Series comparison

-[PULL 0/5] tcg patch queue
+[PULL v2 0/8] tcg patch queue
-The following changes since commit fb7e7990342e59cf67dbd895c1a1e3fb1741df7a:
+The following changes since commit 79b677d658d3d35e1e776826ac4abb28cdce69b8:
-  tests/qtest/qom-test: Do not print tested properties by default (2023-01-16 15:00:57 +0000)
+  Merge tag 'net-pull-request' of https://github.com/jasowang/qemu into staging (2023-02-21 11:28:31 +0000)
 are available in the Git repository at:
-  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20230116
+  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20230221
-for you to fetch changes up to 61710a7e23a63546da0071ea32adb96476fa5d07:
+for you to fetch changes up to dbd672c87f19949bb62bfb1fb3a97b9729fd7560:
-  accel/tcg: Split out cpu_exec_{setjmp,loop} (2023-01-16 10:14:12 -1000)
+  sysemu/os-win32: fix setjmp/longjmp on windows-arm64 (2023-02-21 13:45:48 -1000)
 ----------------------------------------------------------------
-- Reorg cpu_tb_exec around setjmp.
+tcg: Allow first half of insn in ram, and second half in mmio
-- Use __attribute__((target)) for buffer_is_zero.
+linux-user/sparc: SIGILL for unknown trap vectors
-- Add perfmap and jitdump for perf support.
+linux-user/microblaze: SIGILL for privileged insns
 linux-user: Fix deadlock while exiting due to signal
 target/microblaze: Add gdbstub xml
 util: Adjust cacheflush for windows-arm64
 include/sysemu/os-win32: Adjust setjmp/longjmp for windows-arm64
 ----------------------------------------------------------------
 Ilya Leoshkevich (3):
-      linux-user: Clean up when exiting due to a signal
+      linux-user: Always exit from exclusive state in fork_end()
-      accel/tcg: Add debuginfo support
+      cpus: Make {start,end}_exclusive() recursive
-      tcg: add perfmap and jitdump
+      linux-user/microblaze: Handle privileged exception
-Richard Henderson (2):
+Pierrick Bouvier (2):
-      util/bufferiszero: Use __attribute__((target)) for avx2/avx512
+      util/cacheflush: fix cache on windows-arm64
-      accel/tcg: Split out cpu_exec_{setjmp,loop}
+      sysemu/os-win32: fix setjmp/longjmp on windows-arm64
- docs/devel/tcg.rst        |  23 +++
+Richard Henderson (3):
- meson.build               |  16 +-
+      accel/tcg: Allow the second page of an instruction to be MMIO
- accel/tcg/debuginfo.h     |  77 ++++++++++
+      linux-user/sparc: Raise SIGILL for all unhandled software traps
- accel/tcg/perf.h          |  49 ++++++
+      target/microblaze: Add gdbstub xml
- accel/tcg/cpu-exec.c      | 111 +++++++-------
- accel/tcg/debuginfo.c     |  96 ++++++++++++
+ include/hw/core/cpu.h                       |  4 +-
- accel/tcg/perf.c          | 375 ++++++++++++++++++++++++++++++++++++++++++++++
+ include/sysemu/os-win32.h                   | 28 ++++++++++--
- accel/tcg/translate-all.c |   7 +
+ target/microblaze/cpu.h                     |  2 +
- hw/core/loader.c          |   5 +
+ accel/tcg/translator.c                      | 12 +++++-
- linux-user/elfload.c      |   3 +
+ cpus-common.c                               | 12 +++++-
- linux-user/exit.c         |   2 +
+ linux-user/main.c                           | 10 +++--
- linux-user/main.c         |  15 ++
+ linux-user/microblaze/cpu_loop.c            | 10 ++++-
- linux-user/signal.c       |   8 +-
+ linux-user/sparc/cpu_loop.c                 |  8 ++++
- softmmu/vl.c              |  11 ++
+ linux-user/syscall.c                        |  1 +
- tcg/tcg.c                 |   2 +
+ target/microblaze/cpu.c                     |  7 ++-
- util/bufferiszero.c       |  41 +----
+ target/microblaze/gdbstub.c                 | 51 ++++++++++++++++------
- accel/tcg/meson.build     |   2 +
+ util/cacheflush.c                           | 14 ++++--
- linux-user/meson.build    |   1 +
+ configs/targets/microblaze-linux-user.mak   |  1 +
- qemu-options.hx           |  20 +++
+ configs/targets/microblaze-softmmu.mak      |  1 +
-files changed, 763 insertions(+), 101 deletions(-)
+ configs/targets/microblazeel-linux-user.mak |  1 +
- create mode 100644 accel/tcg/debuginfo.h
+ configs/targets/microblazeel-softmmu.mak    |  1 +
- create mode 100644 accel/tcg/perf.h
+ gdb-xml/microblaze-core.xml                 | 67 +++++++++++++++++++++++++++++
- create mode 100644 accel/tcg/debuginfo.c
+ gdb-xml/microblaze-stack-protect.xml        | 12 ++++++
- create mode 100644 accel/tcg/perf.c
+ meson.build                                 | 21 +++++++++
 files changed, 229 insertions(+), 34 deletions(-)
  create mode 100644 gdb-xml/microblaze-core.xml
  create mode 100644 gdb-xml/microblaze-stack-protect.xml

-[PULL 5/5] accel/tcg: Split out cpu_exec_{setjmp,loop}
+[PULL v2 1/8] accel/tcg: Allow the second page of an instruction to be MMIO
-Recently the g_assert(cpu == current_cpu) test has been
+If an instruction straddles a page boundary, and the first page
-intermittently failing with gcc.  Reorg the code around
+was ram, but the second page was MMIO, we would abort.  Handle
-the setjmp to minimize the lifetime of the cpu variable
+this as if both pages are MMIO, by setting the ram_addr_t for
-affected by the setjmp.
+the first page to -1.
-This appears to fix the existing issue with clang as well.
+Reported-by: Sid Manning <sidneym@quicinc.com>
+Reported-by: Jørgen Hansen <Jorgen.Hansen@wdc.com>
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1147
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/cpu-exec.c | 111 +++++++++++++++++++++----------------------
+ accel/tcg/translator.c | 12 ++++++++++--
-file changed, 54 insertions(+), 57 deletions(-)
+file changed, 10 insertions(+), 2 deletions(-)
-diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
+diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cpu-exec.c
+--- a/accel/tcg/translator.c
-+++ b/accel/tcg/cpu-exec.c
++++ b/accel/tcg/translator.c
-@@ -XXX,XX +XXX,XX @@ static inline void cpu_loop_exec_tb(CPUState *cpu, TranslationBlock *tb,
+@@ -XXX,XX +XXX,XX @@ static void *translator_access(CPUArchState *env, DisasContextBase *db,
+         if (host == NULL) {
- /* main execution loop */
+             tb_page_addr_t phys_page =
+                 get_page_addr_code_hostp(env, base, &db->host_addr[1]);
--int cpu_exec(CPUState *cpu)
+-            /* We cannot handle MMIO as second page. */
-+static int __attribute__((noinline))
+-            assert(phys_page != -1);
 +cpu_exec_loop(CPUState *cpu, SyncClocks *sc)
  {
      int ret;
 -    SyncClocks sc = { 0 };
 -
 -    /* replay_interrupt may need current_cpu */
 -    current_cpu = cpu;
 -
 -    if (cpu_handle_halt(cpu)) {
 -        return EXCP_HALTED;
 -    }
 -
 -    rcu_read_lock();
 -
 -    cpu_exec_enter(cpu);
 -
 -    /* Calculate difference between guest clock and host clock.
 -     * This delay includes the delay of the last cycle, so
 -     * what we have to do is sleep until it is 0. As for the
 -     * advance/delay we gain here, we try to fix it next time.
 -     */
 -    init_delay_params(&sc, cpu);
 -
 -    /* prepare setjmp context for exception handling */
 -    if (sigsetjmp(cpu->jmp_env, 0) != 0) {
 -#if defined(__clang__)
 -        /*
 -         * Some compilers wrongly smash all local variables after
 -         * siglongjmp (the spec requires that only non-volatile locals
 -         * which are changed between the sigsetjmp and siglongjmp are
 -         * permitted to be trashed). There were bug reports for gcc
 -         * 4.5.0 and clang.  The bug is fixed in all versions of gcc
 -         * that we support, but is still unfixed in clang:
 -         *   https://bugs.llvm.org/show_bug.cgi?id=21183
 -         *
 -         * Reload an essential local variable here for those compilers.
 -         * Newer versions of gcc would complain about this code (-Wclobbered),
 -         * so we only perform the workaround for clang.
 -         */
 -        cpu = current_cpu;
 -#else
 -        /* Non-buggy compilers preserve this; assert the correct value. */
 -        g_assert(cpu == current_cpu);
 -#endif
 -
 -#ifndef CONFIG_SOFTMMU
 -        clear_helper_retaddr();
 -        if (have_mmap_lock()) {
 -            mmap_unlock();
 -        }
 -#endif
 -        if (qemu_mutex_iothread_locked()) {
 -            qemu_mutex_unlock_iothread();
 -        }
 -        qemu_plugin_disable_mem_helpers(cpu);
 -
 -        assert_no_pages_locked();
 -    }
      /* if an exception is pending, we execute it here */
      while (!cpu_handle_exception(cpu, &ret)) {
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
              /* Try to align the host and virtual clocks
                 if the guest is in advance */
 -            align_clocks(&sc, cpu);
 +            align_clocks(sc, cpu);
          }
      }
 +    return ret;
 +}
 +
-+static int cpu_exec_setjmp(CPUState *cpu, SyncClocks *sc)
++            /*
-+{
++             * If the second page is MMIO, treat as if the first page
-+    /* Prepare setjmp context for exception handling. */
++             * was MMIO as well, so that we do not cache the TB.
-+    if (unlikely(sigsetjmp(cpu->jmp_env, 0) != 0)) {
++             */
-+        /* Non-buggy compilers preserve this; assert the correct value. */
++            if (unlikely(phys_page == -1)) {
-+        g_assert(cpu == current_cpu);
++                tb_set_page_addr0(tb, -1);
 +                return NULL;
 +            }
 +
-+#ifndef CONFIG_SOFTMMU
+             tb_set_page_addr1(tb, phys_page);
-+        clear_helper_retaddr();
+ #ifdef CONFIG_USER_ONLY
-+        if (have_mmap_lock()) {
+             page_protect(end);
 +            mmap_unlock();
 +        }
 +#endif
 +        if (qemu_mutex_iothread_locked()) {
 +            qemu_mutex_unlock_iothread();
 +        }
 +        qemu_plugin_disable_mem_helpers(cpu);
 +
 +        assert_no_pages_locked();
 +    }
 +
 +    return cpu_exec_loop(cpu, sc);
 +}
 +
 +int cpu_exec(CPUState *cpu)
 +{
 +    int ret;
 +    SyncClocks sc = { 0 };
 +
 +    /* replay_interrupt may need current_cpu */
 +    current_cpu = cpu;
 +
 +    if (cpu_handle_halt(cpu)) {
 +        return EXCP_HALTED;
 +    }
 +
 +    rcu_read_lock();
 +    cpu_exec_enter(cpu);
 +
 +    /*
 +     * Calculate difference between guest clock and host clock.
 +     * This delay includes the delay of the last cycle, so
 +     * what we have to do is sleep until it is 0. As for the
 +     * advance/delay we gain here, we try to fix it next time.
 +     */
 +    init_delay_params(&sc, cpu);
 +
 +    ret = cpu_exec_setjmp(cpu, &sc);
      cpu_exec_exit(cpu);
      rcu_read_unlock();
 --
 .34.1

-New patch
+[PULL v2 2/8] linux-user/sparc: Raise SIGILL for all unhandled software traps
+The linux kernel's trap tables vector all unassigned trap
+numbers to BAD_TRAP, which then raises SIGILL.
+Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Reported-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ linux-user/sparc/cpu_loop.c | 8 ++++++++
+file changed, 8 insertions(+)
+diff --git a/linux-user/sparc/cpu_loop.c b/linux-user/sparc/cpu_loop.c
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/sparc/cpu_loop.c
++++ b/linux-user/sparc/cpu_loop.c
+@@ -XXX,XX +XXX,XX @@ void cpu_loop (CPUSPARCState *env)
+             cpu_exec_step_atomic(cs);
+             break;
+         default:
++            /*
++             * Most software trap numbers vector to BAD_TRAP.
++             * Handle anything not explicitly matched above.
++             */
++            if (trapnr >= TT_TRAP && trapnr <= TT_TRAP + 0x7f) {
++                force_sig_fault(TARGET_SIGILL, ILL_ILLTRP, env->pc);
++                break;
++            }
+             fprintf(stderr, "Unhandled trap: 0x%x\n", trapnr);
+             cpu_dump_state(cs, stderr, 0);
+             exit(EXIT_FAILURE);
+--
+.34.1

-[PULL 1/5] linux-user: Clean up when exiting due to a signal
+[PULL v2 3/8] linux-user: Always exit from exclusive state in fork_end()
 From: Ilya Leoshkevich <iii@linux.ibm.com>
-When exiting due to an exit() syscall, qemu-user calls
+fork()ed processes currently start with
-preexit_cleanup(), but this is currently not the case when exiting due
+current_cpu->in_exclusive_context set, which is, strictly speaking, not
-to a signal. This leads to various buffers not being flushed (e.g.,
+correct, but does not cause problems (even assertion failures).
 for gprof, for gcov, and for the upcoming perf support).
-Add the missing call.
+With one of the next patches, the code begins to rely on this value, so
 fix it by always calling end_exclusive() in fork_end().
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Message-Id: <20230214140829.45392-2-iii@linux.ibm.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20230112152013.125680-2-iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- linux-user/signal.c | 8 +++++---
+ linux-user/main.c    | 10 ++++++----
-file changed, 5 insertions(+), 3 deletions(-)
+ linux-user/syscall.c |  1 +
 files changed, 7 insertions(+), 4 deletions(-)
-diff --git a/linux-user/signal.c b/linux-user/signal.c
+diff --git a/linux-user/main.c b/linux-user/main.c
 index XXXXXXX..XXXXXXX 100644
---- a/linux-user/signal.c
+--- a/linux-user/main.c
-+++ b/linux-user/signal.c
++++ b/linux-user/main.c
-@@ -XXX,XX +XXX,XX @@ void cpu_loop_exit_sigbus(CPUState *cpu, target_ulong addr,
+@@ -XXX,XX +XXX,XX @@ void fork_end(int child)
+         }
- /* abort execution with signal */
+         qemu_init_cpu_list();
- static G_NORETURN
+         gdbserver_fork(thread_cpu);
--void dump_core_and_abort(int target_sig)
+-        /* qemu_init_cpu_list() takes care of reinitializing the
-+void dump_core_and_abort(CPUArchState *cpu_env, int target_sig)
+-         * exclusive state, so we don't need to end_exclusive() here.
- {
+-         */
-     CPUState *cpu = thread_cpu;
+     } else {
-     CPUArchState *env = cpu->env_ptr;
+         cpu_list_unlock();
-@@ -XXX,XX +XXX,XX @@ void dump_core_and_abort(int target_sig)
+-        end_exclusive();
              target_sig, strsignal(host_sig), "core dumped" );
      }
++    /*
-+    preexit_cleanup(cpu_env, 128 + target_sig);
++     * qemu_init_cpu_list() reinitialized the child exclusive state, but we
-+
++     * also need to keep current_cpu consistent, so call end_exclusive() for
-     /* The proper exit code for dying from an uncaught signal is
++     * both child and parent.
-      * -<signal>.  The kernel doesn't allow exit() or _exit() to pass
++     */
-      * a negative value.  To get the proper exit code we need to
++    end_exclusive();
-@@ -XXX,XX +XXX,XX @@ static void handle_pending_signal(CPUArchState *cpu_env, int sig,
+ }
-                    sig != TARGET_SIGURG &&
-                    sig != TARGET_SIGWINCH &&
+ __thread CPUState *thread_cpu;
-                    sig != TARGET_SIGCONT) {
+diff --git a/linux-user/syscall.c b/linux-user/syscall.c
--            dump_core_and_abort(sig);
+index XXXXXXX..XXXXXXX 100644
-+            dump_core_and_abort(cpu_env, sig);
+--- a/linux-user/syscall.c
 +++ b/linux-user/syscall.c
@@ -XXX,XX +XXX,XX @@ static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,
              cpu_clone_regs_parent(env, flags);
              fork_end(0);
          }
-     } else if (handler == TARGET_SIG_IGN) {
++        g_assert(!cpu_in_exclusive_context(cpu));
-         /* ignore sig */
+     }
-     } else if (handler == TARGET_SIG_ERR) {
+     return ret;
--        dump_core_and_abort(sig);
+ }
 +        dump_core_and_abort(cpu_env, sig);
      } else {
          /* compute the blocked signals during the handler execution */
          sigset_t *blocked_set;
 --
 .34.1

