Series comparison

-[PULL 0/5] tcg patch queue
+[PULL 0/4] tcg patch queue
-The following changes since commit fb7e7990342e59cf67dbd895c1a1e3fb1741df7a:
+Pretty small still, but there are two patches that ought
 to get backported to stable, so no point in delaying.
-  tests/qtest/qom-test: Do not print tested properties by default (2023-01-16 15:00:57 +0000)
+r~
 The following changes since commit a5ba0a7e4e150d1350a041f0d0ef9ca6c8d7c307:
   Merge tag 'pull-aspeed-20241211' of https://github.com/legoater/qemu into staging (2024-12-11 15:16:47 +0000)
 are available in the Git repository at:
-  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20230116
+  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20241212
-for you to fetch changes up to 61710a7e23a63546da0071ea32adb96476fa5d07:
+for you to fetch changes up to 7ac87b14a92234b6a89b701b4043ad6cf8bdcccf:
-  accel/tcg: Split out cpu_exec_{setjmp,loop} (2023-01-16 10:14:12 -1000)
+  target/sparc: Use memcpy() and remove memcpy32() (2024-12-12 14:28:38 -0600)
 ----------------------------------------------------------------
-- Reorg cpu_tb_exec around setjmp.
+tcg: Reset free_temps before tcg_optimize
-- Use __attribute__((target)) for buffer_is_zero.
+tcg/riscv: Fix StoreStore barrier generation
-- Add perfmap and jitdump for perf support.
+include/exec: Introduce fpst alias in helper-head.h.inc
 target/sparc: Use memcpy() and remove memcpy32()
 ----------------------------------------------------------------
-Ilya Leoshkevich (3):
+Philippe Mathieu-Daudé (1):
-      linux-user: Clean up when exiting due to a signal
+      target/sparc: Use memcpy() and remove memcpy32()
       accel/tcg: Add debuginfo support
       tcg: add perfmap and jitdump
 Richard Henderson (2):
-      util/bufferiszero: Use __attribute__((target)) for avx2/avx512
+      tcg: Reset free_temps before tcg_optimize
-      accel/tcg: Split out cpu_exec_{setjmp,loop}
+      include/exec: Introduce fpst alias in helper-head.h.inc
- docs/devel/tcg.rst        |  23 +++
+Roman Artemev (1):
- meson.build               |  16 +-
+      tcg/riscv: Fix StoreStore barrier generation
- accel/tcg/debuginfo.h     |  77 ++++++++++
- accel/tcg/perf.h          |  49 ++++++
+ include/tcg/tcg-temp-internal.h |  6 ++++++
- accel/tcg/cpu-exec.c      | 111 +++++++-------
+ accel/tcg/plugin-gen.c          |  2 +-
- accel/tcg/debuginfo.c     |  96 ++++++++++++
+ target/sparc/win_helper.c       | 26 ++++++++------------------
- accel/tcg/perf.c          | 375 ++++++++++++++++++++++++++++++++++++++++++++++
+ tcg/tcg.c                       |  5 ++++-
- accel/tcg/translate-all.c |   7 +
+ include/exec/helper-head.h.inc  |  3 +++
- hw/core/loader.c          |   5 +
+ tcg/riscv/tcg-target.c.inc      |  2 +-
- linux-user/elfload.c      |   3 +
+files changed, 23 insertions(+), 21 deletions(-)
- linux-user/exit.c         |   2 +
  linux-user/main.c         |  15 ++
  linux-user/signal.c       |   8 +-
  softmmu/vl.c              |  11 ++
  tcg/tcg.c                 |   2 +
  util/bufferiszero.c       |  41 +----
  accel/tcg/meson.build     |   2 +
  linux-user/meson.build    |   1 +
  qemu-options.hx           |  20 +++
 files changed, 763 insertions(+), 101 deletions(-)
  create mode 100644 accel/tcg/debuginfo.h
  create mode 100644 accel/tcg/perf.h
  create mode 100644 accel/tcg/debuginfo.c
  create mode 100644 accel/tcg/perf.c

