Series comparison

-[PATCH for-8.0 00/11] tcg patch queue
+[PULL 00/15] tcg patch queue
-Posting pre-PR because I had to adjust Emilio's QTree patch [1],
+Merge the first set of reviewed patches from my queue.
 and added a new patch to avoid an assert that can be generated
 with incorrect -R reserved_va values vs the ARM commpage.
 r~
-[1] https://gitlab.com/rth7680/qemu/-/jobs/3975817279#L92
+The following changes since commit 6dd06214892d71cbbdd25daed7693e58afcb1093:
-Emilio Cota (2):
+  Merge tag 'pull-hex-20230421' of https://github.com/quic/qemu into staging (2023-04-22 08:31:38 +0100)
   util: import GTree as QTree
   tcg: use QTree instead of GTree
-Richard Henderson (9):
+are available in the Git repository at:
   linux-user: Diagnose misaligned -R size
   include/exec: Change reserved_va semantics to last byte
   accel/tcg: Pass last not end to page_set_flags
   accel/tcg: Pass last not end to page_reset_target_data
   accel/tcg: Pass last not end to PAGE_FOR_EACH_TB
   accel/tcg: Pass last not end to page_collection_lock
   accel/tcg: Pass last not end to tb_invalidate_phys_page_range__locked
   accel/tcg: Pass last not end to tb_invalidate_phys_range
   linux-user/arm: Take more care allocating commpage
- configure                   |   15 +
+  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20230423
  meson.build                 |    4 +
  include/exec/cpu-all.h      |   15 +-
  include/exec/exec-all.h     |    2 +-
  include/qemu/qtree.h        |  201 +++++
  linux-user/arm/target_cpu.h |    2 +-
  accel/tcg/tb-maint.c        |  112 +--
  accel/tcg/translate-all.c   |    2 +-
  accel/tcg/user-exec.c       |   25 +-
  bsd-user/main.c             |   10 +-
  bsd-user/mmap.c             |   10 +-
  linux-user/elfload.c        |   67 +-
  linux-user/main.c           |   31 +-
  linux-user/mmap.c           |   22 +-
  linux-user/syscall.c        |    4 +-
  softmmu/physmem.c           |    2 +-
  tcg/region.c                |   19 +-
  tests/bench/qtree-bench.c   |  286 +++++++
  tests/unit/test-qtree.c     |  333 +++++++++
  util/qtree.c                | 1390 +++++++++++++++++++++++++++++++++++
  tests/bench/meson.build     |    4 +
  tests/unit/meson.build      |    1 +
  util/meson.build            |    1 +
 files changed, 2412 insertions(+), 146 deletions(-)
  create mode 100644 include/qemu/qtree.h
  create mode 100644 tests/bench/qtree-bench.c
  create mode 100644 tests/unit/test-qtree.c
  create mode 100644 util/qtree.c
---
+for you to fetch changes up to 3ea9be33400f14305565a9a094cb6031c07183d5:
-.34.1
   tcg/riscv: Conditionalize tcg_out_exts_i32_i64 (2023-04-23 08:46:45 +0100)
 ----------------------------------------------------------------
 tcg cleanups:
   - Remove tcg_abort()
   - Split out extensions as known backend interfaces
   - Put the separate extensions together as tcg_out_movext
   - Introduce tcg_out_xchg as a backend interface
   - Clear TCGLabelQemuLdst on allocation
   - Avoid redundant extensions for riscv
 ----------------------------------------------------------------
 Richard Henderson (15):
       tcg: Replace if + tcg_abort with tcg_debug_assert
       tcg: Replace tcg_abort with g_assert_not_reached
       tcg: Split out tcg_out_ext8s
       tcg: Split out tcg_out_ext8u
       tcg: Split out tcg_out_ext16s
       tcg: Split out tcg_out_ext16u
       tcg: Split out tcg_out_ext32s
       tcg: Split out tcg_out_ext32u
       tcg: Split out tcg_out_exts_i32_i64
       tcg: Split out tcg_out_extu_i32_i64
       tcg: Split out tcg_out_extrl_i64_i32
       tcg: Introduce tcg_out_movext
       tcg: Introduce tcg_out_xchg
       tcg: Clear TCGLabelQemuLdst on allocation
       tcg/riscv: Conditionalize tcg_out_exts_i32_i64
  include/tcg/tcg.h                |   6 --
  target/i386/tcg/translate.c      |  20 +++---
  target/s390x/tcg/translate.c     |   4 +-
  tcg/optimize.c                   |  10 ++-
  tcg/tcg.c                        | 135 +++++++++++++++++++++++++++++++++++----
  tcg/aarch64/tcg-target.c.inc     | 106 +++++++++++++++++++-----------
  tcg/arm/tcg-target.c.inc         |  93 +++++++++++++++++----------
  tcg/i386/tcg-target.c.inc        | 129 ++++++++++++++++++-------------------
  tcg/loongarch64/tcg-target.c.inc | 123 +++++++++++++----------------------
  tcg/mips/tcg-target.c.inc        |  94 +++++++++++++++++++--------
  tcg/ppc/tcg-target.c.inc         | 119 ++++++++++++++++++----------------
  tcg/riscv/tcg-target.c.inc       |  83 +++++++++++-------------
  tcg/s390x/tcg-target.c.inc       | 128 +++++++++++++++++--------------------
  tcg/sparc64/tcg-target.c.inc     | 117 +++++++++++++++++++++------------
  tcg/tcg-ldst.c.inc               |   1 +
  tcg/tci/tcg-target.c.inc         | 116 ++++++++++++++++++++++++++++++---
 files changed, 786 insertions(+), 498 deletions(-)

-[PATCH for-8.0 05/11] accel/tcg: Pass last not end to page_set_flags
+[PULL 01/15] tcg: Replace if + tcg_abort with tcg_debug_assert
-Pass the address of the last byte to be changed, rather than
-the first address past the last byte.  This avoids overflow
-when the last page of the address space is involved.
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1528
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/cpu-all.h |  2 +-
+ tcg/tcg.c                 | 4 +---
- accel/tcg/user-exec.c  | 16 +++++++---------
+ tcg/i386/tcg-target.c.inc | 8 +++-----
- bsd-user/mmap.c        |  6 +++---
+files changed, 4 insertions(+), 8 deletions(-)
  linux-user/elfload.c   | 11 ++++++-----
  linux-user/mmap.c      | 16 ++++++++--------
  linux-user/syscall.c   |  4 ++--
 files changed, 27 insertions(+), 28 deletions(-)
-diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
+diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/cpu-all.h
+--- a/tcg/tcg.c
-+++ b/include/exec/cpu-all.h
++++ b/tcg/tcg.c
-@@ -XXX,XX +XXX,XX @@ typedef int (*walk_memory_regions_fn)(void *, target_ulong,
+@@ -XXX,XX +XXX,XX @@ static TCGTemp *tcg_global_reg_new_internal(TCGContext *s, TCGType type,
- int walk_memory_regions(void *, walk_memory_regions_fn);
+ {
+     TCGTemp *ts;
- int page_get_flags(target_ulong address);
--void page_set_flags(target_ulong start, target_ulong end, int flags);
+-    if (TCG_TARGET_REG_BITS == 32 && type != TCG_TYPE_I32) {
-+void page_set_flags(target_ulong start, target_ulong last, int flags);
+-        tcg_abort();
- void page_reset_target_data(target_ulong start, target_ulong end);
+-    }
- int page_check_range(target_ulong start, target_ulong len, int flags);
++    tcg_debug_assert(TCG_TARGET_REG_BITS == 64 || type == TCG_TYPE_I32);
-diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
+     ts = tcg_global_alloc(s);
      ts->base_type = type;
 diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/user-exec.c
+--- a/tcg/i386/tcg-target.c.inc
-+++ b/accel/tcg/user-exec.c
++++ b/tcg/i386/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool pageflags_set_clear(target_ulong start, target_ulong last,
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_addi(TCGContext *s, int reg, tcg_target_long val)
   * The flag PAGE_WRITE_ORG is positioned automatically depending
   * on PAGE_WRITE.  The mmap_lock should already be held.
   */
 -void page_set_flags(target_ulong start, target_ulong end, int flags)
 +void page_set_flags(target_ulong start, target_ulong last, int flags)
  {
 -    target_ulong last;
      bool reset = false;
      bool inval_tb = false;
      /* This function should never be called with addresses outside the
         guest address space.  If this assert fires, it probably indicates
         a missing call to h2g_valid.  */
 -    assert(start < end);
 -    assert(end - 1 <= GUEST_ADDR_MAX);
 +    assert(start <= last);
 +    assert(last <= GUEST_ADDR_MAX);
      /* Only set PAGE_ANON with new mappings. */
      assert(!(flags & PAGE_ANON) || (flags & PAGE_RESET));
      assert_memory_lock();
 -    start = start & TARGET_PAGE_MASK;
 -    end = TARGET_PAGE_ALIGN(end);
 -    last = end - 1;
 +    start &= TARGET_PAGE_MASK;
 +    last |= ~TARGET_PAGE_MASK;
      if (!(flags & PAGE_VALID)) {
          flags = 0;
@@ -XXX,XX +XXX,XX @@ void page_set_flags(target_ulong start, target_ulong end, int flags)
      }
      if (!flags || reset) {
 -        page_reset_target_data(start, end);
 +        page_reset_target_data(start, last + 1);
          inval_tb |= pageflags_unset(start, last);
      }
      if (flags) {
@@ -XXX,XX +XXX,XX @@ void page_set_flags(target_ulong start, target_ulong end, int flags)
                                          ~(reset ? 0 : PAGE_STICKY));
      }
      if (inval_tb) {
 -        tb_invalidate_phys_range(start, end);
 +        tb_invalidate_phys_range(start, last + 1);
      }
  }
-diff --git a/bsd-user/mmap.c b/bsd-user/mmap.c
+-/* Use SMALL != 0 to force a short forward branch.  */
-index XXXXXXX..XXXXXXX 100644
+-static void tcg_out_jxx(TCGContext *s, int opc, TCGLabel *l, int small)
---- a/bsd-user/mmap.c
++/* Set SMALL to force a short forward branch.  */
-+++ b/bsd-user/mmap.c
++static void tcg_out_jxx(TCGContext *s, int opc, TCGLabel *l, bool small)
-@@ -XXX,XX +XXX,XX @@ int target_mprotect(abi_ulong start, abi_ulong len, int prot)
+ {
-         if (ret != 0)
+     int32_t val, val1;
-             goto error;
-     }
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_jxx(TCGContext *s, int opc, TCGLabel *l, int small)
--    page_set_flags(start, start + len, prot | PAGE_VALID);
+             }
-+    page_set_flags(start, start + len - 1, prot | PAGE_VALID);
+             tcg_out8(s, val1);
-     mmap_unlock();
+         } else {
-     return 0;
+-            if (small) {
- error:
+-                tcg_abort();
-@@ -XXX,XX +XXX,XX @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int prot,
+-            }
-         }
++            tcg_debug_assert(!small);
-     }
+             if (opc == -1) {
-  the_end1:
+                 tcg_out8(s, OPC_JMP_long);
--    page_set_flags(start, start + len, prot | PAGE_VALID);
+                 tcg_out32(s, val - 5);
 +    page_set_flags(start, start + len - 1, prot | PAGE_VALID);
   the_end:
  #ifdef DEBUG_MMAP
      printf("ret=0x" TARGET_ABI_FMT_lx "\n", start);
@@ -XXX,XX +XXX,XX @@ int target_munmap(abi_ulong start, abi_ulong len)
      }
      if (ret == 0) {
 -        page_set_flags(start, start + len, 0);
 +        page_set_flags(start, start + len - 1, 0);
      }
      mmap_unlock();
      return ret;
 diff --git a/linux-user/elfload.c b/linux-user/elfload.c
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/elfload.c
 +++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)
          exit(EXIT_FAILURE);
      }
      page_set_flags(TARGET_VSYSCALL_PAGE,
 -                   TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE,
 +                   TARGET_VSYSCALL_PAGE | ~TARGET_PAGE_MASK,
                     PAGE_EXEC | PAGE_VALID);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)
          exit(EXIT_FAILURE);
      }
 -    page_set_flags(commpage, commpage + qemu_host_page_size,
 +    page_set_flags(commpage, commpage | ~qemu_host_page_mask,
                     PAGE_READ | PAGE_EXEC | PAGE_VALID);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)
          exit(EXIT_FAILURE);
      }
 -    page_set_flags(LO_COMMPAGE, LO_COMMPAGE + TARGET_PAGE_SIZE,
 +    page_set_flags(LO_COMMPAGE, LO_COMMPAGE | ~TARGET_PAGE_MASK,
                     PAGE_READ | PAGE_EXEC | PAGE_VALID);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)
       * and implement syscalls.  Here, simply mark the page executable.
       * Special case the entry points during translation (see do_page_zero).
       */
 -    page_set_flags(LO_COMMPAGE, LO_COMMPAGE + TARGET_PAGE_SIZE,
 +    page_set_flags(LO_COMMPAGE, LO_COMMPAGE | ~TARGET_PAGE_MASK,
                     PAGE_EXEC | PAGE_VALID);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static void zero_bss(abi_ulong elf_bss, abi_ulong last_bss, int prot)
      /* Ensure that the bss page(s) are valid */
      if ((page_get_flags(last_bss-1) & prot) != prot) {
 -        page_set_flags(elf_bss & TARGET_PAGE_MASK, last_bss, prot | PAGE_VALID);
 +        page_set_flags(elf_bss & TARGET_PAGE_MASK, last_bss - 1,
 +                       prot | PAGE_VALID);
      }
      if (host_start < host_map_start) {
 diff --git a/linux-user/mmap.c b/linux-user/mmap.c
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/mmap.c
 +++ b/linux-user/mmap.c
@@ -XXX,XX +XXX,XX @@ int target_mprotect(abi_ulong start, abi_ulong len, int target_prot)
          }
      }
 -    page_set_flags(start, start + len, page_flags);
 +    page_set_flags(start, start + len - 1, page_flags);
      ret = 0;
  error:
@@ -XXX,XX +XXX,XX @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
      }
      page_flags |= PAGE_RESET;
      if (passthrough_start == passthrough_end) {
 -        page_set_flags(start, start + len, page_flags);
 +        page_set_flags(start, start + len - 1, page_flags);
      } else {
          if (start < passthrough_start) {
 -            page_set_flags(start, passthrough_start, page_flags);
 +            page_set_flags(start, passthrough_start - 1, page_flags);
          }
 -        page_set_flags(passthrough_start, passthrough_end,
 +        page_set_flags(passthrough_start, passthrough_end - 1,
                         page_flags | PAGE_PASSTHROUGH);
          if (passthrough_end < start + len) {
 -            page_set_flags(passthrough_end, start + len, page_flags);
 +            page_set_flags(passthrough_end, start + len - 1, page_flags);
          }
      }
   the_end:
@@ -XXX,XX +XXX,XX @@ int target_munmap(abi_ulong start, abi_ulong len)
      }
      if (ret == 0) {
 -        page_set_flags(start, start + len, 0);
 +        page_set_flags(start, start + len - 1, 0);
      }
      mmap_unlock();
      return ret;
@@ -XXX,XX +XXX,XX @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
      } else {
          new_addr = h2g(host_addr);
          prot = page_get_flags(old_addr);
 -        page_set_flags(old_addr, old_addr + old_size, 0);
 -        page_set_flags(new_addr, new_addr + new_size,
 +        page_set_flags(old_addr, old_addr + old_size - 1, 0);
 +        page_set_flags(new_addr, new_addr + new_size - 1,
                         prot | PAGE_VALID | PAGE_RESET);
      }
      mmap_unlock();
 diff --git a/linux-user/syscall.c b/linux-user/syscall.c
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/syscall.c
 +++ b/linux-user/syscall.c
@@ -XXX,XX +XXX,XX @@ static inline abi_ulong do_shmat(CPUArchState *cpu_env,
      }
      raddr=h2g((unsigned long)host_raddr);
 -    page_set_flags(raddr, raddr + shm_info.shm_segsz,
 +    page_set_flags(raddr, raddr + shm_info.shm_segsz - 1,
                     PAGE_VALID | PAGE_RESET | PAGE_READ |
                     (shmflg & SHM_RDONLY ? 0 : PAGE_WRITE));
@@ -XXX,XX +XXX,XX @@ static inline abi_long do_shmdt(abi_ulong shmaddr)
      for (i = 0; i < N_SHM_REGIONS; ++i) {
          if (shm_regions[i].in_use && shm_regions[i].start == shmaddr) {
              shm_regions[i].in_use = false;
 -            page_set_flags(shmaddr, shmaddr + shm_regions[i].size, 0);
 +            page_set_flags(shmaddr, shmaddr + shm_regions[i].size - 1, 0);
              break;
          }
      }
 --
 .34.1

-New patch
+[PULL 02/15] tcg: Replace tcg_abort with g_assert_not_reached
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ include/tcg/tcg.h            |  6 ------
+ target/i386/tcg/translate.c  | 20 ++++++++++----------
+ target/s390x/tcg/translate.c |  4 ++--
+ tcg/optimize.c               | 10 ++++------
+ tcg/tcg.c                    |  8 ++++----
+ tcg/aarch64/tcg-target.c.inc |  4 ++--
+ tcg/arm/tcg-target.c.inc     |  2 +-
+ tcg/i386/tcg-target.c.inc    | 14 +++++++-------
+ tcg/mips/tcg-target.c.inc    | 14 +++++++-------
+ tcg/ppc/tcg-target.c.inc     |  8 ++++----
+ tcg/s390x/tcg-target.c.inc   |  8 ++++----
+ tcg/sparc64/tcg-target.c.inc |  2 +-
+ tcg/tci/tcg-target.c.inc     |  2 +-
+files changed, 47 insertions(+), 55 deletions(-)
+diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/tcg/tcg.h
++++ b/include/tcg/tcg.h
+@@ -XXX,XX +XXX,XX @@ typedef struct TCGTargetOpDef {
+     const char *args_ct_str[TCG_MAX_OP_ARGS];
+ } TCGTargetOpDef;
+-#define tcg_abort() \
+-do {\
+-    fprintf(stderr, "%s:%d: tcg fatal error\n", __FILE__, __LINE__);\
+-    abort();\
+-} while (0)
+-
+ bool tcg_op_supported(TCGOpcode op);
+ void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args);
+diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/i386/tcg/translate.c
++++ b/target/i386/tcg/translate.c
+@@ -XXX,XX +XXX,XX @@ static TCGv gen_op_deposit_reg_v(DisasContext *s, MemOp ot, int reg, TCGv dest,
+         break;
+ #endif
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+     return cpu_regs[reg];
+ }
+@@ -XXX,XX +XXX,XX @@ static void gen_lea_v_seg(DisasContext *s, MemOp aflag, TCGv a0,
+         }
+         break;
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+     if (ovr_seg >= 0) {
+@@ -XXX,XX +XXX,XX @@ static void gen_helper_in_func(MemOp ot, TCGv v, TCGv_i32 n)
+         gen_helper_inl(v, cpu_env, n);
+         break;
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static void gen_helper_out_func(MemOp ot, TCGv_i32 v, TCGv_i32 n)
+         gen_helper_outl(cpu_env, v, n);
+         break;
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static void gen_rotc_rm_T1(DisasContext *s, MemOp ot, int op1,
+             break;
+ #endif
+         default:
+-            tcg_abort();
++            g_assert_not_reached();
+         }
+     } else {
+         switch (ot) {
+@@ -XXX,XX +XXX,XX @@ static void gen_rotc_rm_T1(DisasContext *s, MemOp ot, int op1,
+             break;
+ #endif
+         default:
+-            tcg_abort();
++            g_assert_not_reached();
+         }
+     }
+     /* store */
+@@ -XXX,XX +XXX,XX @@ static AddressParts gen_lea_modrm_0(CPUX86State *env, DisasContext *s,
+         break;
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+  done:
+@@ -XXX,XX +XXX,XX @@ static inline uint32_t insn_get(CPUX86State *env, DisasContext *s, MemOp ot)
+         ret = x86_ldl_code(env, s);
+         break;
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+     return ret;
+ }
+@@ -XXX,XX +XXX,XX @@ static bool disas_insn(DisasContext *s, CPUState *cpu)
+             gen_op_mov_reg_v(s, MO_16, R_EAX, s->T0);
+             break;
+         default:
+-            tcg_abort();
++            g_assert_not_reached();
+         }
+         break;
+     case 0x99: /* CDQ/CWD */
+@@ -XXX,XX +XXX,XX @@ static bool disas_insn(DisasContext *s, CPUState *cpu)
+             gen_op_mov_reg_v(s, MO_16, R_EDX, s->T0);
+             break;
+         default:
+-            tcg_abort();
++            g_assert_not_reached();
+         }
+         break;
+     case 0x1af: /* imul Gv, Ev */
+diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/s390x/tcg/translate.c
++++ b/target/s390x/tcg/translate.c
+@@ -XXX,XX +XXX,XX @@ static int get_mem_index(DisasContext *s)
+     case PSW_ASC_HOME >> FLAG_MASK_PSW_SHIFT:
+         return MMU_HOME_IDX;
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+         break;
+     }
+ #endif
+@@ -XXX,XX +XXX,XX @@ static void gen_op_calc_cc(DisasContext *s)
+         gen_helper_calc_cc(cc_op, cpu_env, cc_op, cc_src, cc_dst, cc_vr);
+         break;
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+     /* We now have cc in cc_op as constant */
+diff --git a/tcg/optimize.c b/tcg/optimize.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/optimize.c
++++ b/tcg/optimize.c
+@@ -XXX,XX +XXX,XX @@ static uint64_t do_constant_folding_2(TCGOpcode op, uint64_t x, uint64_t y)
+         return (uint64_t)x % ((uint64_t)y ? : 1);
+     default:
+-        fprintf(stderr,
+-                "Unrecognized operation %d in do_constant_folding.\n", op);
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static bool do_constant_folding_cond_32(uint32_t x, uint32_t y, TCGCond c)
+     case TCG_COND_GTU:
+         return x > y;
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static bool do_constant_folding_cond_64(uint64_t x, uint64_t y, TCGCond c)
+     case TCG_COND_GTU:
+         return x > y;
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static bool do_constant_folding_cond_eq(TCGCond c)
+     case TCG_COND_EQ:
+         return 1;
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+ }
+diff --git a/tcg/tcg.c b/tcg/tcg.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/tcg.c
++++ b/tcg/tcg.c
+@@ -XXX,XX +XXX,XX @@ static void temp_sync(TCGContext *s, TCGTemp *ts, TCGRegSet allocated_regs,
+         case TEMP_VAL_DEAD:
+         default:
+-            tcg_abort();
++            g_assert_not_reached();
+         }
+         ts->mem_coherent = 1;
+     }
+@@ -XXX,XX +XXX,XX @@ static TCGReg tcg_reg_alloc(TCGContext *s, TCGRegSet required_regs,
+         }
+     }
+-    tcg_abort();
++    g_assert_not_reached();
+ }
+ static TCGReg tcg_reg_alloc_pair(TCGContext *s, TCGRegSet required_regs,
+@@ -XXX,XX +XXX,XX @@ static TCGReg tcg_reg_alloc_pair(TCGContext *s, TCGRegSet required_regs,
+             }
+         }
+     }
+-    tcg_abort();
++    g_assert_not_reached();
+ }
+ /* Make sure the temporary is in a register.  If needed, allocate the register
+@@ -XXX,XX +XXX,XX @@ static void temp_load(TCGContext *s, TCGTemp *ts, TCGRegSet desired_regs,
+         break;
+     case TEMP_VAL_DEAD:
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+     set_temp_val_reg(s, ts, reg);
+ }
+diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/aarch64/tcg-target.c.inc
++++ b/tcg/aarch64/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp memop, TCGType ext,
+         tcg_out_ldst_r(s, I3312_LDRX, data_r, addr_r, otype, off_r);
+         break;
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, MemOp memop,
+         tcg_out_ldst_r(s, I3312_STRX, data_r, addr_r, otype, off_r);
+         break;
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+ }
+diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/arm/tcg-target.c.inc
++++ b/tcg/arm/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
+     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+ }
+diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/i386/tcg-target.c.inc
++++ b/tcg/i386/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static bool patch_reloc(tcg_insn_unit *code_ptr, int type,
+         tcg_patch8(code_ptr, value);
+         break;
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+     return true;
+ }
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_pushi(TCGContext *s, tcg_target_long val)
+         tcg_out_opc(s, OPC_PUSH_Iv, 0, 0, 0);
+         tcg_out32(s, val);
+     } else {
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static void tgen_arithi(TCGContext *s, int c, int r0,
+         return;
+     }
+-    tcg_abort();
++    g_assert_not_reached();
+ }
+ static void tcg_out_addi(TCGContext *s, int reg, tcg_target_long val)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_brcond2(TCGContext *s, const TCGArg *args,
+                          label_this, small);
+         break;
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+     tcg_out_label(s, label_next);
+ }
+@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+         }
+         break;
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+     /* Jump to the code corresponding to next IR of qemu_st */
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
+             /* load bits 0..15 */
+             tcg_out_modrm(s, OPC_MOVL_EvGv | P_DATA16, a2, a0);
+         } else {
+-            tcg_abort();
++            g_assert_not_reached();
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
+     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+ #undef OP_32_64
+diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/mips/tcg-target.c.inc
++++ b/tcg/mips/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_setcond(TCGContext *s, TCGCond cond, TCGReg ret,
+         break;
+      default:
+-         tcg_abort();
++         g_assert_not_reached();
+          break;
+      }
+ }
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_brcond(TCGContext *s, TCGCond cond, TCGReg arg1,
+         break;
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+         break;
+     }
+@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+         }
+         break;
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+     i = tcg_out_call_iarg_imm(s, i, oi);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg lo, TCGReg hi,
+         }
+         break;
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, TCGReg lo, TCGReg hi,
+         break;
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_unalign(TCGContext *s, TCGReg lo, TCGReg hi,
+         break;
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+ }
+ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
+     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+ }
+diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/ppc/tcg-target.c.inc
++++ b/tcg/ppc/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_cmp(TCGContext *s, int cond, TCGArg arg1, TCGArg arg2,
+         break;
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+     op |= BF(cr) | ((type == TCG_TYPE_I64) << 21);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_setcond(TCGContext *s, TCGType type, TCGCond cond,
+         break;
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_cmp2(TCGContext *s, const TCGArg *args,
+         break;
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_exit_tb:   /* Always emitted via tcg_out_exit_tb.  */
+     case INDEX_op_goto_tb:   /* Always emitted via tcg_out_goto_tb.  */
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+ }
+diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/s390x/tcg-target.c.inc
++++ b/tcg/s390x/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp opc, TCGReg data,
+         break;
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, MemOp opc, TCGReg data,
+         break;
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
+         tcg_out_mov(s, TCG_TYPE_I64, TCG_REG_R4, data_reg);
+         break;
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+     tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_R5, oi);
+     tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_R6, (uintptr_t)lb->raddr);
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
+     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+ }
+diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/sparc64/tcg-target.c.inc
++++ b/tcg/sparc64/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
+     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+ }
+diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/tci/tcg-target.c.inc
++++ b/tcg/tci/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
+     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
+     default:
+-        tcg_abort();
++        g_assert_not_reached();
+     }
+ }
+--
+.34.1

-New patch
+[PULL 03/15] tcg: Split out tcg_out_ext8s
+We will need a backend interface for performing 8-bit sign-extend.
+Use it in tcg_reg_alloc_op in the meantime.
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/tcg.c                        | 21 ++++++++++++++++-----
+ tcg/aarch64/tcg-target.c.inc     | 11 +++++++----
+ tcg/arm/tcg-target.c.inc         | 10 ++++------
+ tcg/i386/tcg-target.c.inc        | 10 +++++-----
+ tcg/loongarch64/tcg-target.c.inc | 11 ++++-------
+ tcg/mips/tcg-target.c.inc        | 12 ++++++++----
+ tcg/ppc/tcg-target.c.inc         | 10 ++++------
+ tcg/riscv/tcg-target.c.inc       |  9 +++------
+ tcg/s390x/tcg-target.c.inc       | 10 +++-------
+ tcg/sparc64/tcg-target.c.inc     |  7 +++++++
+ tcg/tci/tcg-target.c.inc         | 21 ++++++++++++++++++++-
+files changed, 81 insertions(+), 51 deletions(-)
+diff --git a/tcg/tcg.c b/tcg/tcg.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/tcg.c
++++ b/tcg/tcg.c
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_ld(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg1,
+ static bool tcg_out_mov(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg);
+ static void tcg_out_movi(TCGContext *s, TCGType type,
+                          TCGReg ret, tcg_target_long arg);
++static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg);
+ static void tcg_out_addi_ptr(TCGContext *s, TCGReg, TCGReg, tcg_target_long);
+ static void tcg_out_exit_tb(TCGContext *s, uintptr_t arg);
+ static void tcg_out_goto_tb(TCGContext *s, int which);
+@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
+     }
+     /* emit instruction */
+-    if (def->flags & TCG_OPF_VECTOR) {
+-        tcg_out_vec_op(s, op->opc, TCGOP_VECL(op), TCGOP_VECE(op),
+-                       new_args, const_args);
+-    } else {
+-        tcg_out_op(s, op->opc, new_args, const_args);
++    switch (op->opc) {
++    case INDEX_op_ext8s_i32:
++        tcg_out_ext8s(s, TCG_TYPE_I32, new_args[0], new_args[1]);
++        break;
++    case INDEX_op_ext8s_i64:
++        tcg_out_ext8s(s, TCG_TYPE_I64, new_args[0], new_args[1]);
++        break;
++    default:
++        if (def->flags & TCG_OPF_VECTOR) {
++            tcg_out_vec_op(s, op->opc, TCGOP_VECL(op), TCGOP_VECE(op),
++                           new_args, const_args);
++        } else {
++            tcg_out_op(s, op->opc, new_args, const_args);
++        }
++        break;
+     }
+     /* move the outputs in the correct register if needed */
+diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/aarch64/tcg-target.c.inc
++++ b/tcg/aarch64/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_sxt(TCGContext *s, TCGType ext, MemOp s_bits,
+     tcg_out_sbfm(s, ext, rd, rn, 0, bits);
+ }
++static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rn)
++{
++    tcg_out_sxt(s, type, MO_8, rd, rn);
++}
++
+ static inline void tcg_out_uxt(TCGContext *s, MemOp s_bits,
+                                TCGReg rd, TCGReg rn)
+ {
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+         }
+         break;
+-    case INDEX_op_ext8s_i64:
+-    case INDEX_op_ext8s_i32:
+-        tcg_out_sxt(s, ext, MO_8, a0, a1);
+-        break;
+     case INDEX_op_ext16s_i64:
+     case INDEX_op_ext16s_i32:
+         tcg_out_sxt(s, ext, MO_16, a0, a1);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
+     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
+     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
++    case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
++    case INDEX_op_ext8s_i64:
+     default:
+         g_assert_not_reached();
+     }
+diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/arm/tcg-target.c.inc
++++ b/tcg/arm/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_udiv(TCGContext *s, ARMCond cond,
+     tcg_out32(s, 0x0730f010 | (cond << 28) | (rd << 16) | rn | (rm << 8));
+ }
+-static void tcg_out_ext8s(TCGContext *s, ARMCond cond, TCGReg rd, TCGReg rn)
++static void tcg_out_ext8s(TCGContext *s, TCGType t, TCGReg rd, TCGReg rn)
+ {
+     /* sxtb */
+-    tcg_out32(s, 0x06af0070 | (cond << 28) | (rd << 12) | rn);
++    tcg_out32(s, 0x06af0070 | (COND_AL << 28) | (rd << 12) | rn);
+ }
+ static void __attribute__((unused))
+@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
+     datahi = lb->datahi_reg;
+     switch (opc & MO_SSIZE) {
+     case MO_SB:
+-        tcg_out_ext8s(s, COND_AL, datalo, TCG_REG_R0);
++        tcg_out_ext8s(s, TCG_TYPE_I32, datalo, TCG_REG_R0);
+         break;
+     case MO_SW:
+         tcg_out_ext16s(s, COND_AL, datalo, TCG_REG_R0);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+         tcg_out_bswap32(s, COND_AL, args[0], args[1]);
+         break;
+-    case INDEX_op_ext8s_i32:
+-        tcg_out_ext8s(s, COND_AL, args[0], args[1]);
+-        break;
+     case INDEX_op_ext16s_i32:
+         tcg_out_ext16s(s, COND_AL, args[0], args[1]);
+         break;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
+     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
+     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
++    case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
+     default:
+         g_assert_not_reached();
+     }
+diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/i386/tcg-target.c.inc
++++ b/tcg/i386/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_ext8u(TCGContext *s, int dest, int src)
+     tcg_out_modrm(s, OPC_MOVZBL + P_REXB_RM, dest, src);
+ }
+-static void tcg_out_ext8s(TCGContext *s, int dest, int src, int rexw)
++static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg dest, TCGReg src)
+ {
++    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+     /* movsbl */
+     tcg_debug_assert(src < 4 || TCG_TARGET_REG_BITS == 64);
+     tcg_out_modrm(s, OPC_MOVSBL + P_REXB_RM + rexw, dest, src);
+@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+     data_reg = l->datalo_reg;
+     switch (opc & MO_SSIZE) {
+     case MO_SB:
+-        tcg_out_ext8s(s, data_reg, TCG_REG_EAX, rexw);
++        tcg_out_ext8s(s, l->type, data_reg, TCG_REG_EAX);
+         break;
+     case MO_SW:
+         tcg_out_ext16s(s, data_reg, TCG_REG_EAX, rexw);
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
+         tcg_out_modrm(s, OPC_GRP3_Ev + rexw, EXT3_NOT, a0);
+         break;
+-    OP_32_64(ext8s):
+-        tcg_out_ext8s(s, a0, a1, rexw);
+-        break;
+     OP_32_64(ext16s):
+         tcg_out_ext16s(s, a0, a1, rexw);
+         break;
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
+     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
+     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
++    case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
++    case INDEX_op_ext8s_i64:
+     default:
+         g_assert_not_reached();
+     }
+diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/loongarch64/tcg-target.c.inc
++++ b/tcg/loongarch64/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32u(TCGContext *s, TCGReg ret, TCGReg arg)
+     tcg_out_opc_bstrpick_d(s, ret, arg, 0, 31);
+ }
+-static void tcg_out_ext8s(TCGContext *s, TCGReg ret, TCGReg arg)
++static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg)
+ {
+     tcg_out_opc_sext_b(s, ret, arg);
+ }
+@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+     switch (opc & MO_SSIZE) {
+     case MO_SB:
+-        tcg_out_ext8s(s, l->datalo_reg, TCG_REG_A0);
++        tcg_out_ext8s(s, type, l->datalo_reg, TCG_REG_A0);
+         break;
+     case MO_SW:
+         tcg_out_ext16s(s, l->datalo_reg, TCG_REG_A0);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+         tcg_out_brcond(s, a2, a0, a1, arg_label(args[3]));
+         break;
+-    case INDEX_op_ext8s_i32:
+-    case INDEX_op_ext8s_i64:
+-        tcg_out_ext8s(s, a0, a1);
+-        break;
+-
+     case INDEX_op_ext8u_i32:
+     case INDEX_op_ext8u_i64:
+         tcg_out_ext8u(s, a0, a1);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
+     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
+     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
++    case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
++    case INDEX_op_ext8s_i64:
+     default:
+         g_assert_not_reached();
+     }
+diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/mips/tcg-target.c.inc
++++ b/tcg/mips/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi(TCGContext *s, TCGType type,
+     }
+ }
++static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
++{
++    tcg_debug_assert(TCG_TARGET_HAS_ext8s_i32);
++    tcg_out_opc_reg(s, OPC_SEB, rd, TCG_REG_ZERO, rs);
++}
++
+ static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
+                              tcg_target_long imm)
+ {
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_not_i64:
+         i1 = OPC_NOR;
+         goto do_unary;
+-    case INDEX_op_ext8s_i32:
+-    case INDEX_op_ext8s_i64:
+-        i1 = OPC_SEB;
+-        goto do_unary;
+     case INDEX_op_ext16s_i32:
+     case INDEX_op_ext16s_i64:
+         i1 = OPC_SEH;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
+     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
+     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
++    case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
++    case INDEX_op_ext8s_i64:
+     default:
+         g_assert_not_reached();
+     }
+diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/ppc/tcg-target.c.inc
++++ b/tcg/ppc/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_rlw(TCGContext *s, int op, TCGReg ra, TCGReg rs,
+     tcg_out32(s, op | RA(ra) | RS(rs) | SH(sh) | MB(mb) | ME(me));
+ }
+-static inline void tcg_out_ext8s(TCGContext *s, TCGReg dst, TCGReg src)
++static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg dst, TCGReg src)
+ {
+     tcg_out32(s, EXTSB | RA(dst) | RS(src));
+ }
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_ld8s_i32:
+     case INDEX_op_ld8s_i64:
+         tcg_out_mem_long(s, LBZ, LBZX, args[0], args[1], args[2]);
+-        tcg_out_ext8s(s, args[0], args[0]);
++        tcg_out_ext8s(s, TCG_TYPE_REG, args[0], args[0]);
+         break;
+     case INDEX_op_ld16u_i32:
+     case INDEX_op_ld16u_i64:
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+         tcg_out_qemu_st(s, args, true);
+         break;
+-    case INDEX_op_ext8s_i32:
+-    case INDEX_op_ext8s_i64:
+-        tcg_out_ext8s(s, args[0], args[1]);
+-        break;
+     case INDEX_op_ext16s_i32:
+     case INDEX_op_ext16s_i64:
+         tcg_out_ext16s(s, args[0], args[1]);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_call:      /* Always emitted via tcg_out_call.  */
+     case INDEX_op_exit_tb:   /* Always emitted via tcg_out_exit_tb.  */
+     case INDEX_op_goto_tb:   /* Always emitted via tcg_out_goto_tb.  */
++    case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
++    case INDEX_op_ext8s_i64:
+     default:
+         g_assert_not_reached();
+     }
+diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/riscv/tcg-target.c.inc
++++ b/tcg/riscv/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32u(TCGContext *s, TCGReg ret, TCGReg arg)
+     tcg_out_opc_imm(s, OPC_SRLI, ret, ret, 32);
+ }
+-static void tcg_out_ext8s(TCGContext *s, TCGReg ret, TCGReg arg)
++static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg)
+ {
+     tcg_out_opc_imm(s, OPC_SLLIW, ret, arg, 24);
+     tcg_out_opc_imm(s, OPC_SRAIW, ret, ret, 24);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+         tcg_out_ext32u(s, a0, a1);
+         break;
+-    case INDEX_op_ext8s_i32:
+-    case INDEX_op_ext8s_i64:
+-        tcg_out_ext8s(s, a0, a1);
+-        break;
+-
+     case INDEX_op_ext16s_i32:
+     case INDEX_op_ext16s_i64:
+         tcg_out_ext16s(s, a0, a1);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
+     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
+     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
++    case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
++    case INDEX_op_ext8s_i64:
+     default:
+         g_assert_not_reached();
+     }
+diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/s390x/tcg-target.c.inc
++++ b/tcg/s390x/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_risbg(TCGContext *s, TCGReg dest, TCGReg src,
+     tcg_out16(s, (ofs << 8) | (RIEf_RISBG & 0xff));
+ }
+-static void tgen_ext8s(TCGContext *s, TCGType type, TCGReg dest, TCGReg src)
++static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg dest, TCGReg src)
+ {
+     tcg_out_insn(s, RRE, LGBR, dest, src);
+ }
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
+         }
+         break;
+-    case INDEX_op_ext8s_i32:
+-        tgen_ext8s(s, TCG_TYPE_I32, args[0], args[1]);
+-        break;
+     case INDEX_op_ext16s_i32:
+         tgen_ext16s(s, TCG_TYPE_I32, args[0], args[1]);
+         break;
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
+         }
+         break;
+-    case INDEX_op_ext8s_i64:
+-        tgen_ext8s(s, TCG_TYPE_I64, args[0], args[1]);
+-        break;
+     case INDEX_op_ext16s_i64:
+         tgen_ext16s(s, TCG_TYPE_I64, args[0], args[1]);
+         break;
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
+     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
+     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
++    case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
++    case INDEX_op_ext8s_i64:
+     default:
+         g_assert_not_reached();
+     }
+diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/sparc64/tcg-target.c.inc
++++ b/tcg/sparc64/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi(TCGContext *s, TCGType type,
+     tcg_out_movi_int(s, type, ret, arg, false, TCG_REG_T2);
+ }
++static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
++{
++    g_assert_not_reached();
++}
++
+ static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
+                              tcg_target_long imm)
+ {
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
+     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
+     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
++    case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
++    case INDEX_op_ext8s_i64:
+     default:
+         g_assert_not_reached();
+     }
+diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/tci/tcg-target.c.inc
++++ b/tcg/tci/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi(TCGContext *s, TCGType type,
+     }
+ }
++static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
++{
++    switch (type) {
++    case TCG_TYPE_I32:
++        tcg_debug_assert(TCG_TARGET_HAS_ext8s_i32);
++        tcg_out_op_rr(s, INDEX_op_ext8s_i32, rd, rs);
++        break;
++#if TCG_TARGET_REG_BITS == 64
++    case TCG_TYPE_I64:
++        tcg_debug_assert(TCG_TARGET_HAS_ext8s_i64);
++        tcg_out_op_rr(s, INDEX_op_ext8s_i64, rd, rs);
++        break;
++#endif
++    default:
++        g_assert_not_reached();
++    }
++}
++
+ static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
+                              tcg_target_long imm)
+ {
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     CASE_32_64(neg)      /* Optional (TCG_TARGET_HAS_neg_*). */
+     CASE_32_64(not)      /* Optional (TCG_TARGET_HAS_not_*). */
+-    CASE_32_64(ext8s)    /* Optional (TCG_TARGET_HAS_ext8s_*). */
+     CASE_32_64(ext8u)    /* Optional (TCG_TARGET_HAS_ext8u_*). */
+     CASE_32_64(ext16s)   /* Optional (TCG_TARGET_HAS_ext16s_*). */
+     CASE_32_64(ext16u)   /* Optional (TCG_TARGET_HAS_ext16u_*). */
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
+     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
+     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
++    case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
++    case INDEX_op_ext8s_i64:
+     default:
+         g_assert_not_reached();
+     }
+--
+.34.1

-New patch
+[PULL 04/15] tcg: Split out tcg_out_ext8u
+We will need a backend interface for performing 8-bit zero-extend.
+Use it in tcg_reg_alloc_op in the meantime.
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/tcg.c                        |  5 +++++
+ tcg/aarch64/tcg-target.c.inc     | 11 +++++++----
+ tcg/arm/tcg-target.c.inc         | 12 +++++++++---
+ tcg/i386/tcg-target.c.inc        |  7 +++----
+ tcg/loongarch64/tcg-target.c.inc |  7 ++-----
+ tcg/mips/tcg-target.c.inc        |  9 ++++++++-
+ tcg/ppc/tcg-target.c.inc         |  7 +++++++
+ tcg/riscv/tcg-target.c.inc       |  7 ++-----
+ tcg/s390x/tcg-target.c.inc       | 14 +++++---------
+ tcg/sparc64/tcg-target.c.inc     |  9 ++++++++-
+ tcg/tci/tcg-target.c.inc         | 14 +++++++++++++-
+files changed, 69 insertions(+), 33 deletions(-)
+diff --git a/tcg/tcg.c b/tcg/tcg.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/tcg.c
++++ b/tcg/tcg.c
+@@ -XXX,XX +XXX,XX @@ static bool tcg_out_mov(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg);
+ static void tcg_out_movi(TCGContext *s, TCGType type,
+                          TCGReg ret, tcg_target_long arg);
+ static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg);
++static void tcg_out_ext8u(TCGContext *s, TCGReg ret, TCGReg arg);
+ static void tcg_out_addi_ptr(TCGContext *s, TCGReg, TCGReg, tcg_target_long);
+ static void tcg_out_exit_tb(TCGContext *s, uintptr_t arg);
+ static void tcg_out_goto_tb(TCGContext *s, int which);
+@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
+     case INDEX_op_ext8s_i64:
+         tcg_out_ext8s(s, TCG_TYPE_I64, new_args[0], new_args[1]);
+         break;
++    case INDEX_op_ext8u_i32:
++    case INDEX_op_ext8u_i64:
++        tcg_out_ext8u(s, new_args[0], new_args[1]);
++        break;
+     default:
+         if (def->flags & TCG_OPF_VECTOR) {
+             tcg_out_vec_op(s, op->opc, TCGOP_VECL(op), TCGOP_VECE(op),
+diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/aarch64/tcg-target.c.inc
++++ b/tcg/aarch64/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_uxt(TCGContext *s, MemOp s_bits,
+     tcg_out_ubfm(s, 0, rd, rn, 0, bits);
+ }
++static void tcg_out_ext8u(TCGContext *s, TCGReg rd, TCGReg rn)
++{
++    tcg_out_uxt(s, MO_8, rd, rn);
++}
++
+ static void tcg_out_addsubi(TCGContext *s, int ext, TCGReg rd,
+                             TCGReg rn, int64_t aimm)
+ {
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_ext32s_i64:
+         tcg_out_sxt(s, TCG_TYPE_I64, MO_32, a0, a1);
+         break;
+-    case INDEX_op_ext8u_i64:
+-    case INDEX_op_ext8u_i32:
+-        tcg_out_uxt(s, MO_8, a0, a1);
+-        break;
+     case INDEX_op_ext16u_i64:
+     case INDEX_op_ext16u_i32:
+         tcg_out_uxt(s, MO_16, a0, a1);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
+     case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
+     case INDEX_op_ext8s_i64:
++    case INDEX_op_ext8u_i32:
++    case INDEX_op_ext8u_i64:
+     default:
+         g_assert_not_reached();
+     }
+diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/arm/tcg-target.c.inc
++++ b/tcg/arm/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8s(TCGContext *s, TCGType t, TCGReg rd, TCGReg rn)
+     tcg_out32(s, 0x06af0070 | (COND_AL << 28) | (rd << 12) | rn);
+ }
++static void tcg_out_ext8u(TCGContext *s, TCGReg rd, TCGReg rn)
++{
++    tcg_out_dat_imm(s, COND_AL, ARITH_AND, rd, rn, 0xff);
++}
++
+ static void __attribute__((unused))
+-tcg_out_ext8u(TCGContext *s, ARMCond cond, TCGReg rd, TCGReg rn)
++tcg_out_ext8u_cond(TCGContext *s, ARMCond cond, TCGReg rd, TCGReg rn)
+ {
+     tcg_out_dat_imm(s, cond, ARITH_AND, rd, rn, 0xff);
+ }
+@@ -XXX,XX +XXX,XX @@ static TCGReg NAME(TCGContext *s, TCGReg argreg, ARGTYPE arg)              \
+ DEFINE_TCG_OUT_ARG(tcg_out_arg_imm32, uint32_t, tcg_out_movi32,
+     (tcg_out_movi32(s, COND_AL, TCG_REG_TMP, arg), arg = TCG_REG_TMP))
+-DEFINE_TCG_OUT_ARG(tcg_out_arg_reg8, TCGReg, tcg_out_ext8u,
+-    (tcg_out_ext8u(s, COND_AL, TCG_REG_TMP, arg), arg = TCG_REG_TMP))
++DEFINE_TCG_OUT_ARG(tcg_out_arg_reg8, TCGReg, tcg_out_ext8u_cond,
++    (tcg_out_ext8u_cond(s, COND_AL, TCG_REG_TMP, arg), arg = TCG_REG_TMP))
+ DEFINE_TCG_OUT_ARG(tcg_out_arg_reg16, TCGReg, tcg_out_ext16u,
+     (tcg_out_ext16u(s, COND_AL, TCG_REG_TMP, arg), arg = TCG_REG_TMP))
+ DEFINE_TCG_OUT_ARG(tcg_out_arg_reg32, TCGReg, tcg_out_mov_reg, )
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
+     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
+     case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
++    case INDEX_op_ext8u_i32:
+     default:
+         g_assert_not_reached();
+     }
+diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/i386/tcg-target.c.inc
++++ b/tcg/i386/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_rolw_8(TCGContext *s, int reg)
+     tcg_out_shifti(s, SHIFT_ROL + P_DATA16, reg, 8);
+ }
+-static inline void tcg_out_ext8u(TCGContext *s, int dest, int src)
++static void tcg_out_ext8u(TCGContext *s, TCGReg dest, TCGReg src)
+ {
+     /* movzbl */
+     tcg_debug_assert(src < 4 || TCG_TARGET_REG_BITS == 64);
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     OP_32_64(ext16s):
+         tcg_out_ext16s(s, a0, a1, rexw);
+         break;
+-    OP_32_64(ext8u):
+-        tcg_out_ext8u(s, a0, a1);
+-        break;
+     OP_32_64(ext16u):
+         tcg_out_ext16u(s, a0, a1);
+         break;
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
+     case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
+     case INDEX_op_ext8s_i64:
++    case INDEX_op_ext8u_i32:
++    case INDEX_op_ext8u_i64:
+     default:
+         g_assert_not_reached();
+     }
+diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/loongarch64/tcg-target.c.inc
++++ b/tcg/loongarch64/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+         tcg_out_brcond(s, a2, a0, a1, arg_label(args[3]));
+         break;
+-    case INDEX_op_ext8u_i32:
+-    case INDEX_op_ext8u_i64:
+-        tcg_out_ext8u(s, a0, a1);
+-        break;
+-
+     case INDEX_op_ext16s_i32:
+     case INDEX_op_ext16s_i64:
+         tcg_out_ext16s(s, a0, a1);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
+     case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
+     case INDEX_op_ext8s_i64:
++    case INDEX_op_ext8u_i32:
++    case INDEX_op_ext8u_i64:
+     default:
+         g_assert_not_reached();
+     }
+diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/mips/tcg-target.c.inc
++++ b/tcg/mips/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
+     tcg_out_opc_reg(s, OPC_SEB, rd, TCG_REG_ZERO, rs);
+ }
++static void tcg_out_ext8u(TCGContext *s, TCGReg rd, TCGReg rs)
++{
++    tcg_out_opc_imm(s, OPC_ANDI, rd, rs, 0xff);
++}
++
+ static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
+                              tcg_target_long imm)
+ {
+@@ -XXX,XX +XXX,XX @@ static int tcg_out_call_iarg_reg8(TCGContext *s, int i, TCGReg arg)
+     if (i < ARRAY_SIZE(tcg_target_call_iarg_regs)) {
+         tmp = tcg_target_call_iarg_regs[i];
+     }
+-    tcg_out_opc_imm(s, OPC_ANDI, tmp, arg, 0xff);
++    tcg_out_ext8u(s, tmp, arg);
+     return tcg_out_call_iarg_reg(s, i, tmp);
+ }
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
+     case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
+     case INDEX_op_ext8s_i64:
++    case INDEX_op_ext8u_i32:
++    case INDEX_op_ext8u_i64:
+     default:
+         g_assert_not_reached();
+     }
+diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/ppc/tcg-target.c.inc
++++ b/tcg/ppc/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg dst, TCGReg src)
+     tcg_out32(s, EXTSB | RA(dst) | RS(src));
+ }
++static void tcg_out_ext8u(TCGContext *s, TCGReg dst, TCGReg src)
++{
++    tcg_out32(s, ANDI | SAI(src, dst, 0xff));
++}
++
+ static inline void tcg_out_ext16s(TCGContext *s, TCGReg dst, TCGReg src)
+ {
+     tcg_out32(s, EXTSH | RA(dst) | RS(src));
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_goto_tb:   /* Always emitted via tcg_out_goto_tb.  */
+     case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
+     case INDEX_op_ext8s_i64:
++    case INDEX_op_ext8u_i32:
++    case INDEX_op_ext8u_i64:
+     default:
+         g_assert_not_reached();
+     }
+diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/riscv/tcg-target.c.inc
++++ b/tcg/riscv/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+         tcg_out_qemu_st(s, args, true);
+         break;
+-    case INDEX_op_ext8u_i32:
+-    case INDEX_op_ext8u_i64:
+-        tcg_out_ext8u(s, a0, a1);
+-        break;
+-
+     case INDEX_op_ext16u_i32:
+     case INDEX_op_ext16u_i64:
+         tcg_out_ext16u(s, a0, a1);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
+     case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
+     case INDEX_op_ext8s_i64:
++    case INDEX_op_ext8u_i32:
++    case INDEX_op_ext8u_i64:
+     default:
+         g_assert_not_reached();
+     }
+diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/s390x/tcg-target.c.inc
++++ b/tcg/s390x/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg dest, TCGReg src)
+     tcg_out_insn(s, RRE, LGBR, dest, src);
+ }
+-static void tgen_ext8u(TCGContext *s, TCGType type, TCGReg dest, TCGReg src)
++static void tcg_out_ext8u(TCGContext *s, TCGReg dest, TCGReg src)
+ {
+     tcg_out_insn(s, RRE, LLGCR, dest, src);
+ }
+@@ -XXX,XX +XXX,XX @@ static void tgen_andi(TCGContext *s, TCGType type, TCGReg dest, uint64_t val)
+         return;
+     }
+     if ((val & valid) == 0xff) {
+-        tgen_ext8u(s, TCG_TYPE_I64, dest, dest);
++        tcg_out_ext8u(s, dest, dest);
+         return;
+     }
+     if ((val & valid) == 0xffff) {
+@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
+     }
+     switch (opc & MO_SIZE) {
+     case MO_UB:
+-        tgen_ext8u(s, TCG_TYPE_I64, TCG_REG_R4, data_reg);
++        tcg_out_ext8u(s, TCG_REG_R4, data_reg);
+         break;
+     case MO_UW:
+         tgen_ext16u(s, TCG_TYPE_I64, TCG_REG_R4, data_reg);
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_ext16s_i32:
+         tgen_ext16s(s, TCG_TYPE_I32, args[0], args[1]);
+         break;
+-    case INDEX_op_ext8u_i32:
+-        tgen_ext8u(s, TCG_TYPE_I32, args[0], args[1]);
+-        break;
+     case INDEX_op_ext16u_i32:
+         tgen_ext16u(s, TCG_TYPE_I32, args[0], args[1]);
+         break;
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_ext32s_i64:
+         tgen_ext32s(s, args[0], args[1]);
+         break;
+-    case INDEX_op_ext8u_i64:
+-        tgen_ext8u(s, TCG_TYPE_I64, args[0], args[1]);
+-        break;
+     case INDEX_op_ext16u_i64:
+         tgen_ext16u(s, TCG_TYPE_I64, args[0], args[1]);
+         break;
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
+     case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
+     case INDEX_op_ext8s_i64:
++    case INDEX_op_ext8u_i32:
++    case INDEX_op_ext8u_i64:
+     default:
+         g_assert_not_reached();
+     }
+diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/sparc64/tcg-target.c.inc
++++ b/tcg/sparc64/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
+     g_assert_not_reached();
+ }
++static void tcg_out_ext8u(TCGContext *s, TCGReg rd, TCGReg rs)
++{
++    tcg_out_arithi(s, rd, rs, 0xff, ARITH_AND);
++}
++
+ static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
+                              tcg_target_long imm)
+ {
+@@ -XXX,XX +XXX,XX @@ static void emit_extend(TCGContext *s, TCGReg r, int op)
+      */
+     switch (op & MO_SIZE) {
+     case MO_8:
+-        tcg_out_arithi(s, r, r, 0xff, ARITH_AND);
++        tcg_out_ext8u(s, r, r);
+         break;
+     case MO_16:
+         tcg_out_arithi(s, r, r, 16, SHIFT_SLL);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
+     case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
+     case INDEX_op_ext8s_i64:
++    case INDEX_op_ext8u_i32:
++    case INDEX_op_ext8u_i64:
+     default:
+         g_assert_not_reached();
+     }
+diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/tci/tcg-target.c.inc
++++ b/tcg/tci/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
+     }
+ }
++static void tcg_out_ext8u(TCGContext *s, TCGReg rd, TCGReg rs)
++{
++    if (TCG_TARGET_REG_BITS == 64) {
++        tcg_debug_assert(TCG_TARGET_HAS_ext8u_i64);
++        tcg_out_op_rr(s, INDEX_op_ext8u_i64, rd, rs);
++    } else {
++        tcg_debug_assert(TCG_TARGET_HAS_ext8u_i32);
++        tcg_out_op_rr(s, INDEX_op_ext8u_i32, rd, rs);
++    }
++}
++
+ static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
+                              tcg_target_long imm)
+ {
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     CASE_32_64(neg)      /* Optional (TCG_TARGET_HAS_neg_*). */
+     CASE_32_64(not)      /* Optional (TCG_TARGET_HAS_not_*). */
+-    CASE_32_64(ext8u)    /* Optional (TCG_TARGET_HAS_ext8u_*). */
+     CASE_32_64(ext16s)   /* Optional (TCG_TARGET_HAS_ext16s_*). */
+     CASE_32_64(ext16u)   /* Optional (TCG_TARGET_HAS_ext16u_*). */
+     CASE_64(ext32s)      /* Optional (TCG_TARGET_HAS_ext32s_i64). */
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
+     case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
+     case INDEX_op_ext8s_i64:
++    case INDEX_op_ext8u_i32:
++    case INDEX_op_ext8u_i64:
+     default:
+         g_assert_not_reached();
+     }
+--
+.34.1