-[PULL 3/5] tcg: add perfmap and jitdump
+[PULL v2 4/8] cpus: Make {start,end}_exclusive() recursive
 From: Ilya Leoshkevich <iii@linux.ibm.com>
-Add ability to dump /tmp/perf-<pid>.map and jit-<pid>.dump.
+Currently dying to one of the core_dump_signal()s deadlocks, because
-The first one allows the perf tool to map samples to each individual
+dump_core_and_abort() calls start_exclusive() two times: first via
-translation block. The second one adds the ability to resolve symbol
+stop_all_tasks(), and then via preexit_cleanup() ->
-names, line numbers and inspect JITed code.
+qemu_plugin_user_exit().
-Example of use:
+There are a number of ways to solve this: resume after dumping core;
 check cpu_in_exclusive_context() in qemu_plugin_user_exit(); or make
 {start,end}_exclusive() recursive. Pick the last option, since it's
 the most straightforward one.
-    perf record qemu-x86_64 -perfmap ./a.out
+Fixes: da91c1920242 ("linux-user: Clean up when exiting due to a signal")
-    perf report
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 or
     perf record -k 1 qemu-x86_64 -jitdump ./a.out
     DEBUGINFOD_URLS= perf inject -j -i perf.data -o perf.data.jitted
     perf report -i perf.data.jitted
 Co-developed-by: Vanderson M. do Rosario <vandersonmr2@gmail.com>
 Co-developed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Message-Id: <20230112152013.125680-4-iii@linux.ibm.com>
+Message-Id: <20230214140829.45392-3-iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- docs/devel/tcg.rst        |  23 +++
+ include/hw/core/cpu.h |  4 ++--
- accel/tcg/perf.h          |  49 +++++
+ cpus-common.c         | 12 ++++++++++--
- accel/tcg/perf.c          | 375 ++++++++++++++++++++++++++++++++++++++
+files changed, 12 insertions(+), 4 deletions(-)
  accel/tcg/translate-all.c |   7 +
  linux-user/exit.c         |   2 +
  linux-user/main.c         |  15 ++
  softmmu/vl.c              |  11 ++
  tcg/tcg.c                 |   2 +
  accel/tcg/meson.build     |   1 +
  qemu-options.hx           |  20 ++
 files changed, 505 insertions(+)
  create mode 100644 accel/tcg/perf.h
  create mode 100644 accel/tcg/perf.c
-diff --git a/docs/devel/tcg.rst b/docs/devel/tcg.rst
+diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/docs/devel/tcg.rst
+--- a/include/hw/core/cpu.h
-+++ b/docs/devel/tcg.rst
++++ b/include/hw/core/cpu.h
-@@ -XXX,XX +XXX,XX @@ memory areas instead calls out to C code for device emulation.
+@@ -XXX,XX +XXX,XX @@ struct CPUState {
- Finally, the MMU helps tracking dirty pages and pages pointed to by
+     bool unplug;
- translation blocks.
+     bool crash_occurred;
+     bool exit_request;
-+Profiling JITted code
+-    bool in_exclusive_context;
-+---------------------
++    int exclusive_context_count;
-+
+     uint32_t cflags_next_tb;
-+The Linux ``perf`` tool will treat all JITted code as a single block as
+     /* updates protected by BQL */
-+unlike the main code it can't use debug information to link individual
+     uint32_t interrupt_request;
-+program counter samples with larger functions. To overcome this
+@@ -XXX,XX +XXX,XX @@ void async_safe_run_on_cpu(CPUState *cpu, run_on_cpu_func func, run_on_cpu_data
-+limitation you can use the ``-perfmap`` or the ``-jitdump`` option to generate
+  */
-+map files. ``-perfmap`` is lightweight and produces only guest-host mappings.
+ static inline bool cpu_in_exclusive_context(const CPUState *cpu)
-+``-jitdump`` additionally saves JITed code and guest debug information (if
+ {
-+available); its output needs to be integrated with the ``perf.data`` file
+-    return cpu->in_exclusive_context;
-+before the final report can be viewed.
++    return cpu->exclusive_context_count;
-+
+ }
-+.. code::
-+
+ /**
-+  perf record $QEMU -perfmap $REMAINING_ARGS
+diff --git a/cpus-common.c b/cpus-common.c
-+  perf report
+index XXXXXXX..XXXXXXX 100644
-+
+--- a/cpus-common.c
-+  perf record -k 1 $QEMU -jitdump $REMAINING_ARGS
++++ b/cpus-common.c
-+  DEBUGINFOD_URLS= perf inject -j -i perf.data -o perf.data.jitted
+@@ -XXX,XX +XXX,XX @@ void start_exclusive(void)
-+  perf report -i perf.data.jitted
+     CPUState *other_cpu;
-+
+     int running_cpus;
-+Note that qemu-system generates mappings only for ``-kernel`` files in ELF
-+format.
++    if (current_cpu->exclusive_context_count) {
-diff --git a/accel/tcg/perf.h b/accel/tcg/perf.h
++        current_cpu->exclusive_context_count++;
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/accel/tcg/perf.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Linux perf perf-<pid>.map and jit-<pid>.dump integration.
 + *
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + */
 +
 +#ifndef ACCEL_TCG_PERF_H
 +#define ACCEL_TCG_PERF_H
 +
 +#if defined(CONFIG_TCG) && defined(CONFIG_LINUX)
 +/* Start writing perf-<pid>.map. */
 +void perf_enable_perfmap(void);
 +
 +/* Start writing jit-<pid>.dump. */
 +void perf_enable_jitdump(void);
 +
 +/* Add information about TCG prologue to profiler maps. */
 +void perf_report_prologue(const void *start, size_t size);
 +
 +/* Add information about JITted guest code to profiler maps. */
 +void perf_report_code(uint64_t guest_pc, TranslationBlock *tb,
 +                      const void *start);
 +
 +/* Stop writing perf-<pid>.map and/or jit-<pid>.dump. */
 +void perf_exit(void);
 +#else
 +static inline void perf_enable_perfmap(void)
 +{
 +}
 +
 +static inline void perf_enable_jitdump(void)
 +{
 +}
 +
 +static inline void perf_report_prologue(const void *start, size_t size)
 +{
 +}
 +
 +static inline void perf_report_code(uint64_t guest_pc, TranslationBlock *tb,
 +                                    const void *start)
 +{
 +}
 +
 +static inline void perf_exit(void)
 +{
 +}
 +#endif
 +
 +#endif
 diff --git a/accel/tcg/perf.c b/accel/tcg/perf.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/accel/tcg/perf.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Linux perf perf-<pid>.map and jit-<pid>.dump integration.
 + *
 + * The jitdump spec can be found at [1].
 + *
 + * [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/plain/tools/perf/Documentation/jitdump-specification.txt
 + *
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + */
 +
 +#include "qemu/osdep.h"
 +#include "elf.h"
 +#include "exec/exec-all.h"
 +#include "qemu/timer.h"
 +#include "tcg/tcg.h"
 +
 +#include "debuginfo.h"
 +#include "perf.h"
 +
 +static FILE *safe_fopen_w(const char *path)
 +{
 +    int saved_errno;
 +    FILE *f;
 +    int fd;
 +
 +    /* Delete the old file, if any. */
 +    unlink(path);
 +
 +    /* Avoid symlink attacks by using O_CREAT | O_EXCL. */
 +    fd = open(path, O_RDWR | O_CREAT | O_EXCL, S_IRUSR | S_IWUSR);
 +    if (fd == -1) {
 +        return NULL;
 +    }
 +
 +    /* Convert fd to FILE*. */
 +    f = fdopen(fd, "w");
 +    if (f == NULL) {
 +        saved_errno = errno;
 +        close(fd);
 +        errno = saved_errno;
 +        return NULL;
 +    }
 +
 +    return f;
 +}
 +
 +static FILE *perfmap;
 +
 +void perf_enable_perfmap(void)
 +{
 +    char map_file[32];
 +
 +    snprintf(map_file, sizeof(map_file), "/tmp/perf-%d.map", getpid());
 +    perfmap = safe_fopen_w(map_file);
 +    if (perfmap == NULL) {
 +        warn_report("Could not open %s: %s, proceeding without perfmap",
 +                    map_file, strerror(errno));
 +    }
 +}
 +
 +/* Get PC and size of code JITed for guest instruction #INSN. */
 +static void get_host_pc_size(uintptr_t *host_pc, uint16_t *host_size,
 +                             const void *start, size_t insn)
 +{
 +    uint16_t start_off = insn ? tcg_ctx->gen_insn_end_off[insn - 1] : 0;
 +
 +    if (host_pc) {
 +        *host_pc = (uintptr_t)start + start_off;
 +    }
 +    if (host_size) {
 +        *host_size = tcg_ctx->gen_insn_end_off[insn] - start_off;
 +    }
 +}
 +
 +static const char *pretty_symbol(const struct debuginfo_query *q, size_t *len)
 +{
 +    static __thread char buf[64];
 +    int tmp;
 +
 +    if (!q->symbol) {
 +        tmp = snprintf(buf, sizeof(buf), "guest-0x%"PRIx64, q->address);
 +        if (len) {
 +            *len = MIN(tmp + 1, sizeof(buf));
 +        }
 +        return buf;
 +    }
 +
 +    if (!q->offset) {
 +        if (len) {
 +            *len = strlen(q->symbol) + 1;
 +        }
 +        return q->symbol;
 +    }
 +
 +    tmp = snprintf(buf, sizeof(buf), "%s+0x%"PRIx64, q->symbol, q->offset);
 +    if (len) {
 +        *len = MIN(tmp + 1, sizeof(buf));
 +    }
 +    return buf;
 +}
 +
 +static void write_perfmap_entry(const void *start, size_t insn,
 +                                const struct debuginfo_query *q)
 +{
 +    uint16_t host_size;
 +    uintptr_t host_pc;
 +
 +    get_host_pc_size(&host_pc, &host_size, start, insn);
 +    fprintf(perfmap, "%"PRIxPTR" %"PRIx16" %s\n",
 +            host_pc, host_size, pretty_symbol(q, NULL));
 +}
 +
 +static FILE *jitdump;
 +
 +#define JITHEADER_MAGIC 0x4A695444
 +#define JITHEADER_VERSION 1
 +
 +struct jitheader {
 +    uint32_t magic;
 +    uint32_t version;
 +    uint32_t total_size;
 +    uint32_t elf_mach;
 +    uint32_t pad1;
 +    uint32_t pid;
 +    uint64_t timestamp;
 +    uint64_t flags;
 +};
 +
 +enum jit_record_type {
 +    JIT_CODE_LOAD = 0,
 +    JIT_CODE_DEBUG_INFO = 2,
 +};
 +
 +struct jr_prefix {
 +    uint32_t id;
 +    uint32_t total_size;
 +    uint64_t timestamp;
 +};
 +
 +struct jr_code_load {
 +    struct jr_prefix p;
 +
 +    uint32_t pid;
 +    uint32_t tid;
 +    uint64_t vma;
 +    uint64_t code_addr;
 +    uint64_t code_size;
 +    uint64_t code_index;
 +};
 +
 +struct debug_entry {
 +    uint64_t addr;
 +    int lineno;
 +    int discrim;
 +    const char name[];
 +};
 +
 +struct jr_code_debug_info {
 +    struct jr_prefix p;
 +
 +    uint64_t code_addr;
 +    uint64_t nr_entry;
 +    struct debug_entry entries[];
 +};
 +
 +static uint32_t get_e_machine(void)
 +{
 +    Elf64_Ehdr elf_header;
 +    FILE *exe;
 +    size_t n;
 +
 +    QEMU_BUILD_BUG_ON(offsetof(Elf32_Ehdr, e_machine) !=
 +                      offsetof(Elf64_Ehdr, e_machine));
 +
 +    exe = fopen("/proc/self/exe", "r");
 +    if (exe == NULL) {
 +        return EM_NONE;
 +    }
 +
 +    n = fread(&elf_header, sizeof(elf_header), 1, exe);
 +    fclose(exe);
 +    if (n != 1) {
 +        return EM_NONE;
 +    }
 +
 +    return elf_header.e_machine;
 +}
 +
 +void perf_enable_jitdump(void)
 +{
 +    struct jitheader header;
 +    char jitdump_file[32];
 +    void *perf_marker;
 +
 +    if (!use_rt_clock) {
 +        warn_report("CLOCK_MONOTONIC is not available, proceeding without jitdump");
 +        return;
 +    }
 +
-+    snprintf(jitdump_file, sizeof(jitdump_file), "jit-%d.dump", getpid());
+     qemu_mutex_lock(&qemu_cpu_list_lock);
-+    jitdump = safe_fopen_w(jitdump_file);
+     exclusive_idle();
-+    if (jitdump == NULL) {
-+        warn_report("Could not open %s: %s, proceeding without jitdump",
+@@ -XXX,XX +XXX,XX @@ void start_exclusive(void)
-+                    jitdump_file, strerror(errno));
+      */
      qemu_mutex_unlock(&qemu_cpu_list_lock);
 -    current_cpu->in_exclusive_context = true;
 +    current_cpu->exclusive_context_count = 1;
  }
  /* Finish an exclusive operation.  */
  void end_exclusive(void)
  {
 -    current_cpu->in_exclusive_context = false;
 +    current_cpu->exclusive_context_count--;
 +    if (current_cpu->exclusive_context_count) {
 +        return;
 +    }
-+
-+    /*
+     qemu_mutex_lock(&qemu_cpu_list_lock);
-+     * `perf inject` will see that the mapped file name in the corresponding
+     qatomic_set(&pending_cpus, 0);
 +     * PERF_RECORD_MMAP or PERF_RECORD_MMAP2 event is of the form jit-%d.dump
 +     * and will process it as a jitdump file.
 +     */
 +    perf_marker = mmap(NULL, qemu_real_host_page_size(), PROT_READ | PROT_EXEC,
 +                       MAP_PRIVATE, fileno(jitdump), 0);
 +    if (perf_marker == MAP_FAILED) {
 +        warn_report("Could not map %s: %s, proceeding without jitdump",
 +                    jitdump_file, strerror(errno));
 +        fclose(jitdump);
 +        jitdump = NULL;
 +        return;
 +    }
 +
 +    header.magic = JITHEADER_MAGIC;
 +    header.version = JITHEADER_VERSION;
 +    header.total_size = sizeof(header);
 +    header.elf_mach = get_e_machine();
 +    header.pad1 = 0;
 +    header.pid = getpid();
 +    header.timestamp = get_clock();
 +    header.flags = 0;
 +    fwrite(&header, sizeof(header), 1, jitdump);
 +}
 +
 +void perf_report_prologue(const void *start, size_t size)
 +{
 +    if (perfmap) {
 +        fprintf(perfmap, "%"PRIxPTR" %zx tcg-prologue-buffer\n",
 +                (uintptr_t)start, size);
 +    }
 +}
 +
 +/* Write a JIT_CODE_DEBUG_INFO jitdump entry. */
 +static void write_jr_code_debug_info(const void *start,
 +                                     const struct debuginfo_query *q,
 +                                     size_t icount)
 +{
 +    struct jr_code_debug_info rec;
 +    struct debug_entry ent;
 +    uintptr_t host_pc;
 +    int insn;
 +
 +    /* Write the header. */
 +    rec.p.id = JIT_CODE_DEBUG_INFO;
 +    rec.p.total_size = sizeof(rec) + sizeof(ent) + 1;
 +    rec.p.timestamp = get_clock();
 +    rec.code_addr = (uintptr_t)start;
 +    rec.nr_entry = 1;
 +    for (insn = 0; insn < icount; insn++) {
 +        if (q[insn].file) {
 +            rec.p.total_size += sizeof(ent) + strlen(q[insn].file) + 1;
 +            rec.nr_entry++;
 +        }
 +    }
 +    fwrite(&rec, sizeof(rec), 1, jitdump);
 +
 +    /* Write the main debug entries. */
 +    for (insn = 0; insn < icount; insn++) {
 +        if (q[insn].file) {
 +            get_host_pc_size(&host_pc, NULL, start, insn);
 +            ent.addr = host_pc;
 +            ent.lineno = q[insn].line;
 +            ent.discrim = 0;
 +            fwrite(&ent, sizeof(ent), 1, jitdump);
 +            fwrite(q[insn].file, strlen(q[insn].file) + 1, 1, jitdump);
 +        }
 +    }
 +
 +    /* Write the trailing debug_entry. */
 +    ent.addr = (uintptr_t)start + tcg_ctx->gen_insn_end_off[icount - 1];
 +    ent.lineno = 0;
 +    ent.discrim = 0;
 +    fwrite(&ent, sizeof(ent), 1, jitdump);
 +    fwrite("", 1, 1, jitdump);
 +}
 +
 +/* Write a JIT_CODE_LOAD jitdump entry. */
 +static void write_jr_code_load(const void *start, uint16_t host_size,
 +                               const struct debuginfo_query *q)
 +{
 +    static uint64_t code_index;
 +    struct jr_code_load rec;
 +    const char *symbol;
 +    size_t symbol_size;
 +
 +    symbol = pretty_symbol(q, &symbol_size);
 +    rec.p.id = JIT_CODE_LOAD;
 +    rec.p.total_size = sizeof(rec) + symbol_size + host_size;
 +    rec.p.timestamp = get_clock();
 +    rec.pid = getpid();
 +    rec.tid = qemu_get_thread_id();
 +    rec.vma = (uintptr_t)start;
 +    rec.code_addr = (uintptr_t)start;
 +    rec.code_size = host_size;
 +    rec.code_index = code_index++;
 +    fwrite(&rec, sizeof(rec), 1, jitdump);
 +    fwrite(symbol, symbol_size, 1, jitdump);
 +    fwrite(start, host_size, 1, jitdump);
 +}
 +
 +void perf_report_code(uint64_t guest_pc, TranslationBlock *tb,
 +                      const void *start)
 +{
 +    struct debuginfo_query *q;
 +    size_t insn;
 +
 +    if (!perfmap && !jitdump) {
 +        return;
 +    }
 +
 +    q = g_try_malloc0_n(tb->icount, sizeof(*q));
 +    if (!q) {
 +        return;
 +    }
 +
 +    debuginfo_lock();
 +
 +    /* Query debuginfo for each guest instruction. */
 +    for (insn = 0; insn < tb->icount; insn++) {
 +        /* FIXME: This replicates the restore_state_to_opc() logic. */
 +        q[insn].address = tcg_ctx->gen_insn_data[insn][0];
 +        if (TARGET_TB_PCREL) {
 +            q[insn].address |= (guest_pc & TARGET_PAGE_MASK);
 +        } else {
 +#if defined(TARGET_I386)
 +            q[insn].address -= tb->cs_base;
 +#endif
 +        }
 +        q[insn].flags = DEBUGINFO_SYMBOL | (jitdump ? DEBUGINFO_LINE : 0);
 +    }
 +    debuginfo_query(q, tb->icount);
 +
 +    /* Emit perfmap entries if needed. */
 +    if (perfmap) {
 +        flockfile(perfmap);
 +        for (insn = 0; insn < tb->icount; insn++) {
 +            write_perfmap_entry(start, insn, &q[insn]);
 +        }
 +        funlockfile(perfmap);
 +    }
 +
 +    /* Emit jitdump entries if needed. */
 +    if (jitdump) {
 +        flockfile(jitdump);
 +        write_jr_code_debug_info(start, q, tb->icount);
 +        write_jr_code_load(start, tcg_ctx->gen_insn_end_off[tb->icount - 1],
 +                           q);
 +        funlockfile(jitdump);
 +    }
 +
 +    debuginfo_unlock();
 +    g_free(q);
 +}
 +
 +void perf_exit(void)
 +{
 +    if (perfmap) {
 +        fclose(perfmap);
 +        perfmap = NULL;
 +    }
 +
 +    if (jitdump) {
 +        fclose(jitdump);
 +        jitdump = NULL;
 +    }
 +}
 diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translate-all.c
 +++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@
  #include "tb-hash.h"
  #include "tb-context.h"
  #include "internal.h"
 +#include "perf.h"
  /* Make sure all possible CPU event bits fit in tb->trace_vcpu_dstate */
  QEMU_BUILD_BUG_ON(CPU_TRACE_DSTATE_MAX_EVENTS >
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
      }
      tb->tc.size = gen_code_size;
 +    /*
 +     * For TARGET_TB_PCREL, attribute all executions of the generated
 +     * code to its first mapping.
 +     */
 +    perf_report_code(pc, tb, tcg_splitwx_to_rx(gen_code_buf));
 +
  #ifdef CONFIG_PROFILER
      qatomic_set(&prof->code_time, prof->code_time + profile_getclock() - ti);
      qatomic_set(&prof->code_in_len, prof->code_in_len + tb->size);
 diff --git a/linux-user/exit.c b/linux-user/exit.c
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/exit.c
 +++ b/linux-user/exit.c
@@ -XXX,XX +XXX,XX @@
   *  along with this program; if not, see <http://www.gnu.org/licenses/>.
   */
  #include "qemu/osdep.h"
 +#include "accel/tcg/perf.h"
  #include "exec/gdbstub.h"
  #include "qemu.h"
  #include "user-internals.h"
@@ -XXX,XX +XXX,XX @@ void preexit_cleanup(CPUArchState *env, int code)
  #endif
          gdb_exit(code);
          qemu_plugin_user_exit();
 +        perf_exit();
  }
 diff --git a/linux-user/main.c b/linux-user/main.c
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/main.c
 +++ b/linux-user/main.c
@@ -XXX,XX +XXX,XX @@
  #include "signal-common.h"
  #include "loader.h"
  #include "user-mmap.h"
 +#include "accel/tcg/perf.h"
  #ifdef CONFIG_SEMIHOSTING
  #include "semihosting/semihost.h"
@@ -XXX,XX +XXX,XX @@ static void handle_arg_abi_call0(const char *arg)
  }
  #endif
 +static void handle_arg_perfmap(const char *arg)
 +{
 +    perf_enable_perfmap();
 +}
 +
 +static void handle_arg_jitdump(const char *arg)
 +{
 +    perf_enable_jitdump();
 +}
 +
  static QemuPluginList plugins = QTAILQ_HEAD_INITIALIZER(plugins);
  #ifdef CONFIG_PLUGIN
@@ -XXX,XX +XXX,XX @@ static const struct qemu_argument arg_table[] = {
      {"xtensa-abi-call0", "QEMU_XTENSA_ABI_CALL0", false, handle_arg_abi_call0,
       "",           "assume CALL0 Xtensa ABI"},
  #endif
 +    {"perfmap",    "QEMU_PERFMAP",     false, handle_arg_perfmap,
 +     "",           "Generate a /tmp/perf-${pid}.map file for perf"},
 +    {"jitdump",    "QEMU_JITDUMP",     false, handle_arg_jitdump,
 +     "",           "Generate a jit-${pid}.dump file for perf"},
      {NULL, NULL, false, NULL, NULL, NULL}
  };
 diff --git a/softmmu/vl.c b/softmmu/vl.c
 index XXXXXXX..XXXXXXX 100644
 --- a/softmmu/vl.c
 +++ b/softmmu/vl.c
@@ -XXX,XX +XXX,XX @@
  #include "fsdev/qemu-fsdev.h"
  #endif
  #include "sysemu/qtest.h"
 +#ifdef CONFIG_TCG
 +#include "accel/tcg/perf.h"
 +#endif
  #include "disas/disas.h"
@@ -XXX,XX +XXX,XX @@ void qemu_init(int argc, char **argv)
              case QEMU_OPTION_DFILTER:
                  qemu_set_dfilter_ranges(optarg, &error_fatal);
                  break;
 +#if defined(CONFIG_TCG) && defined(CONFIG_LINUX)
 +            case QEMU_OPTION_perfmap:
 +                perf_enable_perfmap();
 +                break;
 +            case QEMU_OPTION_jitdump:
 +                perf_enable_jitdump();
 +                break;
 +#endif
              case QEMU_OPTION_seed:
                  qemu_guest_random_seed_main(optarg, &error_fatal);
                  break;
 diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg.c
 +++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/log.h"
  #include "tcg/tcg-ldst.h"
  #include "tcg-internal.h"
 +#include "accel/tcg/perf.h"
  /* Forward declarations for functions declared in tcg-target.c.inc and
     used here. */
@@ -XXX,XX +XXX,XX @@ void tcg_prologue_init(TCGContext *s)
  #endif
      prologue_size = tcg_current_code_size(s);
 +    perf_report_prologue(s->code_gen_ptr, prologue_size);
  #ifndef CONFIG_TCG_INTERPRETER
      flush_idcache_range((uintptr_t)tcg_splitwx_to_rx(s->code_buf),
 diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/meson.build
 +++ b/accel/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ tcg_ss.add(when: 'CONFIG_USER_ONLY', if_true: files('user-exec.c'))
  tcg_ss.add(when: 'CONFIG_SOFTMMU', if_false: files('user-exec-stub.c'))
  tcg_ss.add(when: 'CONFIG_PLUGIN', if_true: [files('plugin-gen.c')])
  tcg_ss.add(when: libdw, if_true: files('debuginfo.c'))
 +tcg_ss.add(when: 'CONFIG_LINUX', if_true: files('perf.c'))
  specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_ss)
  specific_ss.add(when: ['CONFIG_SOFTMMU', 'CONFIG_TCG'], if_true: files(
 diff --git a/qemu-options.hx b/qemu-options.hx
 index XXXXXXX..XXXXXXX 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ SRST
      Enable synchronization profiling.
  ERST
 +#if defined(CONFIG_TCG) && defined(CONFIG_LINUX)
 +DEF("perfmap", 0, QEMU_OPTION_perfmap,
 +    "-perfmap        generate a /tmp/perf-${pid}.map file for perf\n",
 +    QEMU_ARCH_ALL)
 +SRST
 +``-perfmap``
 +    Generate a map file for Linux perf tools that will allow basic profiling
 +    information to be broken down into basic blocks.
 +ERST
 +
 +DEF("jitdump", 0, QEMU_OPTION_jitdump,
 +    "-jitdump        generate a jit-${pid}.dump file for perf\n",
 +    QEMU_ARCH_ALL)
 +SRST
 +``-jitdump``
 +    Generate a dump file for Linux perf tools that maps basic blocks to symbol
 +    names, line numbers and JITted code.
 +ERST
 +#endif
 +
  DEFHEADING()
  DEFHEADING(Generic object creation:)
 --
 .34.1

