xref: /openbmc/qemu/tcg/tcg.c (revision 5c0968a7e1da73f91f148d563a29af529427c5a5)
1 /*
2  * Tiny Code Generator for QEMU
3  *
4  * Copyright (c) 2008 Fabrice Bellard
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 
27 /* Define to jump the ELF file used to communicate with GDB.  */
28 #undef DEBUG_JIT
29 
30 #include "qemu/error-report.h"
31 #include "qemu/cutils.h"
32 #include "qemu/host-utils.h"
33 #include "qemu/qemu-print.h"
34 #include "qemu/cacheflush.h"
35 #include "qemu/cacheinfo.h"
36 #include "qemu/timer.h"
37 #include "exec/translation-block.h"
38 #include "exec/tlb-common.h"
39 #include "tcg/startup.h"
40 #include "tcg/tcg-op-common.h"
41 
42 #if UINTPTR_MAX == UINT32_MAX
43 # define ELF_CLASS  ELFCLASS32
44 #else
45 # define ELF_CLASS  ELFCLASS64
46 #endif
47 #if HOST_BIG_ENDIAN
48 # define ELF_DATA   ELFDATA2MSB
49 #else
50 # define ELF_DATA   ELFDATA2LSB
51 #endif
52 
53 #include "elf.h"
54 #include "exec/log.h"
55 #include "tcg/tcg-ldst.h"
56 #include "tcg/tcg-temp-internal.h"
57 #include "tcg-internal.h"
58 #include "tcg/perf.h"
59 #include "tcg-has.h"
60 #ifdef CONFIG_USER_ONLY
61 #include "user/guest-base.h"
62 #endif
63 
64 /* Forward declarations for functions declared in tcg-target.c.inc and
65    used here. */
66 static void tcg_target_init(TCGContext *s);
67 static void tcg_target_qemu_prologue(TCGContext *s);
68 static bool patch_reloc(tcg_insn_unit *code_ptr, int type,
69                         intptr_t value, intptr_t addend);
70 static void tcg_out_nop_fill(tcg_insn_unit *p, int count);
71 
72 typedef struct TCGLabelQemuLdst TCGLabelQemuLdst;
73 static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l);
74 static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l);
75 
76 /* The CIE and FDE header definitions will be common to all hosts.  */
77 typedef struct {
78     uint32_t len __attribute__((aligned((sizeof(void *)))));
79     uint32_t id;
80     uint8_t version;
81     char augmentation[1];
82     uint8_t code_align;
83     uint8_t data_align;
84     uint8_t return_column;
85 } DebugFrameCIE;
86 
87 typedef struct QEMU_PACKED {
88     uint32_t len __attribute__((aligned((sizeof(void *)))));
89     uint32_t cie_offset;
90     uintptr_t func_start;
91     uintptr_t func_len;
92 } DebugFrameFDEHeader;
93 
94 typedef struct QEMU_PACKED {
95     DebugFrameCIE cie;
96     DebugFrameFDEHeader fde;
97 } DebugFrameHeader;
98 
99 struct TCGLabelQemuLdst {
100     bool is_ld;             /* qemu_ld: true, qemu_st: false */
101     MemOpIdx oi;
102     TCGType type;           /* result type of a load */
103     TCGReg addr_reg;        /* reg index for guest virtual addr */
104     TCGReg datalo_reg;      /* reg index for low word to be loaded or stored */
105     TCGReg datahi_reg;      /* reg index for high word to be loaded or stored */
106     const tcg_insn_unit *raddr;   /* addr of the next IR of qemu_ld/st IR */
107     tcg_insn_unit *label_ptr[2]; /* label pointers to be updated */
108     QSIMPLEQ_ENTRY(TCGLabelQemuLdst) next;
109 };
110 
111 static void tcg_register_jit_int(const void *buf, size_t size,
112                                  const void *debug_frame,
113                                  size_t debug_frame_size)
114     __attribute__((unused));
115 
116 /* Forward declarations for functions declared and used in tcg-target.c.inc. */
117 static void tcg_out_tb_start(TCGContext *s);
118 static void tcg_out_ld(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg1,
119                        intptr_t arg2);
120 static bool tcg_out_mov(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg);
121 static void tcg_out_movi(TCGContext *s, TCGType type,
122                          TCGReg ret, tcg_target_long arg);
123 static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg);
124 static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg);
125 static void tcg_out_ext8u(TCGContext *s, TCGReg ret, TCGReg arg);
126 static void tcg_out_ext16u(TCGContext *s, TCGReg ret, TCGReg arg);
127 static void tcg_out_ext32s(TCGContext *s, TCGReg ret, TCGReg arg);
128 static void tcg_out_ext32u(TCGContext *s, TCGReg ret, TCGReg arg);
129 static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg);
130 static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg ret, TCGReg arg);
131 static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg ret, TCGReg arg);
132 static void tcg_out_addi_ptr(TCGContext *s, TCGReg, TCGReg, tcg_target_long);
133 static bool tcg_out_xchg(TCGContext *s, TCGType type, TCGReg r1, TCGReg r2);
134 static void tcg_out_exit_tb(TCGContext *s, uintptr_t arg);
135 static void tcg_out_goto_tb(TCGContext *s, int which);
136 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
137                        const TCGArg args[TCG_MAX_OP_ARGS],
138                        const int const_args[TCG_MAX_OP_ARGS]);
139 #if TCG_TARGET_MAYBE_vec
140 static bool tcg_out_dup_vec(TCGContext *s, TCGType type, unsigned vece,
141                             TCGReg dst, TCGReg src);
142 static bool tcg_out_dupm_vec(TCGContext *s, TCGType type, unsigned vece,
143                              TCGReg dst, TCGReg base, intptr_t offset);
144 static void tcg_out_dupi_vec(TCGContext *s, TCGType type, unsigned vece,
145                              TCGReg dst, int64_t arg);
146 static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
147                            unsigned vecl, unsigned vece,
148                            const TCGArg args[TCG_MAX_OP_ARGS],
149                            const int const_args[TCG_MAX_OP_ARGS]);
150 #else
151 static inline bool tcg_out_dup_vec(TCGContext *s, TCGType type, unsigned vece,
152                                    TCGReg dst, TCGReg src)
153 {
154     g_assert_not_reached();
155 }
156 static inline bool tcg_out_dupm_vec(TCGContext *s, TCGType type, unsigned vece,
157                                     TCGReg dst, TCGReg base, intptr_t offset)
158 {
159     g_assert_not_reached();
160 }
161 static inline void tcg_out_dupi_vec(TCGContext *s, TCGType type, unsigned vece,
162                                     TCGReg dst, int64_t arg)
163 {
164     g_assert_not_reached();
165 }
166 static inline void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
167                                   unsigned vecl, unsigned vece,
168                                   const TCGArg args[TCG_MAX_OP_ARGS],
169                                   const int const_args[TCG_MAX_OP_ARGS])
170 {
171     g_assert_not_reached();
172 }
173 int tcg_can_emit_vec_op(TCGOpcode o, TCGType t, unsigned ve)
174 {
175     return 0;
176 }
177 #endif
178 static void tcg_out_st(TCGContext *s, TCGType type, TCGReg arg, TCGReg arg1,
179                        intptr_t arg2);
180 static bool tcg_out_sti(TCGContext *s, TCGType type, TCGArg val,
181                         TCGReg base, intptr_t ofs);
182 static void tcg_out_call(TCGContext *s, const tcg_insn_unit *target,
183                          const TCGHelperInfo *info);
184 static TCGReg tcg_target_call_oarg_reg(TCGCallReturnKind kind, int slot);
185 static bool tcg_target_const_match(int64_t val, int ct,
186                                    TCGType type, TCGCond cond, int vece);
187 
188 #ifndef CONFIG_USER_ONLY
189 #define guest_base  ({ qemu_build_not_reached(); (uintptr_t)0; })
190 #endif
191 
192 typedef struct TCGLdstHelperParam {
193     TCGReg (*ra_gen)(TCGContext *s, const TCGLabelQemuLdst *l, int arg_reg);
194     unsigned ntmp;
195     int tmp[3];
196 } TCGLdstHelperParam;
197 
198 static void tcg_out_ld_helper_args(TCGContext *s, const TCGLabelQemuLdst *l,
199                                    const TCGLdstHelperParam *p)
200     __attribute__((unused));
201 static void tcg_out_ld_helper_ret(TCGContext *s, const TCGLabelQemuLdst *l,
202                                   bool load_sign, const TCGLdstHelperParam *p)
203     __attribute__((unused));
204 static void tcg_out_st_helper_args(TCGContext *s, const TCGLabelQemuLdst *l,
205                                    const TCGLdstHelperParam *p)
206     __attribute__((unused));
207 
208 static void * const qemu_ld_helpers[MO_SSIZE + 1] __attribute__((unused)) = {
209     [MO_UB] = helper_ldub_mmu,
210     [MO_SB] = helper_ldsb_mmu,
211     [MO_UW] = helper_lduw_mmu,
212     [MO_SW] = helper_ldsw_mmu,
213     [MO_UL] = helper_ldul_mmu,
214     [MO_UQ] = helper_ldq_mmu,
215 #if TCG_TARGET_REG_BITS == 64
216     [MO_SL] = helper_ldsl_mmu,
217     [MO_128] = helper_ld16_mmu,
218 #endif
219 };
220 
221 static void * const qemu_st_helpers[MO_SIZE + 1] __attribute__((unused)) = {
222     [MO_8]  = helper_stb_mmu,
223     [MO_16] = helper_stw_mmu,
224     [MO_32] = helper_stl_mmu,
225     [MO_64] = helper_stq_mmu,
226 #if TCG_TARGET_REG_BITS == 64
227     [MO_128] = helper_st16_mmu,
228 #endif
229 };
230 
231 typedef struct {
232     MemOp atom;   /* lg2 bits of atomicity required */
233     MemOp align;  /* lg2 bits of alignment to use */
234 } TCGAtomAlign;
235 
236 static TCGAtomAlign atom_and_align_for_opc(TCGContext *s, MemOp opc,
237                                            MemOp host_atom, bool allow_two_ops)
238     __attribute__((unused));