-[PATCH for-8.0 01/11] util: import GTree as QTree
+[PULL 05/15] tcg: Split out tcg_out_ext16s
-From: Emilio Cota <cota@braap.org>
+We will need a backend interface for performing 16-bit sign-extend.
 Use it in tcg_reg_alloc_op in the meantime.
-The only reason to add this implementation is to control the memory allocator
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 used. Some users (e.g. TCG) cannot work reliably in multi-threaded
 environments (e.g. forking in user-mode) with GTree's allocator, GSlice.
 See https://gitlab.com/qemu-project/qemu/-/issues/285 for details.
 Importing GTree is a temporary workaround until GTree migrates away
 from GSlice.
 This implementation is identical to that in glib v2.75.0, except that
 we don't import recent additions to the API nor deprecated API calls,
 none of which are used in QEMU.
 I've imported tests from glib and added a benchmark just to
 make sure that performance is similar. Note: it cannot be identical
 because (1) we are not using GSlice, (2) we use different compilation flags
 (e.g. -fPIC) and (3) we're linking statically.
 $ cat /proc/cpuinfo| grep 'model name' | head -1
 model name      : AMD Ryzen 7 PRO 5850U with Radeon Graphics
 $ echo '0' | sudo tee /sys/devices/system/cpu/cpufreq/boost
 $ tests/bench/qtree-bench
  Tree         Op      32            1024            4096          131072         1048576
 ------------------------------------------------------------------------------------------------
 GTree     Lookup   83.23           43.08           25.31           19.40           16.22
 QTree     Lookup  113.42 (1.36x)   53.83 (1.25x)   28.38 (1.12x)   17.64 (0.91x)   13.04 (0.80x)
 GTree     Insert   44.23           29.37           25.83           19.49           17.03
 QTree     Insert   46.87 (1.06x)   25.62 (0.87x)   24.29 (0.94x)   16.83 (0.86x)   12.97 (0.76x)
 GTree     Remove   53.27           35.15           31.43           24.64           16.70
 QTree     Remove   57.32 (1.08x)   41.76 (1.19x)   38.37 (1.22x)   29.30 (1.19x)   15.07 (0.90x)
 GTree  RemoveAll  135.44          127.52          126.72          120.11           64.34
 QTree  RemoveAll  127.15 (0.94x)  110.37 (0.87x)  107.97 (0.85x)   97.13 (0.81x)   55.10 (0.86x)
 GTree   Traverse  277.71          276.09          272.78          246.72           98.47
 QTree   Traverse  370.33 (1.33x)  411.97 (1.49x)  400.23 (1.47x)  262.82 (1.07x)   78.52 (0.80x)
 ------------------------------------------------------------------------------------------------
 As a sanity check, the same benchmark when Glib's version
 is >= $glib_dropped_gslice_version (i.e. QTree == GTree):
  Tree         Op      32            1024            4096          131072         1048576
 ------------------------------------------------------------------------------------------------
 GTree     Lookup   82.72           43.09           24.18           19.73           16.09
 QTree     Lookup   81.82 (0.99x)   43.10 (1.00x)   24.20 (1.00x)   19.76 (1.00x)   16.26 (1.01x)
 GTree     Insert   45.07           29.62           26.34           19.90           17.18
 QTree     Insert   45.72 (1.01x)   29.60 (1.00x)   26.38 (1.00x)   19.71 (0.99x)   17.20 (1.00x)
 GTree     Remove   54.48           35.36           31.77           24.97           16.95
 QTree     Remove   54.46 (1.00x)   35.32 (1.00x)   31.77 (1.00x)   24.91 (1.00x)   17.15 (1.01x)
 GTree  RemoveAll  140.68          127.36          125.43          121.45           68.20
 QTree  RemoveAll  140.65 (1.00x)  127.64 (1.00x)  125.01 (1.00x)  121.73 (1.00x)   67.06 (0.98x)
 GTree   Traverse  278.68          276.05          266.75          251.65          104.93
 QTree   Traverse  278.31 (1.00x)  275.78 (1.00x)  266.42 (1.00x)  247.89 (0.99x)  104.58 (1.00x)
 ------------------------------------------------------------------------------------------------
 Signed-off-by: Emilio Cota <cota@braap.org>
 Message-Id: <20230205163758.416992-2-cota@braap.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- configure                 |   15 +
+ tcg/tcg.c                        |  7 +++++++
- meson.build               |    4 +
+ tcg/aarch64/tcg-target.c.inc     | 13 ++++++++-----
- include/qemu/qtree.h      |  201 ++++++
+ tcg/arm/tcg-target.c.inc         | 10 ++++------
- tests/bench/qtree-bench.c |  286 ++++++++
+ tcg/i386/tcg-target.c.inc        | 16 ++++++++--------
- tests/unit/test-qtree.c   |  333 +++++++++
+ tcg/loongarch64/tcg-target.c.inc | 13 +++++--------
- util/qtree.c              | 1390 +++++++++++++++++++++++++++++++++++++
+ tcg/mips/tcg-target.c.inc        | 11 ++++++++---
- tests/bench/meson.build   |    4 +
+ tcg/ppc/tcg-target.c.inc         | 12 +++++-------
- tests/unit/meson.build    |    1 +
+ tcg/riscv/tcg-target.c.inc       |  9 +++------
- util/meson.build          |    1 +
+ tcg/s390x/tcg-target.c.inc       | 12 ++++--------
-files changed, 2235 insertions(+)
+ tcg/sparc64/tcg-target.c.inc     |  7 +++++++
- create mode 100644 include/qemu/qtree.h
+ tcg/tci/tcg-target.c.inc         | 21 ++++++++++++++++++++-
- create mode 100644 tests/bench/qtree-bench.c
+files changed, 79 insertions(+), 52 deletions(-)
  create mode 100644 tests/unit/test-qtree.c
  create mode 100644 util/qtree.c
-diff --git a/configure b/configure
+diff --git a/tcg/tcg.c b/tcg/tcg.c
-index XXXXXXX..XXXXXXX 100755
+index XXXXXXX..XXXXXXX 100644
---- a/configure
+--- a/tcg/tcg.c
-+++ b/configure
++++ b/tcg/tcg.c
-@@ -XXX,XX +XXX,XX @@ safe_stack=""
+@@ -XXX,XX +XXX,XX @@ static bool tcg_out_mov(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg);
- use_containers="yes"
+ static void tcg_out_movi(TCGContext *s, TCGType type,
- gdb_bin=$(command -v "gdb-multiarch" || command -v "gdb")
+                          TCGReg ret, tcg_target_long arg);
- gdb_arches=""
+ static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg);
-+glib_has_gslice="no"
++static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg);
+ static void tcg_out_ext8u(TCGContext *s, TCGReg ret, TCGReg arg);
- if test -e "$source_path/.git"
+ static void tcg_out_addi_ptr(TCGContext *s, TCGReg, TCGReg, tcg_target_long);
- then
+ static void tcg_out_exit_tb(TCGContext *s, uintptr_t arg);
-@@ -XXX,XX +XXX,XX @@ for i in $glib_modules; do
+@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
-     fi
+     case INDEX_op_ext8u_i64:
- done
+         tcg_out_ext8u(s, new_args[0], new_args[1]);
+         break;
-+# Check whether glib has gslice, which we have to avoid for correctness.
++    case INDEX_op_ext16s_i32:
-+# TODO: remove this check and the corresponding workaround (qtree) when
++        tcg_out_ext16s(s, TCG_TYPE_I32, new_args[0], new_args[1]);
-+# the minimum supported glib is >= $glib_dropped_gslice_version.
++        break;
-+glib_dropped_gslice_version=2.75.3
++    case INDEX_op_ext16s_i64:
-+for i in $glib_modules; do
++        tcg_out_ext16s(s, TCG_TYPE_I64, new_args[0], new_args[1]);
-+    if ! $pkg_config --atleast-version=$glib_dropped_gslice_version $i; then
++        break;
-+        glib_has_gslice="yes"
+     default:
-+    break
+         if (def->flags & TCG_OPF_VECTOR) {
-+    fi
+             tcg_out_vec_op(s, op->opc, TCGOP_VECL(op), TCGOP_VECE(op),
-+done
+diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
-+
+index XXXXXXX..XXXXXXX 100644
- glib_bindir="$($pkg_config --variable=bindir glib-2.0)"
+--- a/tcg/aarch64/tcg-target.c.inc
- if test -z "$glib_bindir" ; then
++++ b/tcg/aarch64/tcg-target.c.inc
-     glib_bindir="$($pkg_config --variable=prefix glib-2.0)"/bin
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rn)
-@@ -XXX,XX +XXX,XX @@ echo "GLIB_CFLAGS=$glib_cflags" >> $config_host_mak
+     tcg_out_sxt(s, type, MO_8, rd, rn);
- echo "GLIB_LIBS=$glib_libs" >> $config_host_mak
+ }
- echo "GLIB_BINDIR=$glib_bindir" >> $config_host_mak
- echo "GLIB_VERSION=$($pkg_config --modversion glib-2.0)" >> $config_host_mak
++static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rn)
 +if test "$glib_has_gslice" = "yes" ; then
 +    echo "HAVE_GLIB_WITH_SLICE_ALLOCATOR=y" >> $config_host_mak
 +fi
  echo "QEMU_LDFLAGS=$QEMU_LDFLAGS" >> $config_host_mak
  echo "EXESUF=$EXESUF" >> $config_host_mak
 diff --git a/meson.build b/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/meson.build
 +++ b/meson.build
@@ -XXX,XX +XXX,XX @@ glib = declare_dependency(compile_args: config_host['GLIB_CFLAGS'].split(),
                            })
  # override glib dep with the configure results (for subprojects)
  meson.override_dependency('glib-2.0', glib)
 +# pass down whether Glib has the slice allocator
 +if config_host.has_key('HAVE_GLIB_WITH_SLICE_ALLOCATOR')
 +  config_host_data.set('HAVE_GLIB_WITH_SLICE_ALLOCATOR', true)
 +endif
  gio = not_found
  gdbus_codegen = not_found
 diff --git a/include/qemu/qtree.h b/include/qemu/qtree.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/qemu/qtree.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * GLIB - Library of useful routines for C programming
 + * Copyright (C) 1995-1997  Peter Mattis, Spencer Kimball and Josh MacDonald
 + *
 + * SPDX-License-Identifier: LGPL-2.1-or-later
 + *
 + * This library is free software; you can redistribute it and/or
 + * modify it under the terms of the GNU Lesser General Public
 + * License as published by the Free Software Foundation; either
 + * version 2.1 of the License, or (at your option) any later version.
 + *
 + * This library is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 + * Lesser General Public License for more details.
 + *
 + * You should have received a copy of the GNU Lesser General Public
 + * License along with this library; if not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +/*
 + * Modified by the GLib Team and others 1997-2000.  See the AUTHORS
 + * file for a list of people on the GLib Team.  See the ChangeLog
 + * files for a list of changes.  These files are distributed with
 + * GLib at ftp://ftp.gtk.org/pub/gtk/.
 + */
 +
 +/*
 + * QTree is a partial import of Glib's GTree. The parts excluded correspond
 + * to API calls either deprecated (e.g. g_tree_traverse) or recently added
 + * (e.g. g_tree_search_node, added in 2.68); neither have callers in QEMU.
 + *
 + * The reason for this import is to allow us to control the memory allocator
 + * used by the tree implementation. Until Glib 2.75.3, GTree uses Glib's
 + * slice allocator, which causes problems when forking in user-mode;
 + * see https://gitlab.com/qemu-project/qemu/-/issues/285 and glib's
 + * "45b5a6c1e gslice: Remove slice allocator and use malloc() instead".
 + *
 + * TODO: remove QTree when QEMU's minimum Glib version is >= 2.75.3.
 + */
 +
 +#ifndef QEMU_QTREE_H
 +#define QEMU_QTREE_H
 +
 +#include "qemu/osdep.h"
 +
 +#ifdef HAVE_GLIB_WITH_SLICE_ALLOCATOR
 +
 +typedef struct _QTree  QTree;
 +
 +typedef struct _QTreeNode QTreeNode;
 +
 +typedef gboolean (*QTraverseNodeFunc)(QTreeNode *node,
 +                                      gpointer user_data);
 +
 +/*
 + * Balanced binary trees
 + */
 +QTree *q_tree_new(GCompareFunc key_compare_func);
 +QTree *q_tree_new_with_data(GCompareDataFunc key_compare_func,
 +                            gpointer key_compare_data);
 +QTree *q_tree_new_full(GCompareDataFunc key_compare_func,
 +                       gpointer key_compare_data,
 +                       GDestroyNotify key_destroy_func,
 +                       GDestroyNotify value_destroy_func);
 +QTree *q_tree_ref(QTree *tree);
 +void q_tree_unref(QTree *tree);
 +void q_tree_destroy(QTree *tree);
 +void q_tree_insert(QTree *tree,
 +                   gpointer key,
 +                   gpointer value);
 +void q_tree_replace(QTree *tree,
 +                    gpointer key,
 +                    gpointer value);
 +gboolean q_tree_remove(QTree *tree,
 +                       gconstpointer key);
 +gboolean q_tree_steal(QTree *tree,
 +                      gconstpointer key);
 +gpointer q_tree_lookup(QTree *tree,
 +                       gconstpointer key);
 +gboolean q_tree_lookup_extended(QTree *tree,
 +                                gconstpointer lookup_key,
 +                                gpointer *orig_key,
 +                                gpointer *value);
 +void q_tree_foreach(QTree *tree,
 +                    GTraverseFunc func,
 +                    gpointer user_data);
 +gpointer q_tree_search(QTree *tree,
 +                       GCompareFunc search_func,
 +                       gconstpointer user_data);
 +gint q_tree_height(QTree *tree);
 +gint q_tree_nnodes(QTree *tree);
 +
 +#else /* !HAVE_GLIB_WITH_SLICE_ALLOCATOR */
 +
 +typedef GTree QTree;
 +typedef GTreeNode QTreeNode;
 +typedef GTraverseNodeFunc QTraverseNodeFunc;
 +
 +static inline QTree *q_tree_new(GCompareFunc key_compare_func)
 +{
-+    return g_tree_new(key_compare_func);
++    tcg_out_sxt(s, type, MO_16, rd, rn);
 +}
 +
-+static inline QTree *q_tree_new_with_data(GCompareDataFunc key_compare_func,
+ static inline void tcg_out_uxt(TCGContext *s, MemOp s_bits,
-+                                          gpointer key_compare_data)
+                                TCGReg rd, TCGReg rn)
  {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          tcg_out_rev(s, TCG_TYPE_I32, MO_16, a0, a1);
          if (a2 & TCG_BSWAP_OS) {
              /* Output must be sign-extended. */
 -            tcg_out_sxt(s, ext, MO_16, a0, a0);
 +            tcg_out_ext16s(s, ext, a0, a0);
          } else if ((a2 & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
              /* Output must be zero-extended, but input isn't. */
              tcg_out_uxt(s, MO_16, a0, a0);
          }
          break;
 -    case INDEX_op_ext16s_i64:
 -    case INDEX_op_ext16s_i32:
 -        tcg_out_sxt(s, ext, MO_16, a0, a1);
 -        break;
      case INDEX_op_ext_i32_i64:
      case INDEX_op_ext32s_i64:
          tcg_out_sxt(s, TCG_TYPE_I64, MO_32, a0, a1);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext8s_i64:
      case INDEX_op_ext8u_i32:
      case INDEX_op_ext8u_i64:
 +    case INDEX_op_ext16s_i64:
 +    case INDEX_op_ext16s_i32:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/arm/tcg-target.c.inc
 +++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ tcg_out_ext8u_cond(TCGContext *s, ARMCond cond, TCGReg rd, TCGReg rn)
      tcg_out_dat_imm(s, cond, ARITH_AND, rd, rn, 0xff);
  }
 -static void tcg_out_ext16s(TCGContext *s, ARMCond cond, TCGReg rd, TCGReg rn)
 +static void tcg_out_ext16s(TCGContext *s, TCGType t, TCGReg rd, TCGReg rn)
  {
      /* sxth */
 -    tcg_out32(s, 0x06bf0070 | (cond << 28) | (rd << 12) | rn);
 +    tcg_out32(s, 0x06bf0070 | (COND_AL << 28) | (rd << 12) | rn);
  }
  static void tcg_out_ext16u(TCGContext *s, ARMCond cond, TCGReg rd, TCGReg rn)
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
          tcg_out_ext8s(s, TCG_TYPE_I32, datalo, TCG_REG_R0);
          break;
      case MO_SW:
 -        tcg_out_ext16s(s, COND_AL, datalo, TCG_REG_R0);
 +        tcg_out_ext16s(s, TCG_TYPE_I32, datalo, TCG_REG_R0);
          break;
      default:
          tcg_out_mov_reg(s, COND_AL, datalo, TCG_REG_R0);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          tcg_out_bswap32(s, COND_AL, args[0], args[1]);
          break;
 -    case INDEX_op_ext16s_i32:
 -        tcg_out_ext16s(s, COND_AL, args[0], args[1]);
 -        break;
      case INDEX_op_ext16u_i32:
          tcg_out_ext16u(s, COND_AL, args[0], args[1]);
          break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
      case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
      case INDEX_op_ext8u_i32:
 +    case INDEX_op_ext16s_i32:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/i386/tcg-target.c.inc
 +++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_ext16u(TCGContext *s, int dest, int src)
      tcg_out_modrm(s, OPC_MOVZWL, dest, src);
  }
 -static inline void tcg_out_ext16s(TCGContext *s, int dest, int src, int rexw)
 +static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg dest, TCGReg src)
  {
 +    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
      /* movsw[lq] */
      tcg_out_modrm(s, OPC_MOVSWL + rexw, dest, src);
  }
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
      MemOp opc = get_memop(oi);
      TCGReg data_reg;
      tcg_insn_unit **label_ptr = &l->label_ptr[0];
 -    int rexw = (l->type == TCG_TYPE_I64 ? P_REXW : 0);
      /* resolve label address */
      tcg_patch32(label_ptr[0], s->code_ptr - label_ptr[0] - 4);
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
          tcg_out_ext8s(s, l->type, data_reg, TCG_REG_EAX);
          break;
      case MO_SW:
 -        tcg_out_ext16s(s, data_reg, TCG_REG_EAX, rexw);
 +        tcg_out_ext16s(s, l->type, data_reg, TCG_REG_EAX);
          break;
  #if TCG_TARGET_REG_BITS == 64
      case MO_SL:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg datalo, TCGReg datahi,
                                     TCGReg base, int index, intptr_t ofs,
                                     int seg, bool is64, MemOp memop)
  {
 +    TCGType type = is64 ? TCG_TYPE_I64 : TCG_TYPE_I32;
      bool use_movbe = false;
      int rexw = is64 * P_REXW;
      int movop = OPC_MOVL_GvEv;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg datalo, TCGReg datahi,
          if (use_movbe) {
              tcg_out_modrm_sib_offset(s, OPC_MOVBE_GyMy + P_DATA16 + seg,
                                       datalo, base, index, 0, ofs);
 -            tcg_out_ext16s(s, datalo, datalo, rexw);
 +            tcg_out_ext16s(s, type, datalo, datalo);
          } else {
              tcg_out_modrm_sib_offset(s, OPC_MOVSWL + rexw + seg,
                                       datalo, base, index, 0, ofs);
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
          tcg_out_modrm(s, OPC_GRP3_Ev + rexw, EXT3_NOT, a0);
          break;
 -    OP_32_64(ext16s):
 -        tcg_out_ext16s(s, a0, a1, rexw);
 -        break;
      OP_32_64(ext16u):
          tcg_out_ext16u(s, a0, a1);
          break;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
          if (a1 < 4 && a0 < 8) {
              tcg_out_modrm(s, OPC_MOVSBL, a0, a1 + 4);
          } else {
 -            tcg_out_ext16s(s, a0, a1, 0);
 +            tcg_out_ext16s(s, TCG_TYPE_I32, a0, a1);
              tcg_out_shifti(s, SHIFT_SAR, a0, 8);
          }
          break;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext8s_i64:
      case INDEX_op_ext8u_i32:
      case INDEX_op_ext8u_i64:
 +    case INDEX_op_ext16s_i32:
 +    case INDEX_op_ext16s_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/loongarch64/tcg-target.c.inc
 +++ b/tcg/loongarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg)
      tcg_out_opc_sext_b(s, ret, arg);
  }
 -static void tcg_out_ext16s(TCGContext *s, TCGReg ret, TCGReg arg)
 +static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg)
  {
      tcg_out_opc_sext_h(s, ret, arg);
  }
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
          tcg_out_ext8s(s, type, l->datalo_reg, TCG_REG_A0);
          break;
      case MO_SW:
 -        tcg_out_ext16s(s, l->datalo_reg, TCG_REG_A0);
 +        tcg_out_ext16s(s, type, l->datalo_reg, TCG_REG_A0);
          break;
      case MO_SL:
          tcg_out_ext32s(s, l->datalo_reg, TCG_REG_A0);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          tcg_out_brcond(s, a2, a0, a1, arg_label(args[3]));
          break;
 -    case INDEX_op_ext16s_i32:
 -    case INDEX_op_ext16s_i64:
 -        tcg_out_ext16s(s, a0, a1);
 -        break;
 -
      case INDEX_op_ext16u_i32:
      case INDEX_op_ext16u_i64:
          tcg_out_ext16u(s, a0, a1);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_bswap16_i64:
          tcg_out_opc_revb_2h(s, a0, a1);
          if (a2 & TCG_BSWAP_OS) {
 -            tcg_out_ext16s(s, a0, a0);
 +            tcg_out_ext16s(s, TCG_TYPE_REG, a0, a0);
          } else if ((a2 & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
              tcg_out_ext16u(s, a0, a0);
          }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext8s_i64:
      case INDEX_op_ext8u_i32:
      case INDEX_op_ext8u_i64:
 +    case INDEX_op_ext16s_i32:
 +    case INDEX_op_ext16s_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/mips/tcg-target.c.inc
 +++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8u(TCGContext *s, TCGReg rd, TCGReg rs)
      tcg_out_opc_imm(s, OPC_ANDI, rd, rs, 0xff);
  }
 +static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
 +{
-+    return g_tree_new_with_data(key_compare_func, key_compare_data);
++    tcg_debug_assert(TCG_TARGET_HAS_ext16s_i32);
 +    tcg_out_opc_reg(s, OPC_SEH, rd, TCG_REG_ZERO, rs);
 +}
 +
-+static inline QTree *q_tree_new_full(GCompareDataFunc key_compare_func,
+ static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
-+                                     gpointer key_compare_data,
+                              tcg_target_long imm)
-+                                     GDestroyNotify key_destroy_func,
+ {
-+                                     GDestroyNotify value_destroy_func)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_not_i64:
          i1 = OPC_NOR;
          goto do_unary;
 -    case INDEX_op_ext16s_i32:
 -    case INDEX_op_ext16s_i64:
 -        i1 = OPC_SEH;
      do_unary:
          tcg_out_opc_reg(s, i1, a0, TCG_REG_ZERO, a1);
          break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext8s_i64:
      case INDEX_op_ext8u_i32:
      case INDEX_op_ext8u_i64:
 +    case INDEX_op_ext16s_i32:
 +    case INDEX_op_ext16s_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/ppc/tcg-target.c.inc
 +++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8u(TCGContext *s, TCGReg dst, TCGReg src)
      tcg_out32(s, ANDI | SAI(src, dst, 0xff));
  }
 -static inline void tcg_out_ext16s(TCGContext *s, TCGReg dst, TCGReg src)
 +static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg dst, TCGReg src)
  {
      tcg_out32(s, EXTSH | RA(dst) | RS(src));
  }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_bswap16(TCGContext *s, TCGReg dst, TCGReg src, int flags)
      if (have_isa_3_10) {
          tcg_out32(s, BRH | RA(dst) | RS(src));
          if (flags & TCG_BSWAP_OS) {
 -            tcg_out_ext16s(s, dst, dst);
 +            tcg_out_ext16s(s, TCG_TYPE_REG, dst, dst);
          } else if ((flags & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
              tcg_out_ext16u(s, dst, dst);
          }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_bswap16(TCGContext *s, TCGReg dst, TCGReg src, int flags)
      tcg_out_rlw(s, RLWIMI, tmp, src, 8, 16, 23);
      if (flags & TCG_BSWAP_OS) {
 -        tcg_out_ext16s(s, dst, tmp);
 +        tcg_out_ext16s(s, TCG_TYPE_REG, dst, tmp);
      } else {
          tcg_out_mov(s, TCG_TYPE_REG, dst, tmp);
      }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          tcg_out_qemu_st(s, args, true);
          break;
 -    case INDEX_op_ext16s_i32:
 -    case INDEX_op_ext16s_i64:
 -        tcg_out_ext16s(s, args[0], args[1]);
 -        break;
      case INDEX_op_ext_i32_i64:
      case INDEX_op_ext32s_i64:
          tcg_out_ext32s(s, args[0], args[1]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext8s_i64:
      case INDEX_op_ext8u_i32:
      case INDEX_op_ext8u_i64:
 +    case INDEX_op_ext16s_i32:
 +    case INDEX_op_ext16s_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/riscv/tcg-target.c.inc
 +++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg)
      tcg_out_opc_imm(s, OPC_SRAIW, ret, ret, 24);
  }
 -static void tcg_out_ext16s(TCGContext *s, TCGReg ret, TCGReg arg)
 +static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg)
  {
      tcg_out_opc_imm(s, OPC_SLLIW, ret, arg, 16);
      tcg_out_opc_imm(s, OPC_SRAIW, ret, ret, 16);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          tcg_out_ext32u(s, a0, a1);
          break;
 -    case INDEX_op_ext16s_i32:
 -    case INDEX_op_ext16s_i64:
 -        tcg_out_ext16s(s, a0, a1);
 -        break;
 -
      case INDEX_op_ext32s_i64:
      case INDEX_op_extrl_i64_i32:
      case INDEX_op_ext_i32_i64:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext8s_i64:
      case INDEX_op_ext8u_i32:
      case INDEX_op_ext8u_i64:
 +    case INDEX_op_ext16s_i32:
 +    case INDEX_op_ext16s_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/s390x/tcg-target.c.inc
 +++ b/tcg/s390x/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8u(TCGContext *s, TCGReg dest, TCGReg src)
      tcg_out_insn(s, RRE, LLGCR, dest, src);
  }
 -static void tgen_ext16s(TCGContext *s, TCGType type, TCGReg dest, TCGReg src)
 +static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg dest, TCGReg src)
  {
      tcg_out_insn(s, RRE, LGHR, dest, src);
  }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp opc, TCGReg data,
      case MO_SW | MO_BSWAP:
          /* swapped sign-extended halfword load */
          tcg_out_insn(s, RXY, LRVH, data, base, index, disp);
 -        tgen_ext16s(s, TCG_TYPE_I64, data, data);
 +        tcg_out_ext16s(s, TCG_TYPE_REG, data, data);
          break;
      case MO_SW:
          tcg_out_insn(s, RXY, LGH, data, base, index, disp);
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
          }
          break;
 -    case INDEX_op_ext16s_i32:
 -        tgen_ext16s(s, TCG_TYPE_I32, args[0], args[1]);
 -        break;
      case INDEX_op_ext16u_i32:
          tgen_ext16u(s, TCG_TYPE_I32, args[0], args[1]);
          break;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
          }
          break;
 -    case INDEX_op_ext16s_i64:
 -        tgen_ext16s(s, TCG_TYPE_I64, args[0], args[1]);
 -        break;
      case INDEX_op_ext_i32_i64:
      case INDEX_op_ext32s_i64:
          tgen_ext32s(s, args[0], args[1]);
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext8s_i64:
      case INDEX_op_ext8u_i32:
      case INDEX_op_ext8u_i64:
 +    case INDEX_op_ext16s_i32:
 +    case INDEX_op_ext16s_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/sparc64/tcg-target.c.inc
 +++ b/tcg/sparc64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
      g_assert_not_reached();
  }
 +static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
 +{
-+    return g_tree_new_full(key_compare_func, key_compare_data,
++    g_assert_not_reached();
 +                           key_destroy_func, value_destroy_func);
 +}
 +
-+static inline QTree *q_tree_ref(QTree *tree)
+ static void tcg_out_ext8u(TCGContext *s, TCGReg rd, TCGReg rs)
  {
      tcg_out_arithi(s, rd, rs, 0xff, ARITH_AND);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext8s_i64:
      case INDEX_op_ext8u_i32:
      case INDEX_op_ext8u_i64:
 +    case INDEX_op_ext16s_i32:
 +    case INDEX_op_ext16s_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.c.inc
 +++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8u(TCGContext *s, TCGReg rd, TCGReg rs)
      }
  }
 +static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
 +{
-+    return g_tree_ref(tree);
++    switch (type) {
-+}
++    case TCG_TYPE_I32:
-+
++        tcg_debug_assert(TCG_TARGET_HAS_ext16s_i32);
-+static inline void q_tree_unref(QTree *tree)
++        tcg_out_op_rr(s, INDEX_op_ext16s_i32, rd, rs);
 +{
 +    g_tree_unref(tree);
 +}
 +
 +static inline void q_tree_destroy(QTree *tree)
 +{
 +    g_tree_destroy(tree);
 +}
 +
 +static inline void q_tree_insert(QTree *tree,
 +                                 gpointer key,
 +                                 gpointer value)
 +{
 +    g_tree_insert(tree, key, value);
 +}
 +
 +static inline void q_tree_replace(QTree *tree,
 +                                  gpointer key,
 +                                  gpointer value)
 +{
 +    g_tree_replace(tree, key, value);
 +}
 +
 +static inline gboolean q_tree_remove(QTree *tree,
 +                                     gconstpointer key)
 +{
 +    return g_tree_remove(tree, key);
 +}
 +
 +static inline gboolean q_tree_steal(QTree *tree,
 +                                    gconstpointer key)
 +{
 +    return g_tree_steal(tree, key);
 +}
 +
 +static inline gpointer q_tree_lookup(QTree *tree,
 +                                     gconstpointer key)
 +{
 +    return g_tree_lookup(tree, key);
 +}
 +
 +static inline gboolean q_tree_lookup_extended(QTree *tree,
 +                                              gconstpointer lookup_key,
 +                                              gpointer *orig_key,
 +                                              gpointer *value)
 +{
 +    return g_tree_lookup_extended(tree, lookup_key, orig_key, value);
 +}
 +
 +static inline void q_tree_foreach(QTree *tree,
 +                                  GTraverseFunc func,
 +                                  gpointer user_data)
 +{
 +    return g_tree_foreach(tree, func, user_data);
 +}
 +
 +static inline gpointer q_tree_search(QTree *tree,
 +                                     GCompareFunc search_func,
 +                                     gconstpointer user_data)
 +{
 +    return g_tree_search(tree, search_func, user_data);
 +}
 +
 +static inline gint q_tree_height(QTree *tree)
 +{
 +    return g_tree_height(tree);
 +}
 +
 +static inline gint q_tree_nnodes(QTree *tree)
 +{
 +    return g_tree_nnodes(tree);
 +}
 +
 +#endif /* HAVE_GLIB_WITH_SLICE_ALLOCATOR */
 +
 +#endif /* QEMU_QTREE_H */
 diff --git a/tests/bench/qtree-bench.c b/tests/bench/qtree-bench.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/bench/qtree-bench.c
@@ -XXX,XX +XXX,XX @@
 +/* SPDX-License-Identifier: GPL-2.0-or-later */
 +#include "qemu/osdep.h"
 +#include "qemu/qtree.h"
 +#include "qemu/timer.h"
 +
 +enum tree_op {
 +    OP_LOOKUP,
 +    OP_INSERT,
 +    OP_REMOVE,
 +    OP_REMOVE_ALL,
 +    OP_TRAVERSE,
 +};
 +
 +struct benchmark {
 +    const char * const name;
 +    enum tree_op op;
 +    bool fill_on_init;
 +};
 +
 +enum impl_type {
 +    IMPL_GTREE,
 +    IMPL_QTREE,
 +};
 +
 +struct tree_implementation {
 +    const char * const name;
 +    enum impl_type type;
 +};
 +
 +static const struct benchmark benchmarks[] = {
 +    {
 +        .name = "Lookup",
 +        .op = OP_LOOKUP,
 +        .fill_on_init = true,
 +    },
 +    {
 +        .name = "Insert",
 +        .op = OP_INSERT,
 +        .fill_on_init = false,
 +    },
 +    {
 +        .name = "Remove",
 +        .op = OP_REMOVE,
 +        .fill_on_init = true,
 +    },
 +    {
 +        .name = "RemoveAll",
 +        .op = OP_REMOVE_ALL,
 +        .fill_on_init = true,
 +    },
 +    {
 +        .name = "Traverse",
 +        .op = OP_TRAVERSE,
 +        .fill_on_init = true,
 +    },
 +};
 +
 +static const struct tree_implementation impls[] = {
 +    {
 +        .name = "GTree",
 +        .type = IMPL_GTREE,
 +    },
 +    {
 +        .name = "QTree",
 +        .type = IMPL_QTREE,
 +    },
 +};
 +
 +static int compare_func(const void *ap, const void *bp)
 +{
 +    const size_t *a = ap;
 +    const size_t *b = bp;
 +
 +    return *a - *b;
 +}
 +
 +static void init_empty_tree_and_keys(enum impl_type impl,
 +                                     void **ret_tree, size_t **ret_keys,
 +                                     size_t n_elems)
 +{
 +    size_t *keys = g_malloc_n(n_elems, sizeof(*keys));
 +    for (size_t i = 0; i < n_elems; i++) {
 +        keys[i] = i;
 +    }
 +
 +    void *tree;
 +    switch (impl) {
 +    case IMPL_GTREE:
 +        tree = g_tree_new(compare_func);
 +        break;
-+    case IMPL_QTREE:
++#if TCG_TARGET_REG_BITS == 64
-+        tree = q_tree_new(compare_func);
++    case TCG_TYPE_I64:
 +        tcg_debug_assert(TCG_TARGET_HAS_ext16s_i64);
 +        tcg_out_op_rr(s, INDEX_op_ext16s_i64, rd, rs);
 +        break;
-+    default:
++#endif
 +        g_assert_not_reached();
 +    }
 +
 +    *ret_tree = tree;
 +    *ret_keys = keys;
 +}
 +
 +static gboolean traverse_func(gpointer key, gpointer value, gpointer data)
 +{
 +    return FALSE;
 +}
 +
 +static inline void remove_all(void *tree, enum impl_type impl)
 +{
 +    switch (impl) {
 +    case IMPL_GTREE:
 +        g_tree_destroy(tree);
 +        break;
 +    case IMPL_QTREE:
 +        q_tree_destroy(tree);
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +}
 +
-+static int64_t run_benchmark(const struct benchmark *bench,
+ static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
-+                             enum impl_type impl,
+                              tcg_target_long imm)
-+                             size_t n_elems)
+ {
-+{
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
-+    void *tree;
-+    size_t *keys;
+     CASE_32_64(neg)      /* Optional (TCG_TARGET_HAS_neg_*). */
-+
+     CASE_32_64(not)      /* Optional (TCG_TARGET_HAS_not_*). */
-+    init_empty_tree_and_keys(impl, &tree, &keys, n_elems);
+-    CASE_32_64(ext16s)   /* Optional (TCG_TARGET_HAS_ext16s_*). */
-+    if (bench->fill_on_init) {
+     CASE_32_64(ext16u)   /* Optional (TCG_TARGET_HAS_ext16u_*). */
-+        for (size_t i = 0; i < n_elems; i++) {
+     CASE_64(ext32s)      /* Optional (TCG_TARGET_HAS_ext32s_i64). */
-+            switch (impl) {
+     CASE_64(ext32u)      /* Optional (TCG_TARGET_HAS_ext32u_i64). */
-+            case IMPL_GTREE:
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
-+                g_tree_insert(tree, &keys[i], &keys[i]);
+     case INDEX_op_ext8s_i64:
-+                break;
+     case INDEX_op_ext8u_i32:
-+            case IMPL_QTREE:
+     case INDEX_op_ext8u_i64:
-+                q_tree_insert(tree, &keys[i], &keys[i]);
++    case INDEX_op_ext16s_i32:
-+                break;
++    case INDEX_op_ext16s_i64:
-+            default:
+     default:
-+                g_assert_not_reached();
+         g_assert_not_reached();
-+            }
+     }
 +        }
 +    }
 +
 +    int64_t start_ns = get_clock();
 +    switch (bench->op) {
 +    case OP_LOOKUP:
 +        for (size_t i = 0; i < n_elems; i++) {
 +            void *value;
 +            switch (impl) {
 +            case IMPL_GTREE:
 +                value = g_tree_lookup(tree, &keys[i]);
 +                break;
 +            case IMPL_QTREE:
 +                value = q_tree_lookup(tree, &keys[i]);
 +                break;
 +            default:
 +                g_assert_not_reached();
 +            }
 +            (void)value;
 +        }
 +        break;
 +    case OP_INSERT:
 +        for (size_t i = 0; i < n_elems; i++) {
 +            switch (impl) {
 +            case IMPL_GTREE:
 +                g_tree_insert(tree, &keys[i], &keys[i]);
 +                break;
 +            case IMPL_QTREE:
 +                q_tree_insert(tree, &keys[i], &keys[i]);
 +                break;
 +            default:
 +                g_assert_not_reached();
 +            }
 +        }
 +        break;
 +    case OP_REMOVE:
 +        for (size_t i = 0; i < n_elems; i++) {
 +            switch (impl) {
 +            case IMPL_GTREE:
 +                g_tree_remove(tree, &keys[i]);
 +                break;
 +            case IMPL_QTREE:
 +                q_tree_remove(tree, &keys[i]);
 +                break;
 +            default:
 +                g_assert_not_reached();
 +            }
 +        }
 +        break;
 +    case OP_REMOVE_ALL:
 +        remove_all(tree, impl);
 +        break;
 +    case OP_TRAVERSE:
 +        switch (impl) {
 +        case IMPL_GTREE:
 +            g_tree_foreach(tree, traverse_func, NULL);
 +            break;
 +        case IMPL_QTREE:
 +            q_tree_foreach(tree, traverse_func, NULL);
 +            break;
 +        default:
 +            g_assert_not_reached();
 +        }
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +    int64_t ns = get_clock() - start_ns;
 +
 +    if (bench->op != OP_REMOVE_ALL) {
 +        remove_all(tree, impl);
 +    }
 +    g_free(keys);
 +
 +    return ns;
 +}
 +
 +int main(int argc, char *argv[])
 +{
 +    size_t sizes[] = {
 +        32,
 +        1024,
 +        1024 * 4,
 +        1024 * 128,
 +        1024 * 1024,
 +    };
 +
 +    double res[ARRAY_SIZE(benchmarks)][ARRAY_SIZE(impls)][ARRAY_SIZE(sizes)];
 +    for (int i = 0; i < ARRAY_SIZE(sizes); i++) {
 +        size_t size = sizes[i];
 +        for (int j = 0; j < ARRAY_SIZE(impls); j++) {
 +            const struct tree_implementation *impl = &impls[j];
 +            for (int k = 0; k < ARRAY_SIZE(benchmarks); k++) {
 +                const struct benchmark *bench = &benchmarks[k];
 +
 +                /* warm-up run */
 +                run_benchmark(bench, impl->type, size);
 +
 +                int64_t total_ns = 0;
 +                int64_t n_runs = 0;
 +                while (total_ns < 2e8 || n_runs < 5) {
 +                    total_ns += run_benchmark(bench, impl->type, size);
 +                    n_runs++;
 +                }
 +                double ns_per_run = (double)total_ns / n_runs;
 +
 +                /* Throughput, in Mops/s */
 +                res[k][j][i] = size / ns_per_run * 1e3;
 +            }
 +        }
 +    }
 +
 +    printf("# Results' breakdown: Tree, Op and #Elements. Units: Mops/s\n");
 +    printf("%5s %10s ", "Tree", "Op");
 +    for (int i = 0; i < ARRAY_SIZE(sizes); i++) {
 +        printf("%7zu         ", sizes[i]);
 +    }
 +    printf("\n");
 +    char separator[97];
 +    for (int i = 0; i < ARRAY_SIZE(separator) - 1; i++) {
 +        separator[i] = '-';
 +    }
 +    separator[ARRAY_SIZE(separator) - 1] = '\0';
 +    printf("%s\n", separator);
 +    for (int i = 0; i < ARRAY_SIZE(benchmarks); i++) {
 +        for (int j = 0; j < ARRAY_SIZE(impls); j++) {
 +            printf("%5s %10s ", impls[j].name, benchmarks[i].name);
 +            for (int k = 0; k < ARRAY_SIZE(sizes); k++) {
 +                printf("%7.2f ", res[i][j][k]);
 +                if (j == 0) {
 +                    printf("        ");
 +                } else {
 +                    if (res[i][0][k] != 0) {
 +                        double speedup = res[i][j][k] / res[i][0][k];
 +                        printf("(%4.2fx) ", speedup);
 +                    } else {
 +                        printf("(     ) ");
 +                    }
 +                }
 +            }
 +            printf("\n");
 +        }
 +    }
 +    printf("%s\n", separator);
 +    return 0;
 +}
 diff --git a/tests/unit/test-qtree.c b/tests/unit/test-qtree.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/unit/test-qtree.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * SPDX-License-Identifier: LGPL-2.1-or-later
 + *
 + * Tests for QTree.
 + * Original source: glib
 + *   https://gitlab.gnome.org/GNOME/glib/-/blob/main/glib/tests/tree.c
 + *   LGPL license.
 + *   Copyright (C) 1995-1997 Peter Mattis, Spencer Kimball and Josh MacDonald
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/qtree.h"
 +
 +static gint my_compare(gconstpointer a, gconstpointer b)
 +{
 +    const char *cha = a;
 +    const char *chb = b;
 +
 +    return *cha - *chb;
 +}
 +
 +static gint my_compare_with_data(gconstpointer a,
 +                                 gconstpointer b,
 +                                 gpointer user_data)
 +{
 +    const char *cha = a;
 +    const char *chb = b;
 +
 +    /* just check that we got the right data */
 +    g_assert(GPOINTER_TO_INT(user_data) == 123);
 +
 +    return *cha - *chb;
 +}
 +
 +static gint my_search(gconstpointer a, gconstpointer b)
 +{
 +    return my_compare(b, a);
 +}
 +
 +static gpointer destroyed_key;
 +static gpointer destroyed_value;
 +static guint destroyed_key_count;
 +static guint destroyed_value_count;
 +
 +static void my_key_destroy(gpointer key)
 +{
 +    destroyed_key = key;
 +    destroyed_key_count++;
 +}
 +
 +static void my_value_destroy(gpointer value)
 +{
 +    destroyed_value = value;
 +    destroyed_value_count++;
 +}
 +
 +static gint my_traverse(gpointer key, gpointer value, gpointer data)
 +{
 +    char *ch = key;
 +
 +    g_assert((*ch) > 0);
 +
 +    if (*ch == 'd') {
 +        return TRUE;
 +    }
 +
 +    return FALSE;
 +}
 +
 +char chars[] =
 +    "0123456789"
 +    "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
 +    "abcdefghijklmnopqrstuvwxyz";
 +
 +char chars2[] =
 +    "0123456789"
 +    "abcdefghijklmnopqrstuvwxyz";
 +
 +static gint check_order(gpointer key, gpointer value, gpointer data)
 +{
 +    char **p = data;
 +    char *ch = key;
 +
 +    g_assert(**p == *ch);
 +
 +    (*p)++;
 +
 +    return FALSE;
 +}
 +
 +static void test_tree_search(void)
 +{
 +    gint i;
 +    QTree *tree;
 +    gboolean removed;
 +    gchar c;
 +    gchar *p, *d;
 +
 +    tree = q_tree_new_with_data(my_compare_with_data, GINT_TO_POINTER(123));
 +
 +    for (i = 0; chars[i]; i++) {
 +        q_tree_insert(tree, &chars[i], &chars[i]);
 +    }
 +
 +    q_tree_foreach(tree, my_traverse, NULL);
 +
 +    g_assert(q_tree_nnodes(tree) == strlen(chars));
 +    g_assert(q_tree_height(tree) == 6);
 +
 +    p = chars;
 +    q_tree_foreach(tree, check_order, &p);
 +
 +    for (i = 0; i < 26; i++) {
 +        removed = q_tree_remove(tree, &chars[i + 10]);
 +        g_assert(removed);
 +    }
 +
 +    c = '\0';
 +    removed = q_tree_remove(tree, &c);
 +    g_assert(!removed);
 +
 +    q_tree_foreach(tree, my_traverse, NULL);
 +
 +    g_assert(q_tree_nnodes(tree) == strlen(chars2));
 +    g_assert(q_tree_height(tree) == 6);
 +
 +    p = chars2;
 +    q_tree_foreach(tree, check_order, &p);
 +
 +    for (i = 25; i >= 0; i--) {
 +        q_tree_insert(tree, &chars[i + 10], &chars[i + 10]);
 +    }
 +
 +    p = chars;
 +    q_tree_foreach(tree, check_order, &p);
 +
 +    c = '0';
 +    p = q_tree_lookup(tree, &c);
 +    g_assert(p && *p == c);
 +    g_assert(q_tree_lookup_extended(tree, &c, (gpointer *)&d, (gpointer *)&p));
 +    g_assert(c == *d && c == *p);
 +
 +    c = 'A';
 +    p = q_tree_lookup(tree, &c);
 +    g_assert(p && *p == c);
 +
 +    c = 'a';
 +    p = q_tree_lookup(tree, &c);
 +    g_assert(p && *p == c);
 +
 +    c = 'z';
 +    p = q_tree_lookup(tree, &c);
 +    g_assert(p && *p == c);
 +
 +    c = '!';
 +    p = q_tree_lookup(tree, &c);
 +    g_assert(p == NULL);
 +
 +    c = '=';
 +    p = q_tree_lookup(tree, &c);
 +    g_assert(p == NULL);
 +
 +    c = '|';
 +    p = q_tree_lookup(tree, &c);
 +    g_assert(p == NULL);
 +
 +    c = '0';
 +    p = q_tree_search(tree, my_search, &c);
 +    g_assert(p && *p == c);
 +
 +    c = 'A';
 +    p = q_tree_search(tree, my_search, &c);
 +    g_assert(p && *p == c);
 +
 +    c = 'a';
 +    p = q_tree_search(tree, my_search, &c);
 +    g_assert(p && *p == c);
 +
 +    c = 'z';
 +    p = q_tree_search(tree, my_search, &c);
 +    g_assert(p && *p == c);
 +
 +    c = '!';
 +    p = q_tree_search(tree, my_search, &c);
 +    g_assert(p == NULL);
 +
 +    c = '=';
 +    p = q_tree_search(tree, my_search, &c);
 +    g_assert(p == NULL);
 +
 +    c = '|';
 +    p = q_tree_search(tree, my_search, &c);
 +    g_assert(p == NULL);
 +
 +    q_tree_destroy(tree);
 +}
 +
 +static void test_tree_remove(void)
 +{
 +    QTree *tree;
 +    char c, d;
 +    gint i;
 +    gboolean removed;
 +
 +    tree = q_tree_new_full((GCompareDataFunc)my_compare, NULL,
 +                           my_key_destroy,
 +                           my_value_destroy);
 +
 +    for (i = 0; chars[i]; i++) {
 +        q_tree_insert(tree, &chars[i], &chars[i]);
 +    }
 +
 +    c = '0';
 +    q_tree_insert(tree, &c, &c);
 +    g_assert(destroyed_key == &c);
 +    g_assert(destroyed_value == &chars[0]);
 +    destroyed_key = NULL;
 +    destroyed_value = NULL;
 +
 +    d = '1';
 +    q_tree_replace(tree, &d, &d);
 +    g_assert(destroyed_key == &chars[1]);
 +    g_assert(destroyed_value == &chars[1]);
 +    destroyed_key = NULL;
 +    destroyed_value = NULL;
 +
 +    c = '2';
 +    removed = q_tree_remove(tree, &c);
 +    g_assert(removed);
 +    g_assert(destroyed_key == &chars[2]);
 +    g_assert(destroyed_value == &chars[2]);
 +    destroyed_key = NULL;
 +    destroyed_value = NULL;
 +
 +    c = '3';
 +    removed = q_tree_steal(tree, &c);
 +    g_assert(removed);
 +    g_assert(destroyed_key == NULL);
 +    g_assert(destroyed_value == NULL);
 +
 +    const gchar *remove = "omkjigfedba";
 +    for (i = 0; remove[i]; i++) {
 +        removed = q_tree_remove(tree, &remove[i]);
 +        g_assert(removed);
 +    }
 +
 +    q_tree_destroy(tree);
 +}
 +
 +static void test_tree_destroy(void)
 +{
 +    QTree *tree;
 +    gint i;
 +
 +    tree = q_tree_new(my_compare);
 +
 +    for (i = 0; chars[i]; i++) {
 +        q_tree_insert(tree, &chars[i], &chars[i]);
 +    }
 +
 +    g_assert(q_tree_nnodes(tree) == strlen(chars));
 +
 +    g_test_message("nnodes: %d", q_tree_nnodes(tree));
 +    q_tree_ref(tree);
 +    q_tree_destroy(tree);
 +
 +    g_test_message("nnodes: %d", q_tree_nnodes(tree));
 +    g_assert(q_tree_nnodes(tree) == 0);
 +
 +    q_tree_unref(tree);
 +}
 +
 +static void test_tree_insert(void)
 +{
 +    QTree *tree;
 +    gchar *p;
 +    gint i;
 +    gchar *scrambled;
 +
 +    tree = q_tree_new(my_compare);
 +
 +    for (i = 0; chars[i]; i++) {
 +        q_tree_insert(tree, &chars[i], &chars[i]);
 +    }
 +    p = chars;
 +    q_tree_foreach(tree, check_order, &p);
 +
 +    q_tree_unref(tree);
 +    tree = q_tree_new(my_compare);
 +
 +    for (i = strlen(chars) - 1; i >= 0; i--) {
 +        q_tree_insert(tree, &chars[i], &chars[i]);
 +    }
 +    p = chars;
 +    q_tree_foreach(tree, check_order, &p);
 +
 +    q_tree_unref(tree);
 +    tree = q_tree_new(my_compare);
 +
 +    scrambled = g_strdup(chars);
 +
 +    for (i = 0; i < 30; i++) {
 +        gchar tmp;
 +        gint a, b;
 +
 +        a = g_random_int_range(0, strlen(scrambled));
 +        b = g_random_int_range(0, strlen(scrambled));
 +        tmp = scrambled[a];
 +        scrambled[a] = scrambled[b];
 +        scrambled[b] = tmp;
 +    }
 +
 +    for (i = 0; scrambled[i]; i++) {
 +        q_tree_insert(tree, &scrambled[i], &scrambled[i]);
 +    }
 +    p = chars;
 +    q_tree_foreach(tree, check_order, &p);
 +
 +    g_free(scrambled);
 +    q_tree_unref(tree);
 +}
 +
 +int main(int argc, char *argv[])
 +{
 +    g_test_init(&argc, &argv, NULL);
 +
 +    g_test_add_func("/qtree/search", test_tree_search);
 +    g_test_add_func("/qtree/remove", test_tree_remove);
 +    g_test_add_func("/qtree/destroy", test_tree_destroy);
 +    g_test_add_func("/qtree/insert", test_tree_insert);
 +
 +    return g_test_run();
 +}
 diff --git a/util/qtree.c b/util/qtree.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/util/qtree.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * GLIB - Library of useful routines for C programming
 + * Copyright (C) 1995-1997  Peter Mattis, Spencer Kimball and Josh MacDonald
 + *
 + * SPDX-License-Identifier: LGPL-2.1-or-later
 + *
 + * This library is free software; you can redistribute it and/or
 + * modify it under the terms of the GNU Lesser General Public
 + * License as published by the Free Software Foundation; either
 + * version 2.1 of the License, or (at your option) any later version.
 + *
 + * This library is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 + * Lesser General Public License for more details.
 + *
 + * You should have received a copy of the GNU Lesser General Public
 + * License along with this library; if not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +/*
 + * Modified by the GLib Team and others 1997-2000.  See the AUTHORS
 + * file for a list of people on the GLib Team.  See the ChangeLog
 + * files for a list of changes.  These files are distributed with
 + * GLib at ftp://ftp.gtk.org/pub/gtk/.
 + */
 +
 +/*
 + * MT safe
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/qtree.h"
 +
 +/**
 + * SECTION:trees-binary
 + * @title: Balanced Binary Trees
 + * @short_description: a sorted collection of key/value pairs optimized
 + *                     for searching and traversing in order
 + *
 + * The #QTree structure and its associated functions provide a sorted
 + * collection of key/value pairs optimized for searching and traversing
 + * in order. This means that most of the operations  (access, search,
 + * insertion, deletion, ...) on #QTree are O(log(n)) in average and O(n)
 + * in worst case for time complexity. But, note that maintaining a
 + * balanced sorted #QTree of n elements is done in time O(n log(n)).
 + *
 + * To create a new #QTree use q_tree_new().
 + *
 + * To insert a key/value pair into a #QTree use q_tree_insert()
 + * (O(n log(n))).
 + *
 + * To remove a key/value pair use q_tree_remove() (O(n log(n))).
 + *
 + * To look up the value corresponding to a given key, use
 + * q_tree_lookup() and q_tree_lookup_extended().
 + *
 + * To find out the number of nodes in a #QTree, use q_tree_nnodes(). To
 + * get the height of a #QTree, use q_tree_height().
 + *
 + * To traverse a #QTree, calling a function for each node visited in
 + * the traversal, use q_tree_foreach().
 + *
 + * To destroy a #QTree, use q_tree_destroy().
 + **/
 +
 +#define MAX_GTREE_HEIGHT 40
 +
 +/**
 + * QTree:
 + *
 + * The QTree struct is an opaque data structure representing a
 + * [balanced binary tree][glib-Balanced-Binary-Trees]. It should be
 + * accessed only by using the following functions.
 + */
 +struct _QTree {
 +    QTreeNode        *root;
 +    GCompareDataFunc  key_compare;
 +    GDestroyNotify    key_destroy_func;
 +    GDestroyNotify    value_destroy_func;
 +    gpointer          key_compare_data;
 +    guint             nnodes;
 +    gint              ref_count;
 +};
 +
 +struct _QTreeNode {
 +    gpointer   key;         /* key for this node */
 +    gpointer   value;       /* value stored at this node */
 +    QTreeNode *left;        /* left subtree */
 +    QTreeNode *right;       /* right subtree */
 +    gint8      balance;     /* height (right) - height (left) */
 +    guint8     left_child;
 +    guint8     right_child;
 +};
 +
 +
 +static QTreeNode *q_tree_node_new(gpointer       key,
 +                                  gpointer       value);
 +static QTreeNode *q_tree_insert_internal(QTree *tree,
 +                                         gpointer key,
 +                                         gpointer value,
 +                                         gboolean replace);
 +static gboolean   q_tree_remove_internal(QTree         *tree,
 +                                         gconstpointer  key,
 +                                         gboolean       steal);
 +static QTreeNode *q_tree_node_balance(QTreeNode     *node);
 +static QTreeNode *q_tree_find_node(QTree         *tree,
 +                                   gconstpointer  key);
 +static QTreeNode *q_tree_node_search(QTreeNode *node,
 +                                     GCompareFunc search_func,
 +                                     gconstpointer data);
 +static QTreeNode *q_tree_node_rotate_left(QTreeNode     *node);
 +static QTreeNode *q_tree_node_rotate_right(QTreeNode     *node);
 +#ifdef Q_TREE_DEBUG
 +static void       q_tree_node_check(QTreeNode     *node);
 +#endif
 +
 +static QTreeNode*
 +q_tree_node_new(gpointer key,
 +                gpointer value)
 +{
 +    QTreeNode *node = g_new(QTreeNode, 1);
 +
 +    node->balance = 0;
 +    node->left = NULL;
 +    node->right = NULL;
 +    node->left_child = FALSE;
 +    node->right_child = FALSE;
 +    node->key = key;
 +    node->value = value;
 +
 +    return node;
 +}
 +
 +/**
 + * q_tree_new:
 + * @key_compare_func: the function used to order the nodes in the #QTree.
 + *   It should return values similar to the standard strcmp() function -
 + *   0 if the two arguments are equal, a negative value if the first argument
 + *   comes before the second, or a positive value if the first argument comes
 + *   after the second.
 + *
 + * Creates a new #QTree.
 + *
 + * Returns: a newly allocated #QTree
 + */
 +QTree *
 +q_tree_new(GCompareFunc key_compare_func)
 +{
 +    g_return_val_if_fail(key_compare_func != NULL, NULL);
 +
 +    return q_tree_new_full((GCompareDataFunc) key_compare_func, NULL,
 +                           NULL, NULL);
 +}
 +
 +/**
 + * q_tree_new_with_data:
 + * @key_compare_func: qsort()-style comparison function
 + * @key_compare_data: data to pass to comparison function
 + *
 + * Creates a new #QTree with a comparison function that accepts user data.
 + * See q_tree_new() for more details.
 + *
 + * Returns: a newly allocated #QTree
 + */
 +QTree *
 +q_tree_new_with_data(GCompareDataFunc key_compare_func,
 +                     gpointer         key_compare_data)
 +{
 +    g_return_val_if_fail(key_compare_func != NULL, NULL);
 +
 +    return q_tree_new_full(key_compare_func, key_compare_data,
 +                           NULL, NULL);
 +}
 +
 +/**
 + * q_tree_new_full:
 + * @key_compare_func: qsort()-style comparison function
 + * @key_compare_data: data to pass to comparison function
 + * @key_destroy_func: a function to free the memory allocated for the key
 + *   used when removing the entry from the #QTree or %NULL if you don't
 + *   want to supply such a function
 + * @value_destroy_func: a function to free the memory allocated for the
 + *   value used when removing the entry from the #QTree or %NULL if you
 + *   don't want to supply such a function
 + *
 + * Creates a new #QTree like q_tree_new() and allows to specify functions
 + * to free the memory allocated for the key and value that get called when
 + * removing the entry from the #QTree.
 + *
 + * Returns: a newly allocated #QTree
 + */
 +QTree *
 +q_tree_new_full(GCompareDataFunc key_compare_func,
 +                gpointer         key_compare_data,
 +                GDestroyNotify   key_destroy_func,
 +                GDestroyNotify   value_destroy_func)
 +{
 +    QTree *tree;
 +
 +    g_return_val_if_fail(key_compare_func != NULL, NULL);
 +
 +    tree = g_new(QTree, 1);
 +    tree->root               = NULL;
 +    tree->key_compare        = key_compare_func;
 +    tree->key_destroy_func   = key_destroy_func;
 +    tree->value_destroy_func = value_destroy_func;
 +    tree->key_compare_data   = key_compare_data;
 +    tree->nnodes             = 0;
 +    tree->ref_count          = 1;
 +
 +    return tree;
 +}
 +
 +/**
 + * q_tree_node_first:
 + * @tree: a #QTree
 + *
 + * Returns the first in-order node of the tree, or %NULL
 + * for an empty tree.
 + *
 + * Returns: (nullable) (transfer none): the first node in the tree
 + *
 + * Since: 2.68 in GLib. Internal in Qtree, i.e. not in the public API.
 + */
 +static QTreeNode *
 +q_tree_node_first(QTree *tree)
 +{
 +    QTreeNode *tmp;
 +
 +    g_return_val_if_fail(tree != NULL, NULL);
 +
 +    if (!tree->root) {
 +        return NULL;
 +    }
 +
 +    tmp = tree->root;
 +
 +    while (tmp->left_child) {
 +        tmp = tmp->left;
 +    }
 +
 +    return tmp;
 +}
 +
 +/**
 + * q_tree_node_previous
 + * @node: a #QTree node
 + *
 + * Returns the previous in-order node of the tree, or %NULL
 + * if the passed node was already the first one.
 + *
 + * Returns: (nullable) (transfer none): the previous node in the tree
 + *
 + * Since: 2.68 in GLib. Internal in Qtree, i.e. not in the public API.
 + */
 +static QTreeNode *
 +q_tree_node_previous(QTreeNode *node)
 +{
 +    QTreeNode *tmp;
 +
 +    g_return_val_if_fail(node != NULL, NULL);
 +
 +    tmp = node->left;
 +
 +    if (node->left_child) {
 +        while (tmp->right_child) {
 +            tmp = tmp->right;
 +        }
 +    }
 +
 +    return tmp;
 +}
 +
 +/**
 + * q_tree_node_next
 + * @node: a #QTree node
 + *
 + * Returns the next in-order node of the tree, or %NULL
 + * if the passed node was already the last one.
 + *
 + * Returns: (nullable) (transfer none): the next node in the tree
 + *
 + * Since: 2.68 in GLib. Internal in Qtree, i.e. not in the public API.
 + */
 +static QTreeNode *
 +q_tree_node_next(QTreeNode *node)
 +{
 +    QTreeNode *tmp;
 +
 +    g_return_val_if_fail(node != NULL, NULL);
 +
 +    tmp = node->right;
 +
 +    if (node->right_child) {
 +        while (tmp->left_child) {
 +            tmp = tmp->left;
 +        }
 +    }
 +
 +    return tmp;
 +}
 +
 +/**
 + * q_tree_remove_all:
 + * @tree: a #QTree
 + *
 + * Removes all nodes from a #QTree and destroys their keys and values,
 + * then resets the #QTree’s root to %NULL.
 + *
 + * Since: 2.70 in GLib. Internal in Qtree, i.e. not in the public API.
 + */
 +static void
 +q_tree_remove_all(QTree *tree)
 +{
 +    QTreeNode *node;
 +    QTreeNode *next;
 +
 +    g_return_if_fail(tree != NULL);
 +
 +    node = q_tree_node_first(tree);
 +
 +    while (node) {
 +        next = q_tree_node_next(node);
 +
 +        if (tree->key_destroy_func) {
 +            tree->key_destroy_func(node->key);
 +        }
 +        if (tree->value_destroy_func) {
 +            tree->value_destroy_func(node->value);
 +        }
 +        g_free(node);
 +
 +#ifdef Q_TREE_DEBUG
 +        g_assert(tree->nnodes > 0);
 +        tree->nnodes--;
 +#endif
 +
 +        node = next;
 +    }
 +
 +#ifdef Q_TREE_DEBUG
 +    g_assert(tree->nnodes == 0);
 +#endif
 +
 +    tree->root = NULL;
 +#ifndef Q_TREE_DEBUG
 +    tree->nnodes = 0;
 +#endif
 +}
 +
 +/**
 + * q_tree_ref:
 + * @tree: a #QTree
 + *
 + * Increments the reference count of @tree by one.
 + *
 + * It is safe to call this function from any thread.
 + *
 + * Returns: the passed in #QTree
 + *
 + * Since: 2.22
 + */
 +QTree *
 +q_tree_ref(QTree *tree)
 +{
 +    g_return_val_if_fail(tree != NULL, NULL);
 +
 +    g_atomic_int_inc(&tree->ref_count);
 +
 +    return tree;
 +}
 +
 +/**
 + * q_tree_unref:
 + * @tree: a #QTree
 + *
 + * Decrements the reference count of @tree by one.
 + * If the reference count drops to 0, all keys and values will
 + * be destroyed (if destroy functions were specified) and all
 + * memory allocated by @tree will be released.
 + *
 + * It is safe to call this function from any thread.
 + *
 + * Since: 2.22
 + */
 +void
 +q_tree_unref(QTree *tree)
 +{
 +    g_return_if_fail(tree != NULL);
 +
 +    if (g_atomic_int_dec_and_test(&tree->ref_count)) {
 +        q_tree_remove_all(tree);
 +        g_free(tree);
 +    }
 +}
 +
 +/**
 + * q_tree_destroy:
 + * @tree: a #QTree
 + *
 + * Removes all keys and values from the #QTree and decreases its
 + * reference count by one. If keys and/or values are dynamically
 + * allocated, you should either free them first or create the #QTree
 + * using q_tree_new_full(). In the latter case the destroy functions
 + * you supplied will be called on all keys and values before destroying
 + * the #QTree.
 + */
 +void
 +q_tree_destroy(QTree *tree)
 +{
 +    g_return_if_fail(tree != NULL);
 +
 +    q_tree_remove_all(tree);
 +    q_tree_unref(tree);
 +}
 +
 +/**
 + * q_tree_insert_node:
 + * @tree: a #QTree
 + * @key: the key to insert
 + * @value: the value corresponding to the key
 + *
 + * Inserts a key/value pair into a #QTree.
 + *
 + * If the given key already exists in the #QTree its corresponding value
 + * is set to the new value. If you supplied a @value_destroy_func when
 + * creating the #QTree, the old value is freed using that function. If
 + * you supplied a @key_destroy_func when creating the #QTree, the passed
 + * key is freed using that function.
 + *
 + * The tree is automatically 'balanced' as new key/value pairs are added,
 + * so that the distance from the root to every leaf is as small as possible.
 + * The cost of maintaining a balanced tree while inserting new key/value
 + * result in a O(n log(n)) operation where most of the other operations
 + * are O(log(n)).
 + *
 + * Returns: (transfer none): the inserted (or set) node.
 + *
 + * Since: 2.68 in GLib. Internal in Qtree, i.e. not in the public API.
 + */
 +static QTreeNode *
 +q_tree_insert_node(QTree    *tree,
 +                   gpointer  key,
 +                   gpointer  value)
 +{
 +    QTreeNode *node;
 +
 +    g_return_val_if_fail(tree != NULL, NULL);
 +
 +    node = q_tree_insert_internal(tree, key, value, FALSE);
 +
 +#ifdef Q_TREE_DEBUG
 +    q_tree_node_check(tree->root);
 +#endif
 +
 +    return node;
 +}
 +
 +/**
 + * q_tree_insert:
 + * @tree: a #QTree
 + * @key: the key to insert
 + * @value: the value corresponding to the key
 + *
 + * Inserts a key/value pair into a #QTree.
 + *
 + * Inserts a new key and value into a #QTree as q_tree_insert_node() does,
 + * only this function does not return the inserted or set node.
 + */
 +void
 +q_tree_insert(QTree    *tree,
 +              gpointer  key,
 +              gpointer  value)
 +{
 +    q_tree_insert_node(tree, key, value);
 +}
 +
 +/**
 + * q_tree_replace_node:
 + * @tree: a #QTree
 + * @key: the key to insert
 + * @value: the value corresponding to the key
 + *
 + * Inserts a new key and value into a #QTree similar to q_tree_insert_node().
 + * The difference is that if the key already exists in the #QTree, it gets
 + * replaced by the new key. If you supplied a @value_destroy_func when
 + * creating the #QTree, the old value is freed using that function. If you
 + * supplied a @key_destroy_func when creating the #QTree, the old key is
 + * freed using that function.
 + *
 + * The tree is automatically 'balanced' as new key/value pairs are added,
 + * so that the distance from the root to every leaf is as small as possible.
 + *
 + * Returns: (transfer none): the inserted (or set) node.
 + *
 + * Since: 2.68 in GLib. Internal in Qtree, i.e. not in the public API.
 + */
 +static QTreeNode *
 +q_tree_replace_node(QTree    *tree,
 +                    gpointer  key,
 +                    gpointer  value)
 +{
 +    QTreeNode *node;
 +
 +    g_return_val_if_fail(tree != NULL, NULL);
 +
 +    node = q_tree_insert_internal(tree, key, value, TRUE);
 +
 +#ifdef Q_TREE_DEBUG
 +    q_tree_node_check(tree->root);
 +#endif
 +
 +    return node;
 +}
 +
 +/**
 + * q_tree_replace:
 + * @tree: a #QTree
 + * @key: the key to insert
 + * @value: the value corresponding to the key
 + *
 + * Inserts a new key and value into a #QTree as q_tree_replace_node() does,
 + * only this function does not return the inserted or set node.
 + */
 +void
 +q_tree_replace(QTree    *tree,
 +               gpointer  key,
 +               gpointer  value)
 +{
 +    q_tree_replace_node(tree, key, value);
 +}
 +
 +/* internal insert routine */
 +static QTreeNode *
 +q_tree_insert_internal(QTree    *tree,
 +                       gpointer  key,
 +                       gpointer  value,
 +                       gboolean  replace)
 +{
 +    QTreeNode *node, *retnode;
 +    QTreeNode *path[MAX_GTREE_HEIGHT];
 +    int idx;
 +
 +    g_return_val_if_fail(tree != NULL, NULL);
 +
 +    if (!tree->root) {
 +        tree->root = q_tree_node_new(key, value);
 +        tree->nnodes++;
 +        return tree->root;
 +    }
 +
 +    idx = 0;
 +    path[idx++] = NULL;
 +    node = tree->root;
 +
 +    while (1) {
 +        int cmp = tree->key_compare(key, node->key, tree->key_compare_data);
 +
 +        if (cmp == 0) {
 +            if (tree->value_destroy_func) {
 +                tree->value_destroy_func(node->value);
 +            }
 +
 +            node->value = value;
 +
 +            if (replace) {
 +                if (tree->key_destroy_func) {
 +                    tree->key_destroy_func(node->key);
 +                }
 +
 +                node->key = key;
 +            } else {
 +                /* free the passed key */
 +                if (tree->key_destroy_func) {
 +                    tree->key_destroy_func(key);
 +                }
 +            }
 +
 +            return node;
 +        } else if (cmp < 0) {
 +            if (node->left_child) {
 +                path[idx++] = node;
 +                node = node->left;
 +            } else {
 +                QTreeNode *child = q_tree_node_new(key, value);
 +
 +                child->left = node->left;
 +                child->right = node;
 +                node->left = child;
 +                node->left_child = TRUE;
 +                node->balance -= 1;
 +
 +                tree->nnodes++;
 +
 +                retnode = child;
 +                break;
 +            }
 +        } else {
 +            if (node->right_child) {
 +                path[idx++] = node;
 +                node = node->right;
 +            } else {
 +                QTreeNode *child = q_tree_node_new(key, value);
 +
 +                child->right = node->right;
 +                child->left = node;
 +                node->right = child;
 +                node->right_child = TRUE;
 +                node->balance += 1;
 +
 +                tree->nnodes++;
 +
 +                retnode = child;
 +                break;
 +            }
 +        }
 +    }
 +
 +    /*
 +     * Restore balance. This is the goodness of a non-recursive
 +     * implementation, when we are done with balancing we 'break'
 +     * the loop and we are done.
 +     */
 +    while (1) {
 +        QTreeNode *bparent = path[--idx];
 +        gboolean left_node = (bparent && node == bparent->left);
 +        g_assert(!bparent || bparent->left == node || bparent->right == node);
 +
 +        if (node->balance < -1 || node->balance > 1) {
 +            node = q_tree_node_balance(node);
 +            if (bparent == NULL) {
 +                tree->root = node;
 +            } else if (left_node) {
 +                bparent->left = node;
 +            } else {
 +                bparent->right = node;
 +            }
 +        }
 +
 +        if (node->balance == 0 || bparent == NULL) {
 +            break;
 +        }
 +
 +        if (left_node) {
 +            bparent->balance -= 1;
 +        } else {
 +            bparent->balance += 1;
 +        }
 +
 +        node = bparent;
 +    }
 +
 +    return retnode;
 +}
 +
 +/**
 + * q_tree_remove:
 + * @tree: a #QTree
 + * @key: the key to remove
 + *
 + * Removes a key/value pair from a #QTree.
 + *
 + * If the #QTree was created using q_tree_new_full(), the key and value
 + * are freed using the supplied destroy functions, otherwise you have to
 + * make sure that any dynamically allocated values are freed yourself.
 + * If the key does not exist in the #QTree, the function does nothing.
 + *
 + * The cost of maintaining a balanced tree while removing a key/value
 + * result in a O(n log(n)) operation where most of the other operations
 + * are O(log(n)).
 + *
 + * Returns: %TRUE if the key was found (prior to 2.8, this function
 + *     returned nothing)
 + */
 +gboolean
 +q_tree_remove(QTree         *tree,
 +              gconstpointer  key)
 +{
 +    gboolean removed;
 +
 +    g_return_val_if_fail(tree != NULL, FALSE);
 +
 +    removed = q_tree_remove_internal(tree, key, FALSE);
 +
 +#ifdef Q_TREE_DEBUG
 +    q_tree_node_check(tree->root);
 +#endif
 +
 +    return removed;
 +}
 +
 +/**
 + * q_tree_steal:
 + * @tree: a #QTree
 + * @key: the key to remove
 + *
 + * Removes a key and its associated value from a #QTree without calling
 + * the key and value destroy functions.
 + *
 + * If the key does not exist in the #QTree, the function does nothing.
 + *
 + * Returns: %TRUE if the key was found (prior to 2.8, this function
 + *     returned nothing)
 + */
 +gboolean
 +q_tree_steal(QTree         *tree,
 +             gconstpointer  key)
 +{
 +    gboolean removed;
 +
 +    g_return_val_if_fail(tree != NULL, FALSE);
 +
 +    removed = q_tree_remove_internal(tree, key, TRUE);
 +
 +#ifdef Q_TREE_DEBUG
 +    q_tree_node_check(tree->root);
 +#endif
 +
 +    return removed;
 +}
 +
 +/* internal remove routine */
 +static gboolean
 +q_tree_remove_internal(QTree         *tree,
 +                       gconstpointer  key,
 +                       gboolean       steal)
 +{
 +    QTreeNode *node, *parent, *balance;
 +    QTreeNode *path[MAX_GTREE_HEIGHT];
 +    int idx;
 +    gboolean left_node;
 +
 +    g_return_val_if_fail(tree != NULL, FALSE);
 +
 +    if (!tree->root) {
 +        return FALSE;
 +    }
 +
 +    idx = 0;
 +    path[idx++] = NULL;
 +    node = tree->root;
 +
 +    while (1) {
 +        int cmp = tree->key_compare(key, node->key, tree->key_compare_data);
 +
 +        if (cmp == 0) {
 +            break;
 +        } else if (cmp < 0) {
 +            if (!node->left_child) {
 +                return FALSE;
 +            }
 +
 +            path[idx++] = node;
 +            node = node->left;
 +        } else {
 +            if (!node->right_child) {
 +                return FALSE;
 +            }
 +
 +            path[idx++] = node;
 +            node = node->right;
 +        }
 +    }
 +
 +    /*
 +     * The following code is almost equal to q_tree_remove_node,
 +     * except that we do not have to call q_tree_node_parent.
 +     */
 +    balance = parent = path[--idx];
 +    g_assert(!parent || parent->left == node || parent->right == node);
 +    left_node = (parent && node == parent->left);
 +
 +    if (!node->left_child) {
 +        if (!node->right_child) {
 +            if (!parent) {
 +                tree->root = NULL;
 +            } else if (left_node) {
 +                parent->left_child = FALSE;
 +                parent->left = node->left;
 +                parent->balance += 1;
 +            } else {
 +                parent->right_child = FALSE;
 +                parent->right = node->right;
 +                parent->balance -= 1;
 +            }
 +        } else {
 +            /* node has a right child */
 +            QTreeNode *tmp = q_tree_node_next(node);
 +            tmp->left = node->left;
 +
 +            if (!parent) {
 +                tree->root = node->right;
 +            } else if (left_node) {
 +                parent->left = node->right;
 +                parent->balance += 1;
 +            } else {
 +                parent->right = node->right;
 +                parent->balance -= 1;
 +            }
 +        }
 +    } else {
 +        /* node has a left child */
 +        if (!node->right_child) {
 +            QTreeNode *tmp = q_tree_node_previous(node);
 +            tmp->right = node->right;
 +
 +            if (parent == NULL) {
 +                tree->root = node->left;
 +            } else if (left_node) {
 +                parent->left = node->left;
 +                parent->balance += 1;
 +            } else {
 +                parent->right = node->left;
 +                parent->balance -= 1;
 +            }
 +        } else {
 +            /* node has a both children (pant, pant!) */
 +            QTreeNode *prev = node->left;
 +            QTreeNode *next = node->right;
 +            QTreeNode *nextp = node;
 +            int old_idx = idx + 1;
 +            idx++;
 +
 +            /* path[idx] == parent */
 +            /* find the immediately next node (and its parent) */
 +            while (next->left_child) {
 +                path[++idx] = nextp = next;
 +                next = next->left;
 +            }
 +
 +            path[old_idx] = next;
 +            balance = path[idx];
 +
 +            /* remove 'next' from the tree */
 +            if (nextp != node) {
 +                if (next->right_child) {
 +                    nextp->left = next->right;
 +                } else {
 +                    nextp->left_child = FALSE;
 +                }
 +                nextp->balance += 1;
 +
 +                next->right_child = TRUE;
 +                next->right = node->right;
 +            } else {
 +                node->balance -= 1;
 +            }
 +
 +            /* set the prev to point to the right place */
 +            while (prev->right_child) {
 +                prev = prev->right;
 +            }
 +            prev->right = next;
 +
 +            /* prepare 'next' to replace 'node' */
 +            next->left_child = TRUE;
 +            next->left = node->left;
 +            next->balance = node->balance;
 +
 +            if (!parent) {
 +                tree->root = next;
 +            } else if (left_node) {
 +                parent->left = next;
 +            } else {
 +                parent->right = next;
 +            }
 +        }
 +    }
 +
 +    /* restore balance */
 +    if (balance) {
 +        while (1) {
 +            QTreeNode *bparent = path[--idx];
 +            g_assert(!bparent ||
 +                     bparent->left == balance ||
 +                     bparent->right == balance);
 +            left_node = (bparent && balance == bparent->left);
 +
 +            if (balance->balance < -1 || balance->balance > 1) {
 +                balance = q_tree_node_balance(balance);
 +                if (!bparent) {
 +                    tree->root = balance;
 +                } else if (left_node) {
 +                    bparent->left = balance;
 +                } else {
 +                    bparent->right = balance;
 +                }
 +            }
 +
 +            if (balance->balance != 0 || !bparent) {
 +                break;
 +            }
 +
 +            if (left_node) {
 +                bparent->balance += 1;
 +            } else {
 +                bparent->balance -= 1;
 +            }
 +
 +            balance = bparent;
 +        }
 +    }
 +
 +    if (!steal) {
 +        if (tree->key_destroy_func) {
 +            tree->key_destroy_func(node->key);
 +        }
 +        if (tree->value_destroy_func) {
 +            tree->value_destroy_func(node->value);
 +        }
 +    }
 +
 +    g_free(node);
 +
 +    tree->nnodes--;
 +
 +    return TRUE;
 +}
 +
 +/**
 + * q_tree_lookup_node:
 + * @tree: a #QTree
 + * @key: the key to look up
 + *
 + * Gets the tree node corresponding to the given key. Since a #QTree is
 + * automatically balanced as key/value pairs are added, key lookup
 + * is O(log n) (where n is the number of key/value pairs in the tree).
 + *
 + * Returns: (nullable) (transfer none): the tree node corresponding to
 + *          the key, or %NULL if the key was not found
 + *
 + * Since: 2.68 in GLib. Internal in Qtree, i.e. not in the public API.
 + */
 +static QTreeNode *
 +q_tree_lookup_node(QTree         *tree,
 +                   gconstpointer  key)
 +{
 +    g_return_val_if_fail(tree != NULL, NULL);
 +
 +    return q_tree_find_node(tree, key);
 +}
 +
 +/**
 + * q_tree_lookup:
 + * @tree: a #QTree
 + * @key: the key to look up
 + *
 + * Gets the value corresponding to the given key. Since a #QTree is
 + * automatically balanced as key/value pairs are added, key lookup
 + * is O(log n) (where n is the number of key/value pairs in the tree).
 + *
 + * Returns: the value corresponding to the key, or %NULL
 + *     if the key was not found
 + */
 +gpointer
 +q_tree_lookup(QTree         *tree,
 +              gconstpointer  key)
 +{
 +    QTreeNode *node;
 +
 +    node = q_tree_lookup_node(tree, key);
 +
 +    return node ? node->value : NULL;
 +}
 +
 +/**
 + * q_tree_lookup_extended:
 + * @tree: a #QTree
 + * @lookup_key: the key to look up
 + * @orig_key: (out) (optional) (nullable): returns the original key
 + * @value: (out) (optional) (nullable): returns the value associated with
 + *         the key
 + *
 + * Looks up a key in the #QTree, returning the original key and the
 + * associated value. This is useful if you need to free the memory
 + * allocated for the original key, for example before calling
 + * q_tree_remove().
 + *
 + * Returns: %TRUE if the key was found in the #QTree
 + */
 +gboolean
 +q_tree_lookup_extended(QTree         *tree,
 +                       gconstpointer  lookup_key,
 +                       gpointer      *orig_key,
 +                       gpointer      *value)
 +{
 +    QTreeNode *node;
 +
 +    g_return_val_if_fail(tree != NULL, FALSE);
 +
 +    node = q_tree_find_node(tree, lookup_key);
 +
 +    if (node) {
 +        if (orig_key) {
 +            *orig_key = node->key;
 +        }
 +        if (value) {
 +            *value = node->value;
 +        }
 +        return TRUE;
 +    } else {
 +        return FALSE;
 +    }
 +}
 +
 +/**
 + * q_tree_foreach:
 + * @tree: a #QTree
 + * @func: the function to call for each node visited.
 + *     If this function returns %TRUE, the traversal is stopped.
 + * @user_data: user data to pass to the function
 + *
 + * Calls the given function for each of the key/value pairs in the #QTree.
 + * The function is passed the key and value of each pair, and the given
 + * @data parameter. The tree is traversed in sorted order.
 + *
 + * The tree may not be modified while iterating over it (you can't
 + * add/remove items). To remove all items matching a predicate, you need
 + * to add each item to a list in your #GTraverseFunc as you walk over
 + * the tree, then walk the list and remove each item.
 + */
 +void
 +q_tree_foreach(QTree         *tree,
 +               GTraverseFunc  func,
 +               gpointer       user_data)
 +{
 +    QTreeNode *node;
 +
 +    g_return_if_fail(tree != NULL);
 +
 +    if (!tree->root) {
 +        return;
 +    }
 +
 +    node = q_tree_node_first(tree);
 +
 +    while (node) {
 +        if ((*func)(node->key, node->value, user_data)) {
 +            break;
 +        }
 +
 +        node = q_tree_node_next(node);
 +    }
 +}
 +
 +/**
 + * q_tree_search_node:
 + * @tree: a #QTree
 + * @search_func: a function used to search the #QTree
 + * @user_data: the data passed as the second argument to @search_func
 + *
 + * Searches a #QTree using @search_func.
 + *
 + * The @search_func is called with a pointer to the key of a key/value
 + * pair in the tree, and the passed in @user_data. If @search_func returns
 + * 0 for a key/value pair, then the corresponding node is returned as
 + * the result of q_tree_search(). If @search_func returns -1, searching
 + * will proceed among the key/value pairs that have a smaller key; if
 + * @search_func returns 1, searching will proceed among the key/value
 + * pairs that have a larger key.
 + *
 + * Returns: (nullable) (transfer none): the node corresponding to the
 + *          found key, or %NULL if the key was not found
 + *
 + * Since: 2.68 in GLib. Internal in Qtree, i.e. not in the public API.
 + */
 +static QTreeNode *
 +q_tree_search_node(QTree         *tree,
 +                   GCompareFunc   search_func,
 +                   gconstpointer  user_data)
 +{
 +    g_return_val_if_fail(tree != NULL, NULL);
 +
 +    if (!tree->root) {
 +        return NULL;
 +    }
 +
 +    return q_tree_node_search(tree->root, search_func, user_data);
 +}
 +
 +/**
 + * q_tree_search:
 + * @tree: a #QTree
 + * @search_func: a function used to search the #QTree
 + * @user_data: the data passed as the second argument to @search_func
 + *
 + * Searches a #QTree using @search_func.
 + *
 + * The @search_func is called with a pointer to the key of a key/value
 + * pair in the tree, and the passed in @user_data. If @search_func returns
 + * 0 for a key/value pair, then the corresponding value is returned as
 + * the result of q_tree_search(). If @search_func returns -1, searching
 + * will proceed among the key/value pairs that have a smaller key; if
 + * @search_func returns 1, searching will proceed among the key/value
 + * pairs that have a larger key.
 + *
 + * Returns: the value corresponding to the found key, or %NULL
 + *     if the key was not found
 + */
 +gpointer
 +q_tree_search(QTree         *tree,
 +              GCompareFunc   search_func,
 +              gconstpointer  user_data)
 +{
 +    QTreeNode *node;
 +
 +    node = q_tree_search_node(tree, search_func, user_data);
 +
 +    return node ? node->value : NULL;
 +}
 +
 +/**
 + * q_tree_height:
 + * @tree: a #QTree
 + *
 + * Gets the height of a #QTree.
 + *
 + * If the #QTree contains no nodes, the height is 0.
 + * If the #QTree contains only one root node the height is 1.
 + * If the root node has children the height is 2, etc.
 + *
 + * Returns: the height of @tree
 + */
 +gint
 +q_tree_height(QTree *tree)
 +{
 +    QTreeNode *node;
 +    gint height;
 +
 +    g_return_val_if_fail(tree != NULL, 0);
 +
 +    if (!tree->root) {
 +        return 0;
 +    }
 +
 +    height = 0;
 +    node = tree->root;
 +
 +    while (1) {
 +        height += 1 + MAX(node->balance, 0);
 +
 +        if (!node->left_child) {
 +            return height;
 +        }
 +
 +        node = node->left;
 +    }
 +}
 +
 +/**
 + * q_tree_nnodes:
 + * @tree: a #QTree
 + *
 + * Gets the number of nodes in a #QTree.
 + *
 + * Returns: the number of nodes in @tree
 + */
 +gint
 +q_tree_nnodes(QTree *tree)
 +{
 +    g_return_val_if_fail(tree != NULL, 0);
 +
 +    return tree->nnodes;
 +}
 +
 +static QTreeNode *
 +q_tree_node_balance(QTreeNode *node)
 +{
 +    if (node->balance < -1) {
 +        if (node->left->balance > 0) {
 +            node->left = q_tree_node_rotate_left(node->left);
 +        }
 +        node = q_tree_node_rotate_right(node);
 +    } else if (node->balance > 1) {
 +        if (node->right->balance < 0) {
 +            node->right = q_tree_node_rotate_right(node->right);
 +        }
 +        node = q_tree_node_rotate_left(node);
 +    }
 +
 +    return node;
 +}
 +
 +static QTreeNode *
 +q_tree_find_node(QTree        *tree,
 +                 gconstpointer key)
 +{
 +    QTreeNode *node;
 +    gint cmp;
 +
 +    node = tree->root;
 +    if (!node) {
 +        return NULL;
 +    }
 +
 +    while (1) {
 +        cmp = tree->key_compare(key, node->key, tree->key_compare_data);
 +        if (cmp == 0) {
 +            return node;
 +        } else if (cmp < 0) {
 +            if (!node->left_child) {
 +                return NULL;
 +            }
 +
 +            node = node->left;
 +        } else {
 +            if (!node->right_child) {
 +                return NULL;
 +            }
 +
 +            node = node->right;
 +        }
 +    }
 +}
 +
 +static QTreeNode *
 +q_tree_node_search(QTreeNode     *node,
 +                   GCompareFunc   search_func,
 +                   gconstpointer  data)
 +{
 +    gint dir;
 +
 +    if (!node) {
 +        return NULL;
 +    }
 +
 +    while (1) {
 +        dir = (*search_func)(node->key, data);
 +        if (dir == 0) {
 +            return node;
 +        } else if (dir < 0) {
 +            if (!node->left_child) {
 +                return NULL;
 +            }
 +
 +            node = node->left;
 +        } else {
 +            if (!node->right_child) {
 +                return NULL;
 +            }
 +
 +            node = node->right;
 +        }
 +    }
 +}
 +
 +static QTreeNode *
 +q_tree_node_rotate_left(QTreeNode *node)
 +{
 +    QTreeNode *right;
 +    gint a_bal;
 +    gint b_bal;
 +
 +    right = node->right;
 +
 +    if (right->left_child) {
 +        node->right = right->left;
 +    } else {
 +        node->right_child = FALSE;
 +        right->left_child = TRUE;
 +    }
 +    right->left = node;
 +
 +    a_bal = node->balance;
 +    b_bal = right->balance;
 +
 +    if (b_bal <= 0) {
 +        if (a_bal >= 1) {
 +            right->balance = b_bal - 1;
 +        } else {
 +            right->balance = a_bal + b_bal - 2;
 +        }
 +        node->balance = a_bal - 1;
 +    } else {
 +        if (a_bal <= b_bal) {
 +            right->balance = a_bal - 2;
 +        } else {
 +            right->balance = b_bal - 1;
 +        }
 +        node->balance = a_bal - b_bal - 1;
 +    }
 +
 +    return right;
 +}
 +
 +static QTreeNode *
 +q_tree_node_rotate_right(QTreeNode *node)
 +{
 +    QTreeNode *left;
 +    gint a_bal;
 +    gint b_bal;
 +
 +    left = node->left;
 +
 +    if (left->right_child) {
 +        node->left = left->right;
 +    } else {
 +        node->left_child = FALSE;
 +        left->right_child = TRUE;
 +    }
 +    left->right = node;
 +
 +    a_bal = node->balance;
 +    b_bal = left->balance;
 +
 +    if (b_bal <= 0) {
 +        if (b_bal > a_bal) {
 +            left->balance = b_bal + 1;
 +        } else {
 +            left->balance = a_bal + 2;
 +        }
 +        node->balance = a_bal - b_bal + 1;
 +    } else {
 +        if (a_bal <= -1) {
 +            left->balance = b_bal + 1;
 +        } else {
 +            left->balance = a_bal + b_bal + 2;
 +        }
 +        node->balance = a_bal + 1;
 +    }
 +
 +    return left;
 +}
 +
 +#ifdef Q_TREE_DEBUG
 +static gint
 +q_tree_node_height(QTreeNode *node)
 +{
 +    gint left_height;
 +    gint right_height;
 +
 +    if (node) {
 +        left_height = 0;
 +        right_height = 0;
 +
 +        if (node->left_child) {
 +            left_height = q_tree_node_height(node->left);
 +        }
 +
 +        if (node->right_child) {
 +            right_height = q_tree_node_height(node->right);
 +        }
 +
 +        return MAX(left_height, right_height) + 1;
 +    }
 +
 +    return 0;
 +}
 +
 +static void q_tree_node_check(QTreeNode *node)
 +{
 +    gint left_height;
 +    gint right_height;
 +    gint balance;
 +    QTreeNode *tmp;
 +
 +    if (node) {
 +        if (node->left_child) {
 +            tmp = q_tree_node_previous(node);
 +            g_assert(tmp->right == node);
 +        }
 +
 +        if (node->right_child) {
 +            tmp = q_tree_node_next(node);
 +            g_assert(tmp->left == node);
 +        }
 +
 +        left_height = 0;
 +        right_height = 0;
 +
 +        if (node->left_child) {
 +            left_height = q_tree_node_height(node->left);
 +        }
 +        if (node->right_child) {
 +            right_height = q_tree_node_height(node->right);
 +        }
 +
 +        balance = right_height - left_height;
 +        g_assert(balance == node->balance);
 +
 +        if (node->left_child) {
 +            q_tree_node_check(node->left);
 +        }
 +        if (node->right_child) {
 +            q_tree_node_check(node->right);
 +        }
 +    }
 +}
 +#endif
 diff --git a/tests/bench/meson.build b/tests/bench/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/bench/meson.build
 +++ b/tests/bench/meson.build
@@ -XXX,XX +XXX,XX @@ xbzrle_bench = executable('xbzrle-bench',
                         dependencies: [qemuutil,migration])
  endif
 +qtree_bench = executable('qtree-bench',
 +                         sources: 'qtree-bench.c',
 +                         dependencies: [qemuutil])
 +
  executable('atomic_add-bench',
             sources: files('atomic_add-bench.c'),
             dependencies: [qemuutil],
 diff --git a/tests/unit/meson.build b/tests/unit/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/unit/meson.build
 +++ b/tests/unit/meson.build
@@ -XXX,XX +XXX,XX @@ tests = {
    'test-rcu-slist': [],
    'test-qdist': [],
    'test-qht': [],
 +  'test-qtree': [],
    'test-bitops': [],
    'test-bitcnt': [],
    'test-qgraph': ['../qtest/libqos/qgraph.c'],
 diff --git a/util/meson.build b/util/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/util/meson.build
 +++ b/util/meson.build
@@ -XXX,XX +XXX,XX @@ util_ss.add(when: 'CONFIG_WIN32', if_true: files('oslib-win32.c'))
  util_ss.add(when: 'CONFIG_WIN32', if_true: files('qemu-thread-win32.c'))
  util_ss.add(when: 'CONFIG_WIN32', if_true: winmm)
  util_ss.add(when: 'CONFIG_WIN32', if_true: pathcch)
 +util_ss.add(when: 'HAVE_GLIB_WITH_SLICE_ALLOCATOR', if_true: files('qtree.c'))
  util_ss.add(files('envlist.c', 'path.c', 'module.c'))
  util_ss.add(files('host-utils.c'))
  util_ss.add(files('bitmap.c', 'bitops.c'))
 --
 .34.1