-New patch
+[PULL v2 5/8] linux-user/microblaze: Handle privileged exception
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+Follow what kernel's full_exception() is doing.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Message-Id: <20230214140829.45392-4-iii@linux.ibm.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ linux-user/microblaze/cpu_loop.c | 10 ++++++++--
+file changed, 8 insertions(+), 2 deletions(-)
+diff --git a/linux-user/microblaze/cpu_loop.c b/linux-user/microblaze/cpu_loop.c
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/microblaze/cpu_loop.c
++++ b/linux-user/microblaze/cpu_loop.c
+@@ -XXX,XX +XXX,XX @@
+ void cpu_loop(CPUMBState *env)
+ {
++    int trapnr, ret, si_code, sig;
+     CPUState *cs = env_cpu(env);
+-    int trapnr, ret, si_code;
+     while (1) {
+         cpu_exec_start(cs);
+@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUMBState *env)
+             env->iflags &= ~(IMM_FLAG | D_FLAG);
+             switch (env->esr & 31) {
+             case ESR_EC_DIVZERO:
++                sig = TARGET_SIGFPE;
+                 si_code = TARGET_FPE_INTDIV;
+                 break;
+             case ESR_EC_FPU:
+@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUMBState *env)
+                  * if there's no recognized bit set.  Possibly this
+                  * implies that si_code is 0, but follow the structure.
+                  */
++                sig = TARGET_SIGFPE;
+                 si_code = env->fsr;
+                 if (si_code & FSR_IO) {
+                     si_code = TARGET_FPE_FLTINV;
+@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUMBState *env)
+                     si_code = TARGET_FPE_FLTRES;
+                 }
+                 break;
++            case ESR_EC_PRIVINSN:
++                sig = SIGILL;
++                si_code = ILL_PRVOPC;
++                break;
+             default:
+                 fprintf(stderr, "Unhandled hw-exception: 0x%x\n",
+                         env->esr & ESR_EC_MASK);
+                 cpu_dump_state(cs, stderr, 0);
+                 exit(EXIT_FAILURE);
+             }
+-            force_sig_fault(TARGET_SIGFPE, si_code, env->pc);
++            force_sig_fault(sig, si_code, env->pc);
+             break;
+         case EXCP_DEBUG:
+--
+.34.1

