Merge tag 'pull-tcg-20250501-v2' of https://gitlab.com/rth7680/qemu into staging

include: Remove 'exec/exec-all.h'
accel/tcg: Build tb-maint.c twice
accel/tcg: Build cpu-exec.c twice
accel/tcg: Buil

Merge tag 'pull-tcg-20250501-v2' of https://gitlab.com/rth7680/qemu into staging

include: Remove 'exec/exec-all.h'
accel/tcg: Build tb-maint.c twice
accel/tcg: Build cpu-exec.c twice
accel/tcg: Build translate-all.c twice
accel/tcg: Build tcg-all.c twice
accel/tcg: Build cputlb.c once
accel/tcg: Build user-exec.c once

# -----BEGIN PGP SIGNATURE-----
#
# iQFRBAABCgA7FiEEekgeeIaLTbaoWgXAZN846K9+IV8FAmgZFdYdHHJpY2hhcmQu
# aGVuZGVyc29uQGxpbmFyby5vcmcACgkQZN846K9+IV/8RAf8C2NTtUNlBrjtPrQD
# hP2YiNVfI+c9e3x3Bivx++9YUYfynWyPO774axnyhqYg3cJONWs+4HJ/MQHNSG/G
# qT+7EihGIDwnjWxTvu9wp5XucvaGKBqGEQ2IZrr0JBEnvrrpuhiauqP7Bjb37eAj
# kxw50NUxxz4wqk5Ql4UZyJ0h1peH5PFNr9uozhr6HJSEET7GxPMfUy611jAa/eXc
# MDkiDwd+0JGSKkMSQaCocMO2vL4OQGr3sTBNHQZ/RalEdMp+AJiQgjJ0fFfCInwK
# 4w8/8we8MKUBIwTn5kTUBjPrI7nlhJk5mFm5aV7fNvSClGf5Yb62SfPesQKm5qkE
# z3aApA==
# =Lpyu
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 05 May 2025 15:47:34 EDT
# gpg: using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F
# gpg: issuer "richard.henderson@linaro.org"
# gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [full]
# Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A 05C0 64DF 38E8 AF7E 215F

* tag 'pull-tcg-20250501-v2' of https://gitlab.com/rth7680/qemu: (59 commits)
accel/tcg: Build user-exec.c once
accel/tcg: Avoid abi_ptr in user-exec.c
accel/tcg: Remove TARGET_PAGE_DATA_SIZE
accel/tcg: Move TARGET_TAGGED_ADDRESSES to TCGCPUOps.untagged_addr
include/user: Use vaddr in guest-host.h
include/user: Convert GUEST_ADDR_MAX to a variable
accel/tcg: Build cputlb.c once
accel/tcg: Use vaddr for plugin_{load,store}_cb
accel/tcg: Use target_long_bits() in cputlb.c
accel/tcg: Move tlb_vaddr_to_host declaration to probe.h
accel/tcg: Move user-only tlb_vaddr_to_host out of line
accel/tcg: Use vaddr in cpu_loop.h
accel/tcg: Build tcg-all.c twice
accel/tcg: Build translate-all.c twice
accel/tcg: Use target_long_bits() in translate-all.c
accel/tcg: Don't use TARGET_LONG_BITS in decode_sleb128
tcg: Define INSN_START_WORDS as constant 3
qemu: Introduce target_long_bits()
qemu/target_info: Add %target_cpu_type field to TargetInfo
system/vl: Filter machine list available for a particular target binary
...

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

show more ...

target/i386: do not block singlestep for STI

STI will trigger a singlestep exception even if it has inhibit-IRQ
behavior. Do not suppress single-step for all IRQ-inhibiting
instructions, instead sp

target/i386: do not block singlestep for STI

STI will trigger a singlestep exception even if it has inhibit-IRQ
behavior. Do not suppress single-step for all IRQ-inhibiting
instructions, instead special case MOV SS and POP SS.

Cc: qemu-stable@nongnu.org
Fixes: f0f0136abba ("target/i386: no single-step exception after MOV or POP SS", 2024-05-25)
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...

target/i386: do not trigger IRQ shadow for LSS

Because LSS need not trigger an IRQ shadow, gen_movl_seg can't just use
the destination register to decide whether to inhibit IRQs. Add an
argument.

target/i386: do not trigger IRQ shadow for LSS

Because LSS need not trigger an IRQ shadow, gen_movl_seg can't just use
the destination register to decide whether to inhibit IRQs. Add an
argument.

Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...

include: Remove 'exec/exec-all.h'

"exec/exec-all.h" is now fully empty, let's remove it.