-[PATCH for-8.0 10/11] accel/tcg: Pass last not end to tb_invalidate_phys_range
+[PULL 06/15] tcg: Split out tcg_out_ext16u
-Pass the address of the last byte to be changed, rather than
+We will need a backend interface for performing 16-bit zero-extend.
-the first address past the last byte.  This avoids overflow
+Use it in tcg_reg_alloc_op in the meantime.
 when the last page of the address space is involved.
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/exec-all.h   |  2 +-
+ tcg/tcg.c                        |  5 +++++
- accel/tcg/tb-maint.c      | 31 ++++++++++++++++---------------
+ tcg/aarch64/tcg-target.c.inc     | 13 ++++++++-----
- accel/tcg/translate-all.c |  2 +-
+ tcg/arm/tcg-target.c.inc         | 17 ++++++++++-------
- accel/tcg/user-exec.c     |  2 +-
+ tcg/i386/tcg-target.c.inc        |  8 +++-----
- softmmu/physmem.c         |  2 +-
+ tcg/loongarch64/tcg-target.c.inc |  7 ++-----
-files changed, 20 insertions(+), 19 deletions(-)
+ tcg/mips/tcg-target.c.inc        |  5 +++++
  tcg/ppc/tcg-target.c.inc         |  4 +++-
  tcg/riscv/tcg-target.c.inc       |  7 ++-----
  tcg/s390x/tcg-target.c.inc       | 17 ++++++-----------
  tcg/sparc64/tcg-target.c.inc     | 11 +++++++++--
  tcg/tci/tcg-target.c.inc         | 14 +++++++++++++-
 files changed, 66 insertions(+), 42 deletions(-)
-diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
+diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/exec-all.h
+--- a/tcg/tcg.c
-+++ b/include/exec/exec-all.h
++++ b/tcg/tcg.c
-@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_addr(target_ulong addr);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi(TCGContext *s, TCGType type,
- void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs);
+ static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg);
- #endif
+ static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg);
- void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr);
+ static void tcg_out_ext8u(TCGContext *s, TCGReg ret, TCGReg arg);
--void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t end);
++static void tcg_out_ext16u(TCGContext *s, TCGReg ret, TCGReg arg);
-+void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t last);
+ static void tcg_out_addi_ptr(TCGContext *s, TCGReg, TCGReg, tcg_target_long);
- void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr);
+ static void tcg_out_exit_tb(TCGContext *s, uintptr_t arg);
+ static void tcg_out_goto_tb(TCGContext *s, int which);
- /* GETPC is the true target of the return instruction that we'll execute.  */
+@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
-diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
+     case INDEX_op_ext16s_i64:
-index XXXXXXX..XXXXXXX 100644
+         tcg_out_ext16s(s, TCG_TYPE_I64, new_args[0], new_args[1]);
---- a/accel/tcg/tb-maint.c
+         break;
-+++ b/accel/tcg/tb-maint.c
++    case INDEX_op_ext16u_i32:
-@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
++    case INDEX_op_ext16u_i64:
-  * Called with mmap_lock held for user-mode emulation.
++        tcg_out_ext16u(s, new_args[0], new_args[1]);
-  * NOTE: this function must not be called while a TB is running.
++        break;
-  */
+     default:
--void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t end)
+         if (def->flags & TCG_OPF_VECTOR) {
-+void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t last)
+             tcg_out_vec_op(s, op->opc, TCGOP_VECL(op), TCGOP_VECE(op),
- {
+diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
-     TranslationBlock *tb;
+index XXXXXXX..XXXXXXX 100644
-     PageForEachNext n;
+--- a/tcg/aarch64/tcg-target.c.inc
--    tb_page_addr_t last = end - 1;
++++ b/tcg/aarch64/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8u(TCGContext *s, TCGReg rd, TCGReg rn)
-     assert_memory_lock();
+     tcg_out_uxt(s, MO_8, rd, rn);
+ }
-@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t end)
-  */
++static void tcg_out_ext16u(TCGContext *s, TCGReg rd, TCGReg rn)
- void tb_invalidate_phys_page(tb_page_addr_t addr)
++{
- {
++    tcg_out_uxt(s, MO_16, rd, rn);
--    tb_page_addr_t start, end;
++}
 +    tb_page_addr_t start, last;
      start = addr & TARGET_PAGE_MASK;
 -    end = start + TARGET_PAGE_SIZE;
 -    tb_invalidate_phys_range(start, end);
 +    last = addr | ~TARGET_PAGE_MASK;
 +    tb_invalidate_phys_range(start, last);
  }
  /*
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_page(tb_page_addr_t addr)
  /*
   * Invalidate all TBs which intersect with the target physical address range
 - * [start;end[. NOTE: start and end may refer to *different* physical pages.
 + * [start;last]. NOTE: start and end may refer to *different* physical pages.
   * 'is_cpu_write_access' should be true if called from a real cpu write
   * access: the virtual CPU will exit the current TB if code is modified inside
   * this TB.
   */
 -void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t end)
 +void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t last)
  {
      struct page_collection *pages;
 -    tb_page_addr_t next;
 +    tb_page_addr_t index, index_last;
 -    pages = page_collection_lock(start, end - 1);
 -    for (next = (start & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
 -         start < end;
 -         start = next, next += TARGET_PAGE_SIZE) {
 -        PageDesc *pd = page_find(start >> TARGET_PAGE_BITS);
 -        tb_page_addr_t bound = MIN(next, end);
 +    pages = page_collection_lock(start, last);
 +
-+    index_last = last >> TARGET_PAGE_BITS;
+ static void tcg_out_addsubi(TCGContext *s, int ext, TCGReg rd,
-+    for (index = start >> TARGET_PAGE_BITS; index <= index_last; index++) {
+                             TCGReg rn, int64_t aimm)
-+        PageDesc *pd = page_find(index);
+ {
-+        tb_page_addr_t bound;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+             tcg_out_ext16s(s, ext, a0, a0);
-         if (pd == NULL) {
+         } else if ((a2 & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
-             continue;
+             /* Output must be zero-extended, but input isn't. */
 -            tcg_out_uxt(s, MO_16, a0, a0);
 +            tcg_out_ext16u(s, a0, a0);
          }
-         assert_page_locked(pd);
+         break;
--        tb_invalidate_phys_page_range__locked(pages, pd, start, bound - 1, 0);
-+        bound = (index << TARGET_PAGE_BITS) | ~TARGET_PAGE_MASK;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
-+        bound = MIN(bound, last);
+     case INDEX_op_ext32s_i64:
-+        tb_invalidate_phys_page_range__locked(pages, pd, start, bound, 0);
+         tcg_out_sxt(s, TCG_TYPE_I64, MO_32, a0, a1);
-     }
+         break;
-     page_collection_unlock(pages);
+-    case INDEX_op_ext16u_i64:
- }
+-    case INDEX_op_ext16u_i32:
-diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
+-        tcg_out_uxt(s, MO_16, a0, a1);
-index XXXXXXX..XXXXXXX 100644
+-        break;
---- a/accel/tcg/translate-all.c
+     case INDEX_op_extu_i32_i64:
-+++ b/accel/tcg/translate-all.c
+     case INDEX_op_ext32u_i64:
-@@ -XXX,XX +XXX,XX @@ void tb_check_watchpoint(CPUState *cpu, uintptr_t retaddr)
+         tcg_out_movr(s, TCG_TYPE_I32, a0, a1);
-         cpu_get_tb_cpu_state(env, &pc, &cs_base, &flags);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
-         addr = get_page_addr_code(env, pc);
+     case INDEX_op_ext8u_i64:
-         if (addr != -1) {
+     case INDEX_op_ext16s_i64:
--            tb_invalidate_phys_range(addr, addr + 1);
+     case INDEX_op_ext16s_i32:
-+            tb_invalidate_phys_range(addr, addr);
++    case INDEX_op_ext16u_i64:
 +    case INDEX_op_ext16u_i32:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/arm/tcg-target.c.inc
 +++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16s(TCGContext *s, TCGType t, TCGReg rd, TCGReg rn)
      tcg_out32(s, 0x06bf0070 | (COND_AL << 28) | (rd << 12) | rn);
  }
 -static void tcg_out_ext16u(TCGContext *s, ARMCond cond, TCGReg rd, TCGReg rn)
 +static void tcg_out_ext16u_cond(TCGContext *s, ARMCond cond,
 +                                TCGReg rd, TCGReg rn)
  {
      /* uxth */
      tcg_out32(s, 0x06ff0070 | (cond << 28) | (rd << 12) | rn);
  }
 +static void tcg_out_ext16u(TCGContext *s, TCGReg rd, TCGReg rn)
 +{
 +    tcg_out_ext16u_cond(s, COND_AL, rd, rn);
 +}
 +
  static void tcg_out_bswap16(TCGContext *s, ARMCond cond,
                              TCGReg rd, TCGReg rn, int flags)
  {
@@ -XXX,XX +XXX,XX @@ DEFINE_TCG_OUT_ARG(tcg_out_arg_imm32, uint32_t, tcg_out_movi32,
      (tcg_out_movi32(s, COND_AL, TCG_REG_TMP, arg), arg = TCG_REG_TMP))
  DEFINE_TCG_OUT_ARG(tcg_out_arg_reg8, TCGReg, tcg_out_ext8u_cond,
      (tcg_out_ext8u_cond(s, COND_AL, TCG_REG_TMP, arg), arg = TCG_REG_TMP))
 -DEFINE_TCG_OUT_ARG(tcg_out_arg_reg16, TCGReg, tcg_out_ext16u,
 -    (tcg_out_ext16u(s, COND_AL, TCG_REG_TMP, arg), arg = TCG_REG_TMP))
 +DEFINE_TCG_OUT_ARG(tcg_out_arg_reg16, TCGReg, tcg_out_ext16u_cond,
 +    (tcg_out_ext16u_cond(s, COND_AL, TCG_REG_TMP, arg), arg = TCG_REG_TMP))
  DEFINE_TCG_OUT_ARG(tcg_out_arg_reg32, TCGReg, tcg_out_mov_reg, )
  static TCGReg tcg_out_arg_reg64(TCGContext *s, TCGReg argreg,
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          tcg_out_bswap32(s, COND_AL, args[0], args[1]);
          break;
 -    case INDEX_op_ext16u_i32:
 -        tcg_out_ext16u(s, COND_AL, args[0], args[1]);
 -        break;
 -
      case INDEX_op_deposit_i32:
          tcg_out_deposit(s, COND_AL, args[0], args[2],
                          args[3], args[4], const_args[2]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
      case INDEX_op_ext8u_i32:
      case INDEX_op_ext16s_i32:
 +    case INDEX_op_ext16u_i32:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/i386/tcg-target.c.inc
 +++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg dest, TCGReg src)
      tcg_out_modrm(s, OPC_MOVSBL + P_REXB_RM + rexw, dest, src);
  }
 -static inline void tcg_out_ext16u(TCGContext *s, int dest, int src)
 +static void tcg_out_ext16u(TCGContext *s, TCGReg dest, TCGReg src)
  {
      /* movzwl */
      tcg_out_modrm(s, OPC_MOVZWL, dest, src);
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
          tcg_out_modrm(s, OPC_GRP3_Ev + rexw, EXT3_NOT, a0);
          break;
 -    OP_32_64(ext16u):
 -        tcg_out_ext16u(s, a0, a1);
 -        break;
 -
      case INDEX_op_qemu_ld_i32:
          tcg_out_qemu_ld(s, args, 0);
          break;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext8u_i64:
      case INDEX_op_ext16s_i32:
      case INDEX_op_ext16s_i64:
 +    case INDEX_op_ext16u_i32:
 +    case INDEX_op_ext16u_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/loongarch64/tcg-target.c.inc
 +++ b/tcg/loongarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          tcg_out_brcond(s, a2, a0, a1, arg_label(args[3]));
          break;
 -    case INDEX_op_ext16u_i32:
 -    case INDEX_op_ext16u_i64:
 -        tcg_out_ext16u(s, a0, a1);
 -        break;
 -
      case INDEX_op_ext32u_i64:
      case INDEX_op_extu_i32_i64:
          tcg_out_ext32u(s, a0, a1);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext8u_i64:
      case INDEX_op_ext16s_i32:
      case INDEX_op_ext16s_i64:
 +    case INDEX_op_ext16u_i32:
 +    case INDEX_op_ext16u_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/mips/tcg-target.c.inc
 +++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
      tcg_out_opc_reg(s, OPC_SEH, rd, TCG_REG_ZERO, rs);
  }
 +static void tcg_out_ext16u(TCGContext *s, TCGReg rd, TCGReg rs)
 +{
 +    tcg_out_opc_imm(s, OPC_ANDI, rd, rs, 0xffff);
 +}
 +
  static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                               tcg_target_long imm)
  {
 diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/ppc/tcg-target.c.inc
 +++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg dst, TCGReg src)
      tcg_out32(s, EXTSH | RA(dst) | RS(src));
  }
 -static inline void tcg_out_ext16u(TCGContext *s, TCGReg dst, TCGReg src)
 +static void tcg_out_ext16u(TCGContext *s, TCGReg dst, TCGReg src)
  {
      tcg_out32(s, ANDI | SAI(src, dst, 0xffff));
  }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext8u_i64:
      case INDEX_op_ext16s_i32:
      case INDEX_op_ext16s_i64:
 +    case INDEX_op_ext16u_i32:
 +    case INDEX_op_ext16u_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/riscv/tcg-target.c.inc
 +++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          tcg_out_qemu_st(s, args, true);
          break;
 -    case INDEX_op_ext16u_i32:
 -    case INDEX_op_ext16u_i64:
 -        tcg_out_ext16u(s, a0, a1);
 -        break;
 -
      case INDEX_op_ext32u_i64:
      case INDEX_op_extu_i32_i64:
          tcg_out_ext32u(s, a0, a1);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext8u_i64:
      case INDEX_op_ext16s_i32:
      case INDEX_op_ext16s_i64:
 +    case INDEX_op_ext16u_i32:
 +    case INDEX_op_ext16u_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/s390x/tcg-target.c.inc
 +++ b/tcg/s390x/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg dest, TCGReg src)
      tcg_out_insn(s, RRE, LGHR, dest, src);
  }
 -static void tgen_ext16u(TCGContext *s, TCGType type, TCGReg dest, TCGReg src)
 +static void tcg_out_ext16u(TCGContext *s, TCGReg dest, TCGReg src)
  {
      tcg_out_insn(s, RRE, LLGHR, dest, src);
  }
@@ -XXX,XX +XXX,XX @@ static void tgen_andi(TCGContext *s, TCGType type, TCGReg dest, uint64_t val)
          return;
      }
      if ((val & valid) == 0xffff) {
 -        tgen_ext16u(s, TCG_TYPE_I64, dest, dest);
 +        tcg_out_ext16u(s, dest, dest);
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp opc, TCGReg data,
      case MO_UW | MO_BSWAP:
          /* swapped unsigned halfword load with upper bits zeroed */
          tcg_out_insn(s, RXY, LRVH, data, base, index, disp);
 -        tgen_ext16u(s, TCG_TYPE_I64, data, data);
 +        tcg_out_ext16u(s, data, data);
          break;
      case MO_UW:
          tcg_out_insn(s, RXY, LLGH, data, base, index, disp);
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
          tcg_out_ext8u(s, TCG_REG_R4, data_reg);
          break;
      case MO_UW:
 -        tgen_ext16u(s, TCG_TYPE_I64, TCG_REG_R4, data_reg);
 +        tcg_out_ext16u(s, TCG_REG_R4, data_reg);
          break;
      case MO_UL:
          tgen_ext32u(s, TCG_REG_R4, data_reg);
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
          }
-     }
+         break;
- }
-diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
+-    case INDEX_op_ext16u_i32:
-index XXXXXXX..XXXXXXX 100644
+-        tgen_ext16u(s, TCG_TYPE_I32, args[0], args[1]);
---- a/accel/tcg/user-exec.c
+-        break;
-+++ b/accel/tcg/user-exec.c
+-
-@@ -XXX,XX +XXX,XX @@ void page_set_flags(target_ulong start, target_ulong last, int flags)
+     case INDEX_op_bswap16_i32:
-                                         ~(reset ? 0 : PAGE_STICKY));
+         a0 = args[0], a1 = args[1], a2 = args[2];
-     }
+         tcg_out_insn(s, RRE, LRVR, a0, a1);
-     if (inval_tb) {
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
--        tb_invalidate_phys_range(start, last + 1);
+     case INDEX_op_ext32s_i64:
-+        tb_invalidate_phys_range(start, last);
+         tgen_ext32s(s, args[0], args[1]);
-     }
+         break;
- }
+-    case INDEX_op_ext16u_i64:
+-        tgen_ext16u(s, TCG_TYPE_I64, args[0], args[1]);
-diff --git a/softmmu/physmem.c b/softmmu/physmem.c
+-        break;
-index XXXXXXX..XXXXXXX 100644
+     case INDEX_op_extu_i32_i64:
---- a/softmmu/physmem.c
+     case INDEX_op_ext32u_i64:
-+++ b/softmmu/physmem.c
+         tgen_ext32u(s, args[0], args[1]);
-@@ -XXX,XX +XXX,XX @@ static void invalidate_and_set_dirty(MemoryRegion *mr, hwaddr addr,
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
-     }
+     case INDEX_op_ext8u_i64:
-     if (dirty_log_mask & (1 << DIRTY_MEMORY_CODE)) {
+     case INDEX_op_ext16s_i32:
-         assert(tcg_enabled());
+     case INDEX_op_ext16s_i64:
--        tb_invalidate_phys_range(addr, addr + length);
++    case INDEX_op_ext16u_i32:
-+        tb_invalidate_phys_range(addr, addr + length - 1);
++    case INDEX_op_ext16u_i64:
-         dirty_log_mask &= ~(1 << DIRTY_MEMORY_CODE);
+     default:
-     }
+         g_assert_not_reached();
-     cpu_physical_memory_set_dirty_range(addr, length, dirty_log_mask);
+     }
 diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/sparc64/tcg-target.c.inc
 +++ b/tcg/sparc64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8u(TCGContext *s, TCGReg rd, TCGReg rs)
      tcg_out_arithi(s, rd, rs, 0xff, ARITH_AND);
  }
 +static void tcg_out_ext16u(TCGContext *s, TCGReg rd, TCGReg rs)
 +{
 +    tcg_out_arithi(s, rd, rs, 16, SHIFT_SLL);
 +    tcg_out_arithi(s, rd, rd, 16, SHIFT_SRL);
 +}
 +
  static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                               tcg_target_long imm)
  {
@@ -XXX,XX +XXX,XX @@ static void emit_extend(TCGContext *s, TCGReg r, int op)
          tcg_out_ext8u(s, r, r);
          break;
      case MO_16:
 -        tcg_out_arithi(s, r, r, 16, SHIFT_SLL);
 -        tcg_out_arithi(s, r, r, 16, SHIFT_SRL);
 +        tcg_out_ext16u(s, r, r);
          break;
      case MO_32:
          tcg_out_arith(s, r, r, 0, SHIFT_SRL);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext8u_i64:
      case INDEX_op_ext16s_i32:
      case INDEX_op_ext16s_i64:
 +    case INDEX_op_ext16u_i32:
 +    case INDEX_op_ext16u_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.c.inc
 +++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
      }
  }
 +static void tcg_out_ext16u(TCGContext *s, TCGReg rd, TCGReg rs)
 +{
 +    if (TCG_TARGET_REG_BITS == 64) {
 +        tcg_debug_assert(TCG_TARGET_HAS_ext16u_i64);
 +        tcg_out_op_rr(s, INDEX_op_ext16u_i64, rd, rs);
 +    } else {
 +        tcg_debug_assert(TCG_TARGET_HAS_ext16u_i32);
 +        tcg_out_op_rr(s, INDEX_op_ext16u_i32, rd, rs);
 +    }
 +}
 +
  static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                               tcg_target_long imm)
  {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      CASE_32_64(neg)      /* Optional (TCG_TARGET_HAS_neg_*). */
      CASE_32_64(not)      /* Optional (TCG_TARGET_HAS_not_*). */
 -    CASE_32_64(ext16u)   /* Optional (TCG_TARGET_HAS_ext16u_*). */
      CASE_64(ext32s)      /* Optional (TCG_TARGET_HAS_ext32s_i64). */
      CASE_64(ext32u)      /* Optional (TCG_TARGET_HAS_ext32u_i64). */
      CASE_64(ext_i32)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext8u_i64:
      case INDEX_op_ext16s_i32:
      case INDEX_op_ext16s_i64:
 +    case INDEX_op_ext16u_i32:
 +    case INDEX_op_ext16u_i64:
      default:
          g_assert_not_reached();
      }
 --
 .34.1

-[PATCH for-8.0 09/11] accel/tcg: Pass last not end to tb_invalidate_phys_page_range__locked
+[PULL 07/15] tcg: Split out tcg_out_ext32s
-Pass the address of the last byte to be changed, rather than
+We will need a backend interface for performing 32-bit sign-extend.
-the first address past the last byte.  This avoids overflow
+Use it in tcg_reg_alloc_op in the meantime.
 when the last page of the address space is involved.
 Properly truncate tb_last to the end of the page; the comment about
 tb_end being past the end of the page being ok is not correct,
 considering overflow.
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/tb-maint.c | 26 ++++++++++++--------------
+ tcg/tcg.c                        |  4 ++++
-file changed, 12 insertions(+), 14 deletions(-)
+ tcg/aarch64/tcg-target.c.inc     |  9 +++++++--
  tcg/arm/tcg-target.c.inc         |  5 +++++
  tcg/i386/tcg-target.c.inc        |  5 +++--
  tcg/loongarch64/tcg-target.c.inc |  2 +-
  tcg/mips/tcg-target.c.inc        | 12 +++++++++---
  tcg/ppc/tcg-target.c.inc         |  5 +++--
  tcg/riscv/tcg-target.c.inc       |  2 +-
  tcg/s390x/tcg-target.c.inc       | 10 +++++-----
  tcg/sparc64/tcg-target.c.inc     | 11 ++++++++---
  tcg/tci/tcg-target.c.inc         |  9 ++++++++-
 files changed, 54 insertions(+), 20 deletions(-)
-diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
+diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/tb-maint.c
+--- a/tcg/tcg.c
-+++ b/accel/tcg/tb-maint.c
++++ b/tcg/tcg.c
-@@ -XXX,XX +XXX,XX @@ bool tb_invalidate_phys_page_unwind(tb_page_addr_t addr, uintptr_t pc)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg);
- static void
+ static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg);
- tb_invalidate_phys_page_range__locked(struct page_collection *pages,
+ static void tcg_out_ext8u(TCGContext *s, TCGReg ret, TCGReg arg);
-                                       PageDesc *p, tb_page_addr_t start,
+ static void tcg_out_ext16u(TCGContext *s, TCGReg ret, TCGReg arg);
--                                      tb_page_addr_t end,
++static void tcg_out_ext32s(TCGContext *s, TCGReg ret, TCGReg arg);
-+                                      tb_page_addr_t last,
+ static void tcg_out_addi_ptr(TCGContext *s, TCGReg, TCGReg, tcg_target_long);
-                                       uintptr_t retaddr)
+ static void tcg_out_exit_tb(TCGContext *s, uintptr_t arg);
- {
+ static void tcg_out_goto_tb(TCGContext *s, int which);
-     TranslationBlock *tb;
+@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
--    tb_page_addr_t tb_start, tb_end;
+     case INDEX_op_ext16u_i64:
-     PageForEachNext n;
+         tcg_out_ext16u(s, new_args[0], new_args[1]);
- #ifdef TARGET_HAS_PRECISE_SMC
+         break;
-     bool current_tb_modified = false;
++    case INDEX_op_ext32s_i64:
-     TranslationBlock *current_tb = retaddr ? tcg_tb_lookup(retaddr) : NULL;
++        tcg_out_ext32s(s, new_args[0], new_args[1]);
- #endif /* TARGET_HAS_PRECISE_SMC */
++        break;
--    tb_page_addr_t last G_GNUC_UNUSED = end - 1;
+     default:
+         if (def->flags & TCG_OPF_VECTOR) {
-     /*
+             tcg_out_vec_op(s, op->opc, TCGOP_VECL(op), TCGOP_VECE(op),
--     * We remove all the TBs in the range [start, end[.
+diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
-+     * We remove all the TBs in the range [start, last].
+index XXXXXXX..XXXXXXX 100644
-      * XXX: see if in some cases it could be faster to invalidate all the code
+--- a/tcg/aarch64/tcg-target.c.inc
-      */
++++ b/tcg/aarch64/tcg-target.c.inc
-     PAGE_FOR_EACH_TB(start, last, p, tb, n) {
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rn)
-+        tb_page_addr_t tb_start, tb_last;
+     tcg_out_sxt(s, type, MO_16, rd, rn);
-+
+ }
-         /* NOTE: this is subtle as a TB may span two physical pages */
-+        tb_start = tb_page_addr0(tb);
++static void tcg_out_ext32s(TCGContext *s, TCGReg rd, TCGReg rn)
-+        tb_last = tb_start + tb->size - 1;
++{
-         if (n == 0) {
++    tcg_out_sxt(s, TCG_TYPE_I64, MO_32, rd, rn);
--            /* NOTE: tb_end may be after the end of the page, but
++}
--               it is not a problem */
++
--            tb_start = tb_page_addr0(tb);
+ static inline void tcg_out_uxt(TCGContext *s, MemOp s_bits,
--            tb_end = tb_start + tb->size;
+                                TCGReg rd, TCGReg rn)
-+            tb_last = MIN(tb_last, tb_start | ~TARGET_PAGE_MASK);
+ {
-         } else {
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
-             tb_start = tb_page_addr1(tb);
+     case INDEX_op_bswap32_i64:
--            tb_end = tb_start + ((tb_page_addr0(tb) + tb->size)
+         tcg_out_rev(s, TCG_TYPE_I32, MO_32, a0, a1);
--                                 & ~TARGET_PAGE_MASK);
+         if (a2 & TCG_BSWAP_OS) {
-+            tb_last = tb_start + (tb_last & ~TARGET_PAGE_MASK);
+-            tcg_out_sxt(s, TCG_TYPE_I64, MO_32, a0, a0);
 +            tcg_out_ext32s(s, a0, a0);
          }
--        if (!(tb_end <= start || tb_start >= end)) {
+         break;
-+        if (!(tb_last < start || tb_start > last)) {
+     case INDEX_op_bswap32_i32:
- #ifdef TARGET_HAS_PRECISE_SMC
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
-             if (current_tb == tb &&
+         break;
-                 (tb_cflags(current_tb) & CF_COUNT_MASK) != 1) {
-@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_page(tb_page_addr_t addr)
+     case INDEX_op_ext_i32_i64:
-     start = addr & TARGET_PAGE_MASK;
+-    case INDEX_op_ext32s_i64:
-     last = addr | ~TARGET_PAGE_MASK;
+         tcg_out_sxt(s, TCG_TYPE_I64, MO_32, a0, a1);
-     pages = page_collection_lock(start, last);
+         break;
--    tb_invalidate_phys_page_range__locked(pages, p, start, last + 1, 0);
+     case INDEX_op_extu_i32_i64:
-+    tb_invalidate_phys_page_range__locked(pages, p, start, last, 0);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
-     page_collection_unlock(pages);
+     case INDEX_op_ext16s_i32:
- }
+     case INDEX_op_ext16u_i64:
+     case INDEX_op_ext16u_i32:
-@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t end)
++    case INDEX_op_ext32s_i64:
-             continue;
+     default:
          g_assert_not_reached();
      }
 diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/arm/tcg-target.c.inc
 +++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16u(TCGContext *s, TCGReg rd, TCGReg rn)
      tcg_out_ext16u_cond(s, COND_AL, rd, rn);
  }
 +static void tcg_out_ext32s(TCGContext *s, TCGReg rd, TCGReg rn)
 +{
 +    g_assert_not_reached();
 +}
 +
  static void tcg_out_bswap16(TCGContext *s, ARMCond cond,
                              TCGReg rd, TCGReg rn, int flags)
  {
 diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/i386/tcg-target.c.inc
 +++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_ext32u(TCGContext *s, int dest, int src)
      tcg_out_modrm(s, OPC_MOVL_GvEv, dest, src);
  }
 -static inline void tcg_out_ext32s(TCGContext *s, int dest, int src)
 +static void tcg_out_ext32s(TCGContext *s, TCGReg dest, TCGReg src)
  {
 +    tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
      tcg_out_modrm(s, OPC_MOVSLQ, dest, src);
  }
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
          tcg_out_ext32u(s, a0, a1);
          break;
      case INDEX_op_ext_i32_i64:
 -    case INDEX_op_ext32s_i64:
          tcg_out_ext32s(s, a0, a1);
          break;
      case INDEX_op_extrh_i64_i32:
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext16s_i64:
      case INDEX_op_ext16u_i32:
      case INDEX_op_ext16u_i64:
 +    case INDEX_op_ext32s_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/loongarch64/tcg-target.c.inc
 +++ b/tcg/loongarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          tcg_out_ext32u(s, a0, a1);
          break;
 -    case INDEX_op_ext32s_i64:
      case INDEX_op_extrl_i64_i32:
      case INDEX_op_ext_i32_i64:
          tcg_out_ext32s(s, a0, a1);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext16s_i64:
      case INDEX_op_ext16u_i32:
      case INDEX_op_ext16u_i64:
 +    case INDEX_op_ext32s_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/mips/tcg-target.c.inc
 +++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16u(TCGContext *s, TCGReg rd, TCGReg rs)
      tcg_out_opc_imm(s, OPC_ANDI, rd, rs, 0xffff);
  }
 +static void tcg_out_ext32s(TCGContext *s, TCGReg rd, TCGReg rs)
 +{
 +    tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
 +    tcg_out_opc_sa(s, OPC_SLL, rd, rs, 0);
 +}
 +
  static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                               tcg_target_long imm)
  {
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
      /* delay slot */
      if (TCG_TARGET_REG_BITS == 64 && l->type == TCG_TYPE_I32) {
          /* we always sign-extend 32-bit loads */
 -        tcg_out_opc_sa(s, OPC_SLL, v0, TCG_REG_V0, 0);
 +        tcg_out_ext32s(s, v0, TCG_REG_V0);
      } else {
          tcg_out_opc_reg(s, OPC_OR, v0, TCG_REG_V0, TCG_REG_ZERO);
      }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_extrh_i64_i32:
          tcg_out_dsra(s, a0, a1, 32);
          break;
 -    case INDEX_op_ext32s_i64:
      case INDEX_op_ext_i32_i64:
      case INDEX_op_extrl_i64_i32:
 -        tcg_out_opc_sa(s, OPC_SLL, a0, a1, 0);
 +        tcg_out_ext32s(s, a0, a1);
          break;
      case INDEX_op_ext32u_i64:
      case INDEX_op_extu_i32_i64:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext8u_i64:
      case INDEX_op_ext16s_i32:
      case INDEX_op_ext16s_i64:
 +    case INDEX_op_ext32s_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/ppc/tcg-target.c.inc
 +++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16u(TCGContext *s, TCGReg dst, TCGReg src)
      tcg_out32(s, ANDI | SAI(src, dst, 0xffff));
  }
 -static inline void tcg_out_ext32s(TCGContext *s, TCGReg dst, TCGReg src)
 +static void tcg_out_ext32s(TCGContext *s, TCGReg dst, TCGReg src)
  {
 +    tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
      tcg_out32(s, EXTSW | RA(dst) | RS(src));
  }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          break;
      case INDEX_op_ext_i32_i64:
 -    case INDEX_op_ext32s_i64:
          tcg_out_ext32s(s, args[0], args[1]);
          break;
      case INDEX_op_extu_i32_i64:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext16s_i64:
      case INDEX_op_ext16u_i32:
      case INDEX_op_ext16u_i64:
 +    case INDEX_op_ext32s_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/riscv/tcg-target.c.inc
 +++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          tcg_out_ext32u(s, a0, a1);
          break;
 -    case INDEX_op_ext32s_i64:
      case INDEX_op_extrl_i64_i32:
      case INDEX_op_ext_i32_i64:
          tcg_out_ext32s(s, a0, a1);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext16s_i64:
      case INDEX_op_ext16u_i32:
      case INDEX_op_ext16u_i64:
 +    case INDEX_op_ext32s_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/s390x/tcg-target.c.inc
 +++ b/tcg/s390x/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16u(TCGContext *s, TCGReg dest, TCGReg src)
      tcg_out_insn(s, RRE, LLGHR, dest, src);
  }
 -static inline void tgen_ext32s(TCGContext *s, TCGReg dest, TCGReg src)
 +static void tcg_out_ext32s(TCGContext *s, TCGReg dest, TCGReg src)
  {
      tcg_out_insn(s, RRE, LGFR, dest, src);
  }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp opc, TCGReg data,
      case MO_SL | MO_BSWAP:
          /* swapped sign-extended int load */
          tcg_out_insn(s, RXY, LRV, data, base, index, disp);
 -        tgen_ext32s(s, data, data);
 +        tcg_out_ext32s(s, data, data);
          break;
      case MO_SL:
          tcg_out_insn(s, RXY, LGF, data, base, index, disp);
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
          a0 = args[0], a1 = args[1], a2 = args[2];
          tcg_out_insn(s, RRE, LRVR, a0, a1);
          if (a2 & TCG_BSWAP_OS) {
 -            tgen_ext32s(s, a0, a0);
 +            tcg_out_ext32s(s, a0, a0);
          } else if ((a2 & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
              tgen_ext32u(s, a0, a0);
          }
-         assert_page_locked(pd);
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
--        tb_invalidate_phys_page_range__locked(pages, pd, start, bound, 0);
+         break;
-+        tb_invalidate_phys_page_range__locked(pages, pd, start, bound - 1, 0);
-     }
+     case INDEX_op_ext_i32_i64:
-     page_collection_unlock(pages);
+-    case INDEX_op_ext32s_i64:
- }
+-        tgen_ext32s(s, args[0], args[1]);
-@@ -XXX,XX +XXX,XX @@ static void tb_invalidate_phys_page_fast__locked(struct page_collection *pages,
++        tcg_out_ext32s(s, args[0], args[1]);
-     }
+         break;
+     case INDEX_op_extu_i32_i64:
-     assert_page_locked(p);
+     case INDEX_op_ext32u_i64:
--    tb_invalidate_phys_page_range__locked(pages, p, start, start + len, ra);
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
-+    tb_invalidate_phys_page_range__locked(pages, p, start, start + len - 1, ra);
+     case INDEX_op_ext16s_i64:
- }
+     case INDEX_op_ext16u_i32:
+     case INDEX_op_ext16u_i64:
- /*
++    case INDEX_op_ext32s_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/sparc64/tcg-target.c.inc
 +++ b/tcg/sparc64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16u(TCGContext *s, TCGReg rd, TCGReg rs)
      tcg_out_arithi(s, rd, rd, 16, SHIFT_SRL);
  }
 +static void tcg_out_ext32s(TCGContext *s, TCGReg rd, TCGReg rs)
 +{
 +    tcg_out_arithi(s, rd, rs, 0, SHIFT_SRA);
 +}
 +
  static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                               tcg_target_long imm)
  {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data, TCGReg addr,
      /* We let the helper sign-extend SB and SW, but leave SL for here.  */
      if (is_64 && (memop & MO_SSIZE) == MO_SL) {
 -        tcg_out_arithi(s, data, TCG_REG_O0, 0, SHIFT_SRA);
 +        tcg_out_ext32s(s, data, TCG_REG_O0);
      } else {
          tcg_out_mov(s, TCG_TYPE_REG, data, TCG_REG_O0);
      }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          c = ARITH_UDIVX;
          goto gen_arith;
      case INDEX_op_ext_i32_i64:
 -    case INDEX_op_ext32s_i64:
 -        tcg_out_arithi(s, a0, a1, 0, SHIFT_SRA);
 +        tcg_out_ext32s(s, a0, a1);
          break;
      case INDEX_op_extu_i32_i64:
      case INDEX_op_ext32u_i64:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext16s_i64:
      case INDEX_op_ext16u_i32:
      case INDEX_op_ext16u_i64:
 +    case INDEX_op_ext32s_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.c.inc
 +++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16u(TCGContext *s, TCGReg rd, TCGReg rs)
      }
  }
 +static void tcg_out_ext32s(TCGContext *s, TCGReg rd, TCGReg rs)
 +{
 +    tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
 +    tcg_debug_assert(TCG_TARGET_HAS_ext32s_i64);
 +    tcg_out_op_rr(s, INDEX_op_ext32s_i64, rd, rs);
 +}
 +
  static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                               tcg_target_long imm)
  {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      CASE_32_64(neg)      /* Optional (TCG_TARGET_HAS_neg_*). */
      CASE_32_64(not)      /* Optional (TCG_TARGET_HAS_not_*). */
 -    CASE_64(ext32s)      /* Optional (TCG_TARGET_HAS_ext32s_i64). */
      CASE_64(ext32u)      /* Optional (TCG_TARGET_HAS_ext32u_i64). */
      CASE_64(ext_i32)
      CASE_64(extu_i32)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext16s_i64:
      case INDEX_op_ext16u_i32:
      case INDEX_op_ext16u_i64:
 +    case INDEX_op_ext32s_i64:
      default:
          g_assert_not_reached();
      }
 --
 .34.1

-[PATCH for-8.0 03/11] linux-user: Diagnose misaligned -R size
+[PULL 08/15] tcg: Split out tcg_out_ext32u
-We have been enforcing host page alignment for the non-R
+We will need a backend interface for performing 32-bit zero-extend.
-fallback of MAX_RESERVED_VA, but failing to enforce for -R.
+Use it in tcg_reg_alloc_op in the meantime.
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- linux-user/main.c | 6 ++++++
+ tcg/tcg.c                        |  4 ++++
-file changed, 6 insertions(+)
+ tcg/aarch64/tcg-target.c.inc     |  9 +++++++--
  tcg/arm/tcg-target.c.inc         |  5 +++++
  tcg/i386/tcg-target.c.inc        |  4 ++--
  tcg/loongarch64/tcg-target.c.inc |  2 +-
  tcg/mips/tcg-target.c.inc        |  3 ++-
  tcg/ppc/tcg-target.c.inc         |  4 +++-
  tcg/riscv/tcg-target.c.inc       |  2 +-
  tcg/s390x/tcg-target.c.inc       | 20 ++++++++++----------
  tcg/sparc64/tcg-target.c.inc     | 17 +++++++++++------
  tcg/tci/tcg-target.c.inc         |  9 ++++++++-
 files changed, 54 insertions(+), 25 deletions(-)
-diff --git a/linux-user/main.c b/linux-user/main.c
+diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
---- a/linux-user/main.c
+--- a/tcg/tcg.c
-+++ b/linux-user/main.c
++++ b/tcg/tcg.c
-@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg);
-      */
+ static void tcg_out_ext8u(TCGContext *s, TCGReg ret, TCGReg arg);
-     max_reserved_va = MAX_RESERVED_VA(cpu);
+ static void tcg_out_ext16u(TCGContext *s, TCGReg ret, TCGReg arg);
-     if (reserved_va != 0) {
+ static void tcg_out_ext32s(TCGContext *s, TCGReg ret, TCGReg arg);
-+        if (reserved_va % qemu_host_page_size) {
++static void tcg_out_ext32u(TCGContext *s, TCGReg ret, TCGReg arg);
-+            char *s = size_to_str(qemu_host_page_size);
+ static void tcg_out_addi_ptr(TCGContext *s, TCGReg, TCGReg, tcg_target_long);
-+            fprintf(stderr, "Reserved virtual address not aligned mod %s\n", s);
+ static void tcg_out_exit_tb(TCGContext *s, uintptr_t arg);
-+            g_free(s);
+ static void tcg_out_goto_tb(TCGContext *s, int which);
-+            exit(EXIT_FAILURE);
+@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
-+        }
+     case INDEX_op_ext32s_i64:
-         if (max_reserved_va && reserved_va > max_reserved_va) {
+         tcg_out_ext32s(s, new_args[0], new_args[1]);
-             fprintf(stderr, "Reserved virtual address too big\n");
+         break;
-             exit(EXIT_FAILURE);
++    case INDEX_op_ext32u_i64:
 +        tcg_out_ext32u(s, new_args[0], new_args[1]);
 +        break;
      default:
          if (def->flags & TCG_OPF_VECTOR) {
              tcg_out_vec_op(s, op->opc, TCGOP_VECL(op), TCGOP_VECE(op),
 diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/aarch64/tcg-target.c.inc
 +++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16u(TCGContext *s, TCGReg rd, TCGReg rn)
      tcg_out_uxt(s, MO_16, rd, rn);
  }
 +static void tcg_out_ext32u(TCGContext *s, TCGReg rd, TCGReg rn)
 +{
 +    tcg_out_movr(s, TCG_TYPE_I32, rd, rn);
 +}
 +
  static void tcg_out_addsubi(TCGContext *s, int ext, TCGReg rd,
                              TCGReg rn, int64_t aimm)
  {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          tcg_out_sxt(s, TCG_TYPE_I64, MO_32, a0, a1);
          break;
      case INDEX_op_extu_i32_i64:
 -    case INDEX_op_ext32u_i64:
 -        tcg_out_movr(s, TCG_TYPE_I32, a0, a1);
 +        tcg_out_ext32u(s, a0, a1);
          break;
      case INDEX_op_deposit_i64:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext16u_i64:
      case INDEX_op_ext16u_i32:
      case INDEX_op_ext32s_i64:
 +    case INDEX_op_ext32u_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/arm/tcg-target.c.inc
 +++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32s(TCGContext *s, TCGReg rd, TCGReg rn)
      g_assert_not_reached();
  }
 +static void tcg_out_ext32u(TCGContext *s, TCGReg rd, TCGReg rn)
 +{
 +    g_assert_not_reached();
 +}
 +
  static void tcg_out_bswap16(TCGContext *s, ARMCond cond,
                              TCGReg rd, TCGReg rn, int flags)
  {
 diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/i386/tcg-target.c.inc
 +++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg dest, TCGReg src)
      tcg_out_modrm(s, OPC_MOVSWL + rexw, dest, src);
  }
 -static inline void tcg_out_ext32u(TCGContext *s, int dest, int src)
 +static void tcg_out_ext32u(TCGContext *s, TCGReg dest, TCGReg src)
  {
      /* 32-bit mov zero extends.  */
      tcg_out_modrm(s, OPC_MOVL_GvEv, dest, src);
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
          tcg_out_bswap64(s, a0);
          break;
      case INDEX_op_extu_i32_i64:
 -    case INDEX_op_ext32u_i64:
      case INDEX_op_extrl_i64_i32:
          tcg_out_ext32u(s, a0, a1);
          break;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext16u_i32:
      case INDEX_op_ext16u_i64:
      case INDEX_op_ext32s_i64:
 +    case INDEX_op_ext32u_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/loongarch64/tcg-target.c.inc
 +++ b/tcg/loongarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          tcg_out_brcond(s, a2, a0, a1, arg_label(args[3]));
          break;
 -    case INDEX_op_ext32u_i64:
      case INDEX_op_extu_i32_i64:
          tcg_out_ext32u(s, a0, a1);
          break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext16u_i32:
      case INDEX_op_ext16u_i64:
      case INDEX_op_ext32s_i64:
 +    case INDEX_op_ext32u_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/mips/tcg-target.c.inc
 +++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_bswap64(TCGContext *s, TCGReg ret, TCGReg arg)
  static void tcg_out_ext32u(TCGContext *s, TCGReg ret, TCGReg arg)
  {
 +    tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
      if (use_mips32r2_instructions) {
          tcg_out_opc_bf(s, OPC_DEXT, ret, arg, 31, 0);
      } else {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_extrl_i64_i32:
          tcg_out_ext32s(s, a0, a1);
          break;
 -    case INDEX_op_ext32u_i64:
      case INDEX_op_extu_i32_i64:
          tcg_out_ext32u(s, a0, a1);
          break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext16s_i32:
      case INDEX_op_ext16s_i64:
      case INDEX_op_ext32s_i64:
 +    case INDEX_op_ext32u_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/ppc/tcg-target.c.inc
 +++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32s(TCGContext *s, TCGReg dst, TCGReg src)
      tcg_out32(s, EXTSW | RA(dst) | RS(src));
  }
 -static inline void tcg_out_ext32u(TCGContext *s, TCGReg dst, TCGReg src)
 +static void tcg_out_ext32u(TCGContext *s, TCGReg dst, TCGReg src)
  {
 +    tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
      tcg_out_rld(s, RLDICL, dst, src, 0, 32);
  }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext16u_i32:
      case INDEX_op_ext16u_i64:
      case INDEX_op_ext32s_i64:
 +    case INDEX_op_ext32u_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/riscv/tcg-target.c.inc
 +++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          tcg_out_qemu_st(s, args, true);
          break;
 -    case INDEX_op_ext32u_i64:
      case INDEX_op_extu_i32_i64:
          tcg_out_ext32u(s, a0, a1);
          break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext16u_i32:
      case INDEX_op_ext16u_i64:
      case INDEX_op_ext32s_i64:
 +    case INDEX_op_ext32u_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/s390x/tcg-target.c.inc
 +++ b/tcg/s390x/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32s(TCGContext *s, TCGReg dest, TCGReg src)
      tcg_out_insn(s, RRE, LGFR, dest, src);
  }
 -static inline void tgen_ext32u(TCGContext *s, TCGReg dest, TCGReg src)
 +static void tcg_out_ext32u(TCGContext *s, TCGReg dest, TCGReg src)
  {
      tcg_out_insn(s, RRE, LLGFR, dest, src);
  }
@@ -XXX,XX +XXX,XX @@ static void tgen_andi(TCGContext *s, TCGType type, TCGReg dest, uint64_t val)
      /* Look for the zero-extensions.  */
      if ((val & valid) == 0xffffffff) {
 -        tgen_ext32u(s, dest, dest);
 +        tcg_out_ext32u(s, dest, dest);
          return;
      }
      if ((val & valid) == 0xff) {
@@ -XXX,XX +XXX,XX @@ static void tgen_ctpop(TCGContext *s, TCGType type, TCGReg dest, TCGReg src)
      /* With MIE3, and bit 0 of m4 set, we get the complete result. */
      if (HAVE_FACILITY(MISC_INSN_EXT3)) {
          if (type == TCG_TYPE_I32) {
 -            tgen_ext32u(s, dest, src);
 +            tcg_out_ext32u(s, dest, src);
              src = dest;
          }
          tcg_out_insn(s, RRFc, POPCNT, dest, src, 8);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp opc, TCGReg data,
      case MO_UL | MO_BSWAP:
          /* swapped unsigned int load with upper bits zeroed */
          tcg_out_insn(s, RXY, LRV, data, base, index, disp);
 -        tgen_ext32u(s, data, data);
 +        tcg_out_ext32u(s, data, data);
          break;
      case MO_UL:
          tcg_out_insn(s, RXY, LLGF, data, base, index, disp);
@@ -XXX,XX +XXX,XX @@ static TCGReg tcg_out_tlb_read(TCGContext *s, TCGReg addr_reg, MemOp opc,
                   offsetof(CPUTLBEntry, addend));
      if (TARGET_LONG_BITS == 32) {
 -        tgen_ext32u(s, TCG_REG_R3, addr_reg);
 +        tcg_out_ext32u(s, TCG_REG_R3, addr_reg);
          return TCG_REG_R3;
      }
      return addr_reg;
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
          tcg_out_ext16u(s, TCG_REG_R4, data_reg);
          break;
      case MO_UL:
 -        tgen_ext32u(s, TCG_REG_R4, data_reg);
 +        tcg_out_ext32u(s, TCG_REG_R4, data_reg);
          break;
      case MO_UQ:
          tcg_out_mov(s, TCG_TYPE_I64, TCG_REG_R4, data_reg);
@@ -XXX,XX +XXX,XX @@ static void tcg_prepare_user_ldst(TCGContext *s, TCGReg *addr_reg,
                                    TCGReg *index_reg, tcg_target_long *disp)
  {
      if (TARGET_LONG_BITS == 32) {
 -        tgen_ext32u(s, TCG_TMP0, *addr_reg);
 +        tcg_out_ext32u(s, TCG_TMP0, *addr_reg);
          *addr_reg = TCG_TMP0;
      }
      if (guest_base < 0x80000) {
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
          if (a2 & TCG_BSWAP_OS) {
              tcg_out_ext32s(s, a0, a0);
          } else if ((a2 & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
 -            tgen_ext32u(s, a0, a0);
 +            tcg_out_ext32u(s, a0, a0);
          }
          break;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
          tcg_out_ext32s(s, args[0], args[1]);
          break;
      case INDEX_op_extu_i32_i64:
 -    case INDEX_op_ext32u_i64:
 -        tgen_ext32u(s, args[0], args[1]);
 +        tcg_out_ext32u(s, args[0], args[1]);
          break;
      case INDEX_op_add2_i64:
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext16u_i32:
      case INDEX_op_ext16u_i64:
      case INDEX_op_ext32s_i64:
 +    case INDEX_op_ext32u_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/sparc64/tcg-target.c.inc
 +++ b/tcg/sparc64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32s(TCGContext *s, TCGReg rd, TCGReg rs)
      tcg_out_arithi(s, rd, rs, 0, SHIFT_SRA);
  }
 +static void tcg_out_ext32u(TCGContext *s, TCGReg rd, TCGReg rs)
 +{
 +    tcg_out_arithi(s, rd, rs, 0, SHIFT_SRL);
 +}
 +
  static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                               tcg_target_long imm)
  {
@@ -XXX,XX +XXX,XX @@ static void emit_extend(TCGContext *s, TCGReg r, int op)
          tcg_out_ext16u(s, r, r);
          break;
      case MO_32:
 -        tcg_out_arith(s, r, r, 0, SHIFT_SRL);
 +        tcg_out_ext32u(s, r, r);
          break;
      case MO_64:
          break;
@@ -XXX,XX +XXX,XX @@ static TCGReg tcg_out_tlb_load(TCGContext *s, TCGReg addr, int mem_index,
      /* If the guest address must be zero-extended, do so now.  */
      if (TARGET_LONG_BITS == 32) {
 -        tcg_out_arithi(s, r0, addr, 0, SHIFT_SRL);
 +        tcg_out_ext32u(s, r0, addr);
          return r0;
      }
      return addr;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data, TCGReg addr,
      unsigned t_bits;
      if (TARGET_LONG_BITS == 32) {
 -        tcg_out_arithi(s, TCG_REG_T1, addr, 0, SHIFT_SRL);
 +        tcg_out_ext32u(s, TCG_REG_T1, addr);
          addr = TCG_REG_T1;
      }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data, TCGReg addr,
      unsigned t_bits;
      if (TARGET_LONG_BITS == 32) {
 -        tcg_out_arithi(s, TCG_REG_T1, addr, 0, SHIFT_SRL);
 +        tcg_out_ext32u(s, TCG_REG_T1, addr);
          addr = TCG_REG_T1;
      }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          tcg_out_ext32s(s, a0, a1);
          break;
      case INDEX_op_extu_i32_i64:
 -    case INDEX_op_ext32u_i64:
 -        tcg_out_arithi(s, a0, a1, 0, SHIFT_SRL);
 +        tcg_out_ext32u(s, a0, a1);
          break;
      case INDEX_op_extrl_i64_i32:
          tcg_out_mov(s, TCG_TYPE_I32, a0, a1);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext16u_i32:
      case INDEX_op_ext16u_i64:
      case INDEX_op_ext32s_i64:
 +    case INDEX_op_ext32u_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.c.inc
 +++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32s(TCGContext *s, TCGReg rd, TCGReg rs)
      tcg_out_op_rr(s, INDEX_op_ext32s_i64, rd, rs);
  }
 +static void tcg_out_ext32u(TCGContext *s, TCGReg rd, TCGReg rs)
 +{
 +    tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
 +    tcg_debug_assert(TCG_TARGET_HAS_ext32u_i64);
 +    tcg_out_op_rr(s, INDEX_op_ext32u_i64, rd, rs);
 +}
 +
  static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                               tcg_target_long imm)
  {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      CASE_32_64(neg)      /* Optional (TCG_TARGET_HAS_neg_*). */
      CASE_32_64(not)      /* Optional (TCG_TARGET_HAS_not_*). */
 -    CASE_64(ext32u)      /* Optional (TCG_TARGET_HAS_ext32u_i64). */
      CASE_64(ext_i32)
      CASE_64(extu_i32)
      CASE_32_64(ctpop)    /* Optional (TCG_TARGET_HAS_ctpop_*). */
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext16u_i32:
      case INDEX_op_ext16u_i64:
      case INDEX_op_ext32s_i64:
 +    case INDEX_op_ext32u_i64:
      default:
          g_assert_not_reached();
      }
 --
 .34.1

-[PATCH for-8.0 07/11] accel/tcg: Pass last not end to PAGE_FOR_EACH_TB
+[PULL 09/15] tcg: Split out tcg_out_exts_i32_i64
-Pass the address of the last byte to be changed, rather than
+We will need a backend interface for type extension with sign.
-the first address past the last byte.  This avoids overflow
+Use it in tcg_reg_alloc_op in the meantime.
 when the last page of the address space is involved.
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/tb-maint.c | 28 ++++++++++++++++------------
+ tcg/tcg.c                        | 4 ++++
-file changed, 16 insertions(+), 12 deletions(-)
+ tcg/aarch64/tcg-target.c.inc     | 9 ++++++---
  tcg/arm/tcg-target.c.inc         | 5 +++++
  tcg/i386/tcg-target.c.inc        | 9 ++++++---
  tcg/loongarch64/tcg-target.c.inc | 7 ++++++-
  tcg/mips/tcg-target.c.inc        | 7 ++++++-
  tcg/ppc/tcg-target.c.inc         | 9 ++++++---
  tcg/riscv/tcg-target.c.inc       | 7 ++++++-
  tcg/s390x/tcg-target.c.inc       | 9 ++++++---
  tcg/sparc64/tcg-target.c.inc     | 9 ++++++---
  tcg/tci/tcg-target.c.inc         | 7 ++++++-
 files changed, 63 insertions(+), 19 deletions(-)
-diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
+diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/tb-maint.c
+--- a/tcg/tcg.c
-+++ b/accel/tcg/tb-maint.c
++++ b/tcg/tcg.c
-@@ -XXX,XX +XXX,XX @@ static void tb_remove(TranslationBlock *tb)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8u(TCGContext *s, TCGReg ret, TCGReg arg);
- }
+ static void tcg_out_ext16u(TCGContext *s, TCGReg ret, TCGReg arg);
+ static void tcg_out_ext32s(TCGContext *s, TCGReg ret, TCGReg arg);
- /* TODO: For now, still shared with translate-all.c for system mode. */
+ static void tcg_out_ext32u(TCGContext *s, TCGReg ret, TCGReg arg);
--#define PAGE_FOR_EACH_TB(start, end, pagedesc, T, N)    \
++static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg);
--    for (T = foreach_tb_first(start, end),              \
+ static void tcg_out_addi_ptr(TCGContext *s, TCGReg, TCGReg, tcg_target_long);
--         N = foreach_tb_next(T, start, end);            \
+ static void tcg_out_exit_tb(TCGContext *s, uintptr_t arg);
-+#define PAGE_FOR_EACH_TB(start, last, pagedesc, T, N)   \
+ static void tcg_out_goto_tb(TCGContext *s, int which);
-+    for (T = foreach_tb_first(start, last),             \
+@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
-+         N = foreach_tb_next(T, start, last);           \
+     case INDEX_op_ext32u_i64:
-          T != NULL;                                     \
+         tcg_out_ext32u(s, new_args[0], new_args[1]);
--         T = N, N = foreach_tb_next(N, start, end))
+         break;
-+         T = N, N = foreach_tb_next(N, start, last))
++    case INDEX_op_ext_i32_i64:
++        tcg_out_exts_i32_i64(s, new_args[0], new_args[1]);
- typedef TranslationBlock *PageForEachNext;
++        break;
+     default:
- static PageForEachNext foreach_tb_first(tb_page_addr_t start,
+         if (def->flags & TCG_OPF_VECTOR) {
--                                        tb_page_addr_t end)
+             tcg_out_vec_op(s, op->opc, TCGOP_VECL(op), TCGOP_VECE(op),
-+                                        tb_page_addr_t last)
+diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
- {
+index XXXXXXX..XXXXXXX 100644
--    IntervalTreeNode *n = interval_tree_iter_first(&tb_root, start, end - 1);
+--- a/tcg/aarch64/tcg-target.c.inc
-+    IntervalTreeNode *n = interval_tree_iter_first(&tb_root, start, last);
++++ b/tcg/aarch64/tcg-target.c.inc
-     return n ? container_of(n, TranslationBlock, itree) : NULL;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32s(TCGContext *s, TCGReg rd, TCGReg rn)
- }
+     tcg_out_sxt(s, TCG_TYPE_I64, MO_32, rd, rn);
+ }
- static PageForEachNext foreach_tb_next(PageForEachNext tb,
-                                        tb_page_addr_t start,
++static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg rd, TCGReg rn)
--                                       tb_page_addr_t end)
++{
-+                                       tb_page_addr_t last)
++    tcg_out_ext32s(s, rd, rn);
- {
++}
-     IntervalTreeNode *n;
++
+ static inline void tcg_out_uxt(TCGContext *s, MemOp s_bits,
-     if (tb) {
+                                TCGReg rd, TCGReg rn)
--        n = interval_tree_iter_next(&tb->itree, start, end - 1);
+ {
-+        n = interval_tree_iter_next(&tb->itree, start, last);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          if (n) {
              return container_of(n, TranslationBlock, itree);
          }
-@@ -XXX,XX +XXX,XX @@ struct page_collection {
+         break;
- };
+-    case INDEX_op_ext_i32_i64:
- typedef int PageForEachNext;
+-        tcg_out_sxt(s, TCG_TYPE_I64, MO_32, a0, a1);
--#define PAGE_FOR_EACH_TB(start, end, pagedesc, tb, n) \
+-        break;
-+#define PAGE_FOR_EACH_TB(start, last, pagedesc, tb, n) \
+     case INDEX_op_extu_i32_i64:
-     TB_FOR_EACH_TAGGED((pagedesc)->first_tb, tb, n, page_next)
+         tcg_out_ext32u(s, a0, a1);
+         break;
- #ifdef CONFIG_DEBUG_TCG
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
-@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t end)
+     case INDEX_op_ext16u_i32:
- {
+     case INDEX_op_ext32s_i64:
-     TranslationBlock *tb;
+     case INDEX_op_ext32u_i64:
-     PageForEachNext n;
++    case INDEX_op_ext_i32_i64:
-+    tb_page_addr_t last = end - 1;
+     default:
+         g_assert_not_reached();
-     assert_memory_lock();
+     }
+diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
--    PAGE_FOR_EACH_TB(start, end, unused, tb, n) {
+index XXXXXXX..XXXXXXX 100644
-+    PAGE_FOR_EACH_TB(start, last, unused, tb, n) {
+--- a/tcg/arm/tcg-target.c.inc
-         tb_phys_invalidate__locked(tb);
++++ b/tcg/arm/tcg-target.c.inc
-     }
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32u(TCGContext *s, TCGReg rd, TCGReg rn)
- }
+     g_assert_not_reached();
-@@ -XXX,XX +XXX,XX @@ bool tb_invalidate_phys_page_unwind(tb_page_addr_t addr, uintptr_t pc)
+ }
-     bool current_tb_modified;
-     TranslationBlock *tb;
++static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg rd, TCGReg rn)
-     PageForEachNext n;
++{
-+    tb_page_addr_t last;
++    g_assert_not_reached();
++}
-     /*
++
-      * Without precise smc semantics, or when outside of a TB,
+ static void tcg_out_bswap16(TCGContext *s, ARMCond cond,
-@@ -XXX,XX +XXX,XX @@ bool tb_invalidate_phys_page_unwind(tb_page_addr_t addr, uintptr_t pc)
+                             TCGReg rd, TCGReg rn, int flags)
-     assert_memory_lock();
+ {
-     current_tb = tcg_tb_lookup(pc);
+diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
-+    last = addr | ~TARGET_PAGE_MASK;
+--- a/tcg/i386/tcg-target.c.inc
-     addr &= TARGET_PAGE_MASK;
++++ b/tcg/i386/tcg-target.c.inc
-     current_tb_modified = false;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32s(TCGContext *s, TCGReg dest, TCGReg src)
+     tcg_out_modrm(s, OPC_MOVSLQ, dest, src);
--    PAGE_FOR_EACH_TB(addr, addr + TARGET_PAGE_SIZE, unused, tb, n) {
+ }
-+    PAGE_FOR_EACH_TB(addr, last, unused, tb, n) {
-         if (current_tb == tb &&
++static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg dest, TCGReg src)
-             (tb_cflags(current_tb) & CF_COUNT_MASK) != 1) {
++{
-             /*
++    tcg_out_ext32s(s, dest, src);
-@@ -XXX,XX +XXX,XX @@ tb_invalidate_phys_page_range__locked(struct page_collection *pages,
++}
-     bool current_tb_modified = false;
++
-     TranslationBlock *current_tb = retaddr ? tcg_tb_lookup(retaddr) : NULL;
+ static inline void tcg_out_bswap64(TCGContext *s, int reg)
- #endif /* TARGET_HAS_PRECISE_SMC */
+ {
-+    tb_page_addr_t last G_GNUC_UNUSED = end - 1;
+     tcg_out_opc(s, OPC_BSWAP + P_REXW + LOWREGMASK(reg), 0, reg, 0);
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
-     /*
+     case INDEX_op_extrl_i64_i32:
-      * We remove all the TBs in the range [start, end[.
+         tcg_out_ext32u(s, a0, a1);
-      * XXX: see if in some cases it could be faster to invalidate all the code
+         break;
-      */
+-    case INDEX_op_ext_i32_i64:
--    PAGE_FOR_EACH_TB(start, end, p, tb, n) {
+-        tcg_out_ext32s(s, a0, a1);
-+    PAGE_FOR_EACH_TB(start, last, p, tb, n) {
+-        break;
-         /* NOTE: this is subtle as a TB may span two physical pages */
+     case INDEX_op_extrh_i64_i32:
-         if (n == 0) {
+         tcg_out_shifti(s, SHIFT_SHR + P_REXW, a0, 32);
-             /* NOTE: tb_end may be after the end of the page, but
+         break;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext16u_i64:
      case INDEX_op_ext32s_i64:
      case INDEX_op_ext32u_i64:
 +    case INDEX_op_ext_i32_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/loongarch64/tcg-target.c.inc
 +++ b/tcg/loongarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32s(TCGContext *s, TCGReg ret, TCGReg arg)
      tcg_out_opc_addi_w(s, ret, arg, 0);
  }
 +static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg)
 +{
 +    tcg_out_ext32s(s, ret, arg);
 +}
 +
  static void tcg_out_clzctz(TCGContext *s, LoongArchInsn opc,
                             TCGReg a0, TCGReg a1, TCGReg a2,
                             bool c2, bool is_32bit)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          break;
      case INDEX_op_extrl_i64_i32:
 -    case INDEX_op_ext_i32_i64:
          tcg_out_ext32s(s, a0, a1);
          break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext16u_i64:
      case INDEX_op_ext32s_i64:
      case INDEX_op_ext32u_i64:
 +    case INDEX_op_ext_i32_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/mips/tcg-target.c.inc
 +++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32s(TCGContext *s, TCGReg rd, TCGReg rs)
      tcg_out_opc_sa(s, OPC_SLL, rd, rs, 0);
  }
 +static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg rd, TCGReg rs)
 +{
 +    tcg_out_ext32s(s, rd, rs);
 +}
 +
  static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                               tcg_target_long imm)
  {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_extrh_i64_i32:
          tcg_out_dsra(s, a0, a1, 32);
          break;
 -    case INDEX_op_ext_i32_i64:
      case INDEX_op_extrl_i64_i32:
          tcg_out_ext32s(s, a0, a1);
          break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext16s_i64:
      case INDEX_op_ext32s_i64:
      case INDEX_op_ext32u_i64:
 +    case INDEX_op_ext_i32_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/ppc/tcg-target.c.inc
 +++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32u(TCGContext *s, TCGReg dst, TCGReg src)
      tcg_out_rld(s, RLDICL, dst, src, 0, 32);
  }
 +static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg dst, TCGReg src)
 +{
 +    tcg_out_ext32s(s, dst, src);
 +}
 +
  static inline void tcg_out_shli32(TCGContext *s, TCGReg dst, TCGReg src, int c)
  {
      tcg_out_rlw(s, RLWINM, dst, src, c, 0, 31 - c);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          tcg_out_qemu_st(s, args, true);
          break;
 -    case INDEX_op_ext_i32_i64:
 -        tcg_out_ext32s(s, args[0], args[1]);
 -        break;
      case INDEX_op_extu_i32_i64:
          tcg_out_ext32u(s, args[0], args[1]);
          break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext16u_i64:
      case INDEX_op_ext32s_i64:
      case INDEX_op_ext32u_i64:
 +    case INDEX_op_ext_i32_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/riscv/tcg-target.c.inc
 +++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32s(TCGContext *s, TCGReg ret, TCGReg arg)
      tcg_out_opc_imm(s, OPC_ADDIW, ret, arg, 0);
  }
 +static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg)
 +{
 +    tcg_out_ext32s(s, ret, arg);
 +}
 +
  static void tcg_out_ldst(TCGContext *s, RISCVInsn opc, TCGReg data,
                           TCGReg addr, intptr_t offset)
  {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          break;
      case INDEX_op_extrl_i64_i32:
 -    case INDEX_op_ext_i32_i64:
          tcg_out_ext32s(s, a0, a1);
          break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext16u_i64:
      case INDEX_op_ext32s_i64:
      case INDEX_op_ext32u_i64:
 +    case INDEX_op_ext_i32_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/s390x/tcg-target.c.inc
 +++ b/tcg/s390x/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32u(TCGContext *s, TCGReg dest, TCGReg src)
      tcg_out_insn(s, RRE, LLGFR, dest, src);
  }
 +static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg dest, TCGReg src)
 +{
 +    tcg_out_ext32s(s, dest, src);
 +}
 +
  static void tgen_andi_risbg(TCGContext *s, TCGReg out, TCGReg in, uint64_t val)
  {
      int msb, lsb;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
          }
          break;
 -    case INDEX_op_ext_i32_i64:
 -        tcg_out_ext32s(s, args[0], args[1]);
 -        break;
      case INDEX_op_extu_i32_i64:
          tcg_out_ext32u(s, args[0], args[1]);
          break;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext16u_i64:
      case INDEX_op_ext32s_i64:
      case INDEX_op_ext32u_i64:
 +    case INDEX_op_ext_i32_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/sparc64/tcg-target.c.inc
 +++ b/tcg/sparc64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32u(TCGContext *s, TCGReg rd, TCGReg rs)
      tcg_out_arithi(s, rd, rs, 0, SHIFT_SRL);
  }
 +static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg rd, TCGReg rs)
 +{
 +    tcg_out_ext32s(s, rd, rs);
 +}
 +
  static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                               tcg_target_long imm)
  {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_divu_i64:
          c = ARITH_UDIVX;
          goto gen_arith;
 -    case INDEX_op_ext_i32_i64:
 -        tcg_out_ext32s(s, a0, a1);
 -        break;
      case INDEX_op_extu_i32_i64:
          tcg_out_ext32u(s, a0, a1);
          break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext16u_i64:
      case INDEX_op_ext32s_i64:
      case INDEX_op_ext32u_i64:
 +    case INDEX_op_ext_i32_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.c.inc
 +++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32u(TCGContext *s, TCGReg rd, TCGReg rs)
      tcg_out_op_rr(s, INDEX_op_ext32u_i64, rd, rs);
  }
 +static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg rd, TCGReg rs)
 +{
 +    tcg_out_ext32s(s, rd, rs);
 +}
 +
  static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                               tcg_target_long imm)
  {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      CASE_32_64(neg)      /* Optional (TCG_TARGET_HAS_neg_*). */
      CASE_32_64(not)      /* Optional (TCG_TARGET_HAS_not_*). */
 -    CASE_64(ext_i32)
      CASE_64(extu_i32)
      CASE_32_64(ctpop)    /* Optional (TCG_TARGET_HAS_ctpop_*). */
      case INDEX_op_bswap32_i32: /* Optional (TCG_TARGET_HAS_bswap32_i32). */
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext16u_i64:
      case INDEX_op_ext32s_i64:
      case INDEX_op_ext32u_i64:
 +    case INDEX_op_ext_i32_i64:
      default:
          g_assert_not_reached();
      }
 --
 .34.1

