Series comparison

-[PULL 0/7] tcg patch queue
+[PULL v2 00/29] tcg patch queue
-The linux-user patches are on the tcg-ish side of user-only
+v2: Fix FreeBSD build error in patch 18.
 emulation, rather than the syscall-ish side, so queuing here.
 Solving the deadlock issue is quite important vs timeouts.
 r~
-The following changes since commit 6dffbe36af79e26a4d23f94a9a1c1201de99c261:
+The following changes since commit 0d239e513e0117e66fa739fb71a43b9383a108ff:
-  Merge tag 'migration-20230215-pull-request' of https://gitlab.com/juan.quintela/qemu into staging (2023-02-16 13:09:51 +0000)
+  Merge tag 'pull-lu-20231018' of https://gitlab.com/rth7680/qemu into staging (2023-10-19 10:20:57 -0700)
 are available in the Git repository at:
-  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20230219
+  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20231018-2
-for you to fetch changes up to 2f5b4792c0220920831ac84f94c3435b14791857:
+for you to fetch changes up to a75f704d972b9408f5e2843784b3add48c724c52:
-  target/microblaze: Add gdbstub xml (2023-02-19 16:12:26 -1000)
+  target/i386: Use i128 for 128 and 256-bit loads and stores (2023-10-19 21:11:44 -0700)
 ----------------------------------------------------------------
-tcg: Allow first half of insn in ram, and second half in mmio
+tcg: Drop unused tcg_temp_free define
-linux-user/sparc: SIGILL for unknown trap vectors
+tcg: Introduce tcg_use_softmmu
-linux-user/microblaze: SIGILL for privileged insns
+tcg: Optimize past conditional branches
-linux-user: Fix deadlock while exiting due to signal
+tcg: Use constant zero when expanding with divu2
-target/microblaze: Add gdbstub xml
+tcg/ppc: Enable direct branching tcg_out_goto_tb with TCG_REG_TB
 tcg/ppc: Use ADDPCIS for power9
 tcg/ppc: Use prefixed instructions for power10
 tcg/ppc: Disable TCG_REG_TB for Power9/Power10
 ----------------------------------------------------------------
-Ilya Leoshkevich (4):
+Jordan Niethe (1):
-      linux-user: Always exit from exclusive state in fork_end()
+      tcg/ppc: Enable direct branching tcg_out_goto_tb with TCG_REG_TB
       cpus: Make {start,end}_exclusive() recursive
       linux-user/microblaze: Handle privileged exception
       tests/tcg/linux-test: Add linux-fork-trap test
-Richard Henderson (3):
+Mike Frysinger (1):
-      accel/tcg: Allow the second page of an instruction to be MMIO
+      tcg: drop unused tcg_temp_free define
       linux-user/sparc: Raise SIGILL for all unhandled software traps
       target/microblaze: Add gdbstub xml
- configs/targets/microblaze-linux-user.mak   |  1 +
+Richard Henderson (27):
- configs/targets/microblaze-softmmu.mak      |  1 +
+      tcg/ppc: Untabify tcg-target.c.inc
- configs/targets/microblazeel-linux-user.mak |  1 +
+      tcg/ppc: Reinterpret tb-relative to TB+4
- configs/targets/microblazeel-softmmu.mak    |  1 +
+      tcg/ppc: Use ADDPCIS in tcg_out_tb_start
- include/hw/core/cpu.h                       |  4 +-
+      tcg/ppc: Use ADDPCIS in tcg_out_movi_int
- target/microblaze/cpu.h                     |  2 +
+      tcg/ppc: Use ADDPCIS for the constant pool
- accel/tcg/translator.c                      | 12 +++++-
+      tcg/ppc: Use ADDPCIS in tcg_out_goto_tb
- cpus-common.c                               | 12 +++++-
+      tcg/ppc: Use PADDI in tcg_out_movi
- linux-user/main.c                           | 10 +++--
+      tcg/ppc: Use prefixed instructions in tcg_out_mem_long
- linux-user/microblaze/cpu_loop.c            | 10 ++++-
+      tcg/ppc: Use PLD in tcg_out_movi for constant pool
- linux-user/sparc/cpu_loop.c                 |  8 ++++
+      tcg/ppc: Use prefixed instructions in tcg_out_dupi_vec
- linux-user/syscall.c                        |  1 +
+      tcg/ppc: Use PLD in tcg_out_goto_tb
- target/microblaze/cpu.c                     |  7 ++-
+      tcg/ppc: Disable TCG_REG_TB for Power9/Power10
- target/microblaze/gdbstub.c                 | 51 ++++++++++++++++------
+      tcg: Introduce tcg_use_softmmu
- tests/tcg/multiarch/linux/linux-fork-trap.c | 51 ++++++++++++++++++++++
+      tcg: Provide guest_base fallback for system mode
- gdb-xml/microblaze-core.xml                 | 67 +++++++++++++++++++++++++++++
+      tcg/arm: Use tcg_use_softmmu
- gdb-xml/microblaze-stack-protect.xml        | 12 ++++++
+      tcg/aarch64: Use tcg_use_softmmu
-files changed, 224 insertions(+), 27 deletions(-)
+      tcg/i386: Use tcg_use_softmmu
- create mode 100644 tests/tcg/multiarch/linux/linux-fork-trap.c
+      tcg/loongarch64: Use tcg_use_softmmu
- create mode 100644 gdb-xml/microblaze-core.xml
+      tcg/mips: Use tcg_use_softmmu
- create mode 100644 gdb-xml/microblaze-stack-protect.xml
+      tcg/ppc: Use tcg_use_softmmu
       tcg/riscv: Do not reserve TCG_GUEST_BASE_REG for guest_base zero
       tcg/riscv: Use tcg_use_softmmu
       tcg/s390x: Use tcg_use_softmmu
       tcg: Use constant zero when expanding with divu2
       tcg: Optimize past conditional branches
       tcg: Add tcg_gen_{ld,st}_i128
       target/i386: Use i128 for 128 and 256-bit loads and stores
  include/tcg/tcg-op-common.h      |   3 +
  include/tcg/tcg-op.h             |   2 -
  include/tcg/tcg.h                |   8 +-
  target/i386/tcg/translate.c      |  63 ++---
  tcg/optimize.c                   |   8 +-
  tcg/tcg-op-ldst.c                |  14 +-
  tcg/tcg-op.c                     |  38 ++-
  tcg/tcg.c                        |  13 +-
  tcg/aarch64/tcg-target.c.inc     | 177 ++++++------
  tcg/arm/tcg-target.c.inc         | 203 +++++++-------
  tcg/i386/tcg-target.c.inc        | 198 +++++++-------
  tcg/loongarch64/tcg-target.c.inc | 126 +++++----
  tcg/mips/tcg-target.c.inc        | 231 ++++++++--------
  tcg/ppc/tcg-target.c.inc         | 561 ++++++++++++++++++++++++++-------------
  tcg/riscv/tcg-target.c.inc       | 189 ++++++-------
  tcg/s390x/tcg-target.c.inc       | 161 ++++++-----
 files changed, 1102 insertions(+), 893 deletions(-)