Mechanical change running:

$ sed -i '/exec\/exec-all.h/d' $(git grep -wl exec/exec-all.h)

Signed-off-by:

include: Remove 'exec/exec-all.h'

"exec/exec-all.h" is now fully empty, let's remove it.

Mechanical change running:

$ sed -i '/exec\/exec-all.h/d' $(git grep -wl exec/exec-all.h)

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250424202412.91612-14-philmd@linaro.org>

show more ...

Merge tag 'pull-misc-2025-04-24' of https://repo.or.cz/qemu/armbru into staging

Miscellaneous patches for 2025-04-24

# -----BEGIN PGP SIGNATURE-----
#
# iQJGBAABCAAwFiEENUvIs9frKmtoZ05fOHC0AOuRhlMF

Merge tag 'pull-misc-2025-04-24' of https://repo.or.cz/qemu/armbru into staging

Miscellaneous patches for 2025-04-24

# -----BEGIN PGP SIGNATURE-----
#
# iQJGBAABCAAwFiEENUvIs9frKmtoZ05fOHC0AOuRhlMFAmgJ7dYSHGFybWJydUBy
# ZWRoYXQuY29tAAoJEDhwtADrkYZTiZIP/1PFAg/s3SoiLQwH/ZrjyUkm1kiKnjOH
# CC5Stw6I9tuYnDAhASAdSymofLv0NNydNe5ai6ZZAWRyRYjIcfNigKAGK4Di+Uhe
# nYxT0Yk8hNGwMhl6NnBp4mmCUNCwcbjT9uXdiYQxFYO/qqYR1388xJjeN3c362l3
# AaLrE5bX5sqa6TAkTeRPjeIqxlyGT7jnCrN7I1hMhDvbc3ITF3AMfYFMjnmAQgr+
# mTWGS1QogqqkloODbR1DKD1CAWOlpK+0HibhNF+lz71P0HlwVvy+HPXso505Wf0B
# dMwlSrZ1DnqNVF/y5IhMEMslahKajbjbFVhBjmrGl/8T821etCxxgB20c0vyFRy8
# qTyJGwBZaEo0VWr70unSmq45TRoeQvdHAw/e+GtilR0ci80q2ly4gbObnw7L8le+
# gqZo4IWmrwp2sbPepE57sYKQpEndwbRayf/kcFd0LPPpeINu9ZooXkYX0pOo6Cdg
# vDKMaEB1/fmPhjSlknxkKN9LZdR+nDw8162S1CKsUdWanAOjmP8haN19aoHhIekZ
# q+r2qUq/U827yNy9/qbInmsoFYDz9s6sAOE63jibd5rZZ9Anei6NOSgLzA4CqCR1
# +d0+TXp19gP9mLMFs7/ZclwkXCz47OQYhXYphjI3wM9x+xbdRcI4n+DOH5u5coKx
# AsA6+2n0GF4Y
# =GaoH
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 24 Apr 2025 03:52:54 EDT
# gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653
# gpg: issuer "armbru@redhat.com"
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full]
# gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [full]
# Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653

* tag 'pull-misc-2025-04-24' of https://repo.or.cz/qemu/armbru:
cleanup: Drop pointless label at end of function
cleanup: Drop pointless return at end of function
cleanup: Re-run return_directly.cocci

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

show more ...

cleanup: Drop pointless return at end of function

A few functions now end with a label. The next commit will clean them
up.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Richar

cleanup: Drop pointless return at end of function

A few functions now end with a label. The next commit will clean them
up.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250407082643.2310002-3-armbru@redhat.com>
[Straightforward conflict with commit 988ad4ccebb6 (hw/loongarch/virt:
Fix cpuslot::cpu set at last in virt_cpu_plug()) resolved]

show more ...

exec/cpu-all: remove exec/target_page include

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Hende

exec/cpu-all: remove exec/target_page include

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

show more ...

include/exec: Split out accel/tcg/cpu-mmu-index.h

The implementation of cpu_mmu_index was split between cpu-common.h
and cpu-all.h, depending on CONFIG_USER_ONLY. We already have the
plumbing commo

include/exec: Split out accel/tcg/cpu-mmu-index.h

The implementation of cpu_mmu_index was split between cpu-common.h
and cpu-all.h, depending on CONFIG_USER_ONLY. We already have the
plumbing common to user and system mode. Using MMU_USER_IDX
requires the cpu.h for a specific target, and so is restricted to
when we're compiling per-target.