-[PATCH for-8.0 04/11] include/exec: Change reserved_va semantics to last byte
+[PULL 10/15] tcg: Split out tcg_out_extu_i32_i64
-Change the semantics to be the last byte of the guest va, rather
+We will need a backend interface for type extension with zero.
-than the following byte.  This avoids some overflow conditions.
+Use it in tcg_reg_alloc_op in the meantime.
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/cpu-all.h      | 11 ++++++++++-
+ tcg/tcg.c                        |  4 ++++
- linux-user/arm/target_cpu.h |  2 +-
+ tcg/aarch64/tcg-target.c.inc     | 10 ++++++----
- bsd-user/main.c             | 10 +++-------
+ tcg/arm/tcg-target.c.inc         |  5 +++++
- bsd-user/mmap.c             |  4 ++--
+ tcg/i386/tcg-target.c.inc        |  7 ++++++-
- linux-user/elfload.c        | 21 +++++++++++----------
+ tcg/loongarch64/tcg-target.c.inc | 10 ++++++----
- linux-user/main.c           | 27 +++++++++++++--------------
+ tcg/mips/tcg-target.c.inc        |  9 ++++++---
- linux-user/mmap.c           |  4 ++--
+ tcg/ppc/tcg-target.c.inc         | 10 ++++++----
-files changed, 42 insertions(+), 37 deletions(-)
+ tcg/riscv/tcg-target.c.inc       | 10 ++++++----
  tcg/s390x/tcg-target.c.inc       | 10 ++++++----
  tcg/sparc64/tcg-target.c.inc     |  9 ++++++---
  tcg/tci/tcg-target.c.inc         |  7 ++++++-
 files changed, 63 insertions(+), 28 deletions(-)
-diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
+diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/cpu-all.h
+--- a/tcg/tcg.c
-+++ b/include/exec/cpu-all.h
++++ b/tcg/tcg.c
-@@ -XXX,XX +XXX,XX @@ static inline void tswap64s(uint64_t *s)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16u(TCGContext *s, TCGReg ret, TCGReg arg);
-  */
+ static void tcg_out_ext32s(TCGContext *s, TCGReg ret, TCGReg arg);
- extern uintptr_t guest_base;
+ static void tcg_out_ext32u(TCGContext *s, TCGReg ret, TCGReg arg);
- extern bool have_guest_base;
+ static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg);
-+
++static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg);
-+/*
+ static void tcg_out_addi_ptr(TCGContext *s, TCGReg, TCGReg, tcg_target_long);
-+ * If non-zero, the guest virtual address space is a contiguous subset
+ static void tcg_out_exit_tb(TCGContext *s, uintptr_t arg);
-+ * of the host virtual address space, i.e. '-R reserved_va' is in effect
+ static void tcg_out_goto_tb(TCGContext *s, int which);
-+ * either from the command-line or by default.  The value is the last
+@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
-+ * byte of the guest address space e.g. UINT32_MAX.
+     case INDEX_op_ext_i32_i64:
-+ *
+         tcg_out_exts_i32_i64(s, new_args[0], new_args[1]);
-+ * If zero, the host and guest virtual address spaces are intermingled.
+         break;
-+ */
++    case INDEX_op_extu_i32_i64:
- extern unsigned long reserved_va;
++        tcg_out_extu_i32_i64(s, new_args[0], new_args[1]);
++        break;
- /*
+     default:
-@@ -XXX,XX +XXX,XX @@ extern unsigned long reserved_va;
+         if (def->flags & TCG_OPF_VECTOR) {
- #define GUEST_ADDR_MAX_                                                 \
+             tcg_out_vec_op(s, op->opc, TCGOP_VECL(op), TCGOP_VECE(op),
-     ((MIN_CONST(TARGET_VIRT_ADDR_SPACE_BITS, TARGET_ABI_BITS) <= 32) ?  \
+diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
-      UINT32_MAX : ~0ul)
+index XXXXXXX..XXXXXXX 100644
--#define GUEST_ADDR_MAX    (reserved_va ? reserved_va - 1 : GUEST_ADDR_MAX_)
+--- a/tcg/aarch64/tcg-target.c.inc
-+#define GUEST_ADDR_MAX    (reserved_va ? : GUEST_ADDR_MAX_)
++++ b/tcg/aarch64/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32u(TCGContext *s, TCGReg rd, TCGReg rn)
- #else
+     tcg_out_movr(s, TCG_TYPE_I32, rd, rn);
+ }
-diff --git a/linux-user/arm/target_cpu.h b/linux-user/arm/target_cpu.h
-index XXXXXXX..XXXXXXX 100644
++static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg rd, TCGReg rn)
---- a/linux-user/arm/target_cpu.h
++{
-+++ b/linux-user/arm/target_cpu.h
++    tcg_out_ext32u(s, rd, rn);
-@@ -XXX,XX +XXX,XX @@ static inline unsigned long arm_max_reserved_va(CPUState *cs)
++}
-          * the high addresses.  Restrict linux-user to the
++
-          * cached write-back RAM in the system map.
+ static void tcg_out_addsubi(TCGContext *s, int ext, TCGReg rd,
-          */
+                             TCGReg rn, int64_t aimm)
--        return 0x80000000ul;
+ {
-+        return 0x7ffffffful;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      } else {
          /*
           * We need to be able to map the commpage.
 diff --git a/bsd-user/main.c b/bsd-user/main.c
 index XXXXXXX..XXXXXXX 100644
 --- a/bsd-user/main.c
 +++ b/bsd-user/main.c
@@ -XXX,XX +XXX,XX @@ bool have_guest_base;
  # if HOST_LONG_BITS > TARGET_VIRT_ADDR_SPACE_BITS
  #  if TARGET_VIRT_ADDR_SPACE_BITS == 32 && \
        (TARGET_LONG_BITS == 32 || defined(TARGET_ABI32))
 -/*
 - * There are a number of places where we assign reserved_va to a variable
 - * of type abi_ulong and expect it to fit.  Avoid the last page.
 - */
 -#   define MAX_RESERVED_VA  (0xfffffffful & TARGET_PAGE_MASK)
 +#   define MAX_RESERVED_VA  0xfffffffful
  #  else
 -#   define MAX_RESERVED_VA  (1ul << TARGET_VIRT_ADDR_SPACE_BITS)
 +#   define MAX_RESERVED_VA  ((1ul << TARGET_VIRT_ADDR_SPACE_BITS) - 1)
  #  endif
  # else
  #  define MAX_RESERVED_VA  0
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
      envlist_free(envlist);
      if (reserved_va) {
 -            mmap_next_start = reserved_va;
 +        mmap_next_start = reserved_va + 1;
      }
      {
 diff --git a/bsd-user/mmap.c b/bsd-user/mmap.c
 index XXXXXXX..XXXXXXX 100644
 --- a/bsd-user/mmap.c
 +++ b/bsd-user/mmap.c
@@ -XXX,XX +XXX,XX @@ static abi_ulong mmap_find_vma_reserved(abi_ulong start, abi_ulong size,
      size = HOST_PAGE_ALIGN(size) + alignment;
      end_addr = start + size;
      if (end_addr > reserved_va) {
 -        end_addr = reserved_va;
 +        end_addr = reserved_va + 1;
      }
      addr = end_addr - qemu_host_page_size;
@@ -XXX,XX +XXX,XX @@ static abi_ulong mmap_find_vma_reserved(abi_ulong start, abi_ulong size,
              if (looped) {
                  return (abi_ulong)-1;
              }
 -            end_addr = reserved_va;
 +            end_addr = reserved_va + 1;
              addr = end_addr - qemu_host_page_size;
              looped = 1;
              continue;
 diff --git a/linux-user/elfload.c b/linux-user/elfload.c
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/elfload.c
 +++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)
       * has specified -R reserved_va, which would trigger an assert().
       */
      if (reserved_va != 0 &&
 -        TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE >= reserved_va) {
 +        TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE - 1 > reserved_va) {
          error_report("Cannot allocate vsyscall page");
          exit(EXIT_FAILURE);
      }
@@ -XXX,XX +XXX,XX @@ static void pgb_have_guest_base(const char *image_name, abi_ulong guest_loaddr,
      /* Sanity check the guest binary. */
      if (reserved_va) {
 -        if (guest_hiaddr > reserved_va) {
 +        if (guest_hiaddr - 1 > reserved_va) {
              error_report("%s: requires more than reserved virtual "
                           "address space (0x%" PRIx64 " > 0x%lx)",
 -                         image_name, (uint64_t)guest_hiaddr, reserved_va);
 +                         image_name, (uint64_t)guest_hiaddr - 1,
 +                         reserved_va);
              exit(EXIT_FAILURE);
          }
-     } else {
+         break;
-@@ -XXX,XX +XXX,XX @@ static void pgb_have_guest_base(const char *image_name, abi_ulong guest_loaddr,
-     if (reserved_va) {
+-    case INDEX_op_extu_i32_i64:
-         guest_loaddr = (guest_base >= mmap_min_addr ? 0
+-        tcg_out_ext32u(s, a0, a1);
-                         : mmap_min_addr - guest_base);
+-        break;
--        guest_hiaddr = reserved_va;
+-
-+        guest_hiaddr = reserved_va + 1;
+     case INDEX_op_deposit_i64:
-     }
+     case INDEX_op_deposit_i32:
+         tcg_out_dep(s, ext, a0, REG0(2), args[3], args[4]);
-     /* Reserve the address space for the binary, or reserved_va. */
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
-@@ -XXX,XX +XXX,XX @@ static void pgb_reserved_va(const char *image_name, abi_ulong guest_loaddr,
+     case INDEX_op_ext32s_i64:
-     int flags = MAP_ANONYMOUS | MAP_PRIVATE | MAP_NORESERVE;
+     case INDEX_op_ext32u_i64:
-     void *addr, *test;
+     case INDEX_op_ext_i32_i64:
++    case INDEX_op_extu_i32_i64:
--    if (guest_hiaddr > reserved_va) {
+     default:
-+    if (guest_hiaddr - 1 > reserved_va) {
+         g_assert_not_reached();
-         error_report("%s: requires more than reserved virtual "
+     }
-                      "address space (0x%" PRIx64 " > 0x%lx)",
+diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
--                     image_name, (uint64_t)guest_hiaddr, reserved_va);
+index XXXXXXX..XXXXXXX 100644
-+                     image_name, (uint64_t)guest_hiaddr - 1, reserved_va);
+--- a/tcg/arm/tcg-target.c.inc
-         exit(EXIT_FAILURE);
++++ b/tcg/arm/tcg-target.c.inc
-     }
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg rd, TCGReg rn)
+     g_assert_not_reached();
-     /* Widen the "image" to the entire reserved address space. */
+ }
--    pgb_static(image_name, 0, reserved_va, align);
-+    pgb_static(image_name, 0, reserved_va + 1, align);
++static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg rd, TCGReg rn)
++{
-     /* osdep.h defines this as 0 if it's missing */
++    g_assert_not_reached();
-     flags |= MAP_FIXED_NOREPLACE;
++}
-@@ -XXX,XX +XXX,XX @@ static void pgb_reserved_va(const char *image_name, abi_ulong guest_loaddr,
++
-     /* Reserve the memory on the host. */
+ static void tcg_out_bswap16(TCGContext *s, ARMCond cond,
-     assert(guest_base != 0);
+                             TCGReg rd, TCGReg rn, int flags)
-     test = g2h_untagged(0);
+ {
--    addr = mmap(test, reserved_va, PROT_NONE, flags, -1, 0);
+diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
-+    addr = mmap(test, reserved_va + 1, PROT_NONE, flags, -1, 0);
+index XXXXXXX..XXXXXXX 100644
-     if (addr == MAP_FAILED || addr != test) {
+--- a/tcg/i386/tcg-target.c.inc
-         error_report("Unable to reserve 0x%lx bytes of virtual address "
++++ b/tcg/i386/tcg-target.c.inc
-                      "space at %p (%s) for use as guest address space (check your "
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg dest, TCGReg src)
-                      "virtual memory ulimit setting, min_mmap_addr or reserve less "
+     tcg_out_ext32s(s, dest, src);
--                     "using -R option)", reserved_va, test, strerror(errno));
+ }
-+                     "using -R option)", reserved_va + 1, test, strerror(errno));
-         exit(EXIT_FAILURE);
++static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg dest, TCGReg src)
-     }
++{
++    tcg_out_ext32u(s, dest, src);
-     qemu_log_mask(CPU_LOG_PAGE, "%s: base @ %p for %lu bytes\n",
++}
--                  __func__, addr, reserved_va);
++
-+                  __func__, addr, reserved_va + 1);
+ static inline void tcg_out_bswap64(TCGContext *s, int reg)
- }
+ {
+     tcg_out_opc(s, OPC_BSWAP + P_REXW + LOWREGMASK(reg), 0, reg, 0);
- void probe_guest_base(const char *image_name, abi_ulong guest_loaddr,
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
-diff --git a/linux-user/main.c b/linux-user/main.c
+     case INDEX_op_bswap64_i64:
-index XXXXXXX..XXXXXXX 100644
+         tcg_out_bswap64(s, a0);
---- a/linux-user/main.c
+         break;
-+++ b/linux-user/main.c
+-    case INDEX_op_extu_i32_i64:
-@@ -XXX,XX +XXX,XX @@ static const char *last_log_filename;
+     case INDEX_op_extrl_i64_i32:
- # if HOST_LONG_BITS > TARGET_VIRT_ADDR_SPACE_BITS
+         tcg_out_ext32u(s, a0, a1);
- #  if TARGET_VIRT_ADDR_SPACE_BITS == 32 && \
+         break;
-       (TARGET_LONG_BITS == 32 || defined(TARGET_ABI32))
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
--/* There are a number of places where we assign reserved_va to a variable
+     case INDEX_op_ext32s_i64:
--   of type abi_ulong and expect it to fit.  Avoid the last page.  */
+     case INDEX_op_ext32u_i64:
--#   define MAX_RESERVED_VA(CPU)  (0xfffffffful & TARGET_PAGE_MASK)
+     case INDEX_op_ext_i32_i64:
-+#   define MAX_RESERVED_VA(CPU)  0xfffffffful
++    case INDEX_op_extu_i32_i64:
- #  else
+     default:
--#   define MAX_RESERVED_VA(CPU)  (1ul << TARGET_VIRT_ADDR_SPACE_BITS)
+         g_assert_not_reached();
-+#   define MAX_RESERVED_VA(CPU)  ((1ul << TARGET_VIRT_ADDR_SPACE_BITS) - 1)
+     }
- #  endif
+diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
- # else
+index XXXXXXX..XXXXXXX 100644
- #  define MAX_RESERVED_VA(CPU)  0
+--- a/tcg/loongarch64/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static void handle_arg_reserved_va(const char *arg)
++++ b/tcg/loongarch64/tcg-target.c.inc
- {
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg)
-     char *p;
+     tcg_out_ext32s(s, ret, arg);
-     int shift = 0;
+ }
--    reserved_va = strtoul(arg, &p, 0);
-+    unsigned long val;
++static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg)
-+
++{
-+    val = strtoul(arg, &p, 0);
++    tcg_out_ext32u(s, ret, arg);
-     switch (*p) {
++}
-     case 'k':
++
-     case 'K':
+ static void tcg_out_clzctz(TCGContext *s, LoongArchInsn opc,
-@@ -XXX,XX +XXX,XX @@ static void handle_arg_reserved_va(const char *arg)
+                            TCGReg a0, TCGReg a1, TCGReg a2,
-         break;
+                            bool c2, bool is_32bit)
-     }
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
-     if (shift) {
+         tcg_out_brcond(s, a2, a0, a1, arg_label(args[3]));
--        unsigned long unshifted = reserved_va;
+         break;
-+        unsigned long unshifted = val;
-         p++;
+-    case INDEX_op_extu_i32_i64:
--        reserved_va <<= shift;
+-        tcg_out_ext32u(s, a0, a1);
--        if (reserved_va >> shift != unshifted) {
+-        break;
-+        val <<= shift;
+-
-+        if (val >> shift != unshifted) {
+     case INDEX_op_extrl_i64_i32:
-             fprintf(stderr, "Reserved virtual address too big\n");
+         tcg_out_ext32s(s, a0, a1);
-             exit(EXIT_FAILURE);
+         break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext32s_i64:
      case INDEX_op_ext32u_i64:
      case INDEX_op_ext_i32_i64:
 +    case INDEX_op_extu_i32_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/mips/tcg-target.c.inc
 +++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg rd, TCGReg rs)
      tcg_out_ext32s(s, rd, rs);
  }
 +static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg rd, TCGReg rs)
 +{
 +    tcg_out_ext32u(s, rd, rs);
 +}
 +
  static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                               tcg_target_long imm)
  {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_extrl_i64_i32:
          tcg_out_ext32s(s, a0, a1);
          break;
 -    case INDEX_op_extu_i32_i64:
 -        tcg_out_ext32u(s, a0, a1);
 -        break;
      case INDEX_op_sar_i32:
          i1 = OPC_SRAV, i2 = OPC_SRA;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext32s_i64:
      case INDEX_op_ext32u_i64:
      case INDEX_op_ext_i32_i64:
 +    case INDEX_op_extu_i32_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/ppc/tcg-target.c.inc
 +++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg dst, TCGReg src)
      tcg_out_ext32s(s, dst, src);
  }
 +static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg dst, TCGReg src)
 +{
 +    tcg_out_ext32u(s, dst, src);
 +}
 +
  static inline void tcg_out_shli32(TCGContext *s, TCGReg dst, TCGReg src, int c)
  {
      tcg_out_rlw(s, RLWINM, dst, src, c, 0, 31 - c);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          tcg_out_qemu_st(s, args, true);
          break;
 -    case INDEX_op_extu_i32_i64:
 -        tcg_out_ext32u(s, args[0], args[1]);
 -        break;
 -
      case INDEX_op_setcond_i32:
          tcg_out_setcond(s, TCG_TYPE_I32, args[3], args[0], args[1], args[2],
                          const_args[2]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext32s_i64:
      case INDEX_op_ext32u_i64:
      case INDEX_op_ext_i32_i64:
 +    case INDEX_op_extu_i32_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/riscv/tcg-target.c.inc
 +++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg)
      tcg_out_ext32s(s, ret, arg);
  }
 +static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg)
 +{
 +    tcg_out_ext32u(s, ret, arg);
 +}
 +
  static void tcg_out_ldst(TCGContext *s, RISCVInsn opc, TCGReg data,
                           TCGReg addr, intptr_t offset)
  {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          tcg_out_qemu_st(s, args, true);
          break;
 -    case INDEX_op_extu_i32_i64:
 -        tcg_out_ext32u(s, a0, a1);
 -        break;
 -
      case INDEX_op_extrl_i64_i32:
          tcg_out_ext32s(s, a0, a1);
          break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext32s_i64:
      case INDEX_op_ext32u_i64:
      case INDEX_op_ext_i32_i64:
 +    case INDEX_op_extu_i32_i64:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/s390x/tcg-target.c.inc
 +++ b/tcg/s390x/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg dest, TCGReg src)
      tcg_out_ext32s(s, dest, src);
  }
 +static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg dest, TCGReg src)
 +{
 +    tcg_out_ext32u(s, dest, src);
 +}
 +
  static void tgen_andi_risbg(TCGContext *s, TCGReg out, TCGReg in, uint64_t val)
  {
      int msb, lsb;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
          }
-@@ -XXX,XX +XXX,XX @@ static void handle_arg_reserved_va(const char *arg)
+         break;
-         fprintf(stderr, "Unrecognised -R size suffix '%s'\n", p);
-         exit(EXIT_FAILURE);
+-    case INDEX_op_extu_i32_i64:
-     }
+-        tcg_out_ext32u(s, args[0], args[1]);
-+    /* The representation is size - 1, with 0 remaining "default". */
+-        break;
-+    reserved_va = val ? val - 1 : 0;
+-
- }
+     case INDEX_op_add2_i64:
+         if (const_args[4]) {
- static void handle_arg_singlestep(const char *arg)
+             if ((int64_t)args[4] >= 0) {
-@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp)
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
-      */
+     case INDEX_op_ext32s_i64:
-     max_reserved_va = MAX_RESERVED_VA(cpu);
+     case INDEX_op_ext32u_i64:
-     if (reserved_va != 0) {
+     case INDEX_op_ext_i32_i64:
--        if (reserved_va % qemu_host_page_size) {
++    case INDEX_op_extu_i32_i64:
-+        if ((reserved_va + 1) % qemu_host_page_size) {
+     default:
-             char *s = size_to_str(qemu_host_page_size);
+         g_assert_not_reached();
-             fprintf(stderr, "Reserved virtual address not aligned mod %s\n", s);
+     }
-             g_free(s);
+diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp)
+index XXXXXXX..XXXXXXX 100644
-             exit(EXIT_FAILURE);
+--- a/tcg/sparc64/tcg-target.c.inc
-         }
++++ b/tcg/sparc64/tcg-target.c.inc
-     } else if (HOST_LONG_BITS == 64 && TARGET_VIRT_ADDR_SPACE_BITS <= 32) {
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg rd, TCGReg rs)
--        /*
+     tcg_out_ext32s(s, rd, rs);
--         * reserved_va must be aligned with the host page size
+ }
--         * as it is used with mmap()
--         */
++static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg rd, TCGReg rs)
--        reserved_va = max_reserved_va & qemu_host_page_mask;
++{
-+        /* MAX_RESERVED_VA + 1 is a large power of 2, so is aligned. */
++    tcg_out_ext32u(s, rd, rs);
-+        reserved_va = max_reserved_va;
++}
-     }
++
+ static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
-     {
+                              tcg_target_long imm)
-diff --git a/linux-user/mmap.c b/linux-user/mmap.c
+ {
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
---- a/linux-user/mmap.c
+     case INDEX_op_divu_i64:
-+++ b/linux-user/mmap.c
+         c = ARITH_UDIVX;
-@@ -XXX,XX +XXX,XX @@ static abi_ulong mmap_find_vma_reserved(abi_ulong start, abi_ulong size,
+         goto gen_arith;
-     end_addr = start + size;
+-    case INDEX_op_extu_i32_i64:
-     if (start > reserved_va - size) {
+-        tcg_out_ext32u(s, a0, a1);
-         /* Start at the top of the address space.  */
+-        break;
--        end_addr = ((reserved_va - size) & -align) + size;
+     case INDEX_op_extrl_i64_i32:
-+        end_addr = ((reserved_va + 1 - size) & -align) + size;
+         tcg_out_mov(s, TCG_TYPE_I32, a0, a1);
-         looped = true;
+         break;
-     }
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_ext32s_i64:
-@@ -XXX,XX +XXX,XX @@ static abi_ulong mmap_find_vma_reserved(abi_ulong start, abi_ulong size,
+     case INDEX_op_ext32u_i64:
-                 return (abi_ulong)-1;
+     case INDEX_op_ext_i32_i64:
-             }
++    case INDEX_op_extu_i32_i64:
-             /* Re-start at the top of the address space.  */
+     default:
--            addr = end_addr = ((reserved_va - size) & -align) + size;
+         g_assert_not_reached();
-+            addr = end_addr = ((reserved_va + 1 - size) & -align) + size;
+     }
-             looped = true;
+diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
-         } else {
+index XXXXXXX..XXXXXXX 100644
-             prot = page_get_flags(addr);
+--- a/tcg/tci/tcg-target.c.inc
 +++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg rd, TCGReg rs)
      tcg_out_ext32s(s, rd, rs);
  }
 +static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg rd, TCGReg rs)
 +{
 +    tcg_out_ext32u(s, rd, rs);
 +}
 +
  static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                               tcg_target_long imm)
  {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      CASE_32_64(neg)      /* Optional (TCG_TARGET_HAS_neg_*). */
      CASE_32_64(not)      /* Optional (TCG_TARGET_HAS_not_*). */
 -    CASE_64(extu_i32)
      CASE_32_64(ctpop)    /* Optional (TCG_TARGET_HAS_ctpop_*). */
      case INDEX_op_bswap32_i32: /* Optional (TCG_TARGET_HAS_bswap32_i32). */
      case INDEX_op_bswap64_i64: /* Optional (TCG_TARGET_HAS_bswap64_i64). */
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext32s_i64:
      case INDEX_op_ext32u_i64:
      case INDEX_op_ext_i32_i64:
 +    case INDEX_op_extu_i32_i64:
      default:
          g_assert_not_reached();
      }
 --
 .34.1

-[PATCH for-8.0 06/11] accel/tcg: Pass last not end to page_reset_target_data
+[PULL 11/15] tcg: Split out tcg_out_extrl_i64_i32
-Pass the address of the last byte to be changed, rather than
+We will need a backend interface for type truncation.  For those backends
-the first address past the last byte.  This avoids overflow
+that did not enable TCG_TARGET_HAS_extrl_i64_i32, use tcg_out_mov.
-when the last page of the address space is involved.
+Use it in tcg_reg_alloc_op in the meantime.
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/cpu-all.h |  2 +-
+ tcg/tcg.c                        |  4 ++++
- accel/tcg/user-exec.c  | 11 +++++------
+ tcg/aarch64/tcg-target.c.inc     |  6 ++++++
- linux-user/mmap.c      |  2 +-
+ tcg/arm/tcg-target.c.inc         |  5 +++++
-files changed, 7 insertions(+), 8 deletions(-)
+ tcg/i386/tcg-target.c.inc        |  9 ++++++---
  tcg/loongarch64/tcg-target.c.inc | 10 ++++++----
  tcg/mips/tcg-target.c.inc        |  9 ++++++---
  tcg/ppc/tcg-target.c.inc         |  7 +++++++
  tcg/riscv/tcg-target.c.inc       | 10 ++++++----
  tcg/s390x/tcg-target.c.inc       |  6 ++++++
  tcg/sparc64/tcg-target.c.inc     |  9 ++++++---
  tcg/tci/tcg-target.c.inc         |  7 +++++++
 files changed, 65 insertions(+), 17 deletions(-)
-diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
+diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/cpu-all.h
+--- a/tcg/tcg.c
-+++ b/include/exec/cpu-all.h
++++ b/tcg/tcg.c
-@@ -XXX,XX +XXX,XX @@ int walk_memory_regions(void *, walk_memory_regions_fn);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32s(TCGContext *s, TCGReg ret, TCGReg arg);
+ static void tcg_out_ext32u(TCGContext *s, TCGReg ret, TCGReg arg);
- int page_get_flags(target_ulong address);
+ static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg);
- void page_set_flags(target_ulong start, target_ulong last, int flags);
+ static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg);
--void page_reset_target_data(target_ulong start, target_ulong end);
++static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg ret, TCGReg arg);
-+void page_reset_target_data(target_ulong start, target_ulong last);
+ static void tcg_out_addi_ptr(TCGContext *s, TCGReg, TCGReg, tcg_target_long);
- int page_check_range(target_ulong start, target_ulong len, int flags);
+ static void tcg_out_exit_tb(TCGContext *s, uintptr_t arg);
+ static void tcg_out_goto_tb(TCGContext *s, int which);
- /**
+@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
-diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
+     case INDEX_op_extu_i32_i64:
-index XXXXXXX..XXXXXXX 100644
+         tcg_out_extu_i32_i64(s, new_args[0], new_args[1]);
---- a/accel/tcg/user-exec.c
+         break;
-+++ b/accel/tcg/user-exec.c
++    case INDEX_op_extrl_i64_i32:
-@@ -XXX,XX +XXX,XX @@ void page_set_flags(target_ulong start, target_ulong last, int flags)
++        tcg_out_extrl_i64_i32(s, new_args[0], new_args[1]);
-     }
++        break;
+     default:
-     if (!flags || reset) {
+         if (def->flags & TCG_OPF_VECTOR) {
--        page_reset_target_data(start, last + 1);
+             tcg_out_vec_op(s, op->opc, TCGOP_VECL(op), TCGOP_VECE(op),
-+        page_reset_target_data(start, last);
+diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
-         inval_tb |= pageflags_unset(start, last);
+index XXXXXXX..XXXXXXX 100644
-     }
+--- a/tcg/aarch64/tcg-target.c.inc
-     if (flags) {
++++ b/tcg/aarch64/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ typedef struct TargetPageDataNode {
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg rd, TCGReg rn)
+     tcg_out_ext32u(s, rd, rn);
- static IntervalTreeRoot targetdata_root;
+ }
--void page_reset_target_data(target_ulong start, target_ulong end)
++static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg rd, TCGReg rn)
-+void page_reset_target_data(target_ulong start, target_ulong last)
++{
- {
++    tcg_out_mov(s, TCG_TYPE_I32, rd, rn);
-     IntervalTreeNode *n, *next;
++}
--    target_ulong last;
++
+ static void tcg_out_addsubi(TCGContext *s, int ext, TCGReg rd,
-     assert_memory_lock();
+                             TCGReg rn, int64_t aimm)
+ {
--    start = start & TARGET_PAGE_MASK;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
--    last = TARGET_PAGE_ALIGN(end) - 1;
+     case INDEX_op_ext32u_i64:
-+    start &= TARGET_PAGE_MASK;
+     case INDEX_op_ext_i32_i64:
-+    last |= ~TARGET_PAGE_MASK;
+     case INDEX_op_extu_i32_i64:
++    case INDEX_op_extrl_i64_i32:
-     for (n = interval_tree_iter_first(&targetdata_root, start, last),
+     default:
-          next = n ? interval_tree_iter_next(n, start, last) : NULL;
+         g_assert_not_reached();
-@@ -XXX,XX +XXX,XX @@ void *page_get_target_data(target_ulong address)
+     }
-     return t->data[(page - region) >> TARGET_PAGE_BITS];
+diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
- }
+index XXXXXXX..XXXXXXX 100644
- #else
+--- a/tcg/arm/tcg-target.c.inc
--void page_reset_target_data(target_ulong start, target_ulong end) { }
++++ b/tcg/arm/tcg-target.c.inc
-+void page_reset_target_data(target_ulong start, target_ulong last) { }
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg rd, TCGReg rn)
- #endif /* TARGET_PAGE_DATA_SIZE */
+     g_assert_not_reached();
+ }
- /* The softmmu versions of these helpers are in cputlb.c.  */
-diff --git a/linux-user/mmap.c b/linux-user/mmap.c
++static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg rd, TCGReg rn)
-index XXXXXXX..XXXXXXX 100644
++{
---- a/linux-user/mmap.c
++    g_assert_not_reached();
-+++ b/linux-user/mmap.c
++}
-@@ -XXX,XX +XXX,XX @@ abi_long target_madvise(abi_ulong start, abi_ulong len_in, int advice)
++
-         if (can_passthrough_madvise(start, end)) {
+ static void tcg_out_bswap16(TCGContext *s, ARMCond cond,
-             ret = get_errno(madvise(g2h_untagged(start), len, advice));
+                             TCGReg rd, TCGReg rn, int flags)
-             if ((advice == MADV_DONTNEED) && (ret == 0)) {
+ {
--                page_reset_target_data(start, start + len);
+diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
-+                page_reset_target_data(start, start + len - 1);
+index XXXXXXX..XXXXXXX 100644
-             }
+--- a/tcg/i386/tcg-target.c.inc
-         }
++++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg dest, TCGReg src)
      tcg_out_ext32u(s, dest, src);
  }
 +static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg dest, TCGReg src)
 +{
 +    tcg_out_ext32u(s, dest, src);
 +}
 +
  static inline void tcg_out_bswap64(TCGContext *s, int reg)
  {
      tcg_out_opc(s, OPC_BSWAP + P_REXW + LOWREGMASK(reg), 0, reg, 0);
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_bswap64_i64:
          tcg_out_bswap64(s, a0);
          break;
 -    case INDEX_op_extrl_i64_i32:
 -        tcg_out_ext32u(s, a0, a1);
 -        break;
      case INDEX_op_extrh_i64_i32:
          tcg_out_shifti(s, SHIFT_SHR + P_REXW, a0, 32);
          break;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext32u_i64:
      case INDEX_op_ext_i32_i64:
      case INDEX_op_extu_i32_i64:
 +    case INDEX_op_extrl_i64_i32:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/loongarch64/tcg-target.c.inc
 +++ b/tcg/loongarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg)
      tcg_out_ext32u(s, ret, arg);
  }
 +static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg ret, TCGReg arg)
 +{
 +    tcg_out_ext32s(s, ret, arg);
 +}
 +
  static void tcg_out_clzctz(TCGContext *s, LoongArchInsn opc,
                             TCGReg a0, TCGReg a1, TCGReg a2,
                             bool c2, bool is_32bit)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          tcg_out_brcond(s, a2, a0, a1, arg_label(args[3]));
          break;
 -    case INDEX_op_extrl_i64_i32:
 -        tcg_out_ext32s(s, a0, a1);
 -        break;
 -
      case INDEX_op_extrh_i64_i32:
          tcg_out_opc_srai_d(s, a0, a1, 32);
          break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext32u_i64:
      case INDEX_op_ext_i32_i64:
      case INDEX_op_extu_i32_i64:
 +    case INDEX_op_extrl_i64_i32:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/mips/tcg-target.c.inc
 +++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg rd, TCGReg rs)
      tcg_out_ext32u(s, rd, rs);
  }
 +static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg rd, TCGReg rs)
 +{
 +    tcg_out_ext32s(s, rd, rs);
 +}
 +
  static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                               tcg_target_long imm)
  {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_extrh_i64_i32:
          tcg_out_dsra(s, a0, a1, 32);
          break;
 -    case INDEX_op_extrl_i64_i32:
 -        tcg_out_ext32s(s, a0, a1);
 -        break;
      case INDEX_op_sar_i32:
          i1 = OPC_SRAV, i2 = OPC_SRA;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext32u_i64:
      case INDEX_op_ext_i32_i64:
      case INDEX_op_extu_i32_i64:
 +    case INDEX_op_extrl_i64_i32:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/ppc/tcg-target.c.inc
 +++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg dst, TCGReg src)
      tcg_out_ext32u(s, dst, src);
  }
 +static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg rd, TCGReg rn)
 +{
 +    tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
 +    tcg_out_mov(s, TCG_TYPE_I32, rd, rn);
 +}
 +
  static inline void tcg_out_shli32(TCGContext *s, TCGReg dst, TCGReg src, int c)
  {
      tcg_out_rlw(s, RLWINM, dst, src, c, 0, 31 - c);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext32u_i64:
      case INDEX_op_ext_i32_i64:
      case INDEX_op_extu_i32_i64:
 +    case INDEX_op_extrl_i64_i32:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/riscv/tcg-target.c.inc
 +++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg)
      tcg_out_ext32u(s, ret, arg);
  }
 +static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg ret, TCGReg arg)
 +{
 +    tcg_out_ext32s(s, ret, arg);
 +}
 +
  static void tcg_out_ldst(TCGContext *s, RISCVInsn opc, TCGReg data,
                           TCGReg addr, intptr_t offset)
  {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          tcg_out_qemu_st(s, args, true);
          break;
 -    case INDEX_op_extrl_i64_i32:
 -        tcg_out_ext32s(s, a0, a1);
 -        break;
 -
      case INDEX_op_extrh_i64_i32:
          tcg_out_opc_imm(s, OPC_SRAI, a0, a1, 32);
          break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext32u_i64:
      case INDEX_op_ext_i32_i64:
      case INDEX_op_extu_i32_i64:
 +    case INDEX_op_extrl_i64_i32:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/s390x/tcg-target.c.inc
 +++ b/tcg/s390x/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg dest, TCGReg src)
      tcg_out_ext32u(s, dest, src);
  }
 +static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg dest, TCGReg src)
 +{
 +    tcg_out_mov(s, TCG_TYPE_I32, dest, src);
 +}
 +
  static void tgen_andi_risbg(TCGContext *s, TCGReg out, TCGReg in, uint64_t val)
  {
      int msb, lsb;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext32u_i64:
      case INDEX_op_ext_i32_i64:
      case INDEX_op_extu_i32_i64:
 +    case INDEX_op_extrl_i64_i32:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/sparc64/tcg-target.c.inc
 +++ b/tcg/sparc64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg rd, TCGReg rs)
      tcg_out_ext32u(s, rd, rs);
  }
 +static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg rd, TCGReg rs)
 +{
 +    tcg_out_mov(s, TCG_TYPE_I32, rd, rs);
 +}
 +
  static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                               tcg_target_long imm)
  {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_divu_i64:
          c = ARITH_UDIVX;
          goto gen_arith;
 -    case INDEX_op_extrl_i64_i32:
 -        tcg_out_mov(s, TCG_TYPE_I32, a0, a1);
 -        break;
      case INDEX_op_extrh_i64_i32:
          tcg_out_arithi(s, a0, a1, 32, SHIFT_SRLX);
          break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext32u_i64:
      case INDEX_op_ext_i32_i64:
      case INDEX_op_extu_i32_i64:
 +    case INDEX_op_extrl_i64_i32:
      default:
          g_assert_not_reached();
      }
 diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.c.inc
 +++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg rd, TCGReg rs)
      tcg_out_ext32u(s, rd, rs);
  }
 +static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg rd, TCGReg rs)
 +{
 +    tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
 +    tcg_out_mov(s, TCG_TYPE_I32, rd, rs);
 +}
 +
  static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                               tcg_target_long imm)
  {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_ext32u_i64:
      case INDEX_op_ext_i32_i64:
      case INDEX_op_extu_i32_i64:
 +    case INDEX_op_extrl_i64_i32:
      default:
          g_assert_not_reached();
      }
 --
 .34.1

-[PATCH for-8.0 08/11] accel/tcg: Pass last not end to page_collection_lock
+[PULL 12/15] tcg: Introduce tcg_out_movext
-Pass the address of the last byte to be changed, rather than
+This is common code in most qemu_{ld,st} slow paths, extending the
-the first address past the last byte.  This avoids overflow
+input value for the store helper data argument or extending the
-when the last page of the address space is involved.
+return value from the load helper.
 Fixes a bug in the loop comparision where "<= end" would lock
 one more page than required.
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/tb-maint.c | 22 +++++++++++-----------
+ tcg/tcg.c                        | 63 ++++++++++++++++++++++++++++++++
-file changed, 11 insertions(+), 11 deletions(-)
+ tcg/aarch64/tcg-target.c.inc     |  8 +---
  tcg/arm/tcg-target.c.inc         | 16 ++------
  tcg/i386/tcg-target.c.inc        | 30 +++------------
  tcg/loongarch64/tcg-target.c.inc | 53 ++++-----------------------
  tcg/ppc/tcg-target.c.inc         | 38 +++++--------------
  tcg/riscv/tcg-target.c.inc       | 13 +------
  tcg/s390x/tcg-target.c.inc       | 19 ++--------
  tcg/sparc64/tcg-target.c.inc     | 31 +++-------------
 files changed, 103 insertions(+), 168 deletions(-)
-diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
+diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/tb-maint.c
+--- a/tcg/tcg.c
-+++ b/accel/tcg/tb-maint.c
++++ b/tcg/tcg.c
-@@ -XXX,XX +XXX,XX @@ static gint tb_page_addr_cmp(gconstpointer ap, gconstpointer bp, gpointer udata)
+@@ -XXX,XX +XXX,XX @@ void tcg_raise_tb_overflow(TCGContext *s)
      siglongjmp(s->jmp_trans, -2);
  }
- /*
++/**
-- * Lock a range of pages ([@start,@end[) as well as the pages of all
++ * tcg_out_movext -- move and extend
-+ * Lock a range of pages ([@start,@last]) as well as the pages of all
++ * @s: tcg context
-  * intersecting TBs.
++ * @dst_type: integral type for destination
-  * Locking order: acquire locks in ascending order of page index.
++ * @dst: destination register
-  */
++ * @src_type: integral type for source
- static struct page_collection *page_collection_lock(tb_page_addr_t start,
++ * @src_ext: extension to apply to source
--                                                    tb_page_addr_t end)
++ * @src: source register
-+                                                    tb_page_addr_t last)
++ *
 + * Move or extend @src into @dst, depending on @src_ext and the types.
 + */
 +static void __attribute__((unused))
 +tcg_out_movext(TCGContext *s, TCGType dst_type, TCGReg dst,
 +               TCGType src_type, MemOp src_ext, TCGReg src)
 +{
 +    switch (src_ext) {
 +    case MO_UB:
 +        tcg_out_ext8u(s, dst, src);
 +        break;
 +    case MO_SB:
 +        tcg_out_ext8s(s, dst_type, dst, src);
 +        break;
 +    case MO_UW:
 +        tcg_out_ext16u(s, dst, src);
 +        break;
 +    case MO_SW:
 +        tcg_out_ext16s(s, dst_type, dst, src);
 +        break;
 +    case MO_UL:
 +    case MO_SL:
 +        if (dst_type == TCG_TYPE_I32) {
 +            if (src_type == TCG_TYPE_I32) {
 +                tcg_out_mov(s, TCG_TYPE_I32, dst, src);
 +            } else {
 +                tcg_out_extrl_i64_i32(s, dst, src);
 +            }
 +        } else if (src_type == TCG_TYPE_I32) {
 +            if (src_ext & MO_SIGN) {
 +                tcg_out_exts_i32_i64(s, dst, src);
 +            } else {
 +                tcg_out_extu_i32_i64(s, dst, src);
 +            }
 +        } else {
 +            if (src_ext & MO_SIGN) {
 +                tcg_out_ext32s(s, dst, src);
 +            } else {
 +                tcg_out_ext32u(s, dst, src);
 +            }
 +        }
 +        break;
 +    case MO_UQ:
 +        tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
 +        if (dst_type == TCG_TYPE_I32) {
 +            tcg_out_extrl_i64_i32(s, dst, src);
 +        } else {
 +            tcg_out_mov(s, TCG_TYPE_I64, dst, src);
 +        }
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +}
 +
  #define C_PFX1(P, A)                    P##A
  #define C_PFX2(P, A, B)                 P##A##_##B
  #define C_PFX3(P, A, B, C)              P##A##_##B##_##C
 diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/aarch64/tcg-target.c.inc
 +++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
  {
-     struct page_collection *set = g_malloc(sizeof(*set));
+     MemOpIdx oi = lb->oi;
-     tb_page_addr_t index;
+     MemOp opc = get_memop(oi);
-     PageDesc *pd;
+-    MemOp size = opc & MO_SIZE;
-     start >>= TARGET_PAGE_BITS;
+     if (!reloc_pc19(lb->label_ptr[0], tcg_splitwx_to_rx(s->code_ptr))) {
--    end   >>= TARGET_PAGE_BITS;
+         return false;
--    g_assert(start <= end);
+@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
-+    last >>= TARGET_PAGE_BITS;
+     tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_X2, oi);
-+    g_assert(start <= last);
+     tcg_out_adr(s, TCG_REG_X3, lb->raddr);
+     tcg_out_call_int(s, qemu_ld_helpers[opc & MO_SIZE]);
-     set->tree = q_tree_new_full(tb_page_addr_cmp, NULL, NULL,
+-    if (opc & MO_SIGN) {
-                                 page_entry_destroy);
+-        tcg_out_sxt(s, lb->type, size, lb->datalo_reg, TCG_REG_X0);
-@@ -XXX,XX +XXX,XX @@ static struct page_collection *page_collection_lock(tb_page_addr_t start,
+-    } else {
-  retry:
+-        tcg_out_mov(s, size == MO_64, lb->datalo_reg, TCG_REG_X0);
-     q_tree_foreach(set->tree, page_entry_lock, NULL);
+-    }
--    for (index = start; index <= end; index++) {
++    tcg_out_movext(s, lb->type, lb->datalo_reg,
-+    for (index = start; index <= last; index++) {
++                   TCG_TYPE_REG, opc & MO_SSIZE, TCG_REG_X0);
-         TranslationBlock *tb;
+     tcg_out_goto(s, lb->raddr);
-         PageForEachNext n;
+     return true;
+ }
-@@ -XXX,XX +XXX,XX @@ tb_invalidate_phys_page_range__locked(struct page_collection *pages,
+diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
- void tb_invalidate_phys_page(tb_page_addr_t addr)
+index XXXXXXX..XXXXXXX 100644
 --- a/tcg/arm/tcg-target.c.inc
 +++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
      datalo = lb->datalo_reg;
      datahi = lb->datahi_reg;
 -    switch (opc & MO_SSIZE) {
 -    case MO_SB:
 -        tcg_out_ext8s(s, TCG_TYPE_I32, datalo, TCG_REG_R0);
 -        break;
 -    case MO_SW:
 -        tcg_out_ext16s(s, TCG_TYPE_I32, datalo, TCG_REG_R0);
 -        break;
 -    default:
 -        tcg_out_mov_reg(s, COND_AL, datalo, TCG_REG_R0);
 -        break;
 -    case MO_UQ:
 +    if ((opc & MO_SIZE) == MO_64) {
          if (datalo != TCG_REG_R1) {
              tcg_out_mov_reg(s, COND_AL, datalo, TCG_REG_R0);
              tcg_out_mov_reg(s, COND_AL, datahi, TCG_REG_R1);
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
              tcg_out_mov_reg(s, COND_AL, datahi, TCG_REG_R1);
              tcg_out_mov_reg(s, COND_AL, datalo, TCG_REG_TMP);
          }
 -        break;
 +    } else {
 +        tcg_out_movext(s, TCG_TYPE_I32, datalo,
 +                       TCG_TYPE_I32, opc & MO_SSIZE, TCG_REG_R0);
      }
      tcg_out_goto(s, COND_AL, lb->raddr);
 diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/i386/tcg-target.c.inc
 +++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
      tcg_out_branch(s, 1, qemu_ld_helpers[opc & (MO_BSWAP | MO_SIZE)]);
      data_reg = l->datalo_reg;
 -    switch (opc & MO_SSIZE) {
 -    case MO_SB:
 -        tcg_out_ext8s(s, l->type, data_reg, TCG_REG_EAX);
 -        break;
 -    case MO_SW:
 -        tcg_out_ext16s(s, l->type, data_reg, TCG_REG_EAX);
 -        break;
 -#if TCG_TARGET_REG_BITS == 64
 -    case MO_SL:
 -        tcg_out_ext32s(s, data_reg, TCG_REG_EAX);
 -        break;
 -#endif
 -    case MO_UB:
 -    case MO_UW:
 -        /* Note that the helpers have zero-extended to tcg_target_long.  */
 -    case MO_UL:
 -        tcg_out_mov(s, TCG_TYPE_I32, data_reg, TCG_REG_EAX);
 -        break;
 -    case MO_UQ:
 -        if (TCG_TARGET_REG_BITS == 64) {
 -            tcg_out_mov(s, TCG_TYPE_I64, data_reg, TCG_REG_RAX);
 -        } else if (data_reg == TCG_REG_EDX) {
 +    if (TCG_TARGET_REG_BITS == 32 && (opc & MO_SIZE) == MO_64) {
 +        if (data_reg == TCG_REG_EDX) {
              /* xchg %edx, %eax */
              tcg_out_opc(s, OPC_XCHG_ax_r32 + TCG_REG_EDX, 0, 0, 0);
              tcg_out_mov(s, TCG_TYPE_I32, l->datahi_reg, TCG_REG_EAX);
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
              tcg_out_mov(s, TCG_TYPE_I32, data_reg, TCG_REG_EAX);
              tcg_out_mov(s, TCG_TYPE_I32, l->datahi_reg, TCG_REG_EDX);
          }
 -        break;
 -    default:
 -        g_assert_not_reached();
 +    } else {
 +        tcg_out_movext(s, l->type, data_reg,
 +                       TCG_TYPE_REG, opc & MO_SSIZE, TCG_REG_EAX);
      }
      /* Jump to the code corresponding to next IR of qemu_st */
 diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/loongarch64/tcg-target.c.inc
 +++ b/tcg/loongarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
      MemOpIdx oi = l->oi;
      MemOp opc = get_memop(oi);
      MemOp size = opc & MO_SIZE;
 -    TCGType type = l->type;
      /* resolve label address */
      if (!reloc_br_sk16(l->label_ptr[0], tcg_splitwx_to_rx(s->code_ptr))) {
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
      tcg_out_call_int(s, qemu_ld_helpers[size], false);
 -    switch (opc & MO_SSIZE) {
 -    case MO_SB:
 -        tcg_out_ext8s(s, type, l->datalo_reg, TCG_REG_A0);
 -        break;
 -    case MO_SW:
 -        tcg_out_ext16s(s, type, l->datalo_reg, TCG_REG_A0);
 -        break;
 -    case MO_SL:
 -        tcg_out_ext32s(s, l->datalo_reg, TCG_REG_A0);
 -        break;
 -    case MO_UL:
 -        if (type == TCG_TYPE_I32) {
 -            /* MO_UL loads of i32 should be sign-extended too */
 -            tcg_out_ext32s(s, l->datalo_reg, TCG_REG_A0);
 -            break;
 -        }
 -        /* fallthrough */
 -    default:
 -        tcg_out_mov(s, type, l->datalo_reg, TCG_REG_A0);
 -        break;
 -    }
 -
 +    tcg_out_movext(s, l->type, l->datalo_reg,
 +                   TCG_TYPE_REG, opc & MO_SSIZE, TCG_REG_A0);
      return tcg_out_goto(s, l->raddr);
  }
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
      /* call store helper */
      tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_A0, TCG_AREG0);
      tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_A1, l->addrlo_reg);
 -    switch (size) {
 -    case MO_8:
 -        tcg_out_ext8u(s, TCG_REG_A2, l->datalo_reg);
 -        break;
 -    case MO_16:
 -        tcg_out_ext16u(s, TCG_REG_A2, l->datalo_reg);
 -        break;
 -    case MO_32:
 -        tcg_out_ext32u(s, TCG_REG_A2, l->datalo_reg);
 -        break;
 -    case MO_64:
 -        tcg_out_mov(s, TCG_TYPE_I64, TCG_REG_A2, l->datalo_reg);
 -        break;
 -    default:
 -        g_assert_not_reached();
 -        break;
 -    }
 +    tcg_out_movext(s, size == MO_64 ? TCG_TYPE_I32 : TCG_TYPE_I32, TCG_REG_A2,
 +                   l->type, size, l->datalo_reg);
      tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_A3, oi);
      tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_A4, (tcg_target_long)l->raddr);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_indexed(TCGContext *s, TCGReg data,
      }
  }
 -static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args)
 +static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, TCGType type)
  {
-     struct page_collection *pages;
+     TCGReg addr_regl;
--    tb_page_addr_t start, end;
+     TCGReg data_regl;
-+    tb_page_addr_t start, last;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args)
-     PageDesc *p;
+     tcg_out_tlb_load(s, addr_regl, oi, label_ptr, 0);
+     base = tcg_out_zext_addr_if_32_bit(s, addr_regl, TCG_REG_TMP0);
-     p = page_find(addr >> TARGET_PAGE_BITS);
+     tcg_out_qemu_st_indexed(s, data_regl, base, TCG_REG_TMP2, opc);
-@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_page(tb_page_addr_t addr)
+-    add_qemu_ldst_label(s, 0, oi,
-     }
+-                        0, /* type param is unused for stores */
++    add_qemu_ldst_label(s, 0, oi, type,
-     start = addr & TARGET_PAGE_MASK;
+                         data_regl, addr_regl,
--    end = start + TARGET_PAGE_SIZE;
+                         s->code_ptr, label_ptr);
--    pages = page_collection_lock(start, end);
+ #else
--    tb_invalidate_phys_page_range__locked(pages, p, start, end, 0);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
-+    last = addr | ~TARGET_PAGE_MASK;
+         tcg_out_qemu_ld(s, args, TCG_TYPE_I64);
-+    pages = page_collection_lock(start, last);
+         break;
-+    tb_invalidate_phys_page_range__locked(pages, p, start, last + 1, 0);
+     case INDEX_op_qemu_st_i32:
-     page_collection_unlock(pages);
+-        tcg_out_qemu_st(s, args);
 +        tcg_out_qemu_st(s, args, TCG_TYPE_I32);
          break;
      case INDEX_op_qemu_st_i64:
 -        tcg_out_qemu_st(s, args);
 +        tcg_out_qemu_st(s, args, TCG_TYPE_I64);
          break;
      case INDEX_op_mov_i32:  /* Always emitted via tcg_out_mov.  */
 diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/ppc/tcg-target.c.inc
 +++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const uint32_t qemu_stx_opc[(MO_SIZE + MO_BSWAP) + 1] = {
      [MO_BSWAP | MO_UQ] = STDBRX,
  };
 -static const uint32_t qemu_exts_opc[4] = {
 -    EXTSB, EXTSH, EXTSW, 0
 -};
 -
  #if defined (CONFIG_SOFTMMU)
  /* helper signature: helper_ld_mmu(CPUState *env, target_ulong addr,
   *                                 int mmu_idx, uintptr_t ra)
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
      if (TCG_TARGET_REG_BITS == 32 && (opc & MO_SIZE) == MO_64) {
          tcg_out_mov(s, TCG_TYPE_I32, lo, TCG_REG_R4);
          tcg_out_mov(s, TCG_TYPE_I32, hi, TCG_REG_R3);
 -    } else if (opc & MO_SIGN) {
 -        uint32_t insn = qemu_exts_opc[opc & MO_SIZE];
 -        tcg_out32(s, insn | RA(lo) | RS(TCG_REG_R3));
      } else {
 -        tcg_out_mov(s, TCG_TYPE_REG, lo, TCG_REG_R3);
 +        tcg_out_movext(s, lb->type, lo,
 +                       TCG_TYPE_REG, opc & MO_SSIZE, TCG_REG_R3);
      }
      tcg_out_b(s, 0, lb->raddr);
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
      lo = lb->datalo_reg;
      hi = lb->datahi_reg;
 -    if (TCG_TARGET_REG_BITS == 32) {
 -        switch (s_bits) {
 -        case MO_64:
 -            arg |= (TCG_TARGET_CALL_ARG_I64 == TCG_CALL_ARG_EVEN);
 -            tcg_out_mov(s, TCG_TYPE_I32, arg++, hi);
 -            /* FALLTHRU */
 -        case MO_32:
 -            tcg_out_mov(s, TCG_TYPE_I32, arg++, lo);
 -            break;
 -        default:
 -            tcg_out_rlw(s, RLWINM, arg++, lo, 0, 32 - (8 << s_bits), 31);
 -            break;
 -        }
 +    if (TCG_TARGET_REG_BITS == 32 && s_bits == MO_64) {
 +        arg |= (TCG_TARGET_CALL_ARG_I64 == TCG_CALL_ARG_EVEN);
 +        tcg_out_mov(s, TCG_TYPE_I32, arg++, hi);
 +        tcg_out_mov(s, TCG_TYPE_I32, arg++, lo);
      } else {
 -        if (s_bits == MO_64) {
 -            tcg_out_mov(s, TCG_TYPE_I64, arg++, lo);
 -        } else {
 -            tcg_out_rld(s, RLDICL, arg++, lo, 0, 64 - (8 << s_bits));
 -        }
 +        tcg_out_movext(s, s_bits == MO_64 ? TCG_TYPE_I64 : TCG_TYPE_I32,
 +                       arg++, lb->type, s_bits, lo);
      }
      tcg_out_movi(s, TCG_TYPE_I32, arg++, oi);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
          } else {
              insn = qemu_ldx_opc[opc & (MO_SIZE | MO_BSWAP)];
              tcg_out32(s, insn | TAB(datalo, rbase, addrlo));
 -            insn = qemu_exts_opc[s_bits];
 -            tcg_out32(s, insn | RA(datalo) | RS(datalo));
 +            tcg_out_movext(s, TCG_TYPE_REG, datalo,
 +                           TCG_TYPE_REG, opc & MO_SSIZE, datalo);
          }
      }
 diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/riscv/tcg-target.c.inc
 +++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
      /* call store helper */
      tcg_out_mov(s, TCG_TYPE_PTR, a0, TCG_AREG0);
      tcg_out_mov(s, TCG_TYPE_PTR, a1, l->addrlo_reg);
 -    tcg_out_mov(s, TCG_TYPE_PTR, a2, l->datalo_reg);
 -    switch (s_bits) {
 -    case MO_8:
 -        tcg_out_ext8u(s, a2, a2);
 -        break;
 -    case MO_16:
 -        tcg_out_ext16u(s, a2, a2);
 -        break;
 -    default:
 -        break;
 -    }
 +    tcg_out_movext(s, s_bits == MO_64 ? TCG_TYPE_I64 : TCG_TYPE_I32, a2,
 +                   l->type, s_bits, l->datalo_reg);
      tcg_out_movi(s, TCG_TYPE_PTR, a3, oi);
      tcg_out_movi(s, TCG_TYPE_PTR, a4, (tcg_target_long)l->raddr);
 diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/s390x/tcg-target.c.inc
 +++ b/tcg/s390x/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
      TCGReg data_reg = lb->datalo_reg;
      MemOpIdx oi = lb->oi;
      MemOp opc = get_memop(oi);
 +    MemOp size = opc & MO_SIZE;
      if (!patch_reloc(lb->label_ptr[0], R_390_PC16DBL,
                       (intptr_t)tcg_splitwx_to_rx(s->code_ptr), 2)) {
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
      if (TARGET_LONG_BITS == 64) {
          tcg_out_mov(s, TCG_TYPE_I64, TCG_REG_R3, addr_reg);
      }
 -    switch (opc & MO_SIZE) {
 -    case MO_UB:
 -        tcg_out_ext8u(s, TCG_REG_R4, data_reg);
 -        break;
 -    case MO_UW:
 -        tcg_out_ext16u(s, TCG_REG_R4, data_reg);
 -        break;
 -    case MO_UL:
 -        tcg_out_ext32u(s, TCG_REG_R4, data_reg);
 -        break;
 -    case MO_UQ:
 -        tcg_out_mov(s, TCG_TYPE_I64, TCG_REG_R4, data_reg);
 -        break;
 -    default:
 -        g_assert_not_reached();
 -    }
 +    tcg_out_movext(s, size == MO_64 ? TCG_TYPE_I64 : TCG_TYPE_I32,
 +                   TCG_REG_R4, lb->type, size, data_reg);
      tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_R5, oi);
      tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_R6, (uintptr_t)lb->raddr);
      tcg_out_call_int(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)]);
 diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/sparc64/tcg-target.c.inc
 +++ b/tcg/sparc64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_mb(TCGContext *s, TCGArg a0)
  static const tcg_insn_unit *qemu_ld_trampoline[(MO_SSIZE | MO_BSWAP) + 1];
  static const tcg_insn_unit *qemu_st_trampoline[(MO_SIZE | MO_BSWAP) + 1];
 -static void emit_extend(TCGContext *s, TCGReg r, int op)
 -{
 -    /* Emit zero extend of 8, 16 or 32 bit data as
 -     * required by the MO_* value op; do nothing for 64 bit.
 -     */
 -    switch (op & MO_SIZE) {
 -    case MO_8:
 -        tcg_out_ext8u(s, r, r);
 -        break;
 -    case MO_16:
 -        tcg_out_ext16u(s, r, r);
 -        break;
 -    case MO_32:
 -        tcg_out_ext32u(s, r, r);
 -        break;
 -    case MO_64:
 -        break;
 -    }
 -}
 -
  static void build_trampolines(TCGContext *s)
  {
      static void * const qemu_ld_helpers[] = {
@@ -XXX,XX +XXX,XX @@ static void build_trampolines(TCGContext *s)
          }
          qemu_st_trampoline[i] = tcg_splitwx_to_rx(s->code_ptr);
 -        emit_extend(s, TCG_REG_O2, i);
 -
          /* Set the retaddr operand.  */
          tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_O4, TCG_REG_O7);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data, TCGReg addr,
  }
-@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t end)
+ static void tcg_out_qemu_st(TCGContext *s, TCGReg data, TCGReg addr,
-     struct page_collection *pages;
+-                            MemOpIdx oi)
-     tb_page_addr_t next;
++                            MemOpIdx oi, TCGType data_type)
 -    pages = page_collection_lock(start, end);
 +    pages = page_collection_lock(start, end - 1);
      for (next = (start & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
           start < end;
           start = next, next += TARGET_PAGE_SIZE) {
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_range_fast(ram_addr_t ram_addr,
  {
-     struct page_collection *pages;
+     MemOp memop = get_memop(oi);
+     tcg_insn_unit *label_ptr;
--    pages = page_collection_lock(ram_addr, ram_addr + size);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data, TCGReg addr,
-+    pages = page_collection_lock(ram_addr, ram_addr + size - 1);
+     /* TLB Miss.  */
-     tb_invalidate_phys_page_fast__locked(pages, ram_addr, size, retaddr);
-     page_collection_unlock(pages);
+     tcg_out_mov(s, TCG_TYPE_REG, TCG_REG_O1, addrz);
- }
+-    tcg_out_mov(s, TCG_TYPE_REG, TCG_REG_O2, data);
 +    tcg_out_movext(s, (memop & MO_SIZE) == MO_64 ? TCG_TYPE_I64 : TCG_TYPE_I32,
 +                   TCG_REG_O2, data_type, memop & MO_SIZE, data);
      func = qemu_st_trampoline[memop & (MO_BSWAP | MO_SIZE)];
      tcg_debug_assert(func != NULL);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
          tcg_out_qemu_ld(s, a0, a1, a2, true);
          break;
      case INDEX_op_qemu_st_i32:
 +        tcg_out_qemu_st(s, a0, a1, a2, TCG_TYPE_I32);
 +        break;
      case INDEX_op_qemu_st_i64:
 -        tcg_out_qemu_st(s, a0, a1, a2);
 +        tcg_out_qemu_st(s, a0, a1, a2, TCG_TYPE_I64);
          break;
      case INDEX_op_ld32s_i64:
 --
 .34.1

