cbs;
  };
  /**
@@ -XXX,XX +XXX,XX @@ struct qemu_plugin_insn *qemu_plugin_tb_insn_get(struct qemu_plugin_tb *tb,
                                                   uint64_t pc)
  {
      struct qemu_plugin_insn *insn;
 -    int i, j;
      if (unlikely(tb->n == tb->insns->len)) {
          struct qemu_plugin_insn *new_insn = qemu_plugin_insn_alloc();
          g_ptr_array_add(tb->insns, new_insn);
      }
 +
      insn = g_ptr_array_index(tb->insns, tb->n++);
      g_byte_array_set_size(insn->data, 0);
      insn->calls_helpers = false;
      insn->mem_helper = false;
      insn->vaddr = pc;
 -
--TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
+-    for (i = 0; i < PLUGIN_N_CB_TYPES; i++) {
--                                   target_ulong cs_base, uint32_t flags,
+-        for (j = 0; j < PLUGIN_N_CB_SUBTYPES; j++) {
--                                   uint32_t cflags)
+-            g_array_set_size(insn->cbs[i][j], 0);
--{
+-        }
--    tb_page_addr_t phys_pc;
++    if (insn->insn_cbs) {
--    struct tb_desc desc;
++        g_array_set_size(insn->insn_cbs, 0);
--    uint32_t h;
++    }
 +    if (insn->mem_cbs) {
 +        g_array_set_size(insn->mem_cbs, 0);
      }
      return insn;
 diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/plugin-gen.c
 +++ b/accel/tcg/plugin-gen.c
@@ -XXX,XX +XXX,XX @@ void plugin_gen_disable_mem_helpers(void)
  static void gen_enable_mem_helper(struct qemu_plugin_tb *ptb,
                                    struct qemu_plugin_insn *insn)
  {
 -    GArray *cbs[2];
      GArray *arr;
 -    size_t n_cbs;
 +    size_t len;
      /*
       * Tracking memory accesses performed from helpers requires extra work.
@@ -XXX,XX +XXX,XX @@ static void gen_enable_mem_helper(struct qemu_plugin_tb *ptb,
          return;
      }
 -    cbs[0] = insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_REGULAR];
 -    cbs[1] = insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_INLINE];
 -    n_cbs = cbs[0]->len + cbs[1]->len;
 -
--    desc.env = cpu->env_ptr;
+-    if (n_cbs == 0) {
--    desc.cs_base = cs_base;
++    if (!insn->mem_cbs || !insn->mem_cbs->len) {
--    desc.flags = flags;
+         insn->mem_helper = false;
--    desc.cflags = cflags;
+         return;
--    desc.trace_vcpu_dstate = *cpu->trace_dstate;
+     }
--    desc.pc = pc;
+     insn->mem_helper = true;
--    phys_pc = get_page_addr_code(desc.env, pc);
+     ptb->mem_helper = true;
--    if (phys_pc == -1) {
--        return NULL;
++    /*
--    }
++     * TODO: It seems like we should be able to use ref/unref
--    desc.phys_page1 = phys_pc & TARGET_PAGE_MASK;
++     * to avoid needing to actually copy this array.
--    h = tb_hash_func(phys_pc, pc, flags, cflags, *cpu->trace_dstate);
++     * Alternately, perhaps we could allocate new memory adjacent
--    return qht_lookup_custom(&tb_ctx.htable, &desc, h, tb_lookup_cmp);
++     * to the TranslationBlock itself, so that we do not have to
--}
++     * actively manage the lifetime after this.
 +     */
 +    len = insn->mem_cbs->len;
      arr = g_array_sized_new(false, false,
 -                            sizeof(struct qemu_plugin_dyn_cb), n_cbs);
 -    g_array_append_vals(arr, cbs[0]->data, cbs[0]->len);
 -    g_array_append_vals(arr, cbs[1]->data, cbs[1]->len);
 -
- void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr)
++                            sizeof(struct qemu_plugin_dyn_cb), len);
- {
++    memcpy(arr->data, insn->mem_cbs->data,
-     if (TCG_TARGET_HAS_direct_jump) {
++           len * sizeof(struct qemu_plugin_dyn_cb));
      qemu_plugin_add_dyn_cb_arr(arr);
      tcg_gen_st_ptr(tcg_constant_ptr((intptr_t)arr), tcg_env,
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
              case PLUGIN_GEN_FROM_TB:
                  assert(insn == NULL);
 -                cbs = plugin_tb->cbs[PLUGIN_CB_REGULAR];
 +                cbs = plugin_tb->cbs;
                  for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
                      struct qemu_plugin_dyn_cb *cb =
                          &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
 -                    gen_udata_cb(cb);
 -                }
 -                cbs = plugin_tb->cbs[PLUGIN_CB_INLINE];
 -                for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
 -                    struct qemu_plugin_dyn_cb *cb =
 -                        &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
 -                    gen_inline_cb(cb);
 +                    switch (cb->type) {
 +                    case PLUGIN_CB_REGULAR:
 +                        gen_udata_cb(cb);
 +                        break;
 +                    case PLUGIN_CB_INLINE:
 +                        gen_inline_cb(cb);
 +                        break;
 +                    default:
 +                        g_assert_not_reached();
 +                    }
                  }
                  break;
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
                  gen_enable_mem_helper(plugin_tb, insn);
 -                cbs = insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_REGULAR];
 +                cbs = insn->insn_cbs;
                  for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
                      struct qemu_plugin_dyn_cb *cb =
                          &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
 -                    gen_udata_cb(cb);
 -                }
 -                cbs = insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_INLINE];
 -                for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
 -                    struct qemu_plugin_dyn_cb *cb =
 -                        &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
 -                    gen_inline_cb(cb);
 +                    switch (cb->type) {
 +                    case PLUGIN_CB_REGULAR:
 +                        gen_udata_cb(cb);
 +                        break;
 +                    case PLUGIN_CB_INLINE:
 +                        gen_inline_cb(cb);
 +                        break;
 +                    default:
 +                        g_assert_not_reached();
 +                    }
                  }
                  break;
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
              tcg_ctx->emit_before_op = op;
 -            cbs = insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_REGULAR];
 +            cbs = insn->mem_cbs;
              for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
                  struct qemu_plugin_dyn_cb *cb =
                      &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
 -                if (cb->rw & rw) {
 -                    gen_mem_cb(cb, meminfo, addr);
 -                }
 -            }
 -            cbs = insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_INLINE];
 -            for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
 -                struct qemu_plugin_dyn_cb *cb =
 -                    &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
                  if (cb->rw & rw) {
 -                    gen_inline_cb(cb);
 +                    switch (cb->type) {
 +                    case PLUGIN_CB_REGULAR:
 +                        gen_mem_cb(cb, meminfo, addr);
 +                        break;
 +                    case PLUGIN_CB_INLINE:
 +                        gen_inline_cb(cb);
 +                        break;
 +                    default:
 +                        g_assert_not_reached();
 +                    }
                  }
              }
@@ -XXX,XX +XXX,XX @@ bool plugin_gen_tb_start(CPUState *cpu, const DisasContextBase *db,
      if (test_bit(QEMU_PLUGIN_EV_VCPU_TB_TRANS, cpu->plugin_state->event_mask)) {
          struct qemu_plugin_tb *ptb = tcg_ctx->plugin_tb;
 -        int i;
          /* reset callbacks */
 -        for (i = 0; i < PLUGIN_N_CB_SUBTYPES; i++) {
 -            if (ptb->cbs[i]) {
 -                g_array_set_size(ptb->cbs[i], 0);
 -            }
 +        if (ptb->cbs) {
 +            g_array_set_size(ptb->cbs, 0);
          }
          ptb->n = 0;
 diff --git a/plugins/api.c b/plugins/api.c
 index XXXXXXX..XXXXXXX 100644
 --- a/plugins/api.c
 +++ b/plugins/api.c
@@ -XXX,XX +XXX,XX @@ void qemu_plugin_register_vcpu_tb_exec_cb(struct qemu_plugin_tb *tb,
                                            void *udata)
  {
      if (!tb->mem_only) {
 -        plugin_register_dyn_cb__udata(&tb->cbs[PLUGIN_CB_REGULAR],
 -                                      cb, flags, udata);
 +        plugin_register_dyn_cb__udata(&tb->cbs, cb, flags, udata);
      }
  }
@@ -XXX,XX +XXX,XX @@ void qemu_plugin_register_vcpu_tb_exec_inline_per_vcpu(
      uint64_t imm)
  {
      if (!tb->mem_only) {
 -        plugin_register_inline_op_on_entry(
 -            &tb->cbs[PLUGIN_CB_INLINE], 0, op, entry, imm);
 +        plugin_register_inline_op_on_entry(&tb->cbs, 0, op, entry, imm);
      }
  }
@@ -XXX,XX +XXX,XX @@ void qemu_plugin_register_vcpu_insn_exec_cb(struct qemu_plugin_insn *insn,
                                              void *udata)
  {
      if (!insn->mem_only) {
 -        plugin_register_dyn_cb__udata(
 -            &insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_REGULAR], cb, flags, udata);
 +        plugin_register_dyn_cb__udata(&insn->insn_cbs, cb, flags, udata);
      }
  }
@@ -XXX,XX +XXX,XX @@ void qemu_plugin_register_vcpu_insn_exec_inline_per_vcpu(
      uint64_t imm)
  {
      if (!insn->mem_only) {
 -        plugin_register_inline_op_on_entry(
 -            &insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_INLINE], 0, op, entry, imm);
 +        plugin_register_inline_op_on_entry(&insn->insn_cbs, 0, op, entry, imm);
      }
  }
@@ -XXX,XX +XXX,XX @@ void qemu_plugin_register_vcpu_mem_cb(struct qemu_plugin_insn *insn,
                                        enum qemu_plugin_mem_rw rw,
                                        void *udata)
  {
 -    plugin_register_vcpu_mem_cb(&insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_REGULAR],
 -                                cb, flags, rw, udata);
 +    plugin_register_vcpu_mem_cb(&insn->mem_cbs, cb, flags, rw, udata);
  }
  void qemu_plugin_register_vcpu_mem_inline_per_vcpu(
@@ -XXX,XX +XXX,XX @@ void qemu_plugin_register_vcpu_mem_inline_per_vcpu(
      qemu_plugin_u64 entry,
      uint64_t imm)
  {
 -    plugin_register_inline_op_on_entry(
 -        &insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_INLINE], rw, op, entry, imm);
 +    plugin_register_inline_op_on_entry(&insn->mem_cbs, rw, op, entry, imm);
  }
  void qemu_plugin_register_vcpu_tb_trans_cb(qemu_plugin_id_t id,
 --
 .34.1

-[PULL 06/20] tests/tcg/i386: Move smc_code2 to an executable section
+[PULL 15/20] plugins: Introduce PLUGIN_CB_MEM_REGULAR
-We're about to start validating PAGE_EXEC, which means
+Use different enumerators for vcpu_udata and vcpu_mem callbacks.
 that we've got to put this code into a section that is
 both writable and executable.
-Note that this test did not run on hardware beforehand either.
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tests/tcg/i386/test-i386.c | 2 +-
+ include/qemu/plugin.h  | 1 +
-file changed, 1 insertion(+), 1 deletion(-)
+ accel/tcg/plugin-gen.c | 2 +-
  plugins/core.c         | 4 ++--
 files changed, 4 insertions(+), 3 deletions(-)
-diff --git a/tests/tcg/i386/test-i386.c b/tests/tcg/i386/test-i386.c
+diff --git a/include/qemu/plugin.h b/include/qemu/plugin.h
 index XXXXXXX..XXXXXXX 100644
---- a/tests/tcg/i386/test-i386.c
+--- a/include/qemu/plugin.h
-+++ b/tests/tcg/i386/test-i386.c
++++ b/include/qemu/plugin.h
-@@ -XXX,XX +XXX,XX @@ uint8_t code[] = {
+@@ -XXX,XX +XXX,XX @@ union qemu_plugin_cb_sig {
-xc3, /* ret */
  enum plugin_dyn_cb_type {
      PLUGIN_CB_REGULAR,
 +    PLUGIN_CB_MEM_REGULAR,
      PLUGIN_CB_INLINE,
  };
--asm(".section \".data\"\n"
+diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
-+asm(".section \".data_x\",\"awx\"\n"
+index XXXXXXX..XXXXXXX 100644
-     "smc_code2:\n"
+--- a/accel/tcg/plugin-gen.c
-     "movl 4(%esp), %eax\n"
++++ b/accel/tcg/plugin-gen.c
-     "movl %eax, smc_patch_addr2 + 1\n"
+@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
                  if (cb->rw & rw) {
                      switch (cb->type) {
 -                    case PLUGIN_CB_REGULAR:
 +                    case PLUGIN_CB_MEM_REGULAR:
                          gen_mem_cb(cb, meminfo, addr);
                          break;
                      case PLUGIN_CB_INLINE:
 diff --git a/plugins/core.c b/plugins/core.c
 index XXXXXXX..XXXXXXX 100644
 --- a/plugins/core.c
 +++ b/plugins/core.c
@@ -XXX,XX +XXX,XX @@ void plugin_register_vcpu_mem_cb(GArray **arr,
      struct qemu_plugin_dyn_cb *dyn_cb = plugin_get_dyn_cb(arr);
      dyn_cb->userp = udata;
 -    dyn_cb->type = PLUGIN_CB_REGULAR;
 +    dyn_cb->type = PLUGIN_CB_MEM_REGULAR;
      dyn_cb->rw = rw;
      dyn_cb->regular.f.vcpu_mem = cb;
@@ -XXX,XX +XXX,XX @@ void qemu_plugin_vcpu_mem_cb(CPUState *cpu, uint64_t vaddr,
                  break;
          }
          switch (cb->type) {
 -        case PLUGIN_CB_REGULAR:
 +        case PLUGIN_CB_MEM_REGULAR:
              cb->regular.f.vcpu_mem(cpu->cpu_index, make_plugin_meminfo(oi, rw),
                                     vaddr, cb->userp);
              break;
 --
 .34.1

-[PULL 07/20] accel/tcg: Introduce is_same_page()
+Deleted patch
-From: Ilya Leoshkevich <iii@linux.ibm.com>
-Introduce a function that checks whether a given address is on the same
-page as where disassembly started. Having it improves readability of
-the following patches.
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Message-Id: <20220811095534.241224-3-iii@linux.ibm.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-[rth: Make the DisasContextBase parameter const.]
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/exec/translator.h | 10 ++++++++++
-file changed, 10 insertions(+)
-diff --git a/include/exec/translator.h b/include/exec/translator.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/exec/translator.h
-+++ b/include/exec/translator.h
-@@ -XXX,XX +XXX,XX @@ FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
- #undef GEN_TRANSLATOR_LD
-+/*
-+ * Return whether addr is on the same page as where disassembly started.
-+ * Translators can use this to enforce the rule that only single-insn
-+ * translation blocks are allowed to cross page boundaries.
-+ */
-+static inline bool is_same_page(const DisasContextBase *db, target_ulong addr)
-+{
-+    return ((addr ^ db->pc_first) & TARGET_PAGE_MASK) == 0;
-+}
-+
- #endif /* EXEC__TRANSLATOR_H */
---
-.34.1

-[PULL 11/20] accel/tcg: Move qemu_ram_addr_from_host_nofail to physmem.c
+[PULL 16/20] plugins: Replace pr_ops with a proper debug dump flag
-The base qemu_ram_addr_from_host function is already in
+The DEBUG_PLUGIN_GEN_OPS ifdef is replaced with "-d op_plugin".
-softmmu/physmem.c; move the nofail version to be adjacent.
+The second pr_ops call can be obtained with "-d op".
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/cpu-common.h |  1 +
+ include/qemu/log.h     |  1 +
- accel/tcg/cputlb.c        | 12 ------------
+ include/tcg/tcg.h      |  1 +
- softmmu/physmem.c         | 12 ++++++++++++
+ accel/tcg/plugin-gen.c | 67 +++++++-----------------------------------
-files changed, 13 insertions(+), 12 deletions(-)
+ tcg/tcg.c              | 29 +++++++++++++++++-
  util/log.c             |  4 +++
 files changed, 45 insertions(+), 57 deletions(-)
-diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
+diff --git a/include/qemu/log.h b/include/qemu/log.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/cpu-common.h
+--- a/include/qemu/log.h
-+++ b/include/exec/cpu-common.h
++++ b/include/qemu/log.h
-@@ -XXX,XX +XXX,XX @@ typedef uintptr_t ram_addr_t;
+@@ -XXX,XX +XXX,XX @@ bool qemu_log_separate(void);
- void qemu_ram_remap(ram_addr_t addr, ram_addr_t length);
+ #define LOG_STRACE         (1 << 19)
- /* This should not be used by devices.  */
+ #define LOG_PER_THREAD     (1 << 20)
- ram_addr_t qemu_ram_addr_from_host(void *ptr);
+ #define CPU_LOG_TB_VPU     (1 << 21)
-+ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr);
++#define LOG_TB_OP_PLUGIN   (1 << 22)
- RAMBlock *qemu_ram_block_by_name(const char *name);
- RAMBlock *qemu_ram_block_from_host(void *ptr, bool round_offset,
+ /* Lock/unlock output. */
-                                    ram_addr_t *offset);
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/include/tcg/tcg.h
-+++ b/accel/tcg/cputlb.c
++++ b/include/tcg/tcg.h
-@@ -XXX,XX +XXX,XX @@ void tlb_set_page(CPUState *cpu, target_ulong vaddr,
+@@ -XXX,XX +XXX,XX @@ static inline const TCGOpcode *tcg_swap_vecop_list(const TCGOpcode *n)
                              prot, mmu_idx, size);
  }
--static inline ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr)
+ bool tcg_can_emit_vecop_list(const TCGOpcode *, TCGType, unsigned);
 +void tcg_dump_ops(TCGContext *s, FILE *f, bool have_prefs);
  #endif /* TCG_H */
 diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/plugin-gen.c
 +++ b/accel/tcg/plugin-gen.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
  #include "qemu/plugin.h"
 +#include "qemu/log.h"
  #include "cpu.h"
  #include "tcg/tcg.h"
  #include "tcg/tcg-temp-internal.h"
@@ -XXX,XX +XXX,XX @@ static void gen_mem_cb(struct qemu_plugin_dyn_cb *cb,
      tcg_temp_free_i32(cpu_index);
  }
 -/* #define DEBUG_PLUGIN_GEN_OPS */
 -static void pr_ops(void)
 -{
--    ram_addr_t ram_addr;
+-#ifdef DEBUG_PLUGIN_GEN_OPS
 -    TCGOp *op;
 -    int i = 0;
 -
--    ram_addr = qemu_ram_addr_from_host(ptr);
+-    QTAILQ_FOREACH(op, &tcg_ctx->ops, link) {
--    if (ram_addr == RAM_ADDR_INVALID) {
+-        const char *name = "";
--        error_report("Bad ram pointer %p", ptr);
+-        const char *type = "";
--        abort();
+-
 -        if (op->opc == INDEX_op_plugin_cb_start) {
 -            switch (op->args[0]) {
 -            case PLUGIN_GEN_FROM_TB:
 -                name = "tb";
 -                break;
 -            case PLUGIN_GEN_FROM_INSN:
 -                name = "insn";
 -                break;
 -            case PLUGIN_GEN_FROM_MEM:
 -                name = "mem";
 -                break;
 -            case PLUGIN_GEN_AFTER_INSN:
 -                name = "after insn";
 -                break;
 -            default:
 -                break;
 -            }
 -            switch (op->args[1]) {
 -            case PLUGIN_GEN_CB_UDATA:
 -                type = "udata";
 -                break;
 -            case PLUGIN_GEN_CB_INLINE:
 -                type = "inline";
 -                break;
 -            case PLUGIN_GEN_CB_MEM:
 -                type = "mem";
 -                break;
 -            case PLUGIN_GEN_ENABLE_MEM_HELPER:
 -                type = "enable mem helper";
 -                break;
 -            case PLUGIN_GEN_DISABLE_MEM_HELPER:
 -                type = "disable mem helper";
 -                break;
 -            default:
 -                break;
 -            }
 -        }
 -        printf("op[%2i]: %s %s %s\n", i, tcg_op_defs[op->opc].name, name, type);
 -        i++;
 -    }
--    return ram_addr;
+-#endif
 -}
 -
- /*
+ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
-  * Note: tlb_fill() can trigger a resize of the TLB. This means that all of the
+ {
-  * caller's prior references to the TLB table (e.g. CPUTLBEntry pointers) must
+     TCGOp *op, *next;
-diff --git a/softmmu/physmem.c b/softmmu/physmem.c
+     int insn_idx = -1;
-index XXXXXXX..XXXXXXX 100644
---- a/softmmu/physmem.c
+-    pr_ops();
-+++ b/softmmu/physmem.c
++    if (unlikely(qemu_loglevel_mask(LOG_TB_OP_PLUGIN)
-@@ -XXX,XX +XXX,XX @@ ram_addr_t qemu_ram_addr_from_host(void *ptr)
++                 && qemu_log_in_addr_range(plugin_tb->vaddr))) {
-     return block->offset + offset;
++        FILE *logfile = qemu_log_trylock();
 +        if (logfile) {
 +            fprintf(logfile, "OP before plugin injection:\n");
 +            tcg_dump_ops(tcg_ctx, logfile, false);
 +            fprintf(logfile, "\n");
 +            qemu_log_unlock(logfile);
 +        }
 +    }
      /*
       * While injecting code, we cannot afford to reuse any ebb temps
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
              break;
          }
      }
 -    pr_ops();
  }
-+ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr)
+ bool plugin_gen_tb_start(CPUState *cpu, const DisasContextBase *db,
-+{
+diff --git a/tcg/tcg.c b/tcg/tcg.c
-+    ram_addr_t ram_addr;
+index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg.c
 +++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static const char bswap_flag_name[][6] = {
      [TCG_BSWAP_IZ | TCG_BSWAP_OS] = "iz,os",
  };
 +#ifdef CONFIG_PLUGIN
 +static const char * const plugin_from_name[] = {
 +    "from-tb",
 +    "from-insn",
 +    "after-insn",
 +    "after-tb",
 +};
 +#endif
 +
-+    ram_addr = qemu_ram_addr_from_host(ptr);
+ static inline bool tcg_regset_single(TCGRegSet d)
-+    if (ram_addr == RAM_ADDR_INVALID) {
+ {
-+        error_report("Bad ram pointer %p", ptr);
+     return (d & (d - 1)) == 0;
-+        abort();
+@@ -XXX,XX +XXX,XX @@ static inline TCGReg tcg_regset_first(TCGRegSet d)
-+    }
+ #define ne_fprintf(...) \
-+    return ram_addr;
+     ({ int ret_ = fprintf(__VA_ARGS__); ret_ >= 0 ? ret_ : 0; })
-+}
 -static void tcg_dump_ops(TCGContext *s, FILE *f, bool have_prefs)
 +void tcg_dump_ops(TCGContext *s, FILE *f, bool have_prefs)
  {
      char buf[128];
      TCGOp *op;
@@ -XXX,XX +XXX,XX @@ static void tcg_dump_ops(TCGContext *s, FILE *f, bool have_prefs)
                      i = k = 1;
                  }
                  break;
 +#ifdef CONFIG_PLUGIN
 +            case INDEX_op_plugin_cb:
 +                {
 +                    TCGArg from = op->args[k++];
 +                    const char *name = NULL;
 +
- static MemTxResult flatview_read(FlatView *fv, hwaddr addr,
++                    if (from < ARRAY_SIZE(plugin_from_name)) {
-                                  MemTxAttrs attrs, void *buf, hwaddr len);
++                        name = plugin_from_name[from];
- static MemTxResult flatview_write(FlatView *fv, hwaddr addr, MemTxAttrs attrs,
++                    }
 +                    if (name) {
 +                        col += ne_fprintf(f, "%s", name);
 +                    } else {
 +                        col += ne_fprintf(f, "$0x%" TCG_PRIlx, from);
 +                    }
 +                    i = 1;
 +                }
 +                break;
 +#endif
              default:
                  i = 0;
                  break;
 diff --git a/util/log.c b/util/log.c
 index XXXXXXX..XXXXXXX 100644
 --- a/util/log.c
 +++ b/util/log.c
@@ -XXX,XX +XXX,XX @@ const QEMULogItem qemu_log_items[] = {
        "show micro ops after optimization" },
      { CPU_LOG_TB_OP_IND, "op_ind",
        "show micro ops before indirect lowering" },
 +#ifdef CONFIG_PLUGIN
 +    { LOG_TB_OP_PLUGIN, "op_plugin",
 +      "show micro ops before plugin injection" },
 +#endif
      { CPU_LOG_INT, "int",
        "show interrupts/exceptions in short format" },
      { CPU_LOG_EXEC, "exec",
 --
 .34.1

-[PULL 17/20] target/s390x: Make translator stop before the end of a page
+[PULL 17/20] plugins: Split out common cb expanders
-From: Ilya Leoshkevich <iii@linux.ibm.com>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Right now translator stops right *after* the end of a page, which
 breaks reporting of fault locations when the last instruction of a
 multi-insn translation block crosses a page boundary.
 Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20220817150506.592862-3-iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/s390x/tcg/translate.c     |  15 +++-
+ accel/tcg/plugin-gen.c | 84 +++++++++++++++++++++---------------------
- tests/tcg/s390x/noexec.c         | 106 +++++++++++++++++++++++
+file changed, 41 insertions(+), 43 deletions(-)
  tests/tcg/multiarch/noexec.c.inc | 139 +++++++++++++++++++++++++++++++
  tests/tcg/s390x/Makefile.target  |   1 +
 files changed, 257 insertions(+), 4 deletions(-)
  create mode 100644 tests/tcg/s390x/noexec.c
  create mode 100644 tests/tcg/multiarch/noexec.c.inc
-diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
+diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/s390x/tcg/translate.c
+--- a/accel/tcg/plugin-gen.c
-+++ b/target/s390x/tcg/translate.c
++++ b/accel/tcg/plugin-gen.c
-@@ -XXX,XX +XXX,XX @@ static void s390x_tr_insn_start(DisasContextBase *dcbase, CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ static void gen_mem_cb(struct qemu_plugin_dyn_cb *cb,
-     dc->insn_start = tcg_last_op();
+     tcg_temp_free_i32(cpu_index);
  }
-+static target_ulong get_next_pc(CPUS390XState *env, DisasContext *s,
++static void inject_cb(struct qemu_plugin_dyn_cb *cb)
-+                                uint64_t pc)
++
 +{
-+    uint64_t insn = ld_code2(env, s, pc);
++    switch (cb->type) {
-+
++    case PLUGIN_CB_REGULAR:
-+    return pc + get_ilen((insn >> 8) & 0xff);
++        gen_udata_cb(cb);
-+}
++        break;
-+
++    case PLUGIN_CB_INLINE:
- static void s390x_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
++        gen_inline_cb(cb);
- {
++        break;
-     CPUS390XState *env = cs->env_ptr;
++    default:
-@@ -XXX,XX +XXX,XX @@ static void s390x_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
++        g_assert_not_reached();
      dc->base.is_jmp = translate_one(env, dc);
      if (dc->base.is_jmp == DISAS_NEXT) {
 -        uint64_t page_start;
 -
 -        page_start = dc->base.pc_first & TARGET_PAGE_MASK;
 -        if (dc->base.pc_next - page_start >= TARGET_PAGE_SIZE || dc->ex_value) {
 +        if (!is_same_page(dcbase, dc->base.pc_next) ||
 +            !is_same_page(dcbase, get_next_pc(env, dc, dc->base.pc_next)) ||
 +            dc->ex_value) {
              dc->base.is_jmp = DISAS_TOO_MANY;
          }
      }
 diff --git a/tests/tcg/s390x/noexec.c b/tests/tcg/s390x/noexec.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/tcg/s390x/noexec.c
@@ -XXX,XX +XXX,XX @@
 +#include "../multiarch/noexec.c.inc"
 +
 +static void *arch_mcontext_pc(const mcontext_t *ctx)
 +{
 +    return (void *)ctx->psw.addr;
 +}
 +
 +static int arch_mcontext_arg(const mcontext_t *ctx)
 +{
 +    return ctx->gregs[2];
 +}
 +
 +static void arch_flush(void *p, int len)
 +{
 +}
 +
 +extern char noexec_1[];
 +extern char noexec_2[];
 +extern char noexec_end[];
 +
 +asm("noexec_1:\n"
 +    "   lgfi %r2,1\n"       /* %r2 is 0 on entry, set 1. */
 +    "noexec_2:\n"
 +    "   lgfi %r2,2\n"       /* %r2 is 0/1; set 2. */
 +    "   br %r14\n"          /* return */
 +    "noexec_end:");
 +
 +extern char exrl_1[];
 +extern char exrl_2[];
 +extern char exrl_end[];
 +
 +asm("exrl_1:\n"
 +    "   exrl %r0, exrl_2\n"
 +    "   br %r14\n"
 +    "exrl_2:\n"
 +    "   lgfi %r2,2\n"
 +    "exrl_end:");
 +
 +int main(void)
 +{
 +    struct noexec_test noexec_tests[] = {
 +        {
 +            .name = "fallthrough",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2,
 +            .entry_ofs = noexec_1 - noexec_2,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = 0,
 +            .expected_arg = 1,
 +        },
 +        {
 +            .name = "jump",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2,
 +            .entry_ofs = 0,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = 0,
 +            .expected_arg = 0,
 +        },
 +        {
 +            .name = "exrl",
 +            .test_code = exrl_1,
 +            .test_len = exrl_end - exrl_1,
 +            .page_ofs = exrl_1 - exrl_2,
 +            .entry_ofs = exrl_1 - exrl_2,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = exrl_1 - exrl_2,
 +            .expected_arg = 0,
 +        },
 +        {
 +            .name = "fallthrough [cross]",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2 - 2,
 +            .entry_ofs = noexec_1 - noexec_2 - 2,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = -2,
 +            .expected_arg = 1,
 +        },
 +        {
 +            .name = "jump [cross]",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2 - 2,
 +            .entry_ofs = -2,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = -2,
 +            .expected_arg = 0,
 +        },
 +        {
 +            .name = "exrl [cross]",
 +            .test_code = exrl_1,
 +            .test_len = exrl_end - exrl_1,
 +            .page_ofs = exrl_1 - exrl_2 - 2,
 +            .entry_ofs = exrl_1 - exrl_2 - 2,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = exrl_1 - exrl_2 - 2,
 +            .expected_arg = 0,
 +        },
 +    };
 +
 +    return test_noexec(noexec_tests,
 +                       sizeof(noexec_tests) / sizeof(noexec_tests[0]));
 +}
 diff --git a/tests/tcg/multiarch/noexec.c.inc b/tests/tcg/multiarch/noexec.c.inc
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/tcg/multiarch/noexec.c.inc
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Common code for arch-specific MMU_INST_FETCH fault testing.
 + */
 +
 +#define _GNU_SOURCE
 +
 +#include <assert.h>
 +#include <signal.h>
 +#include <stdio.h>
 +#include <stdlib.h>
 +#include <string.h>
 +#include <errno.h>
 +#include <unistd.h>
 +#include <sys/mman.h>
 +#include <sys/ucontext.h>
 +
 +/* Forward declarations. */
 +
 +static void *arch_mcontext_pc(const mcontext_t *ctx);
 +static int arch_mcontext_arg(const mcontext_t *ctx);
 +static void arch_flush(void *p, int len);
 +
 +/* Testing infrastructure. */
 +
 +struct noexec_test {
 +    const char *name;
 +    const char *test_code;
 +    int test_len;
 +    int page_ofs;
 +    int entry_ofs;
 +    int expected_si_ofs;
 +    int expected_pc_ofs;
 +    int expected_arg;
 +};
 +
 +static void *page_base;
 +static int page_size;
 +static const struct noexec_test *current_noexec_test;
 +
 +static void handle_err(const char *syscall)
 +{
 +    printf("[  FAILED  ] %s: %s\n", syscall, strerror(errno));
 +    exit(EXIT_FAILURE);
 +}
 +
 +static void handle_segv(int sig, siginfo_t *info, void *ucontext)
 +{
 +    const struct noexec_test *test = current_noexec_test;
 +    const mcontext_t *mc = &((ucontext_t *)ucontext)->uc_mcontext;
 +    void *expected_si;
 +    void *expected_pc;
 +    void *pc;
 +    int arg;
 +
 +    if (test == NULL) {
 +        printf("[  FAILED  ] unexpected SEGV\n");
 +        exit(EXIT_FAILURE);
 +    }
 +    current_noexec_test = NULL;
 +
 +    expected_si = page_base + test->expected_si_ofs;
 +    if (info->si_addr != expected_si) {
 +        printf("[  FAILED  ] wrong si_addr (%p != %p)\n",
 +               info->si_addr, expected_si);
 +        exit(EXIT_FAILURE);
 +    }
 +
 +    pc = arch_mcontext_pc(mc);
 +    expected_pc = page_base + test->expected_pc_ofs;
 +    if (pc != expected_pc) {
 +        printf("[  FAILED  ] wrong pc (%p != %p)\n", pc, expected_pc);
 +        exit(EXIT_FAILURE);
 +    }
 +
 +    arg = arch_mcontext_arg(mc);
 +    if (arg != test->expected_arg) {
 +        printf("[  FAILED  ] wrong arg (%d != %d)\n", arg, test->expected_arg);
 +        exit(EXIT_FAILURE);
 +    }
 +
 +    if (mprotect(page_base, page_size,
 +                 PROT_READ | PROT_WRITE | PROT_EXEC) < 0) {
 +        handle_err("mprotect");
 +    }
 +}
 +
-+static void test_noexec_1(const struct noexec_test *test)
++static void inject_mem_cb(struct qemu_plugin_dyn_cb *cb,
 +                          enum qemu_plugin_mem_rw rw,
 +                          qemu_plugin_meminfo_t meminfo, TCGv_i64 addr)
 +{
-+    void *start = page_base + test->page_ofs;
++    if (cb->rw & rw) {
-+    void (*fn)(int arg) = page_base + test->entry_ofs;
++        switch (cb->type) {
-+
++        case PLUGIN_CB_MEM_REGULAR:
-+    memcpy(start, test->test_code, test->test_len);
++            gen_mem_cb(cb, meminfo, addr);
-+    arch_flush(start, test->test_len);
++            break;
-+
++        default:
-+    /* Trigger TB creation in order to test invalidation. */
++            inject_cb(cb);
-+    fn(0);
++            break;
-+
++        }
 +    if (mprotect(page_base, page_size, PROT_NONE) < 0) {
 +        handle_err("mprotect");
 +    }
-+
-+    /* Trigger SEGV and check that handle_segv() ran. */
-+    current_noexec_test = test;
-+    fn(0);
-+    assert(current_noexec_test == NULL);
 +}
 +
-+static int test_noexec(struct noexec_test *tests, size_t n_tests)
+ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
-+{
+ {
-+    struct sigaction act;
+     TCGOp *op, *next;
-+    size_t i;
+@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
-+
-+    memset(&act, 0, sizeof(act));
+                 cbs = plugin_tb->cbs;
-+    act.sa_sigaction = handle_segv;
+                 for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
-+    act.sa_flags = SA_SIGINFO;
+-                    struct qemu_plugin_dyn_cb *cb =
-+    if (sigaction(SIGSEGV, &act, NULL) < 0) {
+-                        &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
-+        handle_err("sigaction");
+-
-+    }
+-                    switch (cb->type) {
-+
+-                    case PLUGIN_CB_REGULAR:
-+    page_size = getpagesize();
+-                        gen_udata_cb(cb);
-+    page_base = mmap(NULL, 2 * page_size,
+-                        break;
-+                     PROT_READ | PROT_WRITE | PROT_EXEC,
+-                    case PLUGIN_CB_INLINE:
-+                     MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
+-                        gen_inline_cb(cb);
-+    if (page_base == MAP_FAILED) {
+-                        break;
-+        handle_err("mmap");
+-                    default:
-+    }
+-                        g_assert_not_reached();
-+    page_base += page_size;
+-                    }
-+
++                    inject_cb(
-+    for (i = 0; i < n_tests; i++) {
++                        &g_array_index(cbs, struct qemu_plugin_dyn_cb, i));
-+        struct noexec_test *test = &tests[i];
+                 }
-+
+                 break;
-+        printf("[ RUN      ] %s\n", test->name);
-+        test_noexec_1(test);
+@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
-+        printf("[       OK ]\n");
-+    }
+                 cbs = insn->insn_cbs;
-+
+                 for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
-+    printf("[  PASSED  ]\n");
+-                    struct qemu_plugin_dyn_cb *cb =
-+    return EXIT_SUCCESS;
+-                        &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
-+}
+-
-diff --git a/tests/tcg/s390x/Makefile.target b/tests/tcg/s390x/Makefile.target
+-                    switch (cb->type) {
-index XXXXXXX..XXXXXXX 100644
+-                    case PLUGIN_CB_REGULAR:
---- a/tests/tcg/s390x/Makefile.target
+-                        gen_udata_cb(cb);
-+++ b/tests/tcg/s390x/Makefile.target
+-                        break;
-@@ -XXX,XX +XXX,XX @@ TESTS+=shift
+-                    case PLUGIN_CB_INLINE:
- TESTS+=trap
+-                        gen_inline_cb(cb);
- TESTS+=signals-s390x
+-                        break;
- TESTS+=branch-relative-long
+-                    default:
-+TESTS+=noexec
+-                        g_assert_not_reached();
+-                    }
- Z14_TESTS=vfminmax
++                    inject_cb(
- vfminmax: LDFLAGS+=-lm
++                        &g_array_index(cbs, struct qemu_plugin_dyn_cb, i));
                  }
                  break;
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
          {
              TCGv_i64 addr = temp_tcgv_i64(arg_temp(op->args[0]));
              qemu_plugin_meminfo_t meminfo = op->args[1];
 +            enum qemu_plugin_mem_rw rw =
 +                (qemu_plugin_mem_is_store(meminfo)
 +                 ? QEMU_PLUGIN_MEM_W : QEMU_PLUGIN_MEM_R);
              struct qemu_plugin_insn *insn;
              const GArray *cbs;
 -            int i, n, rw;
 +            int i, n;
              assert(insn_idx >= 0);
              insn = g_ptr_array_index(plugin_tb->insns, insn_idx);
 -            rw = qemu_plugin_mem_is_store(meminfo) ? 2 : 1;
              tcg_ctx->emit_before_op = op;
              cbs = insn->mem_cbs;
              for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
 -                struct qemu_plugin_dyn_cb *cb =
 -                    &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
 -
 -                if (cb->rw & rw) {
 -                    switch (cb->type) {
 -                    case PLUGIN_CB_MEM_REGULAR:
 -                        gen_mem_cb(cb, meminfo, addr);
 -                        break;
 -                    case PLUGIN_CB_INLINE:
 -                        gen_inline_cb(cb);
 -                        break;
 -                    default:
 -                        g_assert_not_reached();
 -                    }
 -                }
 +                inject_mem_cb(&g_array_index(cbs, struct qemu_plugin_dyn_cb, i),
 +                              rw, meminfo, addr);
              }
              tcg_ctx->emit_before_op = NULL;
 --
 .34.1