-[PULL 1/7] accel/tcg: Allow the second page of an instruction to be MMIO
+[PULL v2 18/29] tcg/i386: Use tcg_use_softmmu
-If an instruction straddles a page boundary, and the first page
-was ram, but the second page was MMIO, we would abort.  Handle
-this as if both pages are MMIO, by setting the ram_addr_t for
-the first page to -1.
-Reported-by: Sid Manning <sidneym@quicinc.com>
-Reported-by: Jørgen Hansen <Jorgen.Hansen@wdc.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/translator.c | 12 ++++++++++--
+ tcg/i386/tcg-target.c.inc | 198 +++++++++++++++++++-------------------
-file changed, 10 insertions(+), 2 deletions(-)
+file changed, 98 insertions(+), 100 deletions(-)
-diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
+diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/translator.c
+--- a/tcg/i386/tcg-target.c.inc
-+++ b/accel/tcg/translator.c
++++ b/tcg/i386/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static void *translator_access(CPUArchState *env, DisasContextBase *db,
+@@ -XXX,XX +XXX,XX @@ static TCGReg tcg_target_call_oarg_reg(TCGCallReturnKind kind, int slot)
-         if (host == NULL) {
+ # define ALL_VECTOR_REGS       0x00ff0000u
-             tb_page_addr_t phys_page =
+ # define ALL_BYTEL_REGS        0x0000000fu
-                 get_page_addr_code_hostp(env, base, &db->host_addr[1]);
+ #endif
--            /* We cannot handle MMIO as second page. */
+-#ifdef CONFIG_SOFTMMU
--            assert(phys_page != -1);
+-# define SOFTMMU_RESERVE_REGS  ((1 << TCG_REG_L0) | (1 << TCG_REG_L1))
 -#else
 -# define SOFTMMU_RESERVE_REGS  0
 -#endif
 +#define SOFTMMU_RESERVE_REGS \
 +    (tcg_use_softmmu ? (1 << TCG_REG_L0) | (1 << TCG_REG_L1) : 0)
  /* For 64-bit, we always know that CMOV is available.  */
  #if TCG_TARGET_REG_BITS == 64
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
      return true;
  }
 -#ifndef CONFIG_SOFTMMU
 +#ifdef CONFIG_USER_ONLY
  static HostAddress x86_guest_base = {
      .index = -1
  };
@@ -XXX,XX +XXX,XX @@ static inline int setup_guest_base_seg(void)
      }
      return 0;
  }
 +#define setup_guest_base_seg  setup_guest_base_seg
  #elif defined(__x86_64__) && \
        (defined (__FreeBSD__) || defined (__FreeBSD_kernel__))
  # include <machine/sysarch.h>
@@ -XXX,XX +XXX,XX @@ static inline int setup_guest_base_seg(void)
      }
      return 0;
  }
 +#define setup_guest_base_seg  setup_guest_base_seg
 +#endif
  #else
 -static inline int setup_guest_base_seg(void)
 -{
 -    return 0;
 -}
 -#endif /* setup_guest_base_seg */
 -#endif /* !SOFTMMU */
 +# define x86_guest_base (*(HostAddress *)({ qemu_build_not_reached(); NULL; }))
 +#endif /* CONFIG_USER_ONLY */
 +#ifndef setup_guest_base_seg
 +# define setup_guest_base_seg()  0
 +#endif
  #define MIN_TLB_MASK_TABLE_OFS  INT_MIN
@@ -XXX,XX +XXX,XX @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
      MemOp s_bits = opc & MO_SIZE;
      unsigned a_mask;
 -#ifdef CONFIG_SOFTMMU
 -    h->index = TCG_REG_L0;
 -    h->ofs = 0;
 -    h->seg = 0;
 -#else
 -    *h = x86_guest_base;
 -#endif
 +    if (tcg_use_softmmu) {
 +        h->index = TCG_REG_L0;
 +        h->ofs = 0;
 +        h->seg = 0;
 +    } else {
 +        *h = x86_guest_base;
 +    }
      h->base = addrlo;
      h->aa = atom_and_align_for_opc(s, opc, MO_ATOM_IFALIGN, s_bits == MO_128);
      a_mask = (1 << h->aa.align) - 1;
 -#ifdef CONFIG_SOFTMMU
 -    int cmp_ofs = is_ld ? offsetof(CPUTLBEntry, addr_read)
 -                        : offsetof(CPUTLBEntry, addr_write);
 -    TCGType ttype = TCG_TYPE_I32;
 -    TCGType tlbtype = TCG_TYPE_I32;
 -    int trexw = 0, hrexw = 0, tlbrexw = 0;
 -    unsigned mem_index = get_mmuidx(oi);
 -    unsigned s_mask = (1 << s_bits) - 1;
 -    int fast_ofs = tlb_mask_table_ofs(s, mem_index);
 -    int tlb_mask;
 +    if (tcg_use_softmmu) {
 +        int cmp_ofs = is_ld ? offsetof(CPUTLBEntry, addr_read)
 +                            : offsetof(CPUTLBEntry, addr_write);
 +        TCGType ttype = TCG_TYPE_I32;
 +        TCGType tlbtype = TCG_TYPE_I32;
 +        int trexw = 0, hrexw = 0, tlbrexw = 0;
 +        unsigned mem_index = get_mmuidx(oi);
 +        unsigned s_mask = (1 << s_bits) - 1;
 +        int fast_ofs = tlb_mask_table_ofs(s, mem_index);
 +        int tlb_mask;
 -    ldst = new_ldst_label(s);
 -    ldst->is_ld = is_ld;
 -    ldst->oi = oi;
 -    ldst->addrlo_reg = addrlo;
 -    ldst->addrhi_reg = addrhi;
 +        ldst = new_ldst_label(s);
 +        ldst->is_ld = is_ld;
 +        ldst->oi = oi;
 +        ldst->addrlo_reg = addrlo;
 +        ldst->addrhi_reg = addrhi;
 -    if (TCG_TARGET_REG_BITS == 64) {
 -        ttype = s->addr_type;
 -        trexw = (ttype == TCG_TYPE_I32 ? 0 : P_REXW);
 -        if (TCG_TYPE_PTR == TCG_TYPE_I64) {
 -            hrexw = P_REXW;
 -            if (s->page_bits + s->tlb_dyn_max_bits > 32) {
 -                tlbtype = TCG_TYPE_I64;
 -                tlbrexw = P_REXW;
 +        if (TCG_TARGET_REG_BITS == 64) {
 +            ttype = s->addr_type;
 +            trexw = (ttype == TCG_TYPE_I32 ? 0 : P_REXW);
 +            if (TCG_TYPE_PTR == TCG_TYPE_I64) {
 +                hrexw = P_REXW;
 +                if (s->page_bits + s->tlb_dyn_max_bits > 32) {
 +                    tlbtype = TCG_TYPE_I64;
 +                    tlbrexw = P_REXW;
 +                }
              }
          }
 -    }
 -    tcg_out_mov(s, tlbtype, TCG_REG_L0, addrlo);
 -    tcg_out_shifti(s, SHIFT_SHR + tlbrexw, TCG_REG_L0,
 -                   s->page_bits - CPU_TLB_ENTRY_BITS);
 +        tcg_out_mov(s, tlbtype, TCG_REG_L0, addrlo);
 +        tcg_out_shifti(s, SHIFT_SHR + tlbrexw, TCG_REG_L0,
 +                       s->page_bits - CPU_TLB_ENTRY_BITS);
 -    tcg_out_modrm_offset(s, OPC_AND_GvEv + trexw, TCG_REG_L0, TCG_AREG0,
 -                         fast_ofs + offsetof(CPUTLBDescFast, mask));
 +        tcg_out_modrm_offset(s, OPC_AND_GvEv + trexw, TCG_REG_L0, TCG_AREG0,
 +                             fast_ofs + offsetof(CPUTLBDescFast, mask));
 -    tcg_out_modrm_offset(s, OPC_ADD_GvEv + hrexw, TCG_REG_L0, TCG_AREG0,
 -                         fast_ofs + offsetof(CPUTLBDescFast, table));
 +        tcg_out_modrm_offset(s, OPC_ADD_GvEv + hrexw, TCG_REG_L0, TCG_AREG0,
 +                             fast_ofs + offsetof(CPUTLBDescFast, table));
 -    /*
 -     * If the required alignment is at least as large as the access, simply
 -     * copy the address and mask.  For lesser alignments, check that we don't
 -     * cross pages for the complete access.
 -     */
 -    if (a_mask >= s_mask) {
 -        tcg_out_mov(s, ttype, TCG_REG_L1, addrlo);
 -    } else {
 -        tcg_out_modrm_offset(s, OPC_LEA + trexw, TCG_REG_L1,
 -                             addrlo, s_mask - a_mask);
 -    }
 -    tlb_mask = s->page_mask | a_mask;
 -    tgen_arithi(s, ARITH_AND + trexw, TCG_REG_L1, tlb_mask, 0);
 +        /*
 +         * If the required alignment is at least as large as the access,
 +         * simply copy the address and mask.  For lesser alignments,
 +         * check that we don't cross pages for the complete access.
 +         */
 +        if (a_mask >= s_mask) {
 +            tcg_out_mov(s, ttype, TCG_REG_L1, addrlo);
 +        } else {
 +            tcg_out_modrm_offset(s, OPC_LEA + trexw, TCG_REG_L1,
 +                                 addrlo, s_mask - a_mask);
 +        }
 +        tlb_mask = s->page_mask | a_mask;
 +        tgen_arithi(s, ARITH_AND + trexw, TCG_REG_L1, tlb_mask, 0);
 -    /* cmp 0(TCG_REG_L0), TCG_REG_L1 */
 -    tcg_out_modrm_offset(s, OPC_CMP_GvEv + trexw,
 -                         TCG_REG_L1, TCG_REG_L0, cmp_ofs);
 -
 -    /* jne slow_path */
 -    tcg_out_opc(s, OPC_JCC_long + JCC_JNE, 0, 0, 0);
 -    ldst->label_ptr[0] = s->code_ptr;
 -    s->code_ptr += 4;
 -
 -    if (TCG_TARGET_REG_BITS == 32 && s->addr_type == TCG_TYPE_I64) {
 -        /* cmp 4(TCG_REG_L0), addrhi */
 -        tcg_out_modrm_offset(s, OPC_CMP_GvEv, addrhi, TCG_REG_L0, cmp_ofs + 4);
 +        /* cmp 0(TCG_REG_L0), TCG_REG_L1 */
 +        tcg_out_modrm_offset(s, OPC_CMP_GvEv + trexw,
 +                             TCG_REG_L1, TCG_REG_L0, cmp_ofs);
          /* jne slow_path */
          tcg_out_opc(s, OPC_JCC_long + JCC_JNE, 0, 0, 0);
 -        ldst->label_ptr[1] = s->code_ptr;
 +        ldst->label_ptr[0] = s->code_ptr;
          s->code_ptr += 4;
 -    }
 -    /* TLB Hit.  */
 -    tcg_out_ld(s, TCG_TYPE_PTR, TCG_REG_L0, TCG_REG_L0,
 -               offsetof(CPUTLBEntry, addend));
 -#else
 -    if (a_mask) {
 +        if (TCG_TARGET_REG_BITS == 32 && s->addr_type == TCG_TYPE_I64) {
 +            /* cmp 4(TCG_REG_L0), addrhi */
 +            tcg_out_modrm_offset(s, OPC_CMP_GvEv, addrhi,
 +                                 TCG_REG_L0, cmp_ofs + 4);
 +
-+            /*
++            /* jne slow_path */
-+             * If the second page is MMIO, treat as if the first page
++            tcg_out_opc(s, OPC_JCC_long + JCC_JNE, 0, 0, 0);
-+             * was MMIO as well, so that we do not cache the TB.
++            ldst->label_ptr[1] = s->code_ptr;
-+             */
++            s->code_ptr += 4;
-+            if (unlikely(phys_page == -1)) {
++        }
 +                tb_set_page_addr0(tb, -1);
 +                return NULL;
 +            }
 +
-             tb_set_page_addr1(tb, phys_page);
++        /* TLB Hit.  */
- #ifdef CONFIG_USER_ONLY
++        tcg_out_ld(s, TCG_TYPE_PTR, TCG_REG_L0, TCG_REG_L0,
-             page_protect(end);
++                   offsetof(CPUTLBEntry, addend));
 +    } else if (a_mask) {
          ldst = new_ldst_label(s);
          ldst->is_ld = is_ld;
@@ -XXX,XX +XXX,XX @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
          ldst->label_ptr[0] = s->code_ptr;
          s->code_ptr += 4;
      }
 -#endif
      return ldst;
  }
@@ -XXX,XX +XXX,XX @@ static void tcg_target_qemu_prologue(TCGContext *s)
          tcg_out_push(s, tcg_target_callee_save_regs[i]);
      }
 -#if TCG_TARGET_REG_BITS == 32
 -    tcg_out_ld(s, TCG_TYPE_PTR, TCG_AREG0, TCG_REG_ESP,
 -               (ARRAY_SIZE(tcg_target_callee_save_regs) + 1) * 4);
 -    tcg_out_addi(s, TCG_REG_ESP, -stack_addend);
 -    /* jmp *tb.  */
 -    tcg_out_modrm_offset(s, OPC_GRP5, EXT5_JMPN_Ev, TCG_REG_ESP,
 -                         (ARRAY_SIZE(tcg_target_callee_save_regs) + 2) * 4
 -                         + stack_addend);
 -#else
 -# if !defined(CONFIG_SOFTMMU)
 -    if (guest_base) {
 +    if (!tcg_use_softmmu && guest_base) {
          int seg = setup_guest_base_seg();
          if (seg != 0) {
              x86_guest_base.seg = seg;
          } else if (guest_base == (int32_t)guest_base) {
              x86_guest_base.ofs = guest_base;
          } else {
 +            assert(TCG_TARGET_REG_BITS == 64);
              /* Choose R12 because, as a base, it requires a SIB byte. */
              x86_guest_base.index = TCG_REG_R12;
              tcg_out_movi(s, TCG_TYPE_PTR, x86_guest_base.index, guest_base);
              tcg_regset_set_reg(s->reserved_regs, x86_guest_base.index);
          }
      }
 -# endif
 -    tcg_out_mov(s, TCG_TYPE_PTR, TCG_AREG0, tcg_target_call_iarg_regs[0]);
 -    tcg_out_addi(s, TCG_REG_ESP, -stack_addend);
 -    /* jmp *tb.  */
 -    tcg_out_modrm(s, OPC_GRP5, EXT5_JMPN_Ev, tcg_target_call_iarg_regs[1]);
 -#endif
 +
 +    if (TCG_TARGET_REG_BITS == 32) {
 +        tcg_out_ld(s, TCG_TYPE_PTR, TCG_AREG0, TCG_REG_ESP,
 +                   (ARRAY_SIZE(tcg_target_callee_save_regs) + 1) * 4);
 +        tcg_out_addi(s, TCG_REG_ESP, -stack_addend);
 +        /* jmp *tb.  */
 +        tcg_out_modrm_offset(s, OPC_GRP5, EXT5_JMPN_Ev, TCG_REG_ESP,
 +                             (ARRAY_SIZE(tcg_target_callee_save_regs) + 2) * 4
 +                             + stack_addend);
 +    } else {
 +        tcg_out_mov(s, TCG_TYPE_PTR, TCG_AREG0, tcg_target_call_iarg_regs[0]);
 +        tcg_out_addi(s, TCG_REG_ESP, -stack_addend);
 +        /* jmp *tb.  */
 +        tcg_out_modrm(s, OPC_GRP5, EXT5_JMPN_Ev, tcg_target_call_iarg_regs[1]);
 +    }
      /*
       * Return path for goto_ptr. Set return value to 0, a-la exit_tb,
 --
 .34.1