-[PULL 2/5] accel/tcg: Add debuginfo support
+[PULL v2 6/8] target/microblaze: Add gdbstub xml
-From: Ilya Leoshkevich <iii@linux.ibm.com>
+Mirroring the upstream gdb xml files, the two stack boundary
 registers are separated out.
-Add libdw-based functions for loading and querying debuginfo. Load
+Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
 debuginfo from the system and the linux-user loaders.
 This is useful for the upcoming perf support, which can then put
 human-readable guest symbols instead of raw guest PCs into perfmap and
 jitdump files.
 Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Message-Id: <20230112152013.125680-3-iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- meson.build            |  8 ++++
+ target/microblaze/cpu.h                     |  2 +
- accel/tcg/debuginfo.h  | 77 +++++++++++++++++++++++++++++++++
+ target/microblaze/cpu.c                     |  7 ++-
- accel/tcg/debuginfo.c  | 96 ++++++++++++++++++++++++++++++++++++++++++
+ target/microblaze/gdbstub.c                 | 51 +++++++++++-----
- hw/core/loader.c       |  5 +++
+ configs/targets/microblaze-linux-user.mak   |  1 +
- linux-user/elfload.c   |  3 ++
+ configs/targets/microblaze-softmmu.mak      |  1 +
- accel/tcg/meson.build  |  1 +
+ configs/targets/microblazeel-linux-user.mak |  1 +
- linux-user/meson.build |  1 +
+ configs/targets/microblazeel-softmmu.mak    |  1 +
-files changed, 191 insertions(+)
+ gdb-xml/microblaze-core.xml                 | 67 +++++++++++++++++++++
- create mode 100644 accel/tcg/debuginfo.h
+ gdb-xml/microblaze-stack-protect.xml        | 12 ++++
- create mode 100644 accel/tcg/debuginfo.c
+files changed, 128 insertions(+), 15 deletions(-)
  create mode 100644 gdb-xml/microblaze-core.xml
  create mode 100644 gdb-xml/microblaze-stack-protect.xml
-diff --git a/meson.build b/meson.build
+diff --git a/target/microblaze/cpu.h b/target/microblaze/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/meson.build
+--- a/target/microblaze/cpu.h
-+++ b/meson.build
++++ b/target/microblaze/cpu.h
-@@ -XXX,XX +XXX,XX @@ if libbpf.found() and not cc.links('''
+@@ -XXX,XX +XXX,XX @@ hwaddr mb_cpu_get_phys_page_attrs_debug(CPUState *cpu, vaddr addr,
-   endif
+                                         MemTxAttrs *attrs);
- endif
+ int mb_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
+ int mb_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
-+# libdw
++int mb_cpu_gdb_read_stack_protect(CPUArchState *cpu, GByteArray *buf, int reg);
-+libdw = dependency('libdw',
++int mb_cpu_gdb_write_stack_protect(CPUArchState *cpu, uint8_t *buf, int reg);
-+                   method: 'pkg-config',
-+                   kwargs: static_kwargs,
+ static inline uint32_t mb_cpu_read_msr(const CPUMBState *env)
-+                   required: false)
+ {
-+
+diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
- #################
+index XXXXXXX..XXXXXXX 100644
- # config-host.h #
+--- a/target/microblaze/cpu.c
- #################
++++ b/target/microblaze/cpu.c
-@@ -XXX,XX +XXX,XX @@ config_host_data.set('CONFIG_DBUS_DISPLAY', dbus_display)
+@@ -XXX,XX +XXX,XX @@
- config_host_data.set('CONFIG_CFI', get_option('cfi'))
+ #include "qemu/module.h"
- config_host_data.set('CONFIG_SELINUX', selinux.found())
+ #include "hw/qdev-properties.h"
- config_host_data.set('CONFIG_XEN_BACKEND', xen.found())
+ #include "exec/exec-all.h"
-+config_host_data.set('CONFIG_LIBDW', libdw.found())
++#include "exec/gdbstub.h"
- if xen.found()
+ #include "fpu/softfloat-helpers.h"
-   # protect from xen.version() having less than three components
-   xen_version = xen.version().split('.') + ['0', '0']
+ static const struct {
-@@ -XXX,XX +XXX,XX @@ summary_info += {'libudev':           libudev}
+@@ -XXX,XX +XXX,XX @@ static void mb_cpu_initfn(Object *obj)
- # Dummy dependency, keep .found()
+     CPUMBState *env = &cpu->env;
- summary_info += {'FUSE lseek':        fuse_lseek.found()}
- summary_info += {'selinux':           selinux}
+     cpu_set_cpustate_pointers(cpu);
-+summary_info += {'libdw':             libdw}
++    gdb_register_coprocessor(CPU(cpu), mb_cpu_gdb_read_stack_protect,
- summary(summary_info, bool_yn: true, section: 'Dependencies')
++                             mb_cpu_gdb_write_stack_protect, 2,
++                             "microblaze-stack-protect.xml", 0);
- if not supported_cpus.contains(cpu)
-diff --git a/accel/tcg/debuginfo.h b/accel/tcg/debuginfo.h
+     set_float_rounding_mode(float_round_nearest_even, &env->fp_status);
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
      cc->sysemu_ops = &mb_sysemu_ops;
  #endif
      device_class_set_props(dc, mb_properties);
 -    cc->gdb_num_core_regs = 32 + 27;
 +    cc->gdb_num_core_regs = 32 + 25;
 +    cc->gdb_core_xml_file = "microblaze-core.xml";
      cc->disas_set_info = mb_disas_set_info;
      cc->tcg_ops = &mb_tcg_ops;
 diff --git a/target/microblaze/gdbstub.c b/target/microblaze/gdbstub.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/microblaze/gdbstub.c
 +++ b/target/microblaze/gdbstub.c
@@ -XXX,XX +XXX,XX @@ enum {
      GDB_PVR0  = 32 + 6,
      GDB_PVR11 = 32 + 17,
      GDB_EDR   = 32 + 18,
 -    GDB_SLR   = 32 + 25,
 -    GDB_SHR   = 32 + 26,
 +};
 +
 +enum {
 +    GDB_SP_SHL,
 +    GDB_SP_SHR,
  };
  int mb_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
@@ -XXX,XX +XXX,XX @@ int mb_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
      case GDB_EDR:
          val = env->edr;
          break;
 -    case GDB_SLR:
 -        val = env->slr;
 -        break;
 -    case GDB_SHR:
 -        val = env->shr;
 -        break;
      default:
          /* Other SRegs aren't modeled, so report a value of 0 */
          val = 0;
@@ -XXX,XX +XXX,XX @@ int mb_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
      return gdb_get_reg32(mem_buf, val);
  }
 +int mb_cpu_gdb_read_stack_protect(CPUMBState *env, GByteArray *mem_buf, int n)
 +{
 +    uint32_t val;
 +
 +    switch (n) {
 +    case GDB_SP_SHL:
 +        val = env->slr;
 +        break;
 +    case GDB_SP_SHR:
 +        val = env->shr;
 +        break;
 +    default:
 +        return 0;
 +    }
 +    return gdb_get_reg32(mem_buf, val);
 +}
 +
  int mb_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
  {
      MicroBlazeCPU *cpu = MICROBLAZE_CPU(cs);
@@ -XXX,XX +XXX,XX @@ int mb_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
      case GDB_EDR:
          env->edr = tmp;
          break;
 -    case GDB_SLR:
 -        env->slr = tmp;
 -        break;
 -    case GDB_SHR:
 -        env->shr = tmp;
 -        break;
 +    }
 +    return 4;
 +}
 +
 +int mb_cpu_gdb_write_stack_protect(CPUMBState *env, uint8_t *mem_buf, int n)
 +{
 +    switch (n) {
 +    case GDB_SP_SHL:
 +        env->slr = ldl_p(mem_buf);
 +        break;
 +    case GDB_SP_SHR:
 +        env->shr = ldl_p(mem_buf);
 +        break;
 +    default:
 +        return 0;
      }
      return 4;
  }
 diff --git a/configs/targets/microblaze-linux-user.mak b/configs/targets/microblaze-linux-user.mak
 index XXXXXXX..XXXXXXX 100644
 --- a/configs/targets/microblaze-linux-user.mak
 +++ b/configs/targets/microblaze-linux-user.mak
@@ -XXX,XX +XXX,XX @@ TARGET_SYSTBL_ABI=common
  TARGET_SYSTBL=syscall.tbl
  TARGET_BIG_ENDIAN=y
  TARGET_HAS_BFLT=y
 +TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
 diff --git a/configs/targets/microblaze-softmmu.mak b/configs/targets/microblaze-softmmu.mak
 index XXXXXXX..XXXXXXX 100644
 --- a/configs/targets/microblaze-softmmu.mak
 +++ b/configs/targets/microblaze-softmmu.mak
@@ -XXX,XX +XXX,XX @@ TARGET_ARCH=microblaze
  TARGET_BIG_ENDIAN=y
  TARGET_SUPPORTS_MTTCG=y
  TARGET_NEED_FDT=y
 +TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
 diff --git a/configs/targets/microblazeel-linux-user.mak b/configs/targets/microblazeel-linux-user.mak
 index XXXXXXX..XXXXXXX 100644
 --- a/configs/targets/microblazeel-linux-user.mak
 +++ b/configs/targets/microblazeel-linux-user.mak
@@ -XXX,XX +XXX,XX @@ TARGET_ARCH=microblaze
  TARGET_SYSTBL_ABI=common
  TARGET_SYSTBL=syscall.tbl
  TARGET_HAS_BFLT=y
 +TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
 diff --git a/configs/targets/microblazeel-softmmu.mak b/configs/targets/microblazeel-softmmu.mak
 index XXXXXXX..XXXXXXX 100644
 --- a/configs/targets/microblazeel-softmmu.mak
 +++ b/configs/targets/microblazeel-softmmu.mak
@@ -XXX,XX +XXX,XX @@
  TARGET_ARCH=microblaze
  TARGET_SUPPORTS_MTTCG=y
  TARGET_NEED_FDT=y
 +TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
 diff --git a/gdb-xml/microblaze-core.xml b/gdb-xml/microblaze-core.xml
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/accel/tcg/debuginfo.h
++++ b/gdb-xml/microblaze-core.xml
 @@ -XXX,XX +XXX,XX @@
-+/*
++<?xml version="1.0"?>
-+ * Debug information support.
++<!-- Copyright (C) 2008 Free Software Foundation, Inc.
-+ *
++
-+ * SPDX-License-Identifier: GPL-2.0-or-later
++     Copying and distribution of this file, with or without modification,
-+ */
++     are permitted in any medium without royalty provided the copyright
-+
++     notice and this notice are preserved.  -->
-+#ifndef ACCEL_TCG_DEBUGINFO_H
++
-+#define ACCEL_TCG_DEBUGINFO_H
++<!DOCTYPE feature SYSTEM "gdb-target.dtd">
-+
++<feature name="org.gnu.gdb.microblaze.core">
-+/*
++  <reg name="r0" bitsize="32" regnum="0"/>
-+ * Debuginfo describing a certain address.
++  <reg name="r1" bitsize="32" type="data_ptr"/>
-+ */
++  <reg name="r2" bitsize="32"/>
-+struct debuginfo_query {
++  <reg name="r3" bitsize="32"/>
-+    uint64_t address;    /* Input: address. */
++  <reg name="r4" bitsize="32"/>
-+    int flags;           /* Input: debuginfo subset. */
++  <reg name="r5" bitsize="32"/>
-+    const char *symbol;  /* Symbol that the address is part of. */
++  <reg name="r6" bitsize="32"/>
-+    uint64_t offset;     /* Offset from the symbol. */
++  <reg name="r7" bitsize="32"/>
-+    const char *file;    /* Source file associated with the address. */
++  <reg name="r8" bitsize="32"/>
-+    int line;            /* Line number in the source file. */
++  <reg name="r9" bitsize="32"/>
-+};
++  <reg name="r10" bitsize="32"/>
-+
++  <reg name="r11" bitsize="32"/>
-+/*
++  <reg name="r12" bitsize="32"/>
-+ * Debuginfo subsets.
++  <reg name="r13" bitsize="32"/>
-+ */
++  <reg name="r14" bitsize="32"/>
-+#define DEBUGINFO_SYMBOL BIT(1)
++  <reg name="r15" bitsize="32"/>
-+#define DEBUGINFO_LINE   BIT(2)
++  <reg name="r16" bitsize="32"/>
-+
++  <reg name="r17" bitsize="32"/>
-+#if defined(CONFIG_TCG) && defined(CONFIG_LIBDW)
++  <reg name="r18" bitsize="32"/>
-+/*
++  <reg name="r19" bitsize="32"/>
-+ * Load debuginfo for the specified guest ELF image.
++  <reg name="r20" bitsize="32"/>
-+ * Return true on success, false on failure.
++  <reg name="r21" bitsize="32"/>
-+ */
++  <reg name="r22" bitsize="32"/>
-+void debuginfo_report_elf(const char *name, int fd, uint64_t bias);
++  <reg name="r23" bitsize="32"/>
-+
++  <reg name="r24" bitsize="32"/>
-+/*
++  <reg name="r25" bitsize="32"/>
-+ * Take the debuginfo lock.
++  <reg name="r26" bitsize="32"/>
-+ */
++  <reg name="r27" bitsize="32"/>
-+void debuginfo_lock(void);
++  <reg name="r28" bitsize="32"/>
-+
++  <reg name="r29" bitsize="32"/>
-+/*
++  <reg name="r30" bitsize="32"/>
-+ * Fill each on N Qs with the debuginfo about Q->ADDRESS as specified by
++  <reg name="r31" bitsize="32"/>
-+ * Q->FLAGS:
++  <reg name="rpc" bitsize="32" type="code_ptr"/>
-+ *
++  <reg name="rmsr" bitsize="32"/>
-+ * - DEBUGINFO_SYMBOL: update Q->SYMBOL and Q->OFFSET. If symbol debuginfo is
++  <reg name="rear" bitsize="32"/>
-+ *                     missing, then leave them as is.
++  <reg name="resr" bitsize="32"/>
-+ * - DEBUINFO_LINE: update Q->FILE and Q->LINE. If line debuginfo is missing,
++  <reg name="rfsr" bitsize="32"/>
-+ *                  then leave them as is.
++  <reg name="rbtr" bitsize="32"/>
-+ *
++  <reg name="rpvr0" bitsize="32"/>
-+ * This function must be called under the debuginfo lock. The results can be
++  <reg name="rpvr1" bitsize="32"/>
-+ * accessed only until the debuginfo lock is released.
++  <reg name="rpvr2" bitsize="32"/>
-+ */
++  <reg name="rpvr3" bitsize="32"/>
-+void debuginfo_query(struct debuginfo_query *q, size_t n);
++  <reg name="rpvr4" bitsize="32"/>
-+
++  <reg name="rpvr5" bitsize="32"/>
-+/*
++  <reg name="rpvr6" bitsize="32"/>
-+ * Release the debuginfo lock.
++  <reg name="rpvr7" bitsize="32"/>
-+ */
++  <reg name="rpvr8" bitsize="32"/>
-+void debuginfo_unlock(void);
++  <reg name="rpvr9" bitsize="32"/>
-+#else
++  <reg name="rpvr10" bitsize="32"/>
-+static inline void debuginfo_report_elf(const char *image_name, int image_fd,
++  <reg name="rpvr11" bitsize="32"/>
-+                                        uint64_t load_bias)
++  <reg name="redr" bitsize="32"/>
-+{
++  <reg name="rpid" bitsize="32"/>
-+}
++  <reg name="rzpr" bitsize="32"/>
-+
++  <reg name="rtlbx" bitsize="32"/>
-+static inline void debuginfo_lock(void)
++  <reg name="rtlbsx" bitsize="32"/>
-+{
++  <reg name="rtlblo" bitsize="32"/>
-+}
++  <reg name="rtlbhi" bitsize="32"/>
-+
++</feature>
-+static inline void debuginfo_query(struct debuginfo_query *q, size_t n)
+diff --git a/gdb-xml/microblaze-stack-protect.xml b/gdb-xml/microblaze-stack-protect.xml
 +{
 +}
 +
 +static inline void debuginfo_unlock(void)
 +{
 +}
 +#endif
 +
 +#endif
 diff --git a/accel/tcg/debuginfo.c b/accel/tcg/debuginfo.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/accel/tcg/debuginfo.c
++++ b/gdb-xml/microblaze-stack-protect.xml
 @@ -XXX,XX +XXX,XX @@
-+/*
++<?xml version="1.0"?>
-+ * Debug information support.
++<!-- Copyright (C) 2008 Free Software Foundation, Inc.
-+ *
++
-+ * SPDX-License-Identifier: GPL-2.0-or-later
++     Copying and distribution of this file, with or without modification,
-+ */
++     are permitted in any medium without royalty provided the copyright
-+
++     notice and this notice are preserved.  -->
-+#include "qemu/osdep.h"
++
-+#include "qemu/lockable.h"
++<!DOCTYPE feature SYSTEM "gdb-target.dtd">
-+
++<feature name="org.gnu.gdb.microblaze.stack-protect">
-+#include <elfutils/libdwfl.h>
++  <reg name="rslr" bitsize="32"/>
-+
++  <reg name="rshr" bitsize="32"/>
-+#include "debuginfo.h"
++</feature>
 +
 +static QemuMutex lock;
 +static Dwfl *dwfl;
 +static const Dwfl_Callbacks dwfl_callbacks = {
 +    .find_elf = NULL,
 +    .find_debuginfo = dwfl_standard_find_debuginfo,
 +    .section_address = NULL,
 +    .debuginfo_path = NULL,
 +};
 +
 +__attribute__((constructor))
 +static void debuginfo_init(void)
 +{
 +    qemu_mutex_init(&lock);
 +}
 +
 +void debuginfo_report_elf(const char *name, int fd, uint64_t bias)
 +{
 +    QEMU_LOCK_GUARD(&lock);
 +
 +    if (dwfl) {
 +        dwfl_report_begin_add(dwfl);
 +    } else {
 +        dwfl = dwfl_begin(&dwfl_callbacks);
 +    }
 +
 +    if (dwfl) {
 +        dwfl_report_elf(dwfl, name, name, fd, bias, true);
 +        dwfl_report_end(dwfl, NULL, NULL);
 +    }
 +}
 +
 +void debuginfo_lock(void)
 +{
 +    qemu_mutex_lock(&lock);
 +}
 +
 +void debuginfo_query(struct debuginfo_query *q, size_t n)
 +{
 +    const char *symbol, *file;
 +    Dwfl_Module *dwfl_module;
 +    Dwfl_Line *dwfl_line;
 +    GElf_Off dwfl_offset;
 +    GElf_Sym dwfl_sym;
 +    size_t i;
 +    int line;
 +
 +    if (!dwfl) {
 +        return;
 +    }
 +
 +    for (i = 0; i < n; i++) {
 +        dwfl_module = dwfl_addrmodule(dwfl, q[i].address);
 +        if (!dwfl_module) {
 +            continue;
 +        }
 +
 +        if (q[i].flags & DEBUGINFO_SYMBOL) {
 +            symbol = dwfl_module_addrinfo(dwfl_module, q[i].address,
 +                                          &dwfl_offset, &dwfl_sym,
 +                                          NULL, NULL, NULL);
 +            if (symbol) {
 +                q[i].symbol = symbol;
 +                q[i].offset = dwfl_offset;
 +            }
 +        }
 +
 +        if (q[i].flags & DEBUGINFO_LINE) {
 +            dwfl_line = dwfl_module_getsrc(dwfl_module, q[i].address);
 +            if (dwfl_line) {
 +                file = dwfl_lineinfo(dwfl_line, NULL, &line, 0, NULL, NULL);
 +                if (file) {
 +                    q[i].file = file;
 +                    q[i].line = line;
 +                }
 +            }
 +        }
 +    }
 +}
 +
 +void debuginfo_unlock(void)
 +{
 +    qemu_mutex_unlock(&lock);
 +}
 diff --git a/hw/core/loader.c b/hw/core/loader.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/core/loader.c
 +++ b/hw/core/loader.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/boards.h"
  #include "qemu/cutils.h"
  #include "sysemu/runstate.h"
 +#include "accel/tcg/debuginfo.h"
  #include <zlib.h>
@@ -XXX,XX +XXX,XX @@ ssize_t load_elf_ram_sym(const char *filename,
                           clear_lsb, data_swab, as, load_rom, sym_cb);
      }
 +    if (ret != ELF_LOAD_FAILED) {
 +        debuginfo_report_elf(filename, fd, 0);
 +    }
 +
   fail:
      close(fd);
      return ret;
 diff --git a/linux-user/elfload.c b/linux-user/elfload.c
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/elfload.c
 +++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/selfmap.h"
  #include "qapi/error.h"
  #include "target_signal.h"
 +#include "accel/tcg/debuginfo.h"
  #ifdef _ARCH_PPC64
  #undef ARCH_DLINFO
@@ -XXX,XX +XXX,XX @@ static void load_elf_image(const char *image_name, int image_fd,
          load_symbols(ehdr, image_fd, load_bias);
      }
 +    debuginfo_report_elf(image_name, image_fd, load_bias);
 +
      mmap_unlock();
      close(image_fd);
 diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/meson.build
 +++ b/accel/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ tcg_ss.add(files(
  tcg_ss.add(when: 'CONFIG_USER_ONLY', if_true: files('user-exec.c'))
  tcg_ss.add(when: 'CONFIG_SOFTMMU', if_false: files('user-exec-stub.c'))
  tcg_ss.add(when: 'CONFIG_PLUGIN', if_true: [files('plugin-gen.c')])
 +tcg_ss.add(when: libdw, if_true: files('debuginfo.c'))
  specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_ss)
  specific_ss.add(when: ['CONFIG_SOFTMMU', 'CONFIG_TCG'], if_true: files(
 diff --git a/linux-user/meson.build b/linux-user/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/meson.build
 +++ b/linux-user/meson.build
@@ -XXX,XX +XXX,XX @@ linux_user_ss.add(files(
    'uname.c',
  ))
  linux_user_ss.add(rt)
 +linux_user_ss.add(libdw)
  linux_user_ss.add(when: 'TARGET_HAS_BFLT', if_true: files('flatload.c'))
  linux_user_ss.add(when: 'TARGET_I386', if_true: files('vm86.c'))
 --
 .34.1

-New patch
+[PULL v2 7/8] util/cacheflush: fix cache on windows-arm64
+From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+ctr_el0 access is privileged on this platform and fails as an illegal
+instruction.
+Windows does not offer a way to flush data cache from userspace, and
+only FlushInstructionCache is available in Windows API.
+The generic implementation of flush_idcache_range uses,
+__builtin___clear_cache, which already use the FlushInstructionCache
+function. So we rely on that.
+Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20230221153006.20300-2-pierrick.bouvier@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ util/cacheflush.c | 14 +++++++++++---
+file changed, 11 insertions(+), 3 deletions(-)
+diff --git a/util/cacheflush.c b/util/cacheflush.c
+index XXXXXXX..XXXXXXX 100644
+--- a/util/cacheflush.c
++++ b/util/cacheflush.c
+@@ -XXX,XX +XXX,XX @@ static void sys_cache_info(int *isize, int *dsize)
+ static bool have_coherent_icache;
+ #endif
+-#if defined(__aarch64__) && !defined(CONFIG_DARWIN)
+-/* Apple does not expose CTR_EL0, so we must use system interfaces. */
++#if defined(__aarch64__) && !defined(CONFIG_DARWIN) && !defined(CONFIG_WIN32)
++/*
++ * Apple does not expose CTR_EL0, so we must use system interfaces.
++ * Windows neither, but we use a generic implementation of flush_idcache_range
++ * in this case.
++ */
+ static uint64_t save_ctr_el0;
+ static void arch_cache_info(int *isize, int *dsize)
+ {
+@@ -XXX,XX +XXX,XX @@ static void __attribute__((constructor)) init_cache_info(void)
+ /* Caches are coherent and do not require flushing; symbol inline. */
+-#elif defined(__aarch64__)
++#elif defined(__aarch64__) && !defined(CONFIG_WIN32)
++/*
++ * For Windows, we use generic implementation of flush_idcache_range, that
++ * performs a call to FlushInstructionCache, through __builtin___clear_cache.
++ */
+ #ifdef CONFIG_DARWIN
+ /* Apple does not expose CTR_EL0, so we must use system interfaces. */
+--
+.34.1

-[PULL 4/5] util/bufferiszero: Use __attribute__((target)) for avx2/avx512
+[PULL v2 8/8] sysemu/os-win32: fix setjmp/longjmp on windows-arm64
-Use the attribute, which is supported by clang, instead of
+From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 the #pragma, which is not supported and, for some reason,
 also not detected by the meson probe, so we fail by -Werror.
-Include only <immintrin.h> as that is the outermost "official"
+Windows implementation of setjmp/longjmp is done in
-header for these intrinsics -- emmintrin.h and smmintrin -- are
+C:/WINDOWS/system32/ucrtbase.dll. Alas, on arm64, it seems to *always*
-older SSE2 and SSE4 specific headers, while the immintrin.h
+perform stack unwinding, which crashes from generated code.
 includes all of the Intel intrinsics.
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+By using alternative implementation built in mingw, we avoid doing stack
 unwinding and this fixes crash when calling longjmp.
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Acked-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20230221153006.20300-3-pierrick.bouvier@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- meson.build         |  8 ++------
+ include/sysemu/os-win32.h | 28 ++++++++++++++++++++++++----
- util/bufferiszero.c | 41 ++++++-----------------------------------
+ meson.build               | 21 +++++++++++++++++++++
-files changed, 8 insertions(+), 41 deletions(-)
+files changed, 45 insertions(+), 4 deletions(-)
+diff --git a/include/sysemu/os-win32.h b/include/sysemu/os-win32.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/sysemu/os-win32.h
++++ b/include/sysemu/os-win32.h
+@@ -XXX,XX +XXX,XX @@ typedef struct sockaddr_un {
+ extern "C" {
+ #endif
+-#if defined(_WIN64)
+-/* On w64, setjmp is implemented by _setjmp which needs a second parameter.
++#if defined(__aarch64__)
++/*
++ * On windows-arm64, setjmp is available in only one variant, and longjmp always
++ * does stack unwinding. This crash with generated code.
++ * Thus, we use another implementation of setjmp (not windows one), coming from
++ * mingw, which never performs stack unwinding.
++ */
++#undef setjmp
++#undef longjmp
++/*
++ * These functions are not declared in setjmp.h because __aarch64__ defines
++ * setjmp to _setjmpex instead. However, they are still defined in libmingwex.a,
++ * which gets linked automatically.
++ */
++extern int __mingw_setjmp(jmp_buf);
++extern void __attribute__((noreturn)) __mingw_longjmp(jmp_buf, int);
++#define setjmp(env) __mingw_setjmp(env)
++#define longjmp(env, val) __mingw_longjmp(env, val)
++#elif defined(_WIN64)
++/*
++ * On windows-x64, setjmp is implemented by _setjmp which needs a second parameter.
+  * If this parameter is NULL, longjump does no stack unwinding.
+  * That is what we need for QEMU. Passing the value of register rsp (default)
+- * lets longjmp try a stack unwinding which will crash with generated code. */
++ * lets longjmp try a stack unwinding which will crash with generated code.
++ */
+ # undef setjmp
+ # define setjmp(env) _setjmp(env, NULL)
+-#endif
++#endif /* __aarch64__ */
+ /* QEMU uses sigsetjmp()/siglongjmp() as the portable way to specify
+  * "longjmp and don't touch the signal masks". Since we know that the
+  * savemask parameter will always be zero we can safely define these
 diff --git a/meson.build b/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -XXX,XX +XXX,XX @@ config_host_data.set('CONFIG_CPUID_H', have_cpuid_h)
+@@ -XXX,XX +XXX,XX @@ if targetos == 'windows'
- config_host_data.set('CONFIG_AVX2_OPT', get_option('avx2') \
+     }''', name: '_lock_file and _unlock_file'))
-   .require(have_cpuid_h, error_message: 'cpuid.h not available, cannot enable AVX2') \
+ endif
-   .require(cc.links('''
--    #pragma GCC push_options
++if targetos == 'windows'
--    #pragma GCC target("avx2")
++  mingw_has_setjmp_longjmp = cc.links('''
-     #include <cpuid.h>
++    #include <setjmp.h>
-     #include <immintrin.h>
++    int main(void) {
--    static int bar(void *a) {
++      /*
-+    static int __attribute__((target("avx2"))) bar(void *a) {
++       * These functions are not available in setjmp header, but may be
-       __m256i x = *(__m256i *)a;
++       * available at link time, from libmingwex.a.
-       return _mm256_testz_si256(x, x);
++       */
-     }
++      extern int __mingw_setjmp(jmp_buf);
-@@ -XXX,XX +XXX,XX @@ config_host_data.set('CONFIG_AVX2_OPT', get_option('avx2') \
++      extern void __attribute__((noreturn)) __mingw_longjmp(jmp_buf, int);
- config_host_data.set('CONFIG_AVX512F_OPT', get_option('avx512f') \
++      jmp_buf env;
-   .require(have_cpuid_h, error_message: 'cpuid.h not available, cannot enable AVX512F') \
++      __mingw_setjmp(env);
-   .require(cc.links('''
++      __mingw_longjmp(env, 0);
--    #pragma GCC push_options
++    }
--    #pragma GCC target("avx512f")
++  ''', name: 'mingw setjmp and longjmp')
-     #include <cpuid.h>
++
-     #include <immintrin.h>
++  if cpu == 'aarch64' and not mingw_has_setjmp_longjmp
--    static int bar(void *a) {
++    error('mingw must provide setjmp/longjmp for windows-arm64')
-+    static int __attribute__((target("avx512f"))) bar(void *a) {
++  endif
-       __m512i x = *(__m512i *)a;
++endif
-       return _mm512_test_epi64_mask(x, x);
++
-     }
+ ########################
-diff --git a/util/bufferiszero.c b/util/bufferiszero.c
+ # Target configuration #
-index XXXXXXX..XXXXXXX 100644
+ ########################
 --- a/util/bufferiszero.c
 +++ b/util/bufferiszero.c
@@ -XXX,XX +XXX,XX @@ buffer_zero_int(const void *buf, size_t len)
  }
  #if defined(CONFIG_AVX512F_OPT) || defined(CONFIG_AVX2_OPT) || defined(__SSE2__)
 -/* Do not use push_options pragmas unnecessarily, because clang
 - * does not support them.
 - */
 -#if defined(CONFIG_AVX512F_OPT) || defined(CONFIG_AVX2_OPT)
 -#pragma GCC push_options
 -#pragma GCC target("sse2")
 -#endif
 -#include <emmintrin.h>
 +#include <immintrin.h>
  /* Note that each of these vectorized functions require len >= 64.  */
 -static bool
 +static bool __attribute__((target("sse2")))
  buffer_zero_sse2(const void *buf, size_t len)
  {
      __m128i t = _mm_loadu_si128(buf);
@@ -XXX,XX +XXX,XX @@ buffer_zero_sse2(const void *buf, size_t len)
      return _mm_movemask_epi8(_mm_cmpeq_epi8(t, zero)) == 0xFFFF;
  }
 -#if defined(CONFIG_AVX512F_OPT) || defined(CONFIG_AVX2_OPT)
 -#pragma GCC pop_options
 -#endif
  #ifdef CONFIG_AVX2_OPT
 -/* Note that due to restrictions/bugs wrt __builtin functions in gcc <= 4.8,
 - * the includes have to be within the corresponding push_options region, and
 - * therefore the regions themselves have to be ordered with increasing ISA.
 - */
 -#pragma GCC push_options
 -#pragma GCC target("sse4")
 -#include <smmintrin.h>
 -
 -static bool
 +static bool __attribute__((target("sse4")))
  buffer_zero_sse4(const void *buf, size_t len)
  {
      __m128i t = _mm_loadu_si128(buf);
@@ -XXX,XX +XXX,XX @@ buffer_zero_sse4(const void *buf, size_t len)
      return _mm_testz_si128(t, t);
  }
 -#pragma GCC pop_options
 -#pragma GCC push_options
 -#pragma GCC target("avx2")
 -#include <immintrin.h>
 -
 -static bool
 +static bool __attribute__((target("avx2")))
  buffer_zero_avx2(const void *buf, size_t len)
  {
      /* Begin with an unaligned head of 32 bytes.  */
@@ -XXX,XX +XXX,XX @@ buffer_zero_avx2(const void *buf, size_t len)
      return _mm256_testz_si256(t, t);
  }
 -#pragma GCC pop_options
  #endif /* CONFIG_AVX2_OPT */
  #ifdef CONFIG_AVX512F_OPT
 -#pragma GCC push_options
 -#pragma GCC target("avx512f")
 -#include <immintrin.h>
 -
 -static bool
 +static bool __attribute__((target("avx512f")))
  buffer_zero_avx512(const void *buf, size_t len)
  {
      /* Begin with an unaligned head of 64 bytes.  */
@@ -XXX,XX +XXX,XX @@ buffer_zero_avx512(const void *buf, size_t len)
      return !_mm512_test_epi64_mask(t, t);
  }
 -#pragma GCC pop_options
 -#endif
 +#endif /* CONFIG_AVX512F_OPT */
  /* Note that for test_buffer_is_zero_next_accel, the most preferred
 --
 .34.1