-[PULL 12/20] accel/tcg: Use probe_access_internal for softmmu get_page_addr_code_hostp
+[PULL 18/20] plugins: Merge qemu_plugin_tb_insn_get to plugin-gen.c
-Simplify the implementation of get_page_addr_code_hostp
+Merge qemu_plugin_insn_alloc and qemu_plugin_tb_insn_get into
-by reusing the existing probe_access infrastructure.
+plugin_gen_insn_start, since it is used nowhere else.
-Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/cputlb.c | 76 ++++++++++++++++------------------------------
+ include/qemu/plugin.h  | 39 ---------------------------------------
-file changed, 26 insertions(+), 50 deletions(-)
+ accel/tcg/plugin-gen.c | 39 ++++++++++++++++++++++++++++++++-------
 files changed, 32 insertions(+), 46 deletions(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+diff --git a/include/qemu/plugin.h b/include/qemu/plugin.h
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/include/qemu/plugin.h
-+++ b/accel/tcg/cputlb.c
++++ b/include/qemu/plugin.h
-@@ -XXX,XX +XXX,XX @@ static bool victim_tlb_hit(CPUArchState *env, size_t mmu_idx, size_t index,
+@@ -XXX,XX +XXX,XX @@ static inline void qemu_plugin_insn_cleanup_fn(gpointer data)
-   victim_tlb_hit(env, mmu_idx, index, offsetof(CPUTLBEntry, TY), \
+     g_byte_array_free(insn->data, true);
-                  (ADDR) & TARGET_PAGE_MASK)
+ }
--/*
+-static inline struct qemu_plugin_insn *qemu_plugin_insn_alloc(void)
-- * Return a ram_addr_t for the virtual address for execution.
+-{
-- *
+-    struct qemu_plugin_insn *insn = g_new0(struct qemu_plugin_insn, 1);
-- * Return -1 if we can't translate and execute from an entire page
+-
-- * of RAM.  This will force us to execute by loading and translating
+-    insn->data = g_byte_array_sized_new(4);
-- * one insn at a time, without caching.
+-    return insn;
-- *
+-}
-- * NOTE: This function will trigger an exception if the page is
+-
-- * not executable.
+ /* Internal context for this TranslationBlock */
  struct qemu_plugin_tb {
      GPtrArray *insns;
@@ -XXX,XX +XXX,XX @@ struct qemu_plugin_tb {
      GArray *cbs;
  };
 -/**
 - * qemu_plugin_tb_insn_get(): get next plugin record for translation.
 - * @tb: the internal tb context
 - * @pc: address of instruction
 - */
--tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
+-static inline
--                                        void **hostp)
+-struct qemu_plugin_insn *qemu_plugin_tb_insn_get(struct qemu_plugin_tb *tb,
 -                                                 uint64_t pc)
 -{
--    uintptr_t mmu_idx = cpu_mmu_index(env, true);
+-    struct qemu_plugin_insn *insn;
 -    uintptr_t index = tlb_index(env, mmu_idx, addr);
 -    CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
 -    void *p;
 -
--    if (unlikely(!tlb_hit(entry->addr_code, addr))) {
+-    if (unlikely(tb->n == tb->insns->len)) {
--        if (!VICTIM_TLB_HIT(addr_code, addr)) {
+-        struct qemu_plugin_insn *new_insn = qemu_plugin_insn_alloc();
--            tlb_fill(env_cpu(env), addr, 0, MMU_INST_FETCH, mmu_idx, 0);
+-        g_ptr_array_add(tb->insns, new_insn);
 -            index = tlb_index(env, mmu_idx, addr);
 -            entry = tlb_entry(env, mmu_idx, addr);
 -
 -            if (unlikely(entry->addr_code & TLB_INVALID_MASK)) {
 -                /*
 -                 * The MMU protection covers a smaller range than a target
 -                 * page, so we must redo the MMU check for every insn.
 -                 */
 -                return -1;
 -            }
 -        }
 -        assert(tlb_hit(entry->addr_code, addr));
 -    }
 -
--    if (unlikely(entry->addr_code & TLB_MMIO)) {
+-    insn = g_ptr_array_index(tb->insns, tb->n++);
--        /* The region is not backed by RAM.  */
+-    g_byte_array_set_size(insn->data, 0);
--        if (hostp) {
+-    insn->calls_helpers = false;
--            *hostp = NULL;
+-    insn->mem_helper = false;
--        }
+-    insn->vaddr = pc;
--        return -1;
+-    if (insn->insn_cbs) {
 -        g_array_set_size(insn->insn_cbs, 0);
 -    }
 -    if (insn->mem_cbs) {
 -        g_array_set_size(insn->mem_cbs, 0);
 -    }
 -
--    p = (void *)((uintptr_t)addr + entry->addend);
+-    return insn;
 -    if (hostp) {
 -        *hostp = p;
 -    }
 -    return qemu_ram_addr_from_host_nofail(p);
 -}
 -
- static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
+ /**
-                            CPUIOTLBEntry *iotlbentry, uintptr_t retaddr)
+  * struct CPUPluginState - per-CPU state for plugins
   * @event_mask: plugin event bitmap. Modified only via async work.
 diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/plugin-gen.c
 +++ b/accel/tcg/plugin-gen.c
@@ -XXX,XX +XXX,XX @@ bool plugin_gen_tb_start(CPUState *cpu, const DisasContextBase *db,
  void plugin_gen_insn_start(CPUState *cpu, const DisasContextBase *db)
  {
-@@ -XXX,XX +XXX,XX @@ void *tlb_vaddr_to_host(CPUArchState *env, abi_ptr addr,
+     struct qemu_plugin_tb *ptb = tcg_ctx->plugin_tb;
-     return flags ? NULL : host;
+-    struct qemu_plugin_insn *pinsn;
 +    struct qemu_plugin_insn *insn;
 +    size_t n = db->num_insns;
 +    vaddr pc;
 -    pinsn = qemu_plugin_tb_insn_get(ptb, db->pc_next);
 -    tcg_ctx->plugin_insn = pinsn;
 -    plugin_gen_empty_callback(PLUGIN_GEN_FROM_INSN);
 +    assert(n >= 1);
 +    ptb->n = n;
 +    if (n <= ptb->insns->len) {
 +        insn = g_ptr_array_index(ptb->insns, n - 1);
 +        g_byte_array_set_size(insn->data, 0);
 +    } else {
 +        assert(n - 1 == ptb->insns->len);
 +        insn = g_new0(struct qemu_plugin_insn, 1);
 +        insn->data = g_byte_array_sized_new(4);
 +        g_ptr_array_add(ptb->insns, insn);
 +    }
 +
 +    tcg_ctx->plugin_insn = insn;
 +    insn->calls_helpers = false;
 +    insn->mem_helper = false;
 +    if (insn->insn_cbs) {
 +        g_array_set_size(insn->insn_cbs, 0);
 +    }
 +    if (insn->mem_cbs) {
 +        g_array_set_size(insn->mem_cbs, 0);
 +    }
 +
 +    pc = db->pc_next;
 +    insn->vaddr = pc;
      /*
       * Detect page crossing to get the new host address.
@@ -XXX,XX +XXX,XX @@ void plugin_gen_insn_start(CPUState *cpu, const DisasContextBase *db)
       * fetching instructions from a region not backed by RAM.
       */
      if (ptb->haddr1 == NULL) {
 -        pinsn->haddr = NULL;
 +        insn->haddr = NULL;
      } else if (is_same_page(db, db->pc_next)) {
 -        pinsn->haddr = ptb->haddr1 + pinsn->vaddr - ptb->vaddr;
 +        insn->haddr = ptb->haddr1 + pc - ptb->vaddr;
      } else {
          if (ptb->vaddr2 == -1) {
              ptb->vaddr2 = TARGET_PAGE_ALIGN(db->pc_first);
              get_page_addr_code_hostp(cpu_env(cpu), ptb->vaddr2, &ptb->haddr2);
          }
 -        pinsn->haddr = ptb->haddr2 + pinsn->vaddr - ptb->vaddr2;
 +        insn->haddr = ptb->haddr2 + pc - ptb->vaddr2;
      }
 +
 +    plugin_gen_empty_callback(PLUGIN_GEN_FROM_INSN);
  }
-+/*
+ void plugin_gen_insn_end(void)
 + * Return a ram_addr_t for the virtual address for execution.
 + *
 + * Return -1 if we can't translate and execute from an entire page
 + * of RAM.  This will force us to execute by loading and translating
 + * one insn at a time, without caching.
 + *
 + * NOTE: This function will trigger an exception if the page is
 + * not executable.
 + */
 +tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
 +                                        void **hostp)
 +{
 +    void *p;
 +
 +    (void)probe_access_internal(env, addr, 1, MMU_INST_FETCH,
 +                                cpu_mmu_index(env, true), false, &p, 0);
 +    if (p == NULL) {
 +        return -1;
 +    }
 +    if (hostp) {
 +        *hostp = p;
 +    }
 +    return qemu_ram_addr_from_host_nofail(p);
 +}
 +
  #ifdef CONFIG_PLUGIN
  /*
   * Perform a TLB lookup and populate the qemu_plugin_hwaddr structure.
 --
 .34.1

-[PULL 08/20] accel/tcg: Properly implement get_page_addr_code for user-only
+[PULL 19/20] plugins: Inline plugin_gen_empty_callback
-The current implementation is a no-op, simply returning addr.
+Each caller can use tcg_gen_plugin_cb directly.
 This is incorrect, because we ought to be checking the page
 permissions for execution.
-Make get_page_addr_code inline for both implementations.
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/exec-all.h | 85 ++++++++++++++---------------------------
+ accel/tcg/plugin-gen.c | 19 +++----------------
- accel/tcg/cputlb.c      |  5 ---
+file changed, 3 insertions(+), 16 deletions(-)
  accel/tcg/user-exec.c   | 14 +++++++
 files changed, 42 insertions(+), 62 deletions(-)
-diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
+diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/exec-all.h
+--- a/accel/tcg/plugin-gen.c
-+++ b/include/exec/exec-all.h
++++ b/accel/tcg/plugin-gen.c
-@@ -XXX,XX +XXX,XX @@ struct MemoryRegionSection *iotlb_to_section(CPUState *cpu,
+@@ -XXX,XX +XXX,XX @@ enum plugin_gen_from {
-                                              hwaddr index, MemTxAttrs attrs);
+     PLUGIN_GEN_AFTER_TB,
- #endif
+ };
--#if defined(CONFIG_USER_ONLY)
+-static void plugin_gen_empty_callback(enum plugin_gen_from from)
 -void mmap_lock(void);
 -void mmap_unlock(void);
 -bool have_mmap_lock(void);
 -
  /**
 - * get_page_addr_code() - user-mode version
 + * get_page_addr_code_hostp()
   * @env: CPUArchState
   * @addr: guest virtual address of guest code
   *
 - * Returns @addr.
 + * See get_page_addr_code() (full-system version) for documentation on the
 + * return value.
 + *
 + * Sets *@hostp (when @hostp is non-NULL) as follows.
 + * If the return value is -1, sets *@hostp to NULL. Otherwise, sets *@hostp
 + * to the host address where @addr's content is kept.
 + *
 + * Note: this function can trigger an exception.
 + */
 +tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
 +                                        void **hostp);
 +
 +/**
 + * get_page_addr_code()
 + * @env: CPUArchState
 + * @addr: guest virtual address of guest code
 + *
 + * If we cannot translate and execute from the entire RAM page, or if
 + * the region is not backed by RAM, returns -1. Otherwise, returns the
 + * ram_addr_t corresponding to the guest code at @addr.
 + *
 + * Note: this function can trigger an exception.
   */
  static inline tb_page_addr_t get_page_addr_code(CPUArchState *env,
                                                  target_ulong addr)
  {
 -    return addr;
 +    return get_page_addr_code_hostp(env, addr, NULL);
  }
 -/**
 - * get_page_addr_code_hostp() - user-mode version
 - * @env: CPUArchState
 - * @addr: guest virtual address of guest code
 - *
 - * Returns @addr.
 - *
 - * If @hostp is non-NULL, sets *@hostp to the host address where @addr's content
 - * is kept.
 - */
 -static inline tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env,
 -                                                      target_ulong addr,
 -                                                      void **hostp)
 -{
--    if (hostp) {
+-    switch (from) {
--        *hostp = g2h_untagged(addr);
+-    case PLUGIN_GEN_AFTER_INSN:
 -    case PLUGIN_GEN_FROM_TB:
 -    case PLUGIN_GEN_FROM_INSN:
 -        tcg_gen_plugin_cb(from);
 -        break;
 -    default:
 -        g_assert_not_reached();
 -    }
--    return addr;
--}
-+#if defined(CONFIG_USER_ONLY)
-+void mmap_lock(void);
-+void mmap_unlock(void);
-+bool have_mmap_lock(void);
- /**
-  * adjust_signal_pc:
-@@ -XXX,XX +XXX,XX @@ G_NORETURN void cpu_loop_exit_sigbus(CPUState *cpu, target_ulong addr,
- static inline void mmap_lock(void) {}
- static inline void mmap_unlock(void) {}
--/**
-- * get_page_addr_code() - full-system version
-- * @env: CPUArchState
-- * @addr: guest virtual address of guest code
-- *
-- * If we cannot translate and execute from the entire RAM page, or if
-- * the region is not backed by RAM, returns -1. Otherwise, returns the
-- * ram_addr_t corresponding to the guest code at @addr.
-- *
-- * Note: this function can trigger an exception.
-- */
--tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr);
--
--/**
-- * get_page_addr_code_hostp() - full-system version
-- * @env: CPUArchState
-- * @addr: guest virtual address of guest code
-- *
-- * See get_page_addr_code() (full-system version) for documentation on the
-- * return value.
-- *
-- * Sets *@hostp (when @hostp is non-NULL) as follows.
-- * If the return value is -1, sets *@hostp to NULL. Otherwise, sets *@hostp
-- * to the host address where @addr's content is kept.
-- *
-- * Note: this function can trigger an exception.
-- */
--tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
--                                        void **hostp);
--
- void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length);
- void tlb_set_dirty(CPUState *cpu, target_ulong vaddr);
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
-+++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
-     return qemu_ram_addr_from_host_nofail(p);
- }
--tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr)
--{
--    return get_page_addr_code_hostp(env, addr, NULL);
 -}
 -
- static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
+ /* called before finishing a TB with exit_tb, goto_tb or goto_ptr */
-                            CPUIOTLBEntry *iotlbentry, uintptr_t retaddr)
+ void plugin_gen_disable_mem_helpers(void)
  {
-diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
+@@ -XXX,XX +XXX,XX @@ bool plugin_gen_tb_start(CPUState *cpu, const DisasContextBase *db,
-index XXXXXXX..XXXXXXX 100644
+         ptb->mem_only = mem_only;
---- a/accel/tcg/user-exec.c
+         ptb->mem_helper = false;
-+++ b/accel/tcg/user-exec.c
-@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
+-        plugin_gen_empty_callback(PLUGIN_GEN_FROM_TB);
-     return size ? g2h(env_cpu(env), addr) : NULL;
++        tcg_gen_plugin_cb(PLUGIN_GEN_FROM_TB);
      }
      tcg_ctx->plugin_insn = NULL;
@@ -XXX,XX +XXX,XX @@ void plugin_gen_insn_start(CPUState *cpu, const DisasContextBase *db)
          insn->haddr = ptb->haddr2 + pc - ptb->vaddr2;
      }
 -    plugin_gen_empty_callback(PLUGIN_GEN_FROM_INSN);
 +    tcg_gen_plugin_cb(PLUGIN_GEN_FROM_INSN);
  }
-+tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
+ void plugin_gen_insn_end(void)
-+                                        void **hostp)
+ {
-+{
+-    plugin_gen_empty_callback(PLUGIN_GEN_AFTER_INSN);
-+    int flags;
++    tcg_gen_plugin_cb(PLUGIN_GEN_AFTER_INSN);
-+
+ }
 +    flags = probe_access_internal(env, addr, 1, MMU_INST_FETCH, false, 0);
 +    g_assert(flags == 0);
 +
 +    if (hostp) {
 +        *hostp = g2h_untagged(addr);
 +    }
 +    return addr;
 +}
 +
  /* The softmmu versions of these helpers are in cputlb.c.  */
  /*
 --
 .34.1

-[PULL 13/20] accel/tcg: Document the faulting lookup in tb_lookup_cmp
+[PULL 20/20] plugins: Update the documentation block for plugin-gen.c
-It was non-obvious to me why we can raise an exception in
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 the middle of a comparison function, but it works.
 While nearby, use TARGET_PAGE_ALIGN instead of open-coding.
 Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/cpu-exec.c | 11 ++++++++++-
+ accel/tcg/plugin-gen.c | 31 ++++---------------------------
-file changed, 10 insertions(+), 1 deletion(-)
+file changed, 4 insertions(+), 27 deletions(-)
-diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
+diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cpu-exec.c
+--- a/accel/tcg/plugin-gen.c
-+++ b/accel/tcg/cpu-exec.c
++++ b/accel/tcg/plugin-gen.c
-@@ -XXX,XX +XXX,XX @@ static bool tb_lookup_cmp(const void *p, const void *d)
+@@ -XXX,XX +XXX,XX @@
-             tb_page_addr_t phys_page2;
+  * Injecting the desired instrumentation could be done with a second
-             target_ulong virt_page2;
+  * translation pass that combined the instrumentation requests, but that
+  * would be ugly and inefficient since we would decode the guest code twice.
--            virt_page2 = (desc->pc & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
+- * Instead, during TB translation we add "empty" instrumentation calls for all
-+            /*
+- * possible instrumentation events, and then once we collect the instrumentation
-+             * We know that the first page matched, and an otherwise valid TB
+- * requests from plugins, we either "fill in" those empty events or remove them
-+             * encountered an incomplete instruction at the end of that page,
+- * if they have no requests.
-+             * therefore we know that generating a new TB from the current PC
+- *
-+             * must also require reading from the next page -- even if the
+- * When "filling in" an event we first copy the empty callback's TCG ops. This
-+             * second pages do not match, and therefore the resulting insn
+- * might seem unnecessary, but it is done to support an arbitrary number
-+             * is different for the new TB.  Therefore any exception raised
+- * of callbacks per event. Take for example a regular instruction callback.
-+             * here by the faulting lookup is not premature.
+- * We first generate a callback to an empty helper function. Then, if two
-+             */
+- * plugins register one callback each for this instruction, we make two copies
-+            virt_page2 = TARGET_PAGE_ALIGN(desc->pc);
+- * of the TCG ops generated for the empty callback, substituting the function
-             phys_page2 = get_page_addr_code(desc->env, virt_page2);
+- * pointer that points to the empty helper function with the plugins' desired
-             if (tb->page_addr[1] == phys_page2) {
+- * callback functions. After that we remove the empty callback's ops.
-                 return true;
+- *
 - * Note that the location in TCGOp.args[] of the pointer to a helper function
 - * varies across different guest and host architectures. Instead of duplicating
 - * the logic that figures this out, we rely on the fact that the empty
 - * callbacks point to empty functions that are unique pointers in the program.
 - * Thus, to find the right location we just have to look for a match in
 - * TCGOp.args[]. This is the main reason why we first copy an empty callback's
 - * TCG ops and then fill them in; regardless of whether we have one or many
 - * callbacks for that event, the logic to add all of them is the same.
 - *
 - * When generating more than one callback per event, we make a small
 - * optimization to avoid generating redundant operations. For instance, for the
 - * second and all subsequent callbacks of an event, we do not need to reload the
 - * CPU's index into a TCG temp, since the first callback did it already.
 + * Instead, during TB translation we add "plugin_cb" marker opcodes
 + * for all possible instrumentation events, and then once we collect the
 + * instrumentation requests from plugins, we generate code for those markers
 + * or remove them if they have no requests.
   */
  #include "qemu/osdep.h"
  #include "qemu/plugin.h"
 --
 .34.1

The following changes since commit e93ded1bf6c94ab95015b33e188bc8b0b0c32670:

Merge tag 'testing-pull-request-2022-08-30' of https://gitlab.com/thuth/qemu into staging (2022-08-31 18:19:03 -0400)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20220901

for you to fetch changes up to 20011be2e30b8aa8ef1fc258485f00c688703deb:

target/riscv: Make translator stop before the end of a page (2022-09-01 07:43:08 +0100)

----------------------------------------------------------------
Respect PROT_EXEC in user-only mode.
Fix s390x, i386 and riscv for translations crossing a page.

----------------------------------------------------------------
Ilya Leoshkevich (4):
      linux-user: Clear translations on mprotect()
      accel/tcg: Introduce is_same_page()
      target/s390x: Make translator stop before the end of a page
      target/i386: Make translator stop before the end of a page

Richard Henderson (16):
      linux-user/arm: Mark the commpage executable
      linux-user/hppa: Allocate page zero as a commpage
      linux-user/x86_64: Allocate vsyscall page as a commpage
      linux-user: Honor PT_GNU_STACK
      tests/tcg/i386: Move smc_code2 to an executable section
      accel/tcg: Properly implement get_page_addr_code for user-only
      accel/tcg: Unlock mmap_lock after longjmp
      accel/tcg: Make tb_htable_lookup static
      accel/tcg: Move qemu_ram_addr_from_host_nofail to physmem.c
      accel/tcg: Use probe_access_internal for softmmu get_page_addr_code_hostp
      accel/tcg: Document the faulting lookup in tb_lookup_cmp
      accel/tcg: Remove translator_ldsw
      accel/tcg: Add pc and host_pc params to gen_intermediate_code
      accel/tcg: Add fast path for translator_ld*
      target/riscv: Add MAX_INSN_LEN and insn_len
      target/riscv: Make translator stop before the end of a page

include/elf.h                     |   1 +
 include/exec/cpu-common.h         |   1 +
 include/exec/exec-all.h           |  89 ++++++++----------------
 include/exec/translator.h         |  96 ++++++++++++++++---------
 linux-user/arm/target_cpu.h       |   4 +-
 linux-user/qemu.h                 |   1 +
 accel/tcg/cpu-exec.c              | 143 ++++++++++++++++++++------------------
 accel/tcg/cputlb.c                |  93 +++++++------------------
 accel/tcg/translate-all.c         |  29 ++++----
 accel/tcg/translator.c            | 135 ++++++++++++++++++++++++++---------
 accel/tcg/user-exec.c             |  17 ++++-
 linux-user/elfload.c              |  82 ++++++++++++++++++++--
 linux-user/mmap.c                 |   6 +-
 softmmu/physmem.c                 |  12 ++++
 target/alpha/translate.c          |   5 +-
 target/arm/translate.c            |   5 +-
 target/avr/translate.c            |   5 +-
 target/cris/translate.c           |   5 +-
 target/hexagon/translate.c        |   6 +-
 target/hppa/translate.c           |   5 +-
 target/i386/tcg/translate.c       |  71 +++++++++++--------
 target/loongarch/translate.c      |   6 +-
 target/m68k/translate.c           |   5 +-
 target/microblaze/translate.c     |   5 +-
 target/mips/tcg/translate.c       |   5 +-
 target/nios2/translate.c          |   5 +-
 target/openrisc/translate.c       |   6 +-
 target/ppc/translate.c            |   5 +-
 target/riscv/translate.c          |  32 +++++++--
 target/rx/translate.c             |   5 +-
 target/s390x/tcg/translate.c      |  20 ++++--
 target/sh4/translate.c            |   5 +-
 target/sparc/translate.c          |   5 +-
 target/tricore/translate.c        |   6 +-
 target/xtensa/translate.c         |   6 +-
 tests/tcg/i386/test-i386.c        |   2 +-
 tests/tcg/riscv64/noexec.c        |  79 +++++++++++++++++++++
 tests/tcg/s390x/noexec.c          | 106 ++++++++++++++++++++++++++++
 tests/tcg/x86_64/noexec.c         |  75 ++++++++++++++++++++
 tests/tcg/multiarch/noexec.c.inc  | 139 ++++++++++++++++++++++++++++++++++++
 tests/tcg/riscv64/Makefile.target |   1 +
 tests/tcg/s390x/Makefile.target   |   1 +
 tests/tcg/x86_64/Makefile.target  |   3 +-
 43 files changed, 966 insertions(+), 367 deletions(-)
 create mode 100644 tests/tcg/riscv64/noexec.c
 create mode 100644 tests/tcg/s390x/noexec.c
 create mode 100644 tests/tcg/x86_64/noexec.c
 create mode 100644 tests/tcg/multiarch/noexec.c.inc

We're about to start validating PAGE_EXEC, which means
that we've got to mark the commpage executable.  We had
been placing the commpage outside of reserved_va, which
was incorrect and lead to an abort.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/arm/target_cpu.h | 4 ++--
 linux-user/elfload.c        | 6 +++++-
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/linux-user/arm/target_cpu.h b/linux-user/arm/target_cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/arm/target_cpu.h
+++ b/linux-user/arm/target_cpu.h
@@ -XXX,XX +XXX,XX @@ static inline unsigned long arm_max_reserved_va(CPUState *cs)
     } else {
         /*
          * We need to be able to map the commpage.
-         * See validate_guest_space in linux-user/elfload.c.
+         * See init_guest_commpage in linux-user/elfload.c.
          */
-        return 0xffff0000ul;
+        return 0xfffffffful;
     }
 }
 #define MAX_RESERVED_VA  arm_max_reserved_va
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ enum {
 
 static bool init_guest_commpage(void)
 {
-    void *want = g2h_untagged(HI_COMMPAGE & -qemu_host_page_size);
+    abi_ptr commpage = HI_COMMPAGE & -qemu_host_page_size;
+    void *want = g2h_untagged(commpage);
     void *addr = mmap(want, qemu_host_page_size, PROT_READ | PROT_WRITE,
                       MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
 
@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)
         perror("Protecting guest commpage");
         exit(EXIT_FAILURE);
     }
+
+    page_set_flags(commpage, commpage + qemu_host_page_size,
+                   PAGE_READ | PAGE_EXEC | PAGE_VALID);
     return true;
 }
 
-- 
2.34.1

While there are no target-specific nonfaulting probes,
generic code may grow some uses at some point.