-[PULL 2/7] linux-user/sparc: Raise SIGILL for all unhandled software traps
+Deleted patch
-The linux kernel's trap tables vector all unassigned trap
-numbers to BAD_TRAP, which then raises SIGILL.
-Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Reported-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- linux-user/sparc/cpu_loop.c | 8 ++++++++
-file changed, 8 insertions(+)
-diff --git a/linux-user/sparc/cpu_loop.c b/linux-user/sparc/cpu_loop.c
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/sparc/cpu_loop.c
-+++ b/linux-user/sparc/cpu_loop.c
-@@ -XXX,XX +XXX,XX @@ void cpu_loop (CPUSPARCState *env)
-             cpu_exec_step_atomic(cs);
-             break;
-         default:
-+            /*
-+             * Most software trap numbers vector to BAD_TRAP.
-+             * Handle anything not explicitly matched above.
-+             */
-+            if (trapnr >= TT_TRAP && trapnr <= TT_TRAP + 0x7f) {
-+                force_sig_fault(TARGET_SIGILL, ILL_ILLTRP, env->pc);
-+                break;
-+            }
-             fprintf(stderr, "Unhandled trap: 0x%x\n", trapnr);
-             cpu_dump_state(cs, stderr, 0);
-             exit(EXIT_FAILURE);
---
-.34.1

-[PULL 3/7] linux-user: Always exit from exclusive state in fork_end()
+Deleted patch
-From: Ilya Leoshkevich <iii@linux.ibm.com>
-fork()ed processes currently start with
-current_cpu->in_exclusive_context set, which is, strictly speaking, not
-correct, but does not cause problems (even assertion failures).
-With one of the next patches, the code begins to rely on this value, so
-fix it by always calling end_exclusive() in fork_end().
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Message-Id: <20230214140829.45392-2-iii@linux.ibm.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- linux-user/main.c    | 10 ++++++----
- linux-user/syscall.c |  1 +
-files changed, 7 insertions(+), 4 deletions(-)
-diff --git a/linux-user/main.c b/linux-user/main.c
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/main.c
-+++ b/linux-user/main.c
-@@ -XXX,XX +XXX,XX @@ void fork_end(int child)
-         }
-         qemu_init_cpu_list();
-         gdbserver_fork(thread_cpu);
--        /* qemu_init_cpu_list() takes care of reinitializing the
--         * exclusive state, so we don't need to end_exclusive() here.
--         */
-     } else {
-         cpu_list_unlock();
--        end_exclusive();
-     }
-+    /*
-+     * qemu_init_cpu_list() reinitialized the child exclusive state, but we
-+     * also need to keep current_cpu consistent, so call end_exclusive() for
-+     * both child and parent.
-+     */
-+    end_exclusive();
- }
- __thread CPUState *thread_cpu;
-diff --git a/linux-user/syscall.c b/linux-user/syscall.c
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/syscall.c
-+++ b/linux-user/syscall.c
-@@ -XXX,XX +XXX,XX @@ static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,
-             cpu_clone_regs_parent(env, flags);
-             fork_end(0);
-         }
-+        g_assert(!cpu_in_exclusive_context(cpu));
-     }
-     return ret;
- }
---
-.34.1

-[PULL 4/7] cpus: Make {start,end}_exclusive() recursive
+Deleted patch
-From: Ilya Leoshkevich <iii@linux.ibm.com>
-Currently dying to one of the core_dump_signal()s deadlocks, because
-dump_core_and_abort() calls start_exclusive() two times: first via
-stop_all_tasks(), and then via preexit_cleanup() ->
-qemu_plugin_user_exit().
-There are a number of ways to solve this: resume after dumping core;
-check cpu_in_exclusive_context() in qemu_plugin_user_exit(); or make
-{start,end}_exclusive() recursive. Pick the last option, since it's
-the most straightforward one.
-Fixes: da91c1920242 ("linux-user: Clean up when exiting due to a signal")
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Message-Id: <20230214140829.45392-3-iii@linux.ibm.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/hw/core/cpu.h |  4 ++--
- cpus-common.c         | 12 ++++++++++--
-files changed, 12 insertions(+), 4 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
-+++ b/include/hw/core/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct CPUState {
-     bool unplug;
-     bool crash_occurred;
-     bool exit_request;
--    bool in_exclusive_context;
-+    int exclusive_context_count;
-     uint32_t cflags_next_tb;
-     /* updates protected by BQL */
-     uint32_t interrupt_request;
-@@ -XXX,XX +XXX,XX @@ void async_safe_run_on_cpu(CPUState *cpu, run_on_cpu_func func, run_on_cpu_data
-  */
- static inline bool cpu_in_exclusive_context(const CPUState *cpu)
- {
--    return cpu->in_exclusive_context;
-+    return cpu->exclusive_context_count;
- }
- /**
-diff --git a/cpus-common.c b/cpus-common.c
-index XXXXXXX..XXXXXXX 100644
---- a/cpus-common.c
-+++ b/cpus-common.c
-@@ -XXX,XX +XXX,XX @@ void start_exclusive(void)
-     CPUState *other_cpu;
-     int running_cpus;
-+    if (current_cpu->exclusive_context_count) {
-+        current_cpu->exclusive_context_count++;
-+        return;
-+    }
-+
-     qemu_mutex_lock(&qemu_cpu_list_lock);
-     exclusive_idle();
-@@ -XXX,XX +XXX,XX @@ void start_exclusive(void)
-      */
-     qemu_mutex_unlock(&qemu_cpu_list_lock);
--    current_cpu->in_exclusive_context = true;
-+    current_cpu->exclusive_context_count = 1;
- }
- /* Finish an exclusive operation.  */
- void end_exclusive(void)
- {
--    current_cpu->in_exclusive_context = false;
-+    current_cpu->exclusive_context_count--;
-+    if (current_cpu->exclusive_context_count) {
-+        return;
-+    }
-     qemu_mutex_lock(&qemu_cpu_list_lock);
-     qatomic_set(&pending_cpus, 0);
---
-.34.1

-[PULL 5/7] linux-user/microblaze: Handle privileged exception
+Deleted patch
-From: Ilya Leoshkevich <iii@linux.ibm.com>
-Follow what kernel's full_exception() is doing.
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Message-Id: <20230214140829.45392-4-iii@linux.ibm.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- linux-user/microblaze/cpu_loop.c | 10 ++++++++--
-file changed, 8 insertions(+), 2 deletions(-)
-diff --git a/linux-user/microblaze/cpu_loop.c b/linux-user/microblaze/cpu_loop.c
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/microblaze/cpu_loop.c
-+++ b/linux-user/microblaze/cpu_loop.c
-@@ -XXX,XX +XXX,XX @@
- void cpu_loop(CPUMBState *env)
- {
-+    int trapnr, ret, si_code, sig;
-     CPUState *cs = env_cpu(env);
--    int trapnr, ret, si_code;
-     while (1) {
-         cpu_exec_start(cs);
-@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUMBState *env)
-             env->iflags &= ~(IMM_FLAG | D_FLAG);
-             switch (env->esr & 31) {
-             case ESR_EC_DIVZERO:
-+                sig = TARGET_SIGFPE;
-                 si_code = TARGET_FPE_INTDIV;
-                 break;
-             case ESR_EC_FPU:
-@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUMBState *env)
-                  * if there's no recognized bit set.  Possibly this
-                  * implies that si_code is 0, but follow the structure.
-                  */
-+                sig = TARGET_SIGFPE;
-                 si_code = env->fsr;
-                 if (si_code & FSR_IO) {
-                     si_code = TARGET_FPE_FLTINV;
-@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUMBState *env)
-                     si_code = TARGET_FPE_FLTRES;
-                 }
-                 break;
-+            case ESR_EC_PRIVINSN:
-+                sig = SIGILL;
-+                si_code = ILL_PRVOPC;
-+                break;
-             default:
-                 fprintf(stderr, "Unhandled hw-exception: 0x%x\n",
-                         env->esr & ESR_EC_MASK);
-                 cpu_dump_state(cs, stderr, 0);
-                 exit(EXIT_FAILURE);
-             }
--            force_sig_fault(TARGET_SIGFPE, si_code, env->pc);
-+            force_sig_fault(sig, si_code, env->pc);
-             break;
-         case EXCP_DEBUG:
---
-.34.1