-[PATCH for-8.0 02/11] tcg: use QTree instead of GTree
+[PULL 13/15] tcg: Introduce tcg_out_xchg
-From: Emilio Cota <cota@braap.org>
+We will want a backend interface for register swapping.
+This is only properly defined for x86; all others get a
-qemu-user can hang in a multi-threaded fork. One common
+stub version that always indicates failure.
-reason is that when creating a TB, between fork and exec
 we manipulate a GTree whose memory allocator (GSlice) is
 not fork-safe.
 Although POSIX does not mandate it, the system's allocator
 (e.g. tcmalloc, libc malloc) is probably fork-safe.
 Fix some of these hangs by using QTree, which uses the system's
 allocator regardless of the Glib version that we used at
 configuration time.
 Tested with the test program in the original bug report, i.e.:
 ```
 void garble() {
   int pid = fork();
   if (pid == 0) {
     exit(0);
   } else {
     int wstatus;
     waitpid(pid, &wstatus, 0);
   }
 }
 void supragarble(unsigned depth) {
   if (depth == 0)
     return ;
   std::thread a(supragarble, depth-1);
   std::thread b(supragarble, depth-1);
   garble();
   a.join();
   b.join();
 }
 int main() {
   supragarble(10);
 }
 ```
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/285
 Reported-by: Valentin David <me@valentindavid.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Emilio Cota <cota@braap.org>
-Message-Id: <20230205163758.416992-3-cota@braap.org>
-[rth: Add QEMU_DISABLE_CFI for all callback using functions.]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/tb-maint.c | 17 +++++++++--------
+ tcg/tcg.c                        | 2 ++
- tcg/region.c         | 19 ++++++++++---------
+ tcg/aarch64/tcg-target.c.inc     | 5 +++++
- util/qtree.c         |  8 ++++----
+ tcg/arm/tcg-target.c.inc         | 5 +++++
-files changed, 23 insertions(+), 21 deletions(-)
+ tcg/i386/tcg-target.c.inc        | 8 ++++++++
+ tcg/loongarch64/tcg-target.c.inc | 5 +++++
-diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
+ tcg/mips/tcg-target.c.inc        | 5 +++++
-index XXXXXXX..XXXXXXX 100644
+ tcg/ppc/tcg-target.c.inc         | 5 +++++
---- a/accel/tcg/tb-maint.c
+ tcg/riscv/tcg-target.c.inc       | 5 +++++
-+++ b/accel/tcg/tb-maint.c
+ tcg/s390x/tcg-target.c.inc       | 5 +++++
-@@ -XXX,XX +XXX,XX @@
+ tcg/sparc64/tcg-target.c.inc     | 5 +++++
+ tcg/tci/tcg-target.c.inc         | 5 +++++
- #include "qemu/osdep.h"
+files changed, 55 insertions(+)
- #include "qemu/interval-tree.h"
-+#include "qemu/qtree.h"
+diff --git a/tcg/tcg.c b/tcg/tcg.c
- #include "exec/cputlb.h"
+index XXXXXXX..XXXXXXX 100644
- #include "exec/log.h"
+--- a/tcg/tcg.c
- #include "exec/exec-all.h"
++++ b/tcg/tcg.c
-@@ -XXX,XX +XXX,XX @@ struct page_entry {
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg);
-  * See also: page_collection_lock().
+ static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg);
-  */
+ static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg ret, TCGReg arg);
- struct page_collection {
+ static void tcg_out_addi_ptr(TCGContext *s, TCGReg, TCGReg, tcg_target_long);
--    GTree *tree;
++static bool tcg_out_xchg(TCGContext *s, TCGType type, TCGReg r1, TCGReg r2)
-+    QTree *tree;
++    __attribute__((unused));
-     struct page_entry *max;
+ static void tcg_out_exit_tb(TCGContext *s, uintptr_t arg);
- };
+ static void tcg_out_goto_tb(TCGContext *s, int which);
+ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
-@@ -XXX,XX +XXX,XX @@ static bool page_trylock_add(struct page_collection *set, tb_page_addr_t addr)
+diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
-     struct page_entry *pe;
+index XXXXXXX..XXXXXXX 100644
-     PageDesc *pd;
+--- a/tcg/aarch64/tcg-target.c.inc
++++ b/tcg/aarch64/tcg-target.c.inc
--    pe = g_tree_lookup(set->tree, &index);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi(TCGContext *s, TCGType type, TCGReg rd,
-+    pe = q_tree_lookup(set->tree, &index);
+     tcg_out_insn(s, 3305, LDR, 0, rd);
-     if (pe) {
+ }
-         return false;
 +static bool tcg_out_xchg(TCGContext *s, TCGType type, TCGReg r1, TCGReg r2)
 +{
 +    return false;
 +}
 +
  static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                               tcg_target_long imm)
  {
 diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/arm/tcg-target.c.inc
 +++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi(TCGContext *s, TCGType type,
      tcg_out_movi32(s, COND_AL, ret, arg);
  }
 +static bool tcg_out_xchg(TCGContext *s, TCGType type, TCGReg r1, TCGReg r2)
 +{
 +    return false;
 +}
 +
  static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                               tcg_target_long imm)
  {
 diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/i386/tcg-target.c.inc
 +++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
  #define OPC_VPTERNLOGQ  (0x25 | P_EXT3A | P_DATA16 | P_VEXW | P_EVEX)
  #define OPC_VZEROUPPER  (0x77 | P_EXT)
  #define OPC_XCHG_ax_r32    (0x90)
 +#define OPC_XCHG_EvGv   (0x87)
  #define OPC_GRP3_Eb     (0xf6)
  #define OPC_GRP3_Ev     (0xf7)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi(TCGContext *s, TCGType type,
      }
-@@ -XXX,XX +XXX,XX @@ static bool page_trylock_add(struct page_collection *set, tb_page_addr_t addr)
+ }
 +static bool tcg_out_xchg(TCGContext *s, TCGType type, TCGReg r1, TCGReg r2)
 +{
 +    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
 +    tcg_out_modrm(s, OPC_XCHG_EvGv + rexw, r1, r2);
 +    return true;
 +}
 +
  static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                               tcg_target_long imm)
  {
 diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/loongarch64/tcg-target.c.inc
 +++ b/tcg/loongarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_addi(TCGContext *s, TCGType type, TCGReg rd,
      }
+ }
-     pe = page_entry_new(pd, index);
--    g_tree_insert(set->tree, &pe->index, pe);
++static bool tcg_out_xchg(TCGContext *s, TCGType type, TCGReg r1, TCGReg r2)
-+    q_tree_insert(set->tree, &pe->index, pe);
++{
++    return false;
-     /*
++}
-      * If this is either (1) the first insertion or (2) a page whose index
++
-@@ -XXX,XX +XXX,XX @@ static struct page_collection *page_collection_lock(tb_page_addr_t start,
+ static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
-     end   >>= TARGET_PAGE_BITS;
+                              tcg_target_long imm)
-     g_assert(start <= end);
+ {
+diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
--    set->tree = g_tree_new_full(tb_page_addr_cmp, NULL, NULL,
+index XXXXXXX..XXXXXXX 100644
-+    set->tree = q_tree_new_full(tb_page_addr_cmp, NULL, NULL,
+--- a/tcg/mips/tcg-target.c.inc
-                                 page_entry_destroy);
++++ b/tcg/mips/tcg-target.c.inc
-     set->max = NULL;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg rd, TCGReg rs)
-     assert_no_pages_locked();
+     tcg_out_ext32s(s, rd, rs);
+ }
-  retry:
--    g_tree_foreach(set->tree, page_entry_lock, NULL);
++static bool tcg_out_xchg(TCGContext *s, TCGType type, TCGReg r1, TCGReg r2)
-+    q_tree_foreach(set->tree, page_entry_lock, NULL);
++{
++    return false;
-     for (index = start; index <= end; index++) {
++}
-         TranslationBlock *tb;
++
-@@ -XXX,XX +XXX,XX @@ static struct page_collection *page_collection_lock(tb_page_addr_t start,
+ static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
-             continue;
+                              tcg_target_long imm)
-         }
+ {
-         if (page_trylock_add(set, index << TARGET_PAGE_BITS)) {
+diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
--            g_tree_foreach(set->tree, page_entry_unlock, NULL);
+index XXXXXXX..XXXXXXX 100644
-+            q_tree_foreach(set->tree, page_entry_unlock, NULL);
+--- a/tcg/ppc/tcg-target.c.inc
-             goto retry;
++++ b/tcg/ppc/tcg-target.c.inc
-         }
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi(TCGContext *s, TCGType type, TCGReg ret,
          assert_page_locked(pd);
@@ -XXX,XX +XXX,XX @@ static struct page_collection *page_collection_lock(tb_page_addr_t start,
                  (tb_page_addr1(tb) != -1 &&
                   page_trylock_add(set, tb_page_addr1(tb)))) {
                  /* drop all locks, and reacquire in order */
 -                g_tree_foreach(set->tree, page_entry_unlock, NULL);
 +                q_tree_foreach(set->tree, page_entry_unlock, NULL);
                  goto retry;
              }
          }
@@ -XXX,XX +XXX,XX @@ static struct page_collection *page_collection_lock(tb_page_addr_t start,
  static void page_collection_unlock(struct page_collection *set)
  {
      /* entries are unlocked and freed via page_entry_destroy */
 -    g_tree_destroy(set->tree);
 +    q_tree_destroy(set->tree);
      g_free(set);
  }
 diff --git a/tcg/region.c b/tcg/region.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/region.c
 +++ b/tcg/region.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/mprotect.h"
  #include "qemu/memalign.h"
  #include "qemu/cacheinfo.h"
 +#include "qemu/qtree.h"
  #include "qapi/error.h"
  #include "exec/exec-all.h"
  #include "tcg/tcg.h"
@@ -XXX,XX +XXX,XX @@
  struct tcg_region_tree {
      QemuMutex lock;
 -    GTree *tree;
 +    QTree *tree;
      /* padding to avoid false sharing is computed at run-time */
  };
@@ -XXX,XX +XXX,XX @@ static void tcg_region_trees_init(void)
          struct tcg_region_tree *rt = region_trees + i * tree_size;
          qemu_mutex_init(&rt->lock);
 -        rt->tree = g_tree_new_full(tb_tc_cmp, NULL, NULL, tb_destroy);
 +        rt->tree = q_tree_new_full(tb_tc_cmp, NULL, NULL, tb_destroy);
      }
  }
-@@ -XXX,XX +XXX,XX @@ void tcg_tb_insert(TranslationBlock *tb)
++static bool tcg_out_xchg(TCGContext *s, TCGType type, TCGReg r1, TCGReg r2)
++{
-     g_assert(rt != NULL);
++    return false;
-     qemu_mutex_lock(&rt->lock);
++}
--    g_tree_insert(rt->tree, &tb->tc, tb);
++
-+    q_tree_insert(rt->tree, &tb->tc, tb);
+ static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
-     qemu_mutex_unlock(&rt->lock);
+                              tcg_target_long imm)
- }
+ {
+diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ void tcg_tb_remove(TranslationBlock *tb)
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/riscv/tcg-target.c.inc
-     g_assert(rt != NULL);
++++ b/tcg/riscv/tcg-target.c.inc
-     qemu_mutex_lock(&rt->lock);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi(TCGContext *s, TCGType type, TCGReg rd,
--    g_tree_remove(rt->tree, &tb->tc);
+     tcg_out_opc_imm(s, OPC_LD, rd, rd, 0);
-+    q_tree_remove(rt->tree, &tb->tc);
+ }
-     qemu_mutex_unlock(&rt->lock);
- }
++static bool tcg_out_xchg(TCGContext *s, TCGType type, TCGReg r1, TCGReg r2)
++{
-@@ -XXX,XX +XXX,XX @@ TranslationBlock *tcg_tb_lookup(uintptr_t tc_ptr)
++    return false;
-     }
++}
++
-     qemu_mutex_lock(&rt->lock);
+ static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
--    tb = g_tree_lookup(rt->tree, &s);
+                              tcg_target_long imm)
-+    tb = q_tree_lookup(rt->tree, &s);
+ {
-     qemu_mutex_unlock(&rt->lock);
+diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
-     return tb;
+index XXXXXXX..XXXXXXX 100644
- }
+--- a/tcg/s390x/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ void tcg_tb_foreach(GTraverseFunc func, gpointer user_data)
++++ b/tcg/s390x/tcg-target.c.inc
-     for (i = 0; i < region.n; i++) {
+@@ -XXX,XX +XXX,XX @@ static inline bool tcg_out_sti(TCGContext *s, TCGType type, TCGArg val,
-         struct tcg_region_tree *rt = region_trees + i * tree_size;
+     return false;
+ }
--        g_tree_foreach(rt->tree, func, user_data);
-+        q_tree_foreach(rt->tree, func, user_data);
++static bool tcg_out_xchg(TCGContext *s, TCGType type, TCGReg r1, TCGReg r2)
-     }
++{
-     tcg_region_tree_unlock_all();
++    return false;
- }
++}
-@@ -XXX,XX +XXX,XX @@ size_t tcg_nb_tbs(void)
++
-     for (i = 0; i < region.n; i++) {
+ static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
-         struct tcg_region_tree *rt = region_trees + i * tree_size;
+                              tcg_target_long imm)
+ {
--        nb_tbs += g_tree_nnodes(rt->tree);
+diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
-+        nb_tbs += q_tree_nnodes(rt->tree);
+index XXXXXXX..XXXXXXX 100644
-     }
+--- a/tcg/sparc64/tcg-target.c.inc
-     tcg_region_tree_unlock_all();
++++ b/tcg/sparc64/tcg-target.c.inc
-     return nb_tbs;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg rd, TCGReg rs)
-@@ -XXX,XX +XXX,XX @@ static void tcg_region_tree_reset_all(void)
+     tcg_out_mov(s, TCG_TYPE_I32, rd, rs);
-         struct tcg_region_tree *rt = region_trees + i * tree_size;
+ }
-         /* Increment the refcount first so that destroy acts as a reset */
++static bool tcg_out_xchg(TCGContext *s, TCGType type, TCGReg r1, TCGReg r2)
--        g_tree_ref(rt->tree);
++{
--        g_tree_destroy(rt->tree);
++    return false;
-+        q_tree_ref(rt->tree);
++}
-+        q_tree_destroy(rt->tree);
++
-     }
+ static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
-     tcg_region_tree_unlock_all();
+                              tcg_target_long imm)
- }
+ {
-diff --git a/util/qtree.c b/util/qtree.c
+diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/util/qtree.c
+--- a/tcg/tci/tcg-target.c.inc
-+++ b/util/qtree.c
++++ b/tcg/tci/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ q_tree_node_next(QTreeNode *node)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg rd, TCGReg rs)
-  *
+     tcg_out_mov(s, TCG_TYPE_I32, rd, rs);
-  * Since: 2.70 in GLib. Internal in Qtree, i.e. not in the public API.
+ }
-  */
--static void
++static bool tcg_out_xchg(TCGContext *s, TCGType type, TCGReg r1, TCGReg r2)
-+static void QEMU_DISABLE_CFI
++{
- q_tree_remove_all(QTree *tree)
++    return false;
- {
++}
-     QTreeNode *node;
++
-@@ -XXX,XX +XXX,XX @@ q_tree_replace(QTree    *tree,
+ static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
- }
+                              tcg_target_long imm)
  /* internal insert routine */
 -static QTreeNode *
 +static QTreeNode * QEMU_DISABLE_CFI
  q_tree_insert_internal(QTree    *tree,
                         gpointer  key,
                         gpointer  value,
@@ -XXX,XX +XXX,XX @@ q_tree_steal(QTree         *tree,
  }
  /* internal remove routine */
 -static gboolean
 +static gboolean QEMU_DISABLE_CFI
  q_tree_remove_internal(QTree         *tree,
                         gconstpointer  key,
                         gboolean       steal)
@@ -XXX,XX +XXX,XX @@ q_tree_node_balance(QTreeNode *node)
      return node;
  }
 -static QTreeNode *
 +static QTreeNode * QEMU_DISABLE_CFI
  q_tree_find_node(QTree        *tree,
                   gconstpointer key)
  {
 --
 .34.1

-New patch
+[PULL 14/15] tcg: Clear TCGLabelQemuLdst on allocation
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/tcg-ldst.c.inc | 1 +
+file changed, 1 insertion(+)
+diff --git a/tcg/tcg-ldst.c.inc b/tcg/tcg-ldst.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/tcg-ldst.c.inc
++++ b/tcg/tcg-ldst.c.inc
+@@ -XXX,XX +XXX,XX @@ static inline TCGLabelQemuLdst *new_ldst_label(TCGContext *s)
+ {
+     TCGLabelQemuLdst *l = tcg_malloc(sizeof(*l));
++    memset(l, 0, sizeof(*l));
+     QSIMPLEQ_INSERT_TAIL(&s->ldst_labels, l, next);
+     return l;
+--
+.34.1

-[PATCH for-8.0 11/11] linux-user/arm: Take more care allocating commpage
+[PULL 15/15] tcg/riscv: Conditionalize tcg_out_exts_i32_i64
-User setting of -R reserved_va can lead to an assertion
+Since TCG_TYPE_I32 values are kept sign-extended in registers, via "w"
-failure in page_set_flags.  Sanity check the value of
+instructions, we don't need to extend if the register matches.
-reserved_va and print an error message instead.  Do not
+This is already relied upon by comparisons.
 allocate a commpage at all for m-profile cpus.
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- linux-user/elfload.c | 37 +++++++++++++++++++++++++++----------
+ tcg/riscv/tcg-target.c.inc | 4 +++-
-file changed, 27 insertions(+), 10 deletions(-)
+file changed, 3 insertions(+), 1 deletion(-)
-diff --git a/linux-user/elfload.c b/linux-user/elfload.c
+diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/linux-user/elfload.c
+--- a/tcg/riscv/tcg-target.c.inc
-+++ b/linux-user/elfload.c
++++ b/tcg/riscv/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ enum {
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32s(TCGContext *s, TCGReg ret, TCGReg arg)
- static bool init_guest_commpage(void)
+ static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg)
  {
--    abi_ptr commpage = HI_COMMPAGE & -qemu_host_page_size;
+-    tcg_out_ext32s(s, ret, arg);
--    void *want = g2h_untagged(commpage);
++    if (ret != arg) {
--    void *addr = mmap(want, qemu_host_page_size, PROT_READ | PROT_WRITE,
++        tcg_out_ext32s(s, ret, arg);
 -                      MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
 +    ARMCPU *cpu = ARM_CPU(thread_cpu);
 +    abi_ptr want = HI_COMMPAGE & TARGET_PAGE_MASK;
 +    abi_ptr addr;
 -    if (addr == MAP_FAILED) {
 +    /*
 +     * M-profile allocates maximum of 2GB address space, so can never
 +     * allocate the commpage.  Skip it.
 +     */
 +    if (arm_feature(&cpu->env, ARM_FEATURE_M)) {
 +        return true;
 +    }
-+
-+    /*
-+     * If reserved_va does not cover the commpage, we get an assert
-+     * in page_set_flags.  Produce an intelligent error instead.
-+     */
-+    if (reserved_va != 0 && want + TARGET_PAGE_SIZE - 1 > reserved_va) {
-+        error_report("Allocating guest commpage: -R 0x%" PRIx64 " too small",
-+                     (uint64_t)reserved_va + 1);
-+        exit(EXIT_FAILURE);
-+    }
-+
-+    addr = target_mmap(want, TARGET_PAGE_SIZE, PROT_READ | PROT_WRITE,
-+                       MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
-+
-+    if (addr == -1) {
-         perror("Allocating guest commpage");
-         exit(EXIT_FAILURE);
-     }
-@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)
-     }
-     /* Set kernel helper versions; rest of page is 0.  */
--    __put_user(5, (uint32_t *)g2h_untagged(0xffff0ffcu));
-+    put_user_u32(5, 0xffff0ffcu);
--    if (mprotect(addr, qemu_host_page_size, PROT_READ)) {
-+    if (target_mprotect(addr, qemu_host_page_size, PROT_READ | PROT_EXEC)) {
-         perror("Protecting guest commpage");
-         exit(EXIT_FAILURE);
-     }
--
--    page_set_flags(commpage, commpage | ~qemu_host_page_mask,
--                   PAGE_READ | PAGE_EXEC | PAGE_VALID);
-     return true;
  }
+ static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg)
 --
 .34.1

Posting pre-PR because I had to adjust Emilio's QTree patch [1],
and added a new patch to avoid an assert that can be generated
with incorrect -R reserved_va values vs the ARM commpage.

[1] https://gitlab.com/rth7680/qemu/-/jobs/3975817279#L92

Emilio Cota (2):
  util: import GTree as QTree
  tcg: use QTree instead of GTree

Richard Henderson (9):
  linux-user: Diagnose misaligned -R size
  include/exec: Change reserved_va semantics to last byte
  accel/tcg: Pass last not end to page_set_flags
  accel/tcg: Pass last not end to page_reset_target_data
  accel/tcg: Pass last not end to PAGE_FOR_EACH_TB
  accel/tcg: Pass last not end to page_collection_lock
  accel/tcg: Pass last not end to tb_invalidate_phys_page_range__locked
  accel/tcg: Pass last not end to tb_invalidate_phys_range
  linux-user/arm: Take more care allocating commpage

-- 
2.34.1

From: Emilio Cota <cota@braap.org>

The only reason to add this implementation is to control the memory allocator
used. Some users (e.g. TCG) cannot work reliably in multi-threaded
environments (e.g. forking in user-mode) with GTree's allocator, GSlice.
See https://gitlab.com/qemu-project/qemu/-/issues/285 for details.

Importing GTree is a temporary workaround until GTree migrates away
from GSlice.

This implementation is identical to that in glib v2.75.0, except that
we don't import recent additions to the API nor deprecated API calls,
none of which are used in QEMU.

I've imported tests from glib and added a benchmark just to
make sure that performance is similar. Note: it cannot be identical
because (1) we are not using GSlice, (2) we use different compilation flags
(e.g. -fPIC) and (3) we're linking statically.

$ cat /proc/cpuinfo| grep 'model name' | head -1
model name      : AMD Ryzen 7 PRO 5850U with Radeon Graphics
$ echo '0' | sudo tee /sys/devices/system/cpu/cpufreq/boost
$ tests/bench/qtree-bench

Tree         Op      32            1024            4096          131072         1048576
------------------------------------------------------------------------------------------------
GTree     Lookup   83.23           43.08           25.31           19.40           16.22
QTree     Lookup  113.42 (1.36x)   53.83 (1.25x)   28.38 (1.12x)   17.64 (0.91x)   13.04 (0.80x)
GTree     Insert   44.23           29.37           25.83           19.49           17.03
QTree     Insert   46.87 (1.06x)   25.62 (0.87x)   24.29 (0.94x)   16.83 (0.86x)   12.97 (0.76x)
GTree     Remove   53.27           35.15           31.43           24.64           16.70
QTree     Remove   57.32 (1.08x)   41.76 (1.19x)   38.37 (1.22x)   29.30 (1.19x)   15.07 (0.90x)
GTree  RemoveAll  135.44          127.52          126.72          120.11           64.34
QTree  RemoveAll  127.15 (0.94x)  110.37 (0.87x)  107.97 (0.85x)   97.13 (0.81x)   55.10 (0.86x)
GTree   Traverse  277.71          276.09          272.78          246.72           98.47
QTree   Traverse  370.33 (1.33x)  411.97 (1.49x)  400.23 (1.47x)  262.82 (1.07x)   78.52 (0.80x)
------------------------------------------------------------------------------------------------

As a sanity check, the same benchmark when Glib's version
is >= $glib_dropped_gslice_version (i.e. QTree == GTree):

Tree         Op      32            1024            4096          131072         1048576
------------------------------------------------------------------------------------------------
GTree     Lookup   82.72           43.09           24.18           19.73           16.09
QTree     Lookup   81.82 (0.99x)   43.10 (1.00x)   24.20 (1.00x)   19.76 (1.00x)   16.26 (1.01x)
GTree     Insert   45.07           29.62           26.34           19.90           17.18
QTree     Insert   45.72 (1.01x)   29.60 (1.00x)   26.38 (1.00x)   19.71 (0.99x)   17.20 (1.00x)
GTree     Remove   54.48           35.36           31.77           24.97           16.95
QTree     Remove   54.46 (1.00x)   35.32 (1.00x)   31.77 (1.00x)   24.91 (1.00x)   17.15 (1.01x)
GTree  RemoveAll  140.68          127.36          125.43          121.45           68.20
QTree  RemoveAll  140.65 (1.00x)  127.64 (1.00x)  125.01 (1.00x)  121.73 (1.00x)   67.06 (0.98x)
GTree   Traverse  278.68          276.05          266.75          251.65          104.93
QTree   Traverse  278.31 (1.00x)  275.78 (1.00x)  266.42 (1.00x)  247.89 (0.99x)  104.58 (1.00x)
------------------------------------------------------------------------------------------------

Signed-off-by: Emilio Cota <cota@braap.org>
Message-Id: <20230205163758.416992-2-cota@braap.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 configure                 |   15 +
 meson.build               |    4 +
 include/qemu/qtree.h      |  201 ++++++
 tests/bench/qtree-bench.c |  286 ++++++++
 tests/unit/test-qtree.c   |  333 +++++++++
 util/qtree.c              | 1390 +++++++++++++++++++++++++++++++++++++
 tests/bench/meson.build   |    4 +
 tests/unit/meson.build    |    1 +
 util/meson.build          |    1 +
 9 files changed, 2235 insertions(+)
 create mode 100644 include/qemu/qtree.h
 create mode 100644 tests/bench/qtree-bench.c
 create mode 100644 tests/unit/test-qtree.c
 create mode 100644 util/qtree.c

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ safe_stack=""
 use_containers="yes"
 gdb_bin=$(command -v "gdb-multiarch" || command -v "gdb")
 gdb_arches=""
+glib_has_gslice="no"
 
 if test -e "$source_path/.git"
 then
@@ -XXX,XX +XXX,XX @@ for i in $glib_modules; do
     fi
 done
 
+# Check whether glib has gslice, which we have to avoid for correctness.
+# TODO: remove this check and the corresponding workaround (qtree) when
+# the minimum supported glib is >= $glib_dropped_gslice_version.
+glib_dropped_gslice_version=2.75.3
+for i in $glib_modules; do
+    if ! $pkg_config --atleast-version=$glib_dropped_gslice_version $i; then
+        glib_has_gslice="yes"
+	break
+    fi
+done
+
 glib_bindir="$($pkg_config --variable=bindir glib-2.0)"
 if test -z "$glib_bindir" ; then
 	glib_bindir="$($pkg_config --variable=prefix glib-2.0)"/bin
@@ -XXX,XX +XXX,XX @@ echo "GLIB_CFLAGS=$glib_cflags" >> $config_host_mak
 echo "GLIB_LIBS=$glib_libs" >> $config_host_mak
 echo "GLIB_BINDIR=$glib_bindir" >> $config_host_mak
 echo "GLIB_VERSION=$($pkg_config --modversion glib-2.0)" >> $config_host_mak
+if test "$glib_has_gslice" = "yes" ; then
+    echo "HAVE_GLIB_WITH_SLICE_ALLOCATOR=y" >> $config_host_mak
+fi
 echo "QEMU_LDFLAGS=$QEMU_LDFLAGS" >> $config_host_mak
 echo "EXESUF=$EXESUF" >> $config_host_mak
 
diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ glib = declare_dependency(compile_args: config_host['GLIB_CFLAGS'].split(),
                           })
 # override glib dep with the configure results (for subprojects)
 meson.override_dependency('glib-2.0', glib)
+# pass down whether Glib has the slice allocator
+if config_host.has_key('HAVE_GLIB_WITH_SLICE_ALLOCATOR')
+  config_host_data.set('HAVE_GLIB_WITH_SLICE_ALLOCATOR', true)
+endif
 
 gio = not_found
 gdbus_codegen = not_found
diff --git a/include/qemu/qtree.h b/include/qemu/qtree.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/qemu/qtree.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * GLIB - Library of useful routines for C programming
+ * Copyright (C) 1995-1997  Peter Mattis, Spencer Kimball and Josh MacDonald
+ *
+ * SPDX-License-Identifier: LGPL-2.1-or-later
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+/*
+ * Modified by the GLib Team and others 1997-2000.  See the AUTHORS
+ * file for a list of people on the GLib Team.  See the ChangeLog
+ * files for a list of changes.  These files are distributed with
+ * GLib at ftp://ftp.gtk.org/pub/gtk/.
+ */
+
+/*
+ * QTree is a partial import of Glib's GTree. The parts excluded correspond
+ * to API calls either deprecated (e.g. g_tree_traverse) or recently added
+ * (e.g. g_tree_search_node, added in 2.68); neither have callers in QEMU.
+ *
+ * The reason for this import is to allow us to control the memory allocator
+ * used by the tree implementation. Until Glib 2.75.3, GTree uses Glib's
+ * slice allocator, which causes problems when forking in user-mode;
+ * see https://gitlab.com/qemu-project/qemu/-/issues/285 and glib's
+ * "45b5a6c1e gslice: Remove slice allocator and use malloc() instead".
+ *
+ * TODO: remove QTree when QEMU's minimum Glib version is >= 2.75.3.
+ */
+
+#ifndef QEMU_QTREE_H
+#define QEMU_QTREE_H
+
+#include "qemu/osdep.h"
+
+#ifdef HAVE_GLIB_WITH_SLICE_ALLOCATOR
+
+typedef struct _QTree  QTree;
+
+typedef struct _QTreeNode QTreeNode;
+
+typedef gboolean (*QTraverseNodeFunc)(QTreeNode *node,
+                                      gpointer user_data);
+
+/*
+ * Balanced binary trees
+ */
+QTree *q_tree_new(GCompareFunc key_compare_func);
+QTree *q_tree_new_with_data(GCompareDataFunc key_compare_func,
+                            gpointer key_compare_data);
+QTree *q_tree_new_full(GCompareDataFunc key_compare_func,
+                       gpointer key_compare_data,
+                       GDestroyNotify key_destroy_func,
+                       GDestroyNotify value_destroy_func);
+QTree *q_tree_ref(QTree *tree);
+void q_tree_unref(QTree *tree);
+void q_tree_destroy(QTree *tree);
+void q_tree_insert(QTree *tree,
+                   gpointer key,
+                   gpointer value);
+void q_tree_replace(QTree *tree,
+                    gpointer key,
+                    gpointer value);
+gboolean q_tree_remove(QTree *tree,
+                       gconstpointer key);
+gboolean q_tree_steal(QTree *tree,
+                      gconstpointer key);
+gpointer q_tree_lookup(QTree *tree,
+                       gconstpointer key);
+gboolean q_tree_lookup_extended(QTree *tree,
+                                gconstpointer lookup_key,
+                                gpointer *orig_key,
+                                gpointer *value);
+void q_tree_foreach(QTree *tree,
+                    GTraverseFunc func,
+                    gpointer user_data);
+gpointer q_tree_search(QTree *tree,
+                       GCompareFunc search_func,
+                       gconstpointer user_data);
+gint q_tree_height(QTree *tree);
+gint q_tree_nnodes(QTree *tree);
+
+#else /* !HAVE_GLIB_WITH_SLICE_ALLOCATOR */
+
+typedef GTree QTree;
+typedef GTreeNode QTreeNode;
+typedef GTraverseNodeFunc QTraverseNodeFunc;
+
+static inline QTree *q_tree_new(GCompareFunc key_compare_func)
+{
+    return g_tree_new(key_compare_func);
+}
+
+static inline QTree *q_tree_new_with_data(GCompareDataFunc key_compare_func,
+                                          gpointer key_compare_data)
+{
+    return g_tree_new_with_data(key_compare_func, key_compare_data);
+}
+
+static inline QTree *q_tree_new_full(GCompareDataFunc key_compare_func,
+                                     gpointer key_compare_data,
+                                     GDestroyNotify key_destroy_func,
+                                     GDestroyNotify value_destroy_func)
+{
+    return g_tree_new_full(key_compare_func, key_compare_data,
+                           key_destroy_func, value_destroy_func);
+}
+
+static inline QTree *q_tree_ref(QTree *tree)
+{
+    return g_tree_ref(tree);
+}
+
+static inline void q_tree_unref(QTree *tree)
+{
+    g_tree_unref(tree);
+}
+
+static inline void q_tree_destroy(QTree *tree)
+{
+    g_tree_destroy(tree);
+}
+
+static inline void q_tree_insert(QTree *tree,
+                                 gpointer key,
+                                 gpointer value)
+{
+    g_tree_insert(tree, key, value);
+}
+
+static inline void q_tree_replace(QTree *tree,
+                                  gpointer key,
+                                  gpointer value)
+{
+    g_tree_replace(tree, key, value);
+}
+
+static inline gboolean q_tree_remove(QTree *tree,
+                                     gconstpointer key)
+{
+    return g_tree_remove(tree, key);
+}
+
+static inline gboolean q_tree_steal(QTree *tree,
+                                    gconstpointer key)
+{
+    return g_tree_steal(tree, key);
+}
+
+static inline gpointer q_tree_lookup(QTree *tree,
+                                     gconstpointer key)
+{
+    return g_tree_lookup(tree, key);
+}
+
+static inline gboolean q_tree_lookup_extended(QTree *tree,
+                                              gconstpointer lookup_key,
+                                              gpointer *orig_key,
+                                              gpointer *value)
+{
+    return g_tree_lookup_extended(tree, lookup_key, orig_key, value);
+}
+
+static inline void q_tree_foreach(QTree *tree,
+                                  GTraverseFunc func,
+                                  gpointer user_data)
+{
+    return g_tree_foreach(tree, func, user_data);
+}
+
+static inline gpointer q_tree_search(QTree *tree,
+                                     GCompareFunc search_func,
+                                     gconstpointer user_data)
+{
+    return g_tree_search(tree, search_func, user_data);
+}
+
+static inline gint q_tree_height(QTree *tree)
+{
+    return g_tree_height(tree);
+}
+
+static inline gint q_tree_nnodes(QTree *tree)
+{
+    return g_tree_nnodes(tree);
+}
+
+#endif /* HAVE_GLIB_WITH_SLICE_ALLOCATOR */
+
+#endif /* QEMU_QTREE_H */
diff --git a/tests/bench/qtree-bench.c b/tests/bench/qtree-bench.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/bench/qtree-bench.c
@@ -XXX,XX +XXX,XX @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+#include "qemu/osdep.h"
+#include "qemu/qtree.h"
+#include "qemu/timer.h"
+
+enum tree_op {
+    OP_LOOKUP,
+    OP_INSERT,
+    OP_REMOVE,
+    OP_REMOVE_ALL,
+    OP_TRAVERSE,
+};
+
+struct benchmark {
+    const char * const name;
+    enum tree_op op;
+    bool fill_on_init;
+};
+
+enum impl_type {
+    IMPL_GTREE,
+    IMPL_QTREE,
+};
+
+struct tree_implementation {
+    const char * const name;
+    enum impl_type type;
+};
+
+static const struct benchmark benchmarks[] = {
+    {
+        .name = "Lookup",
+        .op = OP_LOOKUP,
+        .fill_on_init = true,
+    },
+    {
+        .name = "Insert",
+        .op = OP_INSERT,
+        .fill_on_init = false,
+    },
+    {
+        .name = "Remove",
+        .op = OP_REMOVE,
+        .fill_on_init = true,
+    },
+    {
+        .name = "RemoveAll",
+        .op = OP_REMOVE_ALL,
+        .fill_on_init = true,
+    },
+    {
+        .name = "Traverse",
+        .op = OP_TRAVERSE,
+        .fill_on_init = true,
+    },
+};
+
+static const struct tree_implementation impls[] = {
+    {
+        .name = "GTree",
+        .type = IMPL_GTREE,
+    },
+    {
+        .name = "QTree",
+        .type = IMPL_QTREE,
+    },
+};
+
+static int compare_func(const void *ap, const void *bp)
+{
+    const size_t *a = ap;
+    const size_t *b = bp;
+
+    return *a - *b;
+}
+
+static void init_empty_tree_and_keys(enum impl_type impl,
+                                     void **ret_tree, size_t **ret_keys,
+                                     size_t n_elems)
+{
+    size_t *keys = g_malloc_n(n_elems, sizeof(*keys));
+    for (size_t i = 0; i < n_elems; i++) {
+        keys[i] = i;
+    }
+
+    void *tree;
+    switch (impl) {
+    case IMPL_GTREE:
+        tree = g_tree_new(compare_func);
+        break;
+    case IMPL_QTREE:
+        tree = q_tree_new(compare_func);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    *ret_tree = tree;
+    *ret_keys = keys;
+}
+
+static gboolean traverse_func(gpointer key, gpointer value, gpointer data)
+{
+    return FALSE;
+}
+
+static inline void remove_all(void *tree, enum impl_type impl)
+{
+    switch (impl) {
+    case IMPL_GTREE:
+        g_tree_destroy(tree);
+        break;
+    case IMPL_QTREE:
+        q_tree_destroy(tree);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+}
+
+static int64_t run_benchmark(const struct benchmark *bench,
+                             enum impl_type impl,
+                             size_t n_elems)
+{
+    void *tree;
+    size_t *keys;
+
+    init_empty_tree_and_keys(impl, &tree, &keys, n_elems);
+    if (bench->fill_on_init) {
+        for (size_t i = 0; i < n_elems; i++) {
+            switch (impl) {
+            case IMPL_GTREE:
+                g_tree_insert(tree, &keys[i], &keys[i]);
+                break;
+            case IMPL_QTREE:
+                q_tree_insert(tree, &keys[i], &keys[i]);
+                break;
+            default:
+                g_assert_not_reached();
+            }
+        }
+    }
+
+    int64_t start_ns = get_clock();
+    switch (bench->op) {
+    case OP_LOOKUP:
+        for (size_t i = 0; i < n_elems; i++) {
+            void *value;
+            switch (impl) {
+            case IMPL_GTREE:
+                value = g_tree_lookup(tree, &keys[i]);
+                break;
+            case IMPL_QTREE:
+                value = q_tree_lookup(tree, &keys[i]);
+                break;
+            default:
+                g_assert_not_reached();
+            }
+            (void)value;
+        }
+        break;
+    case OP_INSERT:
+        for (size_t i = 0; i < n_elems; i++) {
+            switch (impl) {
+            case IMPL_GTREE:
+                g_tree_insert(tree, &keys[i], &keys[i]);
+                break;
+            case IMPL_QTREE:
+                q_tree_insert(tree, &keys[i], &keys[i]);
+                break;
+            default:
+                g_assert_not_reached();
+            }
+        }
+        break;
+    case OP_REMOVE:
+        for (size_t i = 0; i < n_elems; i++) {
+            switch (impl) {
+            case IMPL_GTREE:
+                g_tree_remove(tree, &keys[i]);
+                break;
+            case IMPL_QTREE:
+                q_tree_remove(tree, &keys[i]);
+                break;
+            default:
+                g_assert_not_reached();
+            }
+        }
+        break;
+    case OP_REMOVE_ALL:
+        remove_all(tree, impl);
+        break;
+    case OP_TRAVERSE:
+        switch (impl) {
+        case IMPL_GTREE:
+            g_tree_foreach(tree, traverse_func, NULL);
+            break;
+        case IMPL_QTREE:
+            q_tree_foreach(tree, traverse_func, NULL);
+            break;
+        default:
+            g_assert_not_reached();
+        }
+        break;
+    default:
+        g_assert_not_reached();
+    }
+    int64_t ns = get_clock() - start_ns;
+
+    if (bench->op != OP_REMOVE_ALL) {
+        remove_all(tree, impl);
+    }
+    g_free(keys);
+
+    return ns;
+}
+
+int main(int argc, char *argv[])
+{
+    size_t sizes[] = {
+        32,
+        1024,
+        1024 * 4,
+        1024 * 128,
+        1024 * 1024,
+    };
+
+    double res[ARRAY_SIZE(benchmarks)][ARRAY_SIZE(impls)][ARRAY_SIZE(sizes)];
+    for (int i = 0; i < ARRAY_SIZE(sizes); i++) {
+        size_t size = sizes[i];
+        for (int j = 0; j < ARRAY_SIZE(impls); j++) {
+            const struct tree_implementation *impl = &impls[j];
+            for (int k = 0; k < ARRAY_SIZE(benchmarks); k++) {
+                const struct benchmark *bench = &benchmarks[k];
+
+                /* warm-up run */
+                run_benchmark(bench, impl->type, size);
+
+                int64_t total_ns = 0;
+                int64_t n_runs = 0;
+                while (total_ns < 2e8 || n_runs < 5) {
+                    total_ns += run_benchmark(bench, impl->type, size);
+                    n_runs++;
+                }
+                double ns_per_run = (double)total_ns / n_runs;
+
+                /* Throughput, in Mops/s */
+                res[k][j][i] = size / ns_per_run * 1e3;
+            }
+        }
+    }
+
+    printf("# Results' breakdown: Tree, Op and #Elements. Units: Mops/s\n");
+    printf("%5s %10s ", "Tree", "Op");
+    for (int i = 0; i < ARRAY_SIZE(sizes); i++) {
+        printf("%7zu         ", sizes[i]);
+    }
+    printf("\n");
+    char separator[97];
+    for (int i = 0; i < ARRAY_SIZE(separator) - 1; i++) {
+        separator[i] = '-';
+    }
+    separator[ARRAY_SIZE(separator) - 1] = '\0';
+    printf("%s\n", separator);
+    for (int i = 0; i < ARRAY_SIZE(benchmarks); i++) {
+        for (int j = 0; j < ARRAY_SIZE(impls); j++) {
+            printf("%5s %10s ", impls[j].name, benchmarks[i].name);
+            for (int k = 0; k < ARRAY_SIZE(sizes); k++) {
+                printf("%7.2f ", res[i][j][k]);
+                if (j == 0) {
+                    printf("        ");
+                } else {
+                    if (res[i][0][k] != 0) {
+                        double speedup = res[i][j][k] / res[i][0][k];
+                        printf("(%4.2fx) ", speedup);
+                    } else {
+                        printf("(     ) ");
+                    }
+                }
+            }
+            printf("\n");
+        }
+    }
+    printf("%s\n", separator);
+    return 0;
+}
diff --git a/tests/unit/test-qtree.c b/tests/unit/test-qtree.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/unit/test-qtree.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * SPDX-License-Identifier: LGPL-2.1-or-later
+ *
+ * Tests for QTree.
+ * Original source: glib
+ *   https://gitlab.gnome.org/GNOME/glib/-/blob/main/glib/tests/tree.c
+ *   LGPL license.
+ *   Copyright (C) 1995-1997 Peter Mattis, Spencer Kimball and Josh MacDonald
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/qtree.h"
+
+static gint my_compare(gconstpointer a, gconstpointer b)
+{
+    const char *cha = a;
+    const char *chb = b;
+
+    return *cha - *chb;
+}
+
+static gint my_compare_with_data(gconstpointer a,
+                                 gconstpointer b,
+                                 gpointer user_data)
+{
+    const char *cha = a;
+    const char *chb = b;
+
+    /* just check that we got the right data */
+    g_assert(GPOINTER_TO_INT(user_data) == 123);
+
+    return *cha - *chb;
+}
+
+static gint my_search(gconstpointer a, gconstpointer b)
+{
+    return my_compare(b, a);
+}
+
+static gpointer destroyed_key;
+static gpointer destroyed_value;
+static guint destroyed_key_count;
+static guint destroyed_value_count;
+
+static void my_key_destroy(gpointer key)
+{
+    destroyed_key = key;
+    destroyed_key_count++;
+}
+
+static void my_value_destroy(gpointer value)
+{
+    destroyed_value = value;
+    destroyed_value_count++;
+}
+
+static gint my_traverse(gpointer key, gpointer value, gpointer data)
+{
+    char *ch = key;
+
+    g_assert((*ch) > 0);
+
+    if (*ch == 'd') {
+        return TRUE;
+    }
+
+    return FALSE;
+}
+
+char chars[] =
+    "0123456789"
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+    "abcdefghijklmnopqrstuvwxyz";
+
+char chars2[] =
+    "0123456789"
+    "abcdefghijklmnopqrstuvwxyz";
+
+static gint check_order(gpointer key, gpointer value, gpointer data)
+{
+    char **p = data;
+    char *ch = key;
+
+    g_assert(**p == *ch);
+
+    (*p)++;
+
+    return FALSE;
+}
+
+static void test_tree_search(void)
+{
+    gint i;
+    QTree *tree;
+    gboolean removed;
+    gchar c;
+    gchar *p, *d;
+
+    tree = q_tree_new_with_data(my_compare_with_data, GINT_TO_POINTER(123));
+
+    for (i = 0; chars[i]; i++) {
+        q_tree_insert(tree, &chars[i], &chars[i]);
+    }
+
+    q_tree_foreach(tree, my_traverse, NULL);
+
+    g_assert(q_tree_nnodes(tree) == strlen(chars));
+    g_assert(q_tree_height(tree) == 6);
+
+    p = chars;
+    q_tree_foreach(tree, check_order, &p);
+
+    for (i = 0; i < 26; i++) {
+        removed = q_tree_remove(tree, &chars[i + 10]);
+        g_assert(removed);
+    }
+
+    c = '\0';
+    removed = q_tree_remove(tree, &c);
+    g_assert(!removed);
+
+    q_tree_foreach(tree, my_traverse, NULL);
+
+    g_assert(q_tree_nnodes(tree) == strlen(chars2));
+    g_assert(q_tree_height(tree) == 6);
+
+    p = chars2;
+    q_tree_foreach(tree, check_order, &p);
+
+    for (i = 25; i >= 0; i--) {
+        q_tree_insert(tree, &chars[i + 10], &chars[i + 10]);
+    }
+
+    p = chars;
+    q_tree_foreach(tree, check_order, &p);
+
+    c = '0';
+    p = q_tree_lookup(tree, &c);
+    g_assert(p && *p == c);
+    g_assert(q_tree_lookup_extended(tree, &c, (gpointer *)&d, (gpointer *)&p));
+    g_assert(c == *d && c == *p);
+
+    c = 'A';
+    p = q_tree_lookup(tree, &c);
+    g_assert(p && *p == c);
+
+    c = 'a';
+    p = q_tree_lookup(tree, &c);
+    g_assert(p && *p == c);
+
+    c = 'z';
+    p = q_tree_lookup(tree, &c);
+    g_assert(p && *p == c);
+
+    c = '!';
+    p = q_tree_lookup(tree, &c);
+    g_assert(p == NULL);
+
+    c = '=';
+    p = q_tree_lookup(tree, &c);
+    g_assert(p == NULL);
+
+    c = '|';
+    p = q_tree_lookup(tree, &c);
+    g_assert(p == NULL);
+
+    c = '0';
+    p = q_tree_search(tree, my_search, &c);
+    g_assert(p && *p == c);
+
+    c = 'A';
+    p = q_tree_search(tree, my_search, &c);
+    g_assert(p && *p == c);
+
+    c = 'a';
+    p = q_tree_search(tree, my_search, &c);
+    g_assert(p && *p == c);
+
+    c = 'z';
+    p = q_tree_search(tree, my_search, &c);
+    g_assert(p && *p == c);
+
+    c = '!';
+    p = q_tree_search(tree, my_search, &c);
+    g_assert(p == NULL);
+
+    c = '=';
+    p = q_tree_search(tree, my_search, &c);
+    g_assert(p == NULL);
+
+    c = '|';
+    p = q_tree_search(tree, my_search, &c);
+    g_assert(p == NULL);
+
+    q_tree_destroy(tree);
+}
+
+static void test_tree_remove(void)
+{
+    QTree *tree;
+    char c, d;
+    gint i;
+    gboolean removed;
+
+    tree = q_tree_new_full((GCompareDataFunc)my_compare, NULL,
+                           my_key_destroy,
+                           my_value_destroy);
+
+    for (i = 0; chars[i]; i++) {
+        q_tree_insert(tree, &chars[i], &chars[i]);
+    }
+
+    c = '0';
+    q_tree_insert(tree, &c, &c);
+    g_assert(destroyed_key == &c);
+    g_assert(destroyed_value == &chars[0]);
+    destroyed_key = NULL;
+    destroyed_value = NULL;
+
+    d = '1';
+    q_tree_replace(tree, &d, &d);
+    g_assert(destroyed_key == &chars[1]);
+    g_assert(destroyed_value == &chars[1]);
+    destroyed_key = NULL;
+    destroyed_value = NULL;
+
+    c = '2';
+    removed = q_tree_remove(tree, &c);
+    g_assert(removed);
+    g_assert(destroyed_key == &chars[2]);
+    g_assert(destroyed_value == &chars[2]);
+    destroyed_key = NULL;
+    destroyed_value = NULL;
+
+    c = '3';
+    removed = q_tree_steal(tree, &c);
+    g_assert(removed);
+    g_assert(destroyed_key == NULL);
+    g_assert(destroyed_value == NULL);
+
+    const gchar *remove = "omkjigfedba";
+    for (i = 0; remove[i]; i++) {
+        removed = q_tree_remove(tree, &remove[i]);
+        g_assert(removed);
+    }
+
+    q_tree_destroy(tree);
+}
+
+static void test_tree_destroy(void)
+{
+    QTree *tree;
+    gint i;
+
+    tree = q_tree_new(my_compare);
+
+    for (i = 0; chars[i]; i++) {
+        q_tree_insert(tree, &chars[i], &chars[i]);
+    }
+
+    g_assert(q_tree_nnodes(tree) == strlen(chars));
+
+    g_test_message("nnodes: %d", q_tree_nnodes(tree));
+    q_tree_ref(tree);
+    q_tree_destroy(tree);
+
+    g_test_message("nnodes: %d", q_tree_nnodes(tree));
+    g_assert(q_tree_nnodes(tree) == 0);
+
+    q_tree_unref(tree);
+}
+
+static void test_tree_insert(void)
+{
+    QTree *tree;
+    gchar *p;
+    gint i;
+    gchar *scrambled;
+
+    tree = q_tree_new(my_compare);
+
+    for (i = 0; chars[i]; i++) {
+        q_tree_insert(tree, &chars[i], &chars[i]);
+    }
+    p = chars;
+    q_tree_foreach(tree, check_order, &p);
+
+    q_tree_unref(tree);
+    tree = q_tree_new(my_compare);
+
+    for (i = strlen(chars) - 1; i >= 0; i--) {
+        q_tree_insert(tree, &chars[i], &chars[i]);
+    }
+    p = chars;
+    q_tree_foreach(tree, check_order, &p);
+
+    q_tree_unref(tree);
+    tree = q_tree_new(my_compare);
+
+    scrambled = g_strdup(chars);
+
+    for (i = 0; i < 30; i++) {
+        gchar tmp;
+        gint a, b;
+
+        a = g_random_int_range(0, strlen(scrambled));
+        b = g_random_int_range(0, strlen(scrambled));
+        tmp = scrambled[a];
+        scrambled[a] = scrambled[b];
+        scrambled[b] = tmp;
+    }
+
+    for (i = 0; scrambled[i]; i++) {
+        q_tree_insert(tree, &scrambled[i], &scrambled[i]);
+    }
+    p = chars;
+    q_tree_foreach(tree, check_order, &p);
+
+    g_free(scrambled);
+    q_tree_unref(tree);
+}
+
+int main(int argc, char *argv[])
+{
+    g_test_init(&argc, &argv, NULL);
+
+    g_test_add_func("/qtree/search", test_tree_search);
+    g_test_add_func("/qtree/remove", test_tree_remove);
+    g_test_add_func("/qtree/destroy", test_tree_destroy);
+    g_test_add_func("/qtree/insert", test_tree_insert);
+
+    return g_test_run();
+}
diff --git a/util/qtree.c b/util/qtree.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/util/qtree.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * GLIB - Library of useful routines for C programming
+ * Copyright (C) 1995-1997  Peter Mattis, Spencer Kimball and Josh MacDonald
+ *
+ * SPDX-License-Identifier: LGPL-2.1-or-later
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+/*
+ * Modified by the GLib Team and others 1997-2000.  See the AUTHORS
+ * file for a list of people on the GLib Team.  See the ChangeLog
+ * files for a list of changes.  These files are distributed with
+ * GLib at ftp://ftp.gtk.org/pub/gtk/.
+ */
+
+/*
+ * MT safe
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/qtree.h"
+
+/**
+ * SECTION:trees-binary
+ * @title: Balanced Binary Trees
+ * @short_description: a sorted collection of key/value pairs optimized
+ *                     for searching and traversing in order
+ *
+ * The #QTree structure and its associated functions provide a sorted
+ * collection of key/value pairs optimized for searching and traversing
+ * in order. This means that most of the operations  (access, search,
+ * insertion, deletion, ...) on #QTree are O(log(n)) in average and O(n)
+ * in worst case for time complexity. But, note that maintaining a
+ * balanced sorted #QTree of n elements is done in time O(n log(n)).
+ *
+ * To create a new #QTree use q_tree_new().
+ *
+ * To insert a key/value pair into a #QTree use q_tree_insert()
+ * (O(n log(n))).
+ *
+ * To remove a key/value pair use q_tree_remove() (O(n log(n))).
+ *
+ * To look up the value corresponding to a given key, use
+ * q_tree_lookup() and q_tree_lookup_extended().
+ *
+ * To find out the number of nodes in a #QTree, use q_tree_nnodes(). To
+ * get the height of a #QTree, use q_tree_height().
+ *
+ * To traverse a #QTree, calling a function for each node visited in
+ * the traversal, use q_tree_foreach().
+ *
+ * To destroy a #QTree, use q_tree_destroy().
+ **/
+
+#define MAX_GTREE_HEIGHT 40
+
+/**
+ * QTree:
+ *
+ * The QTree struct is an opaque data structure representing a
+ * [balanced binary tree][glib-Balanced-Binary-Trees]. It should be
+ * accessed only by using the following functions.
+ */
+struct _QTree {
+    QTreeNode        *root;
+    GCompareDataFunc  key_compare;
+    GDestroyNotify    key_destroy_func;
+    GDestroyNotify    value_destroy_func;
+    gpointer          key_compare_data;
+    guint             nnodes;
+    gint              ref_count;
+};
+
+struct _QTreeNode {
+    gpointer   key;         /* key for this node */
+    gpointer   value;       /* value stored at this node */
+    QTreeNode *left;        /* left subtree */
+    QTreeNode *right;       /* right subtree */
+    gint8      balance;     /* height (right) - height (left) */
+    guint8     left_child;
+    guint8     right_child;
+};
+
+
+static QTreeNode *q_tree_node_new(gpointer       key,
+                                  gpointer       value);
+static QTreeNode *q_tree_insert_internal(QTree *tree,
+                                         gpointer key,
+                                         gpointer value,
+                                         gboolean replace);
+static gboolean   q_tree_remove_internal(QTree         *tree,
+                                         gconstpointer  key,
+                                         gboolean       steal);
+static QTreeNode *q_tree_node_balance(QTreeNode     *node);
+static QTreeNode *q_tree_find_node(QTree         *tree,
+                                   gconstpointer  key);
+static QTreeNode *q_tree_node_search(QTreeNode *node,
+                                     GCompareFunc search_func,
+                                     gconstpointer data);
+static QTreeNode *q_tree_node_rotate_left(QTreeNode     *node);
+static QTreeNode *q_tree_node_rotate_right(QTreeNode     *node);
+#ifdef Q_TREE_DEBUG
+static void       q_tree_node_check(QTreeNode     *node);
+#endif
+
+static QTreeNode*
+q_tree_node_new(gpointer key,
+                gpointer value)
+{
+    QTreeNode *node = g_new(QTreeNode, 1);
+
+    node->balance = 0;
+    node->left = NULL;
+    node->right = NULL;
+    node->left_child = FALSE;
+    node->right_child = FALSE;
+    node->key = key;
+    node->value = value;
+
+    return node;
+}
+
+/**
+ * q_tree_new:
+ * @key_compare_func: the function used to order the nodes in the #QTree.
+ *   It should return values similar to the standard strcmp() function -
+ *   0 if the two arguments are equal, a negative value if the first argument
+ *   comes before the second, or a positive value if the first argument comes
+ *   after the second.
+ *
+ * Creates a new #QTree.
+ *
+ * Returns: a newly allocated #QTree
+ */
+QTree *
+q_tree_new(GCompareFunc key_compare_func)
+{
+    g_return_val_if_fail(key_compare_func != NULL, NULL);
+
+    return q_tree_new_full((GCompareDataFunc) key_compare_func, NULL,
+                           NULL, NULL);
+}
+
+/**
+ * q_tree_new_with_data:
+ * @key_compare_func: qsort()-style comparison function
+ * @key_compare_data: data to pass to comparison function
+ *
+ * Creates a new #QTree with a comparison function that accepts user data.
+ * See q_tree_new() for more details.
+ *
+ * Returns: a newly allocated #QTree
+ */
+QTree *
+q_tree_new_with_data(GCompareDataFunc key_compare_func,
+                     gpointer         key_compare_data)
+{
+    g_return_val_if_fail(key_compare_func != NULL, NULL);
+
+    return q_tree_new_full(key_compare_func, key_compare_data,
+                           NULL, NULL);
+}
+
+/**
+ * q_tree_new_full:
+ * @key_compare_func: qsort()-style comparison function
+ * @key_compare_data: data to pass to comparison function
+ * @key_destroy_func: a function to free the memory allocated for the key
+ *   used when removing the entry from the #QTree or %NULL if you don't
+ *   want to supply such a function
+ * @value_destroy_func: a function to free the memory allocated for the
+ *   value used when removing the entry from the #QTree or %NULL if you
+ *   don't want to supply such a function
+ *
+ * Creates a new #QTree like q_tree_new() and allows to specify functions
+ * to free the memory allocated for the key and value that get called when
+ * removing the entry from the #QTree.
+ *
+ * Returns: a newly allocated #QTree
+ */
+QTree *
+q_tree_new_full(GCompareDataFunc key_compare_func,
+                gpointer         key_compare_data,
+                GDestroyNotify   key_destroy_func,
+                GDestroyNotify   value_destroy_func)
+{
+    QTree *tree;
+
+    g_return_val_if_fail(key_compare_func != NULL, NULL);
+
+    tree = g_new(QTree, 1);
+    tree->root               = NULL;
+    tree->key_compare        = key_compare_func;
+    tree->key_destroy_func   = key_destroy_func;
+    tree->value_destroy_func = value_destroy_func;
+    tree->key_compare_data   = key_compare_data;
+    tree->nnodes             = 0;
+    tree->ref_count          = 1;
+
+    return tree;
+}
+
+/**
+ * q_tree_node_first:
+ * @tree: a #QTree
+ *
+ * Returns the first in-order node of the tree, or %NULL
+ * for an empty tree.
+ *
+ * Returns: (nullable) (transfer none): the first node in the tree
+ *
+ * Since: 2.68 in GLib. Internal in Qtree, i.e. not in the public API.
+ */
+static QTreeNode *
+q_tree_node_first(QTree *tree)
+{
+    QTreeNode *tmp;
+
+    g_return_val_if_fail(tree != NULL, NULL);
+
+    if (!tree->root) {
+        return NULL;
+    }
+
+    tmp = tree->root;
+
+    while (tmp->left_child) {
+        tmp = tmp->left;
+    }
+
+    return tmp;
+}
+
+/**
+ * q_tree_node_previous
+ * @node: a #QTree node
+ *
+ * Returns the previous in-order node of the tree, or %NULL
+ * if the passed node was already the first one.
+ *
+ * Returns: (nullable) (transfer none): the previous node in the tree
+ *
+ * Since: 2.68 in GLib. Internal in Qtree, i.e. not in the public API.
+ */
+static QTreeNode *
+q_tree_node_previous(QTreeNode *node)
+{
+    QTreeNode *tmp;
+
+    g_return_val_if_fail(node != NULL, NULL);
+
+    tmp = node->left;
+
+    if (node->left_child) {
+        while (tmp->right_child) {
+            tmp = tmp->right;
+        }
+    }
+
+    return tmp;
+}
+
+/**
+ * q_tree_node_next
+ * @node: a #QTree node
+ *
+ * Returns the next in-order node of the tree, or %NULL
+ * if the passed node was already the last one.
+ *
+ * Returns: (nullable) (transfer none): the next node in the tree
+ *
+ * Since: 2.68 in GLib. Internal in Qtree, i.e. not in the public API.
+ */
+static QTreeNode *
+q_tree_node_next(QTreeNode *node)
+{
+    QTreeNode *tmp;
+
+    g_return_val_if_fail(node != NULL, NULL);
+
+    tmp = node->right;
+
+    if (node->right_child) {
+        while (tmp->left_child) {
+            tmp = tmp->left;
+        }
+    }
+
+    return tmp;
+}
+
+/**
+ * q_tree_remove_all:
+ * @tree: a #QTree
+ *
+ * Removes all nodes from a #QTree and destroys their keys and values,
+ * then resets the #QTree’s root to %NULL.
+ *
+ * Since: 2.70 in GLib. Internal in Qtree, i.e. not in the public API.
+ */
+static void
+q_tree_remove_all(QTree *tree)
+{
+    QTreeNode *node;
+    QTreeNode *next;
+
+    g_return_if_fail(tree != NULL);
+
+    node = q_tree_node_first(tree);
+
+    while (node) {
+        next = q_tree_node_next(node);
+
+        if (tree->key_destroy_func) {
+            tree->key_destroy_func(node->key);
+        }
+        if (tree->value_destroy_func) {
+            tree->value_destroy_func(node->value);
+        }
+        g_free(node);
+
+#ifdef Q_TREE_DEBUG
+        g_assert(tree->nnodes > 0);
+        tree->nnodes--;
+#endif
+
+        node = next;
+    }
+
+#ifdef Q_TREE_DEBUG
+    g_assert(tree->nnodes == 0);
+#endif
+
+    tree->root = NULL;
+#ifndef Q_TREE_DEBUG
+    tree->nnodes = 0;
+#endif
+}
+
+/**
+ * q_tree_ref:
+ * @tree: a #QTree
+ *
+ * Increments the reference count of @tree by one.
+ *
+ * It is safe to call this function from any thread.
+ *
+ * Returns: the passed in #QTree
+ *
+ * Since: 2.22
+ */
+QTree *
+q_tree_ref(QTree *tree)
+{
+    g_return_val_if_fail(tree != NULL, NULL);
+
+    g_atomic_int_inc(&tree->ref_count);
+
+    return tree;
+}
+
+/**
+ * q_tree_unref:
+ * @tree: a #QTree
+ *
+ * Decrements the reference count of @tree by one.
+ * If the reference count drops to 0, all keys and values will
+ * be destroyed (if destroy functions were specified) and all
+ * memory allocated by @tree will be released.
+ *
+ * It is safe to call this function from any thread.
+ *
+ * Since: 2.22
+ */
+void
+q_tree_unref(QTree *tree)
+{
+    g_return_if_fail(tree != NULL);
+
+    if (g_atomic_int_dec_and_test(&tree->ref_count)) {
+        q_tree_remove_all(tree);
+        g_free(tree);
+    }
+}
+
+/**
+ * q_tree_destroy:
+ * @tree: a #QTree
+ *
+ * Removes all keys and values from the #QTree and decreases its
+ * reference count by one. If keys and/or values are dynamically
+ * allocated, you should either free them first or create the #QTree
+ * using q_tree_new_full(). In the latter case the destroy functions
+ * you supplied will be called on all keys and values before destroying
+ * the #QTree.
+ */
+void
+q_tree_destroy(QTree *tree)
+{
+    g_return_if_fail(tree != NULL);
+
+    q_tree_remove_all(tree);
+    q_tree_unref(tree);
+}
+
+/**
+ * q_tree_insert_node:
+ * @tree: a #QTree
+ * @key: the key to insert
+ * @value: the value corresponding to the key
+ *
+ * Inserts a key/value pair into a #QTree.
+ *
+ * If the given key already exists in the #QTree its corresponding value
+ * is set to the new value. If you supplied a @value_destroy_func when
+ * creating the #QTree, the old value is freed using that function. If
+ * you supplied a @key_destroy_func when creating the #QTree, the passed
+ * key is freed using that function.
+ *
+ * The tree is automatically 'balanced' as new key/value pairs are added,
+ * so that the distance from the root to every leaf is as small as possible.
+ * The cost of maintaining a balanced tree while inserting new key/value
+ * result in a O(n log(n)) operation where most of the other operations
+ * are O(log(n)).
+ *
+ * Returns: (transfer none): the inserted (or set) node.
+ *
+ * Since: 2.68 in GLib. Internal in Qtree, i.e. not in the public API.
+ */
+static QTreeNode *
+q_tree_insert_node(QTree    *tree,
+                   gpointer  key,
+                   gpointer  value)
+{
+    QTreeNode *node;
+
+    g_return_val_if_fail(tree != NULL, NULL);
+
+    node = q_tree_insert_internal(tree, key, value, FALSE);
+
+#ifdef Q_TREE_DEBUG
+    q_tree_node_check(tree->root);
+#endif
+
+    return node;
+}
+
+/**
+ * q_tree_insert:
+ * @tree: a #QTree
+ * @key: the key to insert
+ * @value: the value corresponding to the key
+ *
+ * Inserts a key/value pair into a #QTree.
+ *
+ * Inserts a new key and value into a #QTree as q_tree_insert_node() does,
+ * only this function does not return the inserted or set node.
+ */
+void
+q_tree_insert(QTree    *tree,
+              gpointer  key,
+              gpointer  value)
+{
+    q_tree_insert_node(tree, key, value);
+}
+
+/**
+ * q_tree_replace_node:
+ * @tree: a #QTree
+ * @key: the key to insert
+ * @value: the value corresponding to the key
+ *
+ * Inserts a new key and value into a #QTree similar to q_tree_insert_node().
+ * The difference is that if the key already exists in the #QTree, it gets
+ * replaced by the new key. If you supplied a @value_destroy_func when
+ * creating the #QTree, the old value is freed using that function. If you
+ * supplied a @key_destroy_func when creating the #QTree, the old key is
+ * freed using that function.
+ *
+ * The tree is automatically 'balanced' as new key/value pairs are added,
+ * so that the distance from the root to every leaf is as small as possible.
+ *
+ * Returns: (transfer none): the inserted (or set) node.
+ *
+ * Since: 2.68 in GLib. Internal in Qtree, i.e. not in the public API.
+ */
+static QTreeNode *
+q_tree_replace_node(QTree    *tree,
+                    gpointer  key,
+                    gpointer  value)
+{
+    QTreeNode *node;
+
+    g_return_val_if_fail(tree != NULL, NULL);
+
+    node = q_tree_insert_internal(tree, key, value, TRUE);
+
+#ifdef Q_TREE_DEBUG
+    q_tree_node_check(tree->root);
+#endif
+
+    return node;
+}
+
+/**
+ * q_tree_replace:
+ * @tree: a #QTree
+ * @key: the key to insert
+ * @value: the value corresponding to the key
+ *
+ * Inserts a new key and value into a #QTree as q_tree_replace_node() does,
+ * only this function does not return the inserted or set node.
+ */
+void
+q_tree_replace(QTree    *tree,
+               gpointer  key,
+               gpointer  value)
+{
+    q_tree_replace_node(tree, key, value);
+}
+
+/* internal insert routine */
+static QTreeNode *
+q_tree_insert_internal(QTree    *tree,
+                       gpointer  key,
+                       gpointer  value,
+                       gboolean  replace)
+{
+    QTreeNode *node, *retnode;
+    QTreeNode *path[MAX_GTREE_HEIGHT];
+    int idx;
+
+    g_return_val_if_fail(tree != NULL, NULL);
+
+    if (!tree->root) {
+        tree->root = q_tree_node_new(key, value);
+        tree->nnodes++;
+        return tree->root;
+    }
+
+    idx = 0;
+    path[idx++] = NULL;
+    node = tree->root;
+
+    while (1) {
+        int cmp = tree->key_compare(key, node->key, tree->key_compare_data);
+
+        if (cmp == 0) {
+            if (tree->value_destroy_func) {
+                tree->value_destroy_func(node->value);
+            }
+
+            node->value = value;
+
+            if (replace) {
+                if (tree->key_destroy_func) {
+                    tree->key_destroy_func(node->key);
+                }
+
+                node->key = key;
+            } else {
+                /* free the passed key */
+                if (tree->key_destroy_func) {
+                    tree->key_destroy_func(key);
+                }
+            }
+
+            return node;
+        } else if (cmp < 0) {
+            if (node->left_child) {
+                path[idx++] = node;
+                node = node->left;
+            } else {
+                QTreeNode *child = q_tree_node_new(key, value);
+
+                child->left = node->left;
+                child->right = node;
+                node->left = child;
+                node->left_child = TRUE;
+                node->balance -= 1;
+
+                tree->nnodes++;
+
+                retnode = child;
+                break;
+            }
+        } else {
+            if (node->right_child) {
+                path[idx++] = node;
+                node = node->right;
+            } else {
+                QTreeNode *child = q_tree_node_new(key, value);
+
+                child->right = node->right;
+                child->left = node;
+                node->right = child;
+                node->right_child = TRUE;
+                node->balance += 1;
+
+                tree->nnodes++;
+
+                retnode = child;
+                break;
+            }
+        }
+    }
+
+    /*
+     * Restore balance. This is the goodness of a non-recursive
+     * implementation, when we are done with balancing we 'break'
+     * the loop and we are done.
+     */
+    while (1) {
+        QTreeNode *bparent = path[--idx];
+        gboolean left_node = (bparent && node == bparent->left);
+        g_assert(!bparent || bparent->left == node || bparent->right == node);
+
+        if (node->balance < -1 || node->balance > 1) {
+            node = q_tree_node_balance(node);
+            if (bparent == NULL) {
+                tree->root = node;
+            } else if (left_node) {
+                bparent->left = node;
+            } else {
+                bparent->right = node;
+            }
+        }
+
+        if (node->balance == 0 || bparent == NULL) {
+            break;
+        }
+
+        if (left_node) {
+            bparent->balance -= 1;
+        } else {
+            bparent->balance += 1;
+        }
+
+        node = bparent;
+    }
+
+    return retnode;
+}
+
+/**
+ * q_tree_remove:
+ * @tree: a #QTree
+ * @key: the key to remove
+ *
+ * Removes a key/value pair from a #QTree.
+ *
+ * If the #QTree was created using q_tree_new_full(), the key and value
+ * are freed using the supplied destroy functions, otherwise you have to
+ * make sure that any dynamically allocated values are freed yourself.
+ * If the key does not exist in the #QTree, the function does nothing.
+ *
+ * The cost of maintaining a balanced tree while removing a key/value
+ * result in a O(n log(n)) operation where most of the other operations
+ * are O(log(n)).
+ *
+ * Returns: %TRUE if the key was found (prior to 2.8, this function
+ *     returned nothing)
+ */
+gboolean
+q_tree_remove(QTree         *tree,
+              gconstpointer  key)
+{
+    gboolean removed;
+
+    g_return_val_if_fail(tree != NULL, FALSE);
+
+    removed = q_tree_remove_internal(tree, key, FALSE);
+
+#ifdef Q_TREE_DEBUG
+    q_tree_node_check(tree->root);
+#endif
+
+    return removed;
+}
+
+/**
+ * q_tree_steal:
+ * @tree: a #QTree
+ * @key: the key to remove
+ *
+ * Removes a key and its associated value from a #QTree without calling
+ * the key and value destroy functions.
+ *
+ * If the key does not exist in the #QTree, the function does nothing.
+ *
+ * Returns: %TRUE if the key was found (prior to 2.8, this function
+ *     returned nothing)
+ */
+gboolean
+q_tree_steal(QTree         *tree,
+             gconstpointer  key)
+{
+    gboolean removed;
+
+    g_return_val_if_fail(tree != NULL, FALSE);
+
+    removed = q_tree_remove_internal(tree, key, TRUE);
+
+#ifdef Q_TREE_DEBUG
+    q_tree_node_check(tree->root);
+#endif
+
+    return removed;
+}
+
+/* internal remove routine */
+static gboolean
+q_tree_remove_internal(QTree         *tree,
+                       gconstpointer  key,
+                       gboolean       steal)
+{
+    QTreeNode *node, *parent, *balance;
+    QTreeNode *path[MAX_GTREE_HEIGHT];
+    int idx;
+    gboolean left_node;
+
+    g_return_val_if_fail(tree != NULL, FALSE);
+
+    if (!tree->root) {
+        return FALSE;
+    }
+
+    idx = 0;
+    path[idx++] = NULL;
+    node = tree->root;
+
+    while (1) {
+        int cmp = tree->key_compare(key, node->key, tree->key_compare_data);
+
+        if (cmp == 0) {
+            break;
+        } else if (cmp < 0) {
+            if (!node->left_child) {
+                return FALSE;
+            }
+
+            path[idx++] = node;
+            node = node->left;
+        } else {
+            if (!node->right_child) {
+                return FALSE;
+            }
+
+            path[idx++] = node;
+            node = node->right;
+        }
+    }
+
+    /*
+     * The following code is almost equal to q_tree_remove_node,
+     * except that we do not have to call q_tree_node_parent.
+     */
+    balance = parent = path[--idx];
+    g_assert(!parent || parent->left == node || parent->right == node);
+    left_node = (parent && node == parent->left);
+
+    if (!node->left_child) {
+        if (!node->right_child) {
+            if (!parent) {
+                tree->root = NULL;
+            } else if (left_node) {
+                parent->left_child = FALSE;
+                parent->left = node->left;
+                parent->balance += 1;
+            } else {
+                parent->right_child = FALSE;
+                parent->right = node->right;
+                parent->balance -= 1;
+            }
+        } else {
+            /* node has a right child */
+            QTreeNode *tmp = q_tree_node_next(node);
+            tmp->left = node->left;
+
+            if (!parent) {
+                tree->root = node->right;
+            } else if (left_node) {
+                parent->left = node->right;
+                parent->balance += 1;
+            } else {
+                parent->right = node->right;
+                parent->balance -= 1;
+            }
+        }
+    } else {
+        /* node has a left child */
+        if (!node->right_child) {
+            QTreeNode *tmp = q_tree_node_previous(node);
+            tmp->right = node->right;
+
+            if (parent == NULL) {
+                tree->root = node->left;
+            } else if (left_node) {
+                parent->left = node->left;
+                parent->balance += 1;
+            } else {
+                parent->right = node->left;
+                parent->balance -= 1;
+            }
+        } else {
+            /* node has a both children (pant, pant!) */
+            QTreeNode *prev = node->left;
+            QTreeNode *next = node->right;
+            QTreeNode *nextp = node;
+            int old_idx = idx + 1;
+            idx++;
+
+            /* path[idx] == parent */
+            /* find the immediately next node (and its parent) */
+            while (next->left_child) {
+                path[++idx] = nextp = next;
+                next = next->left;
+            }
+
+            path[old_idx] = next;
+            balance = path[idx];
+
+            /* remove 'next' from the tree */
+            if (nextp != node) {
+                if (next->right_child) {
+                    nextp->left = next->right;
+                } else {
+                    nextp->left_child = FALSE;
+                }
+                nextp->balance += 1;
+
+                next->right_child = TRUE;
+                next->right = node->right;
+            } else {
+                node->balance -= 1;
+            }
+
+            /* set the prev to point to the right place */
+            while (prev->right_child) {
+                prev = prev->right;
+            }
+            prev->right = next;
+
+            /* prepare 'next' to replace 'node' */
+            next->left_child = TRUE;
+            next->left = node->left;
+            next->balance = node->balance;
+
+            if (!parent) {
+                tree->root = next;
+            } else if (left_node) {
+                parent->left = next;
+            } else {
+                parent->right = next;
+            }
+        }
+    }
+
+    /* restore balance */
+    if (balance) {
+        while (1) {
+            QTreeNode *bparent = path[--idx];
+            g_assert(!bparent ||
+                     bparent->left == balance ||
+                     bparent->right == balance);
+            left_node = (bparent && balance == bparent->left);
+
+            if (balance->balance < -1 || balance->balance > 1) {
+                balance = q_tree_node_balance(balance);
+                if (!bparent) {
+                    tree->root = balance;
+                } else if (left_node) {
+                    bparent->left = balance;
+                } else {
+                    bparent->right = balance;
+                }
+            }
+
+            if (balance->balance != 0 || !bparent) {
+                break;
+            }
+
+            if (left_node) {
+                bparent->balance += 1;
+            } else {
+                bparent->balance -= 1;
+            }
+
+            balance = bparent;
+        }
+    }
+
+    if (!steal) {
+        if (tree->key_destroy_func) {
+            tree->key_destroy_func(node->key);
+        }
+        if (tree->value_destroy_func) {
+            tree->value_destroy_func(node->value);
+        }
+    }
+
+    g_free(node);
+
+    tree->nnodes--;
+
+    return TRUE;
+}
+
+/**
+ * q_tree_lookup_node:
+ * @tree: a #QTree
+ * @key: the key to look up
+ *
+ * Gets the tree node corresponding to the given key. Since a #QTree is
+ * automatically balanced as key/value pairs are added, key lookup
+ * is O(log n) (where n is the number of key/value pairs in the tree).
+ *
+ * Returns: (nullable) (transfer none): the tree node corresponding to
+ *          the key, or %NULL if the key was not found
+ *
+ * Since: 2.68 in GLib. Internal in Qtree, i.e. not in the public API.
+ */
+static QTreeNode *
+q_tree_lookup_node(QTree         *tree,
+                   gconstpointer  key)
+{
+    g_return_val_if_fail(tree != NULL, NULL);
+
+    return q_tree_find_node(tree, key);
+}
+
+/**
+ * q_tree_lookup:
+ * @tree: a #QTree
+ * @key: the key to look up
+ *
+ * Gets the value corresponding to the given key. Since a #QTree is
+ * automatically balanced as key/value pairs are added, key lookup
+ * is O(log n) (where n is the number of key/value pairs in the tree).
+ *
+ * Returns: the value corresponding to the key, or %NULL
+ *     if the key was not found
+ */
+gpointer
+q_tree_lookup(QTree         *tree,
+              gconstpointer  key)
+{
+    QTreeNode *node;
+
+    node = q_tree_lookup_node(tree, key);
+
+    return node ? node->value : NULL;
+}
+
+/**
+ * q_tree_lookup_extended:
+ * @tree: a #QTree
+ * @lookup_key: the key to look up
+ * @orig_key: (out) (optional) (nullable): returns the original key
+ * @value: (out) (optional) (nullable): returns the value associated with
+ *         the key
+ *
+ * Looks up a key in the #QTree, returning the original key and the
+ * associated value. This is useful if you need to free the memory
+ * allocated for the original key, for example before calling
+ * q_tree_remove().
+ *
+ * Returns: %TRUE if the key was found in the #QTree
+ */
+gboolean
+q_tree_lookup_extended(QTree         *tree,
+                       gconstpointer  lookup_key,
+                       gpointer      *orig_key,
+                       gpointer      *value)
+{
+    QTreeNode *node;
+
+    g_return_val_if_fail(tree != NULL, FALSE);
+
+    node = q_tree_find_node(tree, lookup_key);
+
+    if (node) {
+        if (orig_key) {
+            *orig_key = node->key;
+        }
+        if (value) {
+            *value = node->value;
+        }
+        return TRUE;
+    } else {
+        return FALSE;
+    }
+}
+
+/**
+ * q_tree_foreach:
+ * @tree: a #QTree
+ * @func: the function to call for each node visited.
+ *     If this function returns %TRUE, the traversal is stopped.
+ * @user_data: user data to pass to the function
+ *
+ * Calls the given function for each of the key/value pairs in the #QTree.
+ * The function is passed the key and value of each pair, and the given
+ * @data parameter. The tree is traversed in sorted order.
+ *
+ * The tree may not be modified while iterating over it (you can't
+ * add/remove items). To remove all items matching a predicate, you need
+ * to add each item to a list in your #GTraverseFunc as you walk over
+ * the tree, then walk the list and remove each item.
+ */
+void
+q_tree_foreach(QTree         *tree,
+               GTraverseFunc  func,
+               gpointer       user_data)
+{
+    QTreeNode *node;
+
+    g_return_if_fail(tree != NULL);
+
+    if (!tree->root) {
+        return;
+    }
+
+    node = q_tree_node_first(tree);
+
+    while (node) {
+        if ((*func)(node->key, node->value, user_data)) {
+            break;
+        }
+
+        node = q_tree_node_next(node);
+    }
+}
+
+/**
+ * q_tree_search_node:
+ * @tree: a #QTree
+ * @search_func: a function used to search the #QTree
+ * @user_data: the data passed as the second argument to @search_func
+ *
+ * Searches a #QTree using @search_func.
+ *
+ * The @search_func is called with a pointer to the key of a key/value
+ * pair in the tree, and the passed in @user_data. If @search_func returns
+ * 0 for a key/value pair, then the corresponding node is returned as
+ * the result of q_tree_search(). If @search_func returns -1, searching
+ * will proceed among the key/value pairs that have a smaller key; if
+ * @search_func returns 1, searching will proceed among the key/value
+ * pairs that have a larger key.
+ *
+ * Returns: (nullable) (transfer none): the node corresponding to the
+ *          found key, or %NULL if the key was not found
+ *
+ * Since: 2.68 in GLib. Internal in Qtree, i.e. not in the public API.
+ */
+static QTreeNode *
+q_tree_search_node(QTree         *tree,
+                   GCompareFunc   search_func,
+                   gconstpointer  user_data)
+{
+    g_return_val_if_fail(tree != NULL, NULL);
+
+    if (!tree->root) {
+        return NULL;
+    }
+
+    return q_tree_node_search(tree->root, search_func, user_data);
+}
+
+/**
+ * q_tree_search:
+ * @tree: a #QTree
+ * @search_func: a function used to search the #QTree
+ * @user_data: the data passed as the second argument to @search_func
+ *
+ * Searches a #QTree using @search_func.
+ *
+ * The @search_func is called with a pointer to the key of a key/value
+ * pair in the tree, and the passed in @user_data. If @search_func returns
+ * 0 for a key/value pair, then the corresponding value is returned as
+ * the result of q_tree_search(). If @search_func returns -1, searching
+ * will proceed among the key/value pairs that have a smaller key; if
+ * @search_func returns 1, searching will proceed among the key/value
+ * pairs that have a larger key.
+ *
+ * Returns: the value corresponding to the found key, or %NULL
+ *     if the key was not found
+ */
+gpointer
+q_tree_search(QTree         *tree,
+              GCompareFunc   search_func,
+              gconstpointer  user_data)
+{
+    QTreeNode *node;
+
+    node = q_tree_search_node(tree, search_func, user_data);
+
+    return node ? node->value : NULL;
+}
+
+/**
+ * q_tree_height:
+ * @tree: a #QTree
+ *
+ * Gets the height of a #QTree.
+ *
+ * If the #QTree contains no nodes, the height is 0.
+ * If the #QTree contains only one root node the height is 1.
+ * If the root node has children the height is 2, etc.
+ *
+ * Returns: the height of @tree
+ */
+gint
+q_tree_height(QTree *tree)
+{
+    QTreeNode *node;
+    gint height;
+
+    g_return_val_if_fail(tree != NULL, 0);
+
+    if (!tree->root) {
+        return 0;
+    }
+
+    height = 0;
+    node = tree->root;
+
+    while (1) {
+        height += 1 + MAX(node->balance, 0);
+
+        if (!node->left_child) {
+            return height;
+        }
+
+        node = node->left;
+    }
+}
+
+/**
+ * q_tree_nnodes:
+ * @tree: a #QTree
+ *
+ * Gets the number of nodes in a #QTree.
+ *
+ * Returns: the number of nodes in @tree
+ */
+gint
+q_tree_nnodes(QTree *tree)
+{
+    g_return_val_if_fail(tree != NULL, 0);
+
+    return tree->nnodes;
+}
+
+static QTreeNode *
+q_tree_node_balance(QTreeNode *node)
+{
+    if (node->balance < -1) {
+        if (node->left->balance > 0) {
+            node->left = q_tree_node_rotate_left(node->left);
+        }
+        node = q_tree_node_rotate_right(node);
+    } else if (node->balance > 1) {
+        if (node->right->balance < 0) {
+            node->right = q_tree_node_rotate_right(node->right);
+        }
+        node = q_tree_node_rotate_left(node);
+    }
+
+    return node;
+}
+
+static QTreeNode *
+q_tree_find_node(QTree        *tree,
+                 gconstpointer key)
+{
+    QTreeNode *node;
+    gint cmp;
+
+    node = tree->root;
+    if (!node) {
+        return NULL;
+    }
+
+    while (1) {
+        cmp = tree->key_compare(key, node->key, tree->key_compare_data);
+        if (cmp == 0) {
+            return node;
+        } else if (cmp < 0) {
+            if (!node->left_child) {
+                return NULL;
+            }
+
+            node = node->left;
+        } else {
+            if (!node->right_child) {
+                return NULL;
+            }
+
+            node = node->right;
+        }
+    }
+}
+
+static QTreeNode *
+q_tree_node_search(QTreeNode     *node,
+                   GCompareFunc   search_func,
+                   gconstpointer  data)
+{
+    gint dir;
+
+    if (!node) {
+        return NULL;
+    }
+
+    while (1) {
+        dir = (*search_func)(node->key, data);
+        if (dir == 0) {
+            return node;
+        } else if (dir < 0) {
+            if (!node->left_child) {
+                return NULL;
+            }
+
+            node = node->left;
+        } else {
+            if (!node->right_child) {
+                return NULL;
+            }
+
+            node = node->right;
+        }
+    }
+}
+
+static QTreeNode *
+q_tree_node_rotate_left(QTreeNode *node)
+{
+    QTreeNode *right;
+    gint a_bal;
+    gint b_bal;
+
+    right = node->right;
+
+    if (right->left_child) {
+        node->right = right->left;
+    } else {
+        node->right_child = FALSE;
+        right->left_child = TRUE;
+    }
+    right->left = node;
+
+    a_bal = node->balance;
+    b_bal = right->balance;
+
+    if (b_bal <= 0) {
+        if (a_bal >= 1) {
+            right->balance = b_bal - 1;
+        } else {
+            right->balance = a_bal + b_bal - 2;
+        }
+        node->balance = a_bal - 1;
+    } else {
+        if (a_bal <= b_bal) {
+            right->balance = a_bal - 2;
+        } else {
+            right->balance = b_bal - 1;
+        }
+        node->balance = a_bal - b_bal - 1;
+    }
+
+    return right;
+}
+
+static QTreeNode *
+q_tree_node_rotate_right(QTreeNode *node)
+{
+    QTreeNode *left;
+    gint a_bal;
+    gint b_bal;
+
+    left = node->left;
+
+    if (left->right_child) {
+        node->left = left->right;
+    } else {
+        node->left_child = FALSE;
+        left->right_child = TRUE;
+    }
+    left->right = node;
+
+    a_bal = node->balance;
+    b_bal = left->balance;
+
+    if (b_bal <= 0) {
+        if (b_bal > a_bal) {
+            left->balance = b_bal + 1;
+        } else {
+            left->balance = a_bal + 2;
+        }
+        node->balance = a_bal - b_bal + 1;
+    } else {
+        if (a_bal <= -1) {
+            left->balance = b_bal + 1;
+        } else {
+            left->balance = a_bal + b_bal + 2;
+        }
+        node->balance = a_bal + 1;
+    }
+
+    return left;
+}
+
+#ifdef Q_TREE_DEBUG
+static gint
+q_tree_node_height(QTreeNode *node)
+{
+    gint left_height;
+    gint right_height;
+
+    if (node) {
+        left_height = 0;
+        right_height = 0;
+
+        if (node->left_child) {
+            left_height = q_tree_node_height(node->left);
+        }
+
+        if (node->right_child) {
+            right_height = q_tree_node_height(node->right);
+        }
+
+        return MAX(left_height, right_height) + 1;
+    }
+
+    return 0;
+}
+
+static void q_tree_node_check(QTreeNode *node)
+{
+    gint left_height;
+    gint right_height;
+    gint balance;
+    QTreeNode *tmp;
+
+    if (node) {
+        if (node->left_child) {
+            tmp = q_tree_node_previous(node);
+            g_assert(tmp->right == node);
+        }
+
+        if (node->right_child) {
+            tmp = q_tree_node_next(node);
+            g_assert(tmp->left == node);
+        }
+
+        left_height = 0;
+        right_height = 0;
+
+        if (node->left_child) {
+            left_height = q_tree_node_height(node->left);
+        }
+        if (node->right_child) {
+            right_height = q_tree_node_height(node->right);
+        }
+
+        balance = right_height - left_height;
+        g_assert(balance == node->balance);
+
+        if (node->left_child) {
+            q_tree_node_check(node->left);
+        }
+        if (node->right_child) {
+            q_tree_node_check(node->right);
+        }
+    }
+}
+#endif
diff --git a/tests/bench/meson.build b/tests/bench/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/bench/meson.build
+++ b/tests/bench/meson.build
@@ -XXX,XX +XXX,XX @@ xbzrle_bench = executable('xbzrle-bench',
                        dependencies: [qemuutil,migration])
 endif
 