239 
240 #ifdef CONFIG_USER_ONLY
241 bool tcg_use_softmmu;
242 #endif
243 
244 TCGContext tcg_init_ctx;
245 __thread TCGContext *tcg_ctx;
246 
247 TCGContext **tcg_ctxs;
248 unsigned int tcg_cur_ctxs;
249 unsigned int tcg_max_ctxs;
250 TCGv_env tcg_env;
251 const void *tcg_code_gen_epilogue;
252 uintptr_t tcg_splitwx_diff;
253 
254 #ifndef CONFIG_TCG_INTERPRETER
255 tcg_prologue_fn *tcg_qemu_tb_exec;
256 #endif
257 
258 static TCGRegSet tcg_target_available_regs[TCG_TYPE_COUNT];
259 static TCGRegSet tcg_target_call_clobber_regs;
260 
261 #if TCG_TARGET_INSN_UNIT_SIZE == 1
262 static __attribute__((unused)) inline void tcg_out8(TCGContext *s, uint8_t v)
263 {
264     *s->code_ptr++ = v;
265 }
266 
267 static __attribute__((unused)) inline void tcg_patch8(tcg_insn_unit *p,
268                                                       uint8_t v)
269 {
270     *p = v;
271 }
272 #endif
273 
274 #if TCG_TARGET_INSN_UNIT_SIZE <= 2
275 static __attribute__((unused)) inline void tcg_out16(TCGContext *s, uint16_t v)
276 {
277     if (TCG_TARGET_INSN_UNIT_SIZE == 2) {
278         *s->code_ptr++ = v;
279     } else {
280         tcg_insn_unit *p = s->code_ptr;
281         memcpy(p, &v, sizeof(v));
282         s->code_ptr = p + (2 / TCG_TARGET_INSN_UNIT_SIZE);
283     }
284 }
285 
286 static __attribute__((unused)) inline void tcg_patch16(tcg_insn_unit *p,
287                                                        uint16_t v)
288 {
289     if (TCG_TARGET_INSN_UNIT_SIZE == 2) {
290         *p = v;
291     } else {
292         memcpy(p, &v, sizeof(v));
293     }
294 }
295 #endif
296 
297 #if TCG_TARGET_INSN_UNIT_SIZE <= 4
298 static __attribute__((unused)) inline void tcg_out32(TCGContext *s, uint32_t v)
299 {
300     if (TCG_TARGET_INSN_UNIT_SIZE == 4) {
301         *s->code_ptr++ = v;
302     } else {
303         tcg_insn_unit *p = s->code_ptr;
304         memcpy(p, &v, sizeof(v));
305         s->code_ptr = p + (4 / TCG_TARGET_INSN_UNIT_SIZE);
306     }
307 }
308 
309 static __attribute__((unused)) inline void tcg_patch32(tcg_insn_unit *p,
310                                                        uint32_t v)
311 {
312     if (TCG_TARGET_INSN_UNIT_SIZE == 4) {
313         *p = v;
314     } else {
315         memcpy(p, &v, sizeof(v));
316     }
317 }
318 #endif
319 
320 #if TCG_TARGET_INSN_UNIT_SIZE <= 8
321 static __attribute__((unused)) inline void tcg_out64(TCGContext *s, uint64_t v)
322 {
323     if (TCG_TARGET_INSN_UNIT_SIZE == 8) {
324         *s->code_ptr++ = v;
325     } else {
326         tcg_insn_unit *p = s->code_ptr;
327         memcpy(p, &v, sizeof(v));
328         s->code_ptr = p + (8 / TCG_TARGET_INSN_UNIT_SIZE);
329     }
330 }
331 
332 static __attribute__((unused)) inline void tcg_patch64(tcg_insn_unit *p,
333                                                        uint64_t v)
334 {
335     if (TCG_TARGET_INSN_UNIT_SIZE == 8) {
336         *p = v;
337     } else {
338         memcpy(p, &v, sizeof(v));
339     }
340 }
341 #endif
342 
343 /* label relocation processing */
344 
345 static void tcg_out_reloc(TCGContext *s, tcg_insn_unit *code_ptr, int type,
346                           TCGLabel *l, intptr_t addend)
347 {
348     TCGRelocation *r = tcg_malloc(sizeof(TCGRelocation));
349 
350     r->type = type;
351     r->ptr = code_ptr;
352     r->addend = addend;
353     QSIMPLEQ_INSERT_TAIL(&l->relocs, r, next);
354 }
355 
356 static void tcg_out_label(TCGContext *s, TCGLabel *l)
357 {
358     tcg_debug_assert(!l->has_value);
359     l->has_value = 1;
360     l->u.value_ptr = tcg_splitwx_to_rx(s->code_ptr);
361 }
362 
363 TCGLabel *gen_new_label(void)
364 {
365     TCGContext *s = tcg_ctx;
366     TCGLabel *l = tcg_malloc(sizeof(TCGLabel));
367 
368     memset(l, 0, sizeof(TCGLabel));
369     l->id = s->nb_labels++;
370     QSIMPLEQ_INIT(&l->branches);
371     QSIMPLEQ_INIT(&l->relocs);
372 
373     QSIMPLEQ_INSERT_TAIL(&s->labels, l, next);
374 
375     return l;
376 }
377 
378 static bool tcg_resolve_relocs(TCGContext *s)
379 {
380     TCGLabel *l;
381 
382     QSIMPLEQ_FOREACH(l, &s->labels, next) {
383         TCGRelocation *r;
384         uintptr_t value = l->u.value;
385 
386         QSIMPLEQ_FOREACH(r, &l->relocs, next) {
387             if (!patch_reloc(r->ptr, r->type, value, r->addend)) {
388                 return false;
389             }
390         }
391     }
392     return true;
393 }
394 
395 static void set_jmp_reset_offset(TCGContext *s, int which)
396 {
397     /*
398      * We will check for overflow at the end of the opcode loop in
399      * tcg_gen_code, where we bound tcg_current_code_size to UINT16_MAX.
400      */
401     s->gen_tb->jmp_reset_offset[which] = tcg_current_code_size(s);
402 }
403 
404 static void G_GNUC_UNUSED set_jmp_insn_offset(TCGContext *s, int which)
405 {
406     /*
407      * We will check for overflow at the end of the opcode loop in
408      * tcg_gen_code, where we bound tcg_current_code_size to UINT16_MAX.
409      */
410     s->gen_tb->jmp_insn_offset[which] = tcg_current_code_size(s);
411 }
412 
413 static uintptr_t G_GNUC_UNUSED get_jmp_target_addr(TCGContext *s, int which)
414 {
415     /*
416      * Return the read-execute version of the pointer, for the benefit
417      * of any pc-relative addressing mode.
418      */
419     return (uintptr_t)tcg_splitwx_to_rx(&s->gen_tb->jmp_target_addr[which]);
420 }
421 
422 static int __attribute__((unused))
423 tlb_mask_table_ofs(TCGContext *s, int which)
424 {
425     return (offsetof(CPUNegativeOffsetState, tlb.f[which]) -
426             sizeof(CPUNegativeOffsetState));
427 }
428 
429 /* Signal overflow, starting over with fewer guest insns. */
430 static G_NORETURN
431 void tcg_raise_tb_overflow(TCGContext *s)
432 {
433     siglongjmp(s->jmp_trans, -2);
434 }
435 
436 /*
437  * Used by tcg_out_movext{1,2} to hold the arguments for tcg_out_movext.
438  * By the time we arrive at tcg_out_movext1, @dst is always a TCGReg.
439  *
440  * However, tcg_out_helper_load_slots reuses this field to hold an
441  * argument slot number (which may designate a argument register or an
442  * argument stack slot), converting to TCGReg once all arguments that
443  * are destined for the stack are processed.
444  */
445 typedef struct TCGMovExtend {
446     unsigned dst;
447     TCGReg src;
448     TCGType dst_type;
449     TCGType src_type;
450     MemOp src_ext;
451 } TCGMovExtend;
452 
453 /**
454  * tcg_out_movext -- move and extend
455  * @s: tcg context
456  * @dst_type: integral type for destination
457  * @dst: destination register
458  * @src_type: integral type for source
459  * @src_ext: extension to apply to source
460  * @src: source register
461  *
462  * Move or extend @src into @dst, depending on @src_ext and the types.
463  */
464 static void tcg_out_movext(TCGContext *s, TCGType dst_type, TCGReg dst,
465                            TCGType src_type, MemOp src_ext, TCGReg src)
466 {
467     switch (src_ext) {
468     case MO_UB:
469         tcg_out_ext8u(s, dst, src);
470         break;
471     case MO_SB:
472         tcg_out_ext8s(s, dst_type, dst, src);
473         break;
474     case MO_UW:
475         tcg_out_ext16u(s, dst, src);
476         break;
477     case MO_SW:
478         tcg_out_ext16s(s, dst_type, dst, src);
479         break;
480     case MO_UL:
481     case MO_SL:
482         if (dst_type == TCG_TYPE_I32) {
483             if (src_type == TCG_TYPE_I32) {
484                 tcg_out_mov(s, TCG_TYPE_I32, dst, src);
485             } else {
486                 tcg_out_extrl_i64_i32(s, dst, src);
487             }
488         } else if (src_type == TCG_TYPE_I32) {
489             if (src_ext & MO_SIGN) {
490                 tcg_out_exts_i32_i64(s, dst, src);
491             } else {
492                 tcg_out_extu_i32_i64(s, dst, src);
493             }
494         } else {
495             if (src_ext & MO_SIGN) {
496                 tcg_out_ext32s(s, dst, src);
497             } else {
498                 tcg_out_ext32u(s, dst, src);
499             }
500         }
501         break;
502     case MO_UQ:
503         tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
504         if (dst_type == TCG_TYPE_I32) {
505             tcg_out_extrl_i64_i32(s, dst, src);
506         } else {
507             tcg_out_mov(s, TCG_TYPE_I64, dst, src);
508         }
509         break;
510     default:
511         g_assert_not_reached();
512     }
513 }
514 
515 /* Minor variations on a theme, using a structure. */
516 static void tcg_out_movext1_new_src(TCGContext *s, const TCGMovExtend *i,
517                                     TCGReg src)
518 {
519     tcg_out_movext(s, i->dst_type, i->dst, i->src_type, i->src_ext, src);
520 }
521 
522 static void tcg_out_movext1(TCGContext *s, const TCGMovExtend *i)
523 {
524     tcg_out_movext1_new_src(s, i, i->src);
525 }
526 
527 /**
528  * tcg_out_movext2 -- move and extend two pair
529  * @s: tcg context
530  * @i1: first move description
531  * @i2: second move description
532  * @scratch: temporary register, or -1 for none
533  *
534  * As tcg_out_movext, for both @i1 and @i2, caring for overlap
535  * between the sources and destinations.