Note that the attrs argument was incorrect -- it should have
been MEMTXATTRS_UNSPECIFIED. Just use the simpler interface.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/helper.c | 46 ++++++++++++++++++++++++++++-----------------
 1 file changed, 29 insertions(+), 17 deletions(-)

diff --git a/target/avr/helper.c b/target/avr/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/helper.c
+++ b/target/avr/helper.c
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                       MMUAccessType access_type, int mmu_idx,
                       bool probe, uintptr_t retaddr)
 {
-    int prot = 0;
-    MemTxAttrs attrs = {};
+    int prot, page_size = TARGET_PAGE_SIZE;
     uint32_t paddr;
 
     address &= TARGET_PAGE_MASK;
 
     if (mmu_idx == MMU_CODE_IDX) {
-        /* access to code in flash */
+        /* Access to code in flash. */
         paddr = OFFSET_CODE + address;
         prot = PAGE_READ | PAGE_EXEC;
-        if (paddr + TARGET_PAGE_SIZE > OFFSET_DATA) {
+        if (paddr >= OFFSET_DATA) {
+            /*
+             * This should not be possible via any architectural operations.
+             * There is certainly not an exception that we can deliver.
+             * Accept probing that might come from generic code.
+             */
+            if (probe) {
+                return false;
+            }
             error_report("execution left flash memory");
             abort();
         }
-    } else if (address < NUMBER_OF_CPU_REGISTERS + NUMBER_OF_IO_REGISTERS) {
-        /*
-         * access to CPU registers, exit and rebuilt this TB to use full access
-         * incase it touches specially handled registers like SREG or SP
-         */
-        AVRCPU *cpu = AVR_CPU(cs);
-        CPUAVRState *env = &cpu->env;
-        env->fullacc = 1;
-        cpu_loop_exit_restore(cs, retaddr);
     } else {
-        /* access to memory. nothing special */
+        /* Access to memory. */
         paddr = OFFSET_DATA + address;
         prot = PAGE_READ | PAGE_WRITE;
+        if (address < NUMBER_OF_CPU_REGISTERS + NUMBER_OF_IO_REGISTERS) {
+            /*
+             * Access to CPU registers, exit and rebuilt this TB to use
+             * full access in case it touches specially handled registers
+             * like SREG or SP.  For probing, set page_size = 1, in order
+             * to force tlb_fill to be called for the next access.
+             */
+            if (probe) {
+                page_size = 1;
+            } else {
+                AVRCPU *cpu = AVR_CPU(cs);
+                CPUAVRState *env = &cpu->env;
+                env->fullacc = 1;
+                cpu_loop_exit_restore(cs, retaddr);
+            }
+        }
     }
 
-    tlb_set_page_with_attrs(cs, address, paddr, attrs, prot,
-                            mmu_idx, TARGET_PAGE_SIZE);
-
+    tlb_set_page(cs, address, paddr, prot, mmu_idx, page_size);
     return true;
 }
 
-- 
2.34.1

There is no need to go through cc->tcg_ops when
we know what value that must have.

Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/helper.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/target/avr/helper.c b/target/avr/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/helper.c
+++ b/target/avr/helper.c
@@ -XXX,XX +XXX,XX @@
 bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 {
     bool ret = false;
-    CPUClass *cc = CPU_GET_CLASS(cs);
     AVRCPU *cpu = AVR_CPU(cs);
     CPUAVRState *env = &cpu->env;
 
     if (interrupt_request & CPU_INTERRUPT_RESET) {
         if (cpu_interrupts_enabled(env)) {
             cs->exception_index = EXCP_RESET;
-            cc->tcg_ops->do_interrupt(cs);
+            avr_cpu_do_interrupt(cs);
 
             cs->interrupt_request &= ~CPU_INTERRUPT_RESET;
 
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
         if (cpu_interrupts_enabled(env) && env->intsrc != 0) {
             int index = ctz32(env->intsrc);
             cs->exception_index = EXCP_INT(index);
-            cc->tcg_ops->do_interrupt(cs);
+            avr_cpu_do_interrupt(cs);
 
             env->intsrc &= env->intsrc - 1; /* clear the interrupt */
             if (!env->intsrc) {
-- 
2.34.1

We're about to start validating PAGE_EXEC, which means that we've
got to mark page zero executable.  We had been special casing this
entirely within translate.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 34 +++++++++++++++++++++++++++++++---
 1 file changed, 31 insertions(+), 3 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ static inline void init_thread(struct target_pt_regs *regs,
     regs->gr[31] = infop->entry;
 }
 
+#define LO_COMMPAGE  0
+
+static bool init_guest_commpage(void)
+{
+    void *want = g2h_untagged(LO_COMMPAGE);
+    void *addr = mmap(want, qemu_host_page_size, PROT_NONE,
+                      MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
+
+    if (addr == MAP_FAILED) {
+        perror("Allocating guest commpage");
+        exit(EXIT_FAILURE);
+    }
+    if (addr != want) {
+        return false;
+    }
+
+    /*
+     * On Linux, page zero is normally marked execute only + gateway.
+     * Normal read or write is supposed to fail (thus PROT_NONE above),
+     * but specific offsets have kernel code mapped to raise permissions
+     * and implement syscalls.  Here, simply mark the page executable.
+     * Special case the entry points during translation (see do_page_zero).
+     */
+    page_set_flags(LO_COMMPAGE, LO_COMMPAGE + TARGET_PAGE_SIZE,
+                   PAGE_EXEC | PAGE_VALID);
+    return true;
+}
+
 #endif /* TARGET_HPPA */
 
 #ifdef TARGET_XTENSA
@@ -XXX,XX +XXX,XX @@ static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
 }
 
 #if defined(HI_COMMPAGE)
-#define LO_COMMPAGE 0
+#define LO_COMMPAGE -1
 #elif defined(LO_COMMPAGE)
 #define HI_COMMPAGE 0
 #else
 #define HI_COMMPAGE 0
-#define LO_COMMPAGE 0
+#define LO_COMMPAGE -1
 #define init_guest_commpage() true
 #endif
 
@@ -XXX,XX +XXX,XX @@ static void pgb_static(const char *image_name, abi_ulong orig_loaddr,
         } else {
             offset = -(HI_COMMPAGE & -align);
         }
-    } else if (LO_COMMPAGE != 0) {
+    } else if (LO_COMMPAGE != -1) {
         loaddr = MIN(loaddr, LO_COMMPAGE & -align);
     }
 
-- 
2.34.1

We're about to start validating PAGE_EXEC, which means that we've
got to mark the vsyscall page executable.  We had been special
casing this entirely within translate.

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *en
     (*regs)[26] = tswapreg(env->segs[R_GS].selector & 0xffff);
 }
 
+#if ULONG_MAX >= TARGET_VSYSCALL_PAGE
+#define INIT_GUEST_COMMPAGE
+static bool init_guest_commpage(void)
+{
+    /*
+     * The vsyscall page is at a high negative address aka kernel space,
+     * which means that we cannot actually allocate it with target_mmap.
+     * We still should be able to use page_set_flags, unless the user
+     * has specified -R reserved_va, which would trigger an assert().
+     */
+    if (reserved_va != 0 &&
+        TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE >= reserved_va) {
+        error_report("Cannot allocate vsyscall page");
+        exit(EXIT_FAILURE);
+    }
+    page_set_flags(TARGET_VSYSCALL_PAGE,
+                   TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE,
+                   PAGE_EXEC | PAGE_VALID);
+    return true;
+}
+#endif
 #else
 
 #define ELF_START_MMAP 0x80000000
@@ -XXX,XX +XXX,XX @@ static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
 #else
 #define HI_COMMPAGE 0
 #define LO_COMMPAGE -1
+#ifndef INIT_GUEST_COMMPAGE
 #define init_guest_commpage() true
 #endif
+#endif
 
 static void pgb_fail_in_use(const char *image_name)
 {
-- 
2.34.1

We cannot deliver two interrupts simultaneously;
the first interrupt handler must execute first.

Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/helper.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

This bit is not saved across interrupts, so we must
delay delivering the interrupt until the skip has
been processed.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1118
Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/helper.c    |  9 +++++++++
 target/avr/translate.c | 26 ++++++++++++++++++++++----
 2 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/target/avr/helper.c b/target/avr/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/helper.c
+++ b/target/avr/helper.c
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
     AVRCPU *cpu = AVR_CPU(cs);
     CPUAVRState *env = &cpu->env;
 
+    /*
+     * We cannot separate a skip from the next instruction,
+     * as the skip would not be preserved across the interrupt.
+     * Separating the two insn normally only happens at page boundaries.
+     */
+    if (env->skip) {
+        return false;
+    }
+
     if (interrupt_request & CPU_INTERRUPT_RESET) {
         if (cpu_interrupts_enabled(env)) {
             cs->exception_index = EXCP_RESET;
diff --git a/target/avr/translate.c b/target/avr/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/translate.c
+++ b/target/avr/translate.c
@@ -XXX,XX +XXX,XX @@ static void avr_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
     if (skip_label) {
         canonicalize_skip(ctx);
         gen_set_label(skip_label);
-        if (ctx->base.is_jmp == DISAS_NORETURN) {
+
+        switch (ctx->base.is_jmp) {
+        case DISAS_NORETURN:
             ctx->base.is_jmp = DISAS_CHAIN;
+            break;
+        case DISAS_NEXT:
+            if (ctx->base.tb->flags & TB_FLAGS_SKIP) {
+                ctx->base.is_jmp = DISAS_TOO_MANY;
+            }
+            break;
+        default:
+            break;
         }
     }
 
@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
 {
     DisasContext *ctx = container_of(dcbase, DisasContext, base);
     bool nonconst_skip = canonicalize_skip(ctx);
+    /*
+     * Because we disable interrupts while env->skip is set,
+     * we must return to the main loop to re-evaluate afterward.
+     */
+    bool force_exit = ctx->base.tb->flags & TB_FLAGS_SKIP;
 
     switch (ctx->base.is_jmp) {
     case DISAS_NORETURN:
@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
     case DISAS_NEXT:
     case DISAS_TOO_MANY:
     case DISAS_CHAIN:
-        if (!nonconst_skip) {
+        if (!nonconst_skip && !force_exit) {
             /* Note gen_goto_tb checks singlestep.  */
             gen_goto_tb(ctx, 1, ctx->npc);
             break;
@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
         tcg_gen_movi_tl(cpu_pc, ctx->npc);
         /* fall through */
     case DISAS_LOOKUP:
-        tcg_gen_lookup_and_goto_ptr();
-        break;
+        if (!force_exit) {
+            tcg_gen_lookup_and_goto_ptr();
+            break;
+        }
+        /* fall through */
     case DISAS_EXIT:
         tcg_gen_exit_tb(NULL, 0);
         break;
-- 
2.34.1

Map the stack executable if required by default or on demand.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/elf.h        |  1 +
 linux-user/qemu.h    |  1 +
 linux-user/elfload.c | 19 ++++++++++++++++++-
 3 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/include/elf.h b/include/elf.h
index XXXXXXX..XXXXXXX 100644
--- a/include/elf.h
+++ b/include/elf.h
@@ -XXX,XX +XXX,XX @@ typedef int64_t  Elf64_Sxword;
 #define PT_LOPROC  0x70000000
 #define PT_HIPROC  0x7fffffff
 
+#define PT_GNU_STACK      (PT_LOOS + 0x474e551)
 #define PT_GNU_PROPERTY   (PT_LOOS + 0x474e553)
 
 #define PT_MIPS_REGINFO   0x70000000
diff --git a/linux-user/qemu.h b/linux-user/qemu.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/qemu.h
+++ b/linux-user/qemu.h
@@ -XXX,XX +XXX,XX @@ struct image_info {
         uint32_t        elf_flags;
         int             personality;
         abi_ulong       alignment;
+        bool            exec_stack;
 
         /* Generic semihosting knows about these pointers. */
         abi_ulong       arg_strings;   /* strings for argv */
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)
 #define ELF_ARCH        EM_386
 
 #define ELF_PLATFORM get_elf_platform()
+#define EXSTACK_DEFAULT true
 
 static const char *get_elf_platform(void)
 {
@@ -XXX,XX +XXX,XX @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *en
 
 #define ELF_ARCH        EM_ARM
 #define ELF_CLASS       ELFCLASS32
+#define EXSTACK_DEFAULT true
 
 static inline void init_thread(struct target_pt_regs *regs,
                                struct image_info *infop)
@@ -XXX,XX +XXX,XX @@ static inline void init_thread(struct target_pt_regs *regs,
 #else
 
 #define ELF_CLASS       ELFCLASS32
+#define EXSTACK_DEFAULT true
 
 #endif
 
@@ -XXX,XX +XXX,XX @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUPPCState *en
 
 #define ELF_CLASS   ELFCLASS64
 #define ELF_ARCH    EM_LOONGARCH
+#define EXSTACK_DEFAULT true
 
 #define elf_check_arch(x) ((x) == EM_LOONGARCH)
 
@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap(void)
 #define ELF_CLASS   ELFCLASS32
 #endif
 #define ELF_ARCH    EM_MIPS
+#define EXSTACK_DEFAULT true
 
 #ifdef TARGET_ABI_MIPSN32
 #define elf_check_abi(x) ((x) & EF_MIPS_ABI2)
@@ -XXX,XX +XXX,XX @@ static inline void init_thread(struct target_pt_regs *regs,
 #define bswaptls(ptr) bswap32s(ptr)
 #endif
 
+#ifndef EXSTACK_DEFAULT
+#define EXSTACK_DEFAULT false
+#endif
+
 #include "elf.h"
 
 /* We must delay the following stanzas until after "elf.h". */
@@ -XXX,XX +XXX,XX @@ static abi_ulong setup_arg_pages(struct linux_binprm *bprm,
                                  struct image_info *info)
 {
     abi_ulong size, error, guard;
+    int prot;
 
     size = guest_stack_size;
     if (size < STACK_LOWER_LIMIT) {
@@ -XXX,XX +XXX,XX @@ static abi_ulong setup_arg_pages(struct linux_binprm *bprm,
         guard = qemu_real_host_page_size();
     }
 
-    error = target_mmap(0, size + guard, PROT_READ | PROT_WRITE,
+    prot = PROT_READ | PROT_WRITE;
+    if (info->exec_stack) {
+        prot |= PROT_EXEC;
+    }
+    error = target_mmap(0, size + guard, prot,
                         MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
     if (error == -1) {
         perror("mmap stack");
@@ -XXX,XX +XXX,XX @@ static void load_elf_image(const char *image_name, int image_fd,
      */
     loaddr = -1, hiaddr = 0;
     info->alignment = 0;
+    info->exec_stack = EXSTACK_DEFAULT;
     for (i = 0; i < ehdr->e_phnum; ++i) {
         struct elf_phdr *eppnt = phdr + i;
         if (eppnt->p_type == PT_LOAD) {
@@ -XXX,XX +XXX,XX @@ static void load_elf_image(const char *image_name, int image_fd,
             if (!parse_elf_properties(image_fd, info, eppnt, bprm_buf, &err)) {
                 goto exit_errmsg;
             }
+        } else if (eppnt->p_type == PT_GNU_STACK) {
+            info->exec_stack = eppnt->p_flags & PF_X;
         }
     }
 
-- 
2.34.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

Introduce a function that checks whether a given address is on the same
page as where disassembly started. Having it improves readability of
the following patches.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20220811095534.241224-3-iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
[rth: Make the DisasContextBase parameter const.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/translator.h | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/include/exec/translator.h b/include/exec/translator.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/translator.h
+++ b/include/exec/translator.h
@@ -XXX,XX +XXX,XX @@ FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
 
 #undef GEN_TRANSLATOR_LD
 
+/*
+ * Return whether addr is on the same page as where disassembly started.
+ * Translators can use this to enforce the rule that only single-insn
+ * translation blocks are allowed to cross page boundaries.
+ */
+static inline bool is_same_page(const DisasContextBase *db, target_ulong addr)
+{
+    return ((addr ^ db->pc_first) & TARGET_PAGE_MASK) == 0;
+}
+
 #endif /* EXEC__TRANSLATOR_H */
-- 
2.34.1

The current implementation is a no-op, simply returning addr.
This is incorrect, because we ought to be checking the page
permissions for execution.

Make get_page_addr_code inline for both implementations.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/exec-all.h | 85 ++++++++++++++---------------------------
 accel/tcg/cputlb.c      |  5 ---
 accel/tcg/user-exec.c   | 14 +++++++
 3 files changed, 42 insertions(+), 62 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ struct MemoryRegionSection *iotlb_to_section(CPUState *cpu,
                                              hwaddr index, MemTxAttrs attrs);
 #endif
 
-#if defined(CONFIG_USER_ONLY)
-void mmap_lock(void);
-void mmap_unlock(void);
-bool have_mmap_lock(void);
-
 /**
- * get_page_addr_code() - user-mode version
+ * get_page_addr_code_hostp()
  * @env: CPUArchState
  * @addr: guest virtual address of guest code
  *
- * Returns @addr.
+ * See get_page_addr_code() (full-system version) for documentation on the
+ * return value.
+ *
+ * Sets *@hostp (when @hostp is non-NULL) as follows.
+ * If the return value is -1, sets *@hostp to NULL. Otherwise, sets *@hostp
+ * to the host address where @addr's content is kept.
+ *
+ * Note: this function can trigger an exception.
+ */
+tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
+                                        void **hostp);
+
+/**
+ * get_page_addr_code()
+ * @env: CPUArchState
+ * @addr: guest virtual address of guest code
+ *
+ * If we cannot translate and execute from the entire RAM page, or if
+ * the region is not backed by RAM, returns -1. Otherwise, returns the
+ * ram_addr_t corresponding to the guest code at @addr.
+ *
+ * Note: this function can trigger an exception.
  */
 static inline tb_page_addr_t get_page_addr_code(CPUArchState *env,
                                                 target_ulong addr)
 {
-    return addr;
+    return get_page_addr_code_hostp(env, addr, NULL);
 }
 
-/**
- * get_page_addr_code_hostp() - user-mode version
- * @env: CPUArchState
- * @addr: guest virtual address of guest code
- *
- * Returns @addr.
- *
- * If @hostp is non-NULL, sets *@hostp to the host address where @addr's content
- * is kept.
- */
-static inline tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env,
-                                                      target_ulong addr,
-                                                      void **hostp)
-{
-    if (hostp) {
-        *hostp = g2h_untagged(addr);
-    }
-    return addr;
-}
+#if defined(CONFIG_USER_ONLY)
+void mmap_lock(void);
+void mmap_unlock(void);
+bool have_mmap_lock(void);
 
 /**
  * adjust_signal_pc:
@@ -XXX,XX +XXX,XX @@ G_NORETURN void cpu_loop_exit_sigbus(CPUState *cpu, target_ulong addr,
 static inline void mmap_lock(void) {}
 static inline void mmap_unlock(void) {}
 
-/**
- * get_page_addr_code() - full-system version
- * @env: CPUArchState
- * @addr: guest virtual address of guest code
- *
- * If we cannot translate and execute from the entire RAM page, or if
- * the region is not backed by RAM, returns -1. Otherwise, returns the
- * ram_addr_t corresponding to the guest code at @addr.
- *
- * Note: this function can trigger an exception.
- */
-tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr);
-
-/**
- * get_page_addr_code_hostp() - full-system version
- * @env: CPUArchState
- * @addr: guest virtual address of guest code
- *
- * See get_page_addr_code() (full-system version) for documentation on the
- * return value.
- *
- * Sets *@hostp (when @hostp is non-NULL) as follows.
- * If the return value is -1, sets *@hostp to NULL. Otherwise, sets *@hostp
- * to the host address where @addr's content is kept.
- *
- * Note: this function can trigger an exception.
- */
-tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
-                                        void **hostp);
-
 void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length);
 void tlb_set_dirty(CPUState *cpu, target_ulong vaddr);
 
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
     return qemu_ram_addr_from_host_nofail(p);
 }
 
-tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr)
-{
-    return get_page_addr_code_hostp(env, addr, NULL);
-}
-
 static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
                            CPUIOTLBEntry *iotlbentry, uintptr_t retaddr)
 {
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
     return size ? g2h(env_cpu(env), addr) : NULL;
 }
 
+tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
+                                        void **hostp)
+{
+    int flags;
+
+    flags = probe_access_internal(env, addr, 1, MMU_INST_FETCH, false, 0);
+    g_assert(flags == 0);
+
+    if (hostp) {
+        *hostp = g2h_untagged(addr);
+    }
+    return addr;
+}
+
 /* The softmmu versions of these helpers are in cputlb.c.  */
 
 /*
-- 
2.34.1

The mmap_lock is held around tb_gen_code.  While the comment
is correct that the lock is dropped when tb_gen_code runs out
of memory, the lock is *not* dropped when an exception is
raised reading code for translation.

Acked-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c  | 12 ++++++------
 accel/tcg/user-exec.c |  3 ---
 2 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ void cpu_exec_step_atomic(CPUState *cpu)
         cpu_tb_exec(cpu, tb, &tb_exit);
         cpu_exec_exit(cpu);
     } else {
-        /*
-         * The mmap_lock is dropped by tb_gen_code if it runs out of
-         * memory.
-         */
 #ifndef CONFIG_SOFTMMU
         clear_helper_retaddr();
-        tcg_debug_assert(!have_mmap_lock());
+        if (have_mmap_lock()) {
+            mmap_unlock();
+        }
 #endif
         if (qemu_mutex_iothread_locked()) {
             qemu_mutex_unlock_iothread();
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
 
 #ifndef CONFIG_SOFTMMU
         clear_helper_retaddr();
-        tcg_debug_assert(!have_mmap_lock());
+        if (have_mmap_lock()) {
+            mmap_unlock();
+        }
 #endif
         if (qemu_mutex_iothread_locked()) {
             qemu_mutex_unlock_iothread();
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ MMUAccessType adjust_signal_pc(uintptr_t *pc, bool is_write)
          * (and if the translator doesn't handle page boundaries correctly
          * there's little we can do about that here).  Therefore, do not
          * trigger the unwinder.
-         *
-         * Like tb_gen_code, release the memory lock before cpu_loop_exit.
          */
-        mmap_unlock();
         *pc = 0;
         return MMU_INST_FETCH;
     }
-- 
2.34.1

The function is not used outside of cpu-exec.c.  Move it and
its subroutines up in the file, before the first use.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/exec-all.h |   3 -
 accel/tcg/cpu-exec.c    | 122 ++++++++++++++++++++--------------------
 2 files changed, 61 insertions(+), 64 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs);
 #endif
 void tb_flush(CPUState *cpu);
 void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr);
-TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
-                                   target_ulong cs_base, uint32_t flags,
-                                   uint32_t cflags);
 void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr);
 
 /* GETPC is the true target of the return instruction that we'll execute.  */
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ uint32_t curr_cflags(CPUState *cpu)
     return cflags;
 }
 
+struct tb_desc {
+    target_ulong pc;
+    target_ulong cs_base;
+    CPUArchState *env;
+    tb_page_addr_t phys_page1;
+    uint32_t flags;
+    uint32_t cflags;
+    uint32_t trace_vcpu_dstate;
+};
+
+static bool tb_lookup_cmp(const void *p, const void *d)
+{
+    const TranslationBlock *tb = p;
+    const struct tb_desc *desc = d;
+
+    if (tb->pc == desc->pc &&
+        tb->page_addr[0] == desc->phys_page1 &&
+        tb->cs_base == desc->cs_base &&
+        tb->flags == desc->flags &&
+        tb->trace_vcpu_dstate == desc->trace_vcpu_dstate &&
+        tb_cflags(tb) == desc->cflags) {
+        /* check next page if needed */
+        if (tb->page_addr[1] == -1) {
+            return true;
+        } else {
+            tb_page_addr_t phys_page2;
+            target_ulong virt_page2;
+
+            virt_page2 = (desc->pc & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
+            phys_page2 = get_page_addr_code(desc->env, virt_page2);
+            if (tb->page_addr[1] == phys_page2) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+
+static TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
+                                          target_ulong cs_base, uint32_t flags,
+                                          uint32_t cflags)
+{
+    tb_page_addr_t phys_pc;
+    struct tb_desc desc;
+    uint32_t h;
+
+    desc.env = cpu->env_ptr;
+    desc.cs_base = cs_base;
+    desc.flags = flags;
+    desc.cflags = cflags;
+    desc.trace_vcpu_dstate = *cpu->trace_dstate;
+    desc.pc = pc;
+    phys_pc = get_page_addr_code(desc.env, pc);
+    if (phys_pc == -1) {
+        return NULL;
+    }
+    desc.phys_page1 = phys_pc & TARGET_PAGE_MASK;
+    h = tb_hash_func(phys_pc, pc, flags, cflags, *cpu->trace_dstate);
+    return qht_lookup_custom(&tb_ctx.htable, &desc, h, tb_lookup_cmp);
+}
+
 /* Might cause an exception, so have a longjmp destination ready */
 static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
                                           target_ulong cs_base,
@@ -XXX,XX +XXX,XX @@ void cpu_exec_step_atomic(CPUState *cpu)
     end_exclusive();
 }
 
-struct tb_desc {
-    target_ulong pc;
-    target_ulong cs_base;
-    CPUArchState *env;
-    tb_page_addr_t phys_page1;
-    uint32_t flags;
-    uint32_t cflags;
-    uint32_t trace_vcpu_dstate;
-};
-
-static bool tb_lookup_cmp(const void *p, const void *d)
-{
-    const TranslationBlock *tb = p;
-    const struct tb_desc *desc = d;
-
-    if (tb->pc == desc->pc &&
-        tb->page_addr[0] == desc->phys_page1 &&
-        tb->cs_base == desc->cs_base &&
-        tb->flags == desc->flags &&
-        tb->trace_vcpu_dstate == desc->trace_vcpu_dstate &&
-        tb_cflags(tb) == desc->cflags) {
-        /* check next page if needed */
-        if (tb->page_addr[1] == -1) {
-            return true;
-        } else {
-            tb_page_addr_t phys_page2;
-            target_ulong virt_page2;
-
-            virt_page2 = (desc->pc & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
-            phys_page2 = get_page_addr_code(desc->env, virt_page2);
-            if (tb->page_addr[1] == phys_page2) {
-                return true;
-            }
-        }
-    }
-    return false;
-}
-
-TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
-                                   target_ulong cs_base, uint32_t flags,
-                                   uint32_t cflags)
-{
-    tb_page_addr_t phys_pc;
-    struct tb_desc desc;
-    uint32_t h;
-
-    desc.env = cpu->env_ptr;
-    desc.cs_base = cs_base;
-    desc.flags = flags;
-    desc.cflags = cflags;
-    desc.trace_vcpu_dstate = *cpu->trace_dstate;
-    desc.pc = pc;
-    phys_pc = get_page_addr_code(desc.env, pc);
-    if (phys_pc == -1) {
-        return NULL;
-    }
-    desc.phys_page1 = phys_pc & TARGET_PAGE_MASK;
-    h = tb_hash_func(phys_pc, pc, flags, cflags, *cpu->trace_dstate);
-    return qht_lookup_custom(&tb_ctx.htable, &desc, h, tb_lookup_cmp);
-}
-
 void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr)
 {
     if (TCG_TARGET_HAS_direct_jump) {
-- 
2.34.1

The base qemu_ram_addr_from_host function is already in
softmmu/physmem.c; move the nofail version to be adjacent.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-common.h |  1 +
 accel/tcg/cputlb.c        | 12 ------------
 softmmu/physmem.c         | 12 ++++++++++++
 3 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -XXX,XX +XXX,XX @@ typedef uintptr_t ram_addr_t;
 void qemu_ram_remap(ram_addr_t addr, ram_addr_t length);
 /* This should not be used by devices.  */
 ram_addr_t qemu_ram_addr_from_host(void *ptr);
+ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr);
 RAMBlock *qemu_ram_block_by_name(const char *name);
 RAMBlock *qemu_ram_block_from_host(void *ptr, bool round_offset,
                                    ram_addr_t *offset);
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ void tlb_set_page(CPUState *cpu, target_ulong vaddr,
                             prot, mmu_idx, size);
 }
 
-static inline ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr)
-{
-    ram_addr_t ram_addr;
-
-    ram_addr = qemu_ram_addr_from_host(ptr);
-    if (ram_addr == RAM_ADDR_INVALID) {
-        error_report("Bad ram pointer %p", ptr);
-        abort();
-    }
-    return ram_addr;
-}
-
 /*
  * Note: tlb_fill() can trigger a resize of the TLB. This means that all of the
  * caller's prior references to the TLB table (e.g. CPUTLBEntry pointers) must
diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -XXX,XX +XXX,XX @@ ram_addr_t qemu_ram_addr_from_host(void *ptr)
     return block->offset + offset;
 }
 
+ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr)
+{
+    ram_addr_t ram_addr;
+
+    ram_addr = qemu_ram_addr_from_host(ptr);
+    if (ram_addr == RAM_ADDR_INVALID) {
+        error_report("Bad ram pointer %p", ptr);
+        abort();
+    }
+    return ram_addr;
+}
+
 static MemTxResult flatview_read(FlatView *fv, hwaddr addr,
                                  MemTxAttrs attrs, void *buf, hwaddr len);
 static MemTxResult flatview_write(FlatView *fv, hwaddr addr, MemTxAttrs attrs,
-- 
2.34.1

Simplify the implementation of get_page_addr_code_hostp
by reusing the existing probe_access infrastructure.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 76 ++++++++++++++++------------------------------
 1 file changed, 26 insertions(+), 50 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static bool victim_tlb_hit(CPUArchState *env, size_t mmu_idx, size_t index,
   victim_tlb_hit(env, mmu_idx, index, offsetof(CPUTLBEntry, TY), \
                  (ADDR) & TARGET_PAGE_MASK)
 
-/*
- * Return a ram_addr_t for the virtual address for execution.
- *
- * Return -1 if we can't translate and execute from an entire page
- * of RAM.  This will force us to execute by loading and translating
- * one insn at a time, without caching.
- *
- * NOTE: This function will trigger an exception if the page is
- * not executable.
- */
-tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
-                                        void **hostp)
-{
-    uintptr_t mmu_idx = cpu_mmu_index(env, true);
-    uintptr_t index = tlb_index(env, mmu_idx, addr);
-    CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
-    void *p;
-
-    if (unlikely(!tlb_hit(entry->addr_code, addr))) {
-        if (!VICTIM_TLB_HIT(addr_code, addr)) {
-            tlb_fill(env_cpu(env), addr, 0, MMU_INST_FETCH, mmu_idx, 0);
-            index = tlb_index(env, mmu_idx, addr);
-            entry = tlb_entry(env, mmu_idx, addr);
-
-            if (unlikely(entry->addr_code & TLB_INVALID_MASK)) {
-                /*
-                 * The MMU protection covers a smaller range than a target
-                 * page, so we must redo the MMU check for every insn.
-                 */
-                return -1;
-            }
-        }
-        assert(tlb_hit(entry->addr_code, addr));
-    }
-
-    if (unlikely(entry->addr_code & TLB_MMIO)) {
-        /* The region is not backed by RAM.  */
-        if (hostp) {
-            *hostp = NULL;
-        }
-        return -1;
-    }
-
-    p = (void *)((uintptr_t)addr + entry->addend);
-    if (hostp) {
-        *hostp = p;
-    }
-    return qemu_ram_addr_from_host_nofail(p);
-}
-
 static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
                            CPUIOTLBEntry *iotlbentry, uintptr_t retaddr)
 {
@@ -XXX,XX +XXX,XX @@ void *tlb_vaddr_to_host(CPUArchState *env, abi_ptr addr,
     return flags ? NULL : host;
 }
 
+/*
+ * Return a ram_addr_t for the virtual address for execution.
+ *
+ * Return -1 if we can't translate and execute from an entire page
+ * of RAM.  This will force us to execute by loading and translating
+ * one insn at a time, without caching.
+ *
+ * NOTE: This function will trigger an exception if the page is
+ * not executable.
+ */
+tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
+                                        void **hostp)
+{
+    void *p;
+
+    (void)probe_access_internal(env, addr, 1, MMU_INST_FETCH,
+                                cpu_mmu_index(env, true), false, &p, 0);
+    if (p == NULL) {
+        return -1;
+    }
+    if (hostp) {
+        *hostp = p;
+    }
+    return qemu_ram_addr_from_host_nofail(p);
+}
+
 #ifdef CONFIG_PLUGIN
 /*
  * Perform a TLB lookup and populate the qemu_plugin_hwaddr structure.
-- 
2.34.1

It was non-obvious to me why we can raise an exception in
the middle of a comparison function, but it works.
While nearby, use TARGET_PAGE_ALIGN instead of open-coding.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static bool tb_lookup_cmp(const void *p, const void *d)
             tb_page_addr_t phys_page2;
             target_ulong virt_page2;
 
-            virt_page2 = (desc->pc & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
+            /*
+             * We know that the first page matched, and an otherwise valid TB
+             * encountered an incomplete instruction at the end of that page,
+             * therefore we know that generating a new TB from the current PC
+             * must also require reading from the next page -- even if the
+             * second pages do not match, and therefore the resulting insn
+             * is different for the new TB.  Therefore any exception raised
+             * here by the faulting lookup is not premature.
+             */
+            virt_page2 = TARGET_PAGE_ALIGN(desc->pc);
             phys_page2 = get_page_addr_code(desc->env, virt_page2);
             if (tb->page_addr[1] == phys_page2) {
                 return true;
-- 
2.34.1

The only user can easily use translator_lduw and
adjust the type to signed during the return.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/translator.h   | 1 -
 target/i386/tcg/translate.c | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/include/exec/translator.h b/include/exec/translator.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/translator.h
+++ b/include/exec/translator.h
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
 
 #define FOR_EACH_TRANSLATOR_LD(F)                                       \
     F(translator_ldub, uint8_t, cpu_ldub_code, /* no swap */)           \
-    F(translator_ldsw, int16_t, cpu_ldsw_code, bswap16)                 \
     F(translator_lduw, uint16_t, cpu_lduw_code, bswap16)                \
     F(translator_ldl, uint32_t, cpu_ldl_code, bswap32)                  \
     F(translator_ldq, uint64_t, cpu_ldq_code, bswap64)
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static inline uint8_t x86_ldub_code(CPUX86State *env, DisasContext *s)
 
 static inline int16_t x86_ldsw_code(CPUX86State *env, DisasContext *s)
 {
-    return translator_ldsw(env, &s->base, advance_pc(env, s, 2));
+    return translator_lduw(env, &s->base, advance_pc(env, s, 2));
 }
 
 static inline uint16_t x86_lduw_code(CPUX86State *env, DisasContext *s)
-- 
2.34.1

Pass these along to translator_loop -- pc may be used instead
of tb->pc, and host_pc is currently unused.  Adjust all targets
at one time.