-[PULL 3/5] tcg: add perfmap and jitdump
+[PULL 1/4] tcg: Reset free_temps before tcg_optimize
-From: Ilya Leoshkevich <iii@linux.ibm.com>
+When allocating new temps during tcg_optmize, do not re-use
 any EBB temps that were used within the TB.  We do not have
 any idea what span of the TB in which the temp was live.
-Add ability to dump /tmp/perf-<pid>.map and jit-<pid>.dump.
+Introduce tcg_temp_ebb_reset_freed and use before tcg_optimize,
-The first one allows the perf tool to map samples to each individual
+as well as replacing the equivalent in plugin_gen_inject and
-translation block. The second one adds the ability to resolve symbol
+tcg_func_start.
 names, line numbers and inspect JITed code.
-Example of use:
+Cc: qemu-stable@nongnu.org
 Fixes: fb04ab7ddd8 ("tcg/optimize: Lower TCG_COND_TST{EQ,NE} if unsupported")
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2711
 Reported-by: wannacu <wannacu2049@gmail.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 ---
  include/tcg/tcg-temp-internal.h | 6 ++++++
  accel/tcg/plugin-gen.c          | 2 +-
  tcg/tcg.c                       | 5 ++++-
 files changed, 11 insertions(+), 2 deletions(-)
-    perf record qemu-x86_64 -perfmap ./a.out
+diff --git a/include/tcg/tcg-temp-internal.h b/include/tcg/tcg-temp-internal.h
     perf report
 or
     perf record -k 1 qemu-x86_64 -jitdump ./a.out
     DEBUGINFOD_URLS= perf inject -j -i perf.data -o perf.data.jitted
     perf report -i perf.data.jitted
 Co-developed-by: Vanderson M. do Rosario <vandersonmr2@gmail.com>
 Co-developed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Message-Id: <20230112152013.125680-4-iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
  docs/devel/tcg.rst        |  23 +++
  accel/tcg/perf.h          |  49 +++++
  accel/tcg/perf.c          | 375 ++++++++++++++++++++++++++++++++++++++
  accel/tcg/translate-all.c |   7 +
  linux-user/exit.c         |   2 +
  linux-user/main.c         |  15 ++
  softmmu/vl.c              |  11 ++
  tcg/tcg.c                 |   2 +
  accel/tcg/meson.build     |   1 +
  qemu-options.hx           |  20 ++
 files changed, 505 insertions(+)
  create mode 100644 accel/tcg/perf.h
  create mode 100644 accel/tcg/perf.c
 diff --git a/docs/devel/tcg.rst b/docs/devel/tcg.rst
 index XXXXXXX..XXXXXXX 100644
---- a/docs/devel/tcg.rst
+--- a/include/tcg/tcg-temp-internal.h
-+++ b/docs/devel/tcg.rst
++++ b/include/tcg/tcg-temp-internal.h
-@@ -XXX,XX +XXX,XX @@ memory areas instead calls out to C code for device emulation.
+@@ -XXX,XX +XXX,XX @@ TCGv_i64 tcg_temp_ebb_new_i64(void);
- Finally, the MMU helps tracking dirty pages and pages pointed to by
+ TCGv_ptr tcg_temp_ebb_new_ptr(void);
- translation blocks.
+ TCGv_i128 tcg_temp_ebb_new_i128(void);
-+Profiling JITted code
++/* Forget all freed EBB temps, so that new allocations produce new temps. */
-+---------------------
++static inline void tcg_temp_ebb_reset_freed(TCGContext *s)
 +
 +The Linux ``perf`` tool will treat all JITted code as a single block as
 +unlike the main code it can't use debug information to link individual
 +program counter samples with larger functions. To overcome this
 +limitation you can use the ``-perfmap`` or the ``-jitdump`` option to generate
 +map files. ``-perfmap`` is lightweight and produces only guest-host mappings.
 +``-jitdump`` additionally saves JITed code and guest debug information (if
 +available); its output needs to be integrated with the ``perf.data`` file
 +before the final report can be viewed.
 +
 +.. code::
 +
 +  perf record $QEMU -perfmap $REMAINING_ARGS
 +  perf report
 +
 +  perf record -k 1 $QEMU -jitdump $REMAINING_ARGS
 +  DEBUGINFOD_URLS= perf inject -j -i perf.data -o perf.data.jitted
 +  perf report -i perf.data.jitted
 +
 +Note that qemu-system generates mappings only for ``-kernel`` files in ELF
 +format.
 diff --git a/accel/tcg/perf.h b/accel/tcg/perf.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/accel/tcg/perf.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Linux perf perf-<pid>.map and jit-<pid>.dump integration.
 + *
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + */
 +
 +#ifndef ACCEL_TCG_PERF_H
 +#define ACCEL_TCG_PERF_H
 +
 +#if defined(CONFIG_TCG) && defined(CONFIG_LINUX)
 +/* Start writing perf-<pid>.map. */
 +void perf_enable_perfmap(void);
 +
 +/* Start writing jit-<pid>.dump. */
 +void perf_enable_jitdump(void);
 +
 +/* Add information about TCG prologue to profiler maps. */
 +void perf_report_prologue(const void *start, size_t size);
 +
 +/* Add information about JITted guest code to profiler maps. */
 +void perf_report_code(uint64_t guest_pc, TranslationBlock *tb,
 +                      const void *start);
 +
 +/* Stop writing perf-<pid>.map and/or jit-<pid>.dump. */
 +void perf_exit(void);
 +#else
 +static inline void perf_enable_perfmap(void)
 +{
++    memset(s->free_temps, 0, sizeof(s->free_temps));
 +}
 +
-+static inline void perf_enable_jitdump(void)
+ #endif /* TCG_TEMP_FREE_H */
-+{
+diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
 +}
 +
 +static inline void perf_report_prologue(const void *start, size_t size)
 +{
 +}
 +
 +static inline void perf_report_code(uint64_t guest_pc, TranslationBlock *tb,
 +                                    const void *start)
 +{
 +}
 +
 +static inline void perf_exit(void)
 +{
 +}
 +#endif
 +
 +#endif
 diff --git a/accel/tcg/perf.c b/accel/tcg/perf.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/accel/tcg/perf.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Linux perf perf-<pid>.map and jit-<pid>.dump integration.
 + *
 + * The jitdump spec can be found at [1].
 + *
 + * [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/plain/tools/perf/Documentation/jitdump-specification.txt
 + *
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + */
 +
 +#include "qemu/osdep.h"
 +#include "elf.h"
 +#include "exec/exec-all.h"
 +#include "qemu/timer.h"
 +#include "tcg/tcg.h"
 +
 +#include "debuginfo.h"
 +#include "perf.h"
 +
 +static FILE *safe_fopen_w(const char *path)
 +{
 +    int saved_errno;
 +    FILE *f;
 +    int fd;
 +
 +    /* Delete the old file, if any. */
 +    unlink(path);
 +
 +    /* Avoid symlink attacks by using O_CREAT | O_EXCL. */
 +    fd = open(path, O_RDWR | O_CREAT | O_EXCL, S_IRUSR | S_IWUSR);
 +    if (fd == -1) {
 +        return NULL;
 +    }
 +
 +    /* Convert fd to FILE*. */
 +    f = fdopen(fd, "w");
 +    if (f == NULL) {
 +        saved_errno = errno;
 +        close(fd);
 +        errno = saved_errno;
 +        return NULL;
 +    }
 +
 +    return f;
 +}
 +
 +static FILE *perfmap;
 +
 +void perf_enable_perfmap(void)
 +{
 +    char map_file[32];
 +
 +    snprintf(map_file, sizeof(map_file), "/tmp/perf-%d.map", getpid());
 +    perfmap = safe_fopen_w(map_file);
 +    if (perfmap == NULL) {
 +        warn_report("Could not open %s: %s, proceeding without perfmap",
 +                    map_file, strerror(errno));
 +    }
 +}
 +
 +/* Get PC and size of code JITed for guest instruction #INSN. */
 +static void get_host_pc_size(uintptr_t *host_pc, uint16_t *host_size,
 +                             const void *start, size_t insn)
 +{
 +    uint16_t start_off = insn ? tcg_ctx->gen_insn_end_off[insn - 1] : 0;
 +
 +    if (host_pc) {
 +        *host_pc = (uintptr_t)start + start_off;
 +    }
 +    if (host_size) {
 +        *host_size = tcg_ctx->gen_insn_end_off[insn] - start_off;
 +    }
 +}
 +
 +static const char *pretty_symbol(const struct debuginfo_query *q, size_t *len)
 +{
 +    static __thread char buf[64];
 +    int tmp;
 +
 +    if (!q->symbol) {
 +        tmp = snprintf(buf, sizeof(buf), "guest-0x%"PRIx64, q->address);
 +        if (len) {
 +            *len = MIN(tmp + 1, sizeof(buf));
 +        }
 +        return buf;
 +    }
 +
 +    if (!q->offset) {
 +        if (len) {
 +            *len = strlen(q->symbol) + 1;
 +        }
 +        return q->symbol;
 +    }
 +
 +    tmp = snprintf(buf, sizeof(buf), "%s+0x%"PRIx64, q->symbol, q->offset);
 +    if (len) {
 +        *len = MIN(tmp + 1, sizeof(buf));
 +    }
 +    return buf;
 +}
 +
 +static void write_perfmap_entry(const void *start, size_t insn,
 +                                const struct debuginfo_query *q)
 +{
 +    uint16_t host_size;
 +    uintptr_t host_pc;
 +
 +    get_host_pc_size(&host_pc, &host_size, start, insn);
 +    fprintf(perfmap, "%"PRIxPTR" %"PRIx16" %s\n",
 +            host_pc, host_size, pretty_symbol(q, NULL));
 +}
 +
 +static FILE *jitdump;
 +
 +#define JITHEADER_MAGIC 0x4A695444
 +#define JITHEADER_VERSION 1
 +
 +struct jitheader {
 +    uint32_t magic;
 +    uint32_t version;
 +    uint32_t total_size;
 +    uint32_t elf_mach;
 +    uint32_t pad1;
 +    uint32_t pid;
 +    uint64_t timestamp;
 +    uint64_t flags;
 +};
 +
 +enum jit_record_type {
 +    JIT_CODE_LOAD = 0,
 +    JIT_CODE_DEBUG_INFO = 2,
 +};
 +
 +struct jr_prefix {
 +    uint32_t id;
 +    uint32_t total_size;
 +    uint64_t timestamp;
 +};
 +
 +struct jr_code_load {
 +    struct jr_prefix p;
 +
 +    uint32_t pid;
 +    uint32_t tid;
 +    uint64_t vma;
 +    uint64_t code_addr;
 +    uint64_t code_size;
 +    uint64_t code_index;
 +};
 +
 +struct debug_entry {
 +    uint64_t addr;
 +    int lineno;
 +    int discrim;
 +    const char name[];
 +};
 +
 +struct jr_code_debug_info {
 +    struct jr_prefix p;
 +
 +    uint64_t code_addr;
 +    uint64_t nr_entry;
 +    struct debug_entry entries[];
 +};
 +
 +static uint32_t get_e_machine(void)
 +{
 +    Elf64_Ehdr elf_header;
 +    FILE *exe;
 +    size_t n;
 +
 +    QEMU_BUILD_BUG_ON(offsetof(Elf32_Ehdr, e_machine) !=
 +                      offsetof(Elf64_Ehdr, e_machine));
 +
 +    exe = fopen("/proc/self/exe", "r");
 +    if (exe == NULL) {
 +        return EM_NONE;
 +    }
 +
 +    n = fread(&elf_header, sizeof(elf_header), 1, exe);
 +    fclose(exe);
 +    if (n != 1) {
 +        return EM_NONE;
 +    }
 +
 +    return elf_header.e_machine;
 +}
 +
 +void perf_enable_jitdump(void)
 +{
 +    struct jitheader header;
 +    char jitdump_file[32];
 +    void *perf_marker;
 +
 +    if (!use_rt_clock) {
 +        warn_report("CLOCK_MONOTONIC is not available, proceeding without jitdump");
 +        return;
 +    }
 +
 +    snprintf(jitdump_file, sizeof(jitdump_file), "jit-%d.dump", getpid());
 +    jitdump = safe_fopen_w(jitdump_file);
 +    if (jitdump == NULL) {
 +        warn_report("Could not open %s: %s, proceeding without jitdump",
 +                    jitdump_file, strerror(errno));
 +        return;
 +    }
 +
 +    /*
 +     * `perf inject` will see that the mapped file name in the corresponding
 +     * PERF_RECORD_MMAP or PERF_RECORD_MMAP2 event is of the form jit-%d.dump
 +     * and will process it as a jitdump file.
 +     */
 +    perf_marker = mmap(NULL, qemu_real_host_page_size(), PROT_READ | PROT_EXEC,
 +                       MAP_PRIVATE, fileno(jitdump), 0);
 +    if (perf_marker == MAP_FAILED) {
 +        warn_report("Could not map %s: %s, proceeding without jitdump",
 +                    jitdump_file, strerror(errno));
 +        fclose(jitdump);
 +        jitdump = NULL;
 +        return;
 +    }
 +
 +    header.magic = JITHEADER_MAGIC;
 +    header.version = JITHEADER_VERSION;
 +    header.total_size = sizeof(header);
 +    header.elf_mach = get_e_machine();
 +    header.pad1 = 0;
 +    header.pid = getpid();
 +    header.timestamp = get_clock();
 +    header.flags = 0;
 +    fwrite(&header, sizeof(header), 1, jitdump);
 +}
 +
 +void perf_report_prologue(const void *start, size_t size)
 +{
 +    if (perfmap) {
 +        fprintf(perfmap, "%"PRIxPTR" %zx tcg-prologue-buffer\n",
 +                (uintptr_t)start, size);
 +    }
 +}
 +
 +/* Write a JIT_CODE_DEBUG_INFO jitdump entry. */
 +static void write_jr_code_debug_info(const void *start,
 +                                     const struct debuginfo_query *q,
 +                                     size_t icount)
 +{
 +    struct jr_code_debug_info rec;
 +    struct debug_entry ent;
 +    uintptr_t host_pc;
 +    int insn;
 +
 +    /* Write the header. */
 +    rec.p.id = JIT_CODE_DEBUG_INFO;
 +    rec.p.total_size = sizeof(rec) + sizeof(ent) + 1;
 +    rec.p.timestamp = get_clock();
 +    rec.code_addr = (uintptr_t)start;
 +    rec.nr_entry = 1;
 +    for (insn = 0; insn < icount; insn++) {
 +        if (q[insn].file) {
 +            rec.p.total_size += sizeof(ent) + strlen(q[insn].file) + 1;
 +            rec.nr_entry++;
 +        }
 +    }
 +    fwrite(&rec, sizeof(rec), 1, jitdump);
 +
 +    /* Write the main debug entries. */
 +    for (insn = 0; insn < icount; insn++) {
 +        if (q[insn].file) {
 +            get_host_pc_size(&host_pc, NULL, start, insn);
 +            ent.addr = host_pc;
 +            ent.lineno = q[insn].line;
 +            ent.discrim = 0;
 +            fwrite(&ent, sizeof(ent), 1, jitdump);
 +            fwrite(q[insn].file, strlen(q[insn].file) + 1, 1, jitdump);
 +        }
 +    }
 +
 +    /* Write the trailing debug_entry. */
 +    ent.addr = (uintptr_t)start + tcg_ctx->gen_insn_end_off[icount - 1];
 +    ent.lineno = 0;
 +    ent.discrim = 0;
 +    fwrite(&ent, sizeof(ent), 1, jitdump);
 +    fwrite("", 1, 1, jitdump);
 +}
 +
 +/* Write a JIT_CODE_LOAD jitdump entry. */
 +static void write_jr_code_load(const void *start, uint16_t host_size,
 +                               const struct debuginfo_query *q)
 +{
 +    static uint64_t code_index;
 +    struct jr_code_load rec;
 +    const char *symbol;
 +    size_t symbol_size;
 +
 +    symbol = pretty_symbol(q, &symbol_size);
 +    rec.p.id = JIT_CODE_LOAD;
 +    rec.p.total_size = sizeof(rec) + symbol_size + host_size;
 +    rec.p.timestamp = get_clock();
 +    rec.pid = getpid();
 +    rec.tid = qemu_get_thread_id();
 +    rec.vma = (uintptr_t)start;
 +    rec.code_addr = (uintptr_t)start;
 +    rec.code_size = host_size;
 +    rec.code_index = code_index++;
 +    fwrite(&rec, sizeof(rec), 1, jitdump);
 +    fwrite(symbol, symbol_size, 1, jitdump);
 +    fwrite(start, host_size, 1, jitdump);
 +}
 +
 +void perf_report_code(uint64_t guest_pc, TranslationBlock *tb,
 +                      const void *start)
 +{
 +    struct debuginfo_query *q;
 +    size_t insn;
 +
 +    if (!perfmap && !jitdump) {
 +        return;
 +    }
 +
 +    q = g_try_malloc0_n(tb->icount, sizeof(*q));
 +    if (!q) {
 +        return;
 +    }
 +
 +    debuginfo_lock();
 +
 +    /* Query debuginfo for each guest instruction. */
 +    for (insn = 0; insn < tb->icount; insn++) {
 +        /* FIXME: This replicates the restore_state_to_opc() logic. */
 +        q[insn].address = tcg_ctx->gen_insn_data[insn][0];
 +        if (TARGET_TB_PCREL) {
 +            q[insn].address |= (guest_pc & TARGET_PAGE_MASK);
 +        } else {
 +#if defined(TARGET_I386)
 +            q[insn].address -= tb->cs_base;
 +#endif
 +        }
 +        q[insn].flags = DEBUGINFO_SYMBOL | (jitdump ? DEBUGINFO_LINE : 0);
 +    }
 +    debuginfo_query(q, tb->icount);
 +
 +    /* Emit perfmap entries if needed. */
 +    if (perfmap) {
 +        flockfile(perfmap);
 +        for (insn = 0; insn < tb->icount; insn++) {
 +            write_perfmap_entry(start, insn, &q[insn]);
 +        }
 +        funlockfile(perfmap);
 +    }
 +
 +    /* Emit jitdump entries if needed. */
 +    if (jitdump) {
 +        flockfile(jitdump);
 +        write_jr_code_debug_info(start, q, tb->icount);
 +        write_jr_code_load(start, tcg_ctx->gen_insn_end_off[tb->icount - 1],
 +                           q);
 +        funlockfile(jitdump);
 +    }
 +
 +    debuginfo_unlock();
 +    g_free(q);
 +}
 +
 +void perf_exit(void)
 +{
 +    if (perfmap) {
 +        fclose(perfmap);
 +        perfmap = NULL;
 +    }
 +
 +    if (jitdump) {
 +        fclose(jitdump);
 +        jitdump = NULL;
 +    }
 +}
 diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/translate-all.c
+--- a/accel/tcg/plugin-gen.c
-+++ b/accel/tcg/translate-all.c
++++ b/accel/tcg/plugin-gen.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
- #include "tb-hash.h"
+      * that might be live within the existing opcode stream.
- #include "tb-context.h"
+      * The simplest solution is to release them all and create new.
- #include "internal.h"
+      */
-+#include "perf.h"
+-    memset(tcg_ctx->free_temps, 0, sizeof(tcg_ctx->free_temps));
++    tcg_temp_ebb_reset_freed(tcg_ctx);
- /* Make sure all possible CPU event bits fit in tb->trace_vcpu_dstate */
- QEMU_BUILD_BUG_ON(CPU_TRACE_DSTATE_MAX_EVENTS >
+     QTAILQ_FOREACH_SAFE(op, &tcg_ctx->ops, link, next) {
-@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
+         switch (op->opc) {
      }
      tb->tc.size = gen_code_size;
 +    /*
 +     * For TARGET_TB_PCREL, attribute all executions of the generated
 +     * code to its first mapping.
 +     */
 +    perf_report_code(pc, tb, tcg_splitwx_to_rx(gen_code_buf));
 +
  #ifdef CONFIG_PROFILER
      qatomic_set(&prof->code_time, prof->code_time + profile_getclock() - ti);
      qatomic_set(&prof->code_in_len, prof->code_in_len + tb->size);
 diff --git a/linux-user/exit.c b/linux-user/exit.c
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/exit.c
 +++ b/linux-user/exit.c
@@ -XXX,XX +XXX,XX @@
   *  along with this program; if not, see <http://www.gnu.org/licenses/>.
   */
  #include "qemu/osdep.h"
 +#include "accel/tcg/perf.h"
  #include "exec/gdbstub.h"
  #include "qemu.h"
  #include "user-internals.h"
@@ -XXX,XX +XXX,XX @@ void preexit_cleanup(CPUArchState *env, int code)
  #endif
          gdb_exit(code);
          qemu_plugin_user_exit();
 +        perf_exit();
  }
 diff --git a/linux-user/main.c b/linux-user/main.c
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/main.c
 +++ b/linux-user/main.c
@@ -XXX,XX +XXX,XX @@
  #include "signal-common.h"
  #include "loader.h"
  #include "user-mmap.h"
 +#include "accel/tcg/perf.h"
  #ifdef CONFIG_SEMIHOSTING
  #include "semihosting/semihost.h"
@@ -XXX,XX +XXX,XX @@ static void handle_arg_abi_call0(const char *arg)
  }
  #endif
 +static void handle_arg_perfmap(const char *arg)
 +{
 +    perf_enable_perfmap();
 +}
 +
 +static void handle_arg_jitdump(const char *arg)
 +{
 +    perf_enable_jitdump();
 +}
 +
  static QemuPluginList plugins = QTAILQ_HEAD_INITIALIZER(plugins);
  #ifdef CONFIG_PLUGIN
@@ -XXX,XX +XXX,XX @@ static const struct qemu_argument arg_table[] = {
      {"xtensa-abi-call0", "QEMU_XTENSA_ABI_CALL0", false, handle_arg_abi_call0,
       "",           "assume CALL0 Xtensa ABI"},
  #endif
 +    {"perfmap",    "QEMU_PERFMAP",     false, handle_arg_perfmap,
 +     "",           "Generate a /tmp/perf-${pid}.map file for perf"},
 +    {"jitdump",    "QEMU_JITDUMP",     false, handle_arg_jitdump,
 +     "",           "Generate a jit-${pid}.dump file for perf"},
      {NULL, NULL, false, NULL, NULL, NULL}
  };
 diff --git a/softmmu/vl.c b/softmmu/vl.c
 index XXXXXXX..XXXXXXX 100644
 --- a/softmmu/vl.c
 +++ b/softmmu/vl.c
@@ -XXX,XX +XXX,XX @@
  #include "fsdev/qemu-fsdev.h"
  #endif
  #include "sysemu/qtest.h"
 +#ifdef CONFIG_TCG
 +#include "accel/tcg/perf.h"
 +#endif
  #include "disas/disas.h"
@@ -XXX,XX +XXX,XX @@ void qemu_init(int argc, char **argv)
              case QEMU_OPTION_DFILTER:
                  qemu_set_dfilter_ranges(optarg, &error_fatal);
                  break;
 +#if defined(CONFIG_TCG) && defined(CONFIG_LINUX)
 +            case QEMU_OPTION_perfmap:
 +                perf_enable_perfmap();
 +                break;
 +            case QEMU_OPTION_jitdump:
 +                perf_enable_jitdump();
 +                break;
 +#endif
              case QEMU_OPTION_seed:
                  qemu_guest_random_seed_main(optarg, &error_fatal);
                  break;
 diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg.c
 +++ b/tcg/tcg.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ void tcg_func_start(TCGContext *s)
- #include "exec/log.h"
+     s->nb_temps = s->nb_globals;
- #include "tcg/tcg-ldst.h"
- #include "tcg-internal.h"
+     /* No temps have been previously allocated for size or locality.  */
-+#include "accel/tcg/perf.h"
+-    memset(s->free_temps, 0, sizeof(s->free_temps));
++    tcg_temp_ebb_reset_freed(s);
- /* Forward declarations for functions declared in tcg-target.c.inc and
-    used here. */
+     /* No constant temps have been previously allocated. */
-@@ -XXX,XX +XXX,XX @@ void tcg_prologue_init(TCGContext *s)
+     for (int i = 0; i < TCG_TYPE_COUNT; ++i) {
@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb, uint64_t pc_start)
      }
  #endif
-     prologue_size = tcg_current_code_size(s);
++    /* Do not reuse any EBB that may be allocated within the TB. */
-+    perf_report_prologue(s->code_gen_ptr, prologue_size);
++    tcg_temp_ebb_reset_freed(s);
  #ifndef CONFIG_TCG_INTERPRETER
      flush_idcache_range((uintptr_t)tcg_splitwx_to_rx(s->code_buf),
 diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/meson.build
 +++ b/accel/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ tcg_ss.add(when: 'CONFIG_USER_ONLY', if_true: files('user-exec.c'))
  tcg_ss.add(when: 'CONFIG_SOFTMMU', if_false: files('user-exec-stub.c'))
  tcg_ss.add(when: 'CONFIG_PLUGIN', if_true: [files('plugin-gen.c')])
  tcg_ss.add(when: libdw, if_true: files('debuginfo.c'))
 +tcg_ss.add(when: 'CONFIG_LINUX', if_true: files('perf.c'))
  specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_ss)
  specific_ss.add(when: ['CONFIG_SOFTMMU', 'CONFIG_TCG'], if_true: files(
 diff --git a/qemu-options.hx b/qemu-options.hx
 index XXXXXXX..XXXXXXX 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ SRST
      Enable synchronization profiling.
  ERST
 +#if defined(CONFIG_TCG) && defined(CONFIG_LINUX)
 +DEF("perfmap", 0, QEMU_OPTION_perfmap,
 +    "-perfmap        generate a /tmp/perf-${pid}.map file for perf\n",
 +    QEMU_ARCH_ALL)
 +SRST
 +``-perfmap``
 +    Generate a map file for Linux perf tools that will allow basic profiling
 +    information to be broken down into basic blocks.
 +ERST
 +
-+DEF("jitdump", 0, QEMU_OPTION_jitdump,
+     tcg_optimize(s);
-+    "-jitdump        generate a jit-${pid}.dump file for perf\n",
-+    QEMU_ARCH_ALL)
+     reachable_code_pass(s);
 +SRST
 +``-jitdump``
 +    Generate a dump file for Linux perf tools that maps basic blocks to symbol
 +    names, line numbers and JITted code.
 +ERST
 +#endif
 +
  DEFHEADING()
  DEFHEADING(Generic object creation:)
 --
-.34.1
+.43.0