536  */
537 
538 static void tcg_out_movext2(TCGContext *s, const TCGMovExtend *i1,
539                             const TCGMovExtend *i2, int scratch)
540 {
541     TCGReg src1 = i1->src;
542     TCGReg src2 = i2->src;
543 
544     if (i1->dst != src2) {
545         tcg_out_movext1(s, i1);
546         tcg_out_movext1(s, i2);
547         return;
548     }
549     if (i2->dst == src1) {
550         TCGType src1_type = i1->src_type;
551         TCGType src2_type = i2->src_type;
552 
553         if (tcg_out_xchg(s, MAX(src1_type, src2_type), src1, src2)) {
554             /* The data is now in the correct registers, now extend. */
555             src1 = i2->src;
556             src2 = i1->src;
557         } else {
558             tcg_debug_assert(scratch >= 0);
559             tcg_out_mov(s, src1_type, scratch, src1);
560             src1 = scratch;
561         }
562     }
563     tcg_out_movext1_new_src(s, i2, src2);
564     tcg_out_movext1_new_src(s, i1, src1);
565 }
566 
567 /**
568  * tcg_out_movext3 -- move and extend three pair
569  * @s: tcg context
570  * @i1: first move description
571  * @i2: second move description
572  * @i3: third move description
573  * @scratch: temporary register, or -1 for none
574  *
575  * As tcg_out_movext, for all of @i1, @i2 and @i3, caring for overlap
576  * between the sources and destinations.
577  */
578 
579 static void tcg_out_movext3(TCGContext *s, const TCGMovExtend *i1,
580                             const TCGMovExtend *i2, const TCGMovExtend *i3,
581                             int scratch)
582 {
583     TCGReg src1 = i1->src;
584     TCGReg src2 = i2->src;
585     TCGReg src3 = i3->src;
586 
587     if (i1->dst != src2 && i1->dst != src3) {
588         tcg_out_movext1(s, i1);
589         tcg_out_movext2(s, i2, i3, scratch);
590         return;
591     }
592     if (i2->dst != src1 && i2->dst != src3) {
593         tcg_out_movext1(s, i2);
594         tcg_out_movext2(s, i1, i3, scratch);
595         return;
596     }
597     if (i3->dst != src1 && i3->dst != src2) {
598         tcg_out_movext1(s, i3);
599         tcg_out_movext2(s, i1, i2, scratch);
600         return;
601     }
602 
603     /*
604      * There is a cycle.  Since there are only 3 nodes, the cycle is
605      * either "clockwise" or "anti-clockwise", and can be solved with
606      * a single scratch or two xchg.
607      */
608     if (i1->dst == src2 && i2->dst == src3 && i3->dst == src1) {
609         /* "Clockwise" */
610         if (tcg_out_xchg(s, MAX(i1->src_type, i2->src_type), src1, src2)) {
611             tcg_out_xchg(s, MAX(i2->src_type, i3->src_type), src2, src3);
612             /* The data is now in the correct registers, now extend. */
613             tcg_out_movext1_new_src(s, i1, i1->dst);
614             tcg_out_movext1_new_src(s, i2, i2->dst);
615             tcg_out_movext1_new_src(s, i3, i3->dst);
616         } else {
617             tcg_debug_assert(scratch >= 0);
618             tcg_out_mov(s, i1->src_type, scratch, src1);
619             tcg_out_movext1(s, i3);
620             tcg_out_movext1(s, i2);
621             tcg_out_movext1_new_src(s, i1, scratch);
622         }
623     } else if (i1->dst == src3 && i2->dst == src1 && i3->dst == src2) {
624         /* "Anti-clockwise" */
625         if (tcg_out_xchg(s, MAX(i2->src_type, i3->src_type), src2, src3)) {
626             tcg_out_xchg(s, MAX(i1->src_type, i2->src_type), src1, src2);
627             /* The data is now in the correct registers, now extend. */
628             tcg_out_movext1_new_src(s, i1, i1->dst);
629             tcg_out_movext1_new_src(s, i2, i2->dst);
630             tcg_out_movext1_new_src(s, i3, i3->dst);
631         } else {
632             tcg_debug_assert(scratch >= 0);
633             tcg_out_mov(s, i1->src_type, scratch, src1);
634             tcg_out_movext1(s, i2);
635             tcg_out_movext1(s, i3);
636             tcg_out_movext1_new_src(s, i1, scratch);
637         }
638     } else {
639         g_assert_not_reached();
640     }
641 }
642 
643 /*
644  * Allocate a new TCGLabelQemuLdst entry.
645  */
646 
647 __attribute__((unused))
648 static TCGLabelQemuLdst *new_ldst_label(TCGContext *s)
649 {
650     TCGLabelQemuLdst *l = tcg_malloc(sizeof(*l));
651 
652     memset(l, 0, sizeof(*l));
653     QSIMPLEQ_INSERT_TAIL(&s->ldst_labels, l, next);
654 
655     return l;
656 }
657 
658 /*
659  * Allocate new constant pool entries.
660  */
661 
662 typedef struct TCGLabelPoolData {
663     struct TCGLabelPoolData *next;
664     tcg_insn_unit *label;
665     intptr_t addend;
666     int rtype;
667     unsigned nlong;
668     tcg_target_ulong data[];
669 } TCGLabelPoolData;
670 
671 static TCGLabelPoolData *new_pool_alloc(TCGContext *s, int nlong, int rtype,
672                                         tcg_insn_unit *label, intptr_t addend)
673 {
674     TCGLabelPoolData *n = tcg_malloc(sizeof(TCGLabelPoolData)
675                                      + sizeof(tcg_target_ulong) * nlong);
676 
677     n->label = label;
678     n->addend = addend;
679     n->rtype = rtype;
680     n->nlong = nlong;
681     return n;
682 }
683 
684 static void new_pool_insert(TCGContext *s, TCGLabelPoolData *n)
685 {
686     TCGLabelPoolData *i, **pp;
687     int nlong = n->nlong;
688 
689     /* Insertion sort on the pool.  */
690     for (pp = &s->pool_labels; (i = *pp) != NULL; pp = &i->next) {
691         if (nlong > i->nlong) {
692             break;
693         }
694         if (nlong < i->nlong) {
695             continue;
696         }
697         if (memcmp(n->data, i->data, sizeof(tcg_target_ulong) * nlong) >= 0) {
698             break;
699         }
700     }
701     n->next = *pp;
702     *pp = n;
703 }
704 
705 /* The "usual" for generic integer code.  */
706 __attribute__((unused))
707 static void new_pool_label(TCGContext *s, tcg_target_ulong d, int rtype,
708                            tcg_insn_unit *label, intptr_t addend)
709 {
710     TCGLabelPoolData *n = new_pool_alloc(s, 1, rtype, label, addend);
711     n->data[0] = d;
712     new_pool_insert(s, n);
713 }
714 
715 /* For v64 or v128, depending on the host.  */
716 __attribute__((unused))
717 static void new_pool_l2(TCGContext *s, int rtype, tcg_insn_unit *label,
718                         intptr_t addend, tcg_target_ulong d0,
719                         tcg_target_ulong d1)
720 {
721     TCGLabelPoolData *n = new_pool_alloc(s, 2, rtype, label, addend);
722     n->data[0] = d0;
723     n->data[1] = d1;
724     new_pool_insert(s, n);
725 }
726 
727 /* For v128 or v256, depending on the host.  */
728 __attribute__((unused))
729 static void new_pool_l4(TCGContext *s, int rtype, tcg_insn_unit *label,
730                         intptr_t addend, tcg_target_ulong d0,
731                         tcg_target_ulong d1, tcg_target_ulong d2,
732                         tcg_target_ulong d3)
733 {
734     TCGLabelPoolData *n = new_pool_alloc(s, 4, rtype, label, addend);
735     n->data[0] = d0;
736     n->data[1] = d1;
737     n->data[2] = d2;
738     n->data[3] = d3;
739     new_pool_insert(s, n);
740 }
741 
742 /* For v256, for 32-bit host.  */
743 __attribute__((unused))
744 static void new_pool_l8(TCGContext *s, int rtype, tcg_insn_unit *label,
745                         intptr_t addend, tcg_target_ulong d0,
746                         tcg_target_ulong d1, tcg_target_ulong d2,
747                         tcg_target_ulong d3, tcg_target_ulong d4,
748                         tcg_target_ulong d5, tcg_target_ulong d6,
749                         tcg_target_ulong d7)
750 {
751     TCGLabelPoolData *n = new_pool_alloc(s, 8, rtype, label, addend);
752     n->data[0] = d0;
753     n->data[1] = d1;
754     n->data[2] = d2;
755     n->data[3] = d3;
756     n->data[4] = d4;
757     n->data[5] = d5;
758     n->data[6] = d6;
759     n->data[7] = d7;
760     new_pool_insert(s, n);
761 }
762 
763 /*
764  * Generate TB finalization at the end of block
765  */
766 
767 static int tcg_out_ldst_finalize(TCGContext *s)
768 {
769     TCGLabelQemuLdst *lb;
770 
771     /* qemu_ld/st slow paths */
772     QSIMPLEQ_FOREACH(lb, &s->ldst_labels, next) {
773         if (lb->is_ld
774             ? !tcg_out_qemu_ld_slow_path(s, lb)
775             : !tcg_out_qemu_st_slow_path(s, lb)) {
776             return -2;
777         }
778 
779         /*
780          * Test for (pending) buffer overflow.  The assumption is that any
781          * one operation beginning below the high water mark cannot overrun
782          * the buffer completely.  Thus we can test for overflow after
783          * generating code without having to check during generation.