Acked-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/exec-all.h       |  1 -
 include/exec/translator.h     | 24 ++++++++++++++++++++----
 accel/tcg/translate-all.c     |  6 ++++--
 accel/tcg/translator.c        |  9 +++++----
 target/alpha/translate.c      |  5 +++--
 target/arm/translate.c        |  5 +++--
 target/avr/translate.c        |  5 +++--
 target/cris/translate.c       |  5 +++--
 target/hexagon/translate.c    |  6 ++++--
 target/hppa/translate.c       |  5 +++--
 target/i386/tcg/translate.c   |  5 +++--
 target/loongarch/translate.c  |  6 ++++--
 target/m68k/translate.c       |  5 +++--
 target/microblaze/translate.c |  5 +++--
 target/mips/tcg/translate.c   |  5 +++--
 target/nios2/translate.c      |  5 +++--
 target/openrisc/translate.c   |  6 ++++--
 target/ppc/translate.c        |  5 +++--
 target/riscv/translate.c      |  5 +++--
 target/rx/translate.c         |  5 +++--
 target/s390x/tcg/translate.c  |  5 +++--
 target/sh4/translate.c        |  5 +++--
 target/sparc/translate.c      |  5 +++--
 target/tricore/translate.c    |  6 ++++--
 target/xtensa/translate.c     |  6 ++++--
 25 files changed, 97 insertions(+), 53 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ typedef ram_addr_t tb_page_addr_t;
 #define TB_PAGE_ADDR_FMT RAM_ADDR_FMT
 #endif
 
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns);
 void restore_state_to_opc(CPUArchState *env, TranslationBlock *tb,
                           target_ulong *data);
 
diff --git a/include/exec/translator.h b/include/exec/translator.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/translator.h
+++ b/include/exec/translator.h
@@ -XXX,XX +XXX,XX @@
 #include "exec/translate-all.h"
 #include "tcg/tcg.h"
 
+/**
+ * gen_intermediate_code
+ * @cpu: cpu context
+ * @tb: translation block
+ * @max_insns: max number of instructions to translate
+ * @pc: guest virtual program counter address
+ * @host_pc: host physical program counter address
+ *
+ * This function must be provided by the target, which should create
+ * the target-specific DisasContext, and then invoke translator_loop.
+ */
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc);
 
 /**
  * DisasJumpType:
@@ -XXX,XX +XXX,XX @@ typedef struct TranslatorOps {
 
 /**
  * translator_loop:
- * @ops: Target-specific operations.
- * @db: Disassembly context.
  * @cpu: Target vCPU.
  * @tb: Translation block.
  * @max_insns: Maximum number of insns to translate.
+ * @pc: guest virtual program counter address
+ * @host_pc: host physical program counter address
+ * @ops: Target-specific operations.
+ * @db: Disassembly context.
  *
  * Generic translator loop.
  *
@@ -XXX,XX +XXX,XX @@ typedef struct TranslatorOps {
  * - When single-stepping is enabled (system-wide or on the current vCPU).
  * - When too many instructions have been translated.
  */
-void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
-                     CPUState *cpu, TranslationBlock *tb, int max_insns);
+void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                     target_ulong pc, void *host_pc,
+                     const TranslatorOps *ops, DisasContextBase *db);
 
 void translator_loop_temp_check(DisasContextBase *db);
 
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@
 
 #include "exec/cputlb.h"
 #include "exec/translate-all.h"
+#include "exec/translator.h"
 #include "qemu/bitmap.h"
 #include "qemu/qemu-print.h"
 #include "qemu/timer.h"
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     TCGProfile *prof = &tcg_ctx->prof;
     int64_t ti;
 #endif
+    void *host_pc;
 
     assert_memory_lock();
     qemu_thread_jit_write();
 
-    phys_pc = get_page_addr_code(env, pc);
+    phys_pc = get_page_addr_code_hostp(env, pc, &host_pc);
 
     if (phys_pc == -1) {
         /* Generate a one-shot TB with 1 insn in it */
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     tcg_func_start(tcg_ctx);
 
     tcg_ctx->cpu = env_cpu(env);
-    gen_intermediate_code(cpu, tb, max_insns);
+    gen_intermediate_code(cpu, tb, max_insns, pc, host_pc);
     assert(tb->size != 0);
     tcg_ctx->cpu = NULL;
     max_insns = tb->icount;
diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translator.c
+++ b/accel/tcg/translator.c
@@ -XXX,XX +XXX,XX @@ static inline void translator_page_protect(DisasContextBase *dcbase,
 #endif
 }
 
-void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
-                     CPUState *cpu, TranslationBlock *tb, int max_insns)
+void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                     target_ulong pc, void *host_pc,
+                     const TranslatorOps *ops, DisasContextBase *db)
 {
     uint32_t cflags = tb_cflags(tb);
     bool plugin_enabled;
 
     /* Initialize DisasContext */
     db->tb = tb;
-    db->pc_first = tb->pc;
-    db->pc_next = db->pc_first;
+    db->pc_first = pc;
+    db->pc_next = pc;
     db->is_jmp = DISAS_NEXT;
     db->num_insns = 0;
     db->max_insns = max_insns;
diff --git a/target/alpha/translate.c b/target/alpha/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/translate.c
+++ b/target/alpha/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps alpha_tr_ops = {
     .disas_log          = alpha_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
-    translator_loop(&alpha_tr_ops, &dc.base, cpu, tb, max_insns);
+    translator_loop(cpu, tb, max_insns, pc, host_pc, &alpha_tr_ops, &dc.base);
 }
 
 void restore_state_to_opc(CPUAlphaState *env, TranslationBlock *tb,
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps thumb_translator_ops = {
 };
 
 /* generate intermediate code for basic block 'tb'.  */
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc = { };
     const TranslatorOps *ops = &arm_translator_ops;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
     }
 #endif
 
-    translator_loop(ops, &dc.base, cpu, tb, max_insns);
+    translator_loop(cpu, tb, max_insns, pc, host_pc, ops, &dc.base);
 }
 
 void restore_state_to_opc(CPUARMState *env, TranslationBlock *tb,
diff --git a/target/avr/translate.c b/target/avr/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/translate.c
+++ b/target/avr/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps avr_tr_ops = {
     .disas_log          = avr_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc = { };
-    translator_loop(&avr_tr_ops, &dc.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &avr_tr_ops, &dc.base);
 }
 
 void restore_state_to_opc(CPUAVRState *env, TranslationBlock *tb,
diff --git a/target/cris/translate.c b/target/cris/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/translate.c
+++ b/target/cris/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps cris_tr_ops = {
     .disas_log          = cris_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
-    translator_loop(&cris_tr_ops, &dc.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &cris_tr_ops, &dc.base);
 }
 
 void cris_cpu_dump_state(CPUState *cs, FILE *f, int flags)
diff --git a/target/hexagon/translate.c b/target/hexagon/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/translate.c
+++ b/target/hexagon/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps hexagon_tr_ops = {
     .disas_log          = hexagon_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
 
-    translator_loop(&hexagon_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc,
+                    &hexagon_tr_ops, &ctx.base);
 }
 
 #define NAME_LEN               64
diff --git a/target/hppa/translate.c b/target/hppa/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/translate.c
+++ b/target/hppa/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps hppa_tr_ops = {
     .disas_log          = hppa_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
-    translator_loop(&hppa_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &hppa_tr_ops, &ctx.base);
 }
 
 void restore_state_to_opc(CPUHPPAState *env, TranslationBlock *tb,
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps i386_tr_ops = {
 };
 
 /* generate intermediate code for basic block 'tb'.  */
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
 
-    translator_loop(&i386_tr_ops, &dc.base, cpu, tb, max_insns);
+    translator_loop(cpu, tb, max_insns, pc, host_pc, &i386_tr_ops, &dc.base);
 }
 
 void restore_state_to_opc(CPUX86State *env, TranslationBlock *tb,
diff --git a/target/loongarch/translate.c b/target/loongarch/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/translate.c
+++ b/target/loongarch/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps loongarch_tr_ops = {
     .disas_log          = loongarch_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
 
-    translator_loop(&loongarch_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc,
+                    &loongarch_tr_ops, &ctx.base);
 }
 
 void loongarch_translate_init(void)
diff --git a/target/m68k/translate.c b/target/m68k/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/translate.c
+++ b/target/m68k/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps m68k_tr_ops = {
     .disas_log          = m68k_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
-    translator_loop(&m68k_tr_ops, &dc.base, cpu, tb, max_insns);
+    translator_loop(cpu, tb, max_insns, pc, host_pc, &m68k_tr_ops, &dc.base);
 }
 
 static double floatx80_to_double(CPUM68KState *env, uint16_t high, uint64_t low)
diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps mb_tr_ops = {
     .disas_log          = mb_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
-    translator_loop(&mb_tr_ops, &dc.base, cpu, tb, max_insns);
+    translator_loop(cpu, tb, max_insns, pc, host_pc, &mb_tr_ops, &dc.base);
 }
 
 void mb_cpu_dump_state(CPUState *cs, FILE *f, int flags)
diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/translate.c
+++ b/target/mips/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps mips_tr_ops = {
     .disas_log          = mips_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
 
-    translator_loop(&mips_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &mips_tr_ops, &ctx.base);
 }
 
 void mips_tcg_init(void)
diff --git a/target/nios2/translate.c b/target/nios2/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/translate.c
+++ b/target/nios2/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps nios2_tr_ops = {
     .disas_log          = nios2_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
-    translator_loop(&nios2_tr_ops, &dc.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &nios2_tr_ops, &dc.base);
 }
 
 void nios2_cpu_dump_state(CPUState *cs, FILE *f, int flags)
diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/translate.c
+++ b/target/openrisc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps openrisc_tr_ops = {
     .disas_log          = openrisc_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
 
-    translator_loop(&openrisc_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc,
+                    &openrisc_tr_ops, &ctx.base);
 }
 
 void openrisc_cpu_dump_state(CPUState *cs, FILE *f, int flags)
diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps ppc_tr_ops = {
     .disas_log          = ppc_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
 
-    translator_loop(&ppc_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &ppc_tr_ops, &ctx.base);
 }
 
 void restore_state_to_opc(CPUPPCState *env, TranslationBlock *tb,
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps riscv_tr_ops = {
     .disas_log          = riscv_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
 
-    translator_loop(&riscv_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &riscv_tr_ops, &ctx.base);
 }
 
 void riscv_translate_init(void)
diff --git a/target/rx/translate.c b/target/rx/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/translate.c
+++ b/target/rx/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps rx_tr_ops = {
     .disas_log          = rx_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
 
-    translator_loop(&rx_tr_ops, &dc.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &rx_tr_ops, &dc.base);
 }
 
 void restore_state_to_opc(CPURXState *env, TranslationBlock *tb,
diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps s390x_tr_ops = {
     .disas_log          = s390x_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
 
-    translator_loop(&s390x_tr_ops, &dc.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &s390x_tr_ops, &dc.base);
 }
 
 void restore_state_to_opc(CPUS390XState *env, TranslationBlock *tb,
diff --git a/target/sh4/translate.c b/target/sh4/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/translate.c
+++ b/target/sh4/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps sh4_tr_ops = {
     .disas_log          = sh4_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
 
-    translator_loop(&sh4_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &sh4_tr_ops, &ctx.base);
 }
 
 void restore_state_to_opc(CPUSH4State *env, TranslationBlock *tb,
diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps sparc_tr_ops = {
     .disas_log          = sparc_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc = {};
 
-    translator_loop(&sparc_tr_ops, &dc.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &sparc_tr_ops, &dc.base);
 }
 
 void sparc_tcg_init(void)
diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps tricore_tr_ops = {
 };
 
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
-    translator_loop(&tricore_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc,
+                    &tricore_tr_ops, &ctx.base);
 }
 
 void
diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/translate.c
+++ b/target/xtensa/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps xtensa_translator_ops = {
     .disas_log          = xtensa_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc = {};
-    translator_loop(&xtensa_translator_ops, &dc.base, cpu, tb, max_insns);
+    translator_loop(cpu, tb, max_insns, pc, host_pc,
+                    &xtensa_translator_ops, &dc.base);
 }
 
 void xtensa_cpu_dump_state(CPUState *cs, FILE *f, int flags)
-- 
2.34.1

Cache the translation from guest to host address, so we may
use direct loads when we hit on the primary translation page.

Look up the second translation page only once, during translation.
This obviates another lookup of the second page within tb_gen_code
after translation.

Fixes a bug in that plugin_insn_append should be passed the bytes
in the original memory order, not bswapped by pieces.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/translator.h |  63 +++++++++++--------
 accel/tcg/translate-all.c |  23 +++----
 accel/tcg/translator.c    | 126 +++++++++++++++++++++++++++++---------
 3 files changed, 141 insertions(+), 71 deletions(-)

diff --git a/include/exec/translator.h b/include/exec/translator.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/translator.h
+++ b/include/exec/translator.h
@@ -XXX,XX +XXX,XX @@ typedef enum DisasJumpType {
  * Architecture-agnostic disassembly context.
  */
 typedef struct DisasContextBase {
-    const TranslationBlock *tb;
+    TranslationBlock *tb;
     target_ulong pc_first;
     target_ulong pc_next;
     DisasJumpType is_jmp;
     int num_insns;
     int max_insns;
     bool singlestep_enabled;
-#ifdef CONFIG_USER_ONLY
-    /*
-     * Guest address of the last byte of the last protected page.
-     *
-     * Pages containing the translated instructions are made non-writable in
-     * order to achieve consistency in case another thread is modifying the
-     * code while translate_insn() fetches the instruction bytes piecemeal.
-     * Such writer threads are blocked on mmap_lock() in page_unprotect().
-     */
-    target_ulong page_protect_end;
-#endif
+    void *host_addr[2];
 } DisasContextBase;
 
 /**
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
  * the relevant information at translation time.
  */
 
-#define GEN_TRANSLATOR_LD(fullname, type, load_fn, swap_fn)             \
-    type fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase, \
-                           abi_ptr pc, bool do_swap);                   \
-    static inline type fullname(CPUArchState *env,                      \
-                                DisasContextBase *dcbase, abi_ptr pc)   \
-    {                                                                   \
-        return fullname ## _swap(env, dcbase, pc, false);               \
+uint8_t translator_ldub(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
+uint16_t translator_lduw(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
+uint32_t translator_ldl(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
+uint64_t translator_ldq(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
+
+static inline uint16_t
+translator_lduw_swap(CPUArchState *env, DisasContextBase *db,
+                     abi_ptr pc, bool do_swap)
+{
+    uint16_t ret = translator_lduw(env, db, pc);
+    if (do_swap) {
+        ret = bswap16(ret);
     }
+    return ret;
+}
 
-#define FOR_EACH_TRANSLATOR_LD(F)                                       \
-    F(translator_ldub, uint8_t, cpu_ldub_code, /* no swap */)           \
-    F(translator_lduw, uint16_t, cpu_lduw_code, bswap16)                \
-    F(translator_ldl, uint32_t, cpu_ldl_code, bswap32)                  \
-    F(translator_ldq, uint64_t, cpu_ldq_code, bswap64)
+static inline uint32_t
+translator_ldl_swap(CPUArchState *env, DisasContextBase *db,
+                    abi_ptr pc, bool do_swap)
+{
+    uint32_t ret = translator_ldl(env, db, pc);
+    if (do_swap) {
+        ret = bswap32(ret);
+    }
+    return ret;
+}
 
-FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
-
-#undef GEN_TRANSLATOR_LD
+static inline uint64_t
+translator_ldq_swap(CPUArchState *env, DisasContextBase *db,
+                    abi_ptr pc, bool do_swap)
+{
+    uint64_t ret = translator_ldq_swap(env, db, pc, false);
+    if (do_swap) {
+        ret = bswap64(ret);
+    }
+    return ret;
+}
 
 /*
  * Return whether addr is on the same page as where disassembly started.
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
 {
     CPUArchState *env = cpu->env_ptr;
     TranslationBlock *tb, *existing_tb;
-    tb_page_addr_t phys_pc, phys_page2;
-    target_ulong virt_page2;
+    tb_page_addr_t phys_pc;
     tcg_insn_unit *gen_code_buf;
     int gen_code_size, search_size, max_insns;
 #ifdef CONFIG_PROFILER
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     tb->flags = flags;
     tb->cflags = cflags;
     tb->trace_vcpu_dstate = *cpu->trace_dstate;
+    tb->page_addr[0] = phys_pc;
+    tb->page_addr[1] = -1;
     tcg_ctx->tb_cflags = cflags;
  tb_overflow:
 
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     }
 
     /*
-     * If the TB is not associated with a physical RAM page then
-     * it must be a temporary one-insn TB, and we have nothing to do
-     * except fill in the page_addr[] fields. Return early before
-     * attempting to link to other TBs or add to the lookup table.
+     * If the TB is not associated with a physical RAM page then it must be
+     * a temporary one-insn TB, and we have nothing left to do. Return early
+     * before attempting to link to other TBs or add to the lookup table.
      */
-    if (phys_pc == -1) {
-        tb->page_addr[0] = tb->page_addr[1] = -1;
+    if (tb->page_addr[0] == -1) {
         return tb;
     }
 
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
      */
     tcg_tb_insert(tb);
 
-    /* check next page if needed */
-    virt_page2 = (pc + tb->size - 1) & TARGET_PAGE_MASK;
-    phys_page2 = -1;
-    if ((pc & TARGET_PAGE_MASK) != virt_page2) {
-        phys_page2 = get_page_addr_code(env, virt_page2);
-    }
     /*
      * No explicit memory barrier is required -- tb_link_page() makes the
      * TB visible in a consistent state.
      */
-    existing_tb = tb_link_page(tb, phys_pc, phys_page2);
+    existing_tb = tb_link_page(tb, tb->page_addr[0], tb->page_addr[1]);
     /* if the TB already exists, discard what we just translated */
     if (unlikely(existing_tb != tb)) {
         uintptr_t orig_aligned = (uintptr_t)gen_code_buf;
diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translator.c
+++ b/accel/tcg/translator.c
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest)
     return ((db->pc_first ^ dest) & TARGET_PAGE_MASK) == 0;
 }
 
-static inline void translator_page_protect(DisasContextBase *dcbase,
-                                           target_ulong pc)
-{
-#ifdef CONFIG_USER_ONLY
-    dcbase->page_protect_end = pc | ~TARGET_PAGE_MASK;
-    page_protect(pc);
-#endif
-}
-
 void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
                      target_ulong pc, void *host_pc,
                      const TranslatorOps *ops, DisasContextBase *db)
@@ -XXX,XX +XXX,XX @@ void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
     db->num_insns = 0;
     db->max_insns = max_insns;
     db->singlestep_enabled = cflags & CF_SINGLE_STEP;
-    translator_page_protect(db, db->pc_next);
+    db->host_addr[0] = host_pc;
+    db->host_addr[1] = NULL;
+
+#ifdef CONFIG_USER_ONLY
+    page_protect(pc);
+#endif
 
     ops->init_disas_context(db, cpu);
     tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
@@ -XXX,XX +XXX,XX @@ void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
 #endif
 }
 
-static inline void translator_maybe_page_protect(DisasContextBase *dcbase,
-                                                 target_ulong pc, size_t len)
+static void *translator_access(CPUArchState *env, DisasContextBase *db,
+                               target_ulong pc, size_t len)
 {
-#ifdef CONFIG_USER_ONLY
-    target_ulong end = pc + len - 1;
+    void *host;
+    target_ulong base, end;
+    TranslationBlock *tb;
 
-    if (end > dcbase->page_protect_end) {
-        translator_page_protect(dcbase, end);
+    tb = db->tb;
+
+    /* Use slow path if first page is MMIO. */
+    if (unlikely(tb->page_addr[0] == -1)) {
+        return NULL;
     }
+
+    end = pc + len - 1;
+    if (likely(is_same_page(db, end))) {
+        host = db->host_addr[0];
+        base = db->pc_first;
+    } else {
+        host = db->host_addr[1];
+        base = TARGET_PAGE_ALIGN(db->pc_first);
+        if (host == NULL) {
+            tb->page_addr[1] =
+                get_page_addr_code_hostp(env, base, &db->host_addr[1]);
+#ifdef CONFIG_USER_ONLY
+            page_protect(end);
 #endif
+            /* We cannot handle MMIO as second page. */
+            assert(tb->page_addr[1] != -1);
+            host = db->host_addr[1];
+        }
+
+        /* Use slow path when crossing pages. */
+        if (is_same_page(db, pc)) {
+            return NULL;
+        }
+    }
+
+    tcg_debug_assert(pc >= base);
+    return host + (pc - base);
 }
 
-#define GEN_TRANSLATOR_LD(fullname, type, load_fn, swap_fn)             \
-    type fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase, \
-                           abi_ptr pc, bool do_swap)                    \
-    {                                                                   \
-        translator_maybe_page_protect(dcbase, pc, sizeof(type));        \
-        type ret = load_fn(env, pc);                                    \
-        if (do_swap) {                                                  \
-            ret = swap_fn(ret);                                         \
-        }                                                               \
-        plugin_insn_append(pc, &ret, sizeof(ret));                      \
-        return ret;                                                     \
+uint8_t translator_ldub(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
+{
+    uint8_t ret;
+    void *p = translator_access(env, db, pc, sizeof(ret));
+
+    if (p) {
+        plugin_insn_append(pc, p, sizeof(ret));
+        return ldub_p(p);
     }
+    ret = cpu_ldub_code(env, pc);
+    plugin_insn_append(pc, &ret, sizeof(ret));
+    return ret;
+}
 
-FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
+uint16_t translator_lduw(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
+{
+    uint16_t ret, plug;
+    void *p = translator_access(env, db, pc, sizeof(ret));
 
-#undef GEN_TRANSLATOR_LD
+    if (p) {
+        plugin_insn_append(pc, p, sizeof(ret));
+        return lduw_p(p);
+    }
+    ret = cpu_lduw_code(env, pc);
+    plug = tswap16(ret);
+    plugin_insn_append(pc, &plug, sizeof(ret));
+    return ret;
+}
+
+uint32_t translator_ldl(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
+{
+    uint32_t ret, plug;
+    void *p = translator_access(env, db, pc, sizeof(ret));
+
+    if (p) {
+        plugin_insn_append(pc, p, sizeof(ret));
+        return ldl_p(p);
+    }
+    ret = cpu_ldl_code(env, pc);
+    plug = tswap32(ret);
+    plugin_insn_append(pc, &plug, sizeof(ret));
+    return ret;
+}
+
+uint64_t translator_ldq(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
+{
+    uint64_t ret, plug;
+    void *p = translator_access(env, db, pc, sizeof(ret));
+
+    if (p) {
+        plugin_insn_append(pc, p, sizeof(ret));
+        return ldq_p(p);
+    }
+    ret = cpu_ldq_code(env, pc);
+    plug = tswap64(ret);
+    plugin_insn_append(pc, &plug, sizeof(ret));
+    return ret;
+}
-- 
2.34.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

Right now translator stops right *after* the end of a page, which
breaks reporting of fault locations when the last instruction of a
multi-insn translation block crosses a page boundary.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220817150506.592862-3-iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/s390x/tcg/translate.c     |  15 +++-
 tests/tcg/s390x/noexec.c         | 106 +++++++++++++++++++++++
 tests/tcg/multiarch/noexec.c.inc | 139 +++++++++++++++++++++++++++++++
 tests/tcg/s390x/Makefile.target  |   1 +
 4 files changed, 257 insertions(+), 4 deletions(-)
 create mode 100644 tests/tcg/s390x/noexec.c
 create mode 100644 tests/tcg/multiarch/noexec.c.inc

diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static void s390x_tr_insn_start(DisasContextBase *dcbase, CPUState *cs)
     dc->insn_start = tcg_last_op();
 }
 
+static target_ulong get_next_pc(CPUS390XState *env, DisasContext *s,
+                                uint64_t pc)
+{
+    uint64_t insn = ld_code2(env, s, pc);
+
+    return pc + get_ilen((insn >> 8) & 0xff);
+}
+
 static void s390x_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
 {
     CPUS390XState *env = cs->env_ptr;
@@ -XXX,XX +XXX,XX @@ static void s390x_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
 
     dc->base.is_jmp = translate_one(env, dc);
     if (dc->base.is_jmp == DISAS_NEXT) {
-        uint64_t page_start;
-
-        page_start = dc->base.pc_first & TARGET_PAGE_MASK;
-        if (dc->base.pc_next - page_start >= TARGET_PAGE_SIZE || dc->ex_value) {
+        if (!is_same_page(dcbase, dc->base.pc_next) ||
+            !is_same_page(dcbase, get_next_pc(env, dc, dc->base.pc_next)) ||
+            dc->ex_value) {
             dc->base.is_jmp = DISAS_TOO_MANY;
         }
     }
diff --git a/tests/tcg/s390x/noexec.c b/tests/tcg/s390x/noexec.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/s390x/noexec.c
@@ -XXX,XX +XXX,XX @@
+#include "../multiarch/noexec.c.inc"
+
+static void *arch_mcontext_pc(const mcontext_t *ctx)
+{
+    return (void *)ctx->psw.addr;
+}
+
+static int arch_mcontext_arg(const mcontext_t *ctx)
+{
+    return ctx->gregs[2];
+}
+
+static void arch_flush(void *p, int len)
+{
+}
+
+extern char noexec_1[];
+extern char noexec_2[];
+extern char noexec_end[];
+
+asm("noexec_1:\n"
+    "   lgfi %r2,1\n"       /* %r2 is 0 on entry, set 1. */
+    "noexec_2:\n"
+    "   lgfi %r2,2\n"       /* %r2 is 0/1; set 2. */
+    "   br %r14\n"          /* return */
+    "noexec_end:");
+
+extern char exrl_1[];
+extern char exrl_2[];
+extern char exrl_end[];
+
+asm("exrl_1:\n"
+    "   exrl %r0, exrl_2\n"
+    "   br %r14\n"
+    "exrl_2:\n"
+    "   lgfi %r2,2\n"
+    "exrl_end:");
+
+int main(void)
+{
+    struct noexec_test noexec_tests[] = {
+        {
+            .name = "fallthrough",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2,
+            .entry_ofs = noexec_1 - noexec_2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = 0,
+            .expected_arg = 1,
+        },
+        {
+            .name = "jump",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2,
+            .entry_ofs = 0,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = 0,
+            .expected_arg = 0,
+        },
+        {
+            .name = "exrl",
+            .test_code = exrl_1,
+            .test_len = exrl_end - exrl_1,
+            .page_ofs = exrl_1 - exrl_2,
+            .entry_ofs = exrl_1 - exrl_2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = exrl_1 - exrl_2,
+            .expected_arg = 0,
+        },
+        {
+            .name = "fallthrough [cross]",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2 - 2,
+            .entry_ofs = noexec_1 - noexec_2 - 2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = -2,
+            .expected_arg = 1,
+        },
+        {
+            .name = "jump [cross]",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2 - 2,
+            .entry_ofs = -2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = -2,
+            .expected_arg = 0,
+        },
+        {
+            .name = "exrl [cross]",
+            .test_code = exrl_1,
+            .test_len = exrl_end - exrl_1,
+            .page_ofs = exrl_1 - exrl_2 - 2,
+            .entry_ofs = exrl_1 - exrl_2 - 2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = exrl_1 - exrl_2 - 2,
+            .expected_arg = 0,
+        },
+    };
+
+    return test_noexec(noexec_tests,
+                       sizeof(noexec_tests) / sizeof(noexec_tests[0]));
+}
diff --git a/tests/tcg/multiarch/noexec.c.inc b/tests/tcg/multiarch/noexec.c.inc
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/multiarch/noexec.c.inc
@@ -XXX,XX +XXX,XX @@
+/*
+ * Common code for arch-specific MMU_INST_FETCH fault testing.
+ */
+
+#define _GNU_SOURCE
+
+#include <assert.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <unistd.h>
+#include <sys/mman.h>
+#include <sys/ucontext.h>
+
+/* Forward declarations. */
+
+static void *arch_mcontext_pc(const mcontext_t *ctx);
+static int arch_mcontext_arg(const mcontext_t *ctx);
+static void arch_flush(void *p, int len);
+
+/* Testing infrastructure. */
+
+struct noexec_test {
+    const char *name;
+    const char *test_code;
+    int test_len;
+    int page_ofs;
+    int entry_ofs;
+    int expected_si_ofs;
+    int expected_pc_ofs;
+    int expected_arg;
+};
+
+static void *page_base;
+static int page_size;
+static const struct noexec_test *current_noexec_test;
+
+static void handle_err(const char *syscall)
+{
+    printf("[  FAILED  ] %s: %s\n", syscall, strerror(errno));
+    exit(EXIT_FAILURE);
+}
+
+static void handle_segv(int sig, siginfo_t *info, void *ucontext)
+{
+    const struct noexec_test *test = current_noexec_test;
+    const mcontext_t *mc = &((ucontext_t *)ucontext)->uc_mcontext;
+    void *expected_si;
+    void *expected_pc;
+    void *pc;
+    int arg;
+
+    if (test == NULL) {
+        printf("[  FAILED  ] unexpected SEGV\n");
+        exit(EXIT_FAILURE);
+    }
+    current_noexec_test = NULL;
+
+    expected_si = page_base + test->expected_si_ofs;
+    if (info->si_addr != expected_si) {
+        printf("[  FAILED  ] wrong si_addr (%p != %p)\n",
+               info->si_addr, expected_si);
+        exit(EXIT_FAILURE);
+    }
+
+    pc = arch_mcontext_pc(mc);
+    expected_pc = page_base + test->expected_pc_ofs;
+    if (pc != expected_pc) {
+        printf("[  FAILED  ] wrong pc (%p != %p)\n", pc, expected_pc);
+        exit(EXIT_FAILURE);
+    }
+
+    arg = arch_mcontext_arg(mc);
+    if (arg != test->expected_arg) {
+        printf("[  FAILED  ] wrong arg (%d != %d)\n", arg, test->expected_arg);
+        exit(EXIT_FAILURE);
+    }
+
+    if (mprotect(page_base, page_size,
+                 PROT_READ | PROT_WRITE | PROT_EXEC) < 0) {
+        handle_err("mprotect");
+    }
+}
+
+static void test_noexec_1(const struct noexec_test *test)
+{
+    void *start = page_base + test->page_ofs;
+    void (*fn)(int arg) = page_base + test->entry_ofs;
+
+    memcpy(start, test->test_code, test->test_len);
+    arch_flush(start, test->test_len);
+
+    /* Trigger TB creation in order to test invalidation. */
+    fn(0);
+
+    if (mprotect(page_base, page_size, PROT_NONE) < 0) {
+        handle_err("mprotect");
+    }
+
+    /* Trigger SEGV and check that handle_segv() ran. */
+    current_noexec_test = test;
+    fn(0);
+    assert(current_noexec_test == NULL);
+}
+
+static int test_noexec(struct noexec_test *tests, size_t n_tests)
+{
+    struct sigaction act;
+    size_t i;
+
+    memset(&act, 0, sizeof(act));
+    act.sa_sigaction = handle_segv;
+    act.sa_flags = SA_SIGINFO;
+    if (sigaction(SIGSEGV, &act, NULL) < 0) {
+        handle_err("sigaction");
+    }
+
+    page_size = getpagesize();
+    page_base = mmap(NULL, 2 * page_size,
+                     PROT_READ | PROT_WRITE | PROT_EXEC,
+                     MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
+    if (page_base == MAP_FAILED) {
+        handle_err("mmap");
+    }
+    page_base += page_size;
+
+    for (i = 0; i < n_tests; i++) {
+        struct noexec_test *test = &tests[i];
+
+        printf("[ RUN      ] %s\n", test->name);
+        test_noexec_1(test);
+        printf("[       OK ]\n");
+    }
+
+    printf("[  PASSED  ]\n");
+    return EXIT_SUCCESS;
+}
diff --git a/tests/tcg/s390x/Makefile.target b/tests/tcg/s390x/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/s390x/Makefile.target
+++ b/tests/tcg/s390x/Makefile.target
@@ -XXX,XX +XXX,XX @@ TESTS+=shift
 TESTS+=trap
 TESTS+=signals-s390x
 TESTS+=branch-relative-long
+TESTS+=noexec
 
 Z14_TESTS=vfminmax
 vfminmax: LDFLAGS+=-lm
-- 
2.34.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

Right now translator stops right *after* the end of a page, which
breaks reporting of fault locations when the last instruction of a
multi-insn translation block crosses a page boundary.