-[PULL 6/7] tests/tcg/linux-test: Add linux-fork-trap test
+Deleted patch
-From: Ilya Leoshkevich <iii@linux.ibm.com>
-Check that dying due to a signal does not deadlock.
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Message-Id: <20230214140829.45392-5-iii@linux.ibm.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tests/tcg/multiarch/linux/linux-fork-trap.c | 51 +++++++++++++++++++++
-file changed, 51 insertions(+)
- create mode 100644 tests/tcg/multiarch/linux/linux-fork-trap.c
-diff --git a/tests/tcg/multiarch/linux/linux-fork-trap.c b/tests/tcg/multiarch/linux/linux-fork-trap.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/tests/tcg/multiarch/linux/linux-fork-trap.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * Test that a fork()ed process terminates after __builtin_trap().
-+ *
-+ * SPDX-License-Identifier: GPL-2.0-or-later
-+ */
-+#include <assert.h>
-+#include <stdio.h>
-+#include <stdlib.h>
-+#include <sys/resource.h>
-+#include <sys/wait.h>
-+#include <unistd.h>
-+
-+int main(void)
-+{
-+    struct rlimit nodump;
-+    pid_t err, pid;
-+    int wstatus;
-+
-+    pid = fork();
-+    assert(pid != -1);
-+    if (pid == 0) {
-+        /* We are about to crash on purpose; disable core dumps. */
-+        if (getrlimit(RLIMIT_CORE, &nodump)) {
-+            return EXIT_FAILURE;
-+        }
-+        nodump.rlim_cur = 0;
-+        if (setrlimit(RLIMIT_CORE, &nodump)) {
-+            return EXIT_FAILURE;
-+        }
-+        /*
-+         * An alternative would be to dereference a NULL pointer, but that
-+         * would be an UB in C.
-+         */
-+        printf("about to trigger fault...\n");
-+#if defined(__MICROBLAZE__)
-+        /*
-+         * gcc emits "bri 0", which is an endless loop.
-+         * Take glibc's ABORT_INSTRUCTION.
-+         */
-+        asm volatile("brki r0,-1");
-+#else
-+        __builtin_trap();
-+#endif
-+    }
-+    err = waitpid(pid, &wstatus, 0);
-+    assert(err == pid);
-+    assert(WIFSIGNALED(wstatus));
-+    printf("faulting thread exited cleanly\n");
-+
-+    return EXIT_SUCCESS;
-+}
---
-.34.1

-[PULL 7/7] target/microblaze: Add gdbstub xml
+Deleted patch
-Mirroring the upstream gdb xml files, the two stack boundary
-registers are separated out.
-Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- configs/targets/microblaze-linux-user.mak   |  1 +
- configs/targets/microblaze-softmmu.mak      |  1 +
- configs/targets/microblazeel-linux-user.mak |  1 +
- configs/targets/microblazeel-softmmu.mak    |  1 +
- target/microblaze/cpu.h                     |  2 +
- target/microblaze/cpu.c                     |  7 ++-
- target/microblaze/gdbstub.c                 | 51 +++++++++++-----
- gdb-xml/microblaze-core.xml                 | 67 +++++++++++++++++++++
- gdb-xml/microblaze-stack-protect.xml        | 12 ++++
-files changed, 128 insertions(+), 15 deletions(-)
- create mode 100644 gdb-xml/microblaze-core.xml
- create mode 100644 gdb-xml/microblaze-stack-protect.xml
-diff --git a/configs/targets/microblaze-linux-user.mak b/configs/targets/microblaze-linux-user.mak
-index XXXXXXX..XXXXXXX 100644
---- a/configs/targets/microblaze-linux-user.mak
-+++ b/configs/targets/microblaze-linux-user.mak
-@@ -XXX,XX +XXX,XX @@ TARGET_SYSTBL_ABI=common
- TARGET_SYSTBL=syscall.tbl
- TARGET_BIG_ENDIAN=y
- TARGET_HAS_BFLT=y
-+TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
-diff --git a/configs/targets/microblaze-softmmu.mak b/configs/targets/microblaze-softmmu.mak
-index XXXXXXX..XXXXXXX 100644
---- a/configs/targets/microblaze-softmmu.mak
-+++ b/configs/targets/microblaze-softmmu.mak
-@@ -XXX,XX +XXX,XX @@ TARGET_ARCH=microblaze
- TARGET_BIG_ENDIAN=y
- TARGET_SUPPORTS_MTTCG=y
- TARGET_NEED_FDT=y
-+TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
-diff --git a/configs/targets/microblazeel-linux-user.mak b/configs/targets/microblazeel-linux-user.mak
-index XXXXXXX..XXXXXXX 100644
---- a/configs/targets/microblazeel-linux-user.mak
-+++ b/configs/targets/microblazeel-linux-user.mak
-@@ -XXX,XX +XXX,XX @@ TARGET_ARCH=microblaze
- TARGET_SYSTBL_ABI=common
- TARGET_SYSTBL=syscall.tbl
- TARGET_HAS_BFLT=y
-+TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
-diff --git a/configs/targets/microblazeel-softmmu.mak b/configs/targets/microblazeel-softmmu.mak
-index XXXXXXX..XXXXXXX 100644
---- a/configs/targets/microblazeel-softmmu.mak
-+++ b/configs/targets/microblazeel-softmmu.mak
-@@ -XXX,XX +XXX,XX @@
- TARGET_ARCH=microblaze
- TARGET_SUPPORTS_MTTCG=y
- TARGET_NEED_FDT=y
-+TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
-diff --git a/target/microblaze/cpu.h b/target/microblaze/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/microblaze/cpu.h
-+++ b/target/microblaze/cpu.h
-@@ -XXX,XX +XXX,XX @@ hwaddr mb_cpu_get_phys_page_attrs_debug(CPUState *cpu, vaddr addr,
-                                         MemTxAttrs *attrs);
- int mb_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
- int mb_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
-+int mb_cpu_gdb_read_stack_protect(CPUArchState *cpu, GByteArray *buf, int reg);
-+int mb_cpu_gdb_write_stack_protect(CPUArchState *cpu, uint8_t *buf, int reg);
- static inline uint32_t mb_cpu_read_msr(const CPUMBState *env)
- {
-diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/microblaze/cpu.c
-+++ b/target/microblaze/cpu.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/module.h"
- #include "hw/qdev-properties.h"
- #include "exec/exec-all.h"
-+#include "exec/gdbstub.h"
- #include "fpu/softfloat-helpers.h"
- static const struct {
-@@ -XXX,XX +XXX,XX @@ static void mb_cpu_initfn(Object *obj)
-     CPUMBState *env = &cpu->env;
-     cpu_set_cpustate_pointers(cpu);
-+    gdb_register_coprocessor(CPU(cpu), mb_cpu_gdb_read_stack_protect,
-+                             mb_cpu_gdb_write_stack_protect, 2,
-+                             "microblaze-stack-protect.xml", 0);
-     set_float_rounding_mode(float_round_nearest_even, &env->fp_status);
-@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
-     cc->sysemu_ops = &mb_sysemu_ops;
- #endif
-     device_class_set_props(dc, mb_properties);
--    cc->gdb_num_core_regs = 32 + 27;
-+    cc->gdb_num_core_regs = 32 + 25;
-+    cc->gdb_core_xml_file = "microblaze-core.xml";
-     cc->disas_set_info = mb_disas_set_info;
-     cc->tcg_ops = &mb_tcg_ops;
-diff --git a/target/microblaze/gdbstub.c b/target/microblaze/gdbstub.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/microblaze/gdbstub.c
-+++ b/target/microblaze/gdbstub.c
-@@ -XXX,XX +XXX,XX @@ enum {
-     GDB_PVR0  = 32 + 6,
-     GDB_PVR11 = 32 + 17,
-     GDB_EDR   = 32 + 18,
--    GDB_SLR   = 32 + 25,
--    GDB_SHR   = 32 + 26,
-+};
-+
-+enum {
-+    GDB_SP_SHL,
-+    GDB_SP_SHR,
- };
- int mb_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
-@@ -XXX,XX +XXX,XX @@ int mb_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
-     case GDB_EDR:
-         val = env->edr;
-         break;
--    case GDB_SLR:
--        val = env->slr;
--        break;
--    case GDB_SHR:
--        val = env->shr;
--        break;
-     default:
-         /* Other SRegs aren't modeled, so report a value of 0 */
-         val = 0;
-@@ -XXX,XX +XXX,XX @@ int mb_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
-     return gdb_get_reg32(mem_buf, val);
- }
-+int mb_cpu_gdb_read_stack_protect(CPUMBState *env, GByteArray *mem_buf, int n)
-+{
-+    uint32_t val;
-+
-+    switch (n) {
-+    case GDB_SP_SHL:
-+        val = env->slr;
-+        break;
-+    case GDB_SP_SHR:
-+        val = env->shr;
-+        break;
-+    default:
-+        return 0;
-+    }
-+    return gdb_get_reg32(mem_buf, val);
-+}
-+
- int mb_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
- {
-     MicroBlazeCPU *cpu = MICROBLAZE_CPU(cs);
-@@ -XXX,XX +XXX,XX @@ int mb_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
-     case GDB_EDR:
-         env->edr = tmp;
-         break;
--    case GDB_SLR:
--        env->slr = tmp;
--        break;
--    case GDB_SHR:
--        env->shr = tmp;
--        break;
-+    }
-+    return 4;
-+}
-+
-+int mb_cpu_gdb_write_stack_protect(CPUMBState *env, uint8_t *mem_buf, int n)
-+{
-+    switch (n) {
-+    case GDB_SP_SHL:
-+        env->slr = ldl_p(mem_buf);
-+        break;
-+    case GDB_SP_SHR:
-+        env->shr = ldl_p(mem_buf);
-+        break;
-+    default:
-+        return 0;
-     }
-     return 4;
- }
-diff --git a/gdb-xml/microblaze-core.xml b/gdb-xml/microblaze-core.xml
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/gdb-xml/microblaze-core.xml
-@@ -XXX,XX +XXX,XX @@
-+<?xml version="1.0"?>
-+<!-- Copyright (C) 2008 Free Software Foundation, Inc.
-+
-+     Copying and distribution of this file, with or without modification,
-+     are permitted in any medium without royalty provided the copyright
-+     notice and this notice are preserved.  -->
-+
-+<!DOCTYPE feature SYSTEM "gdb-target.dtd">
-+<feature name="org.gnu.gdb.microblaze.core">
-+  <reg name="r0" bitsize="32" regnum="0"/>
-+  <reg name="r1" bitsize="32" type="data_ptr"/>
-+  <reg name="r2" bitsize="32"/>
-+  <reg name="r3" bitsize="32"/>
-+  <reg name="r4" bitsize="32"/>
-+  <reg name="r5" bitsize="32"/>
-+  <reg name="r6" bitsize="32"/>
-+  <reg name="r7" bitsize="32"/>
-+  <reg name="r8" bitsize="32"/>
-+  <reg name="r9" bitsize="32"/>
-+  <reg name="r10" bitsize="32"/>
-+  <reg name="r11" bitsize="32"/>
-+  <reg name="r12" bitsize="32"/>
-+  <reg name="r13" bitsize="32"/>
-+  <reg name="r14" bitsize="32"/>
-+  <reg name="r15" bitsize="32"/>
-+  <reg name="r16" bitsize="32"/>
-+  <reg name="r17" bitsize="32"/>
-+  <reg name="r18" bitsize="32"/>
-+  <reg name="r19" bitsize="32"/>
-+  <reg name="r20" bitsize="32"/>
-+  <reg name="r21" bitsize="32"/>
-+  <reg name="r22" bitsize="32"/>
-+  <reg name="r23" bitsize="32"/>
-+  <reg name="r24" bitsize="32"/>
-+  <reg name="r25" bitsize="32"/>
-+  <reg name="r26" bitsize="32"/>
-+  <reg name="r27" bitsize="32"/>
-+  <reg name="r28" bitsize="32"/>
-+  <reg name="r29" bitsize="32"/>
-+  <reg name="r30" bitsize="32"/>
-+  <reg name="r31" bitsize="32"/>
-+  <reg name="rpc" bitsize="32" type="code_ptr"/>
-+  <reg name="rmsr" bitsize="32"/>
-+  <reg name="rear" bitsize="32"/>
-+  <reg name="resr" bitsize="32"/>
-+  <reg name="rfsr" bitsize="32"/>
-+  <reg name="rbtr" bitsize="32"/>
-+  <reg name="rpvr0" bitsize="32"/>
-+  <reg name="rpvr1" bitsize="32"/>
-+  <reg name="rpvr2" bitsize="32"/>
-+  <reg name="rpvr3" bitsize="32"/>
-+  <reg name="rpvr4" bitsize="32"/>
-+  <reg name="rpvr5" bitsize="32"/>
-+  <reg name="rpvr6" bitsize="32"/>
-+  <reg name="rpvr7" bitsize="32"/>
-+  <reg name="rpvr8" bitsize="32"/>
-+  <reg name="rpvr9" bitsize="32"/>
-+  <reg name="rpvr10" bitsize="32"/>
-+  <reg name="rpvr11" bitsize="32"/>
-+  <reg name="redr" bitsize="32"/>
-+  <reg name="rpid" bitsize="32"/>
-+  <reg name="rzpr" bitsize="32"/>
-+  <reg name="rtlbx" bitsize="32"/>
-+  <reg name="rtlbsx" bitsize="32"/>
-+  <reg name="rtlblo" bitsize="32"/>
-+  <reg name="rtlbhi" bitsize="32"/>
-+</feature>
-diff --git a/gdb-xml/microblaze-stack-protect.xml b/gdb-xml/microblaze-stack-protect.xml
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/gdb-xml/microblaze-stack-protect.xml
-@@ -XXX,XX +XXX,XX @@
-+<?xml version="1.0"?>
-+<!-- Copyright (C) 2008 Free Software Foundation, Inc.
-+
-+     Copying and distribution of this file, with or without modification,
-+     are permitted in any medium without royalty provided the copyright
-+     notice and this notice are preserved.  -->
-+
-+<!DOCTYPE feature SYSTEM "gdb-target.dtd">
-+<feature name="org.gnu.gdb.microblaze.stack-protect">
-+  <reg name="rslr" bitsize="32"/>
-+  <reg name="rshr" bitsize="32"/>
-+</feature>
---
-.34.1