784          */
785         if (unlikely((void *)s->code_ptr > s->code_gen_highwater)) {
786             return -1;
787         }
788     }
789     return 0;
790 }
791 
792 static int tcg_out_pool_finalize(TCGContext *s)
793 {
794     TCGLabelPoolData *p = s->pool_labels;
795     TCGLabelPoolData *l = NULL;
796     void *a;
797 
798     if (p == NULL) {
799         return 0;
800     }
801 
802     /*
803      * ??? Round up to qemu_icache_linesize, but then do not round
804      * again when allocating the next TranslationBlock structure.
805      */
806     a = (void *)ROUND_UP((uintptr_t)s->code_ptr,
807                          sizeof(tcg_target_ulong) * p->nlong);
808     tcg_out_nop_fill(s->code_ptr, (tcg_insn_unit *)a - s->code_ptr);
809     s->data_gen_ptr = a;
810 
811     for (; p != NULL; p = p->next) {
812         size_t size = sizeof(tcg_target_ulong) * p->nlong;
813         uintptr_t value;
814 
815         if (!l || l->nlong != p->nlong || memcmp(l->data, p->data, size)) {
816             if (unlikely(a > s->code_gen_highwater)) {
817                 return -1;
818             }
819             memcpy(a, p->data, size);
820             a += size;
821             l = p;
822         }
823 
824         value = (uintptr_t)tcg_splitwx_to_rx(a) - size;
825         if (!patch_reloc(p->label, p->rtype, value, p->addend)) {
826             return -2;
827         }
828     }
829 
830     s->code_ptr = a;
831     return 0;
832 }
833 
834 #define C_PFX1(P, A)                    P##A
835 #define C_PFX2(P, A, B)                 P##A##_##B
836 #define C_PFX3(P, A, B, C)              P##A##_##B##_##C
837 #define C_PFX4(P, A, B, C, D)           P##A##_##B##_##C##_##D
838 #define C_PFX5(P, A, B, C, D, E)        P##A##_##B##_##C##_##D##_##E
839 #define C_PFX6(P, A, B, C, D, E, F)     P##A##_##B##_##C##_##D##_##E##_##F
840 
841 /* Define an enumeration for the various combinations. */
842 
843 #define C_O0_I1(I1)                     C_PFX1(c_o0_i1_, I1),
844 #define C_O0_I2(I1, I2)                 C_PFX2(c_o0_i2_, I1, I2),
845 #define C_O0_I3(I1, I2, I3)             C_PFX3(c_o0_i3_, I1, I2, I3),
846 #define C_O0_I4(I1, I2, I3, I4)         C_PFX4(c_o0_i4_, I1, I2, I3, I4),
847 
848 #define C_O1_I1(O1, I1)                 C_PFX2(c_o1_i1_, O1, I1),
849 #define C_O1_I2(O1, I1, I2)             C_PFX3(c_o1_i2_, O1, I1, I2),
850 #define C_O1_I3(O1, I1, I2, I3)         C_PFX4(c_o1_i3_, O1, I1, I2, I3),
851 #define C_O1_I4(O1, I1, I2, I3, I4)     C_PFX5(c_o1_i4_, O1, I1, I2, I3, I4),
852 
853 #define C_N1_I2(O1, I1, I2)             C_PFX3(c_n1_i2_, O1, I1, I2),
854 #define C_N1O1_I1(O1, O2, I1)           C_PFX3(c_n1o1_i1_, O1, O2, I1),
855 #define C_N2_I1(O1, O2, I1)             C_PFX3(c_n2_i1_, O1, O2, I1),
856 
857 #define C_O2_I1(O1, O2, I1)             C_PFX3(c_o2_i1_, O1, O2, I1),
858 #define C_O2_I2(O1, O2, I1, I2)         C_PFX4(c_o2_i2_, O1, O2, I1, I2),
859 #define C_O2_I3(O1, O2, I1, I2, I3)     C_PFX5(c_o2_i3_, O1, O2, I1, I2, I3),
860 #define C_O2_I4(O1, O2, I1, I2, I3, I4) C_PFX6(c_o2_i4_, O1, O2, I1, I2, I3, I4),
861 #define C_N1_O1_I4(O1, O2, I1, I2, I3, I4) C_PFX6(c_n1_o1_i4_, O1, O2, I1, I2, I3, I4),
862 
863 typedef enum {
864     C_Dynamic = -2,
865     C_NotImplemented = -1,
866 #include "tcg-target-con-set.h"
867 } TCGConstraintSetIndex;
868 
869 static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode, TCGType, unsigned);
870 
871 #undef C_O0_I1
872 #undef C_O0_I2
873 #undef C_O0_I3
874 #undef C_O0_I4
875 #undef C_O1_I1
876 #undef C_O1_I2
877 #undef C_O1_I3
878 #undef C_O1_I4
879 #undef C_N1_I2
880 #undef C_N1O1_I1
881 #undef C_N2_I1
882 #undef C_O2_I1
883 #undef C_O2_I2
884 #undef C_O2_I3
885 #undef C_O2_I4
886 #undef C_N1_O1_I4
887 
888 /* Put all of the constraint sets into an array, indexed by the enum. */
889 
890 typedef struct TCGConstraintSet {
891     uint8_t nb_oargs, nb_iargs;
892     const char *args_ct_str[TCG_MAX_OP_ARGS];
893 } TCGConstraintSet;
894 
895 #define C_O0_I1(I1)                     { 0, 1, { #I1 } },
896 #define C_O0_I2(I1, I2)                 { 0, 2, { #I1, #I2 } },
897 #define C_O0_I3(I1, I2, I3)             { 0, 3, { #I1, #I2, #I3 } },
898 #define C_O0_I4(I1, I2, I3, I4)         { 0, 4, { #I1, #I2, #I3, #I4 } },
899 
900 #define C_O1_I1(O1, I1)                 { 1, 1, { #O1, #I1 } },
901 #define C_O1_I2(O1, I1, I2)             { 1, 2, { #O1, #I1, #I2 } },
902 #define C_O1_I3(O1, I1, I2, I3)         { 1, 3, { #O1, #I1, #I2, #I3 } },
903 #define C_O1_I4(O1, I1, I2, I3, I4)     { 1, 4, { #O1, #I1, #I2, #I3, #I4 } },
904 
905 #define C_N1_I2(O1, I1, I2)             { 1, 2, { "&" #O1, #I1, #I2 } },
906 #define C_N1O1_I1(O1, O2, I1)           { 2, 1, { "&" #O1, #O2, #I1 } },
907 #define C_N2_I1(O1, O2, I1)             { 2, 1, { "&" #O1, "&" #O2, #I1 } },
908 
909 #define C_O2_I1(O1, O2, I1)             { 2, 1, { #O1, #O2, #I1 } },
910 #define C_O2_I2(O1, O2, I1, I2)         { 2, 2, { #O1, #O2, #I1, #I2 } },
911 #define C_O2_I3(O1, O2, I1, I2, I3)     { 2, 3, { #O1, #O2, #I1, #I2, #I3 } },
912 #define C_O2_I4(O1, O2, I1, I2, I3, I4) { 2, 4, { #O1, #O2, #I1, #I2, #I3, #I4 } },
913 #define C_N1_O1_I4(O1, O2, I1, I2, I3, I4) { 2, 4, { "&" #O1, #O2, #I1, #I2, #I3, #I4 } },
914 
915 static const TCGConstraintSet constraint_sets[] = {
916 #include "tcg-target-con-set.h"
917 };
918 
919 #undef C_O0_I1
920 #undef C_O0_I2
921 #undef C_O0_I3
922 #undef C_O0_I4
923 #undef C_O1_I1
924 #undef C_O1_I2
925 #undef C_O1_I3
926 #undef C_O1_I4
927 #undef C_N1_I2
928 #undef C_N1O1_I1
929 #undef C_N2_I1
930 #undef C_O2_I1
931 #undef C_O2_I2
932 #undef C_O2_I3
933 #undef C_O2_I4
934 #undef C_N1_O1_I4
935 
936 /* Expand the enumerator to be returned from tcg_target_op_def(). */
937 
938 #define C_O0_I1(I1)                     C_PFX1(c_o0_i1_, I1)
939 #define C_O0_I2(I1, I2)                 C_PFX2(c_o0_i2_, I1, I2)
940 #define C_O0_I3(I1, I2, I3)             C_PFX3(c_o0_i3_, I1, I2, I3)
941 #define C_O0_I4(I1, I2, I3, I4)         C_PFX4(c_o0_i4_, I1, I2, I3, I4)
942 
943 #define C_O1_I1(O1, I1)                 C_PFX2(c_o1_i1_, O1, I1)
944 #define C_O1_I2(O1, I1, I2)             C_PFX3(c_o1_i2_, O1, I1, I2)
945 #define C_O1_I3(O1, I1, I2, I3)         C_PFX4(c_o1_i3_, O1, I1, I2, I3)
946 #define C_O1_I4(O1, I1, I2, I3, I4)     C_PFX5(c_o1_i4_, O1, I1, I2, I3, I4)
947 
948 #define C_N1_I2(O1, I1, I2)             C_PFX3(c_n1_i2_, O1, I1, I2)
949 #define C_N1O1_I1(O1, O2, I1)           C_PFX3(c_n1o1_i1_, O1, O2, I1)
950 #define C_N2_I1(O1, O2, I1)             C_PFX3(c_n2_i1_, O1, O2, I1)
951 
952 #define C_O2_I1(O1, O2, I1)             C_PFX3(c_o2_i1_, O1, O2, I1)
953 #define C_O2_I2(O1, O2, I1, I2)         C_PFX4(c_o2_i2_, O1, O2, I1, I2)
954 #define C_O2_I3(O1, O2, I1, I2, I3)     C_PFX5(c_o2_i3_, O1, O2, I1, I2, I3)
955 #define C_O2_I4(O1, O2, I1, I2, I3, I4) C_PFX6(c_o2_i4_, O1, O2, I1, I2, I3, I4)
956 #define C_N1_O1_I4(O1, O2, I1, I2, I3, I4) C_PFX6(c_n1_o1_i4_, O1, O2, I1, I2, I3, I4)
957 
958 /*
959  * TCGOutOp is the base class for a set of structures that describe how
960  * to generate code for a given TCGOpcode.