An implementation, like the one arm and s390x have, would require an
i386 length disassembler, which is burdensome to maintain. Another
alternative would be to single-step at the end of a guest page, but
this may come with a performance impact.

Fix by snapshotting disassembly state and restoring it after we figure
out we crossed a page boundary. This includes rolling back cc_op
updates and emitted ops.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1143
Message-Id: <20220817150506.592862-4-iii@linux.ibm.com>
[rth: Simplify end-of-insn cross-page checks.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/i386/tcg/translate.c      | 64 ++++++++++++++++-----------
 tests/tcg/x86_64/noexec.c        | 75 ++++++++++++++++++++++++++++++++
 tests/tcg/x86_64/Makefile.target |  3 +-
 3 files changed, 116 insertions(+), 26 deletions(-)
 create mode 100644 tests/tcg/x86_64/noexec.c

diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     TCGv_i64 tmp1_i64;
 
     sigjmp_buf jmpbuf;
+    TCGOp *prev_insn_end;
 } DisasContext;
 
 /* The environment in which user-only runs is constrained. */
@@ -XXX,XX +XXX,XX @@ static uint64_t advance_pc(CPUX86State *env, DisasContext *s, int num_bytes)
 {
     uint64_t pc = s->pc;
 
+    /* This is a subsequent insn that crosses a page boundary.  */
+    if (s->base.num_insns > 1 &&
+        !is_same_page(&s->base, s->pc + num_bytes - 1)) {
+        siglongjmp(s->jmpbuf, 2);
+    }
+
     s->pc += num_bytes;
     if (unlikely(s->pc - s->pc_start > X86_MAX_INSN_LENGTH)) {
         /* If the instruction's 16th byte is on a different page than the 1st, a
@@ -XXX,XX +XXX,XX @@ static target_ulong disas_insn(DisasContext *s, CPUState *cpu)
     int modrm, reg, rm, mod, op, opreg, val;
     target_ulong next_eip, tval;
     target_ulong pc_start = s->base.pc_next;
+    bool orig_cc_op_dirty = s->cc_op_dirty;
+    CCOp orig_cc_op = s->cc_op;
 
     s->pc_start = s->pc = pc_start;
     s->override = -1;
@@ -XXX,XX +XXX,XX @@ static target_ulong disas_insn(DisasContext *s, CPUState *cpu)
     s->rip_offset = 0; /* for relative ip address */
     s->vex_l = 0;
     s->vex_v = 0;
-    if (sigsetjmp(s->jmpbuf, 0) != 0) {
+    switch (sigsetjmp(s->jmpbuf, 0)) {
+    case 0:
+        break;
+    case 1:
         gen_exception_gpf(s);
         return s->pc;
+    case 2:
+        /* Restore state that may affect the next instruction. */
+        s->cc_op_dirty = orig_cc_op_dirty;
+        s->cc_op = orig_cc_op;
+        s->base.num_insns--;
+        tcg_remove_ops_after(s->prev_insn_end);
+        s->base.is_jmp = DISAS_TOO_MANY;
+        return pc_start;
+    default:
+        g_assert_not_reached();
     }
 
     prefixes = 0;
@@ -XXX,XX +XXX,XX @@ static void i386_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu)
 {
     DisasContext *dc = container_of(dcbase, DisasContext, base);
 
+    dc->prev_insn_end = tcg_last_op();
     tcg_gen_insn_start(dc->base.pc_next, dc->cc_op);
 }
 
@@ -XXX,XX +XXX,XX @@ static void i386_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
 #endif
 
     pc_next = disas_insn(dc, cpu);
-
-    if (dc->flags & (HF_TF_MASK | HF_INHIBIT_IRQ_MASK)) {
-        /* if single step mode, we generate only one instruction and
-           generate an exception */
-        /* if irq were inhibited with HF_INHIBIT_IRQ_MASK, we clear
-           the flag and abort the translation to give the irqs a
-           chance to happen */
-        dc->base.is_jmp = DISAS_TOO_MANY;
-    } else if ((tb_cflags(dc->base.tb) & CF_USE_ICOUNT)
-               && ((pc_next & TARGET_PAGE_MASK)
-                   != ((pc_next + TARGET_MAX_INSN_SIZE - 1)
-                       & TARGET_PAGE_MASK)
-                   || (pc_next & ~TARGET_PAGE_MASK) == 0)) {
-        /* Do not cross the boundary of the pages in icount mode,
-           it can cause an exception. Do it only when boundary is
-           crossed by the first instruction in the block.
-           If current instruction already crossed the bound - it's ok,
-           because an exception hasn't stopped this code.
-         */
-        dc->base.is_jmp = DISAS_TOO_MANY;
-    } else if ((pc_next - dc->base.pc_first) >= (TARGET_PAGE_SIZE - 32)) {
-        dc->base.is_jmp = DISAS_TOO_MANY;
-    }
-
     dc->base.pc_next = pc_next;
+
+    if (dc->base.is_jmp == DISAS_NEXT) {
+        if (dc->flags & (HF_TF_MASK | HF_INHIBIT_IRQ_MASK)) {
+            /*
+             * If single step mode, we generate only one instruction and
+             * generate an exception.
+             * If irq were inhibited with HF_INHIBIT_IRQ_MASK, we clear
+             * the flag and abort the translation to give the irqs a
+             * chance to happen.
+             */
+            dc->base.is_jmp = DISAS_TOO_MANY;
+        } else if (!is_same_page(&dc->base, pc_next)) {
+            dc->base.is_jmp = DISAS_TOO_MANY;
+        }
+    }
 }
 
 static void i386_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
diff --git a/tests/tcg/x86_64/noexec.c b/tests/tcg/x86_64/noexec.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/x86_64/noexec.c
@@ -XXX,XX +XXX,XX @@
+#include "../multiarch/noexec.c.inc"
+
+static void *arch_mcontext_pc(const mcontext_t *ctx)
+{
+    return (void *)ctx->gregs[REG_RIP];
+}
+
+int arch_mcontext_arg(const mcontext_t *ctx)
+{
+    return ctx->gregs[REG_RDI];
+}
+
+static void arch_flush(void *p, int len)
+{
+}
+
+extern char noexec_1[];
+extern char noexec_2[];
+extern char noexec_end[];
+
+asm("noexec_1:\n"
+    "    movq $1,%rdi\n"    /* %rdi is 0 on entry, set 1. */
+    "noexec_2:\n"
+    "    movq $2,%rdi\n"    /* %rdi is 0/1; set 2. */
+    "    ret\n"
+    "noexec_end:");
+
+int main(void)
+{
+    struct noexec_test noexec_tests[] = {
+        {
+            .name = "fallthrough",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2,
+            .entry_ofs = noexec_1 - noexec_2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = 0,
+            .expected_arg = 1,
+        },
+        {
+            .name = "jump",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2,
+            .entry_ofs = 0,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = 0,
+            .expected_arg = 0,
+        },
+        {
+            .name = "fallthrough [cross]",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2 - 2,
+            .entry_ofs = noexec_1 - noexec_2 - 2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = -2,
+            .expected_arg = 1,
+        },
+        {
+            .name = "jump [cross]",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2 - 2,
+            .entry_ofs = -2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = -2,
+            .expected_arg = 0,
+        },
+    };
+
+    return test_noexec(noexec_tests,
+                       sizeof(noexec_tests) / sizeof(noexec_tests[0]));
+}
diff --git a/tests/tcg/x86_64/Makefile.target b/tests/tcg/x86_64/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/x86_64/Makefile.target
+++ b/tests/tcg/x86_64/Makefile.target
@@ -XXX,XX +XXX,XX @@ include $(SRC_PATH)/tests/tcg/i386/Makefile.target
 
 ifeq ($(filter %-linux-user, $(TARGET)),$(TARGET))
 X86_64_TESTS += vsyscall
+X86_64_TESTS += noexec
 TESTS=$(MULTIARCH_TESTS) $(X86_64_TESTS) test-x86_64
 else
 TESTS=$(MULTIARCH_TESTS)
@@ -XXX,XX +XXX,XX @@ test-x86_64: LDFLAGS+=-lm -lc
 test-x86_64: test-i386.c test-i386.h test-i386-shift.h test-i386-muldiv.h
 	$(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
 
-vsyscall: $(SRC_PATH)/tests/tcg/x86_64/vsyscall.c
+%: $(SRC_PATH)/tests/tcg/x86_64/%.c
 	$(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
-- 
2.34.1

These will be useful in properly ending the TB.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/riscv/translate.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
 /* Include decoders for factored-out extensions */
 #include "decode-XVentanaCondOps.c.inc"
 
+/* The specification allows for longer insns, but not supported by qemu. */
+#define MAX_INSN_LEN  4
+
+static inline int insn_len(uint16_t first_word)
+{
+    return (first_word & 3) == 3 ? 4 : 2;
+}
+
 static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
 {
     /*
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
     };
 
     /* Check for compressed insn */
-    if (extract16(opcode, 0, 2) != 3) {
+    if (insn_len(opcode) == 2) {
         if (!has_ext(ctx, RVC)) {
             gen_exception_illegal(ctx);
         } else {
-- 
2.34.1

Right now the translator stops right *after* the end of a page, which
breaks reporting of fault locations when the last instruction of a
multi-insn translation block crosses a page boundary.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1155
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/riscv/translate.c          | 17 +++++--
 tests/tcg/riscv64/noexec.c        | 79 +++++++++++++++++++++++++++++++
 tests/tcg/riscv64/Makefile.target |  1 +
 3 files changed, 93 insertions(+), 4 deletions(-)
 create mode 100644 tests/tcg/riscv64/noexec.c

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
     }
     ctx->nftemp = 0;
 
+    /* Only the first insn within a TB is allowed to cross a page boundary. */
     if (ctx->base.is_jmp == DISAS_NEXT) {
-        target_ulong page_start;
-
-        page_start = ctx->base.pc_first & TARGET_PAGE_MASK;
-        if (ctx->base.pc_next - page_start >= TARGET_PAGE_SIZE) {
+        if (!is_same_page(&ctx->base, ctx->base.pc_next)) {
             ctx->base.is_jmp = DISAS_TOO_MANY;
+        } else {
+            unsigned page_ofs = ctx->base.pc_next & ~TARGET_PAGE_MASK;
+
+            if (page_ofs > TARGET_PAGE_SIZE - MAX_INSN_LEN) {
+                uint16_t next_insn = cpu_lduw_code(env, ctx->base.pc_next);
+                int len = insn_len(next_insn);
+
+                if (!is_same_page(&ctx->base, ctx->base.pc_next + len)) {
+                    ctx->base.is_jmp = DISAS_TOO_MANY;
+                }
+            }
         }
     }
 }
diff --git a/tests/tcg/riscv64/noexec.c b/tests/tcg/riscv64/noexec.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/riscv64/noexec.c
@@ -XXX,XX +XXX,XX @@
+#include "../multiarch/noexec.c.inc"
+
+static void *arch_mcontext_pc(const mcontext_t *ctx)
+{
+    return (void *)ctx->__gregs[REG_PC];
+}
+
+static int arch_mcontext_arg(const mcontext_t *ctx)
+{
+    return ctx->__gregs[REG_A0];
+}
+
+static void arch_flush(void *p, int len)
+{
+    __builtin___clear_cache(p, p + len);
+}
+
+extern char noexec_1[];
+extern char noexec_2[];
+extern char noexec_end[];
+
+asm(".option push\n"
+    ".option norvc\n"
+    "noexec_1:\n"
+    "   li a0,1\n"       /* a0 is 0 on entry, set 1. */
+    "noexec_2:\n"
+    "   li a0,2\n"      /* a0 is 0/1; set 2. */
+    "   ret\n"
+    "noexec_end:\n"
+    ".option pop");
+
+int main(void)
+{
+    struct noexec_test noexec_tests[] = {
+        {
+            .name = "fallthrough",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2,
+            .entry_ofs = noexec_1 - noexec_2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = 0,
+            .expected_arg = 1,
+        },
+        {
+            .name = "jump",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2,
+            .entry_ofs = 0,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = 0,
+            .expected_arg = 0,
+        },
+        {
+            .name = "fallthrough [cross]",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2 - 2,
+            .entry_ofs = noexec_1 - noexec_2 - 2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = -2,
+            .expected_arg = 1,
+        },
+        {
+            .name = "jump [cross]",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2 - 2,
+            .entry_ofs = -2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = -2,
+            .expected_arg = 0,
+        },
+    };
+
+    return test_noexec(noexec_tests,
+                       sizeof(noexec_tests) / sizeof(noexec_tests[0]));
+}
diff --git a/tests/tcg/riscv64/Makefile.target b/tests/tcg/riscv64/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/riscv64/Makefile.target
+++ b/tests/tcg/riscv64/Makefile.target
@@ -XXX,XX +XXX,XX @@
 
 VPATH += $(SRC_PATH)/tests/tcg/riscv64
 TESTS += test-div
+TESTS += noexec
-- 
2.34.1

The following changes since commit 9c6c079bc6723da8061ccfb44361d67b1dd785dd:

Merge tag 'pull-target-arm-20240430' of https://git.linaro.org/people/pmaydell/qemu-arm into staging (2024-04-30 09:58:54 -0700)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20240501

for you to fetch changes up to 917d7f8d948d706e275c9f33169b9dd0149ded1e:

plugins: Update the documentation block for plugin-gen.c (2024-04-30 16:12:05 -0700)

----------------------------------------------------------------
plugins: Rewrite plugin tcg expansion

----------------------------------------------------------------
Richard Henderson (20):
      tcg: Make tcg/helper-info.h self-contained
      tcg: Pass function pointer to tcg_gen_call*
      plugins: Zero new qemu_plugin_dyn_cb entries
      plugins: Move function pointer in qemu_plugin_dyn_cb
      plugins: Create TCGHelperInfo for all out-of-line callbacks
      plugins: Use emit_before_op for PLUGIN_GEN_AFTER_INSN
      plugins: Use emit_before_op for PLUGIN_GEN_FROM_TB
      plugins: Add PLUGIN_GEN_AFTER_TB
      plugins: Use emit_before_op for PLUGIN_GEN_FROM_INSN
      plugins: Use emit_before_op for PLUGIN_GEN_FROM_MEM
      plugins: Remove plugin helpers
      tcg: Remove TCG_CALL_PLUGIN
      tcg: Remove INDEX_op_plugin_cb_{start,end}
      plugins: Simplify callback queues
      plugins: Introduce PLUGIN_CB_MEM_REGULAR
      plugins: Replace pr_ops with a proper debug dump flag
      plugins: Split out common cb expanders
      plugins: Merge qemu_plugin_tb_insn_get to plugin-gen.c
      plugins: Inline plugin_gen_empty_callback
      plugins: Update the documentation block for plugin-gen.c

Move MAX_CALL_IARGS from tcg.h and include for
the define of TCG_TARGET_REG_BITS.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/helper-info.h | 3 +++
 include/tcg/tcg.h         | 2 --
 tcg/tci.c                 | 1 +
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/include/tcg/helper-info.h b/include/tcg/helper-info.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/helper-info.h
+++ b/include/tcg/helper-info.h
@@ -XXX,XX +XXX,XX @@
 #ifdef CONFIG_TCG_INTERPRETER
 #include <ffi.h>
 #endif
+#include "tcg-target-reg-bits.h"
+
+#define MAX_CALL_IARGS  7
 
 /*
  * Describe the calling convention of a given argument type.
diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@
 /* XXX: make safe guess about sizes */
 #define MAX_OP_PER_INSTR 266
 
-#define MAX_CALL_IARGS  7
-
 #define CPU_TEMP_BUF_NLONGS 128
 #define TCG_STATIC_FRAME_SIZE  (CPU_TEMP_BUF_NLONGS * sizeof(long))
 
diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "tcg/tcg.h"
+#include "tcg/helper-info.h"
 #include "tcg/tcg-ldst.h"
 #include <ffi.h>
 
-- 
2.34.1

For normal helpers, read the function pointer from the
structure earlier.  For plugins, this will allow the
function pointer to come from elsewhere.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg.h             | 21 +++++++++-------
 include/exec/helper-gen.h.inc | 24 ++++++++++++-------
 tcg/tcg.c                     | 45 +++++++++++++++++++----------------
 3 files changed, 52 insertions(+), 38 deletions(-)

diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ typedef struct TCGTargetOpDef {
 
 bool tcg_op_supported(TCGOpcode op);
 
-void tcg_gen_call0(TCGHelperInfo *, TCGTemp *ret);
-void tcg_gen_call1(TCGHelperInfo *, TCGTemp *ret, TCGTemp *);
-void tcg_gen_call2(TCGHelperInfo *, TCGTemp *ret, TCGTemp *, TCGTemp *);
-void tcg_gen_call3(TCGHelperInfo *, TCGTemp *ret, TCGTemp *,
+void tcg_gen_call0(void *func, TCGHelperInfo *, TCGTemp *ret);
+void tcg_gen_call1(void *func, TCGHelperInfo *, TCGTemp *ret, TCGTemp *);
+void tcg_gen_call2(void *func, TCGHelperInfo *, TCGTemp *ret,
                    TCGTemp *, TCGTemp *);
-void tcg_gen_call4(TCGHelperInfo *, TCGTemp *ret, TCGTemp *, TCGTemp *,
-                   TCGTemp *, TCGTemp *);
-void tcg_gen_call5(TCGHelperInfo *, TCGTemp *ret, TCGTemp *, TCGTemp *,
+void tcg_gen_call3(void *func, TCGHelperInfo *, TCGTemp *ret,
                    TCGTemp *, TCGTemp *, TCGTemp *);
-void tcg_gen_call6(TCGHelperInfo *, TCGTemp *ret, TCGTemp *, TCGTemp *,
+void tcg_gen_call4(void *func, TCGHelperInfo *, TCGTemp *ret,
                    TCGTemp *, TCGTemp *, TCGTemp *, TCGTemp *);
-void tcg_gen_call7(TCGHelperInfo *, TCGTemp *ret, TCGTemp *, TCGTemp *,
+void tcg_gen_call5(void *func, TCGHelperInfo *, TCGTemp *ret,
                    TCGTemp *, TCGTemp *, TCGTemp *, TCGTemp *, TCGTemp *);
+void tcg_gen_call6(void *func, TCGHelperInfo *, TCGTemp *ret,
+                   TCGTemp *, TCGTemp *, TCGTemp *, TCGTemp *,
+                   TCGTemp *, TCGTemp *);
+void tcg_gen_call7(void *func, TCGHelperInfo *, TCGTemp *ret,
+                   TCGTemp *, TCGTemp *, TCGTemp *, TCGTemp *,
+                   TCGTemp *, TCGTemp *, TCGTemp *);
 
 TCGOp *tcg_emit_op(TCGOpcode opc, unsigned nargs);
 void tcg_op_remove(TCGContext *s, TCGOp *op);
diff --git a/include/exec/helper-gen.h.inc b/include/exec/helper-gen.h.inc
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/helper-gen.h.inc
+++ b/include/exec/helper-gen.h.inc
@@ -XXX,XX +XXX,XX @@
 extern TCGHelperInfo glue(helper_info_, name);                          \
 static inline void glue(gen_helper_, name)(dh_retvar_decl0(ret))        \
 {                                                                       \
-    tcg_gen_call0(&glue(helper_info_, name), dh_retvar(ret));           \
+    tcg_gen_call0(glue(helper_info_,name).func,                         \
+                  &glue(helper_info_,name), dh_retvar(ret));            \
 }
 
 #define DEF_HELPER_FLAGS_1(name, flags, ret, t1)                        \
@@ -XXX,XX +XXX,XX @@ extern TCGHelperInfo glue(helper_info_, name);                          \
 static inline void glue(gen_helper_, name)(dh_retvar_decl(ret)          \
     dh_arg_decl(t1, 1))                                                 \
 {                                                                       \
-    tcg_gen_call1(&glue(helper_info_, name), dh_retvar(ret),            \
+    tcg_gen_call1(glue(helper_info_,name).func,                         \
+                  &glue(helper_info_,name), dh_retvar(ret),             \
                   dh_arg(t1, 1));                                       \
 }
 
@@ -XXX,XX +XXX,XX @@ extern TCGHelperInfo glue(helper_info_, name);                          \
 static inline void glue(gen_helper_, name)(dh_retvar_decl(ret)          \
     dh_arg_decl(t1, 1), dh_arg_decl(t2, 2))                             \
 {                                                                       \
-    tcg_gen_call2(&glue(helper_info_, name), dh_retvar(ret),            \
+    tcg_gen_call2(glue(helper_info_,name).func,                         \
+                  &glue(helper_info_,name), dh_retvar(ret),             \
                   dh_arg(t1, 1), dh_arg(t2, 2));                        \
 }
 
@@ -XXX,XX +XXX,XX @@ extern TCGHelperInfo glue(helper_info_, name);                          \
 static inline void glue(gen_helper_, name)(dh_retvar_decl(ret)          \
     dh_arg_decl(t1, 1), dh_arg_decl(t2, 2), dh_arg_decl(t3, 3))         \
 {                                                                       \
-    tcg_gen_call3(&glue(helper_info_, name), dh_retvar(ret),            \
+    tcg_gen_call3(glue(helper_info_,name).func,                         \
+                  &glue(helper_info_,name), dh_retvar(ret),             \
                   dh_arg(t1, 1), dh_arg(t2, 2), dh_arg(t3, 3));         \
 }
 
@@ -XXX,XX +XXX,XX @@ static inline void glue(gen_helper_, name)(dh_retvar_decl(ret)          \
     dh_arg_decl(t1, 1), dh_arg_decl(t2, 2),                             \
     dh_arg_decl(t3, 3), dh_arg_decl(t4, 4))                             \
 {                                                                       \
-    tcg_gen_call4(&glue(helper_info_, name), dh_retvar(ret),            \
+    tcg_gen_call4(glue(helper_info_,name).func,                         \
+                  &glue(helper_info_,name), dh_retvar(ret),             \
                   dh_arg(t1, 1), dh_arg(t2, 2),                         \
                   dh_arg(t3, 3), dh_arg(t4, 4));                        \
 }
@@ -XXX,XX +XXX,XX @@ static inline void glue(gen_helper_, name)(dh_retvar_decl(ret)          \
     dh_arg_decl(t1, 1), dh_arg_decl(t2, 2), dh_arg_decl(t3, 3),         \
     dh_arg_decl(t4, 4), dh_arg_decl(t5, 5))                             \
 {                                                                       \
-    tcg_gen_call5(&glue(helper_info_, name), dh_retvar(ret),            \
+    tcg_gen_call5(glue(helper_info_,name).func,                         \
+                  &glue(helper_info_,name), dh_retvar(ret),             \
                   dh_arg(t1, 1), dh_arg(t2, 2), dh_arg(t3, 3),          \
                   dh_arg(t4, 4), dh_arg(t5, 5));                        \
 }
@@ -XXX,XX +XXX,XX @@ static inline void glue(gen_helper_, name)(dh_retvar_decl(ret)          \
     dh_arg_decl(t1, 1), dh_arg_decl(t2, 2), dh_arg_decl(t3, 3),         \
     dh_arg_decl(t4, 4), dh_arg_decl(t5, 5), dh_arg_decl(t6, 6))         \
 {                                                                       \
-    tcg_gen_call6(&glue(helper_info_, name), dh_retvar(ret),            \
+    tcg_gen_call6(glue(helper_info_,name).func,                         \
+                  &glue(helper_info_,name), dh_retvar(ret),             \
                   dh_arg(t1, 1), dh_arg(t2, 2), dh_arg(t3, 3),          \
                   dh_arg(t4, 4), dh_arg(t5, 5), dh_arg(t6, 6));         \
 }
@@ -XXX,XX +XXX,XX @@ static inline void glue(gen_helper_, name)(dh_retvar_decl(ret)          \
     dh_arg_decl(t4, 4), dh_arg_decl(t5, 5), dh_arg_decl(t6, 6),         \
     dh_arg_decl(t7, 7))                                                 \
 {                                                                       \
-    tcg_gen_call7(&glue(helper_info_, name), dh_retvar(ret),            \
+    tcg_gen_call7(glue(helper_info_,name).func,                         \
+                  &glue(helper_info_,name), dh_retvar(ret),             \
                   dh_arg(t1, 1), dh_arg(t2, 2), dh_arg(t3, 3),          \
                   dh_arg(t4, 4), dh_arg(t5, 5), dh_arg(t6, 6),          \
                   dh_arg(t7, 7));                                       \
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ bool tcg_op_supported(TCGOpcode op)
 
 static TCGOp *tcg_op_alloc(TCGOpcode opc, unsigned nargs);
 
-static void tcg_gen_callN(TCGHelperInfo *info, TCGTemp *ret, TCGTemp **args)
+static void tcg_gen_callN(void *func, TCGHelperInfo *info,
+                          TCGTemp *ret, TCGTemp **args)
 {
     TCGv_i64 extend_free[MAX_CALL_IARGS];
     int n_extend = 0;
@@ -XXX,XX +XXX,XX @@ static void tcg_gen_callN(TCGHelperInfo *info, TCGTemp *ret, TCGTemp **args)
             g_assert_not_reached();
         }
     }
-    op->args[pi++] = (uintptr_t)info->func;
+    op->args[pi++] = (uintptr_t)func;
     op->args[pi++] = (uintptr_t)info;
     tcg_debug_assert(pi == total_args);
 
@@ -XXX,XX +XXX,XX @@ static void tcg_gen_callN(TCGHelperInfo *info, TCGTemp *ret, TCGTemp **args)
     }
 }
 
-void tcg_gen_call0(TCGHelperInfo *info, TCGTemp *ret)
+void tcg_gen_call0(void *func, TCGHelperInfo *info, TCGTemp *ret)
 {
-    tcg_gen_callN(info, ret, NULL);
+    tcg_gen_callN(func, info, ret, NULL);
 }
 
-void tcg_gen_call1(TCGHelperInfo *info, TCGTemp *ret, TCGTemp *t1)
+void tcg_gen_call1(void *func, TCGHelperInfo *info, TCGTemp *ret, TCGTemp *t1)
 {
-    tcg_gen_callN(info, ret, &t1);
+    tcg_gen_callN(func, info, ret, &t1);
 }
 
-void tcg_gen_call2(TCGHelperInfo *info, TCGTemp *ret, TCGTemp *t1, TCGTemp *t2)
+void tcg_gen_call2(void *func, TCGHelperInfo *info, TCGTemp *ret,
+                   TCGTemp *t1, TCGTemp *t2)
 {
     TCGTemp *args[2] = { t1, t2 };
-    tcg_gen_callN(info, ret, args);
+    tcg_gen_callN(func, info, ret, args);
 }
 
-void tcg_gen_call3(TCGHelperInfo *info, TCGTemp *ret, TCGTemp *t1,
-                   TCGTemp *t2, TCGTemp *t3)
+void tcg_gen_call3(void *func, TCGHelperInfo *info, TCGTemp *ret,
+                   TCGTemp *t1, TCGTemp *t2, TCGTemp *t3)
 {
     TCGTemp *args[3] = { t1, t2, t3 };
-    tcg_gen_callN(info, ret, args);
+    tcg_gen_callN(func, info, ret, args);
 }
 
-void tcg_gen_call4(TCGHelperInfo *info, TCGTemp *ret, TCGTemp *t1,
-                   TCGTemp *t2, TCGTemp *t3, TCGTemp *t4)
+void tcg_gen_call4(void *func, TCGHelperInfo *info, TCGTemp *ret,
+                   TCGTemp *t1, TCGTemp *t2, TCGTemp *t3, TCGTemp *t4)
 {
     TCGTemp *args[4] = { t1, t2, t3, t4 };
-    tcg_gen_callN(info, ret, args);
+    tcg_gen_callN(func, info, ret, args);
 }
 
-void tcg_gen_call5(TCGHelperInfo *info, TCGTemp *ret, TCGTemp *t1,
+void tcg_gen_call5(void *func, TCGHelperInfo *info, TCGTemp *ret, TCGTemp *t1,
                    TCGTemp *t2, TCGTemp *t3, TCGTemp *t4, TCGTemp *t5)
 {
     TCGTemp *args[5] = { t1, t2, t3, t4, t5 };
-    tcg_gen_callN(info, ret, args);
+    tcg_gen_callN(func, info, ret, args);
 }
 
-void tcg_gen_call6(TCGHelperInfo *info, TCGTemp *ret, TCGTemp *t1, TCGTemp *t2,
-                   TCGTemp *t3, TCGTemp *t4, TCGTemp *t5, TCGTemp *t6)
+void tcg_gen_call6(void *func, TCGHelperInfo *info, TCGTemp *ret,
+                   TCGTemp *t1, TCGTemp *t2, TCGTemp *t3,
+                   TCGTemp *t4, TCGTemp *t5, TCGTemp *t6)
 {
     TCGTemp *args[6] = { t1, t2, t3, t4, t5, t6 };
-    tcg_gen_callN(info, ret, args);
+    tcg_gen_callN(func, info, ret, args);
 }
 
-void tcg_gen_call7(TCGHelperInfo *info, TCGTemp *ret, TCGTemp *t1,
+void tcg_gen_call7(void *func, TCGHelperInfo *info, TCGTemp *ret, TCGTemp *t1,
                    TCGTemp *t2, TCGTemp *t3, TCGTemp *t4,
                    TCGTemp *t5, TCGTemp *t6, TCGTemp *t7)
 {
     TCGTemp *args[7] = { t1, t2, t3, t4, t5, t6, t7 };
-    tcg_gen_callN(info, ret, args);
+    tcg_gen_callN(func, info, ret, args);
 }
 
 static void tcg_reg_alloc_start(TCGContext *s)
-- 
2.34.1

The out-of-line function pointer is mutually exclusive
with inline expansion, so move it into the union.
Wrap the pointer in a structure named 'regular' to match
PLUGIN_CB_REGULAR.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/qemu/plugin.h  | 4 +++-
 accel/tcg/plugin-gen.c | 4 ++--
 plugins/core.c         | 8 ++++----
 3 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/include/qemu/plugin.h b/include/qemu/plugin.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/plugin.h
+++ b/include/qemu/plugin.h
@@ -XXX,XX +XXX,XX @@ enum plugin_dyn_cb_subtype {
  * instance of a callback to be called upon the execution of a particular TB.
  */
 struct qemu_plugin_dyn_cb {
-    union qemu_plugin_cb_sig f;
     void *userp;
     enum plugin_dyn_cb_subtype type;
     /* @rw applies to mem callbacks only (both regular and inline) */
     enum qemu_plugin_mem_rw rw;
     /* fields specific to each dyn_cb type go here */
     union {
+        struct {
+            union qemu_plugin_cb_sig f;
+        } regular;
         struct {
             qemu_plugin_u64 entry;
             enum qemu_plugin_op op;
diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/plugin-gen.c
+++ b/accel/tcg/plugin-gen.c
@@ -XXX,XX +XXX,XX @@ static TCGOp *append_udata_cb(const struct qemu_plugin_dyn_cb *cb,
     }
 
     /* call */
-    op = copy_call(&begin_op, op, cb->f.vcpu_udata, cb_idx);
+    op = copy_call(&begin_op, op, cb->regular.f.vcpu_udata, cb_idx);
 
     return op;
 }
@@ -XXX,XX +XXX,XX @@ static TCGOp *append_mem_cb(const struct qemu_plugin_dyn_cb *cb,
 
     if (type == PLUGIN_GEN_CB_MEM) {
         /* call */
-        op = copy_call(&begin_op, op, cb->f.vcpu_udata, cb_idx);
+        op = copy_call(&begin_op, op, cb->regular.f.vcpu_udata, cb_idx);
     }
 
     return op;
diff --git a/plugins/core.c b/plugins/core.c
index XXXXXXX..XXXXXXX 100644
--- a/plugins/core.c
+++ b/plugins/core.c
@@ -XXX,XX +XXX,XX @@ void plugin_register_dyn_cb__udata(GArray **arr,
 
     dyn_cb->userp = udata;
     /* Note flags are discarded as unused. */
-    dyn_cb->f.vcpu_udata = cb;
+    dyn_cb->regular.f.vcpu_udata = cb;
     dyn_cb->type = PLUGIN_CB_REGULAR;
 }
 
@@ -XXX,XX +XXX,XX @@ void plugin_register_vcpu_mem_cb(GArray **arr,
     /* Note flags are discarded as unused. */
     dyn_cb->type = PLUGIN_CB_REGULAR;
     dyn_cb->rw = rw;
-    dyn_cb->f.generic = cb;
+    dyn_cb->regular.f.vcpu_mem = cb;
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ void qemu_plugin_vcpu_mem_cb(CPUState *cpu, uint64_t vaddr,
         }
         switch (cb->type) {
         case PLUGIN_CB_REGULAR:
-            cb->f.vcpu_mem(cpu->cpu_index, make_plugin_meminfo(oi, rw),
-                           vaddr, cb->userp);
+            cb->regular.f.vcpu_mem(cpu->cpu_index, make_plugin_meminfo(oi, rw),
+                                   vaddr, cb->userp);
             break;
         case PLUGIN_CB_INLINE:
             exec_inline_op(cb, cpu->cpu_index);
-- 
2.34.1