The following changes since commit fb7e7990342e59cf67dbd895c1a1e3fb1741df7a:

tests/qtest/qom-test: Do not print tested properties by default (2023-01-16 15:00:57 +0000)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20230116

for you to fetch changes up to 61710a7e23a63546da0071ea32adb96476fa5d07:

accel/tcg: Split out cpu_exec_{setjmp,loop} (2023-01-16 10:14:12 -1000)

----------------------------------------------------------------
- Reorg cpu_tb_exec around setjmp.
- Use __attribute__((target)) for buffer_is_zero.
- Add perfmap and jitdump for perf support.

----------------------------------------------------------------
Ilya Leoshkevich (3):
      linux-user: Clean up when exiting due to a signal
      accel/tcg: Add debuginfo support
      tcg: add perfmap and jitdump

Richard Henderson (2):
      util/bufferiszero: Use __attribute__((target)) for avx2/avx512
      accel/tcg: Split out cpu_exec_{setjmp,loop}

From: Ilya Leoshkevich <iii@linux.ibm.com>

When exiting due to an exit() syscall, qemu-user calls
preexit_cleanup(), but this is currently not the case when exiting due
to a signal. This leads to various buffers not being flushed (e.g.,
for gprof, for gcov, and for the upcoming perf support).

Add the missing call.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230112152013.125680-2-iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/signal.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/linux-user/signal.c b/linux-user/signal.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -XXX,XX +XXX,XX @@ void cpu_loop_exit_sigbus(CPUState *cpu, target_ulong addr,
 
 /* abort execution with signal */
 static G_NORETURN
-void dump_core_and_abort(int target_sig)
+void dump_core_and_abort(CPUArchState *cpu_env, int target_sig)
 {
     CPUState *cpu = thread_cpu;
     CPUArchState *env = cpu->env_ptr;
@@ -XXX,XX +XXX,XX @@ void dump_core_and_abort(int target_sig)
             target_sig, strsignal(host_sig), "core dumped" );
     }
 
+    preexit_cleanup(cpu_env, 128 + target_sig);
+
     /* The proper exit code for dying from an uncaught signal is
      * -<signal>.  The kernel doesn't allow exit() or _exit() to pass
      * a negative value.  To get the proper exit code we need to
@@ -XXX,XX +XXX,XX @@ static void handle_pending_signal(CPUArchState *cpu_env, int sig,
                    sig != TARGET_SIGURG &&
                    sig != TARGET_SIGWINCH &&
                    sig != TARGET_SIGCONT) {
-            dump_core_and_abort(sig);
+            dump_core_and_abort(cpu_env, sig);
         }
     } else if (handler == TARGET_SIG_IGN) {
         /* ignore sig */
     } else if (handler == TARGET_SIG_ERR) {
-        dump_core_and_abort(sig);
+        dump_core_and_abort(cpu_env, sig);
     } else {
         /* compute the blocked signals during the handler execution */
         sigset_t *blocked_set;
-- 
2.34.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

Add libdw-based functions for loading and querying debuginfo. Load
debuginfo from the system and the linux-user loaders.

This is useful for the upcoming perf support, which can then put
human-readable guest symbols instead of raw guest PCs into perfmap and
jitdump files.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230112152013.125680-3-iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 meson.build            |  8 ++++
 accel/tcg/debuginfo.h  | 77 +++++++++++++++++++++++++++++++++
 accel/tcg/debuginfo.c  | 96 ++++++++++++++++++++++++++++++++++++++++++
 hw/core/loader.c       |  5 +++
 linux-user/elfload.c   |  3 ++
 accel/tcg/meson.build  |  1 +
 linux-user/meson.build |  1 +
 7 files changed, 191 insertions(+)
 create mode 100644 accel/tcg/debuginfo.h
 create mode 100644 accel/tcg/debuginfo.c

diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ if libbpf.found() and not cc.links('''
   endif
 endif
 
+# libdw
+libdw = dependency('libdw',
+                   method: 'pkg-config',
+                   kwargs: static_kwargs,
+                   required: false)
+
 #################
 # config-host.h #
 #################
@@ -XXX,XX +XXX,XX @@ config_host_data.set('CONFIG_DBUS_DISPLAY', dbus_display)
 config_host_data.set('CONFIG_CFI', get_option('cfi'))
 config_host_data.set('CONFIG_SELINUX', selinux.found())
 config_host_data.set('CONFIG_XEN_BACKEND', xen.found())
+config_host_data.set('CONFIG_LIBDW', libdw.found())
 if xen.found()
   # protect from xen.version() having less than three components
   xen_version = xen.version().split('.') + ['0', '0']
@@ -XXX,XX +XXX,XX @@ summary_info += {'libudev':           libudev}
 # Dummy dependency, keep .found()
 summary_info += {'FUSE lseek':        fuse_lseek.found()}
 summary_info += {'selinux':           selinux}
+summary_info += {'libdw':             libdw}
 summary(summary_info, bool_yn: true, section: 'Dependencies')
 
 if not supported_cpus.contains(cpu)
diff --git a/accel/tcg/debuginfo.h b/accel/tcg/debuginfo.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/accel/tcg/debuginfo.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Debug information support.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef ACCEL_TCG_DEBUGINFO_H
+#define ACCEL_TCG_DEBUGINFO_H
+
+/*
+ * Debuginfo describing a certain address.
+ */
+struct debuginfo_query {
+    uint64_t address;    /* Input: address. */
+    int flags;           /* Input: debuginfo subset. */
+    const char *symbol;  /* Symbol that the address is part of. */
+    uint64_t offset;     /* Offset from the symbol. */
+    const char *file;    /* Source file associated with the address. */
+    int line;            /* Line number in the source file. */
+};
+
+/*
+ * Debuginfo subsets.
+ */
+#define DEBUGINFO_SYMBOL BIT(1)
+#define DEBUGINFO_LINE   BIT(2)
+
+#if defined(CONFIG_TCG) && defined(CONFIG_LIBDW)
+/*
+ * Load debuginfo for the specified guest ELF image.
+ * Return true on success, false on failure.
+ */
+void debuginfo_report_elf(const char *name, int fd, uint64_t bias);
+
+/*
+ * Take the debuginfo lock.
+ */
+void debuginfo_lock(void);
+
+/*
+ * Fill each on N Qs with the debuginfo about Q->ADDRESS as specified by
+ * Q->FLAGS:
+ *
+ * - DEBUGINFO_SYMBOL: update Q->SYMBOL and Q->OFFSET. If symbol debuginfo is
+ *                     missing, then leave them as is.
+ * - DEBUINFO_LINE: update Q->FILE and Q->LINE. If line debuginfo is missing,
+ *                  then leave them as is.
+ *
+ * This function must be called under the debuginfo lock. The results can be
+ * accessed only until the debuginfo lock is released.
+ */
+void debuginfo_query(struct debuginfo_query *q, size_t n);
+
+/*
+ * Release the debuginfo lock.
+ */
+void debuginfo_unlock(void);
+#else
+static inline void debuginfo_report_elf(const char *image_name, int image_fd,
+                                        uint64_t load_bias)
+{
+}
+
+static inline void debuginfo_lock(void)
+{
+}
+
+static inline void debuginfo_query(struct debuginfo_query *q, size_t n)
+{
+}
+
+static inline void debuginfo_unlock(void)
+{
+}
+#endif
+
+#endif
diff --git a/accel/tcg/debuginfo.c b/accel/tcg/debuginfo.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/accel/tcg/debuginfo.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Debug information support.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/lockable.h"
+
+#include <elfutils/libdwfl.h>
+
+#include "debuginfo.h"
+
+static QemuMutex lock;
+static Dwfl *dwfl;
+static const Dwfl_Callbacks dwfl_callbacks = {
+    .find_elf = NULL,
+    .find_debuginfo = dwfl_standard_find_debuginfo,
+    .section_address = NULL,
+    .debuginfo_path = NULL,
+};
+
+__attribute__((constructor))
+static void debuginfo_init(void)
+{
+    qemu_mutex_init(&lock);
+}
+
+void debuginfo_report_elf(const char *name, int fd, uint64_t bias)
+{
+    QEMU_LOCK_GUARD(&lock);
+
+    if (dwfl) {
+        dwfl_report_begin_add(dwfl);
+    } else {
+        dwfl = dwfl_begin(&dwfl_callbacks);
+    }
+
+    if (dwfl) {
+        dwfl_report_elf(dwfl, name, name, fd, bias, true);
+        dwfl_report_end(dwfl, NULL, NULL);
+    }
+}
+
+void debuginfo_lock(void)
+{
+    qemu_mutex_lock(&lock);
+}
+
+void debuginfo_query(struct debuginfo_query *q, size_t n)
+{
+    const char *symbol, *file;
+    Dwfl_Module *dwfl_module;
+    Dwfl_Line *dwfl_line;
+    GElf_Off dwfl_offset;
+    GElf_Sym dwfl_sym;
+    size_t i;
+    int line;
+
+    if (!dwfl) {
+        return;
+    }
+
+    for (i = 0; i < n; i++) {
+        dwfl_module = dwfl_addrmodule(dwfl, q[i].address);
+        if (!dwfl_module) {
+            continue;
+        }
+
+        if (q[i].flags & DEBUGINFO_SYMBOL) {
+            symbol = dwfl_module_addrinfo(dwfl_module, q[i].address,
+                                          &dwfl_offset, &dwfl_sym,
+                                          NULL, NULL, NULL);
+            if (symbol) {
+                q[i].symbol = symbol;
+                q[i].offset = dwfl_offset;
+            }
+        }
+
+        if (q[i].flags & DEBUGINFO_LINE) {
+            dwfl_line = dwfl_module_getsrc(dwfl_module, q[i].address);
+            if (dwfl_line) {
+                file = dwfl_lineinfo(dwfl_line, NULL, &line, 0, NULL, NULL);
+                if (file) {
+                    q[i].file = file;
+                    q[i].line = line;
+                }
+            }
+        }
+    }
+}
+
+void debuginfo_unlock(void)
+{
+    qemu_mutex_unlock(&lock);
+}
diff --git a/hw/core/loader.c b/hw/core/loader.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/loader.c
+++ b/hw/core/loader.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #include "qemu/cutils.h"
 #include "sysemu/runstate.h"
+#include "accel/tcg/debuginfo.h"
 
 #include <zlib.h>
 
@@ -XXX,XX +XXX,XX @@ ssize_t load_elf_ram_sym(const char *filename,
                          clear_lsb, data_swab, as, load_rom, sym_cb);
     }
 
+    if (ret != ELF_LOAD_FAILED) {
+        debuginfo_report_elf(filename, fd, 0);
+    }
+
  fail:
     close(fd);
     return ret;
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/selfmap.h"
 #include "qapi/error.h"
 #include "target_signal.h"
+#include "accel/tcg/debuginfo.h"
 
 #ifdef _ARCH_PPC64
 #undef ARCH_DLINFO
@@ -XXX,XX +XXX,XX @@ static void load_elf_image(const char *image_name, int image_fd,
         load_symbols(ehdr, image_fd, load_bias);
     }
 
+    debuginfo_report_elf(image_name, image_fd, load_bias);
+
     mmap_unlock();
 
     close(image_fd);
diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/meson.build
+++ b/accel/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ tcg_ss.add(files(
 tcg_ss.add(when: 'CONFIG_USER_ONLY', if_true: files('user-exec.c'))
 tcg_ss.add(when: 'CONFIG_SOFTMMU', if_false: files('user-exec-stub.c'))
 tcg_ss.add(when: 'CONFIG_PLUGIN', if_true: [files('plugin-gen.c')])
+tcg_ss.add(when: libdw, if_true: files('debuginfo.c'))
 specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_ss)
 
 specific_ss.add(when: ['CONFIG_SOFTMMU', 'CONFIG_TCG'], if_true: files(
diff --git a/linux-user/meson.build b/linux-user/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/meson.build
+++ b/linux-user/meson.build
@@ -XXX,XX +XXX,XX @@ linux_user_ss.add(files(
   'uname.c',
 ))
 linux_user_ss.add(rt)
+linux_user_ss.add(libdw)
 
 linux_user_ss.add(when: 'TARGET_HAS_BFLT', if_true: files('flatload.c'))
 linux_user_ss.add(when: 'TARGET_I386', if_true: files('vm86.c'))
-- 
2.34.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

Add ability to dump /tmp/perf-<pid>.map and jit-<pid>.dump.
The first one allows the perf tool to map samples to each individual
translation block. The second one adds the ability to resolve symbol
names, line numbers and inspect JITed code.

Example of use:

perf record qemu-x86_64 -perfmap ./a.out
    perf report

perf record -k 1 qemu-x86_64 -jitdump ./a.out
    DEBUGINFOD_URLS= perf inject -j -i perf.data -o perf.data.jitted
    perf report -i perf.data.jitted

Co-developed-by: Vanderson M. do Rosario <vandersonmr2@gmail.com>
Co-developed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230112152013.125680-4-iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg.rst        |  23 +++
 accel/tcg/perf.h          |  49 +++++
 accel/tcg/perf.c          | 375 ++++++++++++++++++++++++++++++++++++++
 accel/tcg/translate-all.c |   7 +
 linux-user/exit.c         |   2 +
 linux-user/main.c         |  15 ++
 softmmu/vl.c              |  11 ++
 tcg/tcg.c                 |   2 +
 accel/tcg/meson.build     |   1 +
 qemu-options.hx           |  20 ++
 10 files changed, 505 insertions(+)
 create mode 100644 accel/tcg/perf.h
 create mode 100644 accel/tcg/perf.c

diff --git a/docs/devel/tcg.rst b/docs/devel/tcg.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/devel/tcg.rst
+++ b/docs/devel/tcg.rst
@@ -XXX,XX +XXX,XX @@ memory areas instead calls out to C code for device emulation.
 Finally, the MMU helps tracking dirty pages and pages pointed to by
 translation blocks.
 