The linux-user patches are on the tcg-ish side of user-only
emulation, rather than the syscall-ish side, so queuing here.
Solving the deadlock issue is quite important vs timeouts.

The following changes since commit 6dffbe36af79e26a4d23f94a9a1c1201de99c261:

Merge tag 'migration-20230215-pull-request' of https://gitlab.com/juan.quintela/qemu into staging (2023-02-16 13:09:51 +0000)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20230219

for you to fetch changes up to 2f5b4792c0220920831ac84f94c3435b14791857:

target/microblaze: Add gdbstub xml (2023-02-19 16:12:26 -1000)

----------------------------------------------------------------
tcg: Allow first half of insn in ram, and second half in mmio
linux-user/sparc: SIGILL for unknown trap vectors
linux-user/microblaze: SIGILL for privileged insns
linux-user: Fix deadlock while exiting due to signal
target/microblaze: Add gdbstub xml

----------------------------------------------------------------
Ilya Leoshkevich (4):
      linux-user: Always exit from exclusive state in fork_end()
      cpus: Make {start,end}_exclusive() recursive
      linux-user/microblaze: Handle privileged exception
      tests/tcg/linux-test: Add linux-fork-trap test

Richard Henderson (3):
      accel/tcg: Allow the second page of an instruction to be MMIO
      linux-user/sparc: Raise SIGILL for all unhandled software traps
      target/microblaze: Add gdbstub xml

configs/targets/microblaze-linux-user.mak   |  1 +
 configs/targets/microblaze-softmmu.mak      |  1 +
 configs/targets/microblazeel-linux-user.mak |  1 +
 configs/targets/microblazeel-softmmu.mak    |  1 +
 include/hw/core/cpu.h                       |  4 +-
 target/microblaze/cpu.h                     |  2 +
 accel/tcg/translator.c                      | 12 +++++-
 cpus-common.c                               | 12 +++++-
 linux-user/main.c                           | 10 +++--
 linux-user/microblaze/cpu_loop.c            | 10 ++++-
 linux-user/sparc/cpu_loop.c                 |  8 ++++
 linux-user/syscall.c                        |  1 +
 target/microblaze/cpu.c                     |  7 ++-
 target/microblaze/gdbstub.c                 | 51 ++++++++++++++++------
 tests/tcg/multiarch/linux/linux-fork-trap.c | 51 ++++++++++++++++++++++
 gdb-xml/microblaze-core.xml                 | 67 +++++++++++++++++++++++++++++
 gdb-xml/microblaze-stack-protect.xml        | 12 ++++++
 17 files changed, 224 insertions(+), 27 deletions(-)
 create mode 100644 tests/tcg/multiarch/linux/linux-fork-trap.c
 create mode 100644 gdb-xml/microblaze-core.xml
 create mode 100644 gdb-xml/microblaze-stack-protect.xml

If an instruction straddles a page boundary, and the first page
was ram, but the second page was MMIO, we would abort.  Handle
this as if both pages are MMIO, by setting the ram_addr_t for
the first page to -1.

Reported-by: Sid Manning <sidneym@quicinc.com>
Reported-by: Jørgen Hansen <Jorgen.Hansen@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/translator.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translator.c
+++ b/accel/tcg/translator.c
@@ -XXX,XX +XXX,XX @@ static void *translator_access(CPUArchState *env, DisasContextBase *db,
         if (host == NULL) {
             tb_page_addr_t phys_page =
                 get_page_addr_code_hostp(env, base, &db->host_addr[1]);
-            /* We cannot handle MMIO as second page. */
-            assert(phys_page != -1);
+
+            /*
+             * If the second page is MMIO, treat as if the first page
+             * was MMIO as well, so that we do not cache the TB.
+             */
+            if (unlikely(phys_page == -1)) {
+                tb_set_page_addr0(tb, -1);
+                return NULL;
+            }
+
             tb_set_page_addr1(tb, phys_page);
 #ifdef CONFIG_USER_ONLY
             page_protect(end);
-- 
2.34.1

The linux kernel's trap tables vector all unassigned trap
numbers to BAD_TRAP, which then raises SIGILL.

Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reported-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/sparc/cpu_loop.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/linux-user/sparc/cpu_loop.c b/linux-user/sparc/cpu_loop.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/sparc/cpu_loop.c
+++ b/linux-user/sparc/cpu_loop.c
@@ -XXX,XX +XXX,XX @@ void cpu_loop (CPUSPARCState *env)
             cpu_exec_step_atomic(cs);
             break;
         default:
+            /*
+             * Most software trap numbers vector to BAD_TRAP.
+             * Handle anything not explicitly matched above.
+             */
+            if (trapnr >= TT_TRAP && trapnr <= TT_TRAP + 0x7f) {
+                force_sig_fault(TARGET_SIGILL, ILL_ILLTRP, env->pc);
+                break;
+            }
             fprintf(stderr, "Unhandled trap: 0x%x\n", trapnr);
             cpu_dump_state(cs, stderr, 0);
             exit(EXIT_FAILURE);
-- 
2.34.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

fork()ed processes currently start with
current_cpu->in_exclusive_context set, which is, strictly speaking, not
correct, but does not cause problems (even assertion failures).

With one of the next patches, the code begins to rely on this value, so
fix it by always calling end_exclusive() in fork_end().

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230214140829.45392-2-iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/main.c    | 10 ++++++----
 linux-user/syscall.c |  1 +
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/linux-user/main.c b/linux-user/main.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -XXX,XX +XXX,XX @@ void fork_end(int child)
         }
         qemu_init_cpu_list();
         gdbserver_fork(thread_cpu);
-        /* qemu_init_cpu_list() takes care of reinitializing the
-         * exclusive state, so we don't need to end_exclusive() here.
-         */
     } else {
         cpu_list_unlock();
-        end_exclusive();
     }
+    /*
+     * qemu_init_cpu_list() reinitialized the child exclusive state, but we
+     * also need to keep current_cpu consistent, so call end_exclusive() for
+     * both child and parent.
+     */
+    end_exclusive();
 }
 
 __thread CPUState *thread_cpu;
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -XXX,XX +XXX,XX @@ static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,
             cpu_clone_regs_parent(env, flags);
             fork_end(0);
         }
+        g_assert(!cpu_in_exclusive_context(cpu));
     }
     return ret;
 }
-- 
2.34.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

Currently dying to one of the core_dump_signal()s deadlocks, because
dump_core_and_abort() calls start_exclusive() two times: first via
stop_all_tasks(), and then via preexit_cleanup() ->
qemu_plugin_user_exit().

There are a number of ways to solve this: resume after dumping core;
check cpu_in_exclusive_context() in qemu_plugin_user_exit(); or make
{start,end}_exclusive() recursive. Pick the last option, since it's
the most straightforward one.