961  *
962  * @static_constraint:
963  *   C_NotImplemented: The TCGOpcode is not supported by the backend.
964  *   C_Dynamic:        Use @dynamic_constraint to select a constraint set
965  *                     based on any of @type, @flags, or host isa.
966  *   Otherwise:        The register allocation constrains for the TCGOpcode.
967  *
968  * Subclasses of TCGOutOp will define a set of output routines that may
969  * be used.  Such routines will often be selected by the set of registers
970  * and constants that come out of register allocation.  The set of
971  * routines that are provided will guide the set of constraints that are
972  * legal.  In particular, assume that tcg_optimize() has done its job in
973  * swapping commutative operands and folding operations for which all
974  * operands are constant.
975  */
976 typedef struct TCGOutOp {
977     TCGConstraintSetIndex static_constraint;
978     TCGConstraintSetIndex (*dynamic_constraint)(TCGType type, unsigned flags);
979 } TCGOutOp;
980 
981 typedef struct TCGOutOpBinary {
982     TCGOutOp base;
983     void (*out_rrr)(TCGContext *s, TCGType type,
984                     TCGReg a0, TCGReg a1, TCGReg a2);
985     void (*out_rri)(TCGContext *s, TCGType type,
986                     TCGReg a0, TCGReg a1, tcg_target_long a2);
987 } TCGOutOpBinary;
988 
989 #include "tcg-target.c.inc"
990 
991 #ifndef CONFIG_TCG_INTERPRETER
992 /* Validate CPUTLBDescFast placement. */
993 QEMU_BUILD_BUG_ON((int)(offsetof(CPUNegativeOffsetState, tlb.f[0]) -
994                         sizeof(CPUNegativeOffsetState))
995                   < MIN_TLB_MASK_TABLE_OFS);
996 #endif
997 
998 /*
999  * Register V as the TCGOutOp for O.
1000  * This verifies that V is of type T, otherwise give a nice compiler error.
1001  * This prevents trivial mistakes within each arch/tcg-target.c.inc.
1002  */
1003 #define OUTOP(O, T, V)  [O] = _Generic(V, T: &V.base)
1004 
1005 /* Register allocation descriptions for every TCGOpcode. */
1006 static const TCGOutOp * const all_outop[NB_OPS] = {
1007     OUTOP(INDEX_op_add, TCGOutOpBinary, outop_add),
1008     OUTOP(INDEX_op_and, TCGOutOpBinary, outop_and),
1009     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
1010     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
1011     OUTOP(INDEX_op_or, TCGOutOpBinary, outop_or),
1012     OUTOP(INDEX_op_orc, TCGOutOpBinary, outop_orc),
1013     OUTOP(INDEX_op_xor, TCGOutOpBinary, outop_xor),
1014 };
1015 
1016 #undef OUTOP
1017 
1018 /*
1019  * All TCG threads except the parent (i.e. the one that called tcg_context_init
1020  * and registered the target's TCG globals) must register with this function
1021  * before initiating translation.
1022  *
1023  * In user-mode we just point tcg_ctx to tcg_init_ctx. See the documentation
1024  * of tcg_region_init() for the reasoning behind this.
1025  *
1026  * In system-mode each caller registers its context in tcg_ctxs[]. Note that in
1027  * system-mode tcg_ctxs[] does not track tcg_ctx_init, since the initial context
1028  * is not used anymore for translation once this function is called.
1029  *
1030  * Not tracking tcg_init_ctx in tcg_ctxs[] in system-mode keeps code that
1031  * iterates over the array (e.g. tcg_code_size() the same for both system/user
1032  * modes.
1033  */
1034 #ifdef CONFIG_USER_ONLY
1035 void tcg_register_thread(void)
1036 {
1037     tcg_ctx = &tcg_init_ctx;
1038 }
1039 #else
1040 void tcg_register_thread(void)
1041 {
1042     TCGContext *s = g_malloc(sizeof(*s));
1043     unsigned int i, n;
1044 
1045     *s = tcg_init_ctx;
1046 
1047     /* Relink mem_base.  */
1048     for (i = 0, n = tcg_init_ctx.nb_globals; i < n; ++i) {
1049         if (tcg_init_ctx.temps[i].mem_base) {
1050             ptrdiff_t b = tcg_init_ctx.temps[i].mem_base - tcg_init_ctx.temps;
1051             tcg_debug_assert(b >= 0 && b < n);
1052             s->temps[i].mem_base = &s->temps[b];
1053         }
1054     }
1055 
1056     /* Claim an entry in tcg_ctxs */
1057     n = qatomic_fetch_inc(&tcg_cur_ctxs);
1058     g_assert(n < tcg_max_ctxs);
1059     qatomic_set(&tcg_ctxs[n], s);
1060 
1061     if (n > 0) {
1062         tcg_region_initial_alloc(s);
1063     }
1064 
1065     tcg_ctx = s;
1066 }
1067 #endif /* !CONFIG_USER_ONLY */
1068 
1069 /* pool based memory allocation */
1070 void *tcg_malloc_internal(TCGContext *s, int size)
1071 {
1072     TCGPool *p;
1073     int pool_size;
1074 
1075     if (size > TCG_POOL_CHUNK_SIZE) {
1076         /* big malloc: insert a new pool (XXX: could optimize) */
1077         p = g_malloc(sizeof(TCGPool) + size);
1078         p->size = size;
1079         p->next = s->pool_first_large;
1080         s->pool_first_large = p;
1081         return p->data;
1082     } else {
1083         p = s->pool_current;
1084         if (!p) {
1085             p = s->pool_first;
1086             if (!p)
1087                 goto new_pool;
1088         } else {
1089             if (!p->next) {
1090             new_pool:
1091                 pool_size = TCG_POOL_CHUNK_SIZE;
1092                 p = g_malloc(sizeof(TCGPool) + pool_size);
1093                 p->size = pool_size;
1094                 p->next = NULL;
1095                 if (s->pool_current) {
1096                     s->pool_current->next = p;
1097                 } else {
1098                     s->pool_first = p;
1099                 }
1100             } else {
1101                 p = p->next;
1102             }
1103         }
1104     }
1105     s->pool_current = p;
1106     s->pool_cur = p->data + size;
1107     s->pool_end = p->data + p->size;
1108     return p->data;
1109 }
1110 
1111 void tcg_pool_reset(TCGContext *s)
1112 {
1113     TCGPool *p, *t;
1114     for (p = s->pool_first_large; p; p = t) {
1115         t = p->next;
1116         g_free(p);
1117     }
1118     s->pool_first_large = NULL;
1119     s->pool_cur = s->pool_end = NULL;
1120     s->pool_current = NULL;
1121 }
1122 
1123 /*
1124  * Create TCGHelperInfo structures for "tcg/tcg-ldst.h" functions,
1125  * akin to what "exec/helper-tcg.h" does with DEF_HELPER_FLAGS_N.
1126  * We only use these for layout in tcg_out_ld_helper_ret and
1127  * tcg_out_st_helper_args, and share them between several of
1128  * the helpers, with the end result that it's easier to build manually.
1129  */
1130 
1131 #if TCG_TARGET_REG_BITS == 32
1132 # define dh_typecode_ttl  dh_typecode_i32
1133 #else
1134 # define dh_typecode_ttl  dh_typecode_i64
1135 #endif
1136 
1137 static TCGHelperInfo info_helper_ld32_mmu = {
1138     .flags = TCG_CALL_NO_WG,
1139     .typemask = dh_typemask(ttl, 0)  /* return tcg_target_ulong */
1140               | dh_typemask(env, 1)
1141               | dh_typemask(i64, 2)  /* uint64_t addr */
1142               | dh_typemask(i32, 3)  /* unsigned oi */
1143               | dh_typemask(ptr, 4)  /* uintptr_t ra */
1144 };
1145 
1146 static TCGHelperInfo info_helper_ld64_mmu = {
1147     .flags = TCG_CALL_NO_WG,
1148     .typemask = dh_typemask(i64, 0)  /* return uint64_t */
1149               | dh_typemask(env, 1)
1150               | dh_typemask(i64, 2)  /* uint64_t addr */
1151               | dh_typemask(i32, 3)  /* unsigned oi */
1152               | dh_typemask(ptr, 4)  /* uintptr_t ra */
1153 };
1154 
1155 static TCGHelperInfo info_helper_ld128_mmu = {
1156     .flags = TCG_CALL_NO_WG,
1157     .typemask = dh_typemask(i128, 0) /* return Int128 */
1158               | dh_typemask(env, 1)
1159               | dh_typemask(i64, 2)  /* uint64_t addr */
1160               | dh_typemask(i32, 3)  /* unsigned oi */
1161               | dh_typemask(ptr, 4)  /* uintptr_t ra */
1162 };
1163 
1164 static TCGHelperInfo info_helper_st32_mmu = {
1165     .flags = TCG_CALL_NO_WG,
1166     .typemask = dh_typemask(void, 0)
1167               | dh_typemask(env, 1)
1168               | dh_typemask(i64, 2)  /* uint64_t addr */
1169               | dh_typemask(i32, 3)  /* uint32_t data */
1170               | dh_typemask(i32, 4)  /* unsigned oi */
1171               | dh_typemask(ptr, 5)  /* uintptr_t ra */
1172 };
1173 
1174 static TCGHelperInfo info_helper_st64_mmu = {
1175     .flags = TCG_CALL_NO_WG,
1176     .typemask = dh_typemask(void, 0)
1177               | dh_typemask(env, 1)
1178               | dh_typemask(i64, 2)  /* uint64_t addr */
1179               | dh_typemask(i64, 3)  /* uint64_t data */
1180               | dh_typemask(i32, 4)  /* unsigned oi */
1181               | dh_typemask(ptr, 5)  /* uintptr_t ra */
1182 };
1183 
1184 static TCGHelperInfo info_helper_st128_mmu = {
1185     .flags = TCG_CALL_NO_WG,
1186     .typemask = dh_typemask(void, 0)
1187               | dh_typemask(env, 1)
1188               | dh_typemask(i64, 2)  /* uint64_t addr */
1189               | dh_typemask(i128, 3) /* Int128 data */
1190               | dh_typemask(i32, 4)  /* unsigned oi */
1191               | dh_typemask(ptr, 5)  /* uintptr_t ra */
1192 };
1193 
1194 #ifdef CONFIG_TCG_INTERPRETER
1195 static ffi_type *typecode_to_ffi(int argmask)
1196 {
1197     /*
1198      * libffi does not support __int128_t, so we have forced Int128
1199      * to use the structure definition instead of the builtin type.