+Profiling JITted code
+---------------------
+
+The Linux ``perf`` tool will treat all JITted code as a single block as
+unlike the main code it can't use debug information to link individual
+program counter samples with larger functions. To overcome this
+limitation you can use the ``-perfmap`` or the ``-jitdump`` option to generate
+map files. ``-perfmap`` is lightweight and produces only guest-host mappings.
+``-jitdump`` additionally saves JITed code and guest debug information (if
+available); its output needs to be integrated with the ``perf.data`` file
+before the final report can be viewed.
+
+.. code::
+
+  perf record $QEMU -perfmap $REMAINING_ARGS
+  perf report
+
+  perf record -k 1 $QEMU -jitdump $REMAINING_ARGS
+  DEBUGINFOD_URLS= perf inject -j -i perf.data -o perf.data.jitted
+  perf report -i perf.data.jitted
+
+Note that qemu-system generates mappings only for ``-kernel`` files in ELF
+format.
diff --git a/accel/tcg/perf.h b/accel/tcg/perf.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/accel/tcg/perf.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Linux perf perf-<pid>.map and jit-<pid>.dump integration.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef ACCEL_TCG_PERF_H
+#define ACCEL_TCG_PERF_H
+
+#if defined(CONFIG_TCG) && defined(CONFIG_LINUX)
+/* Start writing perf-<pid>.map. */
+void perf_enable_perfmap(void);
+
+/* Start writing jit-<pid>.dump. */
+void perf_enable_jitdump(void);
+
+/* Add information about TCG prologue to profiler maps. */
+void perf_report_prologue(const void *start, size_t size);
+
+/* Add information about JITted guest code to profiler maps. */
+void perf_report_code(uint64_t guest_pc, TranslationBlock *tb,
+                      const void *start);
+
+/* Stop writing perf-<pid>.map and/or jit-<pid>.dump. */
+void perf_exit(void);
+#else
+static inline void perf_enable_perfmap(void)
+{
+}
+
+static inline void perf_enable_jitdump(void)
+{
+}
+
+static inline void perf_report_prologue(const void *start, size_t size)
+{
+}
+
+static inline void perf_report_code(uint64_t guest_pc, TranslationBlock *tb,
+                                    const void *start)
+{
+}
+
+static inline void perf_exit(void)
+{
+}
+#endif
+
+#endif
diff --git a/accel/tcg/perf.c b/accel/tcg/perf.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/accel/tcg/perf.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Linux perf perf-<pid>.map and jit-<pid>.dump integration.
+ *
+ * The jitdump spec can be found at [1].
+ *
+ * [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/plain/tools/perf/Documentation/jitdump-specification.txt
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "elf.h"
+#include "exec/exec-all.h"
+#include "qemu/timer.h"
+#include "tcg/tcg.h"
+
+#include "debuginfo.h"
+#include "perf.h"
+
+static FILE *safe_fopen_w(const char *path)
+{
+    int saved_errno;
+    FILE *f;
+    int fd;
+
+    /* Delete the old file, if any. */
+    unlink(path);
+
+    /* Avoid symlink attacks by using O_CREAT | O_EXCL. */
+    fd = open(path, O_RDWR | O_CREAT | O_EXCL, S_IRUSR | S_IWUSR);
+    if (fd == -1) {
+        return NULL;
+    }
+
+    /* Convert fd to FILE*. */
+    f = fdopen(fd, "w");
+    if (f == NULL) {
+        saved_errno = errno;
+        close(fd);
+        errno = saved_errno;
+        return NULL;
+    }
+
+    return f;
+}
+
+static FILE *perfmap;
+
+void perf_enable_perfmap(void)
+{
+    char map_file[32];
+
+    snprintf(map_file, sizeof(map_file), "/tmp/perf-%d.map", getpid());
+    perfmap = safe_fopen_w(map_file);
+    if (perfmap == NULL) {
+        warn_report("Could not open %s: %s, proceeding without perfmap",
+                    map_file, strerror(errno));
+    }
+}
+
+/* Get PC and size of code JITed for guest instruction #INSN. */
+static void get_host_pc_size(uintptr_t *host_pc, uint16_t *host_size,
+                             const void *start, size_t insn)
+{
+    uint16_t start_off = insn ? tcg_ctx->gen_insn_end_off[insn - 1] : 0;
+
+    if (host_pc) {
+        *host_pc = (uintptr_t)start + start_off;
+    }
+    if (host_size) {
+        *host_size = tcg_ctx->gen_insn_end_off[insn] - start_off;
+    }
+}
+
+static const char *pretty_symbol(const struct debuginfo_query *q, size_t *len)
+{
+    static __thread char buf[64];
+    int tmp;
+
+    if (!q->symbol) {
+        tmp = snprintf(buf, sizeof(buf), "guest-0x%"PRIx64, q->address);
+        if (len) {
+            *len = MIN(tmp + 1, sizeof(buf));
+        }
+        return buf;
+    }
+
+    if (!q->offset) {
+        if (len) {
+            *len = strlen(q->symbol) + 1;
+        }
+        return q->symbol;
+    }
+
+    tmp = snprintf(buf, sizeof(buf), "%s+0x%"PRIx64, q->symbol, q->offset);
+    if (len) {
+        *len = MIN(tmp + 1, sizeof(buf));
+    }
+    return buf;
+}
+
+static void write_perfmap_entry(const void *start, size_t insn,
+                                const struct debuginfo_query *q)
+{
+    uint16_t host_size;
+    uintptr_t host_pc;
+
+    get_host_pc_size(&host_pc, &host_size, start, insn);
+    fprintf(perfmap, "%"PRIxPTR" %"PRIx16" %s\n",
+            host_pc, host_size, pretty_symbol(q, NULL));
+}
+
+static FILE *jitdump;
+
+#define JITHEADER_MAGIC 0x4A695444
+#define JITHEADER_VERSION 1
+
+struct jitheader {
+    uint32_t magic;
+    uint32_t version;
+    uint32_t total_size;
+    uint32_t elf_mach;
+    uint32_t pad1;
+    uint32_t pid;
+    uint64_t timestamp;
+    uint64_t flags;
+};
+
+enum jit_record_type {
+    JIT_CODE_LOAD = 0,
+    JIT_CODE_DEBUG_INFO = 2,
+};
+
+struct jr_prefix {
+    uint32_t id;
+    uint32_t total_size;
+    uint64_t timestamp;
+};
+
+struct jr_code_load {
+    struct jr_prefix p;
+
+    uint32_t pid;
+    uint32_t tid;
+    uint64_t vma;
+    uint64_t code_addr;
+    uint64_t code_size;
+    uint64_t code_index;
+};
+
+struct debug_entry {
+    uint64_t addr;
+    int lineno;
+    int discrim;
+    const char name[];
+};
+
+struct jr_code_debug_info {
+    struct jr_prefix p;
+
+    uint64_t code_addr;
+    uint64_t nr_entry;
+    struct debug_entry entries[];
+};
+
+static uint32_t get_e_machine(void)
+{
+    Elf64_Ehdr elf_header;
+    FILE *exe;
+    size_t n;
+
+    QEMU_BUILD_BUG_ON(offsetof(Elf32_Ehdr, e_machine) !=
+                      offsetof(Elf64_Ehdr, e_machine));
+
+    exe = fopen("/proc/self/exe", "r");
+    if (exe == NULL) {
+        return EM_NONE;
+    }
+
+    n = fread(&elf_header, sizeof(elf_header), 1, exe);
+    fclose(exe);
+    if (n != 1) {
+        return EM_NONE;
+    }
+
+    return elf_header.e_machine;
+}
+
+void perf_enable_jitdump(void)
+{
+    struct jitheader header;
+    char jitdump_file[32];
+    void *perf_marker;
+
+    if (!use_rt_clock) {
+        warn_report("CLOCK_MONOTONIC is not available, proceeding without jitdump");
+        return;
+    }
+
+    snprintf(jitdump_file, sizeof(jitdump_file), "jit-%d.dump", getpid());
+    jitdump = safe_fopen_w(jitdump_file);
+    if (jitdump == NULL) {
+        warn_report("Could not open %s: %s, proceeding without jitdump",
+                    jitdump_file, strerror(errno));
+        return;
+    }
+
+    /*
+     * `perf inject` will see that the mapped file name in the corresponding
+     * PERF_RECORD_MMAP or PERF_RECORD_MMAP2 event is of the form jit-%d.dump
+     * and will process it as a jitdump file.
+     */
+    perf_marker = mmap(NULL, qemu_real_host_page_size(), PROT_READ | PROT_EXEC,
+                       MAP_PRIVATE, fileno(jitdump), 0);
+    if (perf_marker == MAP_FAILED) {
+        warn_report("Could not map %s: %s, proceeding without jitdump",
+                    jitdump_file, strerror(errno));
+        fclose(jitdump);
+        jitdump = NULL;
+        return;
+    }
+
+    header.magic = JITHEADER_MAGIC;
+    header.version = JITHEADER_VERSION;
+    header.total_size = sizeof(header);
+    header.elf_mach = get_e_machine();
+    header.pad1 = 0;
+    header.pid = getpid();
+    header.timestamp = get_clock();
+    header.flags = 0;
+    fwrite(&header, sizeof(header), 1, jitdump);
+}
+
+void perf_report_prologue(const void *start, size_t size)
+{
+    if (perfmap) {
+        fprintf(perfmap, "%"PRIxPTR" %zx tcg-prologue-buffer\n",
+                (uintptr_t)start, size);
+    }
+}
+
+/* Write a JIT_CODE_DEBUG_INFO jitdump entry. */
+static void write_jr_code_debug_info(const void *start,
+                                     const struct debuginfo_query *q,
+                                     size_t icount)
+{
+    struct jr_code_debug_info rec;
+    struct debug_entry ent;
+    uintptr_t host_pc;
+    int insn;
+
+    /* Write the header. */
+    rec.p.id = JIT_CODE_DEBUG_INFO;
+    rec.p.total_size = sizeof(rec) + sizeof(ent) + 1;
+    rec.p.timestamp = get_clock();
+    rec.code_addr = (uintptr_t)start;
+    rec.nr_entry = 1;
+    for (insn = 0; insn < icount; insn++) {
+        if (q[insn].file) {
+            rec.p.total_size += sizeof(ent) + strlen(q[insn].file) + 1;
+            rec.nr_entry++;
+        }
+    }
+    fwrite(&rec, sizeof(rec), 1, jitdump);
+
+    /* Write the main debug entries. */
+    for (insn = 0; insn < icount; insn++) {
+        if (q[insn].file) {
+            get_host_pc_size(&host_pc, NULL, start, insn);
+            ent.addr = host_pc;
+            ent.lineno = q[insn].line;
+            ent.discrim = 0;
+            fwrite(&ent, sizeof(ent), 1, jitdump);
+            fwrite(q[insn].file, strlen(q[insn].file) + 1, 1, jitdump);
+        }
+    }
+
+    /* Write the trailing debug_entry. */
+    ent.addr = (uintptr_t)start + tcg_ctx->gen_insn_end_off[icount - 1];
+    ent.lineno = 0;
+    ent.discrim = 0;
+    fwrite(&ent, sizeof(ent), 1, jitdump);
+    fwrite("", 1, 1, jitdump);
+}
+
+/* Write a JIT_CODE_LOAD jitdump entry. */
+static void write_jr_code_load(const void *start, uint16_t host_size,
+                               const struct debuginfo_query *q)
+{
+    static uint64_t code_index;
+    struct jr_code_load rec;
+    const char *symbol;
+    size_t symbol_size;
+
+    symbol = pretty_symbol(q, &symbol_size);
+    rec.p.id = JIT_CODE_LOAD;
+    rec.p.total_size = sizeof(rec) + symbol_size + host_size;
+    rec.p.timestamp = get_clock();
+    rec.pid = getpid();
+    rec.tid = qemu_get_thread_id();
+    rec.vma = (uintptr_t)start;
+    rec.code_addr = (uintptr_t)start;
+    rec.code_size = host_size;
+    rec.code_index = code_index++;
+    fwrite(&rec, sizeof(rec), 1, jitdump);
+    fwrite(symbol, symbol_size, 1, jitdump);
+    fwrite(start, host_size, 1, jitdump);
+}
+
+void perf_report_code(uint64_t guest_pc, TranslationBlock *tb,
+                      const void *start)
+{
+    struct debuginfo_query *q;
+    size_t insn;
+
+    if (!perfmap && !jitdump) {
+        return;
+    }
+
+    q = g_try_malloc0_n(tb->icount, sizeof(*q));
+    if (!q) {
+        return;
+    }
+
+    debuginfo_lock();
+
+    /* Query debuginfo for each guest instruction. */
+    for (insn = 0; insn < tb->icount; insn++) {
+        /* FIXME: This replicates the restore_state_to_opc() logic. */
+        q[insn].address = tcg_ctx->gen_insn_data[insn][0];
+        if (TARGET_TB_PCREL) {
+            q[insn].address |= (guest_pc & TARGET_PAGE_MASK);
+        } else {
+#if defined(TARGET_I386)
+            q[insn].address -= tb->cs_base;
+#endif
+        }
+        q[insn].flags = DEBUGINFO_SYMBOL | (jitdump ? DEBUGINFO_LINE : 0);
+    }
+    debuginfo_query(q, tb->icount);
+
+    /* Emit perfmap entries if needed. */
+    if (perfmap) {
+        flockfile(perfmap);
+        for (insn = 0; insn < tb->icount; insn++) {
+            write_perfmap_entry(start, insn, &q[insn]);
+        }
+        funlockfile(perfmap);
+    }
+
+    /* Emit jitdump entries if needed. */
+    if (jitdump) {
+        flockfile(jitdump);
+        write_jr_code_debug_info(start, q, tb->icount);
+        write_jr_code_load(start, tcg_ctx->gen_insn_end_off[tb->icount - 1],
+                           q);
+        funlockfile(jitdump);
+    }
+
+    debuginfo_unlock();
+    g_free(q);
+}
+
+void perf_exit(void)
+{
+    if (perfmap) {
+        fclose(perfmap);
+        perfmap = NULL;
+    }
+
+    if (jitdump) {
+        fclose(jitdump);
+        jitdump = NULL;
+    }
+}
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@
 #include "tb-hash.h"
 #include "tb-context.h"
 #include "internal.h"
+#include "perf.h"
 
 /* Make sure all possible CPU event bits fit in tb->trace_vcpu_dstate */
 QEMU_BUILD_BUG_ON(CPU_TRACE_DSTATE_MAX_EVENTS >
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     }
     tb->tc.size = gen_code_size;
 
+    /*
+     * For TARGET_TB_PCREL, attribute all executions of the generated
+     * code to its first mapping.
+     */
+    perf_report_code(pc, tb, tcg_splitwx_to_rx(gen_code_buf));
+
 #ifdef CONFIG_PROFILER
     qatomic_set(&prof->code_time, prof->code_time + profile_getclock() - ti);
     qatomic_set(&prof->code_in_len, prof->code_in_len + tb->size);
diff --git a/linux-user/exit.c b/linux-user/exit.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/exit.c
+++ b/linux-user/exit.c
@@ -XXX,XX +XXX,XX @@
  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 #include "qemu/osdep.h"
+#include "accel/tcg/perf.h"
 #include "exec/gdbstub.h"
 #include "qemu.h"
 #include "user-internals.h"
@@ -XXX,XX +XXX,XX @@ void preexit_cleanup(CPUArchState *env, int code)
 #endif
         gdb_exit(code);
         qemu_plugin_user_exit();
+        perf_exit();
 }
diff --git a/linux-user/main.c b/linux-user/main.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -XXX,XX +XXX,XX @@
 #include "signal-common.h"
 #include "loader.h"
 #include "user-mmap.h"
+#include "accel/tcg/perf.h"
 
 #ifdef CONFIG_SEMIHOSTING
 #include "semihosting/semihost.h"
@@ -XXX,XX +XXX,XX @@ static void handle_arg_abi_call0(const char *arg)
 }
 #endif
 
+static void handle_arg_perfmap(const char *arg)
+{
+    perf_enable_perfmap();
+}
+
+static void handle_arg_jitdump(const char *arg)
+{
+    perf_enable_jitdump();
+}
+
 static QemuPluginList plugins = QTAILQ_HEAD_INITIALIZER(plugins);
 
 #ifdef CONFIG_PLUGIN
@@ -XXX,XX +XXX,XX @@ static const struct qemu_argument arg_table[] = {
     {"xtensa-abi-call0", "QEMU_XTENSA_ABI_CALL0", false, handle_arg_abi_call0,
      "",           "assume CALL0 Xtensa ABI"},
 #endif
+    {"perfmap",    "QEMU_PERFMAP",     false, handle_arg_perfmap,
+     "",           "Generate a /tmp/perf-${pid}.map file for perf"},
+    {"jitdump",    "QEMU_JITDUMP",     false, handle_arg_jitdump,
+     "",           "Generate a jit-${pid}.dump file for perf"},
     {NULL, NULL, false, NULL, NULL, NULL}
 };
 
diff --git a/softmmu/vl.c b/softmmu/vl.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/vl.c
+++ b/softmmu/vl.c
@@ -XXX,XX +XXX,XX @@
 #include "fsdev/qemu-fsdev.h"
 #endif
 #include "sysemu/qtest.h"
+#ifdef CONFIG_TCG
+#include "accel/tcg/perf.h"
+#endif
 
 #include "disas/disas.h"
 
@@ -XXX,XX +XXX,XX @@ void qemu_init(int argc, char **argv)
             case QEMU_OPTION_DFILTER:
                 qemu_set_dfilter_ranges(optarg, &error_fatal);
                 break;
+#if defined(CONFIG_TCG) && defined(CONFIG_LINUX)
+            case QEMU_OPTION_perfmap:
+                perf_enable_perfmap();
+                break;
+            case QEMU_OPTION_jitdump:
+                perf_enable_jitdump();
+                break;
+#endif
             case QEMU_OPTION_seed:
                 qemu_guest_random_seed_main(optarg, &error_fatal);
                 break;
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/log.h"
 #include "tcg/tcg-ldst.h"
 #include "tcg-internal.h"
+#include "accel/tcg/perf.h"
 
 /* Forward declarations for functions declared in tcg-target.c.inc and
    used here. */
@@ -XXX,XX +XXX,XX @@ void tcg_prologue_init(TCGContext *s)
 #endif
 
     prologue_size = tcg_current_code_size(s);
+    perf_report_prologue(s->code_gen_ptr, prologue_size);
 
 #ifndef CONFIG_TCG_INTERPRETER
     flush_idcache_range((uintptr_t)tcg_splitwx_to_rx(s->code_buf),
diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/meson.build
+++ b/accel/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ tcg_ss.add(when: 'CONFIG_USER_ONLY', if_true: files('user-exec.c'))
 tcg_ss.add(when: 'CONFIG_SOFTMMU', if_false: files('user-exec-stub.c'))
 tcg_ss.add(when: 'CONFIG_PLUGIN', if_true: [files('plugin-gen.c')])
 tcg_ss.add(when: libdw, if_true: files('debuginfo.c'))
+tcg_ss.add(when: 'CONFIG_LINUX', if_true: files('perf.c'))
 specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_ss)
 
 specific_ss.add(when: ['CONFIG_SOFTMMU', 'CONFIG_TCG'], if_true: files(
diff --git a/qemu-options.hx b/qemu-options.hx
index XXXXXXX..XXXXXXX 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ SRST
     Enable synchronization profiling.
 ERST
 
+#if defined(CONFIG_TCG) && defined(CONFIG_LINUX)
+DEF("perfmap", 0, QEMU_OPTION_perfmap,
+    "-perfmap        generate a /tmp/perf-${pid}.map file for perf\n",
+    QEMU_ARCH_ALL)
+SRST
+``-perfmap``
+    Generate a map file for Linux perf tools that will allow basic profiling
+    information to be broken down into basic blocks.
+ERST
+
+DEF("jitdump", 0, QEMU_OPTION_jitdump,
+    "-jitdump        generate a jit-${pid}.dump file for perf\n",
+    QEMU_ARCH_ALL)
+SRST
+``-jitdump``
+    Generate a dump file for Linux perf tools that maps basic blocks to symbol
+    names, line numbers and JITted code.
+ERST
+#endif
+
 DEFHEADING()
 
 DEFHEADING(Generic object creation:)
-- 
2.34.1

Use the attribute, which is supported by clang, instead of
the #pragma, which is not supported and, for some reason,
also not detected by the meson probe, so we fail by -Werror.