Fixes: da91c1920242 ("linux-user: Clean up when exiting due to a signal")
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230214140829.45392-3-iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h |  4 ++--
 cpus-common.c         | 12 ++++++++++--
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPUState {
     bool unplug;
     bool crash_occurred;
     bool exit_request;
-    bool in_exclusive_context;
+    int exclusive_context_count;
     uint32_t cflags_next_tb;
     /* updates protected by BQL */
     uint32_t interrupt_request;
@@ -XXX,XX +XXX,XX @@ void async_safe_run_on_cpu(CPUState *cpu, run_on_cpu_func func, run_on_cpu_data
  */
 static inline bool cpu_in_exclusive_context(const CPUState *cpu)
 {
-    return cpu->in_exclusive_context;
+    return cpu->exclusive_context_count;
 }
 
 /**
diff --git a/cpus-common.c b/cpus-common.c
index XXXXXXX..XXXXXXX 100644
--- a/cpus-common.c
+++ b/cpus-common.c
@@ -XXX,XX +XXX,XX @@ void start_exclusive(void)
     CPUState *other_cpu;
     int running_cpus;
 
+    if (current_cpu->exclusive_context_count) {
+        current_cpu->exclusive_context_count++;
+        return;
+    }
+
     qemu_mutex_lock(&qemu_cpu_list_lock);
     exclusive_idle();
 
@@ -XXX,XX +XXX,XX @@ void start_exclusive(void)
      */
     qemu_mutex_unlock(&qemu_cpu_list_lock);
 
-    current_cpu->in_exclusive_context = true;
+    current_cpu->exclusive_context_count = 1;
 }
 
 /* Finish an exclusive operation.  */
 void end_exclusive(void)
 {
-    current_cpu->in_exclusive_context = false;
+    current_cpu->exclusive_context_count--;
+    if (current_cpu->exclusive_context_count) {
+        return;
+    }
 
     qemu_mutex_lock(&qemu_cpu_list_lock);
     qatomic_set(&pending_cpus, 0);
-- 
2.34.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

Follow what kernel's full_exception() is doing.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230214140829.45392-4-iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/microblaze/cpu_loop.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/linux-user/microblaze/cpu_loop.c b/linux-user/microblaze/cpu_loop.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/microblaze/cpu_loop.c
+++ b/linux-user/microblaze/cpu_loop.c
@@ -XXX,XX +XXX,XX @@
 
 void cpu_loop(CPUMBState *env)
 {
+    int trapnr, ret, si_code, sig;
     CPUState *cs = env_cpu(env);
-    int trapnr, ret, si_code;
 
     while (1) {
         cpu_exec_start(cs);
@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUMBState *env)
             env->iflags &= ~(IMM_FLAG | D_FLAG);
             switch (env->esr & 31) {
             case ESR_EC_DIVZERO:
+                sig = TARGET_SIGFPE;
                 si_code = TARGET_FPE_INTDIV;
                 break;
             case ESR_EC_FPU:
@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUMBState *env)
                  * if there's no recognized bit set.  Possibly this
                  * implies that si_code is 0, but follow the structure.
                  */
+                sig = TARGET_SIGFPE;
                 si_code = env->fsr;
                 if (si_code & FSR_IO) {
                     si_code = TARGET_FPE_FLTINV;
@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUMBState *env)
                     si_code = TARGET_FPE_FLTRES;
                 }
                 break;
+            case ESR_EC_PRIVINSN:
+                sig = SIGILL;
+                si_code = ILL_PRVOPC;
+                break;
             default:
                 fprintf(stderr, "Unhandled hw-exception: 0x%x\n",
                         env->esr & ESR_EC_MASK);
                 cpu_dump_state(cs, stderr, 0);
                 exit(EXIT_FAILURE);
             }
-            force_sig_fault(TARGET_SIGFPE, si_code, env->pc);
+            force_sig_fault(sig, si_code, env->pc);
             break;
 
         case EXCP_DEBUG:
-- 
2.34.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

Check that dying due to a signal does not deadlock.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230214140829.45392-5-iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tests/tcg/multiarch/linux/linux-fork-trap.c | 51 +++++++++++++++++++++
 1 file changed, 51 insertions(+)
 create mode 100644 tests/tcg/multiarch/linux/linux-fork-trap.c

diff --git a/tests/tcg/multiarch/linux/linux-fork-trap.c b/tests/tcg/multiarch/linux/linux-fork-trap.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/multiarch/linux/linux-fork-trap.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Test that a fork()ed process terminates after __builtin_trap().
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+#include <assert.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/resource.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+int main(void)
+{
+    struct rlimit nodump;
+    pid_t err, pid;
+    int wstatus;
+
+    pid = fork();
+    assert(pid != -1);
+    if (pid == 0) {
+        /* We are about to crash on purpose; disable core dumps. */
+        if (getrlimit(RLIMIT_CORE, &nodump)) {
+            return EXIT_FAILURE;
+        }
+        nodump.rlim_cur = 0;
+        if (setrlimit(RLIMIT_CORE, &nodump)) {
+            return EXIT_FAILURE;
+        }
+        /*
+         * An alternative would be to dereference a NULL pointer, but that
+         * would be an UB in C.
+         */
+        printf("about to trigger fault...\n");
+#if defined(__MICROBLAZE__)
+        /*
+         * gcc emits "bri 0", which is an endless loop.
+         * Take glibc's ABORT_INSTRUCTION.
+         */
+        asm volatile("brki r0,-1");
+#else
+        __builtin_trap();
+#endif
+    }
+    err = waitpid(pid, &wstatus, 0);
+    assert(err == pid);
+    assert(WIFSIGNALED(wstatus));
+    printf("faulting thread exited cleanly\n");
+
+    return EXIT_SUCCESS;
+}
-- 
2.34.1

Mirroring the upstream gdb xml files, the two stack boundary
registers are separated out.

Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 configs/targets/microblaze-linux-user.mak   |  1 +
 configs/targets/microblaze-softmmu.mak      |  1 +
 configs/targets/microblazeel-linux-user.mak |  1 +
 configs/targets/microblazeel-softmmu.mak    |  1 +
 target/microblaze/cpu.h                     |  2 +
 target/microblaze/cpu.c                     |  7 ++-
 target/microblaze/gdbstub.c                 | 51 +++++++++++-----
 gdb-xml/microblaze-core.xml                 | 67 +++++++++++++++++++++
 gdb-xml/microblaze-stack-protect.xml        | 12 ++++
 9 files changed, 128 insertions(+), 15 deletions(-)
 create mode 100644 gdb-xml/microblaze-core.xml
 create mode 100644 gdb-xml/microblaze-stack-protect.xml

diff --git a/configs/targets/microblaze-linux-user.mak b/configs/targets/microblaze-linux-user.mak
index XXXXXXX..XXXXXXX 100644
--- a/configs/targets/microblaze-linux-user.mak
+++ b/configs/targets/microblaze-linux-user.mak
@@ -XXX,XX +XXX,XX @@ TARGET_SYSTBL_ABI=common
 TARGET_SYSTBL=syscall.tbl
 TARGET_BIG_ENDIAN=y
 TARGET_HAS_BFLT=y
+TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
diff --git a/configs/targets/microblaze-softmmu.mak b/configs/targets/microblaze-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/configs/targets/microblaze-softmmu.mak
+++ b/configs/targets/microblaze-softmmu.mak
@@ -XXX,XX +XXX,XX @@ TARGET_ARCH=microblaze
 TARGET_BIG_ENDIAN=y
 TARGET_SUPPORTS_MTTCG=y
 TARGET_NEED_FDT=y
+TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
diff --git a/configs/targets/microblazeel-linux-user.mak b/configs/targets/microblazeel-linux-user.mak
index XXXXXXX..XXXXXXX 100644
--- a/configs/targets/microblazeel-linux-user.mak
+++ b/configs/targets/microblazeel-linux-user.mak
@@ -XXX,XX +XXX,XX @@ TARGET_ARCH=microblaze
 TARGET_SYSTBL_ABI=common
 TARGET_SYSTBL=syscall.tbl
 TARGET_HAS_BFLT=y
+TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
diff --git a/configs/targets/microblazeel-softmmu.mak b/configs/targets/microblazeel-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/configs/targets/microblazeel-softmmu.mak
+++ b/configs/targets/microblazeel-softmmu.mak
@@ -XXX,XX +XXX,XX @@
 TARGET_ARCH=microblaze
 TARGET_SUPPORTS_MTTCG=y
 TARGET_NEED_FDT=y
+TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
diff --git a/target/microblaze/cpu.h b/target/microblaze/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.h
+++ b/target/microblaze/cpu.h
@@ -XXX,XX +XXX,XX @@ hwaddr mb_cpu_get_phys_page_attrs_debug(CPUState *cpu, vaddr addr,
                                         MemTxAttrs *attrs);
 int mb_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
 int mb_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
+int mb_cpu_gdb_read_stack_protect(CPUArchState *cpu, GByteArray *buf, int reg);
+int mb_cpu_gdb_write_stack_protect(CPUArchState *cpu, uint8_t *buf, int reg);
 
 static inline uint32_t mb_cpu_read_msr(const CPUMBState *env)
 {
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/module.h"
 #include "hw/qdev-properties.h"
 #include "exec/exec-all.h"
+#include "exec/gdbstub.h"
 #include "fpu/softfloat-helpers.h"
 
 static const struct {
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_initfn(Object *obj)
     CPUMBState *env = &cpu->env;
 
     cpu_set_cpustate_pointers(cpu);
+    gdb_register_coprocessor(CPU(cpu), mb_cpu_gdb_read_stack_protect,
+                             mb_cpu_gdb_write_stack_protect, 2,
+                             "microblaze-stack-protect.xml", 0);
 
     set_float_rounding_mode(float_round_nearest_even, &env->fp_status);
 
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     cc->sysemu_ops = &mb_sysemu_ops;
 #endif
     device_class_set_props(dc, mb_properties);
-    cc->gdb_num_core_regs = 32 + 27;
+    cc->gdb_num_core_regs = 32 + 25;
+    cc->gdb_core_xml_file = "microblaze-core.xml";
 
     cc->disas_set_info = mb_disas_set_info;
     cc->tcg_ops = &mb_tcg_ops;
diff --git a/target/microblaze/gdbstub.c b/target/microblaze/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/gdbstub.c
+++ b/target/microblaze/gdbstub.c
@@ -XXX,XX +XXX,XX @@ enum {
     GDB_PVR0  = 32 + 6,
     GDB_PVR11 = 32 + 17,
     GDB_EDR   = 32 + 18,
-    GDB_SLR   = 32 + 25,
-    GDB_SHR   = 32 + 26,
+};
+
+enum {
+    GDB_SP_SHL,
+    GDB_SP_SHR,
 };
 
 int mb_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
@@ -XXX,XX +XXX,XX @@ int mb_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
     case GDB_EDR:
         val = env->edr;
         break;
-    case GDB_SLR:
-        val = env->slr;
-        break;
-    case GDB_SHR:
-        val = env->shr;
-        break;
     default:
         /* Other SRegs aren't modeled, so report a value of 0 */
         val = 0;
@@ -XXX,XX +XXX,XX @@ int mb_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
     return gdb_get_reg32(mem_buf, val);
 }
 