1200      */
1201     static ffi_type *ffi_type_i128_elements[3] = {
1202         &ffi_type_uint64,
1203         &ffi_type_uint64,
1204         NULL
1205     };
1206     static ffi_type ffi_type_i128 = {
1207         .size = 16,
1208         .alignment = __alignof__(Int128),
1209         .type = FFI_TYPE_STRUCT,
1210         .elements = ffi_type_i128_elements,
1211     };
1212 
1213     switch (argmask) {
1214     case dh_typecode_void:
1215         return &ffi_type_void;
1216     case dh_typecode_i32:
1217         return &ffi_type_uint32;
1218     case dh_typecode_s32:
1219         return &ffi_type_sint32;
1220     case dh_typecode_i64:
1221         return &ffi_type_uint64;
1222     case dh_typecode_s64:
1223         return &ffi_type_sint64;
1224     case dh_typecode_ptr:
1225         return &ffi_type_pointer;
1226     case dh_typecode_i128:
1227         return &ffi_type_i128;
1228     }
1229     g_assert_not_reached();
1230 }
1231 
1232 static ffi_cif *init_ffi_layout(TCGHelperInfo *info)
1233 {
1234     unsigned typemask = info->typemask;
1235     struct {
1236         ffi_cif cif;
1237         ffi_type *args[];
1238     } *ca;
1239     ffi_status status;
1240     int nargs;
1241 
1242     /* Ignoring the return type, find the last non-zero field. */
1243     nargs = 32 - clz32(typemask >> 3);
1244     nargs = DIV_ROUND_UP(nargs, 3);
1245     assert(nargs <= MAX_CALL_IARGS);
1246 
1247     ca = g_malloc0(sizeof(*ca) + nargs * sizeof(ffi_type *));
1248     ca->cif.rtype = typecode_to_ffi(typemask & 7);
1249     ca->cif.nargs = nargs;
1250 
1251     if (nargs != 0) {
1252         ca->cif.arg_types = ca->args;
1253         for (int j = 0; j < nargs; ++j) {
1254             int typecode = extract32(typemask, (j + 1) * 3, 3);
1255             ca->args[j] = typecode_to_ffi(typecode);
1256         }
1257     }
1258 
1259     status = ffi_prep_cif(&ca->cif, FFI_DEFAULT_ABI, nargs,
1260                           ca->cif.rtype, ca->cif.arg_types);
1261     assert(status == FFI_OK);
1262 
1263     return &ca->cif;
1264 }
1265 
1266 #define HELPER_INFO_INIT(I)      (&(I)->cif)
1267 #define HELPER_INFO_INIT_VAL(I)  init_ffi_layout(I)
1268 #else
1269 #define HELPER_INFO_INIT(I)      (&(I)->init)
1270 #define HELPER_INFO_INIT_VAL(I)  1
1271 #endif /* CONFIG_TCG_INTERPRETER */
1272 
1273 static inline bool arg_slot_reg_p(unsigned arg_slot)
1274 {
1275     /*
1276      * Split the sizeof away from the comparison to avoid Werror from
1277      * "unsigned < 0 is always false", when iarg_regs is empty.
1278      */
1279     unsigned nreg = ARRAY_SIZE(tcg_target_call_iarg_regs);
1280     return arg_slot < nreg;
1281 }
1282 
1283 static inline int arg_slot_stk_ofs(unsigned arg_slot)
1284 {
1285     unsigned max = TCG_STATIC_CALL_ARGS_SIZE / sizeof(tcg_target_long);
1286     unsigned stk_slot = arg_slot - ARRAY_SIZE(tcg_target_call_iarg_regs);
1287 
1288     tcg_debug_assert(stk_slot < max);
1289     return TCG_TARGET_CALL_STACK_OFFSET + stk_slot * sizeof(tcg_target_long);
1290 }
1291 
1292 typedef struct TCGCumulativeArgs {
1293     int arg_idx;                /* tcg_gen_callN args[] */
1294     int info_in_idx;            /* TCGHelperInfo in[] */
1295     int arg_slot;               /* regs+stack slot */
1296     int ref_slot;               /* stack slots for references */
1297 } TCGCumulativeArgs;
1298 
1299 static void layout_arg_even(TCGCumulativeArgs *cum)
1300 {
1301     cum->arg_slot += cum->arg_slot & 1;
1302 }
1303 
1304 static void layout_arg_1(TCGCumulativeArgs *cum, TCGHelperInfo *info,
1305                          TCGCallArgumentKind kind)
1306 {
1307     TCGCallArgumentLoc *loc = &info->in[cum->info_in_idx];
1308 
1309     *loc = (TCGCallArgumentLoc){
1310         .kind = kind,
1311         .arg_idx = cum->arg_idx,
1312         .arg_slot = cum->arg_slot,
1313     };
1314     cum->info_in_idx++;
1315     cum->arg_slot++;
1316 }
1317 
1318 static void layout_arg_normal_n(TCGCumulativeArgs *cum,
1319                                 TCGHelperInfo *info, int n)
1320 {
1321     TCGCallArgumentLoc *loc = &info->in[cum->info_in_idx];
1322 
1323     for (int i = 0; i < n; ++i) {
1324         /* Layout all using the same arg_idx, adjusting the subindex. */
1325         loc[i] = (TCGCallArgumentLoc){
1326             .kind = TCG_CALL_ARG_NORMAL,
1327             .arg_idx = cum->arg_idx,
1328             .tmp_subindex = i,
1329             .arg_slot = cum->arg_slot + i,
1330         };
1331     }
1332     cum->info_in_idx += n;
1333     cum->arg_slot += n;
1334 }
1335 
1336 static void layout_arg_by_ref(TCGCumulativeArgs *cum, TCGHelperInfo *info)
1337 {
1338     TCGCallArgumentLoc *loc = &info->in[cum->info_in_idx];
1339     int n = 128 / TCG_TARGET_REG_BITS;
1340 
1341     /* The first subindex carries the pointer. */
1342     layout_arg_1(cum, info, TCG_CALL_ARG_BY_REF);
1343 
1344     /*
1345      * The callee is allowed to clobber memory associated with
1346      * structure pass by-reference.  Therefore we must make copies.
1347      * Allocate space from "ref_slot", which will be adjusted to
1348      * follow the parameters on the stack.
1349      */
1350     loc[0].ref_slot = cum->ref_slot;
1351 
1352     /*
1353      * Subsequent words also go into the reference slot, but
1354      * do not accumulate into the regular arguments.
1355      */
1356     for (int i = 1; i < n; ++i) {
1357         loc[i] = (TCGCallArgumentLoc){
1358             .kind = TCG_CALL_ARG_BY_REF_N,
1359             .arg_idx = cum->arg_idx,
1360             .tmp_subindex = i,
1361             .ref_slot = cum->ref_slot + i,
1362         };
1363     }
1364     cum->info_in_idx += n - 1;  /* i=0 accounted for in layout_arg_1 */
1365     cum->ref_slot += n;
1366 }
1367 
1368 static void init_call_layout(TCGHelperInfo *info)
1369 {
1370     int max_reg_slots = ARRAY_SIZE(tcg_target_call_iarg_regs);
1371     int max_stk_slots = TCG_STATIC_CALL_ARGS_SIZE / sizeof(tcg_target_long);
1372     unsigned typemask = info->typemask;
1373     unsigned typecode;
1374     TCGCumulativeArgs cum = { };
1375 
1376     /*
1377      * Parse and place any function return value.
1378      */
1379     typecode = typemask & 7;
1380     switch (typecode) {
1381     case dh_typecode_void:
1382         info->nr_out = 0;
1383         break;
1384     case dh_typecode_i32:
1385     case dh_typecode_s32:
1386     case dh_typecode_ptr:
1387         info->nr_out = 1;
1388         info->out_kind = TCG_CALL_RET_NORMAL;
1389         break;
1390     case dh_typecode_i64:
1391     case dh_typecode_s64:
1392         info->nr_out = 64 / TCG_TARGET_REG_BITS;
1393         info->out_kind = TCG_CALL_RET_NORMAL;
1394         /* Query the last register now to trigger any assert early. */
1395         tcg_target_call_oarg_reg(info->out_kind, info->nr_out - 1);
1396         break;
1397     case dh_typecode_i128:
1398         info->nr_out = 128 / TCG_TARGET_REG_BITS;
1399         info->out_kind = TCG_TARGET_CALL_RET_I128;
1400         switch (TCG_TARGET_CALL_RET_I128) {
1401         case TCG_CALL_RET_NORMAL:
1402             /* Query the last register now to trigger any assert early. */
1403             tcg_target_call_oarg_reg(info->out_kind, info->nr_out - 1);
1404             break;
1405         case TCG_CALL_RET_BY_VEC:
1406             /* Query the single register now to trigger any assert early. */
1407             tcg_target_call_oarg_reg(TCG_CALL_RET_BY_VEC, 0);
1408             break;
1409         case TCG_CALL_RET_BY_REF:
1410             /*
1411              * Allocate the first argument to the output.
1412              * We don't need to store this anywhere, just make it
1413              * unavailable for use in the input loop below.
1414              */
1415             cum.arg_slot = 1;
1416             break;
1417         default:
1418             qemu_build_not_reached();
1419         }
1420         break;
1421     default:
1422         g_assert_not_reached();
1423     }
1424 
1425     /*
1426      * Parse and place function arguments.