Include the new header only where needed.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

show more ...

target/i386: tcg: remove some more uses of temporaries

Remove all uses of 32-bit temporaries in emit.c.inc. Remove uses
in translate.c outside the large multiplexed generator functions.
tmp3_i32 is

target/i386: tcg: remove some more uses of temporaries

Remove all uses of 32-bit temporaries in emit.c.inc. Remove uses
in translate.c outside the large multiplexed generator functions.
tmp3_i32 is not used anymore and can go away.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...

target/i386: tcg: remove tmp0

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

target/i386: tcg: remove subf from SHLD/SHRD expansion

It is computing 33-count but 32-count had just been used, so just shift
further by one.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

target/i386: tcg: remove tmp0 and tmp4 from SHLD/SHRD

Apply some of the simplifications used for RCL and RCR. tmp4 is not
used anywhere else, so remove it.

Signed-off-by: Paolo Bonzini <pbonzini@r

target/i386: tcg: remove tmp0 and tmp4 from SHLD/SHRD

Apply some of the simplifications used for RCL and RCR. tmp4 is not
used anywhere else, so remove it.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...

target/i386: special case ADC/SBB x,0 and SBB x,x

Avoid the three-operand CC_OP_ADD and CC_OP_ADC in these relatively
common cases.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

target/i386: avoid using s->tmp0 for add to implicit registers

For updates to implicit registers (RCX in LOOP instructions, RSI or RDI
in string instructions, or the stack pointer) do the add direct

target/i386: avoid using s->tmp0 for add to implicit registers

For updates to implicit registers (RCX in LOOP instructions, RSI or RDI
in string instructions, or the stack pointer) do the add directly using
the registers (with no temporary) if 32-bit or 64-bit, or use a temporary
created for the occasion if 16-bit. This is more efficient and removes
move instructions for the MO_TL case.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Link: https://lore.kernel.org/r/20241215090613.89588-14-pbonzini@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...

target/i386: extract common bits of gen_repz/gen_repz_nz

Now that everything has been cleaned up, look at DF and prefixes
in a single function, and call that one from gen_repz and gen_repz_nz.

Sugg

target/i386: extract common bits of gen_repz/gen_repz_nz

Now that everything has been cleaned up, look at DF and prefixes
in a single function, and call that one from gen_repz and gen_repz_nz.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...

target/i386: pull computation of string update value out of loop

This is a common operation that is executed many times in rep
movs or rep stos loops. It can improve performance by several
percenta

target/i386: pull computation of string update value out of loop

This is a common operation that is executed many times in rep
movs or rep stos loops. It can improve performance by several
percentage points.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Link: https://lore.kernel.org/r/20241215090613.89588-13-pbonzini@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...

target/i386: execute multiple REP/REPZ iterations without leaving TB

Use a TCG loop so that it is not necessary to go through the setup steps
of REP and through the I/O check on every iteration. In

target/i386: execute multiple REP/REPZ iterations without leaving TB

Use a TCG loop so that it is not necessary to go through the setup steps
of REP and through the I/O check on every iteration. Interestingly, this
is not a particularly effective optimization on its own, though it avoids
the cost of correct RF emulation that was added in the previous patch.
The main benefit lies in allowing the hoisting of loop invariants outside
the loop, which will happen separately.

The loop exits when the low 16 bits of CX/ECX/RCX are zero (so generally
speaking the string operation runs in 65536 iteration batches) to give
the main loop an opportunity to pick up interrupts.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Link: https://lore.kernel.org/r/20241215090613.89588-12-pbonzini@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...

target/i386: optimize CX handling in repeated string operations

In a repeated string operation, CX/ECX will be decremented until it
is 0 but never underflow. Use this observation to avoid a deposit

target/i386: optimize CX handling in repeated string operations

In a repeated string operation, CX/ECX will be decremented until it
is 0 but never underflow. Use this observation to avoid a deposit or
zero-extend operation if the address size of the operation is smaller
than MO_TL.

As in the previous patch, the patch is structured to include some
preparatory work for subsequent changes. In particular, introducing
cx_next prepares for when ECX will be decremented *before* calling
fn(s, ot), and therefore cannot yet be written back to cpu_regs.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Link: https://lore.kernel.org/r/20241215090613.89588-11-pbonzini@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...

target/i386: do not use gen_op_jz_ecx for repeated string operations

Explicitly generate a TSTEQ branch (which is optimized to NE x,0 if possible).
This does not make much sense yet, but later we wi

target/i386: do not use gen_op_jz_ecx for repeated string operations

Explicitly generate a TSTEQ branch (which is optimized to NE x,0 if possible).
This does not make much sense yet, but later we will add more checks and some
will use a temporary to check on the decremented value of CX/ECX/RCX; it will
be clearer for all checks to share the same logic using TSTEQ(reg, cx_mask).