-[PULL 4/5] util/bufferiszero: Use __attribute__((target)) for avx2/avx512
+[PULL 2/4] tcg/riscv: Fix StoreStore barrier generation
-Use the attribute, which is supported by clang, instead of
+From: Roman Artemev <roman.artemev@syntacore.com>
 the #pragma, which is not supported and, for some reason,
 also not detected by the meson probe, so we fail by -Werror.
-Include only <immintrin.h> as that is the outermost "official"
+On RISC-V to StoreStore barrier corresponds
-header for these intrinsics -- emmintrin.h and smmintrin -- are
+`fence w, w` not `fence r, r`
 older SSE2 and SSE4 specific headers, while the immintrin.h
 includes all of the Intel intrinsics.
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Cc: qemu-stable@nongnu.org
 Fixes: efbea94c76b ("tcg/riscv: Add slowpath load and store instructions")
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Denis Tomashev <denis.tomashev@syntacore.com>
 Signed-off-by: Roman Artemev <roman.artemev@syntacore.com>
 Message-ID: <e2f2131e294a49e79959d4fa9ec02cf4@syntacore.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- meson.build         |  8 ++------
+ tcg/riscv/tcg-target.c.inc | 2 +-
- util/bufferiszero.c | 41 ++++++-----------------------------------
+file changed, 1 insertion(+), 1 deletion(-)
 files changed, 8 insertions(+), 41 deletions(-)
-diff --git a/meson.build b/meson.build
+diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/meson.build
+--- a/tcg/riscv/tcg-target.c.inc
-+++ b/meson.build
++++ b/tcg/riscv/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ config_host_data.set('CONFIG_CPUID_H', have_cpuid_h)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_mb(TCGContext *s, TCGArg a0)
- config_host_data.set('CONFIG_AVX2_OPT', get_option('avx2') \
+         insn |= 0x02100000;
    .require(have_cpuid_h, error_message: 'cpuid.h not available, cannot enable AVX2') \
    .require(cc.links('''
 -    #pragma GCC push_options
 -    #pragma GCC target("avx2")
      #include <cpuid.h>
      #include <immintrin.h>
 -    static int bar(void *a) {
 +    static int __attribute__((target("avx2"))) bar(void *a) {
        __m256i x = *(__m256i *)a;
        return _mm256_testz_si256(x, x);
      }
-@@ -XXX,XX +XXX,XX @@ config_host_data.set('CONFIG_AVX2_OPT', get_option('avx2') \
+     if (a0 & TCG_MO_ST_ST) {
- config_host_data.set('CONFIG_AVX512F_OPT', get_option('avx512f') \
+-        insn |= 0x02200000;
-   .require(have_cpuid_h, error_message: 'cpuid.h not available, cannot enable AVX512F') \
++        insn |= 0x01100000;
    .require(cc.links('''
 -    #pragma GCC push_options
 -    #pragma GCC target("avx512f")
      #include <cpuid.h>
      #include <immintrin.h>
 -    static int bar(void *a) {
 +    static int __attribute__((target("avx512f"))) bar(void *a) {
        __m512i x = *(__m512i *)a;
        return _mm512_test_epi64_mask(x, x);
      }
-diff --git a/util/bufferiszero.c b/util/bufferiszero.c
+     tcg_out32(s, insn);
 index XXXXXXX..XXXXXXX 100644
 --- a/util/bufferiszero.c
 +++ b/util/bufferiszero.c
@@ -XXX,XX +XXX,XX @@ buffer_zero_int(const void *buf, size_t len)
  }
- #if defined(CONFIG_AVX512F_OPT) || defined(CONFIG_AVX2_OPT) || defined(__SSE2__)
--/* Do not use push_options pragmas unnecessarily, because clang
-- * does not support them.
-- */
--#if defined(CONFIG_AVX512F_OPT) || defined(CONFIG_AVX2_OPT)
--#pragma GCC push_options
--#pragma GCC target("sse2")
--#endif
--#include <emmintrin.h>
-+#include <immintrin.h>
- /* Note that each of these vectorized functions require len >= 64.  */
--static bool
-+static bool __attribute__((target("sse2")))
- buffer_zero_sse2(const void *buf, size_t len)
- {
-     __m128i t = _mm_loadu_si128(buf);
-@@ -XXX,XX +XXX,XX @@ buffer_zero_sse2(const void *buf, size_t len)
-     return _mm_movemask_epi8(_mm_cmpeq_epi8(t, zero)) == 0xFFFF;
- }
--#if defined(CONFIG_AVX512F_OPT) || defined(CONFIG_AVX2_OPT)
--#pragma GCC pop_options
--#endif
- #ifdef CONFIG_AVX2_OPT
--/* Note that due to restrictions/bugs wrt __builtin functions in gcc <= 4.8,
-- * the includes have to be within the corresponding push_options region, and
-- * therefore the regions themselves have to be ordered with increasing ISA.
-- */
--#pragma GCC push_options
--#pragma GCC target("sse4")
--#include <smmintrin.h>
--
--static bool
-+static bool __attribute__((target("sse4")))
- buffer_zero_sse4(const void *buf, size_t len)
- {
-     __m128i t = _mm_loadu_si128(buf);
-@@ -XXX,XX +XXX,XX @@ buffer_zero_sse4(const void *buf, size_t len)
-     return _mm_testz_si128(t, t);
- }
--#pragma GCC pop_options
--#pragma GCC push_options
--#pragma GCC target("avx2")
--#include <immintrin.h>
--
--static bool
-+static bool __attribute__((target("avx2")))
- buffer_zero_avx2(const void *buf, size_t len)
- {
-     /* Begin with an unaligned head of 32 bytes.  */
-@@ -XXX,XX +XXX,XX @@ buffer_zero_avx2(const void *buf, size_t len)
-     return _mm256_testz_si256(t, t);
- }
--#pragma GCC pop_options
- #endif /* CONFIG_AVX2_OPT */
- #ifdef CONFIG_AVX512F_OPT
--#pragma GCC push_options
--#pragma GCC target("avx512f")
--#include <immintrin.h>
--
--static bool
-+static bool __attribute__((target("avx512f")))
- buffer_zero_avx512(const void *buf, size_t len)
- {
-     /* Begin with an unaligned head of 64 bytes.  */
-@@ -XXX,XX +XXX,XX @@ buffer_zero_avx512(const void *buf, size_t len)
-     return !_mm512_test_epi64_mask(t, t);
- }
--#pragma GCC pop_options
--#endif
-+#endif /* CONFIG_AVX512F_OPT */
- /* Note that for test_buffer_is_zero_next_accel, the most preferred
 --
-.34.1
+.43.0

-[PULL 5/5] accel/tcg: Split out cpu_exec_{setjmp,loop}
+[PULL 3/4] include/exec: Introduce fpst alias in helper-head.h.inc
-Recently the g_assert(cpu == current_cpu) test has been
+This allows targets to declare that the helper requires a
-intermittently failing with gcc.  Reorg the code around
+float_status pointer and instead of a generic void pointer.
 the setjmp to minimize the lifetime of the cpu variable
 affected by the setjmp.
-This appears to fix the existing issue with clang as well.
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1147
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/cpu-exec.c | 111 +++++++++++++++++++++----------------------
+ include/exec/helper-head.h.inc | 3 +++
-file changed, 54 insertions(+), 57 deletions(-)
+file changed, 3 insertions(+)
-diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
+diff --git a/include/exec/helper-head.h.inc b/include/exec/helper-head.h.inc
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cpu-exec.c
+--- a/include/exec/helper-head.h.inc
-+++ b/accel/tcg/cpu-exec.c
++++ b/include/exec/helper-head.h.inc
-@@ -XXX,XX +XXX,XX @@ static inline void cpu_loop_exec_tb(CPUState *cpu, TranslationBlock *tb,
+@@ -XXX,XX +XXX,XX @@
+ #define dh_alias_ptr ptr
- /* main execution loop */
+ #define dh_alias_cptr ptr
+ #define dh_alias_env ptr
--int cpu_exec(CPUState *cpu)
++#define dh_alias_fpst ptr
-+static int __attribute__((noinline))
+ #define dh_alias_void void
-+cpu_exec_loop(CPUState *cpu, SyncClocks *sc)
+ #define dh_alias_noreturn noreturn
- {
+ #define dh_alias(t) glue(dh_alias_, t)
-     int ret;
+@@ -XXX,XX +XXX,XX @@
--    SyncClocks sc = { 0 };
+ #define dh_ctype_ptr void *
--
+ #define dh_ctype_cptr const void *
--    /* replay_interrupt may need current_cpu */
+ #define dh_ctype_env CPUArchState *
--    current_cpu = cpu;
++#define dh_ctype_fpst float_status *
--
+ #define dh_ctype_void void
--    if (cpu_handle_halt(cpu)) {
+ #define dh_ctype_noreturn G_NORETURN void
--        return EXCP_HALTED;
+ #define dh_ctype(t) dh_ctype_##t
--    }
+@@ -XXX,XX +XXX,XX @@
--
+ #define dh_typecode_f64 dh_typecode_i64
--    rcu_read_lock();
+ #define dh_typecode_cptr dh_typecode_ptr
--
+ #define dh_typecode_env dh_typecode_ptr
--    cpu_exec_enter(cpu);
++#define dh_typecode_fpst dh_typecode_ptr
--
+ #define dh_typecode(t) dh_typecode_##t
--    /* Calculate difference between guest clock and host clock.
--     * This delay includes the delay of the last cycle, so
+ #define dh_callflag_i32  0
 -     * what we have to do is sleep until it is 0. As for the
 -     * advance/delay we gain here, we try to fix it next time.
 -     */
 -    init_delay_params(&sc, cpu);
 -
 -    /* prepare setjmp context for exception handling */
 -    if (sigsetjmp(cpu->jmp_env, 0) != 0) {
 -#if defined(__clang__)
 -        /*
 -         * Some compilers wrongly smash all local variables after
 -         * siglongjmp (the spec requires that only non-volatile locals
 -         * which are changed between the sigsetjmp and siglongjmp are
 -         * permitted to be trashed). There were bug reports for gcc
 -         * 4.5.0 and clang.  The bug is fixed in all versions of gcc
 -         * that we support, but is still unfixed in clang:
 -         *   https://bugs.llvm.org/show_bug.cgi?id=21183
 -         *
 -         * Reload an essential local variable here for those compilers.
 -         * Newer versions of gcc would complain about this code (-Wclobbered),
 -         * so we only perform the workaround for clang.
 -         */
 -        cpu = current_cpu;
 -#else
 -        /* Non-buggy compilers preserve this; assert the correct value. */
 -        g_assert(cpu == current_cpu);
 -#endif
 -
 -#ifndef CONFIG_SOFTMMU
 -        clear_helper_retaddr();
 -        if (have_mmap_lock()) {
 -            mmap_unlock();
 -        }
 -#endif
 -        if (qemu_mutex_iothread_locked()) {
 -            qemu_mutex_unlock_iothread();
 -        }
 -        qemu_plugin_disable_mem_helpers(cpu);
 -
 -        assert_no_pages_locked();
 -    }
      /* if an exception is pending, we execute it here */
      while (!cpu_handle_exception(cpu, &ret)) {
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
              /* Try to align the host and virtual clocks
                 if the guest is in advance */
 -            align_clocks(&sc, cpu);
 +            align_clocks(sc, cpu);
          }
      }
 +    return ret;
 +}
 +
 +static int cpu_exec_setjmp(CPUState *cpu, SyncClocks *sc)
 +{
 +    /* Prepare setjmp context for exception handling. */
 +    if (unlikely(sigsetjmp(cpu->jmp_env, 0) != 0)) {
 +        /* Non-buggy compilers preserve this; assert the correct value. */
 +        g_assert(cpu == current_cpu);
 +
 +#ifndef CONFIG_SOFTMMU
 +        clear_helper_retaddr();
 +        if (have_mmap_lock()) {
 +            mmap_unlock();
 +        }
 +#endif
 +        if (qemu_mutex_iothread_locked()) {
 +            qemu_mutex_unlock_iothread();
 +        }
 +        qemu_plugin_disable_mem_helpers(cpu);
 +
 +        assert_no_pages_locked();
 +    }
 +
 +    return cpu_exec_loop(cpu, sc);
 +}
 +
 +int cpu_exec(CPUState *cpu)
 +{
 +    int ret;
 +    SyncClocks sc = { 0 };
 +
 +    /* replay_interrupt may need current_cpu */
 +    current_cpu = cpu;
 +
 +    if (cpu_handle_halt(cpu)) {
 +        return EXCP_HALTED;
 +    }
 +
 +    rcu_read_lock();
 +    cpu_exec_enter(cpu);
 +
 +    /*
 +     * Calculate difference between guest clock and host clock.
 +     * This delay includes the delay of the last cycle, so
 +     * what we have to do is sleep until it is 0. As for the
 +     * advance/delay we gain here, we try to fix it next time.
 +     */
 +    init_delay_params(&sc, cpu);
 +
 +    ret = cpu_exec_setjmp(cpu, &sc);
      cpu_exec_exit(cpu);
      rcu_read_unlock();
 --
-.34.1
+.43.0