1427      */
1428     for (typemask >>= 3; typemask; typemask >>= 3, cum.arg_idx++) {
1429         TCGCallArgumentKind kind;
1430         TCGType type;
1431 
1432         typecode = typemask & 7;
1433         switch (typecode) {
1434         case dh_typecode_i32:
1435         case dh_typecode_s32:
1436             type = TCG_TYPE_I32;
1437             break;
1438         case dh_typecode_i64:
1439         case dh_typecode_s64:
1440             type = TCG_TYPE_I64;
1441             break;
1442         case dh_typecode_ptr:
1443             type = TCG_TYPE_PTR;
1444             break;
1445         case dh_typecode_i128:
1446             type = TCG_TYPE_I128;
1447             break;
1448         default:
1449             g_assert_not_reached();
1450         }
1451 
1452         switch (type) {
1453         case TCG_TYPE_I32:
1454             switch (TCG_TARGET_CALL_ARG_I32) {
1455             case TCG_CALL_ARG_EVEN:
1456                 layout_arg_even(&cum);
1457                 /* fall through */
1458             case TCG_CALL_ARG_NORMAL:
1459                 layout_arg_1(&cum, info, TCG_CALL_ARG_NORMAL);
1460                 break;
1461             case TCG_CALL_ARG_EXTEND:
1462                 kind = TCG_CALL_ARG_EXTEND_U + (typecode & 1);
1463                 layout_arg_1(&cum, info, kind);
1464                 break;
1465             default:
1466                 qemu_build_not_reached();
1467             }
1468             break;
1469 
1470         case TCG_TYPE_I64:
1471             switch (TCG_TARGET_CALL_ARG_I64) {
1472             case TCG_CALL_ARG_EVEN:
1473                 layout_arg_even(&cum);
1474                 /* fall through */
1475             case TCG_CALL_ARG_NORMAL:
1476                 if (TCG_TARGET_REG_BITS == 32) {
1477                     layout_arg_normal_n(&cum, info, 2);
1478                 } else {
1479                     layout_arg_1(&cum, info, TCG_CALL_ARG_NORMAL);
1480                 }
1481                 break;
1482             default:
1483                 qemu_build_not_reached();
1484             }
1485             break;
1486 
1487         case TCG_TYPE_I128:
1488             switch (TCG_TARGET_CALL_ARG_I128) {
1489             case TCG_CALL_ARG_EVEN:
1490                 layout_arg_even(&cum);
1491                 /* fall through */
1492             case TCG_CALL_ARG_NORMAL:
1493                 layout_arg_normal_n(&cum, info, 128 / TCG_TARGET_REG_BITS);
1494                 break;
1495             case TCG_CALL_ARG_BY_REF:
1496                 layout_arg_by_ref(&cum, info);
1497                 break;
1498             default:
1499                 qemu_build_not_reached();
1500             }
1501             break;
1502 
1503         default:
1504             g_assert_not_reached();
1505         }
1506     }
1507     info->nr_in = cum.info_in_idx;
1508 
1509     /* Validate that we didn't overrun the input array. */
1510     assert(cum.info_in_idx <= ARRAY_SIZE(info->in));
1511     /* Validate the backend has enough argument space. */
1512     assert(cum.arg_slot <= max_reg_slots + max_stk_slots);
1513 
1514     /*
1515      * Relocate the "ref_slot" area to the end of the parameters.
1516      * Minimizing this stack offset helps code size for x86,
1517      * which has a signed 8-bit offset encoding.
1518      */
1519     if (cum.ref_slot != 0) {
1520         int ref_base = 0;
1521 
1522         if (cum.arg_slot > max_reg_slots) {
1523             int align = __alignof(Int128) / sizeof(tcg_target_long);
1524 
1525             ref_base = cum.arg_slot - max_reg_slots;
1526             if (align > 1) {
1527                 ref_base = ROUND_UP(ref_base, align);
1528             }
1529         }
1530         assert(ref_base + cum.ref_slot <= max_stk_slots);
1531         ref_base += max_reg_slots;
1532 
1533         if (ref_base != 0) {
1534             for (int i = cum.info_in_idx - 1; i >= 0; --i) {
1535                 TCGCallArgumentLoc *loc = &info->in[i];
1536                 switch (loc->kind) {
1537                 case TCG_CALL_ARG_BY_REF:
1538                 case TCG_CALL_ARG_BY_REF_N:
1539                     loc->ref_slot += ref_base;
1540                     break;
1541                 default:
1542                     break;
1543                 }
1544             }
1545         }
1546     }
1547 }
1548 
1549 static int indirect_reg_alloc_order[ARRAY_SIZE(tcg_target_reg_alloc_order)];
1550 static void process_constraint_sets(void);
1551 static TCGTemp *tcg_global_reg_new_internal(TCGContext *s, TCGType type,
1552                                             TCGReg reg, const char *name);
1553 
1554 static void tcg_context_init(unsigned max_threads)
1555 {
1556     TCGContext *s = &tcg_init_ctx;
1557     int n, i;
1558     TCGTemp *ts;
1559 
1560     memset(s, 0, sizeof(*s));
1561     s->nb_globals = 0;
1562 
1563     init_call_layout(&info_helper_ld32_mmu);
1564     init_call_layout(&info_helper_ld64_mmu);
1565     init_call_layout(&info_helper_ld128_mmu);
1566     init_call_layout(&info_helper_st32_mmu);
1567     init_call_layout(&info_helper_st64_mmu);
1568     init_call_layout(&info_helper_st128_mmu);
1569 
1570     tcg_target_init(s);
1571     process_constraint_sets();
1572 
1573     /* Reverse the order of the saved registers, assuming they're all at
1574        the start of tcg_target_reg_alloc_order.  */
1575     for (n = 0; n < ARRAY_SIZE(tcg_target_reg_alloc_order); ++n) {
1576         int r = tcg_target_reg_alloc_order[n];
1577         if (tcg_regset_test_reg(tcg_target_call_clobber_regs, r)) {
1578             break;
1579         }
1580     }
1581     for (i = 0; i < n; ++i) {
1582         indirect_reg_alloc_order[i] = tcg_target_reg_alloc_order[n - 1 - i];
1583     }
1584     for (; i < ARRAY_SIZE(tcg_target_reg_alloc_order); ++i) {
1585         indirect_reg_alloc_order[i] = tcg_target_reg_alloc_order[i];
1586     }
1587 
1588     tcg_ctx = s;
1589     /*
1590      * In user-mode we simply share the init context among threads, since we
1591      * use a single region. See the documentation tcg_region_init() for the
1592      * reasoning behind this.
1593      * In system-mode we will have at most max_threads TCG threads.
1594      */
1595 #ifdef CONFIG_USER_ONLY
1596     tcg_ctxs = &tcg_ctx;
1597     tcg_cur_ctxs = 1;
1598     tcg_max_ctxs = 1;
1599 #else
1600     tcg_max_ctxs = max_threads;
1601     tcg_ctxs = g_new0(TCGContext *, max_threads);
1602 #endif
1603 
1604     tcg_debug_assert(!tcg_regset_test_reg(s->reserved_regs, TCG_AREG0));
1605     ts = tcg_global_reg_new_internal(s, TCG_TYPE_PTR, TCG_AREG0, "env");
1606     tcg_env = temp_tcgv_ptr(ts);
1607 }
1608 
1609 void tcg_init(size_t tb_size, int splitwx, unsigned max_threads)
1610 {
1611     tcg_context_init(max_threads);
1612     tcg_region_init(tb_size, splitwx, max_threads);
1613 }
1614 
1615 /*
1616  * Allocate TBs right before their corresponding translated code, making
1617  * sure that TBs and code are on different cache lines.
1618  */
1619 TranslationBlock *tcg_tb_alloc(TCGContext *s)
1620 {
1621     uintptr_t align = qemu_icache_linesize;
1622     TranslationBlock *tb;
1623     void *next;
1624 
1625  retry:
1626     tb = (void *)ROUND_UP((uintptr_t)s->code_gen_ptr, align);
1627     next = (void *)ROUND_UP((uintptr_t)(tb + 1), align);
1628 
1629     if (unlikely(next > s->code_gen_highwater)) {
1630         if (tcg_region_alloc(s)) {
1631             return NULL;
1632         }
1633         goto retry;
1634     }
1635     qatomic_set(&s->code_gen_ptr, next);
1636     return tb;
1637 }
1638 
1639 void tcg_prologue_init(void)
1640 {
1641     TCGContext *s = tcg_ctx;
1642     size_t prologue_size;
1643 
1644     s->code_ptr = s->code_gen_ptr;
1645     s->code_buf = s->code_gen_ptr;
1646     s->data_gen_ptr = NULL;
1647 
1648 #ifndef CONFIG_TCG_INTERPRETER
1649     tcg_qemu_tb_exec = (tcg_prologue_fn *)tcg_splitwx_to_rx(s->code_ptr);
1650 #endif
1651 
1652     s->pool_labels = NULL;
1653 
1654     qemu_thread_jit_write();
1655     /* Generate the prologue.  */
1656     tcg_target_qemu_prologue(s);
1657 
1658     /* Allow the prologue to put e.g. guest_base into a pool entry.  */
1659     {
1660         int result = tcg_out_pool_finalize(s);
1661         tcg_debug_assert(result == 0);
1662     }
1663 
1664     prologue_size = tcg_current_code_size(s);
1665     perf_report_prologue(s->code_gen_ptr, prologue_size);
1666 
1667 #ifndef CONFIG_TCG_INTERPRETER
1668     flush_idcache_range((uintptr_t)tcg_splitwx_to_rx(s->code_buf),
1669                         (uintptr_t)s->code_buf, prologue_size);
1670 #endif
1671 
1672     if (qemu_loglevel_mask(CPU_LOG_TB_OUT_ASM)) {
1673         FILE *logfile = qemu_log_trylock();
1674         if (logfile) {
1675             fprintf(logfile, "PROLOGUE: [size=%zu]\n", prologue_size);
1676             if (s->data_gen_ptr) {
1677                 size_t code_size = s->data_gen_ptr - s->code_gen_ptr;
1678                 size_t data_size = prologue_size - code_size;
1679                 size_t i;
1680 
1681                 disas(logfile, s->code_gen_ptr, code_size);
1682 
1683                 for (i = 0; i < data_size; i += sizeof(tcg_target_ulong)) {
1684                     if (sizeof(tcg_target_ulong) == 8) {
1685                         fprintf(logfile,
1686                                 "0x%08" PRIxPTR ":  .quad  0x%016" PRIx64 "\n",
1687                                 (uintptr_t)s->data_gen_ptr + i,
1688                                 *(uint64_t *)(s->data_gen_ptr + i));
1689                     } else {
1690                         fprintf(logfile,
1691                                 "0x%08" PRIxPTR ":  .long  0x%08x\n",
1692                                 (uintptr_t)s->data_gen_ptr + i,
1693                                 *(uint32_t *)(s->data_gen_ptr + i));
1694                     }
1695                 }
1696             } else {
1697                 disas(logfile, s->code_gen_ptr, prologue_size);
1698             }
1699             fprintf(logfile, "\n");
1700             qemu_log_unlock(logfile);
1701         }
1702     }
1703 
1704 #ifndef CONFIG_TCG_INTERPRETER
1705     /*
1706      * Assert that goto_ptr is implemented completely, setting an epilogue.