+int mb_cpu_gdb_read_stack_protect(CPUMBState *env, GByteArray *mem_buf, int n)
+{
+    uint32_t val;
+
+    switch (n) {
+    case GDB_SP_SHL:
+        val = env->slr;
+        break;
+    case GDB_SP_SHR:
+        val = env->shr;
+        break;
+    default:
+        return 0;
+    }
+    return gdb_get_reg32(mem_buf, val);
+}
+
 int mb_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
     MicroBlazeCPU *cpu = MICROBLAZE_CPU(cs);
@@ -XXX,XX +XXX,XX @@ int mb_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
     case GDB_EDR:
         env->edr = tmp;
         break;
-    case GDB_SLR:
-        env->slr = tmp;
-        break;
-    case GDB_SHR:
-        env->shr = tmp;
-        break;
+    }
+    return 4;
+}
+
+int mb_cpu_gdb_write_stack_protect(CPUMBState *env, uint8_t *mem_buf, int n)
+{
+    switch (n) {
+    case GDB_SP_SHL:
+        env->slr = ldl_p(mem_buf);
+        break;
+    case GDB_SP_SHR:
+        env->shr = ldl_p(mem_buf);
+        break;
+    default:
+        return 0;
     }
     return 4;
 }
diff --git a/gdb-xml/microblaze-core.xml b/gdb-xml/microblaze-core.xml
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/gdb-xml/microblaze-core.xml
@@ -XXX,XX +XXX,XX @@
+<?xml version="1.0"?>
+
+
+<!DOCTYPE feature SYSTEM "gdb-target.dtd">
+<feature name="org.gnu.gdb.microblaze.core">
+  <reg name="r0" bitsize="32" regnum="0"/>
+  <reg name="r1" bitsize="32" type="data_ptr"/>
+  <reg name="r2" bitsize="32"/>
+  <reg name="r3" bitsize="32"/>
+  <reg name="r4" bitsize="32"/>
+  <reg name="r5" bitsize="32"/>
+  <reg name="r6" bitsize="32"/>
+  <reg name="r7" bitsize="32"/>
+  <reg name="r8" bitsize="32"/>
+  <reg name="r9" bitsize="32"/>
+  <reg name="r10" bitsize="32"/>
+  <reg name="r11" bitsize="32"/>
+  <reg name="r12" bitsize="32"/>
+  <reg name="r13" bitsize="32"/>
+  <reg name="r14" bitsize="32"/>
+  <reg name="r15" bitsize="32"/>
+  <reg name="r16" bitsize="32"/>
+  <reg name="r17" bitsize="32"/>
+  <reg name="r18" bitsize="32"/>
+  <reg name="r19" bitsize="32"/>
+  <reg name="r20" bitsize="32"/>
+  <reg name="r21" bitsize="32"/>
+  <reg name="r22" bitsize="32"/>
+  <reg name="r23" bitsize="32"/>
+  <reg name="r24" bitsize="32"/>
+  <reg name="r25" bitsize="32"/>
+  <reg name="r26" bitsize="32"/>
+  <reg name="r27" bitsize="32"/>
+  <reg name="r28" bitsize="32"/>
+  <reg name="r29" bitsize="32"/>
+  <reg name="r30" bitsize="32"/>
+  <reg name="r31" bitsize="32"/>
+  <reg name="rpc" bitsize="32" type="code_ptr"/>
+  <reg name="rmsr" bitsize="32"/>
+  <reg name="rear" bitsize="32"/>
+  <reg name="resr" bitsize="32"/>
+  <reg name="rfsr" bitsize="32"/>
+  <reg name="rbtr" bitsize="32"/>
+  <reg name="rpvr0" bitsize="32"/>
+  <reg name="rpvr1" bitsize="32"/>
+  <reg name="rpvr2" bitsize="32"/>
+  <reg name="rpvr3" bitsize="32"/>
+  <reg name="rpvr4" bitsize="32"/>
+  <reg name="rpvr5" bitsize="32"/>
+  <reg name="rpvr6" bitsize="32"/>
+  <reg name="rpvr7" bitsize="32"/>
+  <reg name="rpvr8" bitsize="32"/>
+  <reg name="rpvr9" bitsize="32"/>
+  <reg name="rpvr10" bitsize="32"/>
+  <reg name="rpvr11" bitsize="32"/>
+  <reg name="redr" bitsize="32"/>
+  <reg name="rpid" bitsize="32"/>
+  <reg name="rzpr" bitsize="32"/>
+  <reg name="rtlbx" bitsize="32"/>
+  <reg name="rtlbsx" bitsize="32"/>
+  <reg name="rtlblo" bitsize="32"/>
+  <reg name="rtlbhi" bitsize="32"/>
+</feature>
diff --git a/gdb-xml/microblaze-stack-protect.xml b/gdb-xml/microblaze-stack-protect.xml
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/gdb-xml/microblaze-stack-protect.xml
@@ -XXX,XX +XXX,XX @@
+<?xml version="1.0"?>
+
+
+<!DOCTYPE feature SYSTEM "gdb-target.dtd">
+<feature name="org.gnu.gdb.microblaze.stack-protect">
+  <reg name="rslr" bitsize="32"/>
+  <reg name="rshr" bitsize="32"/>
+</feature>
-- 
2.34.1

v2: Fix FreeBSD build error in patch 18.

The following changes since commit 0d239e513e0117e66fa739fb71a43b9383a108ff:

Merge tag 'pull-lu-20231018' of https://gitlab.com/rth7680/qemu into staging (2023-10-19 10:20:57 -0700)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20231018-2

for you to fetch changes up to a75f704d972b9408f5e2843784b3add48c724c52:

target/i386: Use i128 for 128 and 256-bit loads and stores (2023-10-19 21:11:44 -0700)

----------------------------------------------------------------
tcg: Drop unused tcg_temp_free define
tcg: Introduce tcg_use_softmmu
tcg: Optimize past conditional branches
tcg: Use constant zero when expanding with divu2
tcg/ppc: Enable direct branching tcg_out_goto_tb with TCG_REG_TB
tcg/ppc: Use ADDPCIS for power9
tcg/ppc: Use prefixed instructions for power10
tcg/ppc: Disable TCG_REG_TB for Power9/Power10

----------------------------------------------------------------
Jordan Niethe (1):
      tcg/ppc: Enable direct branching tcg_out_goto_tb with TCG_REG_TB

Mike Frysinger (1):
      tcg: drop unused tcg_temp_free define

Richard Henderson (27):
      tcg/ppc: Untabify tcg-target.c.inc
      tcg/ppc: Reinterpret tb-relative to TB+4
      tcg/ppc: Use ADDPCIS in tcg_out_tb_start
      tcg/ppc: Use ADDPCIS in tcg_out_movi_int
      tcg/ppc: Use ADDPCIS for the constant pool
      tcg/ppc: Use ADDPCIS in tcg_out_goto_tb
      tcg/ppc: Use PADDI in tcg_out_movi
      tcg/ppc: Use prefixed instructions in tcg_out_mem_long
      tcg/ppc: Use PLD in tcg_out_movi for constant pool
      tcg/ppc: Use prefixed instructions in tcg_out_dupi_vec
      tcg/ppc: Use PLD in tcg_out_goto_tb
      tcg/ppc: Disable TCG_REG_TB for Power9/Power10
      tcg: Introduce tcg_use_softmmu
      tcg: Provide guest_base fallback for system mode
      tcg/arm: Use tcg_use_softmmu
      tcg/aarch64: Use tcg_use_softmmu
      tcg/i386: Use tcg_use_softmmu
      tcg/loongarch64: Use tcg_use_softmmu
      tcg/mips: Use tcg_use_softmmu
      tcg/ppc: Use tcg_use_softmmu
      tcg/riscv: Do not reserve TCG_GUEST_BASE_REG for guest_base zero
      tcg/riscv: Use tcg_use_softmmu
      tcg/s390x: Use tcg_use_softmmu
      tcg: Use constant zero when expanding with divu2
      tcg: Optimize past conditional branches
      tcg: Add tcg_gen_{ld,st}_i128
      target/i386: Use i128 for 128 and 256-bit loads and stores

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.c.inc | 198 +++++++++++++++++++-------------------
 1 file changed, 98 insertions(+), 100 deletions(-)

diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static TCGReg tcg_target_call_oarg_reg(TCGCallReturnKind kind, int slot)
 # define ALL_VECTOR_REGS       0x00ff0000u
 # define ALL_BYTEL_REGS        0x0000000fu
 #endif
-#ifdef CONFIG_SOFTMMU
-# define SOFTMMU_RESERVE_REGS  ((1 << TCG_REG_L0) | (1 << TCG_REG_L1))
-#else
-# define SOFTMMU_RESERVE_REGS  0
-#endif
+#define SOFTMMU_RESERVE_REGS \
+    (tcg_use_softmmu ? (1 << TCG_REG_L0) | (1 << TCG_REG_L1) : 0)
 
 /* For 64-bit, we always know that CMOV is available.  */
 #if TCG_TARGET_REG_BITS == 64
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
     return true;
 }
 
-#ifndef CONFIG_SOFTMMU
+#ifdef CONFIG_USER_ONLY
 static HostAddress x86_guest_base = {
     .index = -1
 };
@@ -XXX,XX +XXX,XX @@ static inline int setup_guest_base_seg(void)
     }
     return 0;
 }
+#define setup_guest_base_seg  setup_guest_base_seg
 #elif defined(__x86_64__) && \
       (defined (__FreeBSD__) || defined (__FreeBSD_kernel__))
 # include <machine/sysarch.h>
@@ -XXX,XX +XXX,XX @@ static inline int setup_guest_base_seg(void)
     }
     return 0;
 }
+#define setup_guest_base_seg  setup_guest_base_seg
+#endif
 #else
-static inline int setup_guest_base_seg(void)
-{
-    return 0;
-}
-#endif /* setup_guest_base_seg */
-#endif /* !SOFTMMU */
+# define x86_guest_base (*(HostAddress *)({ qemu_build_not_reached(); NULL; }))
+#endif /* CONFIG_USER_ONLY */
+#ifndef setup_guest_base_seg
+# define setup_guest_base_seg()  0
+#endif
 
 #define MIN_TLB_MASK_TABLE_OFS  INT_MIN
 
@@ -XXX,XX +XXX,XX @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
     MemOp s_bits = opc & MO_SIZE;
     unsigned a_mask;
 
-#ifdef CONFIG_SOFTMMU
-    h->index = TCG_REG_L0;
-    h->ofs = 0;
-    h->seg = 0;
-#else
-    *h = x86_guest_base;
-#endif
+    if (tcg_use_softmmu) {
+        h->index = TCG_REG_L0;
+        h->ofs = 0;
+        h->seg = 0;
+    } else {
+        *h = x86_guest_base;
+    }
     h->base = addrlo;
     h->aa = atom_and_align_for_opc(s, opc, MO_ATOM_IFALIGN, s_bits == MO_128);
     a_mask = (1 << h->aa.align) - 1;
 