-[PULL 1/5] linux-user: Clean up when exiting due to a signal
+[PULL 4/4] target/sparc: Use memcpy() and remove memcpy32()
-From: Ilya Leoshkevich <iii@linux.ibm.com>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-When exiting due to an exit() syscall, qemu-user calls
+Rather than manually copying each register, use
-preexit_cleanup(), but this is currently not the case when exiting due
+the libc memcpy(), which is well optimized nowadays.
 to a signal. This leads to various buffers not being flushed (e.g.,
 for gprof, for gcov, and for the upcoming perf support).
-Add the missing call.
+Suggested-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <20230112152013.125680-2-iii@linux.ibm.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-ID: <20241205205418.67613-1-philmd@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- linux-user/signal.c | 8 +++++---
+ target/sparc/win_helper.c | 26 ++++++++------------------
-file changed, 5 insertions(+), 3 deletions(-)
+file changed, 8 insertions(+), 18 deletions(-)
-diff --git a/linux-user/signal.c b/linux-user/signal.c
+diff --git a/target/sparc/win_helper.c b/target/sparc/win_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/linux-user/signal.c
+--- a/target/sparc/win_helper.c
-+++ b/linux-user/signal.c
++++ b/target/sparc/win_helper.c
-@@ -XXX,XX +XXX,XX @@ void cpu_loop_exit_sigbus(CPUState *cpu, target_ulong addr,
+@@ -XXX,XX +XXX,XX @@
+ #include "exec/helper-proto.h"
- /* abort execution with signal */
+ #include "trace.h"
- static G_NORETURN
--void dump_core_and_abort(int target_sig)
+-static inline void memcpy32(target_ulong *dst, const target_ulong *src)
-+void dump_core_and_abort(CPUArchState *cpu_env, int target_sig)
+-{
 -    dst[0] = src[0];
 -    dst[1] = src[1];
 -    dst[2] = src[2];
 -    dst[3] = src[3];
 -    dst[4] = src[4];
 -    dst[5] = src[5];
 -    dst[6] = src[6];
 -    dst[7] = src[7];
 -}
 -
  void cpu_set_cwp(CPUSPARCState *env, int new_cwp)
  {
-     CPUState *cpu = thread_cpu;
+     /* put the modified wrap registers at their proper location */
-     CPUArchState *env = cpu->env_ptr;
+     if (env->cwp == env->nwindows - 1) {
-@@ -XXX,XX +XXX,XX @@ void dump_core_and_abort(int target_sig)
+-        memcpy32(env->regbase, env->regbase + env->nwindows * 16);
-             target_sig, strsignal(host_sig), "core dumped" );
++        memcpy(env->regbase, env->regbase + env->nwindows * 16,
 +               sizeof(env->gregs));
      }
+     env->cwp = new_cwp;
-+    preexit_cleanup(cpu_env, 128 + target_sig);
-+
+     /* put the wrap registers at their temporary location */
-     /* The proper exit code for dying from an uncaught signal is
+     if (new_cwp == env->nwindows - 1) {
-      * -<signal>.  The kernel doesn't allow exit() or _exit() to pass
+-        memcpy32(env->regbase + env->nwindows * 16, env->regbase);
-      * a negative value.  To get the proper exit code we need to
++        memcpy(env->regbase + env->nwindows * 16, env->regbase,
-@@ -XXX,XX +XXX,XX @@ static void handle_pending_signal(CPUArchState *cpu_env, int sig,
++               sizeof(env->gregs));
-                    sig != TARGET_SIGURG &&
+     }
-                    sig != TARGET_SIGWINCH &&
+     env->regwptr = env->regbase + (new_cwp * 16);
-                    sig != TARGET_SIGCONT) {
+ }
--            dump_core_and_abort(sig);
+@@ -XXX,XX +XXX,XX @@ void cpu_gl_switch_gregs(CPUSPARCState *env, uint32_t new_gl)
-+            dump_core_and_abort(cpu_env, sig);
+     dst = get_gl_gregset(env, env->gl);
-         }
-     } else if (handler == TARGET_SIG_IGN) {
+     if (src != dst) {
-         /* ignore sig */
+-        memcpy32(dst, env->gregs);
-     } else if (handler == TARGET_SIG_ERR) {
+-        memcpy32(env->gregs, src);
--        dump_core_and_abort(sig);
++        memcpy(dst, env->gregs, sizeof(env->gregs));
-+        dump_core_and_abort(cpu_env, sig);
++        memcpy(env->gregs, src, sizeof(env->gregs));
      }
  }
@@ -XXX,XX +XXX,XX @@ void cpu_change_pstate(CPUSPARCState *env, uint32_t new_pstate)
          /* Switch global register bank */
          src = get_gregset(env, new_pstate_regs);
          dst = get_gregset(env, pstate_regs);
 -        memcpy32(dst, env->gregs);
 -        memcpy32(env->gregs, src);
 +        memcpy(dst, env->gregs, sizeof(env->gregs));
 +        memcpy(env->gregs, src, sizeof(env->gregs));
      } else {
-         /* compute the blocked signals during the handler execution */
+         trace_win_helper_no_switch_pstate(new_pstate_regs);
-         sigset_t *blocked_set;
+     }
 --
-.34.1
+.43.0

-[PULL 2/5] accel/tcg: Add debuginfo support
+Deleted patch
-From: Ilya Leoshkevich <iii@linux.ibm.com>
-Add libdw-based functions for loading and querying debuginfo. Load
-debuginfo from the system and the linux-user loaders.
-This is useful for the upcoming perf support, which can then put
-human-readable guest symbols instead of raw guest PCs into perfmap and
-jitdump files.
-Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Message-Id: <20230112152013.125680-3-iii@linux.ibm.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- meson.build            |  8 ++++
- accel/tcg/debuginfo.h  | 77 +++++++++++++++++++++++++++++++++
- accel/tcg/debuginfo.c  | 96 ++++++++++++++++++++++++++++++++++++++++++
- hw/core/loader.c       |  5 +++
- linux-user/elfload.c   |  3 ++
- accel/tcg/meson.build  |  1 +
- linux-user/meson.build |  1 +
-files changed, 191 insertions(+)
- create mode 100644 accel/tcg/debuginfo.h
- create mode 100644 accel/tcg/debuginfo.c
-diff --git a/meson.build b/meson.build
-index XXXXXXX..XXXXXXX 100644
---- a/meson.build
-+++ b/meson.build
-@@ -XXX,XX +XXX,XX @@ if libbpf.found() and not cc.links('''
-   endif
- endif
-+# libdw
-+libdw = dependency('libdw',
-+                   method: 'pkg-config',
-+                   kwargs: static_kwargs,
-+                   required: false)
-+
- #################
- # config-host.h #
- #################
-@@ -XXX,XX +XXX,XX @@ config_host_data.set('CONFIG_DBUS_DISPLAY', dbus_display)
- config_host_data.set('CONFIG_CFI', get_option('cfi'))
- config_host_data.set('CONFIG_SELINUX', selinux.found())
- config_host_data.set('CONFIG_XEN_BACKEND', xen.found())
-+config_host_data.set('CONFIG_LIBDW', libdw.found())
- if xen.found()
-   # protect from xen.version() having less than three components
-   xen_version = xen.version().split('.') + ['0', '0']
-@@ -XXX,XX +XXX,XX @@ summary_info += {'libudev':           libudev}
- # Dummy dependency, keep .found()
- summary_info += {'FUSE lseek':        fuse_lseek.found()}
- summary_info += {'selinux':           selinux}
-+summary_info += {'libdw':             libdw}
- summary(summary_info, bool_yn: true, section: 'Dependencies')
- if not supported_cpus.contains(cpu)
-diff --git a/accel/tcg/debuginfo.h b/accel/tcg/debuginfo.h
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/accel/tcg/debuginfo.h
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * Debug information support.
-+ *
-+ * SPDX-License-Identifier: GPL-2.0-or-later
-+ */
-+
-+#ifndef ACCEL_TCG_DEBUGINFO_H
-+#define ACCEL_TCG_DEBUGINFO_H
-+
-+/*
-+ * Debuginfo describing a certain address.
-+ */
-+struct debuginfo_query {
-+    uint64_t address;    /* Input: address. */
-+    int flags;           /* Input: debuginfo subset. */
-+    const char *symbol;  /* Symbol that the address is part of. */
-+    uint64_t offset;     /* Offset from the symbol. */
-+    const char *file;    /* Source file associated with the address. */
-+    int line;            /* Line number in the source file. */
-+};
-+
-+/*
-+ * Debuginfo subsets.
-+ */
-+#define DEBUGINFO_SYMBOL BIT(1)
-+#define DEBUGINFO_LINE   BIT(2)
-+
-+#if defined(CONFIG_TCG) && defined(CONFIG_LIBDW)
-+/*
-+ * Load debuginfo for the specified guest ELF image.
-+ * Return true on success, false on failure.
-+ */
-+void debuginfo_report_elf(const char *name, int fd, uint64_t bias);
-+
-+/*
-+ * Take the debuginfo lock.
-+ */
-+void debuginfo_lock(void);
-+
-+/*
-+ * Fill each on N Qs with the debuginfo about Q->ADDRESS as specified by
-+ * Q->FLAGS:
-+ *
-+ * - DEBUGINFO_SYMBOL: update Q->SYMBOL and Q->OFFSET. If symbol debuginfo is
-+ *                     missing, then leave them as is.
-+ * - DEBUINFO_LINE: update Q->FILE and Q->LINE. If line debuginfo is missing,
-+ *                  then leave them as is.
-+ *
-+ * This function must be called under the debuginfo lock. The results can be
-+ * accessed only until the debuginfo lock is released.
-+ */
-+void debuginfo_query(struct debuginfo_query *q, size_t n);
-+
-+/*
-+ * Release the debuginfo lock.
-+ */
-+void debuginfo_unlock(void);
-+#else
-+static inline void debuginfo_report_elf(const char *image_name, int image_fd,
-+                                        uint64_t load_bias)
-+{
-+}
-+
-+static inline void debuginfo_lock(void)
-+{
-+}
-+
-+static inline void debuginfo_query(struct debuginfo_query *q, size_t n)
-+{
-+}
-+
-+static inline void debuginfo_unlock(void)
-+{
-+}
-+#endif
-+
-+#endif
-diff --git a/accel/tcg/debuginfo.c b/accel/tcg/debuginfo.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/accel/tcg/debuginfo.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * Debug information support.
-+ *
-+ * SPDX-License-Identifier: GPL-2.0-or-later
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "qemu/lockable.h"
-+
-+#include <elfutils/libdwfl.h>
-+
-+#include "debuginfo.h"
-+
-+static QemuMutex lock;
-+static Dwfl *dwfl;
-+static const Dwfl_Callbacks dwfl_callbacks = {
-+    .find_elf = NULL,
-+    .find_debuginfo = dwfl_standard_find_debuginfo,
-+    .section_address = NULL,
-+    .debuginfo_path = NULL,
-+};
-+
-+__attribute__((constructor))
-+static void debuginfo_init(void)
-+{
-+    qemu_mutex_init(&lock);
-+}
-+
-+void debuginfo_report_elf(const char *name, int fd, uint64_t bias)
-+{
-+    QEMU_LOCK_GUARD(&lock);
-+
-+    if (dwfl) {
-+        dwfl_report_begin_add(dwfl);
-+    } else {
-+        dwfl = dwfl_begin(&dwfl_callbacks);
-+    }
-+
-+    if (dwfl) {
-+        dwfl_report_elf(dwfl, name, name, fd, bias, true);
-+        dwfl_report_end(dwfl, NULL, NULL);
-+    }
-+}
-+
-+void debuginfo_lock(void)
-+{
-+    qemu_mutex_lock(&lock);
-+}
-+
-+void debuginfo_query(struct debuginfo_query *q, size_t n)
-+{
-+    const char *symbol, *file;
-+    Dwfl_Module *dwfl_module;
-+    Dwfl_Line *dwfl_line;
-+    GElf_Off dwfl_offset;
-+    GElf_Sym dwfl_sym;
-+    size_t i;
-+    int line;
-+
-+    if (!dwfl) {
-+        return;
-+    }
-+
-+    for (i = 0; i < n; i++) {
-+        dwfl_module = dwfl_addrmodule(dwfl, q[i].address);
-+        if (!dwfl_module) {
-+            continue;
-+        }
-+
-+        if (q[i].flags & DEBUGINFO_SYMBOL) {
-+            symbol = dwfl_module_addrinfo(dwfl_module, q[i].address,
-+                                          &dwfl_offset, &dwfl_sym,
-+                                          NULL, NULL, NULL);
-+            if (symbol) {
-+                q[i].symbol = symbol;
-+                q[i].offset = dwfl_offset;
-+            }
-+        }
-+
-+        if (q[i].flags & DEBUGINFO_LINE) {
-+            dwfl_line = dwfl_module_getsrc(dwfl_module, q[i].address);
-+            if (dwfl_line) {
-+                file = dwfl_lineinfo(dwfl_line, NULL, &line, 0, NULL, NULL);
-+                if (file) {
-+                    q[i].file = file;
-+                    q[i].line = line;
-+                }
-+            }
-+        }
-+    }
-+}
-+
-+void debuginfo_unlock(void)
-+{
-+    qemu_mutex_unlock(&lock);
-+}
-diff --git a/hw/core/loader.c b/hw/core/loader.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/core/loader.c
-+++ b/hw/core/loader.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/boards.h"
- #include "qemu/cutils.h"
- #include "sysemu/runstate.h"
-+#include "accel/tcg/debuginfo.h"
- #include <zlib.h>
-@@ -XXX,XX +XXX,XX @@ ssize_t load_elf_ram_sym(const char *filename,
-                          clear_lsb, data_swab, as, load_rom, sym_cb);
-     }
-+    if (ret != ELF_LOAD_FAILED) {
-+        debuginfo_report_elf(filename, fd, 0);
-+    }
-+
-  fail:
-     close(fd);
-     return ret;
-diff --git a/linux-user/elfload.c b/linux-user/elfload.c
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/elfload.c
-+++ b/linux-user/elfload.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/selfmap.h"
- #include "qapi/error.h"
- #include "target_signal.h"
-+#include "accel/tcg/debuginfo.h"
- #ifdef _ARCH_PPC64
- #undef ARCH_DLINFO
-@@ -XXX,XX +XXX,XX @@ static void load_elf_image(const char *image_name, int image_fd,
-         load_symbols(ehdr, image_fd, load_bias);
-     }
-+    debuginfo_report_elf(image_name, image_fd, load_bias);
-+
-     mmap_unlock();
-     close(image_fd);
-diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/meson.build
-+++ b/accel/tcg/meson.build
-@@ -XXX,XX +XXX,XX @@ tcg_ss.add(files(
- tcg_ss.add(when: 'CONFIG_USER_ONLY', if_true: files('user-exec.c'))
- tcg_ss.add(when: 'CONFIG_SOFTMMU', if_false: files('user-exec-stub.c'))
- tcg_ss.add(when: 'CONFIG_PLUGIN', if_true: [files('plugin-gen.c')])
-+tcg_ss.add(when: libdw, if_true: files('debuginfo.c'))
- specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_ss)
- specific_ss.add(when: ['CONFIG_SOFTMMU', 'CONFIG_TCG'], if_true: files(
-diff --git a/linux-user/meson.build b/linux-user/meson.build
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/meson.build
-+++ b/linux-user/meson.build
-@@ -XXX,XX +XXX,XX @@ linux_user_ss.add(files(
-   'uname.c',
- ))
- linux_user_ss.add(rt)
-+linux_user_ss.add(libdw)
- linux_user_ss.add(when: 'TARGET_HAS_BFLT', if_true: files('flatload.c'))
- linux_user_ss.add(when: 'TARGET_I386', if_true: files('vm86.c'))
---
-.34.1