1707      * For tci, we use NULL as the signal to return from the interpreter,
1708      * so skip this check.
1709      */
1710     tcg_debug_assert(tcg_code_gen_epilogue != NULL);
1711 #endif
1712 
1713     tcg_region_prologue_set(s);
1714 }
1715 
1716 void tcg_func_start(TCGContext *s)
1717 {
1718     tcg_pool_reset(s);
1719     s->nb_temps = s->nb_globals;
1720 
1721     /* No temps have been previously allocated for size or locality.  */
1722     tcg_temp_ebb_reset_freed(s);
1723 
1724     /* No constant temps have been previously allocated. */
1725     for (int i = 0; i < TCG_TYPE_COUNT; ++i) {
1726         if (s->const_table[i]) {
1727             g_hash_table_remove_all(s->const_table[i]);
1728         }
1729     }
1730 
1731     s->nb_ops = 0;
1732     s->nb_labels = 0;
1733     s->current_frame_offset = s->frame_start;
1734 
1735 #ifdef CONFIG_DEBUG_TCG
1736     s->goto_tb_issue_mask = 0;
1737 #endif
1738 
1739     QTAILQ_INIT(&s->ops);
1740     QTAILQ_INIT(&s->free_ops);
1741     s->emit_before_op = NULL;
1742     QSIMPLEQ_INIT(&s->labels);
1743 
1744     tcg_debug_assert(s->addr_type <= TCG_TYPE_REG);
1745     tcg_debug_assert(s->insn_start_words > 0);
1746 }
1747 
1748 static TCGTemp *tcg_temp_alloc(TCGContext *s)
1749 {
1750     int n = s->nb_temps++;
1751 
1752     if (n >= TCG_MAX_TEMPS) {
1753         tcg_raise_tb_overflow(s);
1754     }
1755     return memset(&s->temps[n], 0, sizeof(TCGTemp));
1756 }
1757 
1758 static TCGTemp *tcg_global_alloc(TCGContext *s)
1759 {
1760     TCGTemp *ts;
1761 
1762     tcg_debug_assert(s->nb_globals == s->nb_temps);
1763     tcg_debug_assert(s->nb_globals < TCG_MAX_TEMPS);
1764     s->nb_globals++;
1765     ts = tcg_temp_alloc(s);
1766     ts->kind = TEMP_GLOBAL;
1767 
1768     return ts;
1769 }
1770 
1771 static TCGTemp *tcg_global_reg_new_internal(TCGContext *s, TCGType type,
1772                                             TCGReg reg, const char *name)
1773 {
1774     TCGTemp *ts;
1775 
1776     tcg_debug_assert(TCG_TARGET_REG_BITS == 64 || type == TCG_TYPE_I32);
1777 
1778     ts = tcg_global_alloc(s);
1779     ts->base_type = type;
1780     ts->type = type;
1781     ts->kind = TEMP_FIXED;
1782     ts->reg = reg;
1783     ts->name = name;
1784     tcg_regset_set_reg(s->reserved_regs, reg);
1785 
1786     return ts;
1787 }
1788 
1789 void tcg_set_frame(TCGContext *s, TCGReg reg, intptr_t start, intptr_t size)
1790 {
1791     s->frame_start = start;
1792     s->frame_end = start + size;
1793     s->frame_temp
1794         = tcg_global_reg_new_internal(s, TCG_TYPE_PTR, reg, "_frame");
1795 }
1796 
1797 static TCGTemp *tcg_global_mem_new_internal(TCGv_ptr base, intptr_t offset,
1798                                             const char *name, TCGType type)
1799 {
1800     TCGContext *s = tcg_ctx;
1801     TCGTemp *base_ts = tcgv_ptr_temp(base);
1802     TCGTemp *ts = tcg_global_alloc(s);
1803     int indirect_reg = 0;
1804 
1805     switch (base_ts->kind) {
1806     case TEMP_FIXED:
1807         break;
1808     case TEMP_GLOBAL:
1809         /* We do not support double-indirect registers.  */
1810         tcg_debug_assert(!base_ts->indirect_reg);
1811         base_ts->indirect_base = 1;
1812         s->nb_indirects += (TCG_TARGET_REG_BITS == 32 && type == TCG_TYPE_I64
1813                             ? 2 : 1);
1814         indirect_reg = 1;
1815         break;
1816     default:
1817         g_assert_not_reached();
1818     }
1819 
1820     if (TCG_TARGET_REG_BITS == 32 && type == TCG_TYPE_I64) {
1821         TCGTemp *ts2 = tcg_global_alloc(s);
1822         char buf[64];
1823 
1824         ts->base_type = TCG_TYPE_I64;
1825         ts->type = TCG_TYPE_I32;
1826         ts->indirect_reg = indirect_reg;
1827         ts->mem_allocated = 1;
1828         ts->mem_base = base_ts;
1829         ts->mem_offset = offset;
1830         pstrcpy(buf, sizeof(buf), name);
1831         pstrcat(buf, sizeof(buf), "_0");
1832         ts->name = strdup(buf);
1833 
1834         tcg_debug_assert(ts2 == ts + 1);
1835         ts2->base_type = TCG_TYPE_I64;
1836         ts2->type = TCG_TYPE_I32;
1837         ts2->indirect_reg = indirect_reg;
1838         ts2->mem_allocated = 1;
1839         ts2->mem_base = base_ts;
1840         ts2->mem_offset = offset + 4;
1841         ts2->temp_subindex = 1;
1842         pstrcpy(buf, sizeof(buf), name);
1843         pstrcat(buf, sizeof(buf), "_1");
1844         ts2->name = strdup(buf);
1845     } else {
1846         ts->base_type = type;
1847         ts->type = type;
1848         ts->indirect_reg = indirect_reg;
1849         ts->mem_allocated = 1;
1850         ts->mem_base = base_ts;
1851         ts->mem_offset = offset;
1852         ts->name = name;
1853     }
1854     return ts;
1855 }
1856 
1857 TCGv_i32 tcg_global_mem_new_i32(TCGv_ptr reg, intptr_t off, const char *name)
1858 {
1859     TCGTemp *ts = tcg_global_mem_new_internal(reg, off, name, TCG_TYPE_I32);
1860     return temp_tcgv_i32(ts);
1861 }
1862 
1863 TCGv_i64 tcg_global_mem_new_i64(TCGv_ptr reg, intptr_t off, const char *name)
1864 {
1865     TCGTemp *ts = tcg_global_mem_new_internal(reg, off, name, TCG_TYPE_I64);
1866     return temp_tcgv_i64(ts);
1867 }
1868 
1869 TCGv_ptr tcg_global_mem_new_ptr(TCGv_ptr reg, intptr_t off, const char *name)
1870 {
1871     TCGTemp *ts = tcg_global_mem_new_internal(reg, off, name, TCG_TYPE_PTR);
1872     return temp_tcgv_ptr(ts);
1873 }
1874 
1875 TCGTemp *tcg_temp_new_internal(TCGType type, TCGTempKind kind)
1876 {
1877     TCGContext *s = tcg_ctx;
1878     TCGTemp *ts;
1879     int n;
1880 
1881     if (kind == TEMP_EBB) {
1882         int idx = find_first_bit(s->free_temps[type].l, TCG_MAX_TEMPS);
1883 
1884         if (idx < TCG_MAX_TEMPS) {
1885             /* There is already an available temp with the right type.  */
1886             clear_bit(idx, s->free_temps[type].l);
1887 
1888             ts = &s->temps[idx];
1889             ts->temp_allocated = 1;
1890             tcg_debug_assert(ts->base_type == type);
1891             tcg_debug_assert(ts->kind == kind);
1892             return ts;
1893         }
1894     } else {
1895         tcg_debug_assert(kind == TEMP_TB);
1896     }
1897 
1898     switch (type) {
1899     case TCG_TYPE_I32:
1900     case TCG_TYPE_V64:
1901     case TCG_TYPE_V128:
1902     case TCG_TYPE_V256:
1903         n = 1;
1904         break;
1905     case TCG_TYPE_I64:
1906         n = 64 / TCG_TARGET_REG_BITS;
1907         break;
1908     case TCG_TYPE_I128:
1909         n = 128 / TCG_TARGET_REG_BITS;
1910         break;
1911     default:
1912         g_assert_not_reached();
1913     }
1914 
1915     ts = tcg_temp_alloc(s);
1916     ts->base_type = type;
1917     ts->temp_allocated = 1;
1918     ts->kind = kind;
1919 
1920     if (n == 1) {
1921         ts->type = type;
1922     } else {
1923         ts->type = TCG_TYPE_REG;
1924 
1925         for (int i = 1; i < n; ++i) {
1926             TCGTemp *ts2 = tcg_temp_alloc(s);
1927 
1928             tcg_debug_assert(ts2 == ts + i);
1929             ts2->base_type = type;
1930             