TCGHelperInfo includes the ABI for every function call.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/qemu/plugin.h |  1 +
 plugins/core.c        | 51 ++++++++++++++++++++++++++++++++++++++-----
 2 files changed, 46 insertions(+), 6 deletions(-)

diff --git a/include/qemu/plugin.h b/include/qemu/plugin.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/plugin.h
+++ b/include/qemu/plugin.h
@@ -XXX,XX +XXX,XX @@ struct qemu_plugin_dyn_cb {
     union {
         struct {
             union qemu_plugin_cb_sig f;
+            TCGHelperInfo *info;
         } regular;
         struct {
             qemu_plugin_u64 entry;
diff --git a/plugins/core.c b/plugins/core.c
index XXXXXXX..XXXXXXX 100644
--- a/plugins/core.c
+++ b/plugins/core.c
@@ -XXX,XX +XXX,XX @@ void plugin_register_dyn_cb__udata(GArray **arr,
                                    enum qemu_plugin_cb_flags flags,
                                    void *udata)
 {
-    struct qemu_plugin_dyn_cb *dyn_cb = plugin_get_dyn_cb(arr);
+    static TCGHelperInfo info[3] = {
+        [QEMU_PLUGIN_CB_NO_REGS].flags = TCG_CALL_NO_RWG | TCG_CALL_PLUGIN,
+        [QEMU_PLUGIN_CB_R_REGS].flags = TCG_CALL_NO_WG | TCG_CALL_PLUGIN,
+        [QEMU_PLUGIN_CB_RW_REGS].flags = TCG_CALL_PLUGIN,
+        /*
+         * Match qemu_plugin_vcpu_udata_cb_t:
+         *   void (*)(uint32_t, void *)
+         */
+        [0 ... 2].typemask = (dh_typemask(void, 0) |
+                              dh_typemask(i32, 1) |
+                              dh_typemask(ptr, 2))
+    };
 
+    struct qemu_plugin_dyn_cb *dyn_cb = plugin_get_dyn_cb(arr);
     dyn_cb->userp = udata;
-    /* Note flags are discarded as unused. */
-    dyn_cb->regular.f.vcpu_udata = cb;
     dyn_cb->type = PLUGIN_CB_REGULAR;
+    dyn_cb->regular.f.vcpu_udata = cb;
+
+    assert((unsigned)flags < ARRAY_SIZE(info));
+    dyn_cb->regular.info = &info[flags];
 }
 
 void plugin_register_vcpu_mem_cb(GArray **arr,
@@ -XXX,XX +XXX,XX @@ void plugin_register_vcpu_mem_cb(GArray **arr,
                                  enum qemu_plugin_mem_rw rw,
                                  void *udata)
 {
-    struct qemu_plugin_dyn_cb *dyn_cb;
+    /*
+     * Expect that the underlying type for enum qemu_plugin_meminfo_t
+     * is either int32_t or uint32_t, aka int or unsigned int.
+     */
+    QEMU_BUILD_BUG_ON(
+        !__builtin_types_compatible_p(qemu_plugin_meminfo_t, uint32_t) &&
+        !__builtin_types_compatible_p(qemu_plugin_meminfo_t, int32_t));
 
-    dyn_cb = plugin_get_dyn_cb(arr);
+    static TCGHelperInfo info[3] = {
+        [QEMU_PLUGIN_CB_NO_REGS].flags = TCG_CALL_NO_RWG | TCG_CALL_PLUGIN,
+        [QEMU_PLUGIN_CB_R_REGS].flags = TCG_CALL_NO_WG | TCG_CALL_PLUGIN,
+        [QEMU_PLUGIN_CB_RW_REGS].flags = TCG_CALL_PLUGIN,
+        /*
+         * Match qemu_plugin_vcpu_mem_cb_t:
+         *   void (*)(uint32_t, qemu_plugin_meminfo_t, uint64_t, void *)
+         */
+        [0 ... 2].typemask =
+            (dh_typemask(void, 0) |
+             dh_typemask(i32, 1) |
+             (__builtin_types_compatible_p(qemu_plugin_meminfo_t, uint32_t)
+              ? dh_typemask(i32, 2) : dh_typemask(s32, 2)) |
+             dh_typemask(i64, 3) |
+             dh_typemask(ptr, 4))
+    };
+
+    struct qemu_plugin_dyn_cb *dyn_cb = plugin_get_dyn_cb(arr);
     dyn_cb->userp = udata;
-    /* Note flags are discarded as unused. */
     dyn_cb->type = PLUGIN_CB_REGULAR;
     dyn_cb->rw = rw;
     dyn_cb->regular.f.vcpu_mem = cb;
+
+    assert((unsigned)flags < ARRAY_SIZE(info));
+    dyn_cb->regular.info = &info[flags];
 }
 
 /*
-- 
2.34.1

Introduce a new plugin_cb op and migrate one operation.
By using emit_before_op, we do not need to emit opcodes
early and modify them later -- we can simply emit the
final set of opcodes once.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg-op-common.h |  1 +
 include/tcg/tcg-opc.h       |  1 +
 accel/tcg/plugin-gen.c      | 74 +++++++++++++++++++++----------------
 tcg/tcg-op.c                |  5 +++
 4 files changed, 50 insertions(+), 31 deletions(-)

diff --git a/include/tcg/tcg-op-common.h b/include/tcg/tcg-op-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg-op-common.h
+++ b/include/tcg/tcg-op-common.h
@@ -XXX,XX +XXX,XX @@ void tcg_gen_goto_tb(unsigned idx);
  */
 void tcg_gen_lookup_and_goto_ptr(void);
 
+void tcg_gen_plugin_cb(unsigned from);
 void tcg_gen_plugin_cb_start(unsigned from, unsigned type, unsigned wr);
 void tcg_gen_plugin_cb_end(void);
 
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -XXX,XX +XXX,XX @@ DEF(exit_tb, 0, 0, 1, TCG_OPF_BB_EXIT | TCG_OPF_BB_END)
 DEF(goto_tb, 0, 0, 1, TCG_OPF_BB_EXIT | TCG_OPF_BB_END)
 DEF(goto_ptr, 0, 1, 0, TCG_OPF_BB_EXIT | TCG_OPF_BB_END)
 
+DEF(plugin_cb, 0, 0, 1, TCG_OPF_NOT_PRESENT)
 DEF(plugin_cb_start, 0, 0, 3, TCG_OPF_NOT_PRESENT)
 DEF(plugin_cb_end, 0, 0, 0, TCG_OPF_NOT_PRESENT)
 
diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/plugin-gen.c
+++ b/accel/tcg/plugin-gen.c
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_empty_callback(enum plugin_gen_from from)
 {
     switch (from) {
     case PLUGIN_GEN_AFTER_INSN:
-        gen_wrapped(from, PLUGIN_GEN_DISABLE_MEM_HELPER,
-                    gen_empty_mem_helper);
+        tcg_gen_plugin_cb(from);
         break;
     case PLUGIN_GEN_FROM_INSN:
         /*
@@ -XXX,XX +XXX,XX @@ static void inject_mem_enable_helper(struct qemu_plugin_tb *ptb,
     inject_mem_helper(begin_op, arr);
 }
 
-static void inject_mem_disable_helper(struct qemu_plugin_insn *plugin_insn,
-                                      TCGOp *begin_op)
-{
-    if (likely(!plugin_insn->mem_helper)) {
-        rm_ops(begin_op);
-        return;
-    }
-    inject_mem_helper(begin_op, NULL);
-}
-
 /* called before finishing a TB with exit_tb, goto_tb or goto_ptr */
 void plugin_gen_disable_mem_helpers(void)
 {
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_enable_mem_helper(struct qemu_plugin_tb *ptb,
     inject_mem_enable_helper(ptb, insn, begin_op);
 }
 
-static void plugin_gen_disable_mem_helper(struct qemu_plugin_tb *ptb,
-                                          TCGOp *begin_op, int insn_idx)
+static void gen_disable_mem_helper(struct qemu_plugin_tb *ptb,
+                                   struct qemu_plugin_insn *insn)
 {
-    struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
-    inject_mem_disable_helper(insn, begin_op);
+    if (insn->mem_helper) {
+        tcg_gen_st_ptr(tcg_constant_ptr(0), tcg_env,
+                       offsetof(CPUState, plugin_mem_cbs) -
+                       offsetof(ArchCPU, env));
+    }
 }
 
 /* #define DEBUG_PLUGIN_GEN_OPS */
@@ -XXX,XX +XXX,XX @@ static void pr_ops(void)
 
 static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
 {
-    TCGOp *op;
+    TCGOp *op, *next;
     int insn_idx = -1;
 
     pr_ops();
 
-    QTAILQ_FOREACH(op, &tcg_ctx->ops, link) {
+    /*
+     * While injecting code, we cannot afford to reuse any ebb temps
+     * that might be live within the existing opcode stream.
+     * The simplest solution is to release them all and create new.
+     */
+    memset(tcg_ctx->free_temps, 0, sizeof(tcg_ctx->free_temps));
+
+    QTAILQ_FOREACH_SAFE(op, &tcg_ctx->ops, link, next) {
         switch (op->opc) {
         case INDEX_op_insn_start:
             insn_idx++;
             break;
+
+        case INDEX_op_plugin_cb:
+        {
+            enum plugin_gen_from from = op->args[0];
+            struct qemu_plugin_insn *insn = NULL;
+
+            if (insn_idx >= 0) {
+                insn = g_ptr_array_index(plugin_tb->insns, insn_idx);
+            }
+
+            tcg_ctx->emit_before_op = op;
+
+            switch (from) {
+            case PLUGIN_GEN_AFTER_INSN:
+                assert(insn != NULL);
+                gen_disable_mem_helper(plugin_tb, insn);
+                break;
+            default:
+                g_assert_not_reached();
+            }
+
+            tcg_ctx->emit_before_op = NULL;
+            tcg_op_remove(tcg_ctx, op);
+            break;
+        }
+
         case INDEX_op_plugin_cb_start:
         {
             enum plugin_gen_from from = op->args[0];
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
 
                 break;
             }
-            case PLUGIN_GEN_AFTER_INSN:
-            {
-                g_assert(insn_idx >= 0);
-
-                switch (type) {
-                case PLUGIN_GEN_DISABLE_MEM_HELPER:
-                    plugin_gen_disable_mem_helper(plugin_tb, op, insn_idx);
-                    break;
-                default:
-                    g_assert_not_reached();
-                }
-                break;
-            }
             default:
                 g_assert_not_reached();
             }
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -XXX,XX +XXX,XX @@ void tcg_gen_mb(TCGBar mb_type)
     }
 }
 
+void tcg_gen_plugin_cb(unsigned from)
+{
+    tcg_gen_op1(INDEX_op_plugin_cb, from);
+}
+
 void tcg_gen_plugin_cb_start(unsigned from, unsigned type, unsigned wr)
 {
     tcg_gen_op3(INDEX_op_plugin_cb_start, from, type, wr);
-- 
2.34.1

By having the qemu_plugin_cb_flags be recorded in the TCGHelperInfo,
we no longer need to distinguish PLUGIN_CB_REGULAR from
PLUGIN_CB_REGULAR_R, so place all TB callbacks in the same queue.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/plugin-gen.c | 96 +++++++++++++++++++++++++-----------------
 plugins/api.c          |  6 +--
 2 files changed, 58 insertions(+), 44 deletions(-)

diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/plugin-gen.c
+++ b/accel/tcg/plugin-gen.c
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_empty_callback(enum plugin_gen_from from)
 {
     switch (from) {
     case PLUGIN_GEN_AFTER_INSN:
+    case PLUGIN_GEN_FROM_TB:
         tcg_gen_plugin_cb(from);
         break;
     case PLUGIN_GEN_FROM_INSN:
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_empty_callback(enum plugin_gen_from from)
          */
         gen_wrapped(from, PLUGIN_GEN_ENABLE_MEM_HELPER,
                     gen_empty_mem_helper);
-        /* fall through */
-    case PLUGIN_GEN_FROM_TB:
         gen_wrapped(from, PLUGIN_GEN_CB_UDATA, gen_empty_udata_cb_no_rwg);
         gen_wrapped(from, PLUGIN_GEN_CB_UDATA_R, gen_empty_udata_cb_no_wg);
         gen_wrapped(from, PLUGIN_GEN_CB_INLINE, gen_empty_inline_cb);
@@ -XXX,XX +XXX,XX @@ void plugin_gen_disable_mem_helpers(void)
                    offsetof(CPUState, plugin_mem_cbs) - offsetof(ArchCPU, env));
 }
 
-static void plugin_gen_tb_udata(const struct qemu_plugin_tb *ptb,
-                                TCGOp *begin_op)
-{
-    inject_udata_cb(ptb->cbs[PLUGIN_CB_REGULAR], begin_op);
-}
-
-static void plugin_gen_tb_udata_r(const struct qemu_plugin_tb *ptb,
-                                  TCGOp *begin_op)
-{
-    inject_udata_cb(ptb->cbs[PLUGIN_CB_REGULAR_R], begin_op);
-}
-
-static void plugin_gen_tb_inline(const struct qemu_plugin_tb *ptb,
-                                 TCGOp *begin_op)
-{
-    inject_inline_cb(ptb->cbs[PLUGIN_CB_INLINE], begin_op, op_ok);
-}
-
 static void plugin_gen_insn_udata(const struct qemu_plugin_tb *ptb,
                                   TCGOp *begin_op, int insn_idx)
 {
@@ -XXX,XX +XXX,XX @@ static void gen_disable_mem_helper(struct qemu_plugin_tb *ptb,
     }
 }
 
+static void gen_udata_cb(struct qemu_plugin_dyn_cb *cb)
+{
+    TCGv_i32 cpu_index = tcg_temp_ebb_new_i32();
+
+    tcg_gen_ld_i32(cpu_index, tcg_env,
+                   -offsetof(ArchCPU, env) + offsetof(CPUState, cpu_index));
+    tcg_gen_call2(cb->regular.f.vcpu_udata, cb->regular.info, NULL,
+                  tcgv_i32_temp(cpu_index),
+                  tcgv_ptr_temp(tcg_constant_ptr(cb->userp)));
+    tcg_temp_free_i32(cpu_index);
+}
+
+static void gen_inline_cb(struct qemu_plugin_dyn_cb *cb)
+{
+    GArray *arr = cb->inline_insn.entry.score->data;
+    size_t offset = cb->inline_insn.entry.offset;
+    TCGv_i32 cpu_index = tcg_temp_ebb_new_i32();
+    TCGv_i64 val = tcg_temp_ebb_new_i64();
+    TCGv_ptr ptr = tcg_temp_ebb_new_ptr();
+
+    tcg_gen_ld_i32(cpu_index, tcg_env,
+                   -offsetof(ArchCPU, env) + offsetof(CPUState, cpu_index));
+    tcg_gen_muli_i32(cpu_index, cpu_index, g_array_get_element_size(arr));
+    tcg_gen_ext_i32_ptr(ptr, cpu_index);
+    tcg_temp_free_i32(cpu_index);
+
+    tcg_gen_addi_ptr(ptr, ptr, (intptr_t)arr->data);
+    tcg_gen_ld_i64(val, ptr, offset);
+    tcg_gen_addi_i64(val, val, cb->inline_insn.imm);
+    tcg_gen_st_i64(val, ptr, offset);
+
+    tcg_temp_free_i64(val);
+    tcg_temp_free_ptr(ptr);
+}
+
 /* #define DEBUG_PLUGIN_GEN_OPS */
 static void pr_ops(void)
 {
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
         {
             enum plugin_gen_from from = op->args[0];
             struct qemu_plugin_insn *insn = NULL;
+            const GArray *cbs;
+            int i, n;
 
             if (insn_idx >= 0) {
                 insn = g_ptr_array_index(plugin_tb->insns, insn_idx);
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
                 assert(insn != NULL);
                 gen_disable_mem_helper(plugin_tb, insn);
                 break;
+
+            case PLUGIN_GEN_FROM_TB:
+                assert(insn == NULL);
+
+                cbs = plugin_tb->cbs[PLUGIN_CB_REGULAR];
+                for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
+                    struct qemu_plugin_dyn_cb *cb =
+                        &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
+                    gen_udata_cb(cb);
+                }
+
+                cbs = plugin_tb->cbs[PLUGIN_CB_INLINE];
+                for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
+                    struct qemu_plugin_dyn_cb *cb =
+                        &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
+                    gen_inline_cb(cb);
+                }
+                break;
+
             default:
                 g_assert_not_reached();
             }
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
             enum plugin_gen_cb type = op->args[1];
 
             switch (from) {
-            case PLUGIN_GEN_FROM_TB:
-            {
-                g_assert(insn_idx == -1);
-
-                switch (type) {
-                case PLUGIN_GEN_CB_UDATA:
-                    plugin_gen_tb_udata(plugin_tb, op);
-                    break;
-                case PLUGIN_GEN_CB_UDATA_R:
-                    plugin_gen_tb_udata_r(plugin_tb, op);
-                    break;
-                case PLUGIN_GEN_CB_INLINE:
-                    plugin_gen_tb_inline(plugin_tb, op);
-                    break;
-                default:
-                    g_assert_not_reached();
-                }
-                break;
-            }
             case PLUGIN_GEN_FROM_INSN:
             {
                 g_assert(insn_idx >= 0);
diff --git a/plugins/api.c b/plugins/api.c
index XXXXXXX..XXXXXXX 100644
--- a/plugins/api.c
+++ b/plugins/api.c
@@ -XXX,XX +XXX,XX @@ void qemu_plugin_register_vcpu_tb_exec_cb(struct qemu_plugin_tb *tb,
                                           void *udata)
 {
     if (!tb->mem_only) {
-        int index = flags == QEMU_PLUGIN_CB_R_REGS ||
-                    flags == QEMU_PLUGIN_CB_RW_REGS ?
-                    PLUGIN_CB_REGULAR_R : PLUGIN_CB_REGULAR;
-
-        plugin_register_dyn_cb__udata(&tb->cbs[index],
+        plugin_register_dyn_cb__udata(&tb->cbs[PLUGIN_CB_REGULAR],
                                       cb, flags, udata);
     }
 }
-- 
2.34.1

Delay test of plugin_tb->mem_helper until the inject pass.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/plugin-gen.c | 37 ++++++++++++++++---------------------
 1 file changed, 16 insertions(+), 21 deletions(-)

diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/plugin-gen.c
+++ b/accel/tcg/plugin-gen.c
@@ -XXX,XX +XXX,XX @@ enum plugin_gen_from {
     PLUGIN_GEN_FROM_INSN,
     PLUGIN_GEN_FROM_MEM,
     PLUGIN_GEN_AFTER_INSN,
+    PLUGIN_GEN_AFTER_TB,
     PLUGIN_GEN_N_FROMS,
 };
 
@@ -XXX,XX +XXX,XX @@ static void inject_mem_enable_helper(struct qemu_plugin_tb *ptb,
 /* called before finishing a TB with exit_tb, goto_tb or goto_ptr */
 void plugin_gen_disable_mem_helpers(void)
 {
-    /*
-     * We could emit the clearing unconditionally and be done. However, this can
-     * be wasteful if for instance plugins don't track memory accesses, or if
-     * most TBs don't use helpers. Instead, emit the clearing iff the TB calls
-     * helpers that might access guest memory.
-     *
-     * Note: we do not reset plugin_tb->mem_helper here; a TB might have several
-     * exit points, and we want to emit the clearing from all of them.
-     */
-    if (!tcg_ctx->plugin_tb->mem_helper) {
-        return;
+    if (tcg_ctx->plugin_insn) {
+        tcg_gen_plugin_cb(PLUGIN_GEN_AFTER_TB);
     }
-    tcg_gen_st_ptr(tcg_constant_ptr(NULL), tcg_env,
-                   offsetof(CPUState, plugin_mem_cbs) - offsetof(ArchCPU, env));
 }
 
 static void plugin_gen_insn_udata(const struct qemu_plugin_tb *ptb,
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_enable_mem_helper(struct qemu_plugin_tb *ptb,
     inject_mem_enable_helper(ptb, insn, begin_op);
 }
 
-static void gen_disable_mem_helper(struct qemu_plugin_tb *ptb,
-                                   struct qemu_plugin_insn *insn)
+static void gen_disable_mem_helper(void)
 {
-    if (insn->mem_helper) {
-        tcg_gen_st_ptr(tcg_constant_ptr(0), tcg_env,
-                       offsetof(CPUState, plugin_mem_cbs) -
-                       offsetof(ArchCPU, env));
-    }
+    tcg_gen_st_ptr(tcg_constant_ptr(0), tcg_env,
+                   offsetof(CPUState, plugin_mem_cbs) -
+                   offsetof(ArchCPU, env));
 }
 
 static void gen_udata_cb(struct qemu_plugin_dyn_cb *cb)
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
             tcg_ctx->emit_before_op = op;
 
             switch (from) {
+            case PLUGIN_GEN_AFTER_TB:
+                if (plugin_tb->mem_helper) {
+                    gen_disable_mem_helper();
+                }
+                break;
+
             case PLUGIN_GEN_AFTER_INSN:
                 assert(insn != NULL);
-                gen_disable_mem_helper(plugin_tb, insn);
+                if (insn->mem_helper) {
+                    gen_disable_mem_helper();
+                }
                 break;
 
             case PLUGIN_GEN_FROM_TB:
-- 
2.34.1

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/qemu/plugin.h  |   1 -
 accel/tcg/plugin-gen.c | 286 ++++++++++-------------------------------
 plugins/api.c          |   8 +-
 3 files changed, 67 insertions(+), 228 deletions(-)

diff --git a/include/qemu/plugin.h b/include/qemu/plugin.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/plugin.h
+++ b/include/qemu/plugin.h
@@ -XXX,XX +XXX,XX @@ enum plugin_dyn_cb_type {
 
 enum plugin_dyn_cb_subtype {
     PLUGIN_CB_REGULAR,
-    PLUGIN_CB_REGULAR_R,
     PLUGIN_CB_INLINE,
     PLUGIN_N_CB_SUBTYPES,
 };
diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/plugin-gen.c
+++ b/accel/tcg/plugin-gen.c
@@ -XXX,XX +XXX,XX @@ void HELPER(plugin_vcpu_mem_cb)(unsigned int vcpu_index,
                                 void *userdata)
 { }
 
-static void gen_empty_udata_cb(void (*gen_helper)(TCGv_i32, TCGv_ptr))
-{
-    TCGv_i32 cpu_index = tcg_temp_ebb_new_i32();
-    TCGv_ptr udata = tcg_temp_ebb_new_ptr();
-
-    tcg_gen_movi_ptr(udata, 0);
-    tcg_gen_ld_i32(cpu_index, tcg_env,
-                   -offsetof(ArchCPU, env) + offsetof(CPUState, cpu_index));
-    gen_helper(cpu_index, udata);
-
-    tcg_temp_free_ptr(udata);
-    tcg_temp_free_i32(cpu_index);
-}
-
-static void gen_empty_udata_cb_no_wg(void)
-{
-    gen_empty_udata_cb(gen_helper_plugin_vcpu_udata_cb_no_wg);
-}
-
-static void gen_empty_udata_cb_no_rwg(void)
-{
-    gen_empty_udata_cb(gen_helper_plugin_vcpu_udata_cb_no_rwg);
-}
-
 /*
  * For now we only support addi_i64.
  * When we support more ops, we can generate one empty inline cb for each.
@@ -XXX,XX +XXX,XX @@ static void gen_empty_mem_cb(TCGv_i64 addr, uint32_t info)
     tcg_temp_free_i32(cpu_index);
 }
 
-/*
- * Share the same function for enable/disable. When enabling, the NULL
- * pointer will be overwritten later.
- */
-static void gen_empty_mem_helper(void)
-{
-    TCGv_ptr ptr = tcg_temp_ebb_new_ptr();
-
-    tcg_gen_movi_ptr(ptr, 0);
-    tcg_gen_st_ptr(ptr, tcg_env, offsetof(CPUState, plugin_mem_cbs) -
-                                 offsetof(ArchCPU, env));
-    tcg_temp_free_ptr(ptr);
-}
-
 static void gen_plugin_cb_start(enum plugin_gen_from from,
                                 enum plugin_gen_cb type, unsigned wr)
 {
     tcg_gen_plugin_cb_start(from, type, wr);
 }
 
-static void gen_wrapped(enum plugin_gen_from from,
-                        enum plugin_gen_cb type, void (*func)(void))
-{
-    gen_plugin_cb_start(from, type, 0);
-    func();
-    tcg_gen_plugin_cb_end();
-}
-
 static void plugin_gen_empty_callback(enum plugin_gen_from from)
 {
     switch (from) {
     case PLUGIN_GEN_AFTER_INSN:
     case PLUGIN_GEN_FROM_TB:
-        tcg_gen_plugin_cb(from);
-        break;
     case PLUGIN_GEN_FROM_INSN:
-        /*
-         * Note: plugin_gen_inject() relies on ENABLE_MEM_HELPER being
-         * the first callback of an instruction
-         */
-        gen_wrapped(from, PLUGIN_GEN_ENABLE_MEM_HELPER,
-                    gen_empty_mem_helper);
-        gen_wrapped(from, PLUGIN_GEN_CB_UDATA, gen_empty_udata_cb_no_rwg);
-        gen_wrapped(from, PLUGIN_GEN_CB_UDATA_R, gen_empty_udata_cb_no_wg);
-        gen_wrapped(from, PLUGIN_GEN_CB_INLINE, gen_empty_inline_cb);
+        tcg_gen_plugin_cb(from);
         break;
     default:
         g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ static TCGOp *copy_mul_i32(TCGOp **begin_op, TCGOp *op, uint32_t v)
     return op;
 }
 
-static TCGOp *copy_st_ptr(TCGOp **begin_op, TCGOp *op)
-{
-    if (UINTPTR_MAX == UINT32_MAX) {
-        /* st_i32 */
-        op = copy_op(begin_op, op, INDEX_op_st_i32);
-    } else {
-        /* st_i64 */
-        op = copy_st_i64(begin_op, op);
-    }
-    return op;
-}
-
 static TCGOp *copy_call(TCGOp **begin_op, TCGOp *op, void *func, int *cb_idx)
 {
     TCGOp *old_op;
@@ -XXX,XX +XXX,XX @@ static TCGOp *copy_call(TCGOp **begin_op, TCGOp *op, void *func, int *cb_idx)
     return op;
 }
 
-/*
- * When we append/replace ops here we are sensitive to changing patterns of
- * TCGOps generated by the tcg_gen_FOO calls when we generated the
- * empty callbacks. This will assert very quickly in a debug build as
- * we assert the ops we are replacing are the correct ones.
- */
-static TCGOp *append_udata_cb(const struct qemu_plugin_dyn_cb *cb,
-                              TCGOp *begin_op, TCGOp *op, int *cb_idx)
-{
-    /* const_ptr */
-    op = copy_const_ptr(&begin_op, op, cb->userp);
-
-    /* copy the ld_i32, but note that we only have to copy it once */
-    if (*cb_idx == -1) {
-        op = copy_op(&begin_op, op, INDEX_op_ld_i32);
-    } else {
-        begin_op = QTAILQ_NEXT(begin_op, link);
-        tcg_debug_assert(begin_op && begin_op->opc == INDEX_op_ld_i32);
-    }
-
-    /* call */
-    op = copy_call(&begin_op, op, cb->regular.f.vcpu_udata, cb_idx);
-
-    return op;
-}
-
 static TCGOp *append_inline_cb(const struct qemu_plugin_dyn_cb *cb,
                                TCGOp *begin_op, TCGOp *op,
                                int *unused)
@@ -XXX,XX +XXX,XX @@ typedef TCGOp *(*inject_fn)(const struct qemu_plugin_dyn_cb *cb,
                             TCGOp *begin_op, TCGOp *op, int *intp);
 typedef bool (*op_ok_fn)(const TCGOp *op, const struct qemu_plugin_dyn_cb *cb);
 
-static bool op_ok(const TCGOp *op, const struct qemu_plugin_dyn_cb *cb)
-{
-    return true;
-}
-
 static bool op_rw(const TCGOp *op, const struct qemu_plugin_dyn_cb *cb)
 {
     int w;
@@ -XXX,XX +XXX,XX @@ static void inject_cb_type(const GArray *cbs, TCGOp *begin_op,
     rm_ops_range(begin_op, end_op);
 }
 
-static void
-inject_udata_cb(const GArray *cbs, TCGOp *begin_op)
-{
-    inject_cb_type(cbs, begin_op, append_udata_cb, op_ok);
-}
-
 static void
 inject_inline_cb(const GArray *cbs, TCGOp *begin_op, op_ok_fn ok)
 {
@@ -XXX,XX +XXX,XX @@ inject_mem_cb(const GArray *cbs, TCGOp *begin_op)
     inject_cb_type(cbs, begin_op, append_mem_cb, op_rw);
 }
 
-/* we could change the ops in place, but we can reuse more code by copying */
-static void inject_mem_helper(TCGOp *begin_op, GArray *arr)
-{
-    TCGOp *orig_op = begin_op;
-    TCGOp *end_op;
-    TCGOp *op;
-
-    end_op = find_op(begin_op, INDEX_op_plugin_cb_end);
-    tcg_debug_assert(end_op);
-
-    /* const ptr */
-    op = copy_const_ptr(&begin_op, end_op, arr);
-
-    /* st_ptr */
-    op = copy_st_ptr(&begin_op, op);
-
-    rm_ops_range(orig_op, end_op);
-}
-
-/*
- * Tracking memory accesses performed from helpers requires extra work.
- * If an instruction is emulated with helpers, we do two things:
- * (1) copy the CB descriptors, and keep track of it so that they can be
- * freed later on, and (2) point CPUState.plugin_mem_cbs to the descriptors, so
- * that we can read them at run-time (i.e. when the helper executes).
- * This run-time access is performed from qemu_plugin_vcpu_mem_cb.
- *
- * Note that plugin_gen_disable_mem_helpers undoes (2). Since it
- * is possible that the code we generate after the instruction is
- * dead, we also add checks before generating tb_exit etc.
- */
-static void inject_mem_enable_helper(struct qemu_plugin_tb *ptb,
-                                     struct qemu_plugin_insn *plugin_insn,
-                                     TCGOp *begin_op)
-{
-    GArray *cbs[2];
-    GArray *arr;
-    size_t n_cbs, i;
-
-    cbs[0] = plugin_insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_REGULAR];
-    cbs[1] = plugin_insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_INLINE];
-
-    n_cbs = 0;
-    for (i = 0; i < ARRAY_SIZE(cbs); i++) {
-        n_cbs += cbs[i]->len;
-    }
-
-    plugin_insn->mem_helper = plugin_insn->calls_helpers && n_cbs;
-    if (likely(!plugin_insn->mem_helper)) {
-        rm_ops(begin_op);
-        return;
-    }
-    ptb->mem_helper = true;
-
-    arr = g_array_sized_new(false, false,
-                            sizeof(struct qemu_plugin_dyn_cb), n_cbs);
-
-    for (i = 0; i < ARRAY_SIZE(cbs); i++) {
-        g_array_append_vals(arr, cbs[i]->data, cbs[i]->len);
-    }
-
-    qemu_plugin_add_dyn_cb_arr(arr);
-    inject_mem_helper(begin_op, arr);
-}
-
 /* called before finishing a TB with exit_tb, goto_tb or goto_ptr */
 void plugin_gen_disable_mem_helpers(void)
 {
@@ -XXX,XX +XXX,XX @@ void plugin_gen_disable_mem_helpers(void)
     }
 }
 
-static void plugin_gen_insn_udata(const struct qemu_plugin_tb *ptb,
-                                  TCGOp *begin_op, int insn_idx)
-{
-    struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
-
-    inject_udata_cb(insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_REGULAR], begin_op);
-}
-
-static void plugin_gen_insn_udata_r(const struct qemu_plugin_tb *ptb,
-                                    TCGOp *begin_op, int insn_idx)
-{
-    struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
-
-    inject_udata_cb(insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_REGULAR_R], begin_op);
-}
-
-static void plugin_gen_insn_inline(const struct qemu_plugin_tb *ptb,
-                                   TCGOp *begin_op, int insn_idx)
-{
-    struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
-    inject_inline_cb(insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_INLINE],
-                     begin_op, op_ok);
-}
-
 static void plugin_gen_mem_regular(const struct qemu_plugin_tb *ptb,
                                    TCGOp *begin_op, int insn_idx)
 {
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_mem_inline(const struct qemu_plugin_tb *ptb,
     inject_inline_cb(cbs, begin_op, op_rw);
 }
 