Include only <immintrin.h> as that is the outermost "official"
header for these intrinsics -- emmintrin.h and smmintrin -- are
older SSE2 and SSE4 specific headers, while the immintrin.h
includes all of the Intel intrinsics.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 meson.build         |  8 ++------
 util/bufferiszero.c | 41 ++++++-----------------------------------
 2 files changed, 8 insertions(+), 41 deletions(-)

diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ config_host_data.set('CONFIG_CPUID_H', have_cpuid_h)
 config_host_data.set('CONFIG_AVX2_OPT', get_option('avx2') \
   .require(have_cpuid_h, error_message: 'cpuid.h not available, cannot enable AVX2') \
   .require(cc.links('''
-    #pragma GCC push_options
-    #pragma GCC target("avx2")
     #include <cpuid.h>
     #include <immintrin.h>
-    static int bar(void *a) {
+    static int __attribute__((target("avx2"))) bar(void *a) {
       __m256i x = *(__m256i *)a;
       return _mm256_testz_si256(x, x);
     }
@@ -XXX,XX +XXX,XX @@ config_host_data.set('CONFIG_AVX2_OPT', get_option('avx2') \
 config_host_data.set('CONFIG_AVX512F_OPT', get_option('avx512f') \
   .require(have_cpuid_h, error_message: 'cpuid.h not available, cannot enable AVX512F') \
   .require(cc.links('''
-    #pragma GCC push_options
-    #pragma GCC target("avx512f")
     #include <cpuid.h>
     #include <immintrin.h>
-    static int bar(void *a) {
+    static int __attribute__((target("avx512f"))) bar(void *a) {
       __m512i x = *(__m512i *)a;
       return _mm512_test_epi64_mask(x, x);
     }
diff --git a/util/bufferiszero.c b/util/bufferiszero.c
index XXXXXXX..XXXXXXX 100644
--- a/util/bufferiszero.c
+++ b/util/bufferiszero.c
@@ -XXX,XX +XXX,XX @@ buffer_zero_int(const void *buf, size_t len)
 }
 
 #if defined(CONFIG_AVX512F_OPT) || defined(CONFIG_AVX2_OPT) || defined(__SSE2__)
-/* Do not use push_options pragmas unnecessarily, because clang
- * does not support them.
- */
-#if defined(CONFIG_AVX512F_OPT) || defined(CONFIG_AVX2_OPT)
-#pragma GCC push_options
-#pragma GCC target("sse2")
-#endif
-#include <emmintrin.h>
+#include <immintrin.h>
 
 /* Note that each of these vectorized functions require len >= 64.  */
 
-static bool
+static bool __attribute__((target("sse2")))
 buffer_zero_sse2(const void *buf, size_t len)
 {
     __m128i t = _mm_loadu_si128(buf);
@@ -XXX,XX +XXX,XX @@ buffer_zero_sse2(const void *buf, size_t len)
 
     return _mm_movemask_epi8(_mm_cmpeq_epi8(t, zero)) == 0xFFFF;
 }
-#if defined(CONFIG_AVX512F_OPT) || defined(CONFIG_AVX2_OPT)
-#pragma GCC pop_options
-#endif
 
 #ifdef CONFIG_AVX2_OPT
-/* Note that due to restrictions/bugs wrt __builtin functions in gcc <= 4.8,
- * the includes have to be within the corresponding push_options region, and
- * therefore the regions themselves have to be ordered with increasing ISA.
- */
-#pragma GCC push_options
-#pragma GCC target("sse4")
-#include <smmintrin.h>
-
-static bool
+static bool __attribute__((target("sse4")))
 buffer_zero_sse4(const void *buf, size_t len)
 {
     __m128i t = _mm_loadu_si128(buf);
@@ -XXX,XX +XXX,XX @@ buffer_zero_sse4(const void *buf, size_t len)
     return _mm_testz_si128(t, t);
 }
 
-#pragma GCC pop_options
-#pragma GCC push_options
-#pragma GCC target("avx2")
-#include <immintrin.h>
-
-static bool
+static bool __attribute__((target("avx2")))
 buffer_zero_avx2(const void *buf, size_t len)
 {
     /* Begin with an unaligned head of 32 bytes.  */
@@ -XXX,XX +XXX,XX @@ buffer_zero_avx2(const void *buf, size_t len)
 
     return _mm256_testz_si256(t, t);
 }
-#pragma GCC pop_options
 #endif /* CONFIG_AVX2_OPT */
 
 #ifdef CONFIG_AVX512F_OPT
-#pragma GCC push_options
-#pragma GCC target("avx512f")
-#include <immintrin.h>
-
-static bool
+static bool __attribute__((target("avx512f")))
 buffer_zero_avx512(const void *buf, size_t len)
 {
     /* Begin with an unaligned head of 64 bytes.  */
@@ -XXX,XX +XXX,XX @@ buffer_zero_avx512(const void *buf, size_t len)
     return !_mm512_test_epi64_mask(t, t);
 
 }
-#pragma GCC pop_options
-#endif
+#endif /* CONFIG_AVX512F_OPT */
 
 
 /* Note that for test_buffer_is_zero_next_accel, the most preferred
-- 
2.34.1

Recently the g_assert(cpu == current_cpu) test has been
intermittently failing with gcc.  Reorg the code around
the setjmp to minimize the lifetime of the cpu variable
affected by the setjmp.

This appears to fix the existing issue with clang as well.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1147
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c | 111 +++++++++++++++++++++----------------------
 1 file changed, 54 insertions(+), 57 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline void cpu_loop_exec_tb(CPUState *cpu, TranslationBlock *tb,
 
 /* main execution loop */
 
-int cpu_exec(CPUState *cpu)
+static int __attribute__((noinline))
+cpu_exec_loop(CPUState *cpu, SyncClocks *sc)
 {
     int ret;
-    SyncClocks sc = { 0 };
-
-    /* replay_interrupt may need current_cpu */
-    current_cpu = cpu;
-
-    if (cpu_handle_halt(cpu)) {
-        return EXCP_HALTED;
-    }
-
-    rcu_read_lock();
-
-    cpu_exec_enter(cpu);
-
-    /* Calculate difference between guest clock and host clock.
-     * This delay includes the delay of the last cycle, so
-     * what we have to do is sleep until it is 0. As for the
-     * advance/delay we gain here, we try to fix it next time.
-     */
-    init_delay_params(&sc, cpu);
-
-    /* prepare setjmp context for exception handling */
-    if (sigsetjmp(cpu->jmp_env, 0) != 0) {
-#if defined(__clang__)
-        /*
-         * Some compilers wrongly smash all local variables after
-         * siglongjmp (the spec requires that only non-volatile locals
-         * which are changed between the sigsetjmp and siglongjmp are
-         * permitted to be trashed). There were bug reports for gcc
-         * 4.5.0 and clang.  The bug is fixed in all versions of gcc
-         * that we support, but is still unfixed in clang:
-         *   https://bugs.llvm.org/show_bug.cgi?id=21183
-         *
-         * Reload an essential local variable here for those compilers.
-         * Newer versions of gcc would complain about this code (-Wclobbered),
-         * so we only perform the workaround for clang.
-         */
-        cpu = current_cpu;
-#else
-        /* Non-buggy compilers preserve this; assert the correct value. */
-        g_assert(cpu == current_cpu);
-#endif
-
-#ifndef CONFIG_SOFTMMU
-        clear_helper_retaddr();
-        if (have_mmap_lock()) {
-            mmap_unlock();
-        }
-#endif
-        if (qemu_mutex_iothread_locked()) {
-            qemu_mutex_unlock_iothread();
-        }
-        qemu_plugin_disable_mem_helpers(cpu);
-
-        assert_no_pages_locked();
-    }
 
     /* if an exception is pending, we execute it here */
     while (!cpu_handle_exception(cpu, &ret)) {
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
 
             /* Try to align the host and virtual clocks
                if the guest is in advance */
-            align_clocks(&sc, cpu);
+            align_clocks(sc, cpu);
         }
     }
+    return ret;
+}
+
+static int cpu_exec_setjmp(CPUState *cpu, SyncClocks *sc)
+{
+    /* Prepare setjmp context for exception handling. */
+    if (unlikely(sigsetjmp(cpu->jmp_env, 0) != 0)) {
+        /* Non-buggy compilers preserve this; assert the correct value. */
+        g_assert(cpu == current_cpu);
+
+#ifndef CONFIG_SOFTMMU
+        clear_helper_retaddr();
+        if (have_mmap_lock()) {
+            mmap_unlock();
+        }
+#endif
+        if (qemu_mutex_iothread_locked()) {
+            qemu_mutex_unlock_iothread();
+        }
+        qemu_plugin_disable_mem_helpers(cpu);
+
+        assert_no_pages_locked();
+    }
+
+    return cpu_exec_loop(cpu, sc);
+}
+
+int cpu_exec(CPUState *cpu)
+{
+    int ret;
+    SyncClocks sc = { 0 };
+
+    /* replay_interrupt may need current_cpu */
+    current_cpu = cpu;
+
+    if (cpu_handle_halt(cpu)) {
+        return EXCP_HALTED;
+    }
+
+    rcu_read_lock();
+    cpu_exec_enter(cpu);
+
+    /*
+     * Calculate difference between guest clock and host clock.
+     * This delay includes the delay of the last cycle, so
+     * what we have to do is sleep until it is 0. As for the
+     * advance/delay we gain here, we try to fix it next time.
+     */
+    init_delay_params(&sc, cpu);
+
+    ret = cpu_exec_setjmp(cpu, &sc);
 
     cpu_exec_exit(cpu);
     rcu_read_unlock();
-- 
2.34.1

The following changes since commit 79b677d658d3d35e1e776826ac4abb28cdce69b8:

Merge tag 'net-pull-request' of https://github.com/jasowang/qemu into staging (2023-02-21 11:28:31 +0000)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20230221

for you to fetch changes up to dbd672c87f19949bb62bfb1fb3a97b9729fd7560:

sysemu/os-win32: fix setjmp/longjmp on windows-arm64 (2023-02-21 13:45:48 -1000)

----------------------------------------------------------------
tcg: Allow first half of insn in ram, and second half in mmio
linux-user/sparc: SIGILL for unknown trap vectors
linux-user/microblaze: SIGILL for privileged insns
linux-user: Fix deadlock while exiting due to signal
target/microblaze: Add gdbstub xml
util: Adjust cacheflush for windows-arm64
include/sysemu/os-win32: Adjust setjmp/longjmp for windows-arm64

----------------------------------------------------------------
Ilya Leoshkevich (3):
      linux-user: Always exit from exclusive state in fork_end()
      cpus: Make {start,end}_exclusive() recursive
      linux-user/microblaze: Handle privileged exception

Pierrick Bouvier (2):
      util/cacheflush: fix cache on windows-arm64
      sysemu/os-win32: fix setjmp/longjmp on windows-arm64

Richard Henderson (3):
      accel/tcg: Allow the second page of an instruction to be MMIO
      linux-user/sparc: Raise SIGILL for all unhandled software traps
      target/microblaze: Add gdbstub xml

include/hw/core/cpu.h                       |  4 +-
 include/sysemu/os-win32.h                   | 28 ++++++++++--
 target/microblaze/cpu.h                     |  2 +
 accel/tcg/translator.c                      | 12 +++++-
 cpus-common.c                               | 12 +++++-
 linux-user/main.c                           | 10 +++--
 linux-user/microblaze/cpu_loop.c            | 10 ++++-
 linux-user/sparc/cpu_loop.c                 |  8 ++++
 linux-user/syscall.c                        |  1 +
 target/microblaze/cpu.c                     |  7 ++-
 target/microblaze/gdbstub.c                 | 51 ++++++++++++++++------
 util/cacheflush.c                           | 14 ++++--
 configs/targets/microblaze-linux-user.mak   |  1 +
 configs/targets/microblaze-softmmu.mak      |  1 +
 configs/targets/microblazeel-linux-user.mak |  1 +
 configs/targets/microblazeel-softmmu.mak    |  1 +
 gdb-xml/microblaze-core.xml                 | 67 +++++++++++++++++++++++++++++
 gdb-xml/microblaze-stack-protect.xml        | 12 ++++++
 meson.build                                 | 21 +++++++++
 19 files changed, 229 insertions(+), 34 deletions(-)
 create mode 100644 gdb-xml/microblaze-core.xml
 create mode 100644 gdb-xml/microblaze-stack-protect.xml

If an instruction straddles a page boundary, and the first page
was ram, but the second page was MMIO, we would abort.  Handle
this as if both pages are MMIO, by setting the ram_addr_t for
the first page to -1.

Reported-by: Sid Manning <sidneym@quicinc.com>
Reported-by: Jørgen Hansen <Jorgen.Hansen@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/translator.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translator.c
+++ b/accel/tcg/translator.c
@@ -XXX,XX +XXX,XX @@ static void *translator_access(CPUArchState *env, DisasContextBase *db,
         if (host == NULL) {
             tb_page_addr_t phys_page =
                 get_page_addr_code_hostp(env, base, &db->host_addr[1]);
-            /* We cannot handle MMIO as second page. */
-            assert(phys_page != -1);
+
+            /*
+             * If the second page is MMIO, treat as if the first page
+             * was MMIO as well, so that we do not cache the TB.
+             */
+            if (unlikely(phys_page == -1)) {
+                tb_set_page_addr0(tb, -1);
+                return NULL;
+            }
+
             tb_set_page_addr1(tb, phys_page);
 #ifdef CONFIG_USER_ONLY
             page_protect(end);
-- 
2.34.1

The linux kernel's trap tables vector all unassigned trap
numbers to BAD_TRAP, which then raises SIGILL.

Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reported-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/sparc/cpu_loop.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/linux-user/sparc/cpu_loop.c b/linux-user/sparc/cpu_loop.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/sparc/cpu_loop.c
+++ b/linux-user/sparc/cpu_loop.c
@@ -XXX,XX +XXX,XX @@ void cpu_loop (CPUSPARCState *env)
             cpu_exec_step_atomic(cs);
             break;
         default:
+            /*
+             * Most software trap numbers vector to BAD_TRAP.
+             * Handle anything not explicitly matched above.
+             */
+            if (trapnr >= TT_TRAP && trapnr <= TT_TRAP + 0x7f) {
+                force_sig_fault(TARGET_SIGILL, ILL_ILLTRP, env->pc);
+                break;
+            }
             fprintf(stderr, "Unhandled trap: 0x%x\n", trapnr);
             cpu_dump_state(cs, stderr, 0);
             exit(EXIT_FAILURE);
-- 
2.34.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

fork()ed processes currently start with
current_cpu->in_exclusive_context set, which is, strictly speaking, not
correct, but does not cause problems (even assertion failures).

With one of the next patches, the code begins to rely on this value, so
fix it by always calling end_exclusive() in fork_end().

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230214140829.45392-2-iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/main.c    | 10 ++++++----
 linux-user/syscall.c |  1 +
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/linux-user/main.c b/linux-user/main.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -XXX,XX +XXX,XX @@ void fork_end(int child)
         }
         qemu_init_cpu_list();
         gdbserver_fork(thread_cpu);
-        /* qemu_init_cpu_list() takes care of reinitializing the
-         * exclusive state, so we don't need to end_exclusive() here.
-         */
     } else {
         cpu_list_unlock();
-        end_exclusive();
     }
+    /*
+     * qemu_init_cpu_list() reinitialized the child exclusive state, but we
+     * also need to keep current_cpu consistent, so call end_exclusive() for
+     * both child and parent.
+     */
+    end_exclusive();
 }
 
 __thread CPUState *thread_cpu;
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -XXX,XX +XXX,XX @@ static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,
             cpu_clone_regs_parent(env, flags);
             fork_end(0);
         }
+        g_assert(!cpu_in_exclusive_context(cpu));
     }
     return ret;
 }
-- 
2.34.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

Currently dying to one of the core_dump_signal()s deadlocks, because
dump_core_and_abort() calls start_exclusive() two times: first via
stop_all_tasks(), and then via preexit_cleanup() ->
qemu_plugin_user_exit().

There are a number of ways to solve this: resume after dumping core;
check cpu_in_exclusive_context() in qemu_plugin_user_exit(); or make
{start,end}_exclusive() recursive. Pick the last option, since it's
the most straightforward one.