The following changes since commit fb7e7990342e59cf67dbd895c1a1e3fb1741df7a:

tests/qtest/qom-test: Do not print tested properties by default (2023-01-16 15:00:57 +0000)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20230116

for you to fetch changes up to 61710a7e23a63546da0071ea32adb96476fa5d07:

accel/tcg: Split out cpu_exec_{setjmp,loop} (2023-01-16 10:14:12 -1000)

----------------------------------------------------------------
- Reorg cpu_tb_exec around setjmp.
- Use __attribute__((target)) for buffer_is_zero.
- Add perfmap and jitdump for perf support.

----------------------------------------------------------------
Ilya Leoshkevich (3):
      linux-user: Clean up when exiting due to a signal
      accel/tcg: Add debuginfo support
      tcg: add perfmap and jitdump

Richard Henderson (2):
      util/bufferiszero: Use __attribute__((target)) for avx2/avx512
      accel/tcg: Split out cpu_exec_{setjmp,loop}

From: Ilya Leoshkevich <iii@linux.ibm.com>

When exiting due to an exit() syscall, qemu-user calls
preexit_cleanup(), but this is currently not the case when exiting due
to a signal. This leads to various buffers not being flushed (e.g.,
for gprof, for gcov, and for the upcoming perf support).

Add the missing call.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230112152013.125680-2-iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/signal.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/linux-user/signal.c b/linux-user/signal.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -XXX,XX +XXX,XX @@ void cpu_loop_exit_sigbus(CPUState *cpu, target_ulong addr,
 
 /* abort execution with signal */
 static G_NORETURN
-void dump_core_and_abort(int target_sig)
+void dump_core_and_abort(CPUArchState *cpu_env, int target_sig)
 {
     CPUState *cpu = thread_cpu;
     CPUArchState *env = cpu->env_ptr;
@@ -XXX,XX +XXX,XX @@ void dump_core_and_abort(int target_sig)
             target_sig, strsignal(host_sig), "core dumped" );
     }
 
+    preexit_cleanup(cpu_env, 128 + target_sig);
+
     /* The proper exit code for dying from an uncaught signal is
      * -<signal>.  The kernel doesn't allow exit() or _exit() to pass
      * a negative value.  To get the proper exit code we need to
@@ -XXX,XX +XXX,XX @@ static void handle_pending_signal(CPUArchState *cpu_env, int sig,
                    sig != TARGET_SIGURG &&
                    sig != TARGET_SIGWINCH &&
                    sig != TARGET_SIGCONT) {
-            dump_core_and_abort(sig);
+            dump_core_and_abort(cpu_env, sig);
         }
     } else if (handler == TARGET_SIG_IGN) {
         /* ignore sig */
     } else if (handler == TARGET_SIG_ERR) {
-        dump_core_and_abort(sig);
+        dump_core_and_abort(cpu_env, sig);
     } else {
         /* compute the blocked signals during the handler execution */
         sigset_t *blocked_set;
-- 
2.34.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

Add libdw-based functions for loading and querying debuginfo. Load
debuginfo from the system and the linux-user loaders.

This is useful for the upcoming perf support, which can then put
human-readable guest symbols instead of raw guest PCs into perfmap and
jitdump files.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230112152013.125680-3-iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 meson.build            |  8 ++++
 accel/tcg/debuginfo.h  | 77 +++++++++++++++++++++++++++++++++
 accel/tcg/debuginfo.c  | 96 ++++++++++++++++++++++++++++++++++++++++++
 hw/core/loader.c       |  5 +++
 linux-user/elfload.c   |  3 ++
 accel/tcg/meson.build  |  1 +
 linux-user/meson.build |  1 +
 7 files changed, 191 insertions(+)
 create mode 100644 accel/tcg/debuginfo.h
 create mode 100644 accel/tcg/debuginfo.c

diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ if libbpf.found() and not cc.links('''
   endif
 endif
 
+# libdw
+libdw = dependency('libdw',
+                   method: 'pkg-config',
+                   kwargs: static_kwargs,
+                   required: false)
+
 #################
 # config-host.h #
 #################
@@ -XXX,XX +XXX,XX @@ config_host_data.set('CONFIG_DBUS_DISPLAY', dbus_display)
 config_host_data.set('CONFIG_CFI', get_option('cfi'))
 config_host_data.set('CONFIG_SELINUX', selinux.found())
 config_host_data.set('CONFIG_XEN_BACKEND', xen.found())
+config_host_data.set('CONFIG_LIBDW', libdw.found())
 if xen.found()
   # protect from xen.version() having less than three components
   xen_version = xen.version().split('.') + ['0', '0']
@@ -XXX,XX +XXX,XX @@ summary_info += {'libudev':           libudev}
 # Dummy dependency, keep .found()
 summary_info += {'FUSE lseek':        fuse_lseek.found()}
 summary_info += {'selinux':           selinux}
+summary_info += {'libdw':             libdw}
 summary(summary_info, bool_yn: true, section: 'Dependencies')
 
 if not supported_cpus.contains(cpu)
diff --git a/accel/tcg/debuginfo.h b/accel/tcg/debuginfo.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/accel/tcg/debuginfo.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Debug information support.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef ACCEL_TCG_DEBUGINFO_H
+#define ACCEL_TCG_DEBUGINFO_H
+
+/*
+ * Debuginfo describing a certain address.
+ */
+struct debuginfo_query {
+    uint64_t address;    /* Input: address. */
+    int flags;           /* Input: debuginfo subset. */
+    const char *symbol;  /* Symbol that the address is part of. */
+    uint64_t offset;     /* Offset from the symbol. */
+    const char *file;    /* Source file associated with the address. */
+    int line;            /* Line number in the source file. */
+};
+
+/*
+ * Debuginfo subsets.
+ */
+#define DEBUGINFO_SYMBOL BIT(1)
+#define DEBUGINFO_LINE   BIT(2)
+
+#if defined(CONFIG_TCG) && defined(CONFIG_LIBDW)
+/*
+ * Load debuginfo for the specified guest ELF image.
+ * Return true on success, false on failure.
+ */
+void debuginfo_report_elf(const char *name, int fd, uint64_t bias);
+
+/*
+ * Take the debuginfo lock.
+ */
+void debuginfo_lock(void);
+
+/*
+ * Fill each on N Qs with the debuginfo about Q->ADDRESS as specified by
+ * Q->FLAGS:
+ *
+ * - DEBUGINFO_SYMBOL: update Q->SYMBOL and Q->OFFSET. If symbol debuginfo is
+ *                     missing, then leave them as is.
+ * - DEBUINFO_LINE: update Q->FILE and Q->LINE. If line debuginfo is missing,
+ *                  then leave them as is.
+ *
+ * This function must be called under the debuginfo lock. The results can be
+ * accessed only until the debuginfo lock is released.
+ */
+void debuginfo_query(struct debuginfo_query *q, size_t n);
+
+/*
+ * Release the debuginfo lock.
+ */
+void debuginfo_unlock(void);
+#else
+static inline void debuginfo_report_elf(const char *image_name, int image_fd,
+                                        uint64_t load_bias)
+{
+}
+
+static inline void debuginfo_lock(void)
+{
+}
+
+static inline void debuginfo_query(struct debuginfo_query *q, size_t n)
+{
+}
+
+static inline void debuginfo_unlock(void)
+{
+}
+#endif
+
+#endif
diff --git a/accel/tcg/debuginfo.c b/accel/tcg/debuginfo.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/accel/tcg/debuginfo.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Debug information support.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/lockable.h"
+
+#include <elfutils/libdwfl.h>
+
+#include "debuginfo.h"
+
+static QemuMutex lock;
+static Dwfl *dwfl;
+static const Dwfl_Callbacks dwfl_callbacks = {
+    .find_elf = NULL,
+    .find_debuginfo = dwfl_standard_find_debuginfo,
+    .section_address = NULL,
+    .debuginfo_path = NULL,
+};
+
+__attribute__((constructor))
+static void debuginfo_init(void)
+{
+    qemu_mutex_init(&lock);
+}
+
+void debuginfo_report_elf(const char *name, int fd, uint64_t bias)
+{
+    QEMU_LOCK_GUARD(&lock);
+
+    if (dwfl) {
+        dwfl_report_begin_add(dwfl);
+    } else {
+        dwfl = dwfl_begin(&dwfl_callbacks);
+    }
+
+    if (dwfl) {
+        dwfl_report_elf(dwfl, name, name, fd, bias, true);
+        dwfl_report_end(dwfl, NULL, NULL);
+    }
+}
+
+void debuginfo_lock(void)
+{
+    qemu_mutex_lock(&lock);
+}
+
+void debuginfo_query(struct debuginfo_query *q, size_t n)
+{
+    const char *symbol, *file;
+    Dwfl_Module *dwfl_module;
+    Dwfl_Line *dwfl_line;
+    GElf_Off dwfl_offset;
+    GElf_Sym dwfl_sym;
+    size_t i;
+    int line;
+
+    if (!dwfl) {
+        return;
+    }
+
+    for (i = 0; i < n; i++) {
+        dwfl_module = dwfl_addrmodule(dwfl, q[i].address);
+        if (!dwfl_module) {
+            continue;
+        }
+
+        if (q[i].flags & DEBUGINFO_SYMBOL) {
+            symbol = dwfl_module_addrinfo(dwfl_module, q[i].address,
+                                          &dwfl_offset, &dwfl_sym,
+                                          NULL, NULL, NULL);
+            if (symbol) {
+                q[i].symbol = symbol;
+                q[i].offset = dwfl_offset;
+            }
+        }
+
+        if (q[i].flags & DEBUGINFO_LINE) {
+            dwfl_line = dwfl_module_getsrc(dwfl_module, q[i].address);
+            if (dwfl_line) {
+                file = dwfl_lineinfo(dwfl_line, NULL, &line, 0, NULL, NULL);
+                if (file) {
+                    q[i].file = file;
+                    q[i].line = line;
+                }
+            }
+        }
+    }
+}
+
+void debuginfo_unlock(void)
+{
+    qemu_mutex_unlock(&lock);
+}
diff --git a/hw/core/loader.c b/hw/core/loader.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/loader.c
+++ b/hw/core/loader.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #include "qemu/cutils.h"
 #include "sysemu/runstate.h"
+#include "accel/tcg/debuginfo.h"
 
 #include <zlib.h>
 
@@ -XXX,XX +XXX,XX @@ ssize_t load_elf_ram_sym(const char *filename,
                          clear_lsb, data_swab, as, load_rom, sym_cb);
     }
 
+    if (ret != ELF_LOAD_FAILED) {
+        debuginfo_report_elf(filename, fd, 0);
+    }
+
  fail:
     close(fd);
     return ret;
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/selfmap.h"
 #include "qapi/error.h"
 #include "target_signal.h"
+#include "accel/tcg/debuginfo.h"
 
 #ifdef _ARCH_PPC64
 #undef ARCH_DLINFO
@@ -XXX,XX +XXX,XX @@ static void load_elf_image(const char *image_name, int image_fd,
         load_symbols(ehdr, image_fd, load_bias);
     }
 
+    debuginfo_report_elf(image_name, image_fd, load_bias);
+
     mmap_unlock();
 
     close(image_fd);
diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/meson.build
+++ b/accel/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ tcg_ss.add(files(
 tcg_ss.add(when: 'CONFIG_USER_ONLY', if_true: files('user-exec.c'))
 tcg_ss.add(when: 'CONFIG_SOFTMMU', if_false: files('user-exec-stub.c'))
 tcg_ss.add(when: 'CONFIG_PLUGIN', if_true: [files('plugin-gen.c')])
+tcg_ss.add(when: libdw, if_true: files('debuginfo.c'))
 specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_ss)
 
 specific_ss.add(when: ['CONFIG_SOFTMMU', 'CONFIG_TCG'], if_true: files(
diff --git a/linux-user/meson.build b/linux-user/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/meson.build
+++ b/linux-user/meson.build
@@ -XXX,XX +XXX,XX @@ linux_user_ss.add(files(
   'uname.c',
 ))
 linux_user_ss.add(rt)
+linux_user_ss.add(libdw)
 
 linux_user_ss.add(when: 'TARGET_HAS_BFLT', if_true: files('flatload.c'))
 linux_user_ss.add(when: 'TARGET_I386', if_true: files('vm86.c'))
-- 
2.34.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

Add ability to dump /tmp/perf-<pid>.map and jit-<pid>.dump.
The first one allows the perf tool to map samples to each individual
translation block. The second one adds the ability to resolve symbol
names, line numbers and inspect JITed code.