-static void plugin_gen_enable_mem_helper(struct qemu_plugin_tb *ptb,
-                                         TCGOp *begin_op, int insn_idx)
+static void gen_enable_mem_helper(struct qemu_plugin_tb *ptb,
+                                  struct qemu_plugin_insn *insn)
 {
-    struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
-    inject_mem_enable_helper(ptb, insn, begin_op);
+    GArray *cbs[2];
+    GArray *arr;
+    size_t n_cbs;
+
+    /*
+     * Tracking memory accesses performed from helpers requires extra work.
+     * If an instruction is emulated with helpers, we do two things:
+     * (1) copy the CB descriptors, and keep track of it so that they can be
+     * freed later on, and (2) point CPUState.plugin_mem_cbs to the
+     * descriptors, so that we can read them at run-time
+     * (i.e. when the helper executes).
+     * This run-time access is performed from qemu_plugin_vcpu_mem_cb.
+     *
+     * Note that plugin_gen_disable_mem_helpers undoes (2). Since it
+     * is possible that the code we generate after the instruction is
+     * dead, we also add checks before generating tb_exit etc.
+     */
+    if (!insn->calls_helpers) {
+        return;
+    }
+
+    cbs[0] = insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_REGULAR];
+    cbs[1] = insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_INLINE];
+    n_cbs = cbs[0]->len + cbs[1]->len;
+
+    if (n_cbs == 0) {
+        insn->mem_helper = false;
+        return;
+    }
+    insn->mem_helper = true;
+    ptb->mem_helper = true;
+
+    arr = g_array_sized_new(false, false,
+                            sizeof(struct qemu_plugin_dyn_cb), n_cbs);
+    g_array_append_vals(arr, cbs[0]->data, cbs[0]->len);
+    g_array_append_vals(arr, cbs[1]->data, cbs[1]->len);
+
+    qemu_plugin_add_dyn_cb_arr(arr);
+
+    tcg_gen_st_ptr(tcg_constant_ptr((intptr_t)arr), tcg_env,
+                   offsetof(CPUState, plugin_mem_cbs) -
+                   offsetof(ArchCPU, env));
 }
 
 static void gen_disable_mem_helper(void)
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
                 }
                 break;
 
+            case PLUGIN_GEN_FROM_INSN:
+                assert(insn != NULL);
+
+                gen_enable_mem_helper(plugin_tb, insn);
+
+                cbs = insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_REGULAR];
+                for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
+                    struct qemu_plugin_dyn_cb *cb =
+                        &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
+                    gen_udata_cb(cb);
+                }
+
+                cbs = insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_INLINE];
+                for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
+                    struct qemu_plugin_dyn_cb *cb =
+                        &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
+                    gen_inline_cb(cb);
+                }
+                break;
+
             default:
                 g_assert_not_reached();
             }
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
             enum plugin_gen_cb type = op->args[1];
 
             switch (from) {
-            case PLUGIN_GEN_FROM_INSN:
-            {
-                g_assert(insn_idx >= 0);
-
-                switch (type) {
-                case PLUGIN_GEN_CB_UDATA:
-                    plugin_gen_insn_udata(plugin_tb, op, insn_idx);
-                    break;
-                case PLUGIN_GEN_CB_UDATA_R:
-                    plugin_gen_insn_udata_r(plugin_tb, op, insn_idx);
-                    break;
-                case PLUGIN_GEN_CB_INLINE:
-                    plugin_gen_insn_inline(plugin_tb, op, insn_idx);
-                    break;
-                case PLUGIN_GEN_ENABLE_MEM_HELPER:
-                    plugin_gen_enable_mem_helper(plugin_tb, op, insn_idx);
-                    break;
-                default:
-                    g_assert_not_reached();
-                }
-                break;
-            }
             case PLUGIN_GEN_FROM_MEM:
             {
                 g_assert(insn_idx >= 0);
diff --git a/plugins/api.c b/plugins/api.c
index XXXXXXX..XXXXXXX 100644
--- a/plugins/api.c
+++ b/plugins/api.c
@@ -XXX,XX +XXX,XX @@ void qemu_plugin_register_vcpu_insn_exec_cb(struct qemu_plugin_insn *insn,
                                             void *udata)
 {
     if (!insn->mem_only) {
-        int index = flags == QEMU_PLUGIN_CB_R_REGS ||
-                    flags == QEMU_PLUGIN_CB_RW_REGS ?
-                    PLUGIN_CB_REGULAR_R : PLUGIN_CB_REGULAR;
-
-        plugin_register_dyn_cb__udata(&insn->cbs[PLUGIN_CB_INSN][index],
-                                      cb, flags, udata);
+        plugin_register_dyn_cb__udata(
+            &insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_REGULAR], cb, flags, udata);
     }
 }
 
-- 
2.34.1

Introduce a new plugin_mem_cb op to hold the address temp
and meminfo computed by tcg-op-ldst.c.  Because this now
has its own opcode, we no longer need PLUGIN_GEN_FROM_MEM.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/plugin-gen.h   |   4 -
 include/tcg/tcg-op-common.h |   1 +
 include/tcg/tcg-opc.h       |   1 +
 accel/tcg/plugin-gen.c      | 408 ++++--------------------------------
 tcg/tcg-op-ldst.c           |   6 +-
 tcg/tcg-op.c                |   5 +
 6 files changed, 54 insertions(+), 371 deletions(-)

diff --git a/include/exec/plugin-gen.h b/include/exec/plugin-gen.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/plugin-gen.h
+++ b/include/exec/plugin-gen.h
@@ -XXX,XX +XXX,XX @@ void plugin_gen_insn_start(CPUState *cpu, const struct DisasContextBase *db);
 void plugin_gen_insn_end(void);
 
 void plugin_gen_disable_mem_helpers(void);
-void plugin_gen_empty_mem_callback(TCGv_i64 addr, uint32_t info);
 
 #else /* !CONFIG_PLUGIN */
 
@@ -XXX,XX +XXX,XX @@ static inline void plugin_gen_tb_end(CPUState *cpu, size_t num_insns)
 static inline void plugin_gen_disable_mem_helpers(void)
 { }
 
-static inline void plugin_gen_empty_mem_callback(TCGv_i64 addr, uint32_t info)
-{ }
-
 #endif /* CONFIG_PLUGIN */
 
 #endif /* QEMU_PLUGIN_GEN_H */
diff --git a/include/tcg/tcg-op-common.h b/include/tcg/tcg-op-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg-op-common.h
+++ b/include/tcg/tcg-op-common.h
@@ -XXX,XX +XXX,XX @@ void tcg_gen_goto_tb(unsigned idx);
 void tcg_gen_lookup_and_goto_ptr(void);
 
 void tcg_gen_plugin_cb(unsigned from);
+void tcg_gen_plugin_mem_cb(TCGv_i64 addr, unsigned meminfo);
 void tcg_gen_plugin_cb_start(unsigned from, unsigned type, unsigned wr);
 void tcg_gen_plugin_cb_end(void);
 
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -XXX,XX +XXX,XX @@ DEF(goto_tb, 0, 0, 1, TCG_OPF_BB_EXIT | TCG_OPF_BB_END)
 DEF(goto_ptr, 0, 1, 0, TCG_OPF_BB_EXIT | TCG_OPF_BB_END)
 
 DEF(plugin_cb, 0, 0, 1, TCG_OPF_NOT_PRESENT)
+DEF(plugin_mem_cb, 0, 1, 1, TCG_OPF_NOT_PRESENT)
 DEF(plugin_cb_start, 0, 0, 3, TCG_OPF_NOT_PRESENT)
 DEF(plugin_cb_end, 0, 0, 0, TCG_OPF_NOT_PRESENT)
 
diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/plugin-gen.c
+++ b/accel/tcg/plugin-gen.c
@@ -XXX,XX +XXX,XX @@
 enum plugin_gen_from {
     PLUGIN_GEN_FROM_TB,
     PLUGIN_GEN_FROM_INSN,
-    PLUGIN_GEN_FROM_MEM,
     PLUGIN_GEN_AFTER_INSN,
     PLUGIN_GEN_AFTER_TB,
     PLUGIN_GEN_N_FROMS,
@@ -XXX,XX +XXX,XX @@ void HELPER(plugin_vcpu_mem_cb)(unsigned int vcpu_index,
                                 void *userdata)
 { }
 
-/*
- * For now we only support addi_i64.
- * When we support more ops, we can generate one empty inline cb for each.
- */
-static void gen_empty_inline_cb(void)
-{
-    TCGv_i32 cpu_index = tcg_temp_ebb_new_i32();
-    TCGv_ptr cpu_index_as_ptr = tcg_temp_ebb_new_ptr();
-    TCGv_i64 val = tcg_temp_ebb_new_i64();
-    TCGv_ptr ptr = tcg_temp_ebb_new_ptr();
-
-    tcg_gen_ld_i32(cpu_index, tcg_env,
-                   -offsetof(ArchCPU, env) + offsetof(CPUState, cpu_index));
-    /* second operand will be replaced by immediate value */
-    tcg_gen_mul_i32(cpu_index, cpu_index, cpu_index);
-    tcg_gen_ext_i32_ptr(cpu_index_as_ptr, cpu_index);
-
-    tcg_gen_movi_ptr(ptr, 0);
-    tcg_gen_add_ptr(ptr, ptr, cpu_index_as_ptr);
-    tcg_gen_ld_i64(val, ptr, 0);
-    /* second operand will be replaced by immediate value */
-    tcg_gen_add_i64(val, val, val);
-
-    tcg_gen_st_i64(val, ptr, 0);
-    tcg_temp_free_ptr(ptr);
-    tcg_temp_free_i64(val);
-    tcg_temp_free_ptr(cpu_index_as_ptr);
-    tcg_temp_free_i32(cpu_index);
-}
-
-static void gen_empty_mem_cb(TCGv_i64 addr, uint32_t info)
-{
-    TCGv_i32 cpu_index = tcg_temp_ebb_new_i32();
-    TCGv_i32 meminfo = tcg_temp_ebb_new_i32();
-    TCGv_ptr udata = tcg_temp_ebb_new_ptr();
-
-    tcg_gen_movi_i32(meminfo, info);
-    tcg_gen_movi_ptr(udata, 0);
-    tcg_gen_ld_i32(cpu_index, tcg_env,
-                   -offsetof(ArchCPU, env) + offsetof(CPUState, cpu_index));
-
-    gen_helper_plugin_vcpu_mem_cb(cpu_index, meminfo, addr, udata);
-
-    tcg_temp_free_ptr(udata);
-    tcg_temp_free_i32(meminfo);
-    tcg_temp_free_i32(cpu_index);
-}
-
-static void gen_plugin_cb_start(enum plugin_gen_from from,
-                                enum plugin_gen_cb type, unsigned wr)
-{
-    tcg_gen_plugin_cb_start(from, type, wr);
-}
-
 static void plugin_gen_empty_callback(enum plugin_gen_from from)
 {
     switch (from) {
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_empty_callback(enum plugin_gen_from from)
     }
 }
 
-void plugin_gen_empty_mem_callback(TCGv_i64 addr, uint32_t info)
-{
-    enum qemu_plugin_mem_rw rw = get_plugin_meminfo_rw(info);
-
-    gen_plugin_cb_start(PLUGIN_GEN_FROM_MEM, PLUGIN_GEN_CB_MEM, rw);
-    gen_empty_mem_cb(addr, info);
-    tcg_gen_plugin_cb_end();
-
-    gen_plugin_cb_start(PLUGIN_GEN_FROM_MEM, PLUGIN_GEN_CB_INLINE, rw);
-    gen_empty_inline_cb();
-    tcg_gen_plugin_cb_end();
-}
-
-static TCGOp *find_op(TCGOp *op, TCGOpcode opc)
-{
-    while (op) {
-        if (op->opc == opc) {
-            return op;
-        }
-        op = QTAILQ_NEXT(op, link);
-    }
-    return NULL;
-}
-
-static TCGOp *rm_ops_range(TCGOp *begin, TCGOp *end)
-{
-    TCGOp *ret = QTAILQ_NEXT(end, link);
-
-    QTAILQ_REMOVE_SEVERAL(&tcg_ctx->ops, begin, end, link);
-    return ret;
-}
-
-/* remove all ops until (and including) plugin_cb_end */
-static TCGOp *rm_ops(TCGOp *op)
-{
-    TCGOp *end_op = find_op(op, INDEX_op_plugin_cb_end);
-
-    tcg_debug_assert(end_op);
-    return rm_ops_range(op, end_op);
-}
-
-static TCGOp *copy_op_nocheck(TCGOp **begin_op, TCGOp *op)
-{
-    TCGOp *old_op = QTAILQ_NEXT(*begin_op, link);
-    unsigned nargs = old_op->nargs;
-
-    *begin_op = old_op;
-    op = tcg_op_insert_after(tcg_ctx, op, old_op->opc, nargs);
-    memcpy(op->args, old_op->args, sizeof(op->args[0]) * nargs);
-
-    return op;
-}
-
-static TCGOp *copy_op(TCGOp **begin_op, TCGOp *op, TCGOpcode opc)
-{
-    op = copy_op_nocheck(begin_op, op);
-    tcg_debug_assert((*begin_op)->opc == opc);
-    return op;
-}
-
-static TCGOp *copy_const_ptr(TCGOp **begin_op, TCGOp *op, void *ptr)
-{
-    if (UINTPTR_MAX == UINT32_MAX) {
-        /* mov_i32 */
-        op = copy_op(begin_op, op, INDEX_op_mov_i32);
-        op->args[1] = tcgv_i32_arg(tcg_constant_i32((uintptr_t)ptr));
-    } else {
-        /* mov_i64 */
-        op = copy_op(begin_op, op, INDEX_op_mov_i64);
-        op->args[1] = tcgv_i64_arg(tcg_constant_i64((uintptr_t)ptr));
-    }
-    return op;
-}
-
-static TCGOp *copy_ld_i32(TCGOp **begin_op, TCGOp *op)
-{
-    return copy_op(begin_op, op, INDEX_op_ld_i32);
-}
-
-static TCGOp *copy_ext_i32_ptr(TCGOp **begin_op, TCGOp *op)
-{
-    if (UINTPTR_MAX == UINT32_MAX) {
-        op = copy_op(begin_op, op, INDEX_op_mov_i32);
-    } else {
-        op = copy_op(begin_op, op, INDEX_op_ext_i32_i64);
-    }
-    return op;
-}
-
-static TCGOp *copy_add_ptr(TCGOp **begin_op, TCGOp *op)
-{
-    if (UINTPTR_MAX == UINT32_MAX) {
-        op = copy_op(begin_op, op, INDEX_op_add_i32);
-    } else {
-        op = copy_op(begin_op, op, INDEX_op_add_i64);
-    }
-    return op;
-}
-
-static TCGOp *copy_ld_i64(TCGOp **begin_op, TCGOp *op)
-{
-    if (TCG_TARGET_REG_BITS == 32) {
-        /* 2x ld_i32 */
-        op = copy_ld_i32(begin_op, op);
-        op = copy_ld_i32(begin_op, op);
-    } else {
-        /* ld_i64 */
-        op = copy_op(begin_op, op, INDEX_op_ld_i64);
-    }
-    return op;
-}
-
-static TCGOp *copy_st_i64(TCGOp **begin_op, TCGOp *op)
-{
-    if (TCG_TARGET_REG_BITS == 32) {
-        /* 2x st_i32 */
-        op = copy_op(begin_op, op, INDEX_op_st_i32);
-        op = copy_op(begin_op, op, INDEX_op_st_i32);
-    } else {
-        /* st_i64 */
-        op = copy_op(begin_op, op, INDEX_op_st_i64);
-    }
-    return op;
-}
-
-static TCGOp *copy_add_i64(TCGOp **begin_op, TCGOp *op, uint64_t v)
-{
-    if (TCG_TARGET_REG_BITS == 32) {
-        /* all 32-bit backends must implement add2_i32 */
-        g_assert(TCG_TARGET_HAS_add2_i32);
-        op = copy_op(begin_op, op, INDEX_op_add2_i32);
-        op->args[4] = tcgv_i32_arg(tcg_constant_i32(v));
-        op->args[5] = tcgv_i32_arg(tcg_constant_i32(v >> 32));
-    } else {
-        op = copy_op(begin_op, op, INDEX_op_add_i64);
-        op->args[2] = tcgv_i64_arg(tcg_constant_i64(v));
-    }
-    return op;
-}
-
-static TCGOp *copy_mul_i32(TCGOp **begin_op, TCGOp *op, uint32_t v)
-{
-    op = copy_op(begin_op, op, INDEX_op_mul_i32);
-    op->args[2] = tcgv_i32_arg(tcg_constant_i32(v));
-    return op;
-}
-
-static TCGOp *copy_call(TCGOp **begin_op, TCGOp *op, void *func, int *cb_idx)
-{
-    TCGOp *old_op;
-    int func_idx;
-
-    /* copy all ops until the call */
-    do {
-        op = copy_op_nocheck(begin_op, op);
-    } while (op->opc != INDEX_op_call);
-
-    /* fill in the op call */
-    old_op = *begin_op;
-    TCGOP_CALLI(op) = TCGOP_CALLI(old_op);
-    TCGOP_CALLO(op) = TCGOP_CALLO(old_op);
-    tcg_debug_assert(op->life == 0);
-
-    func_idx = TCGOP_CALLO(op) + TCGOP_CALLI(op);
-    *cb_idx = func_idx;
-    op->args[func_idx] = (uintptr_t)func;
-
-    return op;
-}
-
-static TCGOp *append_inline_cb(const struct qemu_plugin_dyn_cb *cb,
-                               TCGOp *begin_op, TCGOp *op,
-                               int *unused)
-{
-    char *ptr = cb->inline_insn.entry.score->data->data;
-    size_t elem_size = g_array_get_element_size(
-        cb->inline_insn.entry.score->data);
-    size_t offset = cb->inline_insn.entry.offset;
-
-    op = copy_ld_i32(&begin_op, op);
-    op = copy_mul_i32(&begin_op, op, elem_size);
-    op = copy_ext_i32_ptr(&begin_op, op);
-    op = copy_const_ptr(&begin_op, op, ptr + offset);
-    op = copy_add_ptr(&begin_op, op);
-    op = copy_ld_i64(&begin_op, op);
-    op = copy_add_i64(&begin_op, op, cb->inline_insn.imm);
-    op = copy_st_i64(&begin_op, op);
-    return op;
-}
-
-static TCGOp *append_mem_cb(const struct qemu_plugin_dyn_cb *cb,
-                            TCGOp *begin_op, TCGOp *op, int *cb_idx)
-{
-    enum plugin_gen_cb type = begin_op->args[1];
-
-    tcg_debug_assert(type == PLUGIN_GEN_CB_MEM);
-
-    /* const_i32 == mov_i32 ("info", so it remains as is) */
-    op = copy_op(&begin_op, op, INDEX_op_mov_i32);
-
-    /* const_ptr */
-    op = copy_const_ptr(&begin_op, op, cb->userp);
-
-    /* copy the ld_i32, but note that we only have to copy it once */
-    if (*cb_idx == -1) {
-        op = copy_op(&begin_op, op, INDEX_op_ld_i32);
-    } else {
-        begin_op = QTAILQ_NEXT(begin_op, link);
-        tcg_debug_assert(begin_op && begin_op->opc == INDEX_op_ld_i32);
-    }
-
-    if (type == PLUGIN_GEN_CB_MEM) {
-        /* call */
-        op = copy_call(&begin_op, op, cb->regular.f.vcpu_udata, cb_idx);
-    }
-
-    return op;
-}
-
-typedef TCGOp *(*inject_fn)(const struct qemu_plugin_dyn_cb *cb,
-                            TCGOp *begin_op, TCGOp *op, int *intp);
-typedef bool (*op_ok_fn)(const TCGOp *op, const struct qemu_plugin_dyn_cb *cb);
-
-static bool op_rw(const TCGOp *op, const struct qemu_plugin_dyn_cb *cb)
-{
-    int w;
-
-    w = op->args[2];
-    return !!(cb->rw & (w + 1));
-}
-
-static void inject_cb_type(const GArray *cbs, TCGOp *begin_op,
-                           inject_fn inject, op_ok_fn ok)
-{
-    TCGOp *end_op;
-    TCGOp *op;
-    int cb_idx = -1;
-    int i;
-
-    if (!cbs || cbs->len == 0) {
-        rm_ops(begin_op);
-        return;
-    }
-
-    end_op = find_op(begin_op, INDEX_op_plugin_cb_end);
-    tcg_debug_assert(end_op);
-
-    op = end_op;
-    for (i = 0; i < cbs->len; i++) {
-        struct qemu_plugin_dyn_cb *cb =
-            &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
-
-        if (!ok(begin_op, cb)) {
-            continue;
-        }
-        op = inject(cb, begin_op, op, &cb_idx);
-    }
-    rm_ops_range(begin_op, end_op);
-}
-
-static void
-inject_inline_cb(const GArray *cbs, TCGOp *begin_op, op_ok_fn ok)
-{
-    inject_cb_type(cbs, begin_op, append_inline_cb, ok);
-}
-
-static void
-inject_mem_cb(const GArray *cbs, TCGOp *begin_op)
-{
-    inject_cb_type(cbs, begin_op, append_mem_cb, op_rw);
-}
-
 /* called before finishing a TB with exit_tb, goto_tb or goto_ptr */
 void plugin_gen_disable_mem_helpers(void)
 {
@@ -XXX,XX +XXX,XX @@ void plugin_gen_disable_mem_helpers(void)
     }
 }
 
-static void plugin_gen_mem_regular(const struct qemu_plugin_tb *ptb,
-                                   TCGOp *begin_op, int insn_idx)
-{
-    struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
-    inject_mem_cb(insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_REGULAR], begin_op);
-}
-
-static void plugin_gen_mem_inline(const struct qemu_plugin_tb *ptb,
-                                  TCGOp *begin_op, int insn_idx)
-{
-    const GArray *cbs;
-    struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
-
-    cbs = insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_INLINE];
-    inject_inline_cb(cbs, begin_op, op_rw);
-}
-
 static void gen_enable_mem_helper(struct qemu_plugin_tb *ptb,
                                   struct qemu_plugin_insn *insn)
 {
@@ -XXX,XX +XXX,XX @@ static void gen_inline_cb(struct qemu_plugin_dyn_cb *cb)
     tcg_temp_free_ptr(ptr);
 }
 
+static void gen_mem_cb(struct qemu_plugin_dyn_cb *cb,
+                       qemu_plugin_meminfo_t meminfo, TCGv_i64 addr)
+{
+    TCGv_i32 cpu_index = tcg_temp_ebb_new_i32();
+
+    tcg_gen_ld_i32(cpu_index, tcg_env,
+                   -offsetof(ArchCPU, env) + offsetof(CPUState, cpu_index));
+    tcg_gen_call4(cb->regular.f.vcpu_mem, cb->regular.info, NULL,
+                  tcgv_i32_temp(cpu_index),
+                  tcgv_i32_temp(tcg_constant_i32(meminfo)),
+                  tcgv_i64_temp(addr),
+                  tcgv_ptr_temp(tcg_constant_ptr(cb->userp)));
+    tcg_temp_free_i32(cpu_index);
+}
+
 /* #define DEBUG_PLUGIN_GEN_OPS */
 static void pr_ops(void)
 {
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
             break;
         }
 
-        case INDEX_op_plugin_cb_start:
+        case INDEX_op_plugin_mem_cb:
         {
-            enum plugin_gen_from from = op->args[0];
-            enum plugin_gen_cb type = op->args[1];
+            TCGv_i64 addr = temp_tcgv_i64(arg_temp(op->args[0]));
+            qemu_plugin_meminfo_t meminfo = op->args[1];
+            struct qemu_plugin_insn *insn;
+            const GArray *cbs;
+            int i, n, rw;
 
-            switch (from) {
-            case PLUGIN_GEN_FROM_MEM:
-            {
-                g_assert(insn_idx >= 0);
+            assert(insn_idx >= 0);
+            insn = g_ptr_array_index(plugin_tb->insns, insn_idx);
+            rw = qemu_plugin_mem_is_store(meminfo) ? 2 : 1;
 
-                switch (type) {
-                case PLUGIN_GEN_CB_MEM:
-                    plugin_gen_mem_regular(plugin_tb, op, insn_idx);
-                    break;
-                case PLUGIN_GEN_CB_INLINE:
-                    plugin_gen_mem_inline(plugin_tb, op, insn_idx);
-                    break;
-                default:
-                    g_assert_not_reached();
+            tcg_ctx->emit_before_op = op;
+
+            cbs = insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_REGULAR];
+            for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
+                struct qemu_plugin_dyn_cb *cb =
+                    &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
+                if (cb->rw & rw) {
+                    gen_mem_cb(cb, meminfo, addr);
                 }
+            }
 
-                break;
-            }
-            default:
-                g_assert_not_reached();
+            cbs = insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_INLINE];
+            for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
+                struct qemu_plugin_dyn_cb *cb =
+                    &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
+                if (cb->rw & rw) {
+                    gen_inline_cb(cb);
+                }
             }
+
+            tcg_ctx->emit_before_op = NULL;
+            tcg_op_remove(tcg_ctx, op);
             break;
         }
+
         default:
             /* plugins don't care about any other ops */
             break;
diff --git a/tcg/tcg-op-ldst.c b/tcg/tcg-op-ldst.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op-ldst.c
+++ b/tcg/tcg-op-ldst.c
@@ -XXX,XX +XXX,XX @@ plugin_gen_mem_callbacks(TCGv_i64 copy_addr, TCGTemp *orig_addr, MemOpIdx oi,
                 copy_addr = tcg_temp_ebb_new_i64();
                 tcg_gen_extu_i32_i64(copy_addr, temp_tcgv_i32(orig_addr));
             }
-            plugin_gen_empty_mem_callback(copy_addr, info);
+            tcg_gen_plugin_mem_cb(copy_addr, info);
             tcg_temp_free_i64(copy_addr);
         } else {
             if (copy_addr) {
-                plugin_gen_empty_mem_callback(copy_addr, info);
+                tcg_gen_plugin_mem_cb(copy_addr, info);
                 tcg_temp_free_i64(copy_addr);
             } else {
-                plugin_gen_empty_mem_callback(temp_tcgv_i64(orig_addr), info);
+                tcg_gen_plugin_mem_cb(temp_tcgv_i64(orig_addr), info);
             }
         }
     }
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -XXX,XX +XXX,XX @@ void tcg_gen_plugin_cb(unsigned from)
     tcg_gen_op1(INDEX_op_plugin_cb, from);
 }
 
+void tcg_gen_plugin_mem_cb(TCGv_i64 addr, unsigned meminfo)
+{
+    tcg_gen_op2(INDEX_op_plugin_mem_cb, tcgv_i64_arg(addr), meminfo);
+}
+
 void tcg_gen_plugin_cb_start(unsigned from, unsigned type, unsigned wr)
 {
     tcg_gen_op3(INDEX_op_plugin_cb_start, from, type, wr);
-- 
2.34.1

These placeholder helpers are no longer required.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/plugin-helpers.h         |  5 -----
 include/exec/helper-gen-common.h   |  4 ----
 include/exec/helper-proto-common.h |  4 ----
 accel/tcg/plugin-gen.c             | 20 --------------------
 4 files changed, 33 deletions(-)
 delete mode 100644 accel/tcg/plugin-helpers.h

diff --git a/accel/tcg/plugin-helpers.h b/accel/tcg/plugin-helpers.h
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/accel/tcg/plugin-helpers.h
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-#ifdef CONFIG_PLUGIN
-DEF_HELPER_FLAGS_2(plugin_vcpu_udata_cb_no_wg, TCG_CALL_NO_WG | TCG_CALL_PLUGIN, void, i32, ptr)
-DEF_HELPER_FLAGS_2(plugin_vcpu_udata_cb_no_rwg, TCG_CALL_NO_RWG | TCG_CALL_PLUGIN, void, i32, ptr)
-DEF_HELPER_FLAGS_4(plugin_vcpu_mem_cb, TCG_CALL_NO_RWG | TCG_CALL_PLUGIN, void, i32, i32, i64, ptr)
-#endif
diff --git a/include/exec/helper-gen-common.h b/include/exec/helper-gen-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/helper-gen-common.h
+++ b/include/exec/helper-gen-common.h
@@ -XXX,XX +XXX,XX @@
 #include "exec/helper-gen.h.inc"
 #undef  HELPER_H
 
-#define HELPER_H "accel/tcg/plugin-helpers.h"
-#include "exec/helper-gen.h.inc"
-#undef  HELPER_H
-
 #endif /* HELPER_GEN_COMMON_H */
diff --git a/include/exec/helper-proto-common.h b/include/exec/helper-proto-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/helper-proto-common.h
+++ b/include/exec/helper-proto-common.h
@@ -XXX,XX +XXX,XX @@
 #include "exec/helper-proto.h.inc"
 #undef  HELPER_H
 
-#define HELPER_H "accel/tcg/plugin-helpers.h"
-#include "exec/helper-proto.h.inc"
-#undef  HELPER_H
-
 #endif /* HELPER_PROTO_COMMON_H */
diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/plugin-gen.c
+++ b/accel/tcg/plugin-gen.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/exec-all.h"
 #include "exec/plugin-gen.h"
 #include "exec/translator.h"
-#include "exec/helper-proto-common.h"
-
-#define HELPER_H  "accel/tcg/plugin-helpers.h"
-#include "exec/helper-info.c.inc"
-#undef  HELPER_H
 
 /*
  * plugin_cb_start TCG op args[]:
@@ -XXX,XX +XXX,XX @@ enum plugin_gen_cb {
     PLUGIN_GEN_N_CBS,
 };
 
-/*
- * These helpers are stubs that get dynamically switched out for calls
- * direct to the plugin if they are subscribed to.
- */
-void HELPER(plugin_vcpu_udata_cb_no_wg)(uint32_t cpu_index, void *udata)
-{ }
-
-void HELPER(plugin_vcpu_udata_cb_no_rwg)(uint32_t cpu_index, void *udata)
-{ }
-
-void HELPER(plugin_vcpu_mem_cb)(unsigned int vcpu_index,
-                                qemu_plugin_meminfo_t info, uint64_t vaddr,
-                                void *userdata)
-{ }
-
 static void plugin_gen_empty_callback(enum plugin_gen_from from)
 {
     switch (from) {
-- 
2.34.1

Since we no longer emit plugin helpers during the initial code
translation phase, we don't need to specially mark plugin helpers.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg.h |  2 --
 plugins/core.c    | 10 ++++------
 tcg/tcg.c         |  4 +---
 3 files changed, 5 insertions(+), 11 deletions(-)

diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ typedef TCGv_ptr TCGv_env;
 #define TCG_CALL_NO_SIDE_EFFECTS    0x0004
 /* Helper is G_NORETURN.  */
 #define TCG_CALL_NO_RETURN          0x0008
-/* Helper is part of Plugins.  */
-#define TCG_CALL_PLUGIN             0x0010
 
 /* convenience version of most used call flags */
 #define TCG_CALL_NO_RWG         TCG_CALL_NO_READ_GLOBALS
diff --git a/plugins/core.c b/plugins/core.c
index XXXXXXX..XXXXXXX 100644
--- a/plugins/core.c
+++ b/plugins/core.c
@@ -XXX,XX +XXX,XX @@ void plugin_register_dyn_cb__udata(GArray **arr,
                                    void *udata)
 {
     static TCGHelperInfo info[3] = {
-        [QEMU_PLUGIN_CB_NO_REGS].flags = TCG_CALL_NO_RWG | TCG_CALL_PLUGIN,
-        [QEMU_PLUGIN_CB_R_REGS].flags = TCG_CALL_NO_WG | TCG_CALL_PLUGIN,
-        [QEMU_PLUGIN_CB_RW_REGS].flags = TCG_CALL_PLUGIN,
+        [QEMU_PLUGIN_CB_NO_REGS].flags = TCG_CALL_NO_RWG,
+        [QEMU_PLUGIN_CB_R_REGS].flags = TCG_CALL_NO_WG,
         /*
          * Match qemu_plugin_vcpu_udata_cb_t:
          *   void (*)(uint32_t, void *)
@@ -XXX,XX +XXX,XX @@ void plugin_register_vcpu_mem_cb(GArray **arr,
         !__builtin_types_compatible_p(qemu_plugin_meminfo_t, int32_t));
 
     static TCGHelperInfo info[3] = {
-        [QEMU_PLUGIN_CB_NO_REGS].flags = TCG_CALL_NO_RWG | TCG_CALL_PLUGIN,
-        [QEMU_PLUGIN_CB_R_REGS].flags = TCG_CALL_NO_WG | TCG_CALL_PLUGIN,
-        [QEMU_PLUGIN_CB_RW_REGS].flags = TCG_CALL_PLUGIN,
+        [QEMU_PLUGIN_CB_NO_REGS].flags = TCG_CALL_NO_RWG,
+        [QEMU_PLUGIN_CB_R_REGS].flags = TCG_CALL_NO_WG,
         /*
          * Match qemu_plugin_vcpu_mem_cb_t:
          *   void (*)(uint32_t, qemu_plugin_meminfo_t, uint64_t, void *)
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static void tcg_gen_callN(void *func, TCGHelperInfo *info,
 