-#ifdef CONFIG_SOFTMMU
-    int cmp_ofs = is_ld ? offsetof(CPUTLBEntry, addr_read)
-                        : offsetof(CPUTLBEntry, addr_write);
-    TCGType ttype = TCG_TYPE_I32;
-    TCGType tlbtype = TCG_TYPE_I32;
-    int trexw = 0, hrexw = 0, tlbrexw = 0;
-    unsigned mem_index = get_mmuidx(oi);
-    unsigned s_mask = (1 << s_bits) - 1;
-    int fast_ofs = tlb_mask_table_ofs(s, mem_index);
-    int tlb_mask;
+    if (tcg_use_softmmu) {
+        int cmp_ofs = is_ld ? offsetof(CPUTLBEntry, addr_read)
+                            : offsetof(CPUTLBEntry, addr_write);
+        TCGType ttype = TCG_TYPE_I32;
+        TCGType tlbtype = TCG_TYPE_I32;
+        int trexw = 0, hrexw = 0, tlbrexw = 0;
+        unsigned mem_index = get_mmuidx(oi);
+        unsigned s_mask = (1 << s_bits) - 1;
+        int fast_ofs = tlb_mask_table_ofs(s, mem_index);
+        int tlb_mask;
 
-    ldst = new_ldst_label(s);
-    ldst->is_ld = is_ld;
-    ldst->oi = oi;
-    ldst->addrlo_reg = addrlo;
-    ldst->addrhi_reg = addrhi;
+        ldst = new_ldst_label(s);
+        ldst->is_ld = is_ld;
+        ldst->oi = oi;
+        ldst->addrlo_reg = addrlo;
+        ldst->addrhi_reg = addrhi;
 
-    if (TCG_TARGET_REG_BITS == 64) {
-        ttype = s->addr_type;
-        trexw = (ttype == TCG_TYPE_I32 ? 0 : P_REXW);
-        if (TCG_TYPE_PTR == TCG_TYPE_I64) {
-            hrexw = P_REXW;
-            if (s->page_bits + s->tlb_dyn_max_bits > 32) {
-                tlbtype = TCG_TYPE_I64;
-                tlbrexw = P_REXW;
+        if (TCG_TARGET_REG_BITS == 64) {
+            ttype = s->addr_type;
+            trexw = (ttype == TCG_TYPE_I32 ? 0 : P_REXW);
+            if (TCG_TYPE_PTR == TCG_TYPE_I64) {
+                hrexw = P_REXW;
+                if (s->page_bits + s->tlb_dyn_max_bits > 32) {
+                    tlbtype = TCG_TYPE_I64;
+                    tlbrexw = P_REXW;
+                }
             }
         }
-    }
 
-    tcg_out_mov(s, tlbtype, TCG_REG_L0, addrlo);
-    tcg_out_shifti(s, SHIFT_SHR + tlbrexw, TCG_REG_L0,
-                   s->page_bits - CPU_TLB_ENTRY_BITS);
+        tcg_out_mov(s, tlbtype, TCG_REG_L0, addrlo);
+        tcg_out_shifti(s, SHIFT_SHR + tlbrexw, TCG_REG_L0,
+                       s->page_bits - CPU_TLB_ENTRY_BITS);
 
-    tcg_out_modrm_offset(s, OPC_AND_GvEv + trexw, TCG_REG_L0, TCG_AREG0,
-                         fast_ofs + offsetof(CPUTLBDescFast, mask));
+        tcg_out_modrm_offset(s, OPC_AND_GvEv + trexw, TCG_REG_L0, TCG_AREG0,
+                             fast_ofs + offsetof(CPUTLBDescFast, mask));
 
-    tcg_out_modrm_offset(s, OPC_ADD_GvEv + hrexw, TCG_REG_L0, TCG_AREG0,
-                         fast_ofs + offsetof(CPUTLBDescFast, table));
+        tcg_out_modrm_offset(s, OPC_ADD_GvEv + hrexw, TCG_REG_L0, TCG_AREG0,
+                             fast_ofs + offsetof(CPUTLBDescFast, table));
 
-    /*
-     * If the required alignment is at least as large as the access, simply
-     * copy the address and mask.  For lesser alignments, check that we don't
-     * cross pages for the complete access.
-     */
-    if (a_mask >= s_mask) {
-        tcg_out_mov(s, ttype, TCG_REG_L1, addrlo);
-    } else {
-        tcg_out_modrm_offset(s, OPC_LEA + trexw, TCG_REG_L1,
-                             addrlo, s_mask - a_mask);
-    }
-    tlb_mask = s->page_mask | a_mask;
-    tgen_arithi(s, ARITH_AND + trexw, TCG_REG_L1, tlb_mask, 0);
+        /*
+         * If the required alignment is at least as large as the access,
+         * simply copy the address and mask.  For lesser alignments,
+         * check that we don't cross pages for the complete access.
+         */
+        if (a_mask >= s_mask) {
+            tcg_out_mov(s, ttype, TCG_REG_L1, addrlo);
+        } else {
+            tcg_out_modrm_offset(s, OPC_LEA + trexw, TCG_REG_L1,
+                                 addrlo, s_mask - a_mask);
+        }
+        tlb_mask = s->page_mask | a_mask;
+        tgen_arithi(s, ARITH_AND + trexw, TCG_REG_L1, tlb_mask, 0);
 
-    /* cmp 0(TCG_REG_L0), TCG_REG_L1 */
-    tcg_out_modrm_offset(s, OPC_CMP_GvEv + trexw,
-                         TCG_REG_L1, TCG_REG_L0, cmp_ofs);
-
-    /* jne slow_path */
-    tcg_out_opc(s, OPC_JCC_long + JCC_JNE, 0, 0, 0);
-    ldst->label_ptr[0] = s->code_ptr;
-    s->code_ptr += 4;
-
-    if (TCG_TARGET_REG_BITS == 32 && s->addr_type == TCG_TYPE_I64) {
-        /* cmp 4(TCG_REG_L0), addrhi */
-        tcg_out_modrm_offset(s, OPC_CMP_GvEv, addrhi, TCG_REG_L0, cmp_ofs + 4);
+        /* cmp 0(TCG_REG_L0), TCG_REG_L1 */
+        tcg_out_modrm_offset(s, OPC_CMP_GvEv + trexw,
+                             TCG_REG_L1, TCG_REG_L0, cmp_ofs);
 
         /* jne slow_path */
         tcg_out_opc(s, OPC_JCC_long + JCC_JNE, 0, 0, 0);
-        ldst->label_ptr[1] = s->code_ptr;
+        ldst->label_ptr[0] = s->code_ptr;
         s->code_ptr += 4;
-    }
 
-    /* TLB Hit.  */
-    tcg_out_ld(s, TCG_TYPE_PTR, TCG_REG_L0, TCG_REG_L0,
-               offsetof(CPUTLBEntry, addend));
-#else
-    if (a_mask) {
+        if (TCG_TARGET_REG_BITS == 32 && s->addr_type == TCG_TYPE_I64) {
+            /* cmp 4(TCG_REG_L0), addrhi */
+            tcg_out_modrm_offset(s, OPC_CMP_GvEv, addrhi,
+                                 TCG_REG_L0, cmp_ofs + 4);
+
+            /* jne slow_path */
+            tcg_out_opc(s, OPC_JCC_long + JCC_JNE, 0, 0, 0);
+            ldst->label_ptr[1] = s->code_ptr;
+            s->code_ptr += 4;
+        }
+
+        /* TLB Hit.  */
+        tcg_out_ld(s, TCG_TYPE_PTR, TCG_REG_L0, TCG_REG_L0,
+                   offsetof(CPUTLBEntry, addend));
+    } else if (a_mask) {
         ldst = new_ldst_label(s);
 
         ldst->is_ld = is_ld;
@@ -XXX,XX +XXX,XX @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
         ldst->label_ptr[0] = s->code_ptr;
         s->code_ptr += 4;
     }
-#endif
 
     return ldst;
 }
@@ -XXX,XX +XXX,XX @@ static void tcg_target_qemu_prologue(TCGContext *s)
         tcg_out_push(s, tcg_target_callee_save_regs[i]);
     }
 
-#if TCG_TARGET_REG_BITS == 32
-    tcg_out_ld(s, TCG_TYPE_PTR, TCG_AREG0, TCG_REG_ESP,
-               (ARRAY_SIZE(tcg_target_callee_save_regs) + 1) * 4);
-    tcg_out_addi(s, TCG_REG_ESP, -stack_addend);
-    /* jmp *tb.  */
-    tcg_out_modrm_offset(s, OPC_GRP5, EXT5_JMPN_Ev, TCG_REG_ESP,
-                         (ARRAY_SIZE(tcg_target_callee_save_regs) + 2) * 4
-                         + stack_addend);
-#else
-# if !defined(CONFIG_SOFTMMU)
-    if (guest_base) {
+    if (!tcg_use_softmmu && guest_base) {
         int seg = setup_guest_base_seg();
         if (seg != 0) {
             x86_guest_base.seg = seg;
         } else if (guest_base == (int32_t)guest_base) {
             x86_guest_base.ofs = guest_base;
         } else {
+            assert(TCG_TARGET_REG_BITS == 64);
             /* Choose R12 because, as a base, it requires a SIB byte. */
             x86_guest_base.index = TCG_REG_R12;
             tcg_out_movi(s, TCG_TYPE_PTR, x86_guest_base.index, guest_base);
             tcg_regset_set_reg(s->reserved_regs, x86_guest_base.index);
         }
     }
-# endif
-    tcg_out_mov(s, TCG_TYPE_PTR, TCG_AREG0, tcg_target_call_iarg_regs[0]);
-    tcg_out_addi(s, TCG_REG_ESP, -stack_addend);
-    /* jmp *tb.  */
-    tcg_out_modrm(s, OPC_GRP5, EXT5_JMPN_Ev, tcg_target_call_iarg_regs[1]);
-#endif
+
+    if (TCG_TARGET_REG_BITS == 32) {
+        tcg_out_ld(s, TCG_TYPE_PTR, TCG_AREG0, TCG_REG_ESP,
+                   (ARRAY_SIZE(tcg_target_callee_save_regs) + 1) * 4);
+        tcg_out_addi(s, TCG_REG_ESP, -stack_addend);
+        /* jmp *tb.  */
+        tcg_out_modrm_offset(s, OPC_GRP5, EXT5_JMPN_Ev, TCG_REG_ESP,
+                             (ARRAY_SIZE(tcg_target_callee_save_regs) + 2) * 4
+                             + stack_addend);
+    } else {
+        tcg_out_mov(s, TCG_TYPE_PTR, TCG_AREG0, tcg_target_call_iarg_regs[0]);
+        tcg_out_addi(s, TCG_REG_ESP, -stack_addend);
+        /* jmp *tb.  */
+        tcg_out_modrm(s, OPC_GRP5, EXT5_JMPN_Ev, tcg_target_call_iarg_regs[1]);
+    }
 
     /*
      * Return path for goto_ptr. Set return value to 0, a-la exit_tb,
-- 
2.34.1