Example of use:

perf record qemu-x86_64 -perfmap ./a.out
    perf report

perf record -k 1 qemu-x86_64 -jitdump ./a.out
    DEBUGINFOD_URLS= perf inject -j -i perf.data -o perf.data.jitted
    perf report -i perf.data.jitted

Co-developed-by: Vanderson M. do Rosario <vandersonmr2@gmail.com>
Co-developed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230112152013.125680-4-iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg.rst        |  23 +++
 accel/tcg/perf.h          |  49 +++++
 accel/tcg/perf.c          | 375 ++++++++++++++++++++++++++++++++++++++
 accel/tcg/translate-all.c |   7 +
 linux-user/exit.c         |   2 +
 linux-user/main.c         |  15 ++
 softmmu/vl.c              |  11 ++
 tcg/tcg.c                 |   2 +
 accel/tcg/meson.build     |   1 +
 qemu-options.hx           |  20 ++
 10 files changed, 505 insertions(+)
 create mode 100644 accel/tcg/perf.h
 create mode 100644 accel/tcg/perf.c

diff --git a/docs/devel/tcg.rst b/docs/devel/tcg.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/devel/tcg.rst
+++ b/docs/devel/tcg.rst
@@ -XXX,XX +XXX,XX @@ memory areas instead calls out to C code for device emulation.
 Finally, the MMU helps tracking dirty pages and pages pointed to by
 translation blocks.
 
+Profiling JITted code
+---------------------
+
+The Linux ``perf`` tool will treat all JITted code as a single block as
+unlike the main code it can't use debug information to link individual
+program counter samples with larger functions. To overcome this
+limitation you can use the ``-perfmap`` or the ``-jitdump`` option to generate
+map files. ``-perfmap`` is lightweight and produces only guest-host mappings.
+``-jitdump`` additionally saves JITed code and guest debug information (if
+available); its output needs to be integrated with the ``perf.data`` file
+before the final report can be viewed.
+
+.. code::
+
+  perf record $QEMU -perfmap $REMAINING_ARGS
+  perf report
+
+  perf record -k 1 $QEMU -jitdump $REMAINING_ARGS
+  DEBUGINFOD_URLS= perf inject -j -i perf.data -o perf.data.jitted
+  perf report -i perf.data.jitted
+
+Note that qemu-system generates mappings only for ``-kernel`` files in ELF
+format.
diff --git a/accel/tcg/perf.h b/accel/tcg/perf.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/accel/tcg/perf.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Linux perf perf-<pid>.map and jit-<pid>.dump integration.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef ACCEL_TCG_PERF_H
+#define ACCEL_TCG_PERF_H
+
+#if defined(CONFIG_TCG) && defined(CONFIG_LINUX)
+/* Start writing perf-<pid>.map. */
+void perf_enable_perfmap(void);
+
+/* Start writing jit-<pid>.dump. */
+void perf_enable_jitdump(void);
+
+/* Add information about TCG prologue to profiler maps. */
+void perf_report_prologue(const void *start, size_t size);
+
+/* Add information about JITted guest code to profiler maps. */
+void perf_report_code(uint64_t guest_pc, TranslationBlock *tb,
+                      const void *start);
+
+/* Stop writing perf-<pid>.map and/or jit-<pid>.dump. */
+void perf_exit(void);
+#else
+static inline void perf_enable_perfmap(void)
+{
+}
+
+static inline void perf_enable_jitdump(void)
+{
+}
+
+static inline void perf_report_prologue(const void *start, size_t size)
+{
+}
+
+static inline void perf_report_code(uint64_t guest_pc, TranslationBlock *tb,
+                                    const void *start)
+{
+}
+
+static inline void perf_exit(void)
+{
+}
+#endif
+
+#endif
diff --git a/accel/tcg/perf.c b/accel/tcg/perf.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/accel/tcg/perf.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Linux perf perf-<pid>.map and jit-<pid>.dump integration.
+ *
+ * The jitdump spec can be found at [1].
+ *
+ * [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/plain/tools/perf/Documentation/jitdump-specification.txt
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "elf.h"
+#include "exec/exec-all.h"
+#include "qemu/timer.h"
+#include "tcg/tcg.h"
+
+#include "debuginfo.h"
+#include "perf.h"
+
+static FILE *safe_fopen_w(const char *path)
+{
+    int saved_errno;
+    FILE *f;
+    int fd;
+
+    /* Delete the old file, if any. */
+    unlink(path);
+
+    /* Avoid symlink attacks by using O_CREAT | O_EXCL. */
+    fd = open(path, O_RDWR | O_CREAT | O_EXCL, S_IRUSR | S_IWUSR);
+    if (fd == -1) {
+        return NULL;
+    }
+
+    /* Convert fd to FILE*. */
+    f = fdopen(fd, "w");
+    if (f == NULL) {
+        saved_errno = errno;
+        close(fd);
+        errno = saved_errno;
+        return NULL;
+    }
+
+    return f;
+}
+
+static FILE *perfmap;
+
+void perf_enable_perfmap(void)
+{
+    char map_file[32];
+
+    snprintf(map_file, sizeof(map_file), "/tmp/perf-%d.map", getpid());
+    perfmap = safe_fopen_w(map_file);
+    if (perfmap == NULL) {
+        warn_report("Could not open %s: %s, proceeding without perfmap",
+                    map_file, strerror(errno));
+    }
+}
+
+/* Get PC and size of code JITed for guest instruction #INSN. */
+static void get_host_pc_size(uintptr_t *host_pc, uint16_t *host_size,
+                             const void *start, size_t insn)
+{
+    uint16_t start_off = insn ? tcg_ctx->gen_insn_end_off[insn - 1] : 0;
+
+    if (host_pc) {
+        *host_pc = (uintptr_t)start + start_off;
+    }
+    if (host_size) {
+        *host_size = tcg_ctx->gen_insn_end_off[insn] - start_off;
+    }
+}
+
+static const char *pretty_symbol(const struct debuginfo_query *q, size_t *len)
+{
+    static __thread char buf[64];
+    int tmp;
+
+    if (!q->symbol) {
+        tmp = snprintf(buf, sizeof(buf), "guest-0x%"PRIx64, q->address);
+        if (len) {
+            *len = MIN(tmp + 1, sizeof(buf));
+        }
+        return buf;
+    }
+
+    if (!q->offset) {
+        if (len) {
+            *len = strlen(q->symbol) + 1;
+        }
+        return q->symbol;
+    }
+
+    tmp = snprintf(buf, sizeof(buf), "%s+0x%"PRIx64, q->symbol, q->offset);
+    if (len) {
+        *len = MIN(tmp + 1, sizeof(buf));
+    }
+    return buf;
+}
+
+static void write_perfmap_entry(const void *start, size_t insn,
+                                const struct debuginfo_query *q)
+{
+    uint16_t host_size;
+    uintptr_t host_pc;
+
+    get_host_pc_size(&host_pc, &host_size, start, insn);
+    fprintf(perfmap, "%"PRIxPTR" %"PRIx16" %s\n",
+            host_pc, host_size, pretty_symbol(q, NULL));
+}
+
+static FILE *jitdump;
+
+#define JITHEADER_MAGIC 0x4A695444
+#define JITHEADER_VERSION 1
+
+struct jitheader {
+    uint32_t magic;
+    uint32_t version;
+    uint32_t total_size;
+    uint32_t elf_mach;
+    uint32_t pad1;
+    uint32_t pid;
+    uint64_t timestamp;
+    uint64_t flags;
+};
+
+enum jit_record_type {
+    JIT_CODE_LOAD = 0,
+    JIT_CODE_DEBUG_INFO = 2,
+};
+
+struct jr_prefix {
+    uint32_t id;
+    uint32_t total_size;
+    uint64_t timestamp;
+};
+
+struct jr_code_load {
+    struct jr_prefix p;
+
+    uint32_t pid;
+    uint32_t tid;
+    uint64_t vma;
+    uint64_t code_addr;
+    uint64_t code_size;
+    uint64_t code_index;
+};
+
+struct debug_entry {
+    uint64_t addr;
+    int lineno;
+    int discrim;
+    const char name[];
+};
+
+struct jr_code_debug_info {
+    struct jr_prefix p;
+
+    uint64_t code_addr;
+    uint64_t nr_entry;
+    struct debug_entry entries[];
+};
+
+static uint32_t get_e_machine(void)
+{
+    Elf64_Ehdr elf_header;
+    FILE *exe;
+    size_t n;
+
+    QEMU_BUILD_BUG_ON(offsetof(Elf32_Ehdr, e_machine) !=
+                      offsetof(Elf64_Ehdr, e_machine));
+
+    exe = fopen("/proc/self/exe", "r");
+    if (exe == NULL) {
+        return EM_NONE;
+    }
+
+    n = fread(&elf_header, sizeof(elf_header), 1, exe);
+    fclose(exe);
+    if (n != 1) {
+        return EM_NONE;
+    }
+
+    return elf_header.e_machine;
+}
+
+void perf_enable_jitdump(void)
+{
+    struct jitheader header;
+    char jitdump_file[32];
+    void *perf_marker;
+
+    if (!use_rt_clock) {
+        warn_report("CLOCK_MONOTONIC is not available, proceeding without jitdump");
+        return;
+    }
+
+    snprintf(jitdump_file, sizeof(jitdump_file), "jit-%d.dump", getpid());
+    jitdump = safe_fopen_w(jitdump_file);
+    if (jitdump == NULL) {
+        warn_report("Could not open %s: %s, proceeding without jitdump",
+                    jitdump_file, strerror(errno));
+        return;
+    }
+
+    /*
+     * `perf inject` will see that the mapped file name in the corresponding
+     * PERF_RECORD_MMAP or PERF_RECORD_MMAP2 event is of the form jit-%d.dump
+     * and will process it as a jitdump file.
+     */
+    perf_marker = mmap(NULL, qemu_real_host_page_size(), PROT_READ | PROT_EXEC,
+                       MAP_PRIVATE, fileno(jitdump), 0);
+    if (perf_marker == MAP_FAILED) {
+        warn_report("Could not map %s: %s, proceeding without jitdump",
+                    jitdump_file, strerror(errno));
+        fclose(jitdump);
+        jitdump = NULL;
+        return;
+    }
+
+    header.magic = JITHEADER_MAGIC;
+    header.version = JITHEADER_VERSION;
+    header.total_size = sizeof(header);
+    header.elf_mach = get_e_machine();
+    header.pad1 = 0;
+    header.pid = getpid();
+    header.timestamp = get_clock();
+    header.flags = 0;
+    fwrite(&header, sizeof(header), 1, jitdump);
+}
+
+void perf_report_prologue(const void *start, size_t size)
+{
+    if (perfmap) {
+        fprintf(perfmap, "%"PRIxPTR" %zx tcg-prologue-buffer\n",
+                (uintptr_t)start, size);
+    }
+}
+
+/* Write a JIT_CODE_DEBUG_INFO jitdump entry. */
+static void write_jr_code_debug_info(const void *start,
+                                     const struct debuginfo_query *q,
+                                     size_t icount)
+{
+    struct jr_code_debug_info rec;
+    struct debug_entry ent;
+    uintptr_t host_pc;
+    int insn;
+
+    /* Write the header. */
+    rec.p.id = JIT_CODE_DEBUG_INFO;
+    rec.p.total_size = sizeof(rec) + sizeof(ent) + 1;
+    rec.p.timestamp = get_clock();
+    rec.code_addr = (uintptr_t)start;
+    rec.nr_entry = 1;
+    for (insn = 0; insn < icount; insn++) {
+        if (q[insn].file) {
+            rec.p.total_size += sizeof(ent) + strlen(q[insn].file) + 1;
+            rec.nr_entry++;
+        }
+    }
+    fwrite(&rec, sizeof(rec), 1, jitdump);
+
+    /* Write the main debug entries. */
+    for (insn = 0; insn < icount; insn++) {
+        if (q[insn].file) {
+            get_host_pc_size(&host_pc, NULL, start, insn);
+            ent.addr = host_pc;
+            ent.lineno = q[insn].line;
+            ent.discrim = 0;
+            fwrite(&ent, sizeof(ent), 1, jitdump);
+            fwrite(q[insn].file, strlen(q[insn].file) + 1, 1, jitdump);
+        }
+    }
+
+    /* Write the trailing debug_entry. */
+    ent.addr = (uintptr_t)start + tcg_ctx->gen_insn_end_off[icount - 1];
+    ent.lineno = 0;
+    ent.discrim = 0;
+    fwrite(&ent, sizeof(ent), 1, jitdump);
+    fwrite("", 1, 1, jitdump);
+}
+
+/* Write a JIT_CODE_LOAD jitdump entry. */
+static void write_jr_code_load(const void *start, uint16_t host_size,
+                               const struct debuginfo_query *q)
+{
+    static uint64_t code_index;
+    struct jr_code_load rec;
+    const char *symbol;
+    size_t symbol_size;
+
+    symbol = pretty_symbol(q, &symbol_size);
+    rec.p.id = JIT_CODE_LOAD;
+    rec.p.total_size = sizeof(rec) + symbol_size + host_size;
+    rec.p.timestamp = get_clock();
+    rec.pid = getpid();
+    rec.tid = qemu_get_thread_id();
+    rec.vma = (uintptr_t)start;
+    rec.code_addr = (uintptr_t)start;
+    rec.code_size = host_size;
+    rec.code_index = code_index++;
+    fwrite(&rec, sizeof(rec), 1, jitdump);
+    fwrite(symbol, symbol_size, 1, jitdump);
+    fwrite(start, host_size, 1, jitdump);
+}
+
+void perf_report_code(uint64_t guest_pc, TranslationBlock *tb,
+                      const void *start)
+{
+    struct debuginfo_query *q;
+    size_t insn;
+
+    if (!perfmap && !jitdump) {
+        return;
+    }
+
+    q = g_try_malloc0_n(tb->icount, sizeof(*q));
+    if (!q) {
+        return;
+    }
+
+    debuginfo_lock();
+
+    /* Query debuginfo for each guest instruction. */
+    for (insn = 0; insn < tb->icount; insn++) {
+        /* FIXME: This replicates the restore_state_to_opc() logic. */
+        q[insn].address = tcg_ctx->gen_insn_data[insn][0];
+        if (TARGET_TB_PCREL) {
+            q[insn].address |= (guest_pc & TARGET_PAGE_MASK);
+        } else {
+#if defined(TARGET_I386)
+            q[insn].address -= tb->cs_base;
+#endif
+        }
+        q[insn].flags = DEBUGINFO_SYMBOL | (jitdump ? DEBUGINFO_LINE : 0);
+    }
+    debuginfo_query(q, tb->icount);
+
+    /* Emit perfmap entries if needed. */
+    if (perfmap) {
+        flockfile(perfmap);
+        for (insn = 0; insn < tb->icount; insn++) {
+            write_perfmap_entry(start, insn, &q[insn]);
+        }
+        funlockfile(perfmap);
+    }
+
+    /* Emit jitdump entries if needed. */
+    if (jitdump) {
+        flockfile(jitdump);
+        write_jr_code_debug_info(start, q, tb->icount);
+        write_jr_code_load(start, tcg_ctx->gen_insn_end_off[tb->icount - 1],
+                           q);
+        funlockfile(jitdump);
+    }
+
+    debuginfo_unlock();
+    g_free(q);
+}
+
+void perf_exit(void)
+{
+    if (perfmap) {
+        fclose(perfmap);
+        perfmap = NULL;
+    }
+
+    if (jitdump) {
+        fclose(jitdump);
+        jitdump = NULL;
+    }
+}
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@
 #include "tb-hash.h"
 #include "tb-context.h"
 #include "internal.h"
+#include "perf.h"
 