 #ifdef CONFIG_PLUGIN
     /* Flag helpers that may affect guest state */
-    if (tcg_ctx->plugin_insn &&
-        !(info->flags & TCG_CALL_PLUGIN) &&
-        !(info->flags & TCG_CALL_NO_SIDE_EFFECTS)) {
+    if (tcg_ctx->plugin_insn && !(info->flags & TCG_CALL_NO_SIDE_EFFECTS)) {
         tcg_ctx->plugin_insn->calls_helpers = true;
     }
 #endif
-- 
2.34.1

These opcodes are no longer used.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg-op-common.h |  2 --
 include/tcg/tcg-opc.h       |  2 --
 accel/tcg/plugin-gen.c      | 18 ------------------
 tcg/tcg-op.c                | 10 ----------
 4 files changed, 32 deletions(-)

We have qemu_plugin_dyn_cb.type to differentiate the various
callback types, so we do not need to keep them in separate queues.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/qemu/plugin.h  | 35 ++++++----------
 accel/tcg/plugin-gen.c | 90 ++++++++++++++++++++++--------------------
 plugins/api.c          | 18 +++------
 3 files changed, 65 insertions(+), 78 deletions(-)

diff --git a/include/qemu/plugin.h b/include/qemu/plugin.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/plugin.h
+++ b/include/qemu/plugin.h
@@ -XXX,XX +XXX,XX @@ union qemu_plugin_cb_sig {
 };
 
 enum plugin_dyn_cb_type {
-    PLUGIN_CB_INSN,
-    PLUGIN_CB_MEM,
-    PLUGIN_N_CB_TYPES,
-};
-
-enum plugin_dyn_cb_subtype {
     PLUGIN_CB_REGULAR,
     PLUGIN_CB_INLINE,
-    PLUGIN_N_CB_SUBTYPES,
 };
 
 /*
@@ -XXX,XX +XXX,XX @@ enum plugin_dyn_cb_subtype {
  */
 struct qemu_plugin_dyn_cb {
     void *userp;
-    enum plugin_dyn_cb_subtype type;
+    enum plugin_dyn_cb_type type;
     /* @rw applies to mem callbacks only (both regular and inline) */
     enum qemu_plugin_mem_rw rw;
     /* fields specific to each dyn_cb type go here */
@@ -XXX,XX +XXX,XX @@ struct qemu_plugin_insn {
     GByteArray *data;
     uint64_t vaddr;
     void *haddr;
-    GArray *cbs[PLUGIN_N_CB_TYPES][PLUGIN_N_CB_SUBTYPES];
+    GArray *insn_cbs;
+    GArray *mem_cbs;
     bool calls_helpers;
 
     /* if set, the instruction calls helpers that might access guest memory */
@@ -XXX,XX +XXX,XX @@ static inline void qemu_plugin_insn_cleanup_fn(gpointer data)
 
 static inline struct qemu_plugin_insn *qemu_plugin_insn_alloc(void)
 {
-    int i, j;
     struct qemu_plugin_insn *insn = g_new0(struct qemu_plugin_insn, 1);
-    insn->data = g_byte_array_sized_new(4);
 
-    for (i = 0; i < PLUGIN_N_CB_TYPES; i++) {
-        for (j = 0; j < PLUGIN_N_CB_SUBTYPES; j++) {
-            insn->cbs[i][j] = g_array_new(false, false,
-                                          sizeof(struct qemu_plugin_dyn_cb));
-        }
-    }
+    insn->data = g_byte_array_sized_new(4);
     return insn;
 }
 
@@ -XXX,XX +XXX,XX @@ struct qemu_plugin_tb {
     /* if set, the TB calls helpers that might access guest memory */
     bool mem_helper;
 
-    GArray *cbs[PLUGIN_N_CB_SUBTYPES];
+    GArray *cbs;
 };
 
 /**
@@ -XXX,XX +XXX,XX @@ struct qemu_plugin_insn *qemu_plugin_tb_insn_get(struct qemu_plugin_tb *tb,
                                                  uint64_t pc)
 {
     struct qemu_plugin_insn *insn;
-    int i, j;
 
     if (unlikely(tb->n == tb->insns->len)) {
         struct qemu_plugin_insn *new_insn = qemu_plugin_insn_alloc();
         g_ptr_array_add(tb->insns, new_insn);
     }
+
     insn = g_ptr_array_index(tb->insns, tb->n++);
     g_byte_array_set_size(insn->data, 0);
     insn->calls_helpers = false;
     insn->mem_helper = false;
     insn->vaddr = pc;
-
-    for (i = 0; i < PLUGIN_N_CB_TYPES; i++) {
-        for (j = 0; j < PLUGIN_N_CB_SUBTYPES; j++) {
-            g_array_set_size(insn->cbs[i][j], 0);
-        }
+    if (insn->insn_cbs) {
+        g_array_set_size(insn->insn_cbs, 0);
+    }
+    if (insn->mem_cbs) {
+        g_array_set_size(insn->mem_cbs, 0);
     }
 
     return insn;
diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/plugin-gen.c
+++ b/accel/tcg/plugin-gen.c
@@ -XXX,XX +XXX,XX @@ void plugin_gen_disable_mem_helpers(void)
 static void gen_enable_mem_helper(struct qemu_plugin_tb *ptb,
                                   struct qemu_plugin_insn *insn)
 {
-    GArray *cbs[2];
     GArray *arr;
-    size_t n_cbs;
+    size_t len;
 
     /*
      * Tracking memory accesses performed from helpers requires extra work.
@@ -XXX,XX +XXX,XX @@ static void gen_enable_mem_helper(struct qemu_plugin_tb *ptb,
         return;
     }
 
-    cbs[0] = insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_REGULAR];
-    cbs[1] = insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_INLINE];
-    n_cbs = cbs[0]->len + cbs[1]->len;
-
-    if (n_cbs == 0) {
+    if (!insn->mem_cbs || !insn->mem_cbs->len) {
         insn->mem_helper = false;
         return;
     }
     insn->mem_helper = true;
     ptb->mem_helper = true;
 
+    /*
+     * TODO: It seems like we should be able to use ref/unref
+     * to avoid needing to actually copy this array.
+     * Alternately, perhaps we could allocate new memory adjacent
+     * to the TranslationBlock itself, so that we do not have to
+     * actively manage the lifetime after this.
+     */
+    len = insn->mem_cbs->len;
     arr = g_array_sized_new(false, false,
-                            sizeof(struct qemu_plugin_dyn_cb), n_cbs);
-    g_array_append_vals(arr, cbs[0]->data, cbs[0]->len);
-    g_array_append_vals(arr, cbs[1]->data, cbs[1]->len);
-
+                            sizeof(struct qemu_plugin_dyn_cb), len);
+    memcpy(arr->data, insn->mem_cbs->data,
+           len * sizeof(struct qemu_plugin_dyn_cb));
     qemu_plugin_add_dyn_cb_arr(arr);
 
     tcg_gen_st_ptr(tcg_constant_ptr((intptr_t)arr), tcg_env,
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
             case PLUGIN_GEN_FROM_TB:
                 assert(insn == NULL);
 
-                cbs = plugin_tb->cbs[PLUGIN_CB_REGULAR];
+                cbs = plugin_tb->cbs;
                 for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
                     struct qemu_plugin_dyn_cb *cb =
                         &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
-                    gen_udata_cb(cb);
-                }
 
-                cbs = plugin_tb->cbs[PLUGIN_CB_INLINE];
-                for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
-                    struct qemu_plugin_dyn_cb *cb =
-                        &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
-                    gen_inline_cb(cb);
+                    switch (cb->type) {
+                    case PLUGIN_CB_REGULAR:
+                        gen_udata_cb(cb);
+                        break;
+                    case PLUGIN_CB_INLINE:
+                        gen_inline_cb(cb);
+                        break;
+                    default:
+                        g_assert_not_reached();
+                    }
                 }
                 break;
 
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
 
                 gen_enable_mem_helper(plugin_tb, insn);
 
-                cbs = insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_REGULAR];
+                cbs = insn->insn_cbs;
                 for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
                     struct qemu_plugin_dyn_cb *cb =
                         &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
-                    gen_udata_cb(cb);
-                }
 
-                cbs = insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_INLINE];
-                for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
-                    struct qemu_plugin_dyn_cb *cb =
-                        &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
-                    gen_inline_cb(cb);
+                    switch (cb->type) {
+                    case PLUGIN_CB_REGULAR:
+                        gen_udata_cb(cb);
+                        break;
+                    case PLUGIN_CB_INLINE:
+                        gen_inline_cb(cb);
+                        break;
+                    default:
+                        g_assert_not_reached();
+                    }
                 }
                 break;
 
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
 
             tcg_ctx->emit_before_op = op;
 
-            cbs = insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_REGULAR];
+            cbs = insn->mem_cbs;
             for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
                 struct qemu_plugin_dyn_cb *cb =
                     &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
-                if (cb->rw & rw) {
-                    gen_mem_cb(cb, meminfo, addr);
-                }
-            }
 
-            cbs = insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_INLINE];
-            for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
-                struct qemu_plugin_dyn_cb *cb =
-                    &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
                 if (cb->rw & rw) {
-                    gen_inline_cb(cb);
+                    switch (cb->type) {
+                    case PLUGIN_CB_REGULAR:
+                        gen_mem_cb(cb, meminfo, addr);
+                        break;
+                    case PLUGIN_CB_INLINE:
+                        gen_inline_cb(cb);
+                        break;
+                    default:
+                        g_assert_not_reached();
+                    }
                 }
             }
 
@@ -XXX,XX +XXX,XX @@ bool plugin_gen_tb_start(CPUState *cpu, const DisasContextBase *db,
 
     if (test_bit(QEMU_PLUGIN_EV_VCPU_TB_TRANS, cpu->plugin_state->event_mask)) {
         struct qemu_plugin_tb *ptb = tcg_ctx->plugin_tb;
-        int i;
 
         /* reset callbacks */
-        for (i = 0; i < PLUGIN_N_CB_SUBTYPES; i++) {
-            if (ptb->cbs[i]) {
-                g_array_set_size(ptb->cbs[i], 0);
-            }
+        if (ptb->cbs) {
+            g_array_set_size(ptb->cbs, 0);
         }
         ptb->n = 0;
 
diff --git a/plugins/api.c b/plugins/api.c
index XXXXXXX..XXXXXXX 100644
--- a/plugins/api.c
+++ b/plugins/api.c
@@ -XXX,XX +XXX,XX @@ void qemu_plugin_register_vcpu_tb_exec_cb(struct qemu_plugin_tb *tb,
                                           void *udata)
 {
     if (!tb->mem_only) {
-        plugin_register_dyn_cb__udata(&tb->cbs[PLUGIN_CB_REGULAR],
-                                      cb, flags, udata);
+        plugin_register_dyn_cb__udata(&tb->cbs, cb, flags, udata);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ void qemu_plugin_register_vcpu_tb_exec_inline_per_vcpu(
     uint64_t imm)
 {
     if (!tb->mem_only) {
-        plugin_register_inline_op_on_entry(
-            &tb->cbs[PLUGIN_CB_INLINE], 0, op, entry, imm);
+        plugin_register_inline_op_on_entry(&tb->cbs, 0, op, entry, imm);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ void qemu_plugin_register_vcpu_insn_exec_cb(struct qemu_plugin_insn *insn,
                                             void *udata)
 {
     if (!insn->mem_only) {
-        plugin_register_dyn_cb__udata(
-            &insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_REGULAR], cb, flags, udata);
+        plugin_register_dyn_cb__udata(&insn->insn_cbs, cb, flags, udata);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ void qemu_plugin_register_vcpu_insn_exec_inline_per_vcpu(
     uint64_t imm)
 {
     if (!insn->mem_only) {
-        plugin_register_inline_op_on_entry(
-            &insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_INLINE], 0, op, entry, imm);
+        plugin_register_inline_op_on_entry(&insn->insn_cbs, 0, op, entry, imm);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ void qemu_plugin_register_vcpu_mem_cb(struct qemu_plugin_insn *insn,
                                       enum qemu_plugin_mem_rw rw,
                                       void *udata)
 {
-    plugin_register_vcpu_mem_cb(&insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_REGULAR],
-                                cb, flags, rw, udata);
+    plugin_register_vcpu_mem_cb(&insn->mem_cbs, cb, flags, rw, udata);
 }
 
 void qemu_plugin_register_vcpu_mem_inline_per_vcpu(
@@ -XXX,XX +XXX,XX @@ void qemu_plugin_register_vcpu_mem_inline_per_vcpu(
     qemu_plugin_u64 entry,
     uint64_t imm)
 {
-    plugin_register_inline_op_on_entry(
-        &insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_INLINE], rw, op, entry, imm);
+    plugin_register_inline_op_on_entry(&insn->mem_cbs, rw, op, entry, imm);
 }
 
 void qemu_plugin_register_vcpu_tb_trans_cb(qemu_plugin_id_t id,
-- 
2.34.1

Use different enumerators for vcpu_udata and vcpu_mem callbacks.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/qemu/plugin.h  | 1 +
 accel/tcg/plugin-gen.c | 2 +-
 plugins/core.c         | 4 ++--
 3 files changed, 4 insertions(+), 3 deletions(-)

The DEBUG_PLUGIN_GEN_OPS ifdef is replaced with "-d op_plugin".
The second pr_ops call can be obtained with "-d op".

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/qemu/log.h     |  1 +
 include/tcg/tcg.h      |  1 +
 accel/tcg/plugin-gen.c | 67 +++++++-----------------------------------
 tcg/tcg.c              | 29 +++++++++++++++++-
 util/log.c             |  4 +++
 5 files changed, 45 insertions(+), 57 deletions(-)

diff --git a/include/qemu/log.h b/include/qemu/log.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/log.h
+++ b/include/qemu/log.h
@@ -XXX,XX +XXX,XX @@ bool qemu_log_separate(void);
 #define LOG_STRACE         (1 << 19)
 #define LOG_PER_THREAD     (1 << 20)
 #define CPU_LOG_TB_VPU     (1 << 21)
+#define LOG_TB_OP_PLUGIN   (1 << 22)
 
 /* Lock/unlock output. */
 
diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ static inline const TCGOpcode *tcg_swap_vecop_list(const TCGOpcode *n)
 }
 
 bool tcg_can_emit_vecop_list(const TCGOpcode *, TCGType, unsigned);
+void tcg_dump_ops(TCGContext *s, FILE *f, bool have_prefs);
 
 #endif /* TCG_H */
diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/plugin-gen.c
+++ b/accel/tcg/plugin-gen.c
@@ -XXX,XX +XXX,XX @@
  */
 #include "qemu/osdep.h"
 #include "qemu/plugin.h"
+#include "qemu/log.h"
 #include "cpu.h"
 #include "tcg/tcg.h"
 #include "tcg/tcg-temp-internal.h"
@@ -XXX,XX +XXX,XX @@ static void gen_mem_cb(struct qemu_plugin_dyn_cb *cb,
     tcg_temp_free_i32(cpu_index);
 }
 
-/* #define DEBUG_PLUGIN_GEN_OPS */
-static void pr_ops(void)
-{
-#ifdef DEBUG_PLUGIN_GEN_OPS
-    TCGOp *op;
-    int i = 0;
-
-    QTAILQ_FOREACH(op, &tcg_ctx->ops, link) {
-        const char *name = "";
-        const char *type = "";
-
-        if (op->opc == INDEX_op_plugin_cb_start) {
-            switch (op->args[0]) {
-            case PLUGIN_GEN_FROM_TB:
-                name = "tb";
-                break;
-            case PLUGIN_GEN_FROM_INSN:
-                name = "insn";
-                break;
-            case PLUGIN_GEN_FROM_MEM:
-                name = "mem";
-                break;
-            case PLUGIN_GEN_AFTER_INSN:
-                name = "after insn";
-                break;
-            default:
-                break;
-            }
-            switch (op->args[1]) {
-            case PLUGIN_GEN_CB_UDATA:
-                type = "udata";
-                break;
-            case PLUGIN_GEN_CB_INLINE:
-                type = "inline";
-                break;
-            case PLUGIN_GEN_CB_MEM:
-                type = "mem";
-                break;
-            case PLUGIN_GEN_ENABLE_MEM_HELPER:
-                type = "enable mem helper";
-                break;
-            case PLUGIN_GEN_DISABLE_MEM_HELPER:
-                type = "disable mem helper";
-                break;
-            default:
-                break;
-            }
-        }
-        printf("op[%2i]: %s %s %s\n", i, tcg_op_defs[op->opc].name, name, type);
-        i++;
-    }
-#endif
-}
-
 static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
 {
     TCGOp *op, *next;
     int insn_idx = -1;
 
-    pr_ops();
+    if (unlikely(qemu_loglevel_mask(LOG_TB_OP_PLUGIN)
+                 && qemu_log_in_addr_range(plugin_tb->vaddr))) {
+        FILE *logfile = qemu_log_trylock();
+        if (logfile) {
+            fprintf(logfile, "OP before plugin injection:\n");
+            tcg_dump_ops(tcg_ctx, logfile, false);
+            fprintf(logfile, "\n");
+            qemu_log_unlock(logfile);
+        }
+    }
 
     /*
      * While injecting code, we cannot afford to reuse any ebb temps
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
             break;
         }
     }
-    pr_ops();
 }
 
 bool plugin_gen_tb_start(CPUState *cpu, const DisasContextBase *db,
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static const char bswap_flag_name[][6] = {
     [TCG_BSWAP_IZ | TCG_BSWAP_OS] = "iz,os",
 };
 
+#ifdef CONFIG_PLUGIN
+static const char * const plugin_from_name[] = {
+    "from-tb",
+    "from-insn",
+    "after-insn",
+    "after-tb",
+};
+#endif
+
 static inline bool tcg_regset_single(TCGRegSet d)
 {
     return (d & (d - 1)) == 0;
@@ -XXX,XX +XXX,XX @@ static inline TCGReg tcg_regset_first(TCGRegSet d)
 #define ne_fprintf(...) \
     ({ int ret_ = fprintf(__VA_ARGS__); ret_ >= 0 ? ret_ : 0; })
 
-static void tcg_dump_ops(TCGContext *s, FILE *f, bool have_prefs)
+void tcg_dump_ops(TCGContext *s, FILE *f, bool have_prefs)
 {
     char buf[128];
     TCGOp *op;
@@ -XXX,XX +XXX,XX @@ static void tcg_dump_ops(TCGContext *s, FILE *f, bool have_prefs)
                     i = k = 1;
                 }
                 break;
+#ifdef CONFIG_PLUGIN
+            case INDEX_op_plugin_cb:
+                {
+                    TCGArg from = op->args[k++];
+                    const char *name = NULL;
+
+                    if (from < ARRAY_SIZE(plugin_from_name)) {
+                        name = plugin_from_name[from];
+                    }
+                    if (name) {
+                        col += ne_fprintf(f, "%s", name);
+                    } else {
+                        col += ne_fprintf(f, "$0x%" TCG_PRIlx, from);
+                    }
+                    i = 1;
+                }
+                break;
+#endif
             default:
                 i = 0;
                 break;
diff --git a/util/log.c b/util/log.c
index XXXXXXX..XXXXXXX 100644
--- a/util/log.c
+++ b/util/log.c
@@ -XXX,XX +XXX,XX @@ const QEMULogItem qemu_log_items[] = {
       "show micro ops after optimization" },
     { CPU_LOG_TB_OP_IND, "op_ind",
       "show micro ops before indirect lowering" },
+#ifdef CONFIG_PLUGIN
+    { LOG_TB_OP_PLUGIN, "op_plugin",
+      "show micro ops before plugin injection" },
+#endif
     { CPU_LOG_INT, "int",
       "show interrupts/exceptions in short format" },
     { CPU_LOG_EXEC, "exec",
-- 
2.34.1

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/plugin-gen.c | 84 +++++++++++++++++++++---------------------
 1 file changed, 41 insertions(+), 43 deletions(-)

diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/plugin-gen.c
+++ b/accel/tcg/plugin-gen.c
@@ -XXX,XX +XXX,XX @@ static void gen_mem_cb(struct qemu_plugin_dyn_cb *cb,
     tcg_temp_free_i32(cpu_index);
 }
 
+static void inject_cb(struct qemu_plugin_dyn_cb *cb)
+
+{
+    switch (cb->type) {
+    case PLUGIN_CB_REGULAR:
+        gen_udata_cb(cb);
+        break;
+    case PLUGIN_CB_INLINE:
+        gen_inline_cb(cb);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+}
+
+static void inject_mem_cb(struct qemu_plugin_dyn_cb *cb,
+                          enum qemu_plugin_mem_rw rw,
+                          qemu_plugin_meminfo_t meminfo, TCGv_i64 addr)
+{
+    if (cb->rw & rw) {
+        switch (cb->type) {
+        case PLUGIN_CB_MEM_REGULAR:
+            gen_mem_cb(cb, meminfo, addr);
+            break;
+        default:
+            inject_cb(cb);
+            break;
+        }
+    }
+}
+
 static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
 {
     TCGOp *op, *next;
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
 
                 cbs = plugin_tb->cbs;
                 for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
-                    struct qemu_plugin_dyn_cb *cb =
-                        &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
-
-                    switch (cb->type) {
-                    case PLUGIN_CB_REGULAR:
-                        gen_udata_cb(cb);
-                        break;
-                    case PLUGIN_CB_INLINE:
-                        gen_inline_cb(cb);
-                        break;
-                    default:
-                        g_assert_not_reached();
-                    }
+                    inject_cb(
+                        &g_array_index(cbs, struct qemu_plugin_dyn_cb, i));
                 }
                 break;
 
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
 
                 cbs = insn->insn_cbs;
                 for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
-                    struct qemu_plugin_dyn_cb *cb =
-                        &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
-
-                    switch (cb->type) {
-                    case PLUGIN_CB_REGULAR:
-                        gen_udata_cb(cb);
-                        break;
-                    case PLUGIN_CB_INLINE:
-                        gen_inline_cb(cb);
-                        break;
-                    default:
-                        g_assert_not_reached();
-                    }
+                    inject_cb(
+                        &g_array_index(cbs, struct qemu_plugin_dyn_cb, i));
                 }
                 break;
 
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
         {
             TCGv_i64 addr = temp_tcgv_i64(arg_temp(op->args[0]));
             qemu_plugin_meminfo_t meminfo = op->args[1];
+            enum qemu_plugin_mem_rw rw =
+                (qemu_plugin_mem_is_store(meminfo)
+                 ? QEMU_PLUGIN_MEM_W : QEMU_PLUGIN_MEM_R);
             struct qemu_plugin_insn *insn;
             const GArray *cbs;
-            int i, n, rw;
+            int i, n;
 
             assert(insn_idx >= 0);
             insn = g_ptr_array_index(plugin_tb->insns, insn_idx);
-            rw = qemu_plugin_mem_is_store(meminfo) ? 2 : 1;
 
             tcg_ctx->emit_before_op = op;
 
             cbs = insn->mem_cbs;
             for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
-                struct qemu_plugin_dyn_cb *cb =
-                    &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
-
-                if (cb->rw & rw) {
-                    switch (cb->type) {
-                    case PLUGIN_CB_MEM_REGULAR:
-                        gen_mem_cb(cb, meminfo, addr);
-                        break;
-                    case PLUGIN_CB_INLINE:
-                        gen_inline_cb(cb);
-                        break;
-                    default:
-                        g_assert_not_reached();
-                    }
-                }
+                inject_mem_cb(&g_array_index(cbs, struct qemu_plugin_dyn_cb, i),
+                              rw, meminfo, addr);
             }
 
             tcg_ctx->emit_before_op = NULL;
-- 
2.34.1

Merge qemu_plugin_insn_alloc and qemu_plugin_tb_insn_get into
plugin_gen_insn_start, since it is used nowhere else.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/qemu/plugin.h  | 39 ---------------------------------------
 accel/tcg/plugin-gen.c | 39 ++++++++++++++++++++++++++++++++-------
 2 files changed, 32 insertions(+), 46 deletions(-)

diff --git a/include/qemu/plugin.h b/include/qemu/plugin.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/plugin.h
+++ b/include/qemu/plugin.h
@@ -XXX,XX +XXX,XX @@ static inline void qemu_plugin_insn_cleanup_fn(gpointer data)
     g_byte_array_free(insn->data, true);
 }
 
-static inline struct qemu_plugin_insn *qemu_plugin_insn_alloc(void)
-{
-    struct qemu_plugin_insn *insn = g_new0(struct qemu_plugin_insn, 1);
-
-    insn->data = g_byte_array_sized_new(4);
-    return insn;
-}
-
 /* Internal context for this TranslationBlock */
 struct qemu_plugin_tb {
     GPtrArray *insns;
@@ -XXX,XX +XXX,XX @@ struct qemu_plugin_tb {
     GArray *cbs;
 };
 
-/**
- * qemu_plugin_tb_insn_get(): get next plugin record for translation.
- * @tb: the internal tb context
- * @pc: address of instruction
- */
-static inline
-struct qemu_plugin_insn *qemu_plugin_tb_insn_get(struct qemu_plugin_tb *tb,
-                                                 uint64_t pc)
-{
-    struct qemu_plugin_insn *insn;
-
-    if (unlikely(tb->n == tb->insns->len)) {
-        struct qemu_plugin_insn *new_insn = qemu_plugin_insn_alloc();
-        g_ptr_array_add(tb->insns, new_insn);
-    }
-
-    insn = g_ptr_array_index(tb->insns, tb->n++);
-    g_byte_array_set_size(insn->data, 0);
-    insn->calls_helpers = false;
-    insn->mem_helper = false;
-    insn->vaddr = pc;
-    if (insn->insn_cbs) {
-        g_array_set_size(insn->insn_cbs, 0);
-    }
-    if (insn->mem_cbs) {
-        g_array_set_size(insn->mem_cbs, 0);
-    }
-
-    return insn;
-}
-
 /**
  * struct CPUPluginState - per-CPU state for plugins
  * @event_mask: plugin event bitmap. Modified only via async work.
diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/plugin-gen.c
+++ b/accel/tcg/plugin-gen.c
@@ -XXX,XX +XXX,XX @@ bool plugin_gen_tb_start(CPUState *cpu, const DisasContextBase *db,
 void plugin_gen_insn_start(CPUState *cpu, const DisasContextBase *db)
 {
     struct qemu_plugin_tb *ptb = tcg_ctx->plugin_tb;
-    struct qemu_plugin_insn *pinsn;
+    struct qemu_plugin_insn *insn;
+    size_t n = db->num_insns;
+    vaddr pc;
 
-    pinsn = qemu_plugin_tb_insn_get(ptb, db->pc_next);
-    tcg_ctx->plugin_insn = pinsn;
-    plugin_gen_empty_callback(PLUGIN_GEN_FROM_INSN);
+    assert(n >= 1);
+    ptb->n = n;
+    if (n <= ptb->insns->len) {
+        insn = g_ptr_array_index(ptb->insns, n - 1);
+        g_byte_array_set_size(insn->data, 0);
+    } else {
+        assert(n - 1 == ptb->insns->len);
+        insn = g_new0(struct qemu_plugin_insn, 1);
+        insn->data = g_byte_array_sized_new(4);
+        g_ptr_array_add(ptb->insns, insn);
+    }
+
+    tcg_ctx->plugin_insn = insn;
+    insn->calls_helpers = false;
+    insn->mem_helper = false;
+    if (insn->insn_cbs) {
+        g_array_set_size(insn->insn_cbs, 0);
+    }
+    if (insn->mem_cbs) {
+        g_array_set_size(insn->mem_cbs, 0);
+    }
+
+    pc = db->pc_next;
+    insn->vaddr = pc;
 
     /*
      * Detect page crossing to get the new host address.
@@ -XXX,XX +XXX,XX @@ void plugin_gen_insn_start(CPUState *cpu, const DisasContextBase *db)
      * fetching instructions from a region not backed by RAM.
      */
     if (ptb->haddr1 == NULL) {
-        pinsn->haddr = NULL;
+        insn->haddr = NULL;
     } else if (is_same_page(db, db->pc_next)) {
-        pinsn->haddr = ptb->haddr1 + pinsn->vaddr - ptb->vaddr;
+        insn->haddr = ptb->haddr1 + pc - ptb->vaddr;
     } else {
         if (ptb->vaddr2 == -1) {
             ptb->vaddr2 = TARGET_PAGE_ALIGN(db->pc_first);
             get_page_addr_code_hostp(cpu_env(cpu), ptb->vaddr2, &ptb->haddr2);
         }
-        pinsn->haddr = ptb->haddr2 + pinsn->vaddr - ptb->vaddr2;
+        insn->haddr = ptb->haddr2 + pc - ptb->vaddr2;
     }
+
+    plugin_gen_empty_callback(PLUGIN_GEN_FROM_INSN);
 }
 
 void plugin_gen_insn_end(void)
-- 
2.34.1

Each caller can use tcg_gen_plugin_cb directly.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/plugin-gen.c | 19 +++----------------
 1 file changed, 3 insertions(+), 16 deletions(-)

diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/plugin-gen.c
+++ b/accel/tcg/plugin-gen.c
@@ -XXX,XX +XXX,XX @@ enum plugin_gen_from {
     PLUGIN_GEN_AFTER_TB,
 };
 
-static void plugin_gen_empty_callback(enum plugin_gen_from from)
-{
-    switch (from) {
-    case PLUGIN_GEN_AFTER_INSN:
-    case PLUGIN_GEN_FROM_TB:
-    case PLUGIN_GEN_FROM_INSN:
-        tcg_gen_plugin_cb(from);
-        break;
-    default:
-        g_assert_not_reached();
-    }
-}
-
 /* called before finishing a TB with exit_tb, goto_tb or goto_ptr */
 void plugin_gen_disable_mem_helpers(void)
 {
@@ -XXX,XX +XXX,XX @@ bool plugin_gen_tb_start(CPUState *cpu, const DisasContextBase *db,
         ptb->mem_only = mem_only;
         ptb->mem_helper = false;
 
-        plugin_gen_empty_callback(PLUGIN_GEN_FROM_TB);
+        tcg_gen_plugin_cb(PLUGIN_GEN_FROM_TB);
     }
 
     tcg_ctx->plugin_insn = NULL;
@@ -XXX,XX +XXX,XX @@ void plugin_gen_insn_start(CPUState *cpu, const DisasContextBase *db)
         insn->haddr = ptb->haddr2 + pc - ptb->vaddr2;
     }
 
-    plugin_gen_empty_callback(PLUGIN_GEN_FROM_INSN);
+    tcg_gen_plugin_cb(PLUGIN_GEN_FROM_INSN);
 }
 
 void plugin_gen_insn_end(void)
 {
-    plugin_gen_empty_callback(PLUGIN_GEN_AFTER_INSN);
+    tcg_gen_plugin_cb(PLUGIN_GEN_AFTER_INSN);
 }
 
 /*
-- 
2.34.1

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/plugin-gen.c | 31 ++++---------------------------
 1 file changed, 4 insertions(+), 27 deletions(-)

diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/plugin-gen.c
+++ b/accel/tcg/plugin-gen.c
@@ -XXX,XX +XXX,XX @@
  * Injecting the desired instrumentation could be done with a second
  * translation pass that combined the instrumentation requests, but that
  * would be ugly and inefficient since we would decode the guest code twice.
- * Instead, during TB translation we add "empty" instrumentation calls for all
- * possible instrumentation events, and then once we collect the instrumentation
- * requests from plugins, we either "fill in" those empty events or remove them
- * if they have no requests.
- *
- * When "filling in" an event we first copy the empty callback's TCG ops. This
- * might seem unnecessary, but it is done to support an arbitrary number
- * of callbacks per event. Take for example a regular instruction callback.
- * We first generate a callback to an empty helper function. Then, if two
- * plugins register one callback each for this instruction, we make two copies
- * of the TCG ops generated for the empty callback, substituting the function
- * pointer that points to the empty helper function with the plugins' desired
- * callback functions. After that we remove the empty callback's ops.
- *
- * Note that the location in TCGOp.args[] of the pointer to a helper function
- * varies across different guest and host architectures. Instead of duplicating
- * the logic that figures this out, we rely on the fact that the empty
- * callbacks point to empty functions that are unique pointers in the program.
- * Thus, to find the right location we just have to look for a match in
- * TCGOp.args[]. This is the main reason why we first copy an empty callback's
- * TCG ops and then fill them in; regardless of whether we have one or many
- * callbacks for that event, the logic to add all of them is the same.
- *
- * When generating more than one callback per event, we make a small
- * optimization to avoid generating redundant operations. For instance, for the
- * second and all subsequent callbacks of an event, we do not need to reload the
- * CPU's index into a TCG temp, since the first callback did it already.
+ * Instead, during TB translation we add "plugin_cb" marker opcodes
+ * for all possible instrumentation events, and then once we collect the
+ * instrumentation requests from plugins, we generate code for those markers
+ * or remove them if they have no requests.
  */
 #include "qemu/osdep.h"
 #include "qemu/plugin.h"
-- 
2.34.1