Fixes: da91c1920242 ("linux-user: Clean up when exiting due to a signal")
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230214140829.45392-3-iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h |  4 ++--
 cpus-common.c         | 12 ++++++++++--
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPUState {
     bool unplug;
     bool crash_occurred;
     bool exit_request;
-    bool in_exclusive_context;
+    int exclusive_context_count;
     uint32_t cflags_next_tb;
     /* updates protected by BQL */
     uint32_t interrupt_request;
@@ -XXX,XX +XXX,XX @@ void async_safe_run_on_cpu(CPUState *cpu, run_on_cpu_func func, run_on_cpu_data
  */
 static inline bool cpu_in_exclusive_context(const CPUState *cpu)
 {
-    return cpu->in_exclusive_context;
+    return cpu->exclusive_context_count;
 }
 
 /**
diff --git a/cpus-common.c b/cpus-common.c
index XXXXXXX..XXXXXXX 100644
--- a/cpus-common.c
+++ b/cpus-common.c
@@ -XXX,XX +XXX,XX @@ void start_exclusive(void)
     CPUState *other_cpu;
     int running_cpus;
 
+    if (current_cpu->exclusive_context_count) {
+        current_cpu->exclusive_context_count++;
+        return;
+    }
+
     qemu_mutex_lock(&qemu_cpu_list_lock);
     exclusive_idle();
 
@@ -XXX,XX +XXX,XX @@ void start_exclusive(void)
      */
     qemu_mutex_unlock(&qemu_cpu_list_lock);
 
-    current_cpu->in_exclusive_context = true;
+    current_cpu->exclusive_context_count = 1;
 }
 
 /* Finish an exclusive operation.  */
 void end_exclusive(void)
 {
-    current_cpu->in_exclusive_context = false;
+    current_cpu->exclusive_context_count--;
+    if (current_cpu->exclusive_context_count) {
+        return;
+    }
 
     qemu_mutex_lock(&qemu_cpu_list_lock);
     qatomic_set(&pending_cpus, 0);
-- 
2.34.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

Follow what kernel's full_exception() is doing.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230214140829.45392-4-iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/microblaze/cpu_loop.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/linux-user/microblaze/cpu_loop.c b/linux-user/microblaze/cpu_loop.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/microblaze/cpu_loop.c
+++ b/linux-user/microblaze/cpu_loop.c
@@ -XXX,XX +XXX,XX @@
 
 void cpu_loop(CPUMBState *env)
 {
+    int trapnr, ret, si_code, sig;
     CPUState *cs = env_cpu(env);
-    int trapnr, ret, si_code;
 
     while (1) {
         cpu_exec_start(cs);
@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUMBState *env)
             env->iflags &= ~(IMM_FLAG | D_FLAG);
             switch (env->esr & 31) {
             case ESR_EC_DIVZERO:
+                sig = TARGET_SIGFPE;
                 si_code = TARGET_FPE_INTDIV;
                 break;
             case ESR_EC_FPU:
@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUMBState *env)
                  * if there's no recognized bit set.  Possibly this
                  * implies that si_code is 0, but follow the structure.
                  */
+                sig = TARGET_SIGFPE;
                 si_code = env->fsr;
                 if (si_code & FSR_IO) {
                     si_code = TARGET_FPE_FLTINV;
@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUMBState *env)
                     si_code = TARGET_FPE_FLTRES;
                 }
                 break;
+            case ESR_EC_PRIVINSN:
+                sig = SIGILL;
+                si_code = ILL_PRVOPC;
+                break;
             default:
                 fprintf(stderr, "Unhandled hw-exception: 0x%x\n",
                         env->esr & ESR_EC_MASK);
                 cpu_dump_state(cs, stderr, 0);
                 exit(EXIT_FAILURE);
             }
-            force_sig_fault(TARGET_SIGFPE, si_code, env->pc);
+            force_sig_fault(sig, si_code, env->pc);
             break;
 
         case EXCP_DEBUG:
-- 
2.34.1

Mirroring the upstream gdb xml files, the two stack boundary
registers are separated out.

Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/microblaze/cpu.h                     |  2 +
 target/microblaze/cpu.c                     |  7 ++-
 target/microblaze/gdbstub.c                 | 51 +++++++++++-----
 configs/targets/microblaze-linux-user.mak   |  1 +
 configs/targets/microblaze-softmmu.mak      |  1 +
 configs/targets/microblazeel-linux-user.mak |  1 +
 configs/targets/microblazeel-softmmu.mak    |  1 +
 gdb-xml/microblaze-core.xml                 | 67 +++++++++++++++++++++
 gdb-xml/microblaze-stack-protect.xml        | 12 ++++
 9 files changed, 128 insertions(+), 15 deletions(-)
 create mode 100644 gdb-xml/microblaze-core.xml
 create mode 100644 gdb-xml/microblaze-stack-protect.xml

diff --git a/target/microblaze/cpu.h b/target/microblaze/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.h
+++ b/target/microblaze/cpu.h
@@ -XXX,XX +XXX,XX @@ hwaddr mb_cpu_get_phys_page_attrs_debug(CPUState *cpu, vaddr addr,
                                         MemTxAttrs *attrs);
 int mb_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
 int mb_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
+int mb_cpu_gdb_read_stack_protect(CPUArchState *cpu, GByteArray *buf, int reg);
+int mb_cpu_gdb_write_stack_protect(CPUArchState *cpu, uint8_t *buf, int reg);
 
 static inline uint32_t mb_cpu_read_msr(const CPUMBState *env)
 {
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/module.h"
 #include "hw/qdev-properties.h"
 #include "exec/exec-all.h"
+#include "exec/gdbstub.h"
 #include "fpu/softfloat-helpers.h"
 
 static const struct {
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_initfn(Object *obj)
     CPUMBState *env = &cpu->env;
 
     cpu_set_cpustate_pointers(cpu);
+    gdb_register_coprocessor(CPU(cpu), mb_cpu_gdb_read_stack_protect,
+                             mb_cpu_gdb_write_stack_protect, 2,
+                             "microblaze-stack-protect.xml", 0);
 
     set_float_rounding_mode(float_round_nearest_even, &env->fp_status);
 
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     cc->sysemu_ops = &mb_sysemu_ops;
 #endif
     device_class_set_props(dc, mb_properties);
-    cc->gdb_num_core_regs = 32 + 27;
+    cc->gdb_num_core_regs = 32 + 25;
+    cc->gdb_core_xml_file = "microblaze-core.xml";
 
     cc->disas_set_info = mb_disas_set_info;
     cc->tcg_ops = &mb_tcg_ops;
diff --git a/target/microblaze/gdbstub.c b/target/microblaze/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/gdbstub.c
+++ b/target/microblaze/gdbstub.c
@@ -XXX,XX +XXX,XX @@ enum {
     GDB_PVR0  = 32 + 6,
     GDB_PVR11 = 32 + 17,
     GDB_EDR   = 32 + 18,
-    GDB_SLR   = 32 + 25,
-    GDB_SHR   = 32 + 26,
+};
+
+enum {
+    GDB_SP_SHL,
+    GDB_SP_SHR,
 };
 
 int mb_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
@@ -XXX,XX +XXX,XX @@ int mb_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
     case GDB_EDR:
         val = env->edr;
         break;
-    case GDB_SLR:
-        val = env->slr;
-        break;
-    case GDB_SHR:
-        val = env->shr;
-        break;
     default:
         /* Other SRegs aren't modeled, so report a value of 0 */
         val = 0;
@@ -XXX,XX +XXX,XX @@ int mb_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
     return gdb_get_reg32(mem_buf, val);
 }
 
+int mb_cpu_gdb_read_stack_protect(CPUMBState *env, GByteArray *mem_buf, int n)
+{
+    uint32_t val;
+
+    switch (n) {
+    case GDB_SP_SHL:
+        val = env->slr;
+        break;
+    case GDB_SP_SHR:
+        val = env->shr;
+        break;
+    default:
+        return 0;
+    }
+    return gdb_get_reg32(mem_buf, val);
+}
+
 int mb_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
     MicroBlazeCPU *cpu = MICROBLAZE_CPU(cs);
@@ -XXX,XX +XXX,XX @@ int mb_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
     case GDB_EDR:
         env->edr = tmp;
         break;
-    case GDB_SLR:
-        env->slr = tmp;
-        break;
-    case GDB_SHR:
-        env->shr = tmp;
-        break;
+    }
+    return 4;
+}
+
+int mb_cpu_gdb_write_stack_protect(CPUMBState *env, uint8_t *mem_buf, int n)
+{
+    switch (n) {
+    case GDB_SP_SHL:
+        env->slr = ldl_p(mem_buf);
+        break;
+    case GDB_SP_SHR:
+        env->shr = ldl_p(mem_buf);
+        break;
+    default:
+        return 0;
     }
     return 4;
 }
diff --git a/configs/targets/microblaze-linux-user.mak b/configs/targets/microblaze-linux-user.mak
index XXXXXXX..XXXXXXX 100644
--- a/configs/targets/microblaze-linux-user.mak
+++ b/configs/targets/microblaze-linux-user.mak
@@ -XXX,XX +XXX,XX @@ TARGET_SYSTBL_ABI=common
 TARGET_SYSTBL=syscall.tbl
 TARGET_BIG_ENDIAN=y
 TARGET_HAS_BFLT=y
+TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
diff --git a/configs/targets/microblaze-softmmu.mak b/configs/targets/microblaze-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/configs/targets/microblaze-softmmu.mak
+++ b/configs/targets/microblaze-softmmu.mak
@@ -XXX,XX +XXX,XX @@ TARGET_ARCH=microblaze
 TARGET_BIG_ENDIAN=y
 TARGET_SUPPORTS_MTTCG=y
 TARGET_NEED_FDT=y
+TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
diff --git a/configs/targets/microblazeel-linux-user.mak b/configs/targets/microblazeel-linux-user.mak
index XXXXXXX..XXXXXXX 100644
--- a/configs/targets/microblazeel-linux-user.mak
+++ b/configs/targets/microblazeel-linux-user.mak
@@ -XXX,XX +XXX,XX @@ TARGET_ARCH=microblaze
 TARGET_SYSTBL_ABI=common
 TARGET_SYSTBL=syscall.tbl
 TARGET_HAS_BFLT=y
+TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
diff --git a/configs/targets/microblazeel-softmmu.mak b/configs/targets/microblazeel-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/configs/targets/microblazeel-softmmu.mak
+++ b/configs/targets/microblazeel-softmmu.mak
@@ -XXX,XX +XXX,XX @@
 TARGET_ARCH=microblaze
 TARGET_SUPPORTS_MTTCG=y
 TARGET_NEED_FDT=y
+TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
diff --git a/gdb-xml/microblaze-core.xml b/gdb-xml/microblaze-core.xml
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/gdb-xml/microblaze-core.xml
@@ -XXX,XX +XXX,XX @@
+<?xml version="1.0"?>
+
+
+<!DOCTYPE feature SYSTEM "gdb-target.dtd">
+<feature name="org.gnu.gdb.microblaze.core">
+  <reg name="r0" bitsize="32" regnum="0"/>
+  <reg name="r1" bitsize="32" type="data_ptr"/>
+  <reg name="r2" bitsize="32"/>
+  <reg name="r3" bitsize="32"/>
+  <reg name="r4" bitsize="32"/>
+  <reg name="r5" bitsize="32"/>
+  <reg name="r6" bitsize="32"/>
+  <reg name="r7" bitsize="32"/>
+  <reg name="r8" bitsize="32"/>
+  <reg name="r9" bitsize="32"/>
+  <reg name="r10" bitsize="32"/>
+  <reg name="r11" bitsize="32"/>
+  <reg name="r12" bitsize="32"/>
+  <reg name="r13" bitsize="32"/>
+  <reg name="r14" bitsize="32"/>
+  <reg name="r15" bitsize="32"/>
+  <reg name="r16" bitsize="32"/>
+  <reg name="r17" bitsize="32"/>
+  <reg name="r18" bitsize="32"/>
+  <reg name="r19" bitsize="32"/>
+  <reg name="r20" bitsize="32"/>
+  <reg name="r21" bitsize="32"/>
+  <reg name="r22" bitsize="32"/>
+  <reg name="r23" bitsize="32"/>
+  <reg name="r24" bitsize="32"/>
+  <reg name="r25" bitsize="32"/>
+  <reg name="r26" bitsize="32"/>
+  <reg name="r27" bitsize="32"/>
+  <reg name="r28" bitsize="32"/>
+  <reg name="r29" bitsize="32"/>
+  <reg name="r30" bitsize="32"/>
+  <reg name="r31" bitsize="32"/>
+  <reg name="rpc" bitsize="32" type="code_ptr"/>
+  <reg name="rmsr" bitsize="32"/>
+  <reg name="rear" bitsize="32"/>
+  <reg name="resr" bitsize="32"/>
+  <reg name="rfsr" bitsize="32"/>
+  <reg name="rbtr" bitsize="32"/>
+  <reg name="rpvr0" bitsize="32"/>
+  <reg name="rpvr1" bitsize="32"/>
+  <reg name="rpvr2" bitsize="32"/>
+  <reg name="rpvr3" bitsize="32"/>
+  <reg name="rpvr4" bitsize="32"/>
+  <reg name="rpvr5" bitsize="32"/>
+  <reg name="rpvr6" bitsize="32"/>
+  <reg name="rpvr7" bitsize="32"/>
+  <reg name="rpvr8" bitsize="32"/>
+  <reg name="rpvr9" bitsize="32"/>
+  <reg name="rpvr10" bitsize="32"/>
+  <reg name="rpvr11" bitsize="32"/>
+  <reg name="redr" bitsize="32"/>
+  <reg name="rpid" bitsize="32"/>
+  <reg name="rzpr" bitsize="32"/>
+  <reg name="rtlbx" bitsize="32"/>
+  <reg name="rtlbsx" bitsize="32"/>
+  <reg name="rtlblo" bitsize="32"/>
+  <reg name="rtlbhi" bitsize="32"/>
+</feature>
diff --git a/gdb-xml/microblaze-stack-protect.xml b/gdb-xml/microblaze-stack-protect.xml
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/gdb-xml/microblaze-stack-protect.xml
@@ -XXX,XX +XXX,XX @@
+<?xml version="1.0"?>
+
+
+<!DOCTYPE feature SYSTEM "gdb-target.dtd">
+<feature name="org.gnu.gdb.microblaze.stack-protect">
+  <reg name="rslr" bitsize="32"/>
+  <reg name="rshr" bitsize="32"/>
+</feature>
-- 
2.34.1

From: Pierrick Bouvier <pierrick.bouvier@linaro.org>

ctr_el0 access is privileged on this platform and fails as an illegal
instruction.

Windows does not offer a way to flush data cache from userspace, and
only FlushInstructionCache is available in Windows API.

The generic implementation of flush_idcache_range uses,
__builtin___clear_cache, which already use the FlushInstructionCache
function. So we rely on that.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230221153006.20300-2-pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 util/cacheflush.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/util/cacheflush.c b/util/cacheflush.c
index XXXXXXX..XXXXXXX 100644
--- a/util/cacheflush.c
+++ b/util/cacheflush.c
@@ -XXX,XX +XXX,XX @@ static void sys_cache_info(int *isize, int *dsize)
 static bool have_coherent_icache;
 #endif
 
-#if defined(__aarch64__) && !defined(CONFIG_DARWIN)
-/* Apple does not expose CTR_EL0, so we must use system interfaces. */
+#if defined(__aarch64__) && !defined(CONFIG_DARWIN) && !defined(CONFIG_WIN32)
+/*
+ * Apple does not expose CTR_EL0, so we must use system interfaces.
+ * Windows neither, but we use a generic implementation of flush_idcache_range
+ * in this case.
+ */
 static uint64_t save_ctr_el0;
 static void arch_cache_info(int *isize, int *dsize)
 {
@@ -XXX,XX +XXX,XX @@ static void __attribute__((constructor)) init_cache_info(void)
 
 /* Caches are coherent and do not require flushing; symbol inline. */
 
-#elif defined(__aarch64__)
+#elif defined(__aarch64__) && !defined(CONFIG_WIN32)
+/*
+ * For Windows, we use generic implementation of flush_idcache_range, that
+ * performs a call to FlushInstructionCache, through __builtin___clear_cache.
+ */
 
 #ifdef CONFIG_DARWIN
 /* Apple does not expose CTR_EL0, so we must use system interfaces. */
-- 
2.34.1

From: Pierrick Bouvier <pierrick.bouvier@linaro.org>

Windows implementation of setjmp/longjmp is done in
C:/WINDOWS/system32/ucrtbase.dll. Alas, on arm64, it seems to *always*
perform stack unwinding, which crashes from generated code.

By using alternative implementation built in mingw, we avoid doing stack
unwinding and this fixes crash when calling longjmp.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230221153006.20300-3-pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/sysemu/os-win32.h | 28 ++++++++++++++++++++++++----
 meson.build               | 21 +++++++++++++++++++++
 2 files changed, 45 insertions(+), 4 deletions(-)

diff --git a/include/sysemu/os-win32.h b/include/sysemu/os-win32.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/os-win32.h
+++ b/include/sysemu/os-win32.h
@@ -XXX,XX +XXX,XX @@ typedef struct sockaddr_un {
 extern "C" {
 #endif
 
-#if defined(_WIN64)
-/* On w64, setjmp is implemented by _setjmp which needs a second parameter.
+#if defined(__aarch64__)
+/*
+ * On windows-arm64, setjmp is available in only one variant, and longjmp always
+ * does stack unwinding. This crash with generated code.
+ * Thus, we use another implementation of setjmp (not windows one), coming from
+ * mingw, which never performs stack unwinding.
+ */
+#undef setjmp
+#undef longjmp
+/*
+ * These functions are not declared in setjmp.h because __aarch64__ defines
+ * setjmp to _setjmpex instead. However, they are still defined in libmingwex.a,
+ * which gets linked automatically.
+ */
+extern int __mingw_setjmp(jmp_buf);
+extern void __attribute__((noreturn)) __mingw_longjmp(jmp_buf, int);
+#define setjmp(env) __mingw_setjmp(env)
+#define longjmp(env, val) __mingw_longjmp(env, val)
+#elif defined(_WIN64)
+/*
+ * On windows-x64, setjmp is implemented by _setjmp which needs a second parameter.
  * If this parameter is NULL, longjump does no stack unwinding.
  * That is what we need for QEMU. Passing the value of register rsp (default)
- * lets longjmp try a stack unwinding which will crash with generated code. */
+ * lets longjmp try a stack unwinding which will crash with generated code.
+ */
 # undef setjmp
 # define setjmp(env) _setjmp(env, NULL)
-#endif
+#endif /* __aarch64__ */
 /* QEMU uses sigsetjmp()/siglongjmp() as the portable way to specify
  * "longjmp and don't touch the signal masks". Since we know that the
  * savemask parameter will always be zero we can safely define these
diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ if targetos == 'windows'
     }''', name: '_lock_file and _unlock_file'))
 endif
 
+if targetos == 'windows'
+  mingw_has_setjmp_longjmp = cc.links('''
+    #include <setjmp.h>
+    int main(void) {
+      /*
+       * These functions are not available in setjmp header, but may be
+       * available at link time, from libmingwex.a.
+       */
+      extern int __mingw_setjmp(jmp_buf);
+      extern void __attribute__((noreturn)) __mingw_longjmp(jmp_buf, int);
+      jmp_buf env;
+      __mingw_setjmp(env);
+      __mingw_longjmp(env, 0);
+    }
+  ''', name: 'mingw setjmp and longjmp')
+
+  if cpu == 'aarch64' and not mingw_has_setjmp_longjmp
+    error('mingw must provide setjmp/longjmp for windows-arm64')
+  endif
+endif
+
 ########################
 # Target configuration #
 ########################
-- 
2.34.1