+qtree_bench = executable('qtree-bench',
+                         sources: 'qtree-bench.c',
+                         dependencies: [qemuutil])
+
 executable('atomic_add-bench',
            sources: files('atomic_add-bench.c'),
            dependencies: [qemuutil],
diff --git a/tests/unit/meson.build b/tests/unit/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/unit/meson.build
+++ b/tests/unit/meson.build
@@ -XXX,XX +XXX,XX @@ tests = {
   'test-rcu-slist': [],
   'test-qdist': [],
   'test-qht': [],
+  'test-qtree': [],
   'test-bitops': [],
   'test-bitcnt': [],
   'test-qgraph': ['../qtest/libqos/qgraph.c'],
diff --git a/util/meson.build b/util/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/util/meson.build
+++ b/util/meson.build
@@ -XXX,XX +XXX,XX @@ util_ss.add(when: 'CONFIG_WIN32', if_true: files('oslib-win32.c'))
 util_ss.add(when: 'CONFIG_WIN32', if_true: files('qemu-thread-win32.c'))
 util_ss.add(when: 'CONFIG_WIN32', if_true: winmm)
 util_ss.add(when: 'CONFIG_WIN32', if_true: pathcch)
+util_ss.add(when: 'HAVE_GLIB_WITH_SLICE_ALLOCATOR', if_true: files('qtree.c'))
 util_ss.add(files('envlist.c', 'path.c', 'module.c'))
 util_ss.add(files('host-utils.c'))
 util_ss.add(files('bitmap.c', 'bitops.c'))
-- 
2.34.1

From: Emilio Cota <cota@braap.org>

qemu-user can hang in a multi-threaded fork. One common
reason is that when creating a TB, between fork and exec
we manipulate a GTree whose memory allocator (GSlice) is
not fork-safe.

Although POSIX does not mandate it, the system's allocator
(e.g. tcmalloc, libc malloc) is probably fork-safe.

Fix some of these hangs by using QTree, which uses the system's
allocator regardless of the Glib version that we used at
configuration time.

Tested with the test program in the original bug report, i.e.:
```

void garble() {
  int pid = fork();
  if (pid == 0) {
    exit(0);
  } else {
    int wstatus;
    waitpid(pid, &wstatus, 0);
  }
}

void supragarble(unsigned depth) {
  if (depth == 0)
    return ;

std::thread a(supragarble, depth-1);
  std::thread b(supragarble, depth-1);
  garble();
  a.join();
  b.join();
}

int main() {
  supragarble(10);
}
```

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/285
Reported-by: Valentin David <me@valentindavid.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Emilio Cota <cota@braap.org>
Message-Id: <20230205163758.416992-3-cota@braap.org>
[rth: Add QEMU_DISABLE_CFI for all callback using functions.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tb-maint.c | 17 +++++++++--------
 tcg/region.c         | 19 ++++++++++---------
 util/qtree.c         |  8 ++++----
 3 files changed, 23 insertions(+), 21 deletions(-)

diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "qemu/interval-tree.h"
+#include "qemu/qtree.h"
 #include "exec/cputlb.h"
 #include "exec/log.h"
 #include "exec/exec-all.h"
@@ -XXX,XX +XXX,XX @@ struct page_entry {
  * See also: page_collection_lock().
  */
 struct page_collection {
-    GTree *tree;
+    QTree *tree;
     struct page_entry *max;
 };
 
@@ -XXX,XX +XXX,XX @@ static bool page_trylock_add(struct page_collection *set, tb_page_addr_t addr)
     struct page_entry *pe;
     PageDesc *pd;
 
-    pe = g_tree_lookup(set->tree, &index);
+    pe = q_tree_lookup(set->tree, &index);
     if (pe) {
         return false;
     }
@@ -XXX,XX +XXX,XX @@ static bool page_trylock_add(struct page_collection *set, tb_page_addr_t addr)
     }
 
     pe = page_entry_new(pd, index);
-    g_tree_insert(set->tree, &pe->index, pe);
+    q_tree_insert(set->tree, &pe->index, pe);
 
     /*
      * If this is either (1) the first insertion or (2) a page whose index
@@ -XXX,XX +XXX,XX @@ static struct page_collection *page_collection_lock(tb_page_addr_t start,
     end   >>= TARGET_PAGE_BITS;
     g_assert(start <= end);
 
-    set->tree = g_tree_new_full(tb_page_addr_cmp, NULL, NULL,
+    set->tree = q_tree_new_full(tb_page_addr_cmp, NULL, NULL,
                                 page_entry_destroy);
     set->max = NULL;
     assert_no_pages_locked();
 
  retry:
-    g_tree_foreach(set->tree, page_entry_lock, NULL);
+    q_tree_foreach(set->tree, page_entry_lock, NULL);
 
     for (index = start; index <= end; index++) {
         TranslationBlock *tb;
@@ -XXX,XX +XXX,XX @@ static struct page_collection *page_collection_lock(tb_page_addr_t start,
             continue;
         }
         if (page_trylock_add(set, index << TARGET_PAGE_BITS)) {
-            g_tree_foreach(set->tree, page_entry_unlock, NULL);
+            q_tree_foreach(set->tree, page_entry_unlock, NULL);
             goto retry;
         }
         assert_page_locked(pd);
@@ -XXX,XX +XXX,XX @@ static struct page_collection *page_collection_lock(tb_page_addr_t start,
                 (tb_page_addr1(tb) != -1 &&
                  page_trylock_add(set, tb_page_addr1(tb)))) {
                 /* drop all locks, and reacquire in order */
-                g_tree_foreach(set->tree, page_entry_unlock, NULL);
+                q_tree_foreach(set->tree, page_entry_unlock, NULL);
                 goto retry;
             }
         }
@@ -XXX,XX +XXX,XX @@ static struct page_collection *page_collection_lock(tb_page_addr_t start,
 static void page_collection_unlock(struct page_collection *set)
 {
     /* entries are unlocked and freed via page_entry_destroy */
-    g_tree_destroy(set->tree);
+    q_tree_destroy(set->tree);
     g_free(set);
 }
 
diff --git a/tcg/region.c b/tcg/region.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/region.c
+++ b/tcg/region.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/mprotect.h"
 #include "qemu/memalign.h"
 #include "qemu/cacheinfo.h"
+#include "qemu/qtree.h"
 #include "qapi/error.h"
 #include "exec/exec-all.h"
 #include "tcg/tcg.h"
@@ -XXX,XX +XXX,XX @@
 
 struct tcg_region_tree {
     QemuMutex lock;
-    GTree *tree;
+    QTree *tree;
     /* padding to avoid false sharing is computed at run-time */
 };
 
@@ -XXX,XX +XXX,XX @@ static void tcg_region_trees_init(void)
         struct tcg_region_tree *rt = region_trees + i * tree_size;
 
         qemu_mutex_init(&rt->lock);
-        rt->tree = g_tree_new_full(tb_tc_cmp, NULL, NULL, tb_destroy);
+        rt->tree = q_tree_new_full(tb_tc_cmp, NULL, NULL, tb_destroy);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ void tcg_tb_insert(TranslationBlock *tb)
 
     g_assert(rt != NULL);
     qemu_mutex_lock(&rt->lock);
-    g_tree_insert(rt->tree, &tb->tc, tb);
+    q_tree_insert(rt->tree, &tb->tc, tb);
     qemu_mutex_unlock(&rt->lock);
 }
 
@@ -XXX,XX +XXX,XX @@ void tcg_tb_remove(TranslationBlock *tb)
 
     g_assert(rt != NULL);
     qemu_mutex_lock(&rt->lock);
-    g_tree_remove(rt->tree, &tb->tc);
+    q_tree_remove(rt->tree, &tb->tc);
     qemu_mutex_unlock(&rt->lock);
 }
 
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tcg_tb_lookup(uintptr_t tc_ptr)
     }
 
     qemu_mutex_lock(&rt->lock);
-    tb = g_tree_lookup(rt->tree, &s);
+    tb = q_tree_lookup(rt->tree, &s);
     qemu_mutex_unlock(&rt->lock);
     return tb;
 }
@@ -XXX,XX +XXX,XX @@ void tcg_tb_foreach(GTraverseFunc func, gpointer user_data)
     for (i = 0; i < region.n; i++) {
         struct tcg_region_tree *rt = region_trees + i * tree_size;
 
-        g_tree_foreach(rt->tree, func, user_data);
+        q_tree_foreach(rt->tree, func, user_data);
     }
     tcg_region_tree_unlock_all();
 }
@@ -XXX,XX +XXX,XX @@ size_t tcg_nb_tbs(void)
     for (i = 0; i < region.n; i++) {
         struct tcg_region_tree *rt = region_trees + i * tree_size;
 
-        nb_tbs += g_tree_nnodes(rt->tree);
+        nb_tbs += q_tree_nnodes(rt->tree);
     }
     tcg_region_tree_unlock_all();
     return nb_tbs;
@@ -XXX,XX +XXX,XX @@ static void tcg_region_tree_reset_all(void)
         struct tcg_region_tree *rt = region_trees + i * tree_size;
 
         /* Increment the refcount first so that destroy acts as a reset */
-        g_tree_ref(rt->tree);
-        g_tree_destroy(rt->tree);
+        q_tree_ref(rt->tree);
+        q_tree_destroy(rt->tree);
     }
     tcg_region_tree_unlock_all();
 }
diff --git a/util/qtree.c b/util/qtree.c
index XXXXXXX..XXXXXXX 100644
--- a/util/qtree.c
+++ b/util/qtree.c
@@ -XXX,XX +XXX,XX @@ q_tree_node_next(QTreeNode *node)
  *
  * Since: 2.70 in GLib. Internal in Qtree, i.e. not in the public API.
  */
-static void
+static void QEMU_DISABLE_CFI
 q_tree_remove_all(QTree *tree)
 {
     QTreeNode *node;
@@ -XXX,XX +XXX,XX @@ q_tree_replace(QTree    *tree,
 }
 
 /* internal insert routine */
-static QTreeNode *
+static QTreeNode * QEMU_DISABLE_CFI
 q_tree_insert_internal(QTree    *tree,
                        gpointer  key,
                        gpointer  value,
@@ -XXX,XX +XXX,XX @@ q_tree_steal(QTree         *tree,
 }
 
 /* internal remove routine */
-static gboolean
+static gboolean QEMU_DISABLE_CFI
 q_tree_remove_internal(QTree         *tree,
                        gconstpointer  key,
                        gboolean       steal)
@@ -XXX,XX +XXX,XX @@ q_tree_node_balance(QTreeNode *node)
     return node;
 }
 
-static QTreeNode *
+static QTreeNode * QEMU_DISABLE_CFI
 q_tree_find_node(QTree        *tree,
                  gconstpointer key)
 {
-- 
2.34.1

We have been enforcing host page alignment for the non-R
fallback of MAX_RESERVED_VA, but failing to enforce for -R.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/main.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/linux-user/main.c b/linux-user/main.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp)
      */
     max_reserved_va = MAX_RESERVED_VA(cpu);
     if (reserved_va != 0) {
+        if (reserved_va % qemu_host_page_size) {
+            char *s = size_to_str(qemu_host_page_size);
+            fprintf(stderr, "Reserved virtual address not aligned mod %s\n", s);
+            g_free(s);
+            exit(EXIT_FAILURE);
+        }
         if (max_reserved_va && reserved_va > max_reserved_va) {
             fprintf(stderr, "Reserved virtual address too big\n");
             exit(EXIT_FAILURE);
-- 
2.34.1

Change the semantics to be the last byte of the guest va, rather
than the following byte.  This avoids some overflow conditions.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-all.h      | 11 ++++++++++-
 linux-user/arm/target_cpu.h |  2 +-
 bsd-user/main.c             | 10 +++-------
 bsd-user/mmap.c             |  4 ++--
 linux-user/elfload.c        | 21 +++++++++++----------
 linux-user/main.c           | 27 +++++++++++++--------------
 linux-user/mmap.c           |  4 ++--
 7 files changed, 42 insertions(+), 37 deletions(-)

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -XXX,XX +XXX,XX @@ static inline void tswap64s(uint64_t *s)
  */
 extern uintptr_t guest_base;
 extern bool have_guest_base;
+
+/*
+ * If non-zero, the guest virtual address space is a contiguous subset
+ * of the host virtual address space, i.e. '-R reserved_va' is in effect
+ * either from the command-line or by default.  The value is the last
+ * byte of the guest address space e.g. UINT32_MAX.
+ *
+ * If zero, the host and guest virtual address spaces are intermingled.
+ */
 extern unsigned long reserved_va;
 
 /*
@@ -XXX,XX +XXX,XX @@ extern unsigned long reserved_va;
 #define GUEST_ADDR_MAX_                                                 \
     ((MIN_CONST(TARGET_VIRT_ADDR_SPACE_BITS, TARGET_ABI_BITS) <= 32) ?  \
      UINT32_MAX : ~0ul)
-#define GUEST_ADDR_MAX    (reserved_va ? reserved_va - 1 : GUEST_ADDR_MAX_)
+#define GUEST_ADDR_MAX    (reserved_va ? : GUEST_ADDR_MAX_)
 
 #else
 
diff --git a/linux-user/arm/target_cpu.h b/linux-user/arm/target_cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/arm/target_cpu.h
+++ b/linux-user/arm/target_cpu.h
@@ -XXX,XX +XXX,XX @@ static inline unsigned long arm_max_reserved_va(CPUState *cs)
          * the high addresses.  Restrict linux-user to the
          * cached write-back RAM in the system map.
          */
-        return 0x80000000ul;
+        return 0x7ffffffful;
     } else {
         /*
          * We need to be able to map the commpage.
diff --git a/bsd-user/main.c b/bsd-user/main.c
index XXXXXXX..XXXXXXX 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -XXX,XX +XXX,XX @@ bool have_guest_base;
 # if HOST_LONG_BITS > TARGET_VIRT_ADDR_SPACE_BITS
 #  if TARGET_VIRT_ADDR_SPACE_BITS == 32 && \
       (TARGET_LONG_BITS == 32 || defined(TARGET_ABI32))
-/*
- * There are a number of places where we assign reserved_va to a variable
- * of type abi_ulong and expect it to fit.  Avoid the last page.
- */
-#   define MAX_RESERVED_VA  (0xfffffffful & TARGET_PAGE_MASK)
+#   define MAX_RESERVED_VA  0xfffffffful
 #  else
-#   define MAX_RESERVED_VA  (1ul << TARGET_VIRT_ADDR_SPACE_BITS)
+#   define MAX_RESERVED_VA  ((1ul << TARGET_VIRT_ADDR_SPACE_BITS) - 1)
 #  endif
 # else
 #  define MAX_RESERVED_VA  0
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
     envlist_free(envlist);
 
     if (reserved_va) {
-            mmap_next_start = reserved_va;
+        mmap_next_start = reserved_va + 1;
     }
 
     {
diff --git a/bsd-user/mmap.c b/bsd-user/mmap.c
index XXXXXXX..XXXXXXX 100644
--- a/bsd-user/mmap.c
+++ b/bsd-user/mmap.c
@@ -XXX,XX +XXX,XX @@ static abi_ulong mmap_find_vma_reserved(abi_ulong start, abi_ulong size,
     size = HOST_PAGE_ALIGN(size) + alignment;
     end_addr = start + size;
     if (end_addr > reserved_va) {
-        end_addr = reserved_va;
+        end_addr = reserved_va + 1;
     }
     addr = end_addr - qemu_host_page_size;
 
@@ -XXX,XX +XXX,XX @@ static abi_ulong mmap_find_vma_reserved(abi_ulong start, abi_ulong size,
             if (looped) {
                 return (abi_ulong)-1;
             }
-            end_addr = reserved_va;
+            end_addr = reserved_va + 1;
             addr = end_addr - qemu_host_page_size;
             looped = 1;
             continue;
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)
      * has specified -R reserved_va, which would trigger an assert().
      */
     if (reserved_va != 0 &&
-        TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE >= reserved_va) {
+        TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE - 1 > reserved_va) {
         error_report("Cannot allocate vsyscall page");
         exit(EXIT_FAILURE);
     }
@@ -XXX,XX +XXX,XX @@ static void pgb_have_guest_base(const char *image_name, abi_ulong guest_loaddr,
 
     /* Sanity check the guest binary. */
     if (reserved_va) {
-        if (guest_hiaddr > reserved_va) {
+        if (guest_hiaddr - 1 > reserved_va) {
             error_report("%s: requires more than reserved virtual "
                          "address space (0x%" PRIx64 " > 0x%lx)",
-                         image_name, (uint64_t)guest_hiaddr, reserved_va);
+                         image_name, (uint64_t)guest_hiaddr - 1,
+                         reserved_va);
             exit(EXIT_FAILURE);
         }
     } else {
@@ -XXX,XX +XXX,XX @@ static void pgb_have_guest_base(const char *image_name, abi_ulong guest_loaddr,
     if (reserved_va) {
         guest_loaddr = (guest_base >= mmap_min_addr ? 0
                         : mmap_min_addr - guest_base);
-        guest_hiaddr = reserved_va;
+        guest_hiaddr = reserved_va + 1;
     }
 
     /* Reserve the address space for the binary, or reserved_va. */
@@ -XXX,XX +XXX,XX @@ static void pgb_reserved_va(const char *image_name, abi_ulong guest_loaddr,
     int flags = MAP_ANONYMOUS | MAP_PRIVATE | MAP_NORESERVE;
     void *addr, *test;
 
-    if (guest_hiaddr > reserved_va) {
+    if (guest_hiaddr - 1 > reserved_va) {
         error_report("%s: requires more than reserved virtual "
                      "address space (0x%" PRIx64 " > 0x%lx)",
-                     image_name, (uint64_t)guest_hiaddr, reserved_va);
+                     image_name, (uint64_t)guest_hiaddr - 1, reserved_va);
         exit(EXIT_FAILURE);
     }
 
     /* Widen the "image" to the entire reserved address space. */
-    pgb_static(image_name, 0, reserved_va, align);
+    pgb_static(image_name, 0, reserved_va + 1, align);
 
     /* osdep.h defines this as 0 if it's missing */
     flags |= MAP_FIXED_NOREPLACE;
@@ -XXX,XX +XXX,XX @@ static void pgb_reserved_va(const char *image_name, abi_ulong guest_loaddr,
     /* Reserve the memory on the host. */
     assert(guest_base != 0);
     test = g2h_untagged(0);
-    addr = mmap(test, reserved_va, PROT_NONE, flags, -1, 0);
+    addr = mmap(test, reserved_va + 1, PROT_NONE, flags, -1, 0);
     if (addr == MAP_FAILED || addr != test) {
         error_report("Unable to reserve 0x%lx bytes of virtual address "
                      "space at %p (%s) for use as guest address space (check your "
                      "virtual memory ulimit setting, min_mmap_addr or reserve less "
-                     "using -R option)", reserved_va, test, strerror(errno));
+                     "using -R option)", reserved_va + 1, test, strerror(errno));
         exit(EXIT_FAILURE);
     }
 
     qemu_log_mask(CPU_LOG_PAGE, "%s: base @ %p for %lu bytes\n",
-                  __func__, addr, reserved_va);
+                  __func__, addr, reserved_va + 1);
 }
 
 void probe_guest_base(const char *image_name, abi_ulong guest_loaddr,
diff --git a/linux-user/main.c b/linux-user/main.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -XXX,XX +XXX,XX @@ static const char *last_log_filename;
 # if HOST_LONG_BITS > TARGET_VIRT_ADDR_SPACE_BITS
 #  if TARGET_VIRT_ADDR_SPACE_BITS == 32 && \
       (TARGET_LONG_BITS == 32 || defined(TARGET_ABI32))
-/* There are a number of places where we assign reserved_va to a variable
-   of type abi_ulong and expect it to fit.  Avoid the last page.  */
-#   define MAX_RESERVED_VA(CPU)  (0xfffffffful & TARGET_PAGE_MASK)
+#   define MAX_RESERVED_VA(CPU)  0xfffffffful
 #  else
-#   define MAX_RESERVED_VA(CPU)  (1ul << TARGET_VIRT_ADDR_SPACE_BITS)
+#   define MAX_RESERVED_VA(CPU)  ((1ul << TARGET_VIRT_ADDR_SPACE_BITS) - 1)
 #  endif
 # else
 #  define MAX_RESERVED_VA(CPU)  0
@@ -XXX,XX +XXX,XX @@ static void handle_arg_reserved_va(const char *arg)
 {
     char *p;
     int shift = 0;
-    reserved_va = strtoul(arg, &p, 0);
+    unsigned long val;
+
+    val = strtoul(arg, &p, 0);
     switch (*p) {
     case 'k':
     case 'K':
@@ -XXX,XX +XXX,XX @@ static void handle_arg_reserved_va(const char *arg)
         break;
     }
     if (shift) {
-        unsigned long unshifted = reserved_va;
+        unsigned long unshifted = val;
         p++;
-        reserved_va <<= shift;
-        if (reserved_va >> shift != unshifted) {
+        val <<= shift;
+        if (val >> shift != unshifted) {
             fprintf(stderr, "Reserved virtual address too big\n");
             exit(EXIT_FAILURE);
         }
@@ -XXX,XX +XXX,XX @@ static void handle_arg_reserved_va(const char *arg)
         fprintf(stderr, "Unrecognised -R size suffix '%s'\n", p);
         exit(EXIT_FAILURE);
     }
+    /* The representation is size - 1, with 0 remaining "default". */
+    reserved_va = val ? val - 1 : 0;
 }
 
 static void handle_arg_singlestep(const char *arg)
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp)
      */
     max_reserved_va = MAX_RESERVED_VA(cpu);
     if (reserved_va != 0) {
-        if (reserved_va % qemu_host_page_size) {
+        if ((reserved_va + 1) % qemu_host_page_size) {
             char *s = size_to_str(qemu_host_page_size);
             fprintf(stderr, "Reserved virtual address not aligned mod %s\n", s);
             g_free(s);
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp)
             exit(EXIT_FAILURE);
         }
     } else if (HOST_LONG_BITS == 64 && TARGET_VIRT_ADDR_SPACE_BITS <= 32) {
-        /*
-         * reserved_va must be aligned with the host page size
-         * as it is used with mmap()
-         */
-        reserved_va = max_reserved_va & qemu_host_page_mask;
+        /* MAX_RESERVED_VA + 1 is a large power of 2, so is aligned. */
+        reserved_va = max_reserved_va;
     }
 
     {
diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -XXX,XX +XXX,XX @@ static abi_ulong mmap_find_vma_reserved(abi_ulong start, abi_ulong size,
     end_addr = start + size;
     if (start > reserved_va - size) {
         /* Start at the top of the address space.  */
-        end_addr = ((reserved_va - size) & -align) + size;
+        end_addr = ((reserved_va + 1 - size) & -align) + size;
         looped = true;
     }
 
@@ -XXX,XX +XXX,XX @@ static abi_ulong mmap_find_vma_reserved(abi_ulong start, abi_ulong size,
                 return (abi_ulong)-1;
             }
             /* Re-start at the top of the address space.  */
-            addr = end_addr = ((reserved_va - size) & -align) + size;
+            addr = end_addr = ((reserved_va + 1 - size) & -align) + size;
             looped = true;
         } else {
             prot = page_get_flags(addr);
-- 
2.34.1

Pass the address of the last byte to be changed, rather than
the first address past the last byte.  This avoids overflow
when the last page of the address space is involved.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1528
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-all.h |  2 +-
 accel/tcg/user-exec.c  | 16 +++++++---------
 bsd-user/mmap.c        |  6 +++---
 linux-user/elfload.c   | 11 ++++++-----
 linux-user/mmap.c      | 16 ++++++++--------
 linux-user/syscall.c   |  4 ++--
 6 files changed, 27 insertions(+), 28 deletions(-)

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -XXX,XX +XXX,XX @@ typedef int (*walk_memory_regions_fn)(void *, target_ulong,
 int walk_memory_regions(void *, walk_memory_regions_fn);
 
 int page_get_flags(target_ulong address);
-void page_set_flags(target_ulong start, target_ulong end, int flags);
+void page_set_flags(target_ulong start, target_ulong last, int flags);
 void page_reset_target_data(target_ulong start, target_ulong end);
 int page_check_range(target_ulong start, target_ulong len, int flags);
 
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ static bool pageflags_set_clear(target_ulong start, target_ulong last,
  * The flag PAGE_WRITE_ORG is positioned automatically depending
  * on PAGE_WRITE.  The mmap_lock should already be held.
  */
-void page_set_flags(target_ulong start, target_ulong end, int flags)
+void page_set_flags(target_ulong start, target_ulong last, int flags)
 {
-    target_ulong last;
     bool reset = false;
     bool inval_tb = false;
 
     /* This function should never be called with addresses outside the
        guest address space.  If this assert fires, it probably indicates
        a missing call to h2g_valid.  */
-    assert(start < end);
-    assert(end - 1 <= GUEST_ADDR_MAX);
+    assert(start <= last);
+    assert(last <= GUEST_ADDR_MAX);
     /* Only set PAGE_ANON with new mappings. */
     assert(!(flags & PAGE_ANON) || (flags & PAGE_RESET));
     assert_memory_lock();
 
-    start = start & TARGET_PAGE_MASK;
-    end = TARGET_PAGE_ALIGN(end);
-    last = end - 1;
+    start &= TARGET_PAGE_MASK;
+    last |= ~TARGET_PAGE_MASK;
 
     if (!(flags & PAGE_VALID)) {
         flags = 0;
@@ -XXX,XX +XXX,XX @@ void page_set_flags(target_ulong start, target_ulong end, int flags)
     }
 
     if (!flags || reset) {
-        page_reset_target_data(start, end);
+        page_reset_target_data(start, last + 1);
         inval_tb |= pageflags_unset(start, last);
     }
     if (flags) {
@@ -XXX,XX +XXX,XX @@ void page_set_flags(target_ulong start, target_ulong end, int flags)
                                         ~(reset ? 0 : PAGE_STICKY));
     }
     if (inval_tb) {
-        tb_invalidate_phys_range(start, end);
+        tb_invalidate_phys_range(start, last + 1);
     }
 }
 
diff --git a/bsd-user/mmap.c b/bsd-user/mmap.c
index XXXXXXX..XXXXXXX 100644
--- a/bsd-user/mmap.c
+++ b/bsd-user/mmap.c
@@ -XXX,XX +XXX,XX @@ int target_mprotect(abi_ulong start, abi_ulong len, int prot)
         if (ret != 0)
             goto error;
     }
-    page_set_flags(start, start + len, prot | PAGE_VALID);
+    page_set_flags(start, start + len - 1, prot | PAGE_VALID);
     mmap_unlock();
     return 0;
 error:
@@ -XXX,XX +XXX,XX @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int prot,
         }
     }
  the_end1:
-    page_set_flags(start, start + len, prot | PAGE_VALID);
+    page_set_flags(start, start + len - 1, prot | PAGE_VALID);
  the_end:
 #ifdef DEBUG_MMAP
     printf("ret=0x" TARGET_ABI_FMT_lx "\n", start);
@@ -XXX,XX +XXX,XX @@ int target_munmap(abi_ulong start, abi_ulong len)
     }
 
     if (ret == 0) {
-        page_set_flags(start, start + len, 0);
+        page_set_flags(start, start + len - 1, 0);
     }
     mmap_unlock();
     return ret;
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)
         exit(EXIT_FAILURE);
     }
     page_set_flags(TARGET_VSYSCALL_PAGE,
-                   TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE,
+                   TARGET_VSYSCALL_PAGE | ~TARGET_PAGE_MASK,
                    PAGE_EXEC | PAGE_VALID);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)
         exit(EXIT_FAILURE);
     }
 
-    page_set_flags(commpage, commpage + qemu_host_page_size,
+    page_set_flags(commpage, commpage | ~qemu_host_page_mask,
                    PAGE_READ | PAGE_EXEC | PAGE_VALID);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)
         exit(EXIT_FAILURE);
     }
 
-    page_set_flags(LO_COMMPAGE, LO_COMMPAGE + TARGET_PAGE_SIZE,
+    page_set_flags(LO_COMMPAGE, LO_COMMPAGE | ~TARGET_PAGE_MASK,
                    PAGE_READ | PAGE_EXEC | PAGE_VALID);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)
      * and implement syscalls.  Here, simply mark the page executable.
      * Special case the entry points during translation (see do_page_zero).
      */
-    page_set_flags(LO_COMMPAGE, LO_COMMPAGE + TARGET_PAGE_SIZE,
+    page_set_flags(LO_COMMPAGE, LO_COMMPAGE | ~TARGET_PAGE_MASK,
                    PAGE_EXEC | PAGE_VALID);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static void zero_bss(abi_ulong elf_bss, abi_ulong last_bss, int prot)
 
     /* Ensure that the bss page(s) are valid */
     if ((page_get_flags(last_bss-1) & prot) != prot) {
-        page_set_flags(elf_bss & TARGET_PAGE_MASK, last_bss, prot | PAGE_VALID);
+        page_set_flags(elf_bss & TARGET_PAGE_MASK, last_bss - 1,
+                       prot | PAGE_VALID);
     }
 
     if (host_start < host_map_start) {
diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -XXX,XX +XXX,XX @@ int target_mprotect(abi_ulong start, abi_ulong len, int target_prot)
         }
     }
 
-    page_set_flags(start, start + len, page_flags);
+    page_set_flags(start, start + len - 1, page_flags);
     ret = 0;
 
 error:
@@ -XXX,XX +XXX,XX @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
     }
     page_flags |= PAGE_RESET;
     if (passthrough_start == passthrough_end) {
-        page_set_flags(start, start + len, page_flags);
+        page_set_flags(start, start + len - 1, page_flags);
     } else {
         if (start < passthrough_start) {
-            page_set_flags(start, passthrough_start, page_flags);
+            page_set_flags(start, passthrough_start - 1, page_flags);
         }
-        page_set_flags(passthrough_start, passthrough_end,
+        page_set_flags(passthrough_start, passthrough_end - 1,
                        page_flags | PAGE_PASSTHROUGH);
         if (passthrough_end < start + len) {
-            page_set_flags(passthrough_end, start + len, page_flags);
+            page_set_flags(passthrough_end, start + len - 1, page_flags);
         }
     }
  the_end:
@@ -XXX,XX +XXX,XX @@ int target_munmap(abi_ulong start, abi_ulong len)
     }
 
     if (ret == 0) {
-        page_set_flags(start, start + len, 0);
+        page_set_flags(start, start + len - 1, 0);
     }
     mmap_unlock();
     return ret;
@@ -XXX,XX +XXX,XX @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
     } else {
         new_addr = h2g(host_addr);
         prot = page_get_flags(old_addr);
-        page_set_flags(old_addr, old_addr + old_size, 0);
-        page_set_flags(new_addr, new_addr + new_size,
+        page_set_flags(old_addr, old_addr + old_size - 1, 0);
+        page_set_flags(new_addr, new_addr + new_size - 1,
                        prot | PAGE_VALID | PAGE_RESET);
     }
     mmap_unlock();
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -XXX,XX +XXX,XX @@ static inline abi_ulong do_shmat(CPUArchState *cpu_env,
     }
     raddr=h2g((unsigned long)host_raddr);
 
-    page_set_flags(raddr, raddr + shm_info.shm_segsz,
+    page_set_flags(raddr, raddr + shm_info.shm_segsz - 1,
                    PAGE_VALID | PAGE_RESET | PAGE_READ |
                    (shmflg & SHM_RDONLY ? 0 : PAGE_WRITE));
 
@@ -XXX,XX +XXX,XX @@ static inline abi_long do_shmdt(abi_ulong shmaddr)
     for (i = 0; i < N_SHM_REGIONS; ++i) {
         if (shm_regions[i].in_use && shm_regions[i].start == shmaddr) {
             shm_regions[i].in_use = false;
-            page_set_flags(shmaddr, shmaddr + shm_regions[i].size, 0);
+            page_set_flags(shmaddr, shmaddr + shm_regions[i].size - 1, 0);
             break;
         }
     }
-- 
2.34.1

Pass the address of the last byte to be changed, rather than
the first address past the last byte.  This avoids overflow
when the last page of the address space is involved.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-all.h |  2 +-
 accel/tcg/user-exec.c  | 11 +++++------
 linux-user/mmap.c      |  2 +-
 3 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -XXX,XX +XXX,XX @@ int walk_memory_regions(void *, walk_memory_regions_fn);
 
 int page_get_flags(target_ulong address);
 void page_set_flags(target_ulong start, target_ulong last, int flags);
-void page_reset_target_data(target_ulong start, target_ulong end);
+void page_reset_target_data(target_ulong start, target_ulong last);
 int page_check_range(target_ulong start, target_ulong len, int flags);
 
 /**
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ void page_set_flags(target_ulong start, target_ulong last, int flags)
     }
 
     if (!flags || reset) {
-        page_reset_target_data(start, last + 1);
+        page_reset_target_data(start, last);
         inval_tb |= pageflags_unset(start, last);
     }
     if (flags) {
@@ -XXX,XX +XXX,XX @@ typedef struct TargetPageDataNode {
 
 static IntervalTreeRoot targetdata_root;
 
-void page_reset_target_data(target_ulong start, target_ulong end)
+void page_reset_target_data(target_ulong start, target_ulong last)
 {
     IntervalTreeNode *n, *next;
-    target_ulong last;
 
     assert_memory_lock();
 
-    start = start & TARGET_PAGE_MASK;
-    last = TARGET_PAGE_ALIGN(end) - 1;
+    start &= TARGET_PAGE_MASK;
+    last |= ~TARGET_PAGE_MASK;
 
     for (n = interval_tree_iter_first(&targetdata_root, start, last),
          next = n ? interval_tree_iter_next(n, start, last) : NULL;
@@ -XXX,XX +XXX,XX @@ void *page_get_target_data(target_ulong address)
     return t->data[(page - region) >> TARGET_PAGE_BITS];
 }
 #else
-void page_reset_target_data(target_ulong start, target_ulong end) { }
+void page_reset_target_data(target_ulong start, target_ulong last) { }
 #endif /* TARGET_PAGE_DATA_SIZE */
 
 /* The softmmu versions of these helpers are in cputlb.c.  */
diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -XXX,XX +XXX,XX @@ abi_long target_madvise(abi_ulong start, abi_ulong len_in, int advice)
         if (can_passthrough_madvise(start, end)) {
             ret = get_errno(madvise(g2h_untagged(start), len, advice));
             if ((advice == MADV_DONTNEED) && (ret == 0)) {
-                page_reset_target_data(start, start + len);
+                page_reset_target_data(start, start + len - 1);
             }
         }
     }
-- 
2.34.1

Pass the address of the last byte to be changed, rather than
the first address past the last byte.  This avoids overflow
when the last page of the address space is involved.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tb-maint.c | 28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -XXX,XX +XXX,XX @@ static void tb_remove(TranslationBlock *tb)
 }
 
 /* TODO: For now, still shared with translate-all.c for system mode. */
-#define PAGE_FOR_EACH_TB(start, end, pagedesc, T, N)    \
-    for (T = foreach_tb_first(start, end),              \
-         N = foreach_tb_next(T, start, end);            \
+#define PAGE_FOR_EACH_TB(start, last, pagedesc, T, N)   \
+    for (T = foreach_tb_first(start, last),             \
+         N = foreach_tb_next(T, start, last);           \
          T != NULL;                                     \
-         T = N, N = foreach_tb_next(N, start, end))
+         T = N, N = foreach_tb_next(N, start, last))
 
 typedef TranslationBlock *PageForEachNext;
 
 static PageForEachNext foreach_tb_first(tb_page_addr_t start,
-                                        tb_page_addr_t end)
+                                        tb_page_addr_t last)
 {
-    IntervalTreeNode *n = interval_tree_iter_first(&tb_root, start, end - 1);
+    IntervalTreeNode *n = interval_tree_iter_first(&tb_root, start, last);
     return n ? container_of(n, TranslationBlock, itree) : NULL;
 }
 
 static PageForEachNext foreach_tb_next(PageForEachNext tb,
                                        tb_page_addr_t start,
-                                       tb_page_addr_t end)
+                                       tb_page_addr_t last)
 {
     IntervalTreeNode *n;
 
     if (tb) {
-        n = interval_tree_iter_next(&tb->itree, start, end - 1);
+        n = interval_tree_iter_next(&tb->itree, start, last);
         if (n) {
             return container_of(n, TranslationBlock, itree);
         }
@@ -XXX,XX +XXX,XX @@ struct page_collection {
 };
 
 typedef int PageForEachNext;
-#define PAGE_FOR_EACH_TB(start, end, pagedesc, tb, n) \
+#define PAGE_FOR_EACH_TB(start, last, pagedesc, tb, n) \
     TB_FOR_EACH_TAGGED((pagedesc)->first_tb, tb, n, page_next)
 
 #ifdef CONFIG_DEBUG_TCG
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t end)
 {
     TranslationBlock *tb;
     PageForEachNext n;
+    tb_page_addr_t last = end - 1;
 
     assert_memory_lock();
 
-    PAGE_FOR_EACH_TB(start, end, unused, tb, n) {
+    PAGE_FOR_EACH_TB(start, last, unused, tb, n) {
         tb_phys_invalidate__locked(tb);
     }
 }
@@ -XXX,XX +XXX,XX @@ bool tb_invalidate_phys_page_unwind(tb_page_addr_t addr, uintptr_t pc)
     bool current_tb_modified;
     TranslationBlock *tb;
     PageForEachNext n;
+    tb_page_addr_t last;
 
     /*
      * Without precise smc semantics, or when outside of a TB,
@@ -XXX,XX +XXX,XX @@ bool tb_invalidate_phys_page_unwind(tb_page_addr_t addr, uintptr_t pc)
     assert_memory_lock();
     current_tb = tcg_tb_lookup(pc);
 
+    last = addr | ~TARGET_PAGE_MASK;
     addr &= TARGET_PAGE_MASK;
     current_tb_modified = false;
 
-    PAGE_FOR_EACH_TB(addr, addr + TARGET_PAGE_SIZE, unused, tb, n) {
+    PAGE_FOR_EACH_TB(addr, last, unused, tb, n) {
         if (current_tb == tb &&
             (tb_cflags(current_tb) & CF_COUNT_MASK) != 1) {
             /*
@@ -XXX,XX +XXX,XX @@ tb_invalidate_phys_page_range__locked(struct page_collection *pages,
     bool current_tb_modified = false;
     TranslationBlock *current_tb = retaddr ? tcg_tb_lookup(retaddr) : NULL;
 #endif /* TARGET_HAS_PRECISE_SMC */
+    tb_page_addr_t last G_GNUC_UNUSED = end - 1;
 
     /*
      * We remove all the TBs in the range [start, end[.
      * XXX: see if in some cases it could be faster to invalidate all the code
      */
-    PAGE_FOR_EACH_TB(start, end, p, tb, n) {
+    PAGE_FOR_EACH_TB(start, last, p, tb, n) {
         /* NOTE: this is subtle as a TB may span two physical pages */
         if (n == 0) {
             /* NOTE: tb_end may be after the end of the page, but
-- 
2.34.1

Pass the address of the last byte to be changed, rather than
the first address past the last byte.  This avoids overflow
when the last page of the address space is involved.

Fixes a bug in the loop comparision where "<= end" would lock
one more page than required.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tb-maint.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -XXX,XX +XXX,XX @@ static gint tb_page_addr_cmp(gconstpointer ap, gconstpointer bp, gpointer udata)
 }
 
 /*
- * Lock a range of pages ([@start,@end[) as well as the pages of all
+ * Lock a range of pages ([@start,@last]) as well as the pages of all
  * intersecting TBs.
  * Locking order: acquire locks in ascending order of page index.
  */
 static struct page_collection *page_collection_lock(tb_page_addr_t start,
-                                                    tb_page_addr_t end)
+                                                    tb_page_addr_t last)
 {
     struct page_collection *set = g_malloc(sizeof(*set));
     tb_page_addr_t index;
     PageDesc *pd;
 
     start >>= TARGET_PAGE_BITS;
-    end   >>= TARGET_PAGE_BITS;
-    g_assert(start <= end);
+    last >>= TARGET_PAGE_BITS;
+    g_assert(start <= last);
 
     set->tree = q_tree_new_full(tb_page_addr_cmp, NULL, NULL,
                                 page_entry_destroy);
@@ -XXX,XX +XXX,XX @@ static struct page_collection *page_collection_lock(tb_page_addr_t start,
  retry:
     q_tree_foreach(set->tree, page_entry_lock, NULL);
 
-    for (index = start; index <= end; index++) {
+    for (index = start; index <= last; index++) {
         TranslationBlock *tb;
         PageForEachNext n;
 
@@ -XXX,XX +XXX,XX @@ tb_invalidate_phys_page_range__locked(struct page_collection *pages,
 void tb_invalidate_phys_page(tb_page_addr_t addr)
 {
     struct page_collection *pages;
-    tb_page_addr_t start, end;
+    tb_page_addr_t start, last;
     PageDesc *p;
 
     p = page_find(addr >> TARGET_PAGE_BITS);
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_page(tb_page_addr_t addr)
     }
 
     start = addr & TARGET_PAGE_MASK;
-    end = start + TARGET_PAGE_SIZE;
-    pages = page_collection_lock(start, end);
-    tb_invalidate_phys_page_range__locked(pages, p, start, end, 0);
+    last = addr | ~TARGET_PAGE_MASK;
+    pages = page_collection_lock(start, last);
+    tb_invalidate_phys_page_range__locked(pages, p, start, last + 1, 0);
     page_collection_unlock(pages);
 }
 
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t end)
     struct page_collection *pages;
     tb_page_addr_t next;
 
-    pages = page_collection_lock(start, end);
+    pages = page_collection_lock(start, end - 1);
     for (next = (start & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
          start < end;
          start = next, next += TARGET_PAGE_SIZE) {
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_range_fast(ram_addr_t ram_addr,
 {
     struct page_collection *pages;
 
-    pages = page_collection_lock(ram_addr, ram_addr + size);
+    pages = page_collection_lock(ram_addr, ram_addr + size - 1);
     tb_invalidate_phys_page_fast__locked(pages, ram_addr, size, retaddr);
     page_collection_unlock(pages);
 }
-- 
2.34.1

Pass the address of the last byte to be changed, rather than
the first address past the last byte.  This avoids overflow
when the last page of the address space is involved.

Properly truncate tb_last to the end of the page; the comment about
tb_end being past the end of the page being ok is not correct,
considering overflow.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tb-maint.c | 26 ++++++++++++--------------
 1 file changed, 12 insertions(+), 14 deletions(-)

diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -XXX,XX +XXX,XX @@ bool tb_invalidate_phys_page_unwind(tb_page_addr_t addr, uintptr_t pc)
 static void
 tb_invalidate_phys_page_range__locked(struct page_collection *pages,
                                       PageDesc *p, tb_page_addr_t start,
-                                      tb_page_addr_t end,
+                                      tb_page_addr_t last,
                                       uintptr_t retaddr)
 {
     TranslationBlock *tb;
-    tb_page_addr_t tb_start, tb_end;
     PageForEachNext n;
 #ifdef TARGET_HAS_PRECISE_SMC
     bool current_tb_modified = false;
     TranslationBlock *current_tb = retaddr ? tcg_tb_lookup(retaddr) : NULL;
 #endif /* TARGET_HAS_PRECISE_SMC */
-    tb_page_addr_t last G_GNUC_UNUSED = end - 1;
 
     /*
-     * We remove all the TBs in the range [start, end[.
+     * We remove all the TBs in the range [start, last].
      * XXX: see if in some cases it could be faster to invalidate all the code
      */
     PAGE_FOR_EACH_TB(start, last, p, tb, n) {
+        tb_page_addr_t tb_start, tb_last;
+
         /* NOTE: this is subtle as a TB may span two physical pages */
+        tb_start = tb_page_addr0(tb);
+        tb_last = tb_start + tb->size - 1;
         if (n == 0) {
-            /* NOTE: tb_end may be after the end of the page, but
-               it is not a problem */
-            tb_start = tb_page_addr0(tb);
-            tb_end = tb_start + tb->size;
+            tb_last = MIN(tb_last, tb_start | ~TARGET_PAGE_MASK);
         } else {
             tb_start = tb_page_addr1(tb);
-            tb_end = tb_start + ((tb_page_addr0(tb) + tb->size)
-                                 & ~TARGET_PAGE_MASK);
+            tb_last = tb_start + (tb_last & ~TARGET_PAGE_MASK);
         }
-        if (!(tb_end <= start || tb_start >= end)) {
+        if (!(tb_last < start || tb_start > last)) {
 #ifdef TARGET_HAS_PRECISE_SMC
             if (current_tb == tb &&
                 (tb_cflags(current_tb) & CF_COUNT_MASK) != 1) {
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_page(tb_page_addr_t addr)
     start = addr & TARGET_PAGE_MASK;
     last = addr | ~TARGET_PAGE_MASK;
     pages = page_collection_lock(start, last);
-    tb_invalidate_phys_page_range__locked(pages, p, start, last + 1, 0);
+    tb_invalidate_phys_page_range__locked(pages, p, start, last, 0);
     page_collection_unlock(pages);
 }
 
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t end)
             continue;
         }
         assert_page_locked(pd);
-        tb_invalidate_phys_page_range__locked(pages, pd, start, bound, 0);
+        tb_invalidate_phys_page_range__locked(pages, pd, start, bound - 1, 0);
     }
     page_collection_unlock(pages);
 }
@@ -XXX,XX +XXX,XX @@ static void tb_invalidate_phys_page_fast__locked(struct page_collection *pages,
     }
 
     assert_page_locked(p);
-    tb_invalidate_phys_page_range__locked(pages, p, start, start + len, ra);
+    tb_invalidate_phys_page_range__locked(pages, p, start, start + len - 1, ra);
 }
 
 /*
-- 
2.34.1

Pass the address of the last byte to be changed, rather than
the first address past the last byte.  This avoids overflow
when the last page of the address space is involved.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/exec-all.h   |  2 +-
 accel/tcg/tb-maint.c      | 31 ++++++++++++++++---------------
 accel/tcg/translate-all.c |  2 +-
 accel/tcg/user-exec.c     |  2 +-
 softmmu/physmem.c         |  2 +-
 5 files changed, 20 insertions(+), 19 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_addr(target_ulong addr);
 void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs);
 #endif
 void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr);
-void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t end);
+void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t last);
 void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr);
 
 /* GETPC is the true target of the return instruction that we'll execute.  */
diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
  * Called with mmap_lock held for user-mode emulation.
  * NOTE: this function must not be called while a TB is running.
  */
-void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t end)
+void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t last)
 {
     TranslationBlock *tb;
     PageForEachNext n;
-    tb_page_addr_t last = end - 1;
 
     assert_memory_lock();
 
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t end)
  */
 void tb_invalidate_phys_page(tb_page_addr_t addr)
 {
-    tb_page_addr_t start, end;
+    tb_page_addr_t start, last;
 
     start = addr & TARGET_PAGE_MASK;
-    end = start + TARGET_PAGE_SIZE;
-    tb_invalidate_phys_range(start, end);
+    last = addr | ~TARGET_PAGE_MASK;
+    tb_invalidate_phys_range(start, last);
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_page(tb_page_addr_t addr)
 
 /*
  * Invalidate all TBs which intersect with the target physical address range
- * [start;end[. NOTE: start and end may refer to *different* physical pages.
+ * [start;last]. NOTE: start and end may refer to *different* physical pages.
  * 'is_cpu_write_access' should be true if called from a real cpu write
  * access: the virtual CPU will exit the current TB if code is modified inside
  * this TB.
  */
-void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t end)
+void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t last)
 {
     struct page_collection *pages;
-    tb_page_addr_t next;
+    tb_page_addr_t index, index_last;
 
-    pages = page_collection_lock(start, end - 1);
-    for (next = (start & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
-         start < end;
-         start = next, next += TARGET_PAGE_SIZE) {
-        PageDesc *pd = page_find(start >> TARGET_PAGE_BITS);
-        tb_page_addr_t bound = MIN(next, end);
+    pages = page_collection_lock(start, last);
+
+    index_last = last >> TARGET_PAGE_BITS;
+    for (index = start >> TARGET_PAGE_BITS; index <= index_last; index++) {
+        PageDesc *pd = page_find(index);
+        tb_page_addr_t bound;
 
         if (pd == NULL) {
             continue;
         }
         assert_page_locked(pd);
-        tb_invalidate_phys_page_range__locked(pages, pd, start, bound - 1, 0);
+        bound = (index << TARGET_PAGE_BITS) | ~TARGET_PAGE_MASK;
+        bound = MIN(bound, last);
+        tb_invalidate_phys_page_range__locked(pages, pd, start, bound, 0);
     }
     page_collection_unlock(pages);
 }
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ void tb_check_watchpoint(CPUState *cpu, uintptr_t retaddr)
         cpu_get_tb_cpu_state(env, &pc, &cs_base, &flags);
         addr = get_page_addr_code(env, pc);
         if (addr != -1) {
-            tb_invalidate_phys_range(addr, addr + 1);
+            tb_invalidate_phys_range(addr, addr);
         }
     }
 }
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ void page_set_flags(target_ulong start, target_ulong last, int flags)
                                         ~(reset ? 0 : PAGE_STICKY));
     }
     if (inval_tb) {
-        tb_invalidate_phys_range(start, last + 1);
+        tb_invalidate_phys_range(start, last);
     }
 }
 
diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -XXX,XX +XXX,XX @@ static void invalidate_and_set_dirty(MemoryRegion *mr, hwaddr addr,
     }
     if (dirty_log_mask & (1 << DIRTY_MEMORY_CODE)) {
         assert(tcg_enabled());
-        tb_invalidate_phys_range(addr, addr + length);
+        tb_invalidate_phys_range(addr, addr + length - 1);
         dirty_log_mask &= ~(1 << DIRTY_MEMORY_CODE);
     }
     cpu_physical_memory_set_dirty_range(addr, length, dirty_log_mask);
-- 
2.34.1

User setting of -R reserved_va can lead to an assertion
failure in page_set_flags.  Sanity check the value of
reserved_va and print an error message instead.  Do not
allocate a commpage at all for m-profile cpus.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 37 +++++++++++++++++++++++++++----------
 1 file changed, 27 insertions(+), 10 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ enum {
 
 static bool init_guest_commpage(void)
 {
-    abi_ptr commpage = HI_COMMPAGE & -qemu_host_page_size;
-    void *want = g2h_untagged(commpage);
-    void *addr = mmap(want, qemu_host_page_size, PROT_READ | PROT_WRITE,
-                      MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
+    ARMCPU *cpu = ARM_CPU(thread_cpu);
+    abi_ptr want = HI_COMMPAGE & TARGET_PAGE_MASK;
+    abi_ptr addr;
 
-    if (addr == MAP_FAILED) {
+    /*
+     * M-profile allocates maximum of 2GB address space, so can never
+     * allocate the commpage.  Skip it.
+     */
+    if (arm_feature(&cpu->env, ARM_FEATURE_M)) {
+        return true;
+    }
+
+    /*
+     * If reserved_va does not cover the commpage, we get an assert
+     * in page_set_flags.  Produce an intelligent error instead.
+     */
+    if (reserved_va != 0 && want + TARGET_PAGE_SIZE - 1 > reserved_va) {
+        error_report("Allocating guest commpage: -R 0x%" PRIx64 " too small",
+                     (uint64_t)reserved_va + 1);
+        exit(EXIT_FAILURE);
+    }
+
+    addr = target_mmap(want, TARGET_PAGE_SIZE, PROT_READ | PROT_WRITE,
+                       MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
+
+    if (addr == -1) {
         perror("Allocating guest commpage");
         exit(EXIT_FAILURE);
     }
@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)
     }
 
     /* Set kernel helper versions; rest of page is 0.  */
-    __put_user(5, (uint32_t *)g2h_untagged(0xffff0ffcu));
+    put_user_u32(5, 0xffff0ffcu);
 
-    if (mprotect(addr, qemu_host_page_size, PROT_READ)) {
+    if (target_mprotect(addr, qemu_host_page_size, PROT_READ | PROT_EXEC)) {
         perror("Protecting guest commpage");
         exit(EXIT_FAILURE);
     }
-
-    page_set_flags(commpage, commpage | ~qemu_host_page_mask,
-                   PAGE_READ | PAGE_EXEC | PAGE_VALID);
     return true;
 }
 
-- 
2.34.1

Merge the first set of reviewed patches from my queue.