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Link: https://lore.kernel.org/r/20241215090613.89588-10-pbonzini@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...

target/i386: make cc_op handling more explicit for repeated string instructions.

Since the cost of gen_update_cc_op() must be paid anyway, it's easier
to place them manually and not rely on spilling

target/i386: make cc_op handling more explicit for repeated string instructions.

Since the cost of gen_update_cc_op() must be paid anyway, it's easier
to place them manually and not rely on spilling that is buried under
multiple levels of function calls. While at it, clarify the circumstances
in which the gen_update_cc_op() is needed, and why it is not for REPxx
SCAS and REPxx CMPS.

And since cc_op will have been spilled at the point of a fault, just
make the whole insn CC_OP_DYNAMIC. Once repz_opt is reintroduced,
a fault could happen either before or after the first execution of
CMPS/SCAS, and CC_OP_DYNAMIC sidesteps the complicated matter of what
x86_restore_state_to_opc would do.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Link: https://lore.kernel.org/r/20241215090613.89588-9-pbonzini@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...

target/i386: fix RF handling for string instructions

RF must be set on traps and interrupts from a string instruction,
except if they occur after the last iteration. Ensure it is set
before giving

target/i386: fix RF handling for string instructions

RF must be set on traps and interrupts from a string instruction,
except if they occur after the last iteration. Ensure it is set
before giving the main loop a chance to execute.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Link: https://lore.kernel.org/r/20241215090613.89588-8-pbonzini@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...

target/i386: tcg: move gen_set/reset_* earlier in the file

Allow using them in the code that translates REP/REPZ, without
forward declarations.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Re

target/i386: tcg: move gen_set/reset_* earlier in the file

Allow using them in the code that translates REP/REPZ, without
forward declarations.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Link: https://lore.kernel.org/r/20241215090613.89588-7-pbonzini@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...

target/i386: reorganize ops emitted by do_gen_rep, drop repz_opt

The condition for optimizing repeat instruction is more or less the
opposite of what you imagine: almost always the string instructio

target/i386: reorganize ops emitted by do_gen_rep, drop repz_opt

The condition for optimizing repeat instruction is more or less the
opposite of what you imagine: almost always the string instruction
was _not_ optimized and optimizing the loop relied on goto_tb.
This is obviously not great for performance, due to the cost of the
exit-to-main-loop check, but also wrong. In fact, after expanding
dc->jmp_opt and simplifying "!!x" to "x", the condition for looping used
to be:

((cflags & CF_NO_GOTO_TB) ||
(flags & (HF_RF_MASK | HF_TF_MASK | HF_INHIBIT_IRQ_MASK))) && !(cflags & CF_USE_ICOUNT)

In other words, setting aside RF (it requires special handling for REP
instructions and it was completely missing), repeat instruction were
being optimized if TF or inhibit IRQ flags were set. This is certainly
wrong for TF, because string instructions trap after every execution,
and probably for interrupt shadow too.

Get rid of repz_opt completely. The next patches will reintroduce the
optimization, applying it in the common case instead of the unlikely
and wrong one.

While at it, place the CX/ECX/RCX=0 case is at the end of the function,
which saves a label and is clearer when reading the generated ops.
For clarity, mark the cc_op explicitly as DYNAMIC even if at the end
of the translation block; the cc_op can come from either the previous
instruction or the string instruction, and currently we rely on
a gen_update_cc_op() that is hidden in the bowels of gen_jcc() to
spill cc_op and mark it clean.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Link: https://lore.kernel.org/r/20241215090613.89588-6-pbonzini@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...

target/i386: unify choice between single and repeated string instructions

The same "if" is present in all generator functions for string instructions.
Push it inside gen_repz() and gen_repz_nz() ins

target/i386: unify choice between single and repeated string instructions

The same "if" is present in all generator functions for string instructions.
Push it inside gen_repz() and gen_repz_nz() instead.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Link: https://lore.kernel.org/r/20241215090613.89588-5-pbonzini@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...

target/i386: unify REP and REPZ/REPNZ generation

It only differs in a single call to gen_jcc, so use a "bool" argument
to distinguish the two cases; do not duplicate code.

Signed-off-by: Paolo Bonz

target/i386: unify REP and REPZ/REPNZ generation

It only differs in a single call to gen_jcc, so use a "bool" argument
to distinguish the two cases; do not duplicate code.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Link: https://lore.kernel.org/r/20241215090613.89588-4-pbonzini@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...