 /* Make sure all possible CPU event bits fit in tb->trace_vcpu_dstate */
 QEMU_BUILD_BUG_ON(CPU_TRACE_DSTATE_MAX_EVENTS >
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     }
     tb->tc.size = gen_code_size;
 
+    /*
+     * For TARGET_TB_PCREL, attribute all executions of the generated
+     * code to its first mapping.
+     */
+    perf_report_code(pc, tb, tcg_splitwx_to_rx(gen_code_buf));
+
 #ifdef CONFIG_PROFILER
     qatomic_set(&prof->code_time, prof->code_time + profile_getclock() - ti);
     qatomic_set(&prof->code_in_len, prof->code_in_len + tb->size);
diff --git a/linux-user/exit.c b/linux-user/exit.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/exit.c
+++ b/linux-user/exit.c
@@ -XXX,XX +XXX,XX @@
  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 #include "qemu/osdep.h"
+#include "accel/tcg/perf.h"
 #include "exec/gdbstub.h"
 #include "qemu.h"
 #include "user-internals.h"
@@ -XXX,XX +XXX,XX @@ void preexit_cleanup(CPUArchState *env, int code)
 #endif
         gdb_exit(code);
         qemu_plugin_user_exit();
+        perf_exit();
 }
diff --git a/linux-user/main.c b/linux-user/main.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -XXX,XX +XXX,XX @@
 #include "signal-common.h"
 #include "loader.h"
 #include "user-mmap.h"
+#include "accel/tcg/perf.h"
 
 #ifdef CONFIG_SEMIHOSTING
 #include "semihosting/semihost.h"
@@ -XXX,XX +XXX,XX @@ static void handle_arg_abi_call0(const char *arg)
 }
 #endif
 
+static void handle_arg_perfmap(const char *arg)
+{
+    perf_enable_perfmap();
+}
+
+static void handle_arg_jitdump(const char *arg)
+{
+    perf_enable_jitdump();
+}
+
 static QemuPluginList plugins = QTAILQ_HEAD_INITIALIZER(plugins);
 
 #ifdef CONFIG_PLUGIN
@@ -XXX,XX +XXX,XX @@ static const struct qemu_argument arg_table[] = {
     {"xtensa-abi-call0", "QEMU_XTENSA_ABI_CALL0", false, handle_arg_abi_call0,
      "",           "assume CALL0 Xtensa ABI"},
 #endif
+    {"perfmap",    "QEMU_PERFMAP",     false, handle_arg_perfmap,
+     "",           "Generate a /tmp/perf-${pid}.map file for perf"},
+    {"jitdump",    "QEMU_JITDUMP",     false, handle_arg_jitdump,
+     "",           "Generate a jit-${pid}.dump file for perf"},
     {NULL, NULL, false, NULL, NULL, NULL}
 };
 
diff --git a/softmmu/vl.c b/softmmu/vl.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/vl.c
+++ b/softmmu/vl.c
@@ -XXX,XX +XXX,XX @@
 #include "fsdev/qemu-fsdev.h"
 #endif
 #include "sysemu/qtest.h"
+#ifdef CONFIG_TCG
+#include "accel/tcg/perf.h"
+#endif
 
 #include "disas/disas.h"
 
@@ -XXX,XX +XXX,XX @@ void qemu_init(int argc, char **argv)
             case QEMU_OPTION_DFILTER:
                 qemu_set_dfilter_ranges(optarg, &error_fatal);
                 break;
+#if defined(CONFIG_TCG) && defined(CONFIG_LINUX)
+            case QEMU_OPTION_perfmap:
+                perf_enable_perfmap();
+                break;
+            case QEMU_OPTION_jitdump:
+                perf_enable_jitdump();
+                break;
+#endif
             case QEMU_OPTION_seed:
                 qemu_guest_random_seed_main(optarg, &error_fatal);
                 break;
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/log.h"
 #include "tcg/tcg-ldst.h"
 #include "tcg-internal.h"
+#include "accel/tcg/perf.h"
 
 /* Forward declarations for functions declared in tcg-target.c.inc and
    used here. */
@@ -XXX,XX +XXX,XX @@ void tcg_prologue_init(TCGContext *s)
 #endif
 
     prologue_size = tcg_current_code_size(s);
+    perf_report_prologue(s->code_gen_ptr, prologue_size);
 
 #ifndef CONFIG_TCG_INTERPRETER
     flush_idcache_range((uintptr_t)tcg_splitwx_to_rx(s->code_buf),
diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/meson.build
+++ b/accel/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ tcg_ss.add(when: 'CONFIG_USER_ONLY', if_true: files('user-exec.c'))
 tcg_ss.add(when: 'CONFIG_SOFTMMU', if_false: files('user-exec-stub.c'))
 tcg_ss.add(when: 'CONFIG_PLUGIN', if_true: [files('plugin-gen.c')])
 tcg_ss.add(when: libdw, if_true: files('debuginfo.c'))
+tcg_ss.add(when: 'CONFIG_LINUX', if_true: files('perf.c'))
 specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_ss)
 
 specific_ss.add(when: ['CONFIG_SOFTMMU', 'CONFIG_TCG'], if_true: files(
diff --git a/qemu-options.hx b/qemu-options.hx
index XXXXXXX..XXXXXXX 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ SRST
     Enable synchronization profiling.
 ERST
 
+#if defined(CONFIG_TCG) && defined(CONFIG_LINUX)
+DEF("perfmap", 0, QEMU_OPTION_perfmap,
+    "-perfmap        generate a /tmp/perf-${pid}.map file for perf\n",
+    QEMU_ARCH_ALL)
+SRST
+``-perfmap``
+    Generate a map file for Linux perf tools that will allow basic profiling
+    information to be broken down into basic blocks.
+ERST
+
+DEF("jitdump", 0, QEMU_OPTION_jitdump,
+    "-jitdump        generate a jit-${pid}.dump file for perf\n",
+    QEMU_ARCH_ALL)
+SRST
+``-jitdump``
+    Generate a dump file for Linux perf tools that maps basic blocks to symbol
+    names, line numbers and JITted code.
+ERST
+#endif
+
 DEFHEADING()
 
 DEFHEADING(Generic object creation:)
-- 
2.34.1

Use the attribute, which is supported by clang, instead of
the #pragma, which is not supported and, for some reason,
also not detected by the meson probe, so we fail by -Werror.

Include only <immintrin.h> as that is the outermost "official"
header for these intrinsics -- emmintrin.h and smmintrin -- are
older SSE2 and SSE4 specific headers, while the immintrin.h
includes all of the Intel intrinsics.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 meson.build         |  8 ++------
 util/bufferiszero.c | 41 ++++++-----------------------------------
 2 files changed, 8 insertions(+), 41 deletions(-)

diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ config_host_data.set('CONFIG_CPUID_H', have_cpuid_h)
 config_host_data.set('CONFIG_AVX2_OPT', get_option('avx2') \
   .require(have_cpuid_h, error_message: 'cpuid.h not available, cannot enable AVX2') \
   .require(cc.links('''
-    #pragma GCC push_options
-    #pragma GCC target("avx2")
     #include <cpuid.h>
     #include <immintrin.h>
-    static int bar(void *a) {
+    static int __attribute__((target("avx2"))) bar(void *a) {
       __m256i x = *(__m256i *)a;
       return _mm256_testz_si256(x, x);
     }
@@ -XXX,XX +XXX,XX @@ config_host_data.set('CONFIG_AVX2_OPT', get_option('avx2') \
 config_host_data.set('CONFIG_AVX512F_OPT', get_option('avx512f') \
   .require(have_cpuid_h, error_message: 'cpuid.h not available, cannot enable AVX512F') \
   .require(cc.links('''
-    #pragma GCC push_options
-    #pragma GCC target("avx512f")
     #include <cpuid.h>
     #include <immintrin.h>
-    static int bar(void *a) {
+    static int __attribute__((target("avx512f"))) bar(void *a) {
       __m512i x = *(__m512i *)a;
       return _mm512_test_epi64_mask(x, x);
     }
diff --git a/util/bufferiszero.c b/util/bufferiszero.c
index XXXXXXX..XXXXXXX 100644
--- a/util/bufferiszero.c
+++ b/util/bufferiszero.c
@@ -XXX,XX +XXX,XX @@ buffer_zero_int(const void *buf, size_t len)
 }
 
 #if defined(CONFIG_AVX512F_OPT) || defined(CONFIG_AVX2_OPT) || defined(__SSE2__)
-/* Do not use push_options pragmas unnecessarily, because clang
- * does not support them.
- */
-#if defined(CONFIG_AVX512F_OPT) || defined(CONFIG_AVX2_OPT)
-#pragma GCC push_options
-#pragma GCC target("sse2")
-#endif
-#include <emmintrin.h>
+#include <immintrin.h>
 
 /* Note that each of these vectorized functions require len >= 64.  */
 
-static bool
+static bool __attribute__((target("sse2")))
 buffer_zero_sse2(const void *buf, size_t len)
 {
     __m128i t = _mm_loadu_si128(buf);
@@ -XXX,XX +XXX,XX @@ buffer_zero_sse2(const void *buf, size_t len)
 
     return _mm_movemask_epi8(_mm_cmpeq_epi8(t, zero)) == 0xFFFF;
 }
-#if defined(CONFIG_AVX512F_OPT) || defined(CONFIG_AVX2_OPT)
-#pragma GCC pop_options
-#endif
 
 #ifdef CONFIG_AVX2_OPT
-/* Note that due to restrictions/bugs wrt __builtin functions in gcc <= 4.8,
- * the includes have to be within the corresponding push_options region, and
- * therefore the regions themselves have to be ordered with increasing ISA.
- */
-#pragma GCC push_options
-#pragma GCC target("sse4")
-#include <smmintrin.h>
-
-static bool
+static bool __attribute__((target("sse4")))
 buffer_zero_sse4(const void *buf, size_t len)
 {
     __m128i t = _mm_loadu_si128(buf);
@@ -XXX,XX +XXX,XX @@ buffer_zero_sse4(const void *buf, size_t len)
     return _mm_testz_si128(t, t);
 }
 
-#pragma GCC pop_options
-#pragma GCC push_options
-#pragma GCC target("avx2")
-#include <immintrin.h>
-
-static bool
+static bool __attribute__((target("avx2")))
 buffer_zero_avx2(const void *buf, size_t len)
 {
     /* Begin with an unaligned head of 32 bytes.  */
@@ -XXX,XX +XXX,XX @@ buffer_zero_avx2(const void *buf, size_t len)
 
     return _mm256_testz_si256(t, t);
 }
-#pragma GCC pop_options
 #endif /* CONFIG_AVX2_OPT */
 
 #ifdef CONFIG_AVX512F_OPT
-#pragma GCC push_options
-#pragma GCC target("avx512f")
-#include <immintrin.h>
-
-static bool
+static bool __attribute__((target("avx512f")))
 buffer_zero_avx512(const void *buf, size_t len)
 {
     /* Begin with an unaligned head of 64 bytes.  */
@@ -XXX,XX +XXX,XX @@ buffer_zero_avx512(const void *buf, size_t len)
     return !_mm512_test_epi64_mask(t, t);
 
 }
-#pragma GCC pop_options
-#endif
+#endif /* CONFIG_AVX512F_OPT */
 
 
 /* Note that for test_buffer_is_zero_next_accel, the most preferred
-- 
2.34.1

Recently the g_assert(cpu == current_cpu) test has been
intermittently failing with gcc.  Reorg the code around
the setjmp to minimize the lifetime of the cpu variable
affected by the setjmp.