The following changes since commit 6dd06214892d71cbbdd25daed7693e58afcb1093:

Merge tag 'pull-hex-20230421' of https://github.com/quic/qemu into staging (2023-04-22 08:31:38 +0100)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20230423

for you to fetch changes up to 3ea9be33400f14305565a9a094cb6031c07183d5:

tcg/riscv: Conditionalize tcg_out_exts_i32_i64 (2023-04-23 08:46:45 +0100)

----------------------------------------------------------------
tcg cleanups:
  - Remove tcg_abort()
  - Split out extensions as known backend interfaces
  - Put the separate extensions together as tcg_out_movext
  - Introduce tcg_out_xchg as a backend interface
  - Clear TCGLabelQemuLdst on allocation
  - Avoid redundant extensions for riscv

----------------------------------------------------------------
Richard Henderson (15):
      tcg: Replace if + tcg_abort with tcg_debug_assert
      tcg: Replace tcg_abort with g_assert_not_reached
      tcg: Split out tcg_out_ext8s
      tcg: Split out tcg_out_ext8u
      tcg: Split out tcg_out_ext16s
      tcg: Split out tcg_out_ext16u
      tcg: Split out tcg_out_ext32s
      tcg: Split out tcg_out_ext32u
      tcg: Split out tcg_out_exts_i32_i64
      tcg: Split out tcg_out_extu_i32_i64
      tcg: Split out tcg_out_extrl_i64_i32
      tcg: Introduce tcg_out_movext
      tcg: Introduce tcg_out_xchg
      tcg: Clear TCGLabelQemuLdst on allocation
      tcg/riscv: Conditionalize tcg_out_exts_i32_i64

include/tcg/tcg.h                |   6 --
 target/i386/tcg/translate.c      |  20 +++---
 target/s390x/tcg/translate.c     |   4 +-
 tcg/optimize.c                   |  10 ++-
 tcg/tcg.c                        | 135 +++++++++++++++++++++++++++++++++++----
 tcg/aarch64/tcg-target.c.inc     | 106 +++++++++++++++++++-----------
 tcg/arm/tcg-target.c.inc         |  93 +++++++++++++++++----------
 tcg/i386/tcg-target.c.inc        | 129 ++++++++++++++++++-------------------
 tcg/loongarch64/tcg-target.c.inc | 123 +++++++++++++----------------------
 tcg/mips/tcg-target.c.inc        |  94 +++++++++++++++++++--------
 tcg/ppc/tcg-target.c.inc         | 119 ++++++++++++++++++----------------
 tcg/riscv/tcg-target.c.inc       |  83 +++++++++++-------------
 tcg/s390x/tcg-target.c.inc       | 128 +++++++++++++++++--------------------
 tcg/sparc64/tcg-target.c.inc     | 117 +++++++++++++++++++++------------
 tcg/tcg-ldst.c.inc               |   1 +
 tcg/tci/tcg-target.c.inc         | 116 ++++++++++++++++++++++++++++++---
 16 files changed, 786 insertions(+), 498 deletions(-)

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg.c                 | 4 +---
 tcg/i386/tcg-target.c.inc | 8 +++-----
 2 files changed, 4 insertions(+), 8 deletions(-)

diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static TCGTemp *tcg_global_reg_new_internal(TCGContext *s, TCGType type,
 {
     TCGTemp *ts;
 
-    if (TCG_TARGET_REG_BITS == 32 && type != TCG_TYPE_I32) {
-        tcg_abort();
-    }
+    tcg_debug_assert(TCG_TARGET_REG_BITS == 64 || type == TCG_TYPE_I32);
 
     ts = tcg_global_alloc(s);
     ts->base_type = type;
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_addi(TCGContext *s, int reg, tcg_target_long val)
     }
 }
 
-/* Use SMALL != 0 to force a short forward branch.  */
-static void tcg_out_jxx(TCGContext *s, int opc, TCGLabel *l, int small)
+/* Set SMALL to force a short forward branch.  */
+static void tcg_out_jxx(TCGContext *s, int opc, TCGLabel *l, bool small)
 {
     int32_t val, val1;
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_jxx(TCGContext *s, int opc, TCGLabel *l, int small)
             }
             tcg_out8(s, val1);
         } else {
-            if (small) {
-                tcg_abort();
-            }
+            tcg_debug_assert(!small);
             if (opc == -1) {
                 tcg_out8(s, OPC_JMP_long);
                 tcg_out32(s, val - 5);
-- 
2.34.1

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg.h            |  6 ------
 target/i386/tcg/translate.c  | 20 ++++++++++----------
 target/s390x/tcg/translate.c |  4 ++--
 tcg/optimize.c               | 10 ++++------
 tcg/tcg.c                    |  8 ++++----
 tcg/aarch64/tcg-target.c.inc |  4 ++--
 tcg/arm/tcg-target.c.inc     |  2 +-
 tcg/i386/tcg-target.c.inc    | 14 +++++++-------
 tcg/mips/tcg-target.c.inc    | 14 +++++++-------
 tcg/ppc/tcg-target.c.inc     |  8 ++++----
 tcg/s390x/tcg-target.c.inc   |  8 ++++----
 tcg/sparc64/tcg-target.c.inc |  2 +-
 tcg/tci/tcg-target.c.inc     |  2 +-
 13 files changed, 47 insertions(+), 55 deletions(-)

diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ typedef struct TCGTargetOpDef {
     const char *args_ct_str[TCG_MAX_OP_ARGS];
 } TCGTargetOpDef;
 
-#define tcg_abort() \
-do {\
-    fprintf(stderr, "%s:%d: tcg fatal error\n", __FILE__, __LINE__);\
-    abort();\
-} while (0)
-
 bool tcg_op_supported(TCGOpcode op);
 
 void tcg_gen_callN(void *func, TCGTemp *ret, int nargs, TCGTemp **args);
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv gen_op_deposit_reg_v(DisasContext *s, MemOp ot, int reg, TCGv dest,
         break;
 #endif
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
     return cpu_regs[reg];
 }
@@ -XXX,XX +XXX,XX @@ static void gen_lea_v_seg(DisasContext *s, MemOp aflag, TCGv a0,
         }
         break;
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
 
     if (ovr_seg >= 0) {
@@ -XXX,XX +XXX,XX @@ static void gen_helper_in_func(MemOp ot, TCGv v, TCGv_i32 n)
         gen_helper_inl(v, cpu_env, n);
         break;
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void gen_helper_out_func(MemOp ot, TCGv_i32 v, TCGv_i32 n)
         gen_helper_outl(cpu_env, v, n);
         break;
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void gen_rotc_rm_T1(DisasContext *s, MemOp ot, int op1,
             break;
 #endif
         default:
-            tcg_abort();
+            g_assert_not_reached();
         }
     } else {
         switch (ot) {
@@ -XXX,XX +XXX,XX @@ static void gen_rotc_rm_T1(DisasContext *s, MemOp ot, int op1,
             break;
 #endif
         default:
-            tcg_abort();
+            g_assert_not_reached();
         }
     }
     /* store */
@@ -XXX,XX +XXX,XX @@ static AddressParts gen_lea_modrm_0(CPUX86State *env, DisasContext *s,
         break;
 
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
 
  done:
@@ -XXX,XX +XXX,XX @@ static inline uint32_t insn_get(CPUX86State *env, DisasContext *s, MemOp ot)
         ret = x86_ldl_code(env, s);
         break;
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
     return ret;
 }
@@ -XXX,XX +XXX,XX @@ static bool disas_insn(DisasContext *s, CPUState *cpu)
             gen_op_mov_reg_v(s, MO_16, R_EAX, s->T0);
             break;
         default:
-            tcg_abort();
+            g_assert_not_reached();
         }
         break;
     case 0x99: /* CDQ/CWD */
@@ -XXX,XX +XXX,XX @@ static bool disas_insn(DisasContext *s, CPUState *cpu)
             gen_op_mov_reg_v(s, MO_16, R_EDX, s->T0);
             break;
         default:
-            tcg_abort();
+            g_assert_not_reached();
         }
         break;
     case 0x1af: /* imul Gv, Ev */
diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static int get_mem_index(DisasContext *s)
     case PSW_ASC_HOME >> FLAG_MASK_PSW_SHIFT:
         return MMU_HOME_IDX;
     default:
-        tcg_abort();
+        g_assert_not_reached();
         break;
     }
 #endif
@@ -XXX,XX +XXX,XX @@ static void gen_op_calc_cc(DisasContext *s)
         gen_helper_calc_cc(cc_op, cpu_env, cc_op, cc_src, cc_dst, cc_vr);
         break;
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
 
     /* We now have cc in cc_op as constant */
diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static uint64_t do_constant_folding_2(TCGOpcode op, uint64_t x, uint64_t y)
         return (uint64_t)x % ((uint64_t)y ? : 1);
 
     default:
-        fprintf(stderr,
-                "Unrecognized operation %d in do_constant_folding.\n", op);
-        tcg_abort();
+        g_assert_not_reached();
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static bool do_constant_folding_cond_32(uint32_t x, uint32_t y, TCGCond c)
     case TCG_COND_GTU:
         return x > y;
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static bool do_constant_folding_cond_64(uint64_t x, uint64_t y, TCGCond c)
     case TCG_COND_GTU:
         return x > y;
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static bool do_constant_folding_cond_eq(TCGCond c)
     case TCG_COND_EQ:
         return 1;
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
 }
 
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static void temp_sync(TCGContext *s, TCGTemp *ts, TCGRegSet allocated_regs,
 
         case TEMP_VAL_DEAD:
         default:
-            tcg_abort();
+            g_assert_not_reached();
         }
         ts->mem_coherent = 1;
     }
@@ -XXX,XX +XXX,XX @@ static TCGReg tcg_reg_alloc(TCGContext *s, TCGRegSet required_regs,
         }
     }
 
-    tcg_abort();
+    g_assert_not_reached();
 }
 
 static TCGReg tcg_reg_alloc_pair(TCGContext *s, TCGRegSet required_regs,
@@ -XXX,XX +XXX,XX @@ static TCGReg tcg_reg_alloc_pair(TCGContext *s, TCGRegSet required_regs,
             }
         }
     }
-    tcg_abort();
+    g_assert_not_reached();
 }
 
 /* Make sure the temporary is in a register.  If needed, allocate the register
@@ -XXX,XX +XXX,XX @@ static void temp_load(TCGContext *s, TCGTemp *ts, TCGRegSet desired_regs,
         break;
     case TEMP_VAL_DEAD:
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
     set_temp_val_reg(s, ts, reg);
 }
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp memop, TCGType ext,
         tcg_out_ldst_r(s, I3312_LDRX, data_r, addr_r, otype, off_r);
         break;
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, MemOp memop,
         tcg_out_ldst_r(s, I3312_STRX, data_r, addr_r, otype, off_r);
         break;
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
 }
 
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
 }
 
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool patch_reloc(tcg_insn_unit *code_ptr, int type,
         tcg_patch8(code_ptr, value);
         break;
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_pushi(TCGContext *s, tcg_target_long val)
         tcg_out_opc(s, OPC_PUSH_Iv, 0, 0, 0);
         tcg_out32(s, val);
     } else {
-        tcg_abort();
+        g_assert_not_reached();
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void tgen_arithi(TCGContext *s, int c, int r0,
         return;
     }
 
-    tcg_abort();
+    g_assert_not_reached();
 }
 
 static void tcg_out_addi(TCGContext *s, int reg, tcg_target_long val)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_brcond2(TCGContext *s, const TCGArg *args,
                          label_this, small);
         break;
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
     tcg_out_label(s, label_next);
 }
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
         }
         break;
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
 
     /* Jump to the code corresponding to next IR of qemu_st */
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
             /* load bits 0..15 */
             tcg_out_modrm(s, OPC_MOVL_EvGv | P_DATA16, a2, a0);
         } else {
-            tcg_abort();
+            g_assert_not_reached();
         }
         break;
 
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
 
 #undef OP_32_64
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_setcond(TCGContext *s, TCGCond cond, TCGReg ret,
         break;
 
      default:
-         tcg_abort();
+         g_assert_not_reached();
          break;
      }
 }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_brcond(TCGContext *s, TCGCond cond, TCGReg arg1,
         break;
 
     default:
-        tcg_abort();
+        g_assert_not_reached();
         break;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
         }
         break;
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
     i = tcg_out_call_iarg_imm(s, i, oi);
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg lo, TCGReg hi,
         }
         break;
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, TCGReg lo, TCGReg hi,
         break;
 
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_unalign(TCGContext *s, TCGReg lo, TCGReg hi,
         break;
 
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
 }
 static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
 }
 
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_cmp(TCGContext *s, int cond, TCGArg arg1, TCGArg arg2,
         break;
 
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
     op |= BF(cr) | ((type == TCG_TYPE_I64) << 21);
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_setcond(TCGContext *s, TCGType type, TCGCond cond,
         break;
 
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_cmp2(TCGContext *s, const TCGArg *args,
         break;
 
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_exit_tb:   /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:   /* Always emitted via tcg_out_goto_tb.  */
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
 }
 
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp opc, TCGReg data,
         break;
 
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, MemOp opc, TCGReg data,
         break;
 
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
         tcg_out_mov(s, TCG_TYPE_I64, TCG_REG_R4, data_reg);
         break;
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
     tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_R5, oi);
     tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_R6, (uintptr_t)lb->raddr);
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
 }
 
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
 }
 
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
     default:
-        tcg_abort();
+        g_assert_not_reached();
     }
 }
 
-- 
2.34.1

We will need a backend interface for performing 8-bit sign-extend.
Use it in tcg_reg_alloc_op in the meantime.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg.c                        | 21 ++++++++++++++++-----
 tcg/aarch64/tcg-target.c.inc     | 11 +++++++----
 tcg/arm/tcg-target.c.inc         | 10 ++++------
 tcg/i386/tcg-target.c.inc        | 10 +++++-----
 tcg/loongarch64/tcg-target.c.inc | 11 ++++-------
 tcg/mips/tcg-target.c.inc        | 12 ++++++++----
 tcg/ppc/tcg-target.c.inc         | 10 ++++------
 tcg/riscv/tcg-target.c.inc       |  9 +++------
 tcg/s390x/tcg-target.c.inc       | 10 +++-------
 tcg/sparc64/tcg-target.c.inc     |  7 +++++++
 tcg/tci/tcg-target.c.inc         | 21 ++++++++++++++++++++-
 11 files changed, 81 insertions(+), 51 deletions(-)

diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ld(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg1,
 static bool tcg_out_mov(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg);
 static void tcg_out_movi(TCGContext *s, TCGType type,
                          TCGReg ret, tcg_target_long arg);
+static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg);
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg, TCGReg, tcg_target_long);
 static void tcg_out_exit_tb(TCGContext *s, uintptr_t arg);
 static void tcg_out_goto_tb(TCGContext *s, int which);
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     }
 
     /* emit instruction */
-    if (def->flags & TCG_OPF_VECTOR) {
-        tcg_out_vec_op(s, op->opc, TCGOP_VECL(op), TCGOP_VECE(op),
-                       new_args, const_args);
-    } else {
-        tcg_out_op(s, op->opc, new_args, const_args);
+    switch (op->opc) {
+    case INDEX_op_ext8s_i32:
+        tcg_out_ext8s(s, TCG_TYPE_I32, new_args[0], new_args[1]);
+        break;
+    case INDEX_op_ext8s_i64:
+        tcg_out_ext8s(s, TCG_TYPE_I64, new_args[0], new_args[1]);
+        break;
+    default:
+        if (def->flags & TCG_OPF_VECTOR) {
+            tcg_out_vec_op(s, op->opc, TCGOP_VECL(op), TCGOP_VECE(op),
+                           new_args, const_args);
+        } else {
+            tcg_out_op(s, op->opc, new_args, const_args);
+        }
+        break;
     }
 
     /* move the outputs in the correct register if needed */
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_sxt(TCGContext *s, TCGType ext, MemOp s_bits,
     tcg_out_sbfm(s, ext, rd, rn, 0, bits);
 }
 
+static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rn)
+{
+    tcg_out_sxt(s, type, MO_8, rd, rn);
+}
+
 static inline void tcg_out_uxt(TCGContext *s, MemOp s_bits,
                                TCGReg rd, TCGReg rn)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         }
         break;
 
-    case INDEX_op_ext8s_i64:
-    case INDEX_op_ext8s_i32:
-        tcg_out_sxt(s, ext, MO_8, a0, a1);
-        break;
     case INDEX_op_ext16s_i64:
     case INDEX_op_ext16s_i32:
         tcg_out_sxt(s, ext, MO_16, a0, a1);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
+    case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
+    case INDEX_op_ext8s_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_udiv(TCGContext *s, ARMCond cond,
     tcg_out32(s, 0x0730f010 | (cond << 28) | (rd << 16) | rn | (rm << 8));
 }
 
-static void tcg_out_ext8s(TCGContext *s, ARMCond cond, TCGReg rd, TCGReg rn)
+static void tcg_out_ext8s(TCGContext *s, TCGType t, TCGReg rd, TCGReg rn)
 {
     /* sxtb */
-    tcg_out32(s, 0x06af0070 | (cond << 28) | (rd << 12) | rn);
+    tcg_out32(s, 0x06af0070 | (COND_AL << 28) | (rd << 12) | rn);
 }
 
 static void __attribute__((unused))
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
     datahi = lb->datahi_reg;
     switch (opc & MO_SSIZE) {
     case MO_SB:
-        tcg_out_ext8s(s, COND_AL, datalo, TCG_REG_R0);
+        tcg_out_ext8s(s, TCG_TYPE_I32, datalo, TCG_REG_R0);
         break;
     case MO_SW:
         tcg_out_ext16s(s, COND_AL, datalo, TCG_REG_R0);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_bswap32(s, COND_AL, args[0], args[1]);
         break;
 
-    case INDEX_op_ext8s_i32:
-        tcg_out_ext8s(s, COND_AL, args[0], args[1]);
-        break;
     case INDEX_op_ext16s_i32:
         tcg_out_ext16s(s, COND_AL, args[0], args[1]);
         break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
+    case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_ext8u(TCGContext *s, int dest, int src)
     tcg_out_modrm(s, OPC_MOVZBL + P_REXB_RM, dest, src);
 }
 
-static void tcg_out_ext8s(TCGContext *s, int dest, int src, int rexw)
+static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg dest, TCGReg src)
 {
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
     /* movsbl */
     tcg_debug_assert(src < 4 || TCG_TARGET_REG_BITS == 64);
     tcg_out_modrm(s, OPC_MOVSBL + P_REXB_RM + rexw, dest, src);
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
     data_reg = l->datalo_reg;
     switch (opc & MO_SSIZE) {
     case MO_SB:
-        tcg_out_ext8s(s, data_reg, TCG_REG_EAX, rexw);
+        tcg_out_ext8s(s, l->type, data_reg, TCG_REG_EAX);
         break;
     case MO_SW:
         tcg_out_ext16s(s, data_reg, TCG_REG_EAX, rexw);
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_modrm(s, OPC_GRP3_Ev + rexw, EXT3_NOT, a0);
         break;
 
-    OP_32_64(ext8s):
-        tcg_out_ext8s(s, a0, a1, rexw);
-        break;
     OP_32_64(ext16s):
         tcg_out_ext16s(s, a0, a1, rexw);
         break;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
+    case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
+    case INDEX_op_ext8s_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32u(TCGContext *s, TCGReg ret, TCGReg arg)
     tcg_out_opc_bstrpick_d(s, ret, arg, 0, 31);
 }
 
-static void tcg_out_ext8s(TCGContext *s, TCGReg ret, TCGReg arg)
+static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg)
 {
     tcg_out_opc_sext_b(s, ret, arg);
 }
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 
     switch (opc & MO_SSIZE) {
     case MO_SB:
-        tcg_out_ext8s(s, l->datalo_reg, TCG_REG_A0);
+        tcg_out_ext8s(s, type, l->datalo_reg, TCG_REG_A0);
         break;
     case MO_SW:
         tcg_out_ext16s(s, l->datalo_reg, TCG_REG_A0);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_brcond(s, a2, a0, a1, arg_label(args[3]));
         break;
 
-    case INDEX_op_ext8s_i32:
-    case INDEX_op_ext8s_i64:
-        tcg_out_ext8s(s, a0, a1);
-        break;
-
     case INDEX_op_ext8u_i32:
     case INDEX_op_ext8u_i64:
         tcg_out_ext8u(s, a0, a1);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
+    case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
+    case INDEX_op_ext8s_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi(TCGContext *s, TCGType type,
     }
 }
 
+static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
+{
+    tcg_debug_assert(TCG_TARGET_HAS_ext8s_i32);
+    tcg_out_opc_reg(s, OPC_SEB, rd, TCG_REG_ZERO, rs);
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_not_i64:
         i1 = OPC_NOR;
         goto do_unary;
-    case INDEX_op_ext8s_i32:
-    case INDEX_op_ext8s_i64:
-        i1 = OPC_SEB;
-        goto do_unary;
     case INDEX_op_ext16s_i32:
     case INDEX_op_ext16s_i64:
         i1 = OPC_SEH;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
+    case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
+    case INDEX_op_ext8s_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_rlw(TCGContext *s, int op, TCGReg ra, TCGReg rs,
     tcg_out32(s, op | RA(ra) | RS(rs) | SH(sh) | MB(mb) | ME(me));
 }
 
-static inline void tcg_out_ext8s(TCGContext *s, TCGReg dst, TCGReg src)
+static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg dst, TCGReg src)
 {
     tcg_out32(s, EXTSB | RA(dst) | RS(src));
 }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ld8s_i32:
     case INDEX_op_ld8s_i64:
         tcg_out_mem_long(s, LBZ, LBZX, args[0], args[1], args[2]);
-        tcg_out_ext8s(s, args[0], args[0]);
+        tcg_out_ext8s(s, TCG_TYPE_REG, args[0], args[0]);
         break;
     case INDEX_op_ld16u_i32:
     case INDEX_op_ld16u_i64:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_qemu_st(s, args, true);
         break;
 
-    case INDEX_op_ext8s_i32:
-    case INDEX_op_ext8s_i64:
-        tcg_out_ext8s(s, args[0], args[1]);
-        break;
     case INDEX_op_ext16s_i32:
     case INDEX_op_ext16s_i64:
         tcg_out_ext16s(s, args[0], args[1]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_call:      /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:   /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:   /* Always emitted via tcg_out_goto_tb.  */
+    case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
+    case INDEX_op_ext8s_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32u(TCGContext *s, TCGReg ret, TCGReg arg)
     tcg_out_opc_imm(s, OPC_SRLI, ret, ret, 32);
 }
 
-static void tcg_out_ext8s(TCGContext *s, TCGReg ret, TCGReg arg)
+static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg)
 {
     tcg_out_opc_imm(s, OPC_SLLIW, ret, arg, 24);
     tcg_out_opc_imm(s, OPC_SRAIW, ret, ret, 24);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_ext32u(s, a0, a1);
         break;
 
-    case INDEX_op_ext8s_i32:
-    case INDEX_op_ext8s_i64:
-        tcg_out_ext8s(s, a0, a1);
-        break;
-
     case INDEX_op_ext16s_i32:
     case INDEX_op_ext16s_i64:
         tcg_out_ext16s(s, a0, a1);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
+    case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
+    case INDEX_op_ext8s_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_risbg(TCGContext *s, TCGReg dest, TCGReg src,
     tcg_out16(s, (ofs << 8) | (RIEf_RISBG & 0xff));
 }
 
-static void tgen_ext8s(TCGContext *s, TCGType type, TCGReg dest, TCGReg src)
+static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg dest, TCGReg src)
 {
     tcg_out_insn(s, RRE, LGBR, dest, src);
 }
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         }
         break;
 
-    case INDEX_op_ext8s_i32:
-        tgen_ext8s(s, TCG_TYPE_I32, args[0], args[1]);
-        break;
     case INDEX_op_ext16s_i32:
         tgen_ext16s(s, TCG_TYPE_I32, args[0], args[1]);
         break;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         }
         break;
 
-    case INDEX_op_ext8s_i64:
-        tgen_ext8s(s, TCG_TYPE_I64, args[0], args[1]);
-        break;
     case INDEX_op_ext16s_i64:
         tgen_ext16s(s, TCG_TYPE_I64, args[0], args[1]);
         break;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
+    case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
+    case INDEX_op_ext8s_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi(TCGContext *s, TCGType type,
     tcg_out_movi_int(s, type, ret, arg, false, TCG_REG_T2);
 }
 
+static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
+{
+    g_assert_not_reached();
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
+    case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
+    case INDEX_op_ext8s_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi(TCGContext *s, TCGType type,
     }
 }
 
+static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
+{
+    switch (type) {
+    case TCG_TYPE_I32:
+        tcg_debug_assert(TCG_TARGET_HAS_ext8s_i32);
+        tcg_out_op_rr(s, INDEX_op_ext8s_i32, rd, rs);
+        break;
+#if TCG_TARGET_REG_BITS == 64
+    case TCG_TYPE_I64:
+        tcg_debug_assert(TCG_TARGET_HAS_ext8s_i64);
+        tcg_out_op_rr(s, INDEX_op_ext8s_i64, rd, rs);
+        break;
+#endif
+    default:
+        g_assert_not_reached();
+    }
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
 
     CASE_32_64(neg)      /* Optional (TCG_TARGET_HAS_neg_*). */
     CASE_32_64(not)      /* Optional (TCG_TARGET_HAS_not_*). */
-    CASE_32_64(ext8s)    /* Optional (TCG_TARGET_HAS_ext8s_*). */
     CASE_32_64(ext8u)    /* Optional (TCG_TARGET_HAS_ext8u_*). */
     CASE_32_64(ext16s)   /* Optional (TCG_TARGET_HAS_ext16s_*). */
     CASE_32_64(ext16u)   /* Optional (TCG_TARGET_HAS_ext16u_*). */
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
+    case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
+    case INDEX_op_ext8s_i64:
     default:
         g_assert_not_reached();
     }
-- 
2.34.1

We will need a backend interface for performing 8-bit zero-extend.
Use it in tcg_reg_alloc_op in the meantime.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg.c                        |  5 +++++
 tcg/aarch64/tcg-target.c.inc     | 11 +++++++----
 tcg/arm/tcg-target.c.inc         | 12 +++++++++---
 tcg/i386/tcg-target.c.inc        |  7 +++----
 tcg/loongarch64/tcg-target.c.inc |  7 ++-----
 tcg/mips/tcg-target.c.inc        |  9 ++++++++-
 tcg/ppc/tcg-target.c.inc         |  7 +++++++
 tcg/riscv/tcg-target.c.inc       |  7 ++-----
 tcg/s390x/tcg-target.c.inc       | 14 +++++---------
 tcg/sparc64/tcg-target.c.inc     |  9 ++++++++-
 tcg/tci/tcg-target.c.inc         | 14 +++++++++++++-
 11 files changed, 69 insertions(+), 33 deletions(-)

diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_mov(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg);
 static void tcg_out_movi(TCGContext *s, TCGType type,
                          TCGReg ret, tcg_target_long arg);
 static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg);
+static void tcg_out_ext8u(TCGContext *s, TCGReg ret, TCGReg arg);
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg, TCGReg, tcg_target_long);
 static void tcg_out_exit_tb(TCGContext *s, uintptr_t arg);
 static void tcg_out_goto_tb(TCGContext *s, int which);
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_ext8s_i64:
         tcg_out_ext8s(s, TCG_TYPE_I64, new_args[0], new_args[1]);
         break;
+    case INDEX_op_ext8u_i32:
+    case INDEX_op_ext8u_i64:
+        tcg_out_ext8u(s, new_args[0], new_args[1]);
+        break;
     default:
         if (def->flags & TCG_OPF_VECTOR) {
             tcg_out_vec_op(s, op->opc, TCGOP_VECL(op), TCGOP_VECE(op),
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_uxt(TCGContext *s, MemOp s_bits,
     tcg_out_ubfm(s, 0, rd, rn, 0, bits);
 }
 
+static void tcg_out_ext8u(TCGContext *s, TCGReg rd, TCGReg rn)
+{
+    tcg_out_uxt(s, MO_8, rd, rn);
+}
+
 static void tcg_out_addsubi(TCGContext *s, int ext, TCGReg rd,
                             TCGReg rn, int64_t aimm)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext32s_i64:
         tcg_out_sxt(s, TCG_TYPE_I64, MO_32, a0, a1);
         break;
-    case INDEX_op_ext8u_i64:
-    case INDEX_op_ext8u_i32:
-        tcg_out_uxt(s, MO_8, a0, a1);
-        break;
     case INDEX_op_ext16u_i64:
     case INDEX_op_ext16u_i32:
         tcg_out_uxt(s, MO_16, a0, a1);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
     case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
     case INDEX_op_ext8s_i64:
+    case INDEX_op_ext8u_i32:
+    case INDEX_op_ext8u_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8s(TCGContext *s, TCGType t, TCGReg rd, TCGReg rn)
     tcg_out32(s, 0x06af0070 | (COND_AL << 28) | (rd << 12) | rn);
 }
 
+static void tcg_out_ext8u(TCGContext *s, TCGReg rd, TCGReg rn)
+{
+    tcg_out_dat_imm(s, COND_AL, ARITH_AND, rd, rn, 0xff);
+}
+
 static void __attribute__((unused))
-tcg_out_ext8u(TCGContext *s, ARMCond cond, TCGReg rd, TCGReg rn)
+tcg_out_ext8u_cond(TCGContext *s, ARMCond cond, TCGReg rd, TCGReg rn)
 {
     tcg_out_dat_imm(s, cond, ARITH_AND, rd, rn, 0xff);
 }
@@ -XXX,XX +XXX,XX @@ static TCGReg NAME(TCGContext *s, TCGReg argreg, ARGTYPE arg)              \
 
 DEFINE_TCG_OUT_ARG(tcg_out_arg_imm32, uint32_t, tcg_out_movi32,
     (tcg_out_movi32(s, COND_AL, TCG_REG_TMP, arg), arg = TCG_REG_TMP))
-DEFINE_TCG_OUT_ARG(tcg_out_arg_reg8, TCGReg, tcg_out_ext8u,
-    (tcg_out_ext8u(s, COND_AL, TCG_REG_TMP, arg), arg = TCG_REG_TMP))
+DEFINE_TCG_OUT_ARG(tcg_out_arg_reg8, TCGReg, tcg_out_ext8u_cond,
+    (tcg_out_ext8u_cond(s, COND_AL, TCG_REG_TMP, arg), arg = TCG_REG_TMP))
 DEFINE_TCG_OUT_ARG(tcg_out_arg_reg16, TCGReg, tcg_out_ext16u,
     (tcg_out_ext16u(s, COND_AL, TCG_REG_TMP, arg), arg = TCG_REG_TMP))
 DEFINE_TCG_OUT_ARG(tcg_out_arg_reg32, TCGReg, tcg_out_mov_reg, )
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
     case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
+    case INDEX_op_ext8u_i32:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_rolw_8(TCGContext *s, int reg)
     tcg_out_shifti(s, SHIFT_ROL + P_DATA16, reg, 8);
 }
 
-static inline void tcg_out_ext8u(TCGContext *s, int dest, int src)
+static void tcg_out_ext8u(TCGContext *s, TCGReg dest, TCGReg src)
 {
     /* movzbl */
     tcg_debug_assert(src < 4 || TCG_TARGET_REG_BITS == 64);
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     OP_32_64(ext16s):
         tcg_out_ext16s(s, a0, a1, rexw);
         break;
-    OP_32_64(ext8u):
-        tcg_out_ext8u(s, a0, a1);
-        break;
     OP_32_64(ext16u):
         tcg_out_ext16u(s, a0, a1);
         break;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
     case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
     case INDEX_op_ext8s_i64:
+    case INDEX_op_ext8u_i32:
+    case INDEX_op_ext8u_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_brcond(s, a2, a0, a1, arg_label(args[3]));
         break;
 
-    case INDEX_op_ext8u_i32:
-    case INDEX_op_ext8u_i64:
-        tcg_out_ext8u(s, a0, a1);
-        break;
-
     case INDEX_op_ext16s_i32:
     case INDEX_op_ext16s_i64:
         tcg_out_ext16s(s, a0, a1);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
     case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
     case INDEX_op_ext8s_i64:
+    case INDEX_op_ext8u_i32:
+    case INDEX_op_ext8u_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
     tcg_out_opc_reg(s, OPC_SEB, rd, TCG_REG_ZERO, rs);
 }
 
+static void tcg_out_ext8u(TCGContext *s, TCGReg rd, TCGReg rs)
+{
+    tcg_out_opc_imm(s, OPC_ANDI, rd, rs, 0xff);
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
@@ -XXX,XX +XXX,XX @@ static int tcg_out_call_iarg_reg8(TCGContext *s, int i, TCGReg arg)
     if (i < ARRAY_SIZE(tcg_target_call_iarg_regs)) {
         tmp = tcg_target_call_iarg_regs[i];
     }
-    tcg_out_opc_imm(s, OPC_ANDI, tmp, arg, 0xff);
+    tcg_out_ext8u(s, tmp, arg);
     return tcg_out_call_iarg_reg(s, i, tmp);
 }
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
     case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
     case INDEX_op_ext8s_i64:
+    case INDEX_op_ext8u_i32:
+    case INDEX_op_ext8u_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg dst, TCGReg src)
     tcg_out32(s, EXTSB | RA(dst) | RS(src));
 }
 
+static void tcg_out_ext8u(TCGContext *s, TCGReg dst, TCGReg src)
+{
+    tcg_out32(s, ANDI | SAI(src, dst, 0xff));
+}
+
 static inline void tcg_out_ext16s(TCGContext *s, TCGReg dst, TCGReg src)
 {
     tcg_out32(s, EXTSH | RA(dst) | RS(src));
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_goto_tb:   /* Always emitted via tcg_out_goto_tb.  */
     case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
     case INDEX_op_ext8s_i64:
+    case INDEX_op_ext8u_i32:
+    case INDEX_op_ext8u_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_qemu_st(s, args, true);
         break;
 
-    case INDEX_op_ext8u_i32:
-    case INDEX_op_ext8u_i64:
-        tcg_out_ext8u(s, a0, a1);
-        break;
-
     case INDEX_op_ext16u_i32:
     case INDEX_op_ext16u_i64:
         tcg_out_ext16u(s, a0, a1);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
     case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
     case INDEX_op_ext8s_i64:
+    case INDEX_op_ext8u_i32:
+    case INDEX_op_ext8u_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg dest, TCGReg src)
     tcg_out_insn(s, RRE, LGBR, dest, src);
 }
 
-static void tgen_ext8u(TCGContext *s, TCGType type, TCGReg dest, TCGReg src)
+static void tcg_out_ext8u(TCGContext *s, TCGReg dest, TCGReg src)
 {
     tcg_out_insn(s, RRE, LLGCR, dest, src);
 }
@@ -XXX,XX +XXX,XX @@ static void tgen_andi(TCGContext *s, TCGType type, TCGReg dest, uint64_t val)
         return;
     }
     if ((val & valid) == 0xff) {
-        tgen_ext8u(s, TCG_TYPE_I64, dest, dest);
+        tcg_out_ext8u(s, dest, dest);
         return;
     }
     if ((val & valid) == 0xffff) {
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
     }
     switch (opc & MO_SIZE) {
     case MO_UB:
-        tgen_ext8u(s, TCG_TYPE_I64, TCG_REG_R4, data_reg);
+        tcg_out_ext8u(s, TCG_REG_R4, data_reg);
         break;
     case MO_UW:
         tgen_ext16u(s, TCG_TYPE_I64, TCG_REG_R4, data_reg);
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext16s_i32:
         tgen_ext16s(s, TCG_TYPE_I32, args[0], args[1]);
         break;
-    case INDEX_op_ext8u_i32:
-        tgen_ext8u(s, TCG_TYPE_I32, args[0], args[1]);
-        break;
     case INDEX_op_ext16u_i32:
         tgen_ext16u(s, TCG_TYPE_I32, args[0], args[1]);
         break;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext32s_i64:
         tgen_ext32s(s, args[0], args[1]);
         break;
-    case INDEX_op_ext8u_i64:
-        tgen_ext8u(s, TCG_TYPE_I64, args[0], args[1]);
-        break;
     case INDEX_op_ext16u_i64:
         tgen_ext16u(s, TCG_TYPE_I64, args[0], args[1]);
         break;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
     case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
     case INDEX_op_ext8s_i64:
+    case INDEX_op_ext8u_i32:
+    case INDEX_op_ext8u_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
     g_assert_not_reached();
 }
 
+static void tcg_out_ext8u(TCGContext *s, TCGReg rd, TCGReg rs)
+{
+    tcg_out_arithi(s, rd, rs, 0xff, ARITH_AND);
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
@@ -XXX,XX +XXX,XX @@ static void emit_extend(TCGContext *s, TCGReg r, int op)
      */
     switch (op & MO_SIZE) {
     case MO_8:
-        tcg_out_arithi(s, r, r, 0xff, ARITH_AND);
+        tcg_out_ext8u(s, r, r);
         break;
     case MO_16:
         tcg_out_arithi(s, r, r, 16, SHIFT_SLL);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
     case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
     case INDEX_op_ext8s_i64:
+    case INDEX_op_ext8u_i32:
+    case INDEX_op_ext8u_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
     }
 }
 
+static void tcg_out_ext8u(TCGContext *s, TCGReg rd, TCGReg rs)
+{
+    if (TCG_TARGET_REG_BITS == 64) {
+        tcg_debug_assert(TCG_TARGET_HAS_ext8u_i64);
+        tcg_out_op_rr(s, INDEX_op_ext8u_i64, rd, rs);
+    } else {
+        tcg_debug_assert(TCG_TARGET_HAS_ext8u_i32);
+        tcg_out_op_rr(s, INDEX_op_ext8u_i32, rd, rs);
+    }
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
 
     CASE_32_64(neg)      /* Optional (TCG_TARGET_HAS_neg_*). */
     CASE_32_64(not)      /* Optional (TCG_TARGET_HAS_not_*). */
-    CASE_32_64(ext8u)    /* Optional (TCG_TARGET_HAS_ext8u_*). */
     CASE_32_64(ext16s)   /* Optional (TCG_TARGET_HAS_ext16s_*). */
     CASE_32_64(ext16u)   /* Optional (TCG_TARGET_HAS_ext16u_*). */
     CASE_64(ext32s)      /* Optional (TCG_TARGET_HAS_ext32s_i64). */
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
     case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
     case INDEX_op_ext8s_i64:
+    case INDEX_op_ext8u_i32:
+    case INDEX_op_ext8u_i64:
     default:
         g_assert_not_reached();
     }
-- 
2.34.1

We will need a backend interface for performing 16-bit sign-extend.
Use it in tcg_reg_alloc_op in the meantime.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg.c                        |  7 +++++++
 tcg/aarch64/tcg-target.c.inc     | 13 ++++++++-----
 tcg/arm/tcg-target.c.inc         | 10 ++++------
 tcg/i386/tcg-target.c.inc        | 16 ++++++++--------
 tcg/loongarch64/tcg-target.c.inc | 13 +++++--------
 tcg/mips/tcg-target.c.inc        | 11 ++++++++---
 tcg/ppc/tcg-target.c.inc         | 12 +++++-------
 tcg/riscv/tcg-target.c.inc       |  9 +++------
 tcg/s390x/tcg-target.c.inc       | 12 ++++--------
 tcg/sparc64/tcg-target.c.inc     |  7 +++++++
 tcg/tci/tcg-target.c.inc         | 21 ++++++++++++++++++++-
 11 files changed, 79 insertions(+), 52 deletions(-)

diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_mov(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg);
 static void tcg_out_movi(TCGContext *s, TCGType type,
                          TCGReg ret, tcg_target_long arg);
 static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg);
+static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg);
 static void tcg_out_ext8u(TCGContext *s, TCGReg ret, TCGReg arg);
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg, TCGReg, tcg_target_long);
 static void tcg_out_exit_tb(TCGContext *s, uintptr_t arg);
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_ext8u_i64:
         tcg_out_ext8u(s, new_args[0], new_args[1]);
         break;
+    case INDEX_op_ext16s_i32:
+        tcg_out_ext16s(s, TCG_TYPE_I32, new_args[0], new_args[1]);
+        break;
+    case INDEX_op_ext16s_i64:
+        tcg_out_ext16s(s, TCG_TYPE_I64, new_args[0], new_args[1]);
+        break;
     default:
         if (def->flags & TCG_OPF_VECTOR) {
             tcg_out_vec_op(s, op->opc, TCGOP_VECL(op), TCGOP_VECE(op),
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rn)
     tcg_out_sxt(s, type, MO_8, rd, rn);
 }
 
+static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rn)
+{
+    tcg_out_sxt(s, type, MO_16, rd, rn);
+}
+
 static inline void tcg_out_uxt(TCGContext *s, MemOp s_bits,
                                TCGReg rd, TCGReg rn)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_rev(s, TCG_TYPE_I32, MO_16, a0, a1);
         if (a2 & TCG_BSWAP_OS) {
             /* Output must be sign-extended. */
-            tcg_out_sxt(s, ext, MO_16, a0, a0);
+            tcg_out_ext16s(s, ext, a0, a0);
         } else if ((a2 & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
             /* Output must be zero-extended, but input isn't. */
             tcg_out_uxt(s, MO_16, a0, a0);
         }
         break;
 
-    case INDEX_op_ext16s_i64:
-    case INDEX_op_ext16s_i32:
-        tcg_out_sxt(s, ext, MO_16, a0, a1);
-        break;
     case INDEX_op_ext_i32_i64:
     case INDEX_op_ext32s_i64:
         tcg_out_sxt(s, TCG_TYPE_I64, MO_32, a0, a1);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext8s_i64:
     case INDEX_op_ext8u_i32:
     case INDEX_op_ext8u_i64:
+    case INDEX_op_ext16s_i64:
+    case INDEX_op_ext16s_i32:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ tcg_out_ext8u_cond(TCGContext *s, ARMCond cond, TCGReg rd, TCGReg rn)
     tcg_out_dat_imm(s, cond, ARITH_AND, rd, rn, 0xff);
 }
 
-static void tcg_out_ext16s(TCGContext *s, ARMCond cond, TCGReg rd, TCGReg rn)
+static void tcg_out_ext16s(TCGContext *s, TCGType t, TCGReg rd, TCGReg rn)
 {
     /* sxth */
-    tcg_out32(s, 0x06bf0070 | (cond << 28) | (rd << 12) | rn);
+    tcg_out32(s, 0x06bf0070 | (COND_AL << 28) | (rd << 12) | rn);
 }
 
 static void tcg_out_ext16u(TCGContext *s, ARMCond cond, TCGReg rd, TCGReg rn)
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
         tcg_out_ext8s(s, TCG_TYPE_I32, datalo, TCG_REG_R0);
         break;
     case MO_SW:
-        tcg_out_ext16s(s, COND_AL, datalo, TCG_REG_R0);
+        tcg_out_ext16s(s, TCG_TYPE_I32, datalo, TCG_REG_R0);
         break;
     default:
         tcg_out_mov_reg(s, COND_AL, datalo, TCG_REG_R0);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_bswap32(s, COND_AL, args[0], args[1]);
         break;
 
-    case INDEX_op_ext16s_i32:
-        tcg_out_ext16s(s, COND_AL, args[0], args[1]);
-        break;
     case INDEX_op_ext16u_i32:
         tcg_out_ext16u(s, COND_AL, args[0], args[1]);
         break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
     case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
     case INDEX_op_ext8u_i32:
+    case INDEX_op_ext16s_i32:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_ext16u(TCGContext *s, int dest, int src)
     tcg_out_modrm(s, OPC_MOVZWL, dest, src);
 }
 
-static inline void tcg_out_ext16s(TCGContext *s, int dest, int src, int rexw)
+static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg dest, TCGReg src)
 {
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
     /* movsw[lq] */
     tcg_out_modrm(s, OPC_MOVSWL + rexw, dest, src);
 }
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
     MemOp opc = get_memop(oi);
     TCGReg data_reg;
     tcg_insn_unit **label_ptr = &l->label_ptr[0];
-    int rexw = (l->type == TCG_TYPE_I64 ? P_REXW : 0);
 
     /* resolve label address */
     tcg_patch32(label_ptr[0], s->code_ptr - label_ptr[0] - 4);
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
         tcg_out_ext8s(s, l->type, data_reg, TCG_REG_EAX);
         break;
     case MO_SW:
-        tcg_out_ext16s(s, data_reg, TCG_REG_EAX, rexw);
+        tcg_out_ext16s(s, l->type, data_reg, TCG_REG_EAX);
         break;
 #if TCG_TARGET_REG_BITS == 64
     case MO_SL:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg datalo, TCGReg datahi,
                                    TCGReg base, int index, intptr_t ofs,
                                    int seg, bool is64, MemOp memop)
 {
+    TCGType type = is64 ? TCG_TYPE_I64 : TCG_TYPE_I32;
     bool use_movbe = false;
     int rexw = is64 * P_REXW;
     int movop = OPC_MOVL_GvEv;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg datalo, TCGReg datahi,
         if (use_movbe) {
             tcg_out_modrm_sib_offset(s, OPC_MOVBE_GyMy + P_DATA16 + seg,
                                      datalo, base, index, 0, ofs);
-            tcg_out_ext16s(s, datalo, datalo, rexw);
+            tcg_out_ext16s(s, type, datalo, datalo);
         } else {
             tcg_out_modrm_sib_offset(s, OPC_MOVSWL + rexw + seg,
                                      datalo, base, index, 0, ofs);
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_modrm(s, OPC_GRP3_Ev + rexw, EXT3_NOT, a0);
         break;
 
-    OP_32_64(ext16s):
-        tcg_out_ext16s(s, a0, a1, rexw);
-        break;
     OP_32_64(ext16u):
         tcg_out_ext16u(s, a0, a1);
         break;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         if (a1 < 4 && a0 < 8) {
             tcg_out_modrm(s, OPC_MOVSBL, a0, a1 + 4);
         } else {
-            tcg_out_ext16s(s, a0, a1, 0);
+            tcg_out_ext16s(s, TCG_TYPE_I32, a0, a1);
             tcg_out_shifti(s, SHIFT_SAR, a0, 8);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext8s_i64:
     case INDEX_op_ext8u_i32:
     case INDEX_op_ext8u_i64:
+    case INDEX_op_ext16s_i32:
+    case INDEX_op_ext16s_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg)
     tcg_out_opc_sext_b(s, ret, arg);
 }
 
-static void tcg_out_ext16s(TCGContext *s, TCGReg ret, TCGReg arg)
+static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg)
 {
     tcg_out_opc_sext_h(s, ret, arg);
 }
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
         tcg_out_ext8s(s, type, l->datalo_reg, TCG_REG_A0);
         break;
     case MO_SW:
-        tcg_out_ext16s(s, l->datalo_reg, TCG_REG_A0);
+        tcg_out_ext16s(s, type, l->datalo_reg, TCG_REG_A0);
         break;
     case MO_SL:
         tcg_out_ext32s(s, l->datalo_reg, TCG_REG_A0);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_brcond(s, a2, a0, a1, arg_label(args[3]));
         break;
 
-    case INDEX_op_ext16s_i32:
-    case INDEX_op_ext16s_i64:
-        tcg_out_ext16s(s, a0, a1);
-        break;
-
     case INDEX_op_ext16u_i32:
     case INDEX_op_ext16u_i64:
         tcg_out_ext16u(s, a0, a1);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_bswap16_i64:
         tcg_out_opc_revb_2h(s, a0, a1);
         if (a2 & TCG_BSWAP_OS) {
-            tcg_out_ext16s(s, a0, a0);
+            tcg_out_ext16s(s, TCG_TYPE_REG, a0, a0);
         } else if ((a2 & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
             tcg_out_ext16u(s, a0, a0);
         }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext8s_i64:
     case INDEX_op_ext8u_i32:
     case INDEX_op_ext8u_i64:
+    case INDEX_op_ext16s_i32:
+    case INDEX_op_ext16s_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8u(TCGContext *s, TCGReg rd, TCGReg rs)
     tcg_out_opc_imm(s, OPC_ANDI, rd, rs, 0xff);
 }
 
+static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
+{
+    tcg_debug_assert(TCG_TARGET_HAS_ext16s_i32);
+    tcg_out_opc_reg(s, OPC_SEH, rd, TCG_REG_ZERO, rs);
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_not_i64:
         i1 = OPC_NOR;
         goto do_unary;
-    case INDEX_op_ext16s_i32:
-    case INDEX_op_ext16s_i64:
-        i1 = OPC_SEH;
     do_unary:
         tcg_out_opc_reg(s, i1, a0, TCG_REG_ZERO, a1);
         break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext8s_i64:
     case INDEX_op_ext8u_i32:
     case INDEX_op_ext8u_i64:
+    case INDEX_op_ext16s_i32:
+    case INDEX_op_ext16s_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8u(TCGContext *s, TCGReg dst, TCGReg src)
     tcg_out32(s, ANDI | SAI(src, dst, 0xff));
 }
 
-static inline void tcg_out_ext16s(TCGContext *s, TCGReg dst, TCGReg src)
+static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg dst, TCGReg src)
 {
     tcg_out32(s, EXTSH | RA(dst) | RS(src));
 }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_bswap16(TCGContext *s, TCGReg dst, TCGReg src, int flags)
     if (have_isa_3_10) {
         tcg_out32(s, BRH | RA(dst) | RS(src));
         if (flags & TCG_BSWAP_OS) {
-            tcg_out_ext16s(s, dst, dst);
+            tcg_out_ext16s(s, TCG_TYPE_REG, dst, dst);
         } else if ((flags & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
             tcg_out_ext16u(s, dst, dst);
         }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_bswap16(TCGContext *s, TCGReg dst, TCGReg src, int flags)
     tcg_out_rlw(s, RLWIMI, tmp, src, 8, 16, 23);
 
     if (flags & TCG_BSWAP_OS) {
-        tcg_out_ext16s(s, dst, tmp);
+        tcg_out_ext16s(s, TCG_TYPE_REG, dst, tmp);
     } else {
         tcg_out_mov(s, TCG_TYPE_REG, dst, tmp);
     }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_qemu_st(s, args, true);
         break;
 
-    case INDEX_op_ext16s_i32:
-    case INDEX_op_ext16s_i64:
-        tcg_out_ext16s(s, args[0], args[1]);
-        break;
     case INDEX_op_ext_i32_i64:
     case INDEX_op_ext32s_i64:
         tcg_out_ext32s(s, args[0], args[1]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext8s_i64:
     case INDEX_op_ext8u_i32:
     case INDEX_op_ext8u_i64:
+    case INDEX_op_ext16s_i32:
+    case INDEX_op_ext16s_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg)
     tcg_out_opc_imm(s, OPC_SRAIW, ret, ret, 24);
 }
 
-static void tcg_out_ext16s(TCGContext *s, TCGReg ret, TCGReg arg)
+static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg)
 {
     tcg_out_opc_imm(s, OPC_SLLIW, ret, arg, 16);
     tcg_out_opc_imm(s, OPC_SRAIW, ret, ret, 16);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_ext32u(s, a0, a1);
         break;
 
-    case INDEX_op_ext16s_i32:
-    case INDEX_op_ext16s_i64:
-        tcg_out_ext16s(s, a0, a1);
-        break;
-
     case INDEX_op_ext32s_i64:
     case INDEX_op_extrl_i64_i32:
     case INDEX_op_ext_i32_i64:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext8s_i64:
     case INDEX_op_ext8u_i32:
     case INDEX_op_ext8u_i64:
+    case INDEX_op_ext16s_i32:
+    case INDEX_op_ext16s_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8u(TCGContext *s, TCGReg dest, TCGReg src)
     tcg_out_insn(s, RRE, LLGCR, dest, src);
 }
 
-static void tgen_ext16s(TCGContext *s, TCGType type, TCGReg dest, TCGReg src)
+static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg dest, TCGReg src)
 {
     tcg_out_insn(s, RRE, LGHR, dest, src);
 }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp opc, TCGReg data,
     case MO_SW | MO_BSWAP:
         /* swapped sign-extended halfword load */
         tcg_out_insn(s, RXY, LRVH, data, base, index, disp);
-        tgen_ext16s(s, TCG_TYPE_I64, data, data);
+        tcg_out_ext16s(s, TCG_TYPE_REG, data, data);
         break;
     case MO_SW:
         tcg_out_insn(s, RXY, LGH, data, base, index, disp);
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         }
         break;
 
-    case INDEX_op_ext16s_i32:
-        tgen_ext16s(s, TCG_TYPE_I32, args[0], args[1]);
-        break;
     case INDEX_op_ext16u_i32:
         tgen_ext16u(s, TCG_TYPE_I32, args[0], args[1]);
         break;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         }
         break;
 
-    case INDEX_op_ext16s_i64:
-        tgen_ext16s(s, TCG_TYPE_I64, args[0], args[1]);
-        break;
     case INDEX_op_ext_i32_i64:
     case INDEX_op_ext32s_i64:
         tgen_ext32s(s, args[0], args[1]);
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext8s_i64:
     case INDEX_op_ext8u_i32:
     case INDEX_op_ext8u_i64:
+    case INDEX_op_ext16s_i32:
+    case INDEX_op_ext16s_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
     g_assert_not_reached();
 }
 
+static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
+{
+    g_assert_not_reached();
+}
+
 static void tcg_out_ext8u(TCGContext *s, TCGReg rd, TCGReg rs)
 {
     tcg_out_arithi(s, rd, rs, 0xff, ARITH_AND);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext8s_i64:
     case INDEX_op_ext8u_i32:
     case INDEX_op_ext8u_i64:
+    case INDEX_op_ext16s_i32:
+    case INDEX_op_ext16s_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8u(TCGContext *s, TCGReg rd, TCGReg rs)
     }
 }
 
+static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
+{
+    switch (type) {
+    case TCG_TYPE_I32:
+        tcg_debug_assert(TCG_TARGET_HAS_ext16s_i32);
+        tcg_out_op_rr(s, INDEX_op_ext16s_i32, rd, rs);
+        break;
+#if TCG_TARGET_REG_BITS == 64
+    case TCG_TYPE_I64:
+        tcg_debug_assert(TCG_TARGET_HAS_ext16s_i64);
+        tcg_out_op_rr(s, INDEX_op_ext16s_i64, rd, rs);
+        break;
+#endif
+    default:
+        g_assert_not_reached();
+    }
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
 
     CASE_32_64(neg)      /* Optional (TCG_TARGET_HAS_neg_*). */
     CASE_32_64(not)      /* Optional (TCG_TARGET_HAS_not_*). */
-    CASE_32_64(ext16s)   /* Optional (TCG_TARGET_HAS_ext16s_*). */
     CASE_32_64(ext16u)   /* Optional (TCG_TARGET_HAS_ext16u_*). */
     CASE_64(ext32s)      /* Optional (TCG_TARGET_HAS_ext32s_i64). */
     CASE_64(ext32u)      /* Optional (TCG_TARGET_HAS_ext32u_i64). */
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext8s_i64:
     case INDEX_op_ext8u_i32:
     case INDEX_op_ext8u_i64:
+    case INDEX_op_ext16s_i32:
+    case INDEX_op_ext16s_i64:
     default:
         g_assert_not_reached();
     }
-- 
2.34.1

We will need a backend interface for performing 16-bit zero-extend.
Use it in tcg_reg_alloc_op in the meantime.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg.c                        |  5 +++++
 tcg/aarch64/tcg-target.c.inc     | 13 ++++++++-----
 tcg/arm/tcg-target.c.inc         | 17 ++++++++++-------
 tcg/i386/tcg-target.c.inc        |  8 +++-----
 tcg/loongarch64/tcg-target.c.inc |  7 ++-----
 tcg/mips/tcg-target.c.inc        |  5 +++++
 tcg/ppc/tcg-target.c.inc         |  4 +++-
 tcg/riscv/tcg-target.c.inc       |  7 ++-----
 tcg/s390x/tcg-target.c.inc       | 17 ++++++-----------
 tcg/sparc64/tcg-target.c.inc     | 11 +++++++++--
 tcg/tci/tcg-target.c.inc         | 14 +++++++++++++-
 11 files changed, 66 insertions(+), 42 deletions(-)

diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi(TCGContext *s, TCGType type,
 static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg);
 static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg);
 static void tcg_out_ext8u(TCGContext *s, TCGReg ret, TCGReg arg);
+static void tcg_out_ext16u(TCGContext *s, TCGReg ret, TCGReg arg);
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg, TCGReg, tcg_target_long);
 static void tcg_out_exit_tb(TCGContext *s, uintptr_t arg);
 static void tcg_out_goto_tb(TCGContext *s, int which);
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_ext16s_i64:
         tcg_out_ext16s(s, TCG_TYPE_I64, new_args[0], new_args[1]);
         break;
+    case INDEX_op_ext16u_i32:
+    case INDEX_op_ext16u_i64:
+        tcg_out_ext16u(s, new_args[0], new_args[1]);
+        break;
     default:
         if (def->flags & TCG_OPF_VECTOR) {
             tcg_out_vec_op(s, op->opc, TCGOP_VECL(op), TCGOP_VECE(op),
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8u(TCGContext *s, TCGReg rd, TCGReg rn)
     tcg_out_uxt(s, MO_8, rd, rn);
 }
 
+static void tcg_out_ext16u(TCGContext *s, TCGReg rd, TCGReg rn)
+{
+    tcg_out_uxt(s, MO_16, rd, rn);
+}
+
 static void tcg_out_addsubi(TCGContext *s, int ext, TCGReg rd,
                             TCGReg rn, int64_t aimm)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
             tcg_out_ext16s(s, ext, a0, a0);
         } else if ((a2 & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
             /* Output must be zero-extended, but input isn't. */
-            tcg_out_uxt(s, MO_16, a0, a0);
+            tcg_out_ext16u(s, a0, a0);
         }
         break;
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext32s_i64:
         tcg_out_sxt(s, TCG_TYPE_I64, MO_32, a0, a1);
         break;
-    case INDEX_op_ext16u_i64:
-    case INDEX_op_ext16u_i32:
-        tcg_out_uxt(s, MO_16, a0, a1);
-        break;
     case INDEX_op_extu_i32_i64:
     case INDEX_op_ext32u_i64:
         tcg_out_movr(s, TCG_TYPE_I32, a0, a1);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext8u_i64:
     case INDEX_op_ext16s_i64:
     case INDEX_op_ext16s_i32:
+    case INDEX_op_ext16u_i64:
+    case INDEX_op_ext16u_i32:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16s(TCGContext *s, TCGType t, TCGReg rd, TCGReg rn)
     tcg_out32(s, 0x06bf0070 | (COND_AL << 28) | (rd << 12) | rn);
 }
 
-static void tcg_out_ext16u(TCGContext *s, ARMCond cond, TCGReg rd, TCGReg rn)
+static void tcg_out_ext16u_cond(TCGContext *s, ARMCond cond,
+                                TCGReg rd, TCGReg rn)
 {
     /* uxth */
     tcg_out32(s, 0x06ff0070 | (cond << 28) | (rd << 12) | rn);
 }
 
+static void tcg_out_ext16u(TCGContext *s, TCGReg rd, TCGReg rn)
+{
+    tcg_out_ext16u_cond(s, COND_AL, rd, rn);
+}
+
 static void tcg_out_bswap16(TCGContext *s, ARMCond cond,
                             TCGReg rd, TCGReg rn, int flags)
 {
@@ -XXX,XX +XXX,XX @@ DEFINE_TCG_OUT_ARG(tcg_out_arg_imm32, uint32_t, tcg_out_movi32,
     (tcg_out_movi32(s, COND_AL, TCG_REG_TMP, arg), arg = TCG_REG_TMP))
 DEFINE_TCG_OUT_ARG(tcg_out_arg_reg8, TCGReg, tcg_out_ext8u_cond,
     (tcg_out_ext8u_cond(s, COND_AL, TCG_REG_TMP, arg), arg = TCG_REG_TMP))
-DEFINE_TCG_OUT_ARG(tcg_out_arg_reg16, TCGReg, tcg_out_ext16u,
-    (tcg_out_ext16u(s, COND_AL, TCG_REG_TMP, arg), arg = TCG_REG_TMP))
+DEFINE_TCG_OUT_ARG(tcg_out_arg_reg16, TCGReg, tcg_out_ext16u_cond,
+    (tcg_out_ext16u_cond(s, COND_AL, TCG_REG_TMP, arg), arg = TCG_REG_TMP))
 DEFINE_TCG_OUT_ARG(tcg_out_arg_reg32, TCGReg, tcg_out_mov_reg, )
 
 static TCGReg tcg_out_arg_reg64(TCGContext *s, TCGReg argreg,
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_bswap32(s, COND_AL, args[0], args[1]);
         break;
 
-    case INDEX_op_ext16u_i32:
-        tcg_out_ext16u(s, COND_AL, args[0], args[1]);
-        break;
-
     case INDEX_op_deposit_i32:
         tcg_out_deposit(s, COND_AL, args[0], args[2],
                         args[3], args[4], const_args[2]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
     case INDEX_op_ext8u_i32:
     case INDEX_op_ext16s_i32:
+    case INDEX_op_ext16u_i32:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg dest, TCGReg src)
     tcg_out_modrm(s, OPC_MOVSBL + P_REXB_RM + rexw, dest, src);
 }
 
-static inline void tcg_out_ext16u(TCGContext *s, int dest, int src)
+static void tcg_out_ext16u(TCGContext *s, TCGReg dest, TCGReg src)
 {
     /* movzwl */
     tcg_out_modrm(s, OPC_MOVZWL, dest, src);
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_modrm(s, OPC_GRP3_Ev + rexw, EXT3_NOT, a0);
         break;
 
-    OP_32_64(ext16u):
-        tcg_out_ext16u(s, a0, a1);
-        break;
-
     case INDEX_op_qemu_ld_i32:
         tcg_out_qemu_ld(s, args, 0);
         break;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext8u_i64:
     case INDEX_op_ext16s_i32:
     case INDEX_op_ext16s_i64:
+    case INDEX_op_ext16u_i32:
+    case INDEX_op_ext16u_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_brcond(s, a2, a0, a1, arg_label(args[3]));
         break;
 
-    case INDEX_op_ext16u_i32:
-    case INDEX_op_ext16u_i64:
-        tcg_out_ext16u(s, a0, a1);
-        break;
-
     case INDEX_op_ext32u_i64:
     case INDEX_op_extu_i32_i64:
         tcg_out_ext32u(s, a0, a1);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext8u_i64:
     case INDEX_op_ext16s_i32:
     case INDEX_op_ext16s_i64:
+    case INDEX_op_ext16u_i32:
+    case INDEX_op_ext16u_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
     tcg_out_opc_reg(s, OPC_SEH, rd, TCG_REG_ZERO, rs);
 }
 
+static void tcg_out_ext16u(TCGContext *s, TCGReg rd, TCGReg rs)
+{
+    tcg_out_opc_imm(s, OPC_ANDI, rd, rs, 0xffff);
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg dst, TCGReg src)
     tcg_out32(s, EXTSH | RA(dst) | RS(src));
 }
 
-static inline void tcg_out_ext16u(TCGContext *s, TCGReg dst, TCGReg src)
+static void tcg_out_ext16u(TCGContext *s, TCGReg dst, TCGReg src)
 {
     tcg_out32(s, ANDI | SAI(src, dst, 0xffff));
 }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext8u_i64:
     case INDEX_op_ext16s_i32:
     case INDEX_op_ext16s_i64:
+    case INDEX_op_ext16u_i32:
+    case INDEX_op_ext16u_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_qemu_st(s, args, true);
         break;
 
-    case INDEX_op_ext16u_i32:
-    case INDEX_op_ext16u_i64:
-        tcg_out_ext16u(s, a0, a1);
-        break;
-
     case INDEX_op_ext32u_i64:
     case INDEX_op_extu_i32_i64:
         tcg_out_ext32u(s, a0, a1);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext8u_i64:
     case INDEX_op_ext16s_i32:
     case INDEX_op_ext16s_i64:
+    case INDEX_op_ext16u_i32:
+    case INDEX_op_ext16u_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg dest, TCGReg src)
     tcg_out_insn(s, RRE, LGHR, dest, src);
 }
 
-static void tgen_ext16u(TCGContext *s, TCGType type, TCGReg dest, TCGReg src)
+static void tcg_out_ext16u(TCGContext *s, TCGReg dest, TCGReg src)
 {
     tcg_out_insn(s, RRE, LLGHR, dest, src);
 }
@@ -XXX,XX +XXX,XX @@ static void tgen_andi(TCGContext *s, TCGType type, TCGReg dest, uint64_t val)
         return;
     }
     if ((val & valid) == 0xffff) {
-        tgen_ext16u(s, TCG_TYPE_I64, dest, dest);
+        tcg_out_ext16u(s, dest, dest);
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp opc, TCGReg data,
     case MO_UW | MO_BSWAP:
         /* swapped unsigned halfword load with upper bits zeroed */
         tcg_out_insn(s, RXY, LRVH, data, base, index, disp);
-        tgen_ext16u(s, TCG_TYPE_I64, data, data);
+        tcg_out_ext16u(s, data, data);
         break;
     case MO_UW:
         tcg_out_insn(s, RXY, LLGH, data, base, index, disp);
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
         tcg_out_ext8u(s, TCG_REG_R4, data_reg);
         break;
     case MO_UW:
-        tgen_ext16u(s, TCG_TYPE_I64, TCG_REG_R4, data_reg);
+        tcg_out_ext16u(s, TCG_REG_R4, data_reg);
         break;
     case MO_UL:
         tgen_ext32u(s, TCG_REG_R4, data_reg);
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         }
         break;
 
-    case INDEX_op_ext16u_i32:
-        tgen_ext16u(s, TCG_TYPE_I32, args[0], args[1]);
-        break;
-
     case INDEX_op_bswap16_i32:
         a0 = args[0], a1 = args[1], a2 = args[2];
         tcg_out_insn(s, RRE, LRVR, a0, a1);
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext32s_i64:
         tgen_ext32s(s, args[0], args[1]);
         break;
-    case INDEX_op_ext16u_i64:
-        tgen_ext16u(s, TCG_TYPE_I64, args[0], args[1]);
-        break;
     case INDEX_op_extu_i32_i64:
     case INDEX_op_ext32u_i64:
         tgen_ext32u(s, args[0], args[1]);
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext8u_i64:
     case INDEX_op_ext16s_i32:
     case INDEX_op_ext16s_i64:
+    case INDEX_op_ext16u_i32:
+    case INDEX_op_ext16u_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8u(TCGContext *s, TCGReg rd, TCGReg rs)
     tcg_out_arithi(s, rd, rs, 0xff, ARITH_AND);
 }
 
+static void tcg_out_ext16u(TCGContext *s, TCGReg rd, TCGReg rs)
+{
+    tcg_out_arithi(s, rd, rs, 16, SHIFT_SLL);
+    tcg_out_arithi(s, rd, rd, 16, SHIFT_SRL);
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
@@ -XXX,XX +XXX,XX @@ static void emit_extend(TCGContext *s, TCGReg r, int op)
         tcg_out_ext8u(s, r, r);
         break;
     case MO_16:
-        tcg_out_arithi(s, r, r, 16, SHIFT_SLL);
-        tcg_out_arithi(s, r, r, 16, SHIFT_SRL);
+        tcg_out_ext16u(s, r, r);
         break;
     case MO_32:
         tcg_out_arith(s, r, r, 0, SHIFT_SRL);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext8u_i64:
     case INDEX_op_ext16s_i32:
     case INDEX_op_ext16s_i64:
+    case INDEX_op_ext16u_i32:
+    case INDEX_op_ext16u_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
     }
 }
 
+static void tcg_out_ext16u(TCGContext *s, TCGReg rd, TCGReg rs)
+{
+    if (TCG_TARGET_REG_BITS == 64) {
+        tcg_debug_assert(TCG_TARGET_HAS_ext16u_i64);
+        tcg_out_op_rr(s, INDEX_op_ext16u_i64, rd, rs);
+    } else {
+        tcg_debug_assert(TCG_TARGET_HAS_ext16u_i32);
+        tcg_out_op_rr(s, INDEX_op_ext16u_i32, rd, rs);
+    }
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
 
     CASE_32_64(neg)      /* Optional (TCG_TARGET_HAS_neg_*). */
     CASE_32_64(not)      /* Optional (TCG_TARGET_HAS_not_*). */
-    CASE_32_64(ext16u)   /* Optional (TCG_TARGET_HAS_ext16u_*). */
     CASE_64(ext32s)      /* Optional (TCG_TARGET_HAS_ext32s_i64). */
     CASE_64(ext32u)      /* Optional (TCG_TARGET_HAS_ext32u_i64). */
     CASE_64(ext_i32)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext8u_i64:
     case INDEX_op_ext16s_i32:
     case INDEX_op_ext16s_i64:
+    case INDEX_op_ext16u_i32:
+    case INDEX_op_ext16u_i64:
     default:
         g_assert_not_reached();
     }
-- 
2.34.1

We will need a backend interface for performing 32-bit sign-extend.
Use it in tcg_reg_alloc_op in the meantime.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg.c                        |  4 ++++
 tcg/aarch64/tcg-target.c.inc     |  9 +++++++--
 tcg/arm/tcg-target.c.inc         |  5 +++++
 tcg/i386/tcg-target.c.inc        |  5 +++--
 tcg/loongarch64/tcg-target.c.inc |  2 +-
 tcg/mips/tcg-target.c.inc        | 12 +++++++++---
 tcg/ppc/tcg-target.c.inc         |  5 +++--
 tcg/riscv/tcg-target.c.inc       |  2 +-
 tcg/s390x/tcg-target.c.inc       | 10 +++++-----
 tcg/sparc64/tcg-target.c.inc     | 11 ++++++++---
 tcg/tci/tcg-target.c.inc         |  9 ++++++++-
 11 files changed, 54 insertions(+), 20 deletions(-)

diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg);
 static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg);
 static void tcg_out_ext8u(TCGContext *s, TCGReg ret, TCGReg arg);
 static void tcg_out_ext16u(TCGContext *s, TCGReg ret, TCGReg arg);
+static void tcg_out_ext32s(TCGContext *s, TCGReg ret, TCGReg arg);
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg, TCGReg, tcg_target_long);
 static void tcg_out_exit_tb(TCGContext *s, uintptr_t arg);
 static void tcg_out_goto_tb(TCGContext *s, int which);
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_ext16u_i64:
         tcg_out_ext16u(s, new_args[0], new_args[1]);
         break;
+    case INDEX_op_ext32s_i64:
+        tcg_out_ext32s(s, new_args[0], new_args[1]);
+        break;
     default:
         if (def->flags & TCG_OPF_VECTOR) {
             tcg_out_vec_op(s, op->opc, TCGOP_VECL(op), TCGOP_VECE(op),
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rn)
     tcg_out_sxt(s, type, MO_16, rd, rn);
 }
 
+static void tcg_out_ext32s(TCGContext *s, TCGReg rd, TCGReg rn)
+{
+    tcg_out_sxt(s, TCG_TYPE_I64, MO_32, rd, rn);
+}
+
 static inline void tcg_out_uxt(TCGContext *s, MemOp s_bits,
                                TCGReg rd, TCGReg rn)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_bswap32_i64:
         tcg_out_rev(s, TCG_TYPE_I32, MO_32, a0, a1);
         if (a2 & TCG_BSWAP_OS) {
-            tcg_out_sxt(s, TCG_TYPE_I64, MO_32, a0, a0);
+            tcg_out_ext32s(s, a0, a0);
         }
         break;
     case INDEX_op_bswap32_i32:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         break;
 
     case INDEX_op_ext_i32_i64:
-    case INDEX_op_ext32s_i64:
         tcg_out_sxt(s, TCG_TYPE_I64, MO_32, a0, a1);
         break;
     case INDEX_op_extu_i32_i64:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext16s_i32:
     case INDEX_op_ext16u_i64:
     case INDEX_op_ext16u_i32:
+    case INDEX_op_ext32s_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16u(TCGContext *s, TCGReg rd, TCGReg rn)
     tcg_out_ext16u_cond(s, COND_AL, rd, rn);
 }
 
+static void tcg_out_ext32s(TCGContext *s, TCGReg rd, TCGReg rn)
+{
+    g_assert_not_reached();
+}
+
 static void tcg_out_bswap16(TCGContext *s, ARMCond cond,
                             TCGReg rd, TCGReg rn, int flags)
 {
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_ext32u(TCGContext *s, int dest, int src)
     tcg_out_modrm(s, OPC_MOVL_GvEv, dest, src);
 }
 
-static inline void tcg_out_ext32s(TCGContext *s, int dest, int src)
+static void tcg_out_ext32s(TCGContext *s, TCGReg dest, TCGReg src)
 {
+    tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
     tcg_out_modrm(s, OPC_MOVSLQ, dest, src);
 }
 