This appears to fix the existing issue with clang as well.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1147
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c | 111 +++++++++++++++++++++----------------------
 1 file changed, 54 insertions(+), 57 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline void cpu_loop_exec_tb(CPUState *cpu, TranslationBlock *tb,
 
 /* main execution loop */
 
-int cpu_exec(CPUState *cpu)
+static int __attribute__((noinline))
+cpu_exec_loop(CPUState *cpu, SyncClocks *sc)
 {
     int ret;
-    SyncClocks sc = { 0 };
-
-    /* replay_interrupt may need current_cpu */
-    current_cpu = cpu;
-
-    if (cpu_handle_halt(cpu)) {
-        return EXCP_HALTED;
-    }
-
-    rcu_read_lock();
-
-    cpu_exec_enter(cpu);
-
-    /* Calculate difference between guest clock and host clock.
-     * This delay includes the delay of the last cycle, so
-     * what we have to do is sleep until it is 0. As for the
-     * advance/delay we gain here, we try to fix it next time.
-     */
-    init_delay_params(&sc, cpu);
-
-    /* prepare setjmp context for exception handling */
-    if (sigsetjmp(cpu->jmp_env, 0) != 0) {
-#if defined(__clang__)
-        /*
-         * Some compilers wrongly smash all local variables after
-         * siglongjmp (the spec requires that only non-volatile locals
-         * which are changed between the sigsetjmp and siglongjmp are
-         * permitted to be trashed). There were bug reports for gcc
-         * 4.5.0 and clang.  The bug is fixed in all versions of gcc
-         * that we support, but is still unfixed in clang:
-         *   https://bugs.llvm.org/show_bug.cgi?id=21183
-         *
-         * Reload an essential local variable here for those compilers.
-         * Newer versions of gcc would complain about this code (-Wclobbered),
-         * so we only perform the workaround for clang.
-         */
-        cpu = current_cpu;
-#else
-        /* Non-buggy compilers preserve this; assert the correct value. */
-        g_assert(cpu == current_cpu);
-#endif
-
-#ifndef CONFIG_SOFTMMU
-        clear_helper_retaddr();
-        if (have_mmap_lock()) {
-            mmap_unlock();
-        }
-#endif
-        if (qemu_mutex_iothread_locked()) {
-            qemu_mutex_unlock_iothread();
-        }
-        qemu_plugin_disable_mem_helpers(cpu);
-
-        assert_no_pages_locked();
-    }
 
     /* if an exception is pending, we execute it here */
     while (!cpu_handle_exception(cpu, &ret)) {
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
 
             /* Try to align the host and virtual clocks
                if the guest is in advance */
-            align_clocks(&sc, cpu);
+            align_clocks(sc, cpu);
         }
     }
+    return ret;
+}
+
+static int cpu_exec_setjmp(CPUState *cpu, SyncClocks *sc)
+{
+    /* Prepare setjmp context for exception handling. */
+    if (unlikely(sigsetjmp(cpu->jmp_env, 0) != 0)) {
+        /* Non-buggy compilers preserve this; assert the correct value. */
+        g_assert(cpu == current_cpu);
+
+#ifndef CONFIG_SOFTMMU
+        clear_helper_retaddr();
+        if (have_mmap_lock()) {
+            mmap_unlock();
+        }
+#endif
+        if (qemu_mutex_iothread_locked()) {
+            qemu_mutex_unlock_iothread();
+        }
+        qemu_plugin_disable_mem_helpers(cpu);
+
+        assert_no_pages_locked();
+    }
+
+    return cpu_exec_loop(cpu, sc);
+}
+
+int cpu_exec(CPUState *cpu)
+{
+    int ret;
+    SyncClocks sc = { 0 };
+
+    /* replay_interrupt may need current_cpu */
+    current_cpu = cpu;
+
+    if (cpu_handle_halt(cpu)) {
+        return EXCP_HALTED;
+    }
+
+    rcu_read_lock();
+    cpu_exec_enter(cpu);
+
+    /*
+     * Calculate difference between guest clock and host clock.
+     * This delay includes the delay of the last cycle, so
+     * what we have to do is sleep until it is 0. As for the
+     * advance/delay we gain here, we try to fix it next time.
+     */
+    init_delay_params(&sc, cpu);
+
+    ret = cpu_exec_setjmp(cpu, &sc);
 
     cpu_exec_exit(cpu);
     rcu_read_unlock();
-- 
2.34.1

Pretty small still, but there are two patches that ought
to get backported to stable, so no point in delaying.

The following changes since commit a5ba0a7e4e150d1350a041f0d0ef9ca6c8d7c307:

Merge tag 'pull-aspeed-20241211' of https://github.com/legoater/qemu into staging (2024-12-11 15:16:47 +0000)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20241212

for you to fetch changes up to 7ac87b14a92234b6a89b701b4043ad6cf8bdcccf:

target/sparc: Use memcpy() and remove memcpy32() (2024-12-12 14:28:38 -0600)

----------------------------------------------------------------
tcg: Reset free_temps before tcg_optimize
tcg/riscv: Fix StoreStore barrier generation
include/exec: Introduce fpst alias in helper-head.h.inc
target/sparc: Use memcpy() and remove memcpy32()

----------------------------------------------------------------
Philippe Mathieu-Daudé (1):
      target/sparc: Use memcpy() and remove memcpy32()

Richard Henderson (2):
      tcg: Reset free_temps before tcg_optimize
      include/exec: Introduce fpst alias in helper-head.h.inc

Roman Artemev (1):
      tcg/riscv: Fix StoreStore barrier generation

When allocating new temps during tcg_optmize, do not re-use
any EBB temps that were used within the TB.  We do not have
any idea what span of the TB in which the temp was live.

Introduce tcg_temp_ebb_reset_freed and use before tcg_optimize,
as well as replacing the equivalent in plugin_gen_inject and
tcg_func_start.

Cc: qemu-stable@nongnu.org
Fixes: fb04ab7ddd8 ("tcg/optimize: Lower TCG_COND_TST{EQ,NE} if unsupported")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2711
Reported-by: wannacu <wannacu2049@gmail.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 include/tcg/tcg-temp-internal.h | 6 ++++++
 accel/tcg/plugin-gen.c          | 2 +-
 tcg/tcg.c                       | 5 ++++-
 3 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/include/tcg/tcg-temp-internal.h b/include/tcg/tcg-temp-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg-temp-internal.h
+++ b/include/tcg/tcg-temp-internal.h
@@ -XXX,XX +XXX,XX @@ TCGv_i64 tcg_temp_ebb_new_i64(void);
 TCGv_ptr tcg_temp_ebb_new_ptr(void);
 TCGv_i128 tcg_temp_ebb_new_i128(void);
 
+/* Forget all freed EBB temps, so that new allocations produce new temps. */
+static inline void tcg_temp_ebb_reset_freed(TCGContext *s)
+{
+    memset(s->free_temps, 0, sizeof(s->free_temps));
+}
+
 #endif /* TCG_TEMP_FREE_H */
diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/plugin-gen.c
+++ b/accel/tcg/plugin-gen.c
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
      * that might be live within the existing opcode stream.
      * The simplest solution is to release them all and create new.
      */
-    memset(tcg_ctx->free_temps, 0, sizeof(tcg_ctx->free_temps));
+    tcg_temp_ebb_reset_freed(tcg_ctx);
 
     QTAILQ_FOREACH_SAFE(op, &tcg_ctx->ops, link, next) {
         switch (op->opc) {
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ void tcg_func_start(TCGContext *s)
     s->nb_temps = s->nb_globals;
 
     /* No temps have been previously allocated for size or locality.  */
-    memset(s->free_temps, 0, sizeof(s->free_temps));
+    tcg_temp_ebb_reset_freed(s);
 
     /* No constant temps have been previously allocated. */
     for (int i = 0; i < TCG_TYPE_COUNT; ++i) {
@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb, uint64_t pc_start)
     }
 #endif
 
+    /* Do not reuse any EBB that may be allocated within the TB. */
+    tcg_temp_ebb_reset_freed(s);
+
     tcg_optimize(s);
 
     reachable_code_pass(s);
-- 
2.43.0

From: Roman Artemev <roman.artemev@syntacore.com>

On RISC-V to StoreStore barrier corresponds
`fence w, w` not `fence r, r`

Cc: qemu-stable@nongnu.org
Fixes: efbea94c76b ("tcg/riscv: Add slowpath load and store instructions")
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Denis Tomashev <denis.tomashev@syntacore.com>
Signed-off-by: Roman Artemev <roman.artemev@syntacore.com>
Message-ID: <e2f2131e294a49e79959d4fa9ec02cf4@syntacore.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/riscv/tcg-target.c.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_mb(TCGContext *s, TCGArg a0)
         insn |= 0x02100000;
     }
     if (a0 & TCG_MO_ST_ST) {
-        insn |= 0x02200000;
+        insn |= 0x01100000;
     }
     tcg_out32(s, insn);
 }
-- 
2.43.0

This allows targets to declare that the helper requires a
float_status pointer and instead of a generic void pointer.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/helper-head.h.inc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/include/exec/helper-head.h.inc b/include/exec/helper-head.h.inc
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/helper-head.h.inc
+++ b/include/exec/helper-head.h.inc
@@ -XXX,XX +XXX,XX @@
 #define dh_alias_ptr ptr
 #define dh_alias_cptr ptr
 #define dh_alias_env ptr
+#define dh_alias_fpst ptr
 #define dh_alias_void void
 #define dh_alias_noreturn noreturn
 #define dh_alias(t) glue(dh_alias_, t)
@@ -XXX,XX +XXX,XX @@
 #define dh_ctype_ptr void *
 #define dh_ctype_cptr const void *
 #define dh_ctype_env CPUArchState *
+#define dh_ctype_fpst float_status *
 #define dh_ctype_void void
 #define dh_ctype_noreturn G_NORETURN void
 #define dh_ctype(t) dh_ctype_##t
@@ -XXX,XX +XXX,XX @@
 #define dh_typecode_f64 dh_typecode_i64
 #define dh_typecode_cptr dh_typecode_ptr
 #define dh_typecode_env dh_typecode_ptr
+#define dh_typecode_fpst dh_typecode_ptr
 #define dh_typecode(t) dh_typecode_##t
 
 #define dh_callflag_i32  0
-- 
2.43.0

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Rather than manually copying each register, use
the libc memcpy(), which is well optimized nowadays.

Suggested-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20241205205418.67613-1-philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/sparc/win_helper.c | 26 ++++++++------------------
 1 file changed, 8 insertions(+), 18 deletions(-)

diff --git a/target/sparc/win_helper.c b/target/sparc/win_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/win_helper.c
+++ b/target/sparc/win_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/helper-proto.h"
 #include "trace.h"
 
-static inline void memcpy32(target_ulong *dst, const target_ulong *src)
-{
-    dst[0] = src[0];
-    dst[1] = src[1];
-    dst[2] = src[2];
-    dst[3] = src[3];
-    dst[4] = src[4];
-    dst[5] = src[5];
-    dst[6] = src[6];
-    dst[7] = src[7];
-}
-
 void cpu_set_cwp(CPUSPARCState *env, int new_cwp)
 {
     /* put the modified wrap registers at their proper location */
     if (env->cwp == env->nwindows - 1) {
-        memcpy32(env->regbase, env->regbase + env->nwindows * 16);
+        memcpy(env->regbase, env->regbase + env->nwindows * 16,
+               sizeof(env->gregs));
     }
     env->cwp = new_cwp;
 
     /* put the wrap registers at their temporary location */
     if (new_cwp == env->nwindows - 1) {
-        memcpy32(env->regbase + env->nwindows * 16, env->regbase);
+        memcpy(env->regbase + env->nwindows * 16, env->regbase,
+               sizeof(env->gregs));
     }
     env->regwptr = env->regbase + (new_cwp * 16);
 }
@@ -XXX,XX +XXX,XX @@ void cpu_gl_switch_gregs(CPUSPARCState *env, uint32_t new_gl)
     dst = get_gl_gregset(env, env->gl);
 
     if (src != dst) {
-        memcpy32(dst, env->gregs);
-        memcpy32(env->gregs, src);
+        memcpy(dst, env->gregs, sizeof(env->gregs));
+        memcpy(env->gregs, src, sizeof(env->gregs));
     }
 }
 
@@ -XXX,XX +XXX,XX @@ void cpu_change_pstate(CPUSPARCState *env, uint32_t new_pstate)
         /* Switch global register bank */
         src = get_gregset(env, new_pstate_regs);
         dst = get_gregset(env, pstate_regs);
-        memcpy32(dst, env->gregs);
-        memcpy32(env->gregs, src);
+        memcpy(dst, env->gregs, sizeof(env->gregs));
+        memcpy(env->gregs, src, sizeof(env->gregs));
     } else {
         trace_win_helper_no_switch_pstate(new_pstate_regs);
     }
-- 
2.43.0