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_ext32u(s, a0, a1);
         break;
     case INDEX_op_ext_i32_i64:
-    case INDEX_op_ext32s_i64:
         tcg_out_ext32s(s, a0, a1);
         break;
     case INDEX_op_extrh_i64_i32:
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext16s_i64:
     case INDEX_op_ext16u_i32:
     case INDEX_op_ext16u_i64:
+    case INDEX_op_ext32s_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_ext32u(s, a0, a1);
         break;
 
-    case INDEX_op_ext32s_i64:
     case INDEX_op_extrl_i64_i32:
     case INDEX_op_ext_i32_i64:
         tcg_out_ext32s(s, a0, a1);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext16s_i64:
     case INDEX_op_ext16u_i32:
     case INDEX_op_ext16u_i64:
+    case INDEX_op_ext32s_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16u(TCGContext *s, TCGReg rd, TCGReg rs)
     tcg_out_opc_imm(s, OPC_ANDI, rd, rs, 0xffff);
 }
 
+static void tcg_out_ext32s(TCGContext *s, TCGReg rd, TCGReg rs)
+{
+    tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
+    tcg_out_opc_sa(s, OPC_SLL, rd, rs, 0);
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
     /* delay slot */
     if (TCG_TARGET_REG_BITS == 64 && l->type == TCG_TYPE_I32) {
         /* we always sign-extend 32-bit loads */
-        tcg_out_opc_sa(s, OPC_SLL, v0, TCG_REG_V0, 0);
+        tcg_out_ext32s(s, v0, TCG_REG_V0);
     } else {
         tcg_out_opc_reg(s, OPC_OR, v0, TCG_REG_V0, TCG_REG_ZERO);
     }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_extrh_i64_i32:
         tcg_out_dsra(s, a0, a1, 32);
         break;
-    case INDEX_op_ext32s_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extrl_i64_i32:
-        tcg_out_opc_sa(s, OPC_SLL, a0, a1, 0);
+        tcg_out_ext32s(s, a0, a1);
         break;
     case INDEX_op_ext32u_i64:
     case INDEX_op_extu_i32_i64:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext8u_i64:
     case INDEX_op_ext16s_i32:
     case INDEX_op_ext16s_i64:
+    case INDEX_op_ext32s_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16u(TCGContext *s, TCGReg dst, TCGReg src)
     tcg_out32(s, ANDI | SAI(src, dst, 0xffff));
 }
 
-static inline void tcg_out_ext32s(TCGContext *s, TCGReg dst, TCGReg src)
+static void tcg_out_ext32s(TCGContext *s, TCGReg dst, TCGReg src)
 {
+    tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
     tcg_out32(s, EXTSW | RA(dst) | RS(src));
 }
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         break;
 
     case INDEX_op_ext_i32_i64:
-    case INDEX_op_ext32s_i64:
         tcg_out_ext32s(s, args[0], args[1]);
         break;
     case INDEX_op_extu_i32_i64:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext16s_i64:
     case INDEX_op_ext16u_i32:
     case INDEX_op_ext16u_i64:
+    case INDEX_op_ext32s_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_ext32u(s, a0, a1);
         break;
 
-    case INDEX_op_ext32s_i64:
     case INDEX_op_extrl_i64_i32:
     case INDEX_op_ext_i32_i64:
         tcg_out_ext32s(s, a0, a1);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext16s_i64:
     case INDEX_op_ext16u_i32:
     case INDEX_op_ext16u_i64:
+    case INDEX_op_ext32s_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16u(TCGContext *s, TCGReg dest, TCGReg src)
     tcg_out_insn(s, RRE, LLGHR, dest, src);
 }
 
-static inline void tgen_ext32s(TCGContext *s, TCGReg dest, TCGReg src)
+static void tcg_out_ext32s(TCGContext *s, TCGReg dest, TCGReg src)
 {
     tcg_out_insn(s, RRE, LGFR, dest, src);
 }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp opc, TCGReg data,
     case MO_SL | MO_BSWAP:
         /* swapped sign-extended int load */
         tcg_out_insn(s, RXY, LRV, data, base, index, disp);
-        tgen_ext32s(s, data, data);
+        tcg_out_ext32s(s, data, data);
         break;
     case MO_SL:
         tcg_out_insn(s, RXY, LGF, data, base, index, disp);
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         a0 = args[0], a1 = args[1], a2 = args[2];
         tcg_out_insn(s, RRE, LRVR, a0, a1);
         if (a2 & TCG_BSWAP_OS) {
-            tgen_ext32s(s, a0, a0);
+            tcg_out_ext32s(s, a0, a0);
         } else if ((a2 & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
             tgen_ext32u(s, a0, a0);
         }
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         break;
 
     case INDEX_op_ext_i32_i64:
-    case INDEX_op_ext32s_i64:
-        tgen_ext32s(s, args[0], args[1]);
+        tcg_out_ext32s(s, args[0], args[1]);
         break;
     case INDEX_op_extu_i32_i64:
     case INDEX_op_ext32u_i64:
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext16s_i64:
     case INDEX_op_ext16u_i32:
     case INDEX_op_ext16u_i64:
+    case INDEX_op_ext32s_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16u(TCGContext *s, TCGReg rd, TCGReg rs)
     tcg_out_arithi(s, rd, rd, 16, SHIFT_SRL);
 }
 
+static void tcg_out_ext32s(TCGContext *s, TCGReg rd, TCGReg rs)
+{
+    tcg_out_arithi(s, rd, rs, 0, SHIFT_SRA);
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data, TCGReg addr,
 
     /* We let the helper sign-extend SB and SW, but leave SL for here.  */
     if (is_64 && (memop & MO_SSIZE) == MO_SL) {
-        tcg_out_arithi(s, data, TCG_REG_O0, 0, SHIFT_SRA);
+        tcg_out_ext32s(s, data, TCG_REG_O0);
     } else {
         tcg_out_mov(s, TCG_TYPE_REG, data, TCG_REG_O0);
     }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         c = ARITH_UDIVX;
         goto gen_arith;
     case INDEX_op_ext_i32_i64:
-    case INDEX_op_ext32s_i64:
-        tcg_out_arithi(s, a0, a1, 0, SHIFT_SRA);
+        tcg_out_ext32s(s, a0, a1);
         break;
     case INDEX_op_extu_i32_i64:
     case INDEX_op_ext32u_i64:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext16s_i64:
     case INDEX_op_ext16u_i32:
     case INDEX_op_ext16u_i64:
+    case INDEX_op_ext32s_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16u(TCGContext *s, TCGReg rd, TCGReg rs)
     }
 }
 
+static void tcg_out_ext32s(TCGContext *s, TCGReg rd, TCGReg rs)
+{
+    tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
+    tcg_debug_assert(TCG_TARGET_HAS_ext32s_i64);
+    tcg_out_op_rr(s, INDEX_op_ext32s_i64, rd, rs);
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
 
     CASE_32_64(neg)      /* Optional (TCG_TARGET_HAS_neg_*). */
     CASE_32_64(not)      /* Optional (TCG_TARGET_HAS_not_*). */
-    CASE_64(ext32s)      /* Optional (TCG_TARGET_HAS_ext32s_i64). */
     CASE_64(ext32u)      /* Optional (TCG_TARGET_HAS_ext32u_i64). */
     CASE_64(ext_i32)
     CASE_64(extu_i32)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext16s_i64:
     case INDEX_op_ext16u_i32:
     case INDEX_op_ext16u_i64:
+    case INDEX_op_ext32s_i64:
     default:
         g_assert_not_reached();
     }
-- 
2.34.1

We will need a backend interface for performing 32-bit zero-extend.
Use it in tcg_reg_alloc_op in the meantime.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg.c                        |  4 ++++
 tcg/aarch64/tcg-target.c.inc     |  9 +++++++--
 tcg/arm/tcg-target.c.inc         |  5 +++++
 tcg/i386/tcg-target.c.inc        |  4 ++--
 tcg/loongarch64/tcg-target.c.inc |  2 +-
 tcg/mips/tcg-target.c.inc        |  3 ++-
 tcg/ppc/tcg-target.c.inc         |  4 +++-
 tcg/riscv/tcg-target.c.inc       |  2 +-
 tcg/s390x/tcg-target.c.inc       | 20 ++++++++++----------
 tcg/sparc64/tcg-target.c.inc     | 17 +++++++++++------
 tcg/tci/tcg-target.c.inc         |  9 ++++++++-
 11 files changed, 54 insertions(+), 25 deletions(-)

diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg);
 static void tcg_out_ext8u(TCGContext *s, TCGReg ret, TCGReg arg);
 static void tcg_out_ext16u(TCGContext *s, TCGReg ret, TCGReg arg);
 static void tcg_out_ext32s(TCGContext *s, TCGReg ret, TCGReg arg);
+static void tcg_out_ext32u(TCGContext *s, TCGReg ret, TCGReg arg);
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg, TCGReg, tcg_target_long);
 static void tcg_out_exit_tb(TCGContext *s, uintptr_t arg);
 static void tcg_out_goto_tb(TCGContext *s, int which);
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_ext32s_i64:
         tcg_out_ext32s(s, new_args[0], new_args[1]);
         break;
+    case INDEX_op_ext32u_i64:
+        tcg_out_ext32u(s, new_args[0], new_args[1]);
+        break;
     default:
         if (def->flags & TCG_OPF_VECTOR) {
             tcg_out_vec_op(s, op->opc, TCGOP_VECL(op), TCGOP_VECE(op),
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16u(TCGContext *s, TCGReg rd, TCGReg rn)
     tcg_out_uxt(s, MO_16, rd, rn);
 }
 
+static void tcg_out_ext32u(TCGContext *s, TCGReg rd, TCGReg rn)
+{
+    tcg_out_movr(s, TCG_TYPE_I32, rd, rn);
+}
+
 static void tcg_out_addsubi(TCGContext *s, int ext, TCGReg rd,
                             TCGReg rn, int64_t aimm)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_sxt(s, TCG_TYPE_I64, MO_32, a0, a1);
         break;
     case INDEX_op_extu_i32_i64:
-    case INDEX_op_ext32u_i64:
-        tcg_out_movr(s, TCG_TYPE_I32, a0, a1);
+        tcg_out_ext32u(s, a0, a1);
         break;
 
     case INDEX_op_deposit_i64:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext16u_i64:
     case INDEX_op_ext16u_i32:
     case INDEX_op_ext32s_i64:
+    case INDEX_op_ext32u_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32s(TCGContext *s, TCGReg rd, TCGReg rn)
     g_assert_not_reached();
 }
 
+static void tcg_out_ext32u(TCGContext *s, TCGReg rd, TCGReg rn)
+{
+    g_assert_not_reached();
+}
+
 static void tcg_out_bswap16(TCGContext *s, ARMCond cond,
                             TCGReg rd, TCGReg rn, int flags)
 {
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg dest, TCGReg src)
     tcg_out_modrm(s, OPC_MOVSWL + rexw, dest, src);
 }
 
-static inline void tcg_out_ext32u(TCGContext *s, int dest, int src)
+static void tcg_out_ext32u(TCGContext *s, TCGReg dest, TCGReg src)
 {
     /* 32-bit mov zero extends.  */
     tcg_out_modrm(s, OPC_MOVL_GvEv, dest, src);
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_bswap64(s, a0);
         break;
     case INDEX_op_extu_i32_i64:
-    case INDEX_op_ext32u_i64:
     case INDEX_op_extrl_i64_i32:
         tcg_out_ext32u(s, a0, a1);
         break;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext16u_i32:
     case INDEX_op_ext16u_i64:
     case INDEX_op_ext32s_i64:
+    case INDEX_op_ext32u_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_brcond(s, a2, a0, a1, arg_label(args[3]));
         break;
 
-    case INDEX_op_ext32u_i64:
     case INDEX_op_extu_i32_i64:
         tcg_out_ext32u(s, a0, a1);
         break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext16u_i32:
     case INDEX_op_ext16u_i64:
     case INDEX_op_ext32s_i64:
+    case INDEX_op_ext32u_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_bswap64(TCGContext *s, TCGReg ret, TCGReg arg)
 
 static void tcg_out_ext32u(TCGContext *s, TCGReg ret, TCGReg arg)
 {
+    tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
     if (use_mips32r2_instructions) {
         tcg_out_opc_bf(s, OPC_DEXT, ret, arg, 31, 0);
     } else {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_extrl_i64_i32:
         tcg_out_ext32s(s, a0, a1);
         break;
-    case INDEX_op_ext32u_i64:
     case INDEX_op_extu_i32_i64:
         tcg_out_ext32u(s, a0, a1);
         break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext16s_i32:
     case INDEX_op_ext16s_i64:
     case INDEX_op_ext32s_i64:
+    case INDEX_op_ext32u_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32s(TCGContext *s, TCGReg dst, TCGReg src)
     tcg_out32(s, EXTSW | RA(dst) | RS(src));
 }
 
-static inline void tcg_out_ext32u(TCGContext *s, TCGReg dst, TCGReg src)
+static void tcg_out_ext32u(TCGContext *s, TCGReg dst, TCGReg src)
 {
+    tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
     tcg_out_rld(s, RLDICL, dst, src, 0, 32);
 }
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext16u_i32:
     case INDEX_op_ext16u_i64:
     case INDEX_op_ext32s_i64:
+    case INDEX_op_ext32u_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_qemu_st(s, args, true);
         break;
 
-    case INDEX_op_ext32u_i64:
     case INDEX_op_extu_i32_i64:
         tcg_out_ext32u(s, a0, a1);
         break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext16u_i32:
     case INDEX_op_ext16u_i64:
     case INDEX_op_ext32s_i64:
+    case INDEX_op_ext32u_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32s(TCGContext *s, TCGReg dest, TCGReg src)
     tcg_out_insn(s, RRE, LGFR, dest, src);
 }
 
-static inline void tgen_ext32u(TCGContext *s, TCGReg dest, TCGReg src)
+static void tcg_out_ext32u(TCGContext *s, TCGReg dest, TCGReg src)
 {
     tcg_out_insn(s, RRE, LLGFR, dest, src);
 }
@@ -XXX,XX +XXX,XX @@ static void tgen_andi(TCGContext *s, TCGType type, TCGReg dest, uint64_t val)
 
     /* Look for the zero-extensions.  */
     if ((val & valid) == 0xffffffff) {
-        tgen_ext32u(s, dest, dest);
+        tcg_out_ext32u(s, dest, dest);
         return;
     }
     if ((val & valid) == 0xff) {
@@ -XXX,XX +XXX,XX @@ static void tgen_ctpop(TCGContext *s, TCGType type, TCGReg dest, TCGReg src)
     /* With MIE3, and bit 0 of m4 set, we get the complete result. */
     if (HAVE_FACILITY(MISC_INSN_EXT3)) {
         if (type == TCG_TYPE_I32) {
-            tgen_ext32u(s, dest, src);
+            tcg_out_ext32u(s, dest, src);
             src = dest;
         }
         tcg_out_insn(s, RRFc, POPCNT, dest, src, 8);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp opc, TCGReg data,
     case MO_UL | MO_BSWAP:
         /* swapped unsigned int load with upper bits zeroed */
         tcg_out_insn(s, RXY, LRV, data, base, index, disp);
-        tgen_ext32u(s, data, data);
+        tcg_out_ext32u(s, data, data);
         break;
     case MO_UL:
         tcg_out_insn(s, RXY, LLGF, data, base, index, disp);
@@ -XXX,XX +XXX,XX @@ static TCGReg tcg_out_tlb_read(TCGContext *s, TCGReg addr_reg, MemOp opc,
                  offsetof(CPUTLBEntry, addend));
 
     if (TARGET_LONG_BITS == 32) {
-        tgen_ext32u(s, TCG_REG_R3, addr_reg);
+        tcg_out_ext32u(s, TCG_REG_R3, addr_reg);
         return TCG_REG_R3;
     }
     return addr_reg;
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
         tcg_out_ext16u(s, TCG_REG_R4, data_reg);
         break;
     case MO_UL:
-        tgen_ext32u(s, TCG_REG_R4, data_reg);
+        tcg_out_ext32u(s, TCG_REG_R4, data_reg);
         break;
     case MO_UQ:
         tcg_out_mov(s, TCG_TYPE_I64, TCG_REG_R4, data_reg);
@@ -XXX,XX +XXX,XX @@ static void tcg_prepare_user_ldst(TCGContext *s, TCGReg *addr_reg,
                                   TCGReg *index_reg, tcg_target_long *disp)
 {
     if (TARGET_LONG_BITS == 32) {
-        tgen_ext32u(s, TCG_TMP0, *addr_reg);
+        tcg_out_ext32u(s, TCG_TMP0, *addr_reg);
         *addr_reg = TCG_TMP0;
     }
     if (guest_base < 0x80000) {
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         if (a2 & TCG_BSWAP_OS) {
             tcg_out_ext32s(s, a0, a0);
         } else if ((a2 & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
-            tgen_ext32u(s, a0, a0);
+            tcg_out_ext32u(s, a0, a0);
         }
         break;
 
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_ext32s(s, args[0], args[1]);
         break;
     case INDEX_op_extu_i32_i64:
-    case INDEX_op_ext32u_i64:
-        tgen_ext32u(s, args[0], args[1]);
+        tcg_out_ext32u(s, args[0], args[1]);
         break;
 
     case INDEX_op_add2_i64:
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext16u_i32:
     case INDEX_op_ext16u_i64:
     case INDEX_op_ext32s_i64:
+    case INDEX_op_ext32u_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32s(TCGContext *s, TCGReg rd, TCGReg rs)
     tcg_out_arithi(s, rd, rs, 0, SHIFT_SRA);
 }
 
+static void tcg_out_ext32u(TCGContext *s, TCGReg rd, TCGReg rs)
+{
+    tcg_out_arithi(s, rd, rs, 0, SHIFT_SRL);
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
@@ -XXX,XX +XXX,XX @@ static void emit_extend(TCGContext *s, TCGReg r, int op)
         tcg_out_ext16u(s, r, r);
         break;
     case MO_32:
-        tcg_out_arith(s, r, r, 0, SHIFT_SRL);
+        tcg_out_ext32u(s, r, r);
         break;
     case MO_64:
         break;
@@ -XXX,XX +XXX,XX @@ static TCGReg tcg_out_tlb_load(TCGContext *s, TCGReg addr, int mem_index,
 
     /* If the guest address must be zero-extended, do so now.  */
     if (TARGET_LONG_BITS == 32) {
-        tcg_out_arithi(s, r0, addr, 0, SHIFT_SRL);
+        tcg_out_ext32u(s, r0, addr);
         return r0;
     }
     return addr;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data, TCGReg addr,
     unsigned t_bits;
 
     if (TARGET_LONG_BITS == 32) {
-        tcg_out_arithi(s, TCG_REG_T1, addr, 0, SHIFT_SRL);
+        tcg_out_ext32u(s, TCG_REG_T1, addr);
         addr = TCG_REG_T1;
     }
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data, TCGReg addr,
     unsigned t_bits;
 
     if (TARGET_LONG_BITS == 32) {
-        tcg_out_arithi(s, TCG_REG_T1, addr, 0, SHIFT_SRL);
+        tcg_out_ext32u(s, TCG_REG_T1, addr);
         addr = TCG_REG_T1;
     }
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_ext32s(s, a0, a1);
         break;
     case INDEX_op_extu_i32_i64:
-    case INDEX_op_ext32u_i64:
-        tcg_out_arithi(s, a0, a1, 0, SHIFT_SRL);
+        tcg_out_ext32u(s, a0, a1);
         break;
     case INDEX_op_extrl_i64_i32:
         tcg_out_mov(s, TCG_TYPE_I32, a0, a1);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext16u_i32:
     case INDEX_op_ext16u_i64:
     case INDEX_op_ext32s_i64:
+    case INDEX_op_ext32u_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32s(TCGContext *s, TCGReg rd, TCGReg rs)
     tcg_out_op_rr(s, INDEX_op_ext32s_i64, rd, rs);
 }
 
+static void tcg_out_ext32u(TCGContext *s, TCGReg rd, TCGReg rs)
+{
+    tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
+    tcg_debug_assert(TCG_TARGET_HAS_ext32u_i64);
+    tcg_out_op_rr(s, INDEX_op_ext32u_i64, rd, rs);
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
 
     CASE_32_64(neg)      /* Optional (TCG_TARGET_HAS_neg_*). */
     CASE_32_64(not)      /* Optional (TCG_TARGET_HAS_not_*). */
-    CASE_64(ext32u)      /* Optional (TCG_TARGET_HAS_ext32u_i64). */
     CASE_64(ext_i32)
     CASE_64(extu_i32)
     CASE_32_64(ctpop)    /* Optional (TCG_TARGET_HAS_ctpop_*). */
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext16u_i32:
     case INDEX_op_ext16u_i64:
     case INDEX_op_ext32s_i64:
+    case INDEX_op_ext32u_i64:
     default:
         g_assert_not_reached();
     }
-- 
2.34.1

We will need a backend interface for type extension with sign.
Use it in tcg_reg_alloc_op in the meantime.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg.c                        | 4 ++++
 tcg/aarch64/tcg-target.c.inc     | 9 ++++++---
 tcg/arm/tcg-target.c.inc         | 5 +++++
 tcg/i386/tcg-target.c.inc        | 9 ++++++---
 tcg/loongarch64/tcg-target.c.inc | 7 ++++++-
 tcg/mips/tcg-target.c.inc        | 7 ++++++-
 tcg/ppc/tcg-target.c.inc         | 9 ++++++---
 tcg/riscv/tcg-target.c.inc       | 7 ++++++-
 tcg/s390x/tcg-target.c.inc       | 9 ++++++---
 tcg/sparc64/tcg-target.c.inc     | 9 ++++++---
 tcg/tci/tcg-target.c.inc         | 7 ++++++-
 11 files changed, 63 insertions(+), 19 deletions(-)

diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext8u(TCGContext *s, TCGReg ret, TCGReg arg);
 static void tcg_out_ext16u(TCGContext *s, TCGReg ret, TCGReg arg);
 static void tcg_out_ext32s(TCGContext *s, TCGReg ret, TCGReg arg);
 static void tcg_out_ext32u(TCGContext *s, TCGReg ret, TCGReg arg);
+static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg);
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg, TCGReg, tcg_target_long);
 static void tcg_out_exit_tb(TCGContext *s, uintptr_t arg);
 static void tcg_out_goto_tb(TCGContext *s, int which);
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_ext32u_i64:
         tcg_out_ext32u(s, new_args[0], new_args[1]);
         break;
+    case INDEX_op_ext_i32_i64:
+        tcg_out_exts_i32_i64(s, new_args[0], new_args[1]);
+        break;
     default:
         if (def->flags & TCG_OPF_VECTOR) {
             tcg_out_vec_op(s, op->opc, TCGOP_VECL(op), TCGOP_VECE(op),
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32s(TCGContext *s, TCGReg rd, TCGReg rn)
     tcg_out_sxt(s, TCG_TYPE_I64, MO_32, rd, rn);
 }
 
+static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg rd, TCGReg rn)
+{
+    tcg_out_ext32s(s, rd, rn);
+}
+
 static inline void tcg_out_uxt(TCGContext *s, MemOp s_bits,
                                TCGReg rd, TCGReg rn)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         }
         break;
 
-    case INDEX_op_ext_i32_i64:
-        tcg_out_sxt(s, TCG_TYPE_I64, MO_32, a0, a1);
-        break;
     case INDEX_op_extu_i32_i64:
         tcg_out_ext32u(s, a0, a1);
         break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext16u_i32:
     case INDEX_op_ext32s_i64:
     case INDEX_op_ext32u_i64:
+    case INDEX_op_ext_i32_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32u(TCGContext *s, TCGReg rd, TCGReg rn)
     g_assert_not_reached();
 }
 
+static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg rd, TCGReg rn)
+{
+    g_assert_not_reached();
+}
+
 static void tcg_out_bswap16(TCGContext *s, ARMCond cond,
                             TCGReg rd, TCGReg rn, int flags)
 {
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32s(TCGContext *s, TCGReg dest, TCGReg src)
     tcg_out_modrm(s, OPC_MOVSLQ, dest, src);
 }
 
+static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg dest, TCGReg src)
+{
+    tcg_out_ext32s(s, dest, src);
+}
+
 static inline void tcg_out_bswap64(TCGContext *s, int reg)
 {
     tcg_out_opc(s, OPC_BSWAP + P_REXW + LOWREGMASK(reg), 0, reg, 0);
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_extrl_i64_i32:
         tcg_out_ext32u(s, a0, a1);
         break;
-    case INDEX_op_ext_i32_i64:
-        tcg_out_ext32s(s, a0, a1);
-        break;
     case INDEX_op_extrh_i64_i32:
         tcg_out_shifti(s, SHIFT_SHR + P_REXW, a0, 32);
         break;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext16u_i64:
     case INDEX_op_ext32s_i64:
     case INDEX_op_ext32u_i64:
+    case INDEX_op_ext_i32_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32s(TCGContext *s, TCGReg ret, TCGReg arg)
     tcg_out_opc_addi_w(s, ret, arg, 0);
 }
 
+static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg)
+{
+    tcg_out_ext32s(s, ret, arg);
+}
+
 static void tcg_out_clzctz(TCGContext *s, LoongArchInsn opc,
                            TCGReg a0, TCGReg a1, TCGReg a2,
                            bool c2, bool is_32bit)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         break;
 
     case INDEX_op_extrl_i64_i32:
-    case INDEX_op_ext_i32_i64:
         tcg_out_ext32s(s, a0, a1);
         break;
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext16u_i64:
     case INDEX_op_ext32s_i64:
     case INDEX_op_ext32u_i64:
+    case INDEX_op_ext_i32_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32s(TCGContext *s, TCGReg rd, TCGReg rs)
     tcg_out_opc_sa(s, OPC_SLL, rd, rs, 0);
 }
 
+static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg rd, TCGReg rs)
+{
+    tcg_out_ext32s(s, rd, rs);
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_extrh_i64_i32:
         tcg_out_dsra(s, a0, a1, 32);
         break;
-    case INDEX_op_ext_i32_i64:
     case INDEX_op_extrl_i64_i32:
         tcg_out_ext32s(s, a0, a1);
         break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext16s_i64:
     case INDEX_op_ext32s_i64:
     case INDEX_op_ext32u_i64:
+    case INDEX_op_ext_i32_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32u(TCGContext *s, TCGReg dst, TCGReg src)
     tcg_out_rld(s, RLDICL, dst, src, 0, 32);
 }
 
+static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg dst, TCGReg src)
+{
+    tcg_out_ext32s(s, dst, src);
+}
+
 static inline void tcg_out_shli32(TCGContext *s, TCGReg dst, TCGReg src, int c)
 {
     tcg_out_rlw(s, RLWINM, dst, src, c, 0, 31 - c);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_qemu_st(s, args, true);
         break;
 
-    case INDEX_op_ext_i32_i64:
-        tcg_out_ext32s(s, args[0], args[1]);
-        break;
     case INDEX_op_extu_i32_i64:
         tcg_out_ext32u(s, args[0], args[1]);
         break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext16u_i64:
     case INDEX_op_ext32s_i64:
     case INDEX_op_ext32u_i64:
+    case INDEX_op_ext_i32_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32s(TCGContext *s, TCGReg ret, TCGReg arg)
     tcg_out_opc_imm(s, OPC_ADDIW, ret, arg, 0);
 }
 
+static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg)
+{
+    tcg_out_ext32s(s, ret, arg);
+}
+
 static void tcg_out_ldst(TCGContext *s, RISCVInsn opc, TCGReg data,
                          TCGReg addr, intptr_t offset)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         break;
 
     case INDEX_op_extrl_i64_i32:
-    case INDEX_op_ext_i32_i64:
         tcg_out_ext32s(s, a0, a1);
         break;
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext16u_i64:
     case INDEX_op_ext32s_i64:
     case INDEX_op_ext32u_i64:
+    case INDEX_op_ext_i32_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32u(TCGContext *s, TCGReg dest, TCGReg src)
     tcg_out_insn(s, RRE, LLGFR, dest, src);
 }
 
+static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg dest, TCGReg src)
+{
+    tcg_out_ext32s(s, dest, src);
+}
+
 static void tgen_andi_risbg(TCGContext *s, TCGReg out, TCGReg in, uint64_t val)
 {
     int msb, lsb;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         }
         break;
 
-    case INDEX_op_ext_i32_i64:
-        tcg_out_ext32s(s, args[0], args[1]);
-        break;
     case INDEX_op_extu_i32_i64:
         tcg_out_ext32u(s, args[0], args[1]);
         break;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext16u_i64:
     case INDEX_op_ext32s_i64:
     case INDEX_op_ext32u_i64:
+    case INDEX_op_ext_i32_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32u(TCGContext *s, TCGReg rd, TCGReg rs)
     tcg_out_arithi(s, rd, rs, 0, SHIFT_SRL);
 }
 
+static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg rd, TCGReg rs)
+{
+    tcg_out_ext32s(s, rd, rs);
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_divu_i64:
         c = ARITH_UDIVX;
         goto gen_arith;
-    case INDEX_op_ext_i32_i64:
-        tcg_out_ext32s(s, a0, a1);
-        break;
     case INDEX_op_extu_i32_i64:
         tcg_out_ext32u(s, a0, a1);
         break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext16u_i64:
     case INDEX_op_ext32s_i64:
     case INDEX_op_ext32u_i64:
+    case INDEX_op_ext_i32_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32u(TCGContext *s, TCGReg rd, TCGReg rs)
     tcg_out_op_rr(s, INDEX_op_ext32u_i64, rd, rs);
 }
 
+static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg rd, TCGReg rs)
+{
+    tcg_out_ext32s(s, rd, rs);
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
 
     CASE_32_64(neg)      /* Optional (TCG_TARGET_HAS_neg_*). */
     CASE_32_64(not)      /* Optional (TCG_TARGET_HAS_not_*). */
-    CASE_64(ext_i32)
     CASE_64(extu_i32)
     CASE_32_64(ctpop)    /* Optional (TCG_TARGET_HAS_ctpop_*). */
     case INDEX_op_bswap32_i32: /* Optional (TCG_TARGET_HAS_bswap32_i32). */
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext16u_i64:
     case INDEX_op_ext32s_i64:
     case INDEX_op_ext32u_i64:
+    case INDEX_op_ext_i32_i64:
     default:
         g_assert_not_reached();
     }
-- 
2.34.1

We will need a backend interface for type extension with zero.
Use it in tcg_reg_alloc_op in the meantime.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg.c                        |  4 ++++
 tcg/aarch64/tcg-target.c.inc     | 10 ++++++----
 tcg/arm/tcg-target.c.inc         |  5 +++++
 tcg/i386/tcg-target.c.inc        |  7 ++++++-
 tcg/loongarch64/tcg-target.c.inc | 10 ++++++----
 tcg/mips/tcg-target.c.inc        |  9 ++++++---
 tcg/ppc/tcg-target.c.inc         | 10 ++++++----
 tcg/riscv/tcg-target.c.inc       | 10 ++++++----
 tcg/s390x/tcg-target.c.inc       | 10 ++++++----
 tcg/sparc64/tcg-target.c.inc     |  9 ++++++---
 tcg/tci/tcg-target.c.inc         |  7 ++++++-
 11 files changed, 63 insertions(+), 28 deletions(-)

diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext16u(TCGContext *s, TCGReg ret, TCGReg arg);
 static void tcg_out_ext32s(TCGContext *s, TCGReg ret, TCGReg arg);
 static void tcg_out_ext32u(TCGContext *s, TCGReg ret, TCGReg arg);
 static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg);
+static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg);
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg, TCGReg, tcg_target_long);
 static void tcg_out_exit_tb(TCGContext *s, uintptr_t arg);
 static void tcg_out_goto_tb(TCGContext *s, int which);
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_ext_i32_i64:
         tcg_out_exts_i32_i64(s, new_args[0], new_args[1]);
         break;
+    case INDEX_op_extu_i32_i64:
+        tcg_out_extu_i32_i64(s, new_args[0], new_args[1]);
+        break;
     default:
         if (def->flags & TCG_OPF_VECTOR) {
             tcg_out_vec_op(s, op->opc, TCGOP_VECL(op), TCGOP_VECE(op),
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32u(TCGContext *s, TCGReg rd, TCGReg rn)
     tcg_out_movr(s, TCG_TYPE_I32, rd, rn);
 }
 
+static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg rd, TCGReg rn)
+{
+    tcg_out_ext32u(s, rd, rn);
+}
+
 static void tcg_out_addsubi(TCGContext *s, int ext, TCGReg rd,
                             TCGReg rn, int64_t aimm)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         }
         break;
 
-    case INDEX_op_extu_i32_i64:
-        tcg_out_ext32u(s, a0, a1);
-        break;
-
     case INDEX_op_deposit_i64:
     case INDEX_op_deposit_i32:
         tcg_out_dep(s, ext, a0, REG0(2), args[3], args[4]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext32s_i64:
     case INDEX_op_ext32u_i64:
     case INDEX_op_ext_i32_i64:
+    case INDEX_op_extu_i32_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg rd, TCGReg rn)
     g_assert_not_reached();
 }
 
+static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg rd, TCGReg rn)
+{
+    g_assert_not_reached();
+}
+
 static void tcg_out_bswap16(TCGContext *s, ARMCond cond,
                             TCGReg rd, TCGReg rn, int flags)
 {
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg dest, TCGReg src)
     tcg_out_ext32s(s, dest, src);
 }
 
+static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg dest, TCGReg src)
+{
+    tcg_out_ext32u(s, dest, src);
+}
+
 static inline void tcg_out_bswap64(TCGContext *s, int reg)
 {
     tcg_out_opc(s, OPC_BSWAP + P_REXW + LOWREGMASK(reg), 0, reg, 0);
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_bswap64_i64:
         tcg_out_bswap64(s, a0);
         break;
-    case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
         tcg_out_ext32u(s, a0, a1);
         break;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext32s_i64:
     case INDEX_op_ext32u_i64:
     case INDEX_op_ext_i32_i64:
+    case INDEX_op_extu_i32_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg)
     tcg_out_ext32s(s, ret, arg);
 }
 
+static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg)
+{
+    tcg_out_ext32u(s, ret, arg);
+}
+
 static void tcg_out_clzctz(TCGContext *s, LoongArchInsn opc,
                            TCGReg a0, TCGReg a1, TCGReg a2,
                            bool c2, bool is_32bit)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_brcond(s, a2, a0, a1, arg_label(args[3]));
         break;
 
-    case INDEX_op_extu_i32_i64:
-        tcg_out_ext32u(s, a0, a1);
-        break;
-
     case INDEX_op_extrl_i64_i32:
         tcg_out_ext32s(s, a0, a1);
         break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext32s_i64:
     case INDEX_op_ext32u_i64:
     case INDEX_op_ext_i32_i64:
+    case INDEX_op_extu_i32_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg rd, TCGReg rs)
     tcg_out_ext32s(s, rd, rs);
 }
 
+static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg rd, TCGReg rs)
+{
+    tcg_out_ext32u(s, rd, rs);
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_extrl_i64_i32:
         tcg_out_ext32s(s, a0, a1);
         break;
-    case INDEX_op_extu_i32_i64:
-        tcg_out_ext32u(s, a0, a1);
-        break;
 
     case INDEX_op_sar_i32:
         i1 = OPC_SRAV, i2 = OPC_SRA;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext32s_i64:
     case INDEX_op_ext32u_i64:
     case INDEX_op_ext_i32_i64:
+    case INDEX_op_extu_i32_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg dst, TCGReg src)
     tcg_out_ext32s(s, dst, src);
 }
 
+static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg dst, TCGReg src)
+{
+    tcg_out_ext32u(s, dst, src);
+}
+
 static inline void tcg_out_shli32(TCGContext *s, TCGReg dst, TCGReg src, int c)
 {
     tcg_out_rlw(s, RLWINM, dst, src, c, 0, 31 - c);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_qemu_st(s, args, true);
         break;
 
-    case INDEX_op_extu_i32_i64:
-        tcg_out_ext32u(s, args[0], args[1]);
-        break;
-
     case INDEX_op_setcond_i32:
         tcg_out_setcond(s, TCG_TYPE_I32, args[3], args[0], args[1], args[2],
                         const_args[2]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext32s_i64:
     case INDEX_op_ext32u_i64:
     case INDEX_op_ext_i32_i64:
+    case INDEX_op_extu_i32_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg)
     tcg_out_ext32s(s, ret, arg);
 }
 
+static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg)
+{
+    tcg_out_ext32u(s, ret, arg);
+}
+
 static void tcg_out_ldst(TCGContext *s, RISCVInsn opc, TCGReg data,
                          TCGReg addr, intptr_t offset)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_qemu_st(s, args, true);
         break;
 
-    case INDEX_op_extu_i32_i64:
-        tcg_out_ext32u(s, a0, a1);
-        break;
-
     case INDEX_op_extrl_i64_i32:
         tcg_out_ext32s(s, a0, a1);
         break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext32s_i64:
     case INDEX_op_ext32u_i64:
     case INDEX_op_ext_i32_i64:
+    case INDEX_op_extu_i32_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg dest, TCGReg src)
     tcg_out_ext32s(s, dest, src);
 }
 
+static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg dest, TCGReg src)
+{
+    tcg_out_ext32u(s, dest, src);
+}
+
 static void tgen_andi_risbg(TCGContext *s, TCGReg out, TCGReg in, uint64_t val)
 {
     int msb, lsb;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         }
         break;
 
-    case INDEX_op_extu_i32_i64:
-        tcg_out_ext32u(s, args[0], args[1]);
-        break;
-
     case INDEX_op_add2_i64:
         if (const_args[4]) {
             if ((int64_t)args[4] >= 0) {
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext32s_i64:
     case INDEX_op_ext32u_i64:
     case INDEX_op_ext_i32_i64:
+    case INDEX_op_extu_i32_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg rd, TCGReg rs)
     tcg_out_ext32s(s, rd, rs);
 }
 
+static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg rd, TCGReg rs)
+{
+    tcg_out_ext32u(s, rd, rs);
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_divu_i64:
         c = ARITH_UDIVX;
         goto gen_arith;
-    case INDEX_op_extu_i32_i64:
-        tcg_out_ext32u(s, a0, a1);
-        break;
     case INDEX_op_extrl_i64_i32:
         tcg_out_mov(s, TCG_TYPE_I32, a0, a1);
         break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext32s_i64:
     case INDEX_op_ext32u_i64:
     case INDEX_op_ext_i32_i64:
+    case INDEX_op_extu_i32_i64:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg rd, TCGReg rs)
     tcg_out_ext32s(s, rd, rs);
 }
 
+static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg rd, TCGReg rs)
+{
+    tcg_out_ext32u(s, rd, rs);
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
 
     CASE_32_64(neg)      /* Optional (TCG_TARGET_HAS_neg_*). */
     CASE_32_64(not)      /* Optional (TCG_TARGET_HAS_not_*). */
-    CASE_64(extu_i32)
     CASE_32_64(ctpop)    /* Optional (TCG_TARGET_HAS_ctpop_*). */
     case INDEX_op_bswap32_i32: /* Optional (TCG_TARGET_HAS_bswap32_i32). */
     case INDEX_op_bswap64_i64: /* Optional (TCG_TARGET_HAS_bswap64_i64). */
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext32s_i64:
     case INDEX_op_ext32u_i64:
     case INDEX_op_ext_i32_i64:
+    case INDEX_op_extu_i32_i64:
     default:
         g_assert_not_reached();
     }
-- 
2.34.1

We will need a backend interface for type truncation.  For those backends
that did not enable TCG_TARGET_HAS_extrl_i64_i32, use tcg_out_mov.
Use it in tcg_reg_alloc_op in the meantime.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg.c                        |  4 ++++
 tcg/aarch64/tcg-target.c.inc     |  6 ++++++
 tcg/arm/tcg-target.c.inc         |  5 +++++
 tcg/i386/tcg-target.c.inc        |  9 ++++++---
 tcg/loongarch64/tcg-target.c.inc | 10 ++++++----
 tcg/mips/tcg-target.c.inc        |  9 ++++++---
 tcg/ppc/tcg-target.c.inc         |  7 +++++++
 tcg/riscv/tcg-target.c.inc       | 10 ++++++----
 tcg/s390x/tcg-target.c.inc       |  6 ++++++
 tcg/sparc64/tcg-target.c.inc     |  9 ++++++---
 tcg/tci/tcg-target.c.inc         |  7 +++++++
 11 files changed, 65 insertions(+), 17 deletions(-)

diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ext32s(TCGContext *s, TCGReg ret, TCGReg arg);
 static void tcg_out_ext32u(TCGContext *s, TCGReg ret, TCGReg arg);
 static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg);
 static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg);
+static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg ret, TCGReg arg);
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg, TCGReg, tcg_target_long);
 static void tcg_out_exit_tb(TCGContext *s, uintptr_t arg);
 static void tcg_out_goto_tb(TCGContext *s, int which);
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_extu_i32_i64:
         tcg_out_extu_i32_i64(s, new_args[0], new_args[1]);
         break;
+    case INDEX_op_extrl_i64_i32:
+        tcg_out_extrl_i64_i32(s, new_args[0], new_args[1]);
+        break;
     default:
         if (def->flags & TCG_OPF_VECTOR) {
             tcg_out_vec_op(s, op->opc, TCGOP_VECL(op), TCGOP_VECE(op),
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg rd, TCGReg rn)
     tcg_out_ext32u(s, rd, rn);
 }
 
+static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg rd, TCGReg rn)
+{
+    tcg_out_mov(s, TCG_TYPE_I32, rd, rn);
+}
+
 static void tcg_out_addsubi(TCGContext *s, int ext, TCGReg rd,
                             TCGReg rn, int64_t aimm)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext32u_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
+    case INDEX_op_extrl_i64_i32:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg rd, TCGReg rn)
     g_assert_not_reached();
 }
 
+static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg rd, TCGReg rn)
+{
+    g_assert_not_reached();
+}
+
 static void tcg_out_bswap16(TCGContext *s, ARMCond cond,
                             TCGReg rd, TCGReg rn, int flags)
 {
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg dest, TCGReg src)
     tcg_out_ext32u(s, dest, src);
 }
 
+static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg dest, TCGReg src)
+{
+    tcg_out_ext32u(s, dest, src);
+}
+
 static inline void tcg_out_bswap64(TCGContext *s, int reg)
 {
     tcg_out_opc(s, OPC_BSWAP + P_REXW + LOWREGMASK(reg), 0, reg, 0);
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_bswap64_i64:
         tcg_out_bswap64(s, a0);
         break;
-    case INDEX_op_extrl_i64_i32:
-        tcg_out_ext32u(s, a0, a1);
-        break;
     case INDEX_op_extrh_i64_i32:
         tcg_out_shifti(s, SHIFT_SHR + P_REXW, a0, 32);
         break;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext32u_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
+    case INDEX_op_extrl_i64_i32:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg)
     tcg_out_ext32u(s, ret, arg);
 }
 
+static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg ret, TCGReg arg)
+{
+    tcg_out_ext32s(s, ret, arg);
+}
+
 static void tcg_out_clzctz(TCGContext *s, LoongArchInsn opc,
                            TCGReg a0, TCGReg a1, TCGReg a2,
                            bool c2, bool is_32bit)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_brcond(s, a2, a0, a1, arg_label(args[3]));
         break;
 
-    case INDEX_op_extrl_i64_i32:
-        tcg_out_ext32s(s, a0, a1);
-        break;
-
     case INDEX_op_extrh_i64_i32:
         tcg_out_opc_srai_d(s, a0, a1, 32);
         break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext32u_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
+    case INDEX_op_extrl_i64_i32:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg rd, TCGReg rs)
     tcg_out_ext32u(s, rd, rs);
 }
 
+static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg rd, TCGReg rs)
+{
+    tcg_out_ext32s(s, rd, rs);
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_extrh_i64_i32:
         tcg_out_dsra(s, a0, a1, 32);
         break;
-    case INDEX_op_extrl_i64_i32:
-        tcg_out_ext32s(s, a0, a1);
-        break;
 
     case INDEX_op_sar_i32:
         i1 = OPC_SRAV, i2 = OPC_SRA;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext32u_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
+    case INDEX_op_extrl_i64_i32:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg dst, TCGReg src)
     tcg_out_ext32u(s, dst, src);
 }
 
+static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg rd, TCGReg rn)
+{
+    tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
+    tcg_out_mov(s, TCG_TYPE_I32, rd, rn);
+}
+
 static inline void tcg_out_shli32(TCGContext *s, TCGReg dst, TCGReg src, int c)
 {
     tcg_out_rlw(s, RLWINM, dst, src, c, 0, 31 - c);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext32u_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
+    case INDEX_op_extrl_i64_i32:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg)
     tcg_out_ext32u(s, ret, arg);
 }
 
+static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg ret, TCGReg arg)
+{
+    tcg_out_ext32s(s, ret, arg);
+}
+
 static void tcg_out_ldst(TCGContext *s, RISCVInsn opc, TCGReg data,
                          TCGReg addr, intptr_t offset)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_qemu_st(s, args, true);
         break;
 
-    case INDEX_op_extrl_i64_i32:
-        tcg_out_ext32s(s, a0, a1);
-        break;
-
     case INDEX_op_extrh_i64_i32:
         tcg_out_opc_imm(s, OPC_SRAI, a0, a1, 32);
         break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext32u_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
+    case INDEX_op_extrl_i64_i32:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg dest, TCGReg src)
     tcg_out_ext32u(s, dest, src);
 }
 
+static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg dest, TCGReg src)
+{
+    tcg_out_mov(s, TCG_TYPE_I32, dest, src);
+}
+
 static void tgen_andi_risbg(TCGContext *s, TCGReg out, TCGReg in, uint64_t val)
 {
     int msb, lsb;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext32u_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
+    case INDEX_op_extrl_i64_i32:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg rd, TCGReg rs)
     tcg_out_ext32u(s, rd, rs);
 }
 
+static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg rd, TCGReg rs)
+{
+    tcg_out_mov(s, TCG_TYPE_I32, rd, rs);
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_divu_i64:
         c = ARITH_UDIVX;
         goto gen_arith;
-    case INDEX_op_extrl_i64_i32:
-        tcg_out_mov(s, TCG_TYPE_I32, a0, a1);
-        break;
     case INDEX_op_extrh_i64_i32:
         tcg_out_arithi(s, a0, a1, 32, SHIFT_SRLX);
         break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext32u_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
+    case INDEX_op_extrl_i64_i32:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg rd, TCGReg rs)
     tcg_out_ext32u(s, rd, rs);
 }
 
+static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg rd, TCGReg rs)
+{
+    tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
+    tcg_out_mov(s, TCG_TYPE_I32, rd, rs);
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext32u_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
+    case INDEX_op_extrl_i64_i32:
     default:
         g_assert_not_reached();
     }
-- 
2.34.1

This is common code in most qemu_{ld,st} slow paths, extending the
input value for the store helper data argument or extending the
return value from the load helper.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg.c                        | 63 ++++++++++++++++++++++++++++++++
 tcg/aarch64/tcg-target.c.inc     |  8 +---
 tcg/arm/tcg-target.c.inc         | 16 ++------
 tcg/i386/tcg-target.c.inc        | 30 +++------------
 tcg/loongarch64/tcg-target.c.inc | 53 ++++-----------------------
 tcg/ppc/tcg-target.c.inc         | 38 +++++--------------
 tcg/riscv/tcg-target.c.inc       | 13 +------
 tcg/s390x/tcg-target.c.inc       | 19 ++--------
 tcg/sparc64/tcg-target.c.inc     | 31 +++-------------
 9 files changed, 103 insertions(+), 168 deletions(-)

diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ void tcg_raise_tb_overflow(TCGContext *s)
     siglongjmp(s->jmp_trans, -2);
 }
 
+/**
+ * tcg_out_movext -- move and extend
+ * @s: tcg context
+ * @dst_type: integral type for destination
+ * @dst: destination register
+ * @src_type: integral type for source
+ * @src_ext: extension to apply to source
+ * @src: source register
+ *
+ * Move or extend @src into @dst, depending on @src_ext and the types.
+ */
+static void __attribute__((unused))
+tcg_out_movext(TCGContext *s, TCGType dst_type, TCGReg dst,
+               TCGType src_type, MemOp src_ext, TCGReg src)
+{
+    switch (src_ext) {
+    case MO_UB:
+        tcg_out_ext8u(s, dst, src);
+        break;
+    case MO_SB:
+        tcg_out_ext8s(s, dst_type, dst, src);
+        break;
+    case MO_UW:
+        tcg_out_ext16u(s, dst, src);
+        break;
+    case MO_SW:
+        tcg_out_ext16s(s, dst_type, dst, src);
+        break;
+    case MO_UL:
+    case MO_SL:
+        if (dst_type == TCG_TYPE_I32) {
+            if (src_type == TCG_TYPE_I32) {
+                tcg_out_mov(s, TCG_TYPE_I32, dst, src);
+            } else {
+                tcg_out_extrl_i64_i32(s, dst, src);
+            }
+        } else if (src_type == TCG_TYPE_I32) {
+            if (src_ext & MO_SIGN) {
+                tcg_out_exts_i32_i64(s, dst, src);
+            } else {
+                tcg_out_extu_i32_i64(s, dst, src);
+            }
+        } else {
+            if (src_ext & MO_SIGN) {
+                tcg_out_ext32s(s, dst, src);
+            } else {
+                tcg_out_ext32u(s, dst, src);
+            }
+        }
+        break;
+    case MO_UQ:
+        tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
+        if (dst_type == TCG_TYPE_I32) {
+            tcg_out_extrl_i64_i32(s, dst, src);
+        } else {
+            tcg_out_mov(s, TCG_TYPE_I64, dst, src);
+        }
+        break;
+    default:
+        g_assert_not_reached();
+    }
+}
+
 #define C_PFX1(P, A)                    P##A
 #define C_PFX2(P, A, B)                 P##A##_##B
 #define C_PFX3(P, A, B, C)              P##A##_##B##_##C
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 {
     MemOpIdx oi = lb->oi;
     MemOp opc = get_memop(oi);
-    MemOp size = opc & MO_SIZE;
 
     if (!reloc_pc19(lb->label_ptr[0], tcg_splitwx_to_rx(s->code_ptr))) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
     tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_X2, oi);
     tcg_out_adr(s, TCG_REG_X3, lb->raddr);
     tcg_out_call_int(s, qemu_ld_helpers[opc & MO_SIZE]);
-    if (opc & MO_SIGN) {
-        tcg_out_sxt(s, lb->type, size, lb->datalo_reg, TCG_REG_X0);
-    } else {
-        tcg_out_mov(s, size == MO_64, lb->datalo_reg, TCG_REG_X0);
-    }
 
+    tcg_out_movext(s, lb->type, lb->datalo_reg,
+                   TCG_TYPE_REG, opc & MO_SSIZE, TCG_REG_X0);
     tcg_out_goto(s, lb->raddr);
     return true;
 }
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 
     datalo = lb->datalo_reg;
     datahi = lb->datahi_reg;
-    switch (opc & MO_SSIZE) {
-    case MO_SB:
-        tcg_out_ext8s(s, TCG_TYPE_I32, datalo, TCG_REG_R0);
-        break;
-    case MO_SW:
-        tcg_out_ext16s(s, TCG_TYPE_I32, datalo, TCG_REG_R0);
-        break;
-    default:
-        tcg_out_mov_reg(s, COND_AL, datalo, TCG_REG_R0);
-        break;
-    case MO_UQ:
+    if ((opc & MO_SIZE) == MO_64) {
         if (datalo != TCG_REG_R1) {
             tcg_out_mov_reg(s, COND_AL, datalo, TCG_REG_R0);
             tcg_out_mov_reg(s, COND_AL, datahi, TCG_REG_R1);
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
             tcg_out_mov_reg(s, COND_AL, datahi, TCG_REG_R1);
             tcg_out_mov_reg(s, COND_AL, datalo, TCG_REG_TMP);
         }
-        break;
+    } else {
+        tcg_out_movext(s, TCG_TYPE_I32, datalo,
+                       TCG_TYPE_I32, opc & MO_SSIZE, TCG_REG_R0);
     }
 
     tcg_out_goto(s, COND_AL, lb->raddr);
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
     tcg_out_branch(s, 1, qemu_ld_helpers[opc & (MO_BSWAP | MO_SIZE)]);
 
     data_reg = l->datalo_reg;
-    switch (opc & MO_SSIZE) {
-    case MO_SB:
-        tcg_out_ext8s(s, l->type, data_reg, TCG_REG_EAX);
-        break;
-    case MO_SW:
-        tcg_out_ext16s(s, l->type, data_reg, TCG_REG_EAX);
-        break;
-#if TCG_TARGET_REG_BITS == 64
-    case MO_SL:
-        tcg_out_ext32s(s, data_reg, TCG_REG_EAX);
-        break;
-#endif
-    case MO_UB:
-    case MO_UW:
-        /* Note that the helpers have zero-extended to tcg_target_long.  */
-    case MO_UL:
-        tcg_out_mov(s, TCG_TYPE_I32, data_reg, TCG_REG_EAX);
-        break;
-    case MO_UQ:
-        if (TCG_TARGET_REG_BITS == 64) {
-            tcg_out_mov(s, TCG_TYPE_I64, data_reg, TCG_REG_RAX);
-        } else if (data_reg == TCG_REG_EDX) {
+    if (TCG_TARGET_REG_BITS == 32 && (opc & MO_SIZE) == MO_64) {
+        if (data_reg == TCG_REG_EDX) {
             /* xchg %edx, %eax */
             tcg_out_opc(s, OPC_XCHG_ax_r32 + TCG_REG_EDX, 0, 0, 0);
             tcg_out_mov(s, TCG_TYPE_I32, l->datahi_reg, TCG_REG_EAX);
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
             tcg_out_mov(s, TCG_TYPE_I32, data_reg, TCG_REG_EAX);
             tcg_out_mov(s, TCG_TYPE_I32, l->datahi_reg, TCG_REG_EDX);
         }
-        break;
-    default:
-        g_assert_not_reached();
+    } else {
+        tcg_out_movext(s, l->type, data_reg,
+                       TCG_TYPE_REG, opc & MO_SSIZE, TCG_REG_EAX);
     }
 
     /* Jump to the code corresponding to next IR of qemu_st */
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
     MemOpIdx oi = l->oi;
     MemOp opc = get_memop(oi);
     MemOp size = opc & MO_SIZE;
-    TCGType type = l->type;
 
     /* resolve label address */
     if (!reloc_br_sk16(l->label_ptr[0], tcg_splitwx_to_rx(s->code_ptr))) {
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 
     tcg_out_call_int(s, qemu_ld_helpers[size], false);
 
-    switch (opc & MO_SSIZE) {
-    case MO_SB:
-        tcg_out_ext8s(s, type, l->datalo_reg, TCG_REG_A0);
-        break;
-    case MO_SW:
-        tcg_out_ext16s(s, type, l->datalo_reg, TCG_REG_A0);
-        break;
-    case MO_SL:
-        tcg_out_ext32s(s, l->datalo_reg, TCG_REG_A0);
-        break;
-    case MO_UL:
-        if (type == TCG_TYPE_I32) {
-            /* MO_UL loads of i32 should be sign-extended too */
-            tcg_out_ext32s(s, l->datalo_reg, TCG_REG_A0);
-            break;
-        }
-        /* fallthrough */
-    default:
-        tcg_out_mov(s, type, l->datalo_reg, TCG_REG_A0);
-        break;
-    }
-
+    tcg_out_movext(s, l->type, l->datalo_reg,
+                   TCG_TYPE_REG, opc & MO_SSIZE, TCG_REG_A0);
     return tcg_out_goto(s, l->raddr);
 }
 
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
     /* call store helper */
     tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_A0, TCG_AREG0);
     tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_A1, l->addrlo_reg);
-    switch (size) {
-    case MO_8:
-        tcg_out_ext8u(s, TCG_REG_A2, l->datalo_reg);
-        break;
-    case MO_16:
-        tcg_out_ext16u(s, TCG_REG_A2, l->datalo_reg);
-        break;
-    case MO_32:
-        tcg_out_ext32u(s, TCG_REG_A2, l->datalo_reg);
-        break;
-    case MO_64:
-        tcg_out_mov(s, TCG_TYPE_I64, TCG_REG_A2, l->datalo_reg);
-        break;
-    default:
-        g_assert_not_reached();
-        break;
-    }
+    tcg_out_movext(s, size == MO_64 ? TCG_TYPE_I32 : TCG_TYPE_I32, TCG_REG_A2,
+                   l->type, size, l->datalo_reg);
     tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_A3, oi);
     tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_A4, (tcg_target_long)l->raddr);
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_indexed(TCGContext *s, TCGReg data,
     }
 }
 
-static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args)
+static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, TCGType type)
 {
     TCGReg addr_regl;
     TCGReg data_regl;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args)
     tcg_out_tlb_load(s, addr_regl, oi, label_ptr, 0);
     base = tcg_out_zext_addr_if_32_bit(s, addr_regl, TCG_REG_TMP0);
     tcg_out_qemu_st_indexed(s, data_regl, base, TCG_REG_TMP2, opc);
-    add_qemu_ldst_label(s, 0, oi,
-                        0, /* type param is unused for stores */
+    add_qemu_ldst_label(s, 0, oi, type,
                         data_regl, addr_regl,
                         s->code_ptr, label_ptr);
 #else
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_qemu_ld(s, args, TCG_TYPE_I64);
         break;
     case INDEX_op_qemu_st_i32:
-        tcg_out_qemu_st(s, args);
+        tcg_out_qemu_st(s, args, TCG_TYPE_I32);
         break;
     case INDEX_op_qemu_st_i64:
-        tcg_out_qemu_st(s, args);
+        tcg_out_qemu_st(s, args, TCG_TYPE_I64);
         break;
 
     case INDEX_op_mov_i32:  /* Always emitted via tcg_out_mov.  */
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const uint32_t qemu_stx_opc[(MO_SIZE + MO_BSWAP) + 1] = {
     [MO_BSWAP | MO_UQ] = STDBRX,
 };
 
-static const uint32_t qemu_exts_opc[4] = {
-    EXTSB, EXTSH, EXTSW, 0
-};
-
 #if defined (CONFIG_SOFTMMU)
 /* helper signature: helper_ld_mmu(CPUState *env, target_ulong addr,
  *                                 int mmu_idx, uintptr_t ra)
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
     if (TCG_TARGET_REG_BITS == 32 && (opc & MO_SIZE) == MO_64) {
         tcg_out_mov(s, TCG_TYPE_I32, lo, TCG_REG_R4);
         tcg_out_mov(s, TCG_TYPE_I32, hi, TCG_REG_R3);
-    } else if (opc & MO_SIGN) {
-        uint32_t insn = qemu_exts_opc[opc & MO_SIZE];
-        tcg_out32(s, insn | RA(lo) | RS(TCG_REG_R3));
     } else {
-        tcg_out_mov(s, TCG_TYPE_REG, lo, TCG_REG_R3);
+        tcg_out_movext(s, lb->type, lo,
+                       TCG_TYPE_REG, opc & MO_SSIZE, TCG_REG_R3);
     }
 
     tcg_out_b(s, 0, lb->raddr);
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 
     lo = lb->datalo_reg;
     hi = lb->datahi_reg;
-    if (TCG_TARGET_REG_BITS == 32) {
-        switch (s_bits) {
-        case MO_64:
-            arg |= (TCG_TARGET_CALL_ARG_I64 == TCG_CALL_ARG_EVEN);
-            tcg_out_mov(s, TCG_TYPE_I32, arg++, hi);
-            /* FALLTHRU */
-        case MO_32:
-            tcg_out_mov(s, TCG_TYPE_I32, arg++, lo);
-            break;
-        default:
-            tcg_out_rlw(s, RLWINM, arg++, lo, 0, 32 - (8 << s_bits), 31);
-            break;
-        }
+    if (TCG_TARGET_REG_BITS == 32 && s_bits == MO_64) {
+        arg |= (TCG_TARGET_CALL_ARG_I64 == TCG_CALL_ARG_EVEN);
+        tcg_out_mov(s, TCG_TYPE_I32, arg++, hi);
+        tcg_out_mov(s, TCG_TYPE_I32, arg++, lo);
     } else {
-        if (s_bits == MO_64) {
-            tcg_out_mov(s, TCG_TYPE_I64, arg++, lo);
-        } else {
-            tcg_out_rld(s, RLDICL, arg++, lo, 0, 64 - (8 << s_bits));
-        }
+        tcg_out_movext(s, s_bits == MO_64 ? TCG_TYPE_I64 : TCG_TYPE_I32,
+                       arg++, lb->type, s_bits, lo);
     }
 
     tcg_out_movi(s, TCG_TYPE_I32, arg++, oi);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
         } else {
             insn = qemu_ldx_opc[opc & (MO_SIZE | MO_BSWAP)];
             tcg_out32(s, insn | TAB(datalo, rbase, addrlo));
-            insn = qemu_exts_opc[s_bits];
-            tcg_out32(s, insn | RA(datalo) | RS(datalo));
+            tcg_out_movext(s, TCG_TYPE_REG, datalo,
+                           TCG_TYPE_REG, opc & MO_SSIZE, datalo);
         }
     }
 
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
     /* call store helper */
     tcg_out_mov(s, TCG_TYPE_PTR, a0, TCG_AREG0);
     tcg_out_mov(s, TCG_TYPE_PTR, a1, l->addrlo_reg);
-    tcg_out_mov(s, TCG_TYPE_PTR, a2, l->datalo_reg);
-    switch (s_bits) {
-    case MO_8:
-        tcg_out_ext8u(s, a2, a2);
-        break;
-    case MO_16:
-        tcg_out_ext16u(s, a2, a2);
-        break;
-    default:
-        break;
-    }
+    tcg_out_movext(s, s_bits == MO_64 ? TCG_TYPE_I64 : TCG_TYPE_I32, a2,
+                   l->type, s_bits, l->datalo_reg);
     tcg_out_movi(s, TCG_TYPE_PTR, a3, oi);
     tcg_out_movi(s, TCG_TYPE_PTR, a4, (tcg_target_long)l->raddr);
 
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
     TCGReg data_reg = lb->datalo_reg;
     MemOpIdx oi = lb->oi;
     MemOp opc = get_memop(oi);
+    MemOp size = opc & MO_SIZE;
 
     if (!patch_reloc(lb->label_ptr[0], R_390_PC16DBL,
                      (intptr_t)tcg_splitwx_to_rx(s->code_ptr), 2)) {
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
     if (TARGET_LONG_BITS == 64) {
         tcg_out_mov(s, TCG_TYPE_I64, TCG_REG_R3, addr_reg);
     }
-    switch (opc & MO_SIZE) {
-    case MO_UB:
-        tcg_out_ext8u(s, TCG_REG_R4, data_reg);
-        break;
-    case MO_UW:
-        tcg_out_ext16u(s, TCG_REG_R4, data_reg);
-        break;
-    case MO_UL:
-        tcg_out_ext32u(s, TCG_REG_R4, data_reg);
-        break;
-    case MO_UQ:
-        tcg_out_mov(s, TCG_TYPE_I64, TCG_REG_R4, data_reg);
-        break;
-    default:
-        g_assert_not_reached();
-    }
+    tcg_out_movext(s, size == MO_64 ? TCG_TYPE_I64 : TCG_TYPE_I32,
+                   TCG_REG_R4, lb->type, size, data_reg);
     tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_R5, oi);
     tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_R6, (uintptr_t)lb->raddr);
     tcg_out_call_int(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)]);
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_mb(TCGContext *s, TCGArg a0)
 static const tcg_insn_unit *qemu_ld_trampoline[(MO_SSIZE | MO_BSWAP) + 1];
 static const tcg_insn_unit *qemu_st_trampoline[(MO_SIZE | MO_BSWAP) + 1];
 
-static void emit_extend(TCGContext *s, TCGReg r, int op)
-{
-    /* Emit zero extend of 8, 16 or 32 bit data as
-     * required by the MO_* value op; do nothing for 64 bit.
-     */
-    switch (op & MO_SIZE) {
-    case MO_8:
-        tcg_out_ext8u(s, r, r);
-        break;
-    case MO_16:
-        tcg_out_ext16u(s, r, r);
-        break;
-    case MO_32:
-        tcg_out_ext32u(s, r, r);
-        break;
-    case MO_64:
-        break;
-    }
-}
-
 static void build_trampolines(TCGContext *s)
 {
     static void * const qemu_ld_helpers[] = {
@@ -XXX,XX +XXX,XX @@ static void build_trampolines(TCGContext *s)
         }
         qemu_st_trampoline[i] = tcg_splitwx_to_rx(s->code_ptr);
 
-        emit_extend(s, TCG_REG_O2, i);
-
         /* Set the retaddr operand.  */
         tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_O4, TCG_REG_O7);
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data, TCGReg addr,
 }
 
 static void tcg_out_qemu_st(TCGContext *s, TCGReg data, TCGReg addr,
-                            MemOpIdx oi)
+                            MemOpIdx oi, TCGType data_type)
 {
     MemOp memop = get_memop(oi);
     tcg_insn_unit *label_ptr;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data, TCGReg addr,
     /* TLB Miss.  */
 
     tcg_out_mov(s, TCG_TYPE_REG, TCG_REG_O1, addrz);
-    tcg_out_mov(s, TCG_TYPE_REG, TCG_REG_O2, data);
+    tcg_out_movext(s, (memop & MO_SIZE) == MO_64 ? TCG_TYPE_I64 : TCG_TYPE_I32,
+                   TCG_REG_O2, data_type, memop & MO_SIZE, data);
 
     func = qemu_st_trampoline[memop & (MO_BSWAP | MO_SIZE)];
     tcg_debug_assert(func != NULL);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_qemu_ld(s, a0, a1, a2, true);
         break;
     case INDEX_op_qemu_st_i32:
+        tcg_out_qemu_st(s, a0, a1, a2, TCG_TYPE_I32);
+        break;
     case INDEX_op_qemu_st_i64:
-        tcg_out_qemu_st(s, a0, a1, a2);
+        tcg_out_qemu_st(s, a0, a1, a2, TCG_TYPE_I64);
         break;
 
     case INDEX_op_ld32s_i64:
-- 
2.34.1

We will want a backend interface for register swapping.
This is only properly defined for x86; all others get a
stub version that always indicates failure.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg.c                        | 2 ++
 tcg/aarch64/tcg-target.c.inc     | 5 +++++
 tcg/arm/tcg-target.c.inc         | 5 +++++
 tcg/i386/tcg-target.c.inc        | 8 ++++++++
 tcg/loongarch64/tcg-target.c.inc | 5 +++++
 tcg/mips/tcg-target.c.inc        | 5 +++++
 tcg/ppc/tcg-target.c.inc         | 5 +++++
 tcg/riscv/tcg-target.c.inc       | 5 +++++
 tcg/s390x/tcg-target.c.inc       | 5 +++++
 tcg/sparc64/tcg-target.c.inc     | 5 +++++
 tcg/tci/tcg-target.c.inc         | 5 +++++
 11 files changed, 55 insertions(+)

diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg);
 static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg);
 static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg ret, TCGReg arg);
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg, TCGReg, tcg_target_long);
+static bool tcg_out_xchg(TCGContext *s, TCGType type, TCGReg r1, TCGReg r2)
+    __attribute__((unused));
 static void tcg_out_exit_tb(TCGContext *s, uintptr_t arg);
 static void tcg_out_goto_tb(TCGContext *s, int which);
 static void tcg_out_op(TCGContext *s, TCGOpcode opc,
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi(TCGContext *s, TCGType type, TCGReg rd,
     tcg_out_insn(s, 3305, LDR, 0, rd);
 }
 
+static bool tcg_out_xchg(TCGContext *s, TCGType type, TCGReg r1, TCGReg r2)
+{
+    return false;
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi(TCGContext *s, TCGType type,
     tcg_out_movi32(s, COND_AL, ret, arg);
 }
 
+static bool tcg_out_xchg(TCGContext *s, TCGType type, TCGReg r1, TCGReg r2)
+{
+    return false;
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
 #define OPC_VPTERNLOGQ  (0x25 | P_EXT3A | P_DATA16 | P_VEXW | P_EVEX)
 #define OPC_VZEROUPPER  (0x77 | P_EXT)
 #define OPC_XCHG_ax_r32	(0x90)
+#define OPC_XCHG_EvGv   (0x87)
 
 #define OPC_GRP3_Eb     (0xf6)
 #define OPC_GRP3_Ev     (0xf7)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi(TCGContext *s, TCGType type,
     }
 }
 
+static bool tcg_out_xchg(TCGContext *s, TCGType type, TCGReg r1, TCGReg r2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tcg_out_modrm(s, OPC_XCHG_EvGv + rexw, r1, r2);
+    return true;
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_addi(TCGContext *s, TCGType type, TCGReg rd,
     }
 }
 
+static bool tcg_out_xchg(TCGContext *s, TCGType type, TCGReg r1, TCGReg r2)
+{
+    return false;
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg rd, TCGReg rs)
     tcg_out_ext32s(s, rd, rs);
 }
 
+static bool tcg_out_xchg(TCGContext *s, TCGType type, TCGReg r1, TCGReg r2)
+{
+    return false;
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi(TCGContext *s, TCGType type, TCGReg ret,
     }
 }
 
+static bool tcg_out_xchg(TCGContext *s, TCGType type, TCGReg r1, TCGReg r2)
+{
+    return false;
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi(TCGContext *s, TCGType type, TCGReg rd,
     tcg_out_opc_imm(s, OPC_LD, rd, rd, 0);
 }
 
+static bool tcg_out_xchg(TCGContext *s, TCGType type, TCGReg r1, TCGReg r2)
+{
+    return false;
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static inline bool tcg_out_sti(TCGContext *s, TCGType type, TCGArg val,
     return false;
 }
 
+static bool tcg_out_xchg(TCGContext *s, TCGType type, TCGReg r1, TCGReg r2)
+{
+    return false;
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg rd, TCGReg rs)
     tcg_out_mov(s, TCG_TYPE_I32, rd, rs);
 }
 
+static bool tcg_out_xchg(TCGContext *s, TCGType type, TCGReg r1, TCGReg r2)
+{
+    return false;
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg rd, TCGReg rs)
     tcg_out_mov(s, TCG_TYPE_I32, rd, rs);
 }
 
+static bool tcg_out_xchg(TCGContext *s, TCGType type, TCGReg r1, TCGReg r2)
+{
+    return false;
+}
+
 static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
                              tcg_target_long imm)
 {
-- 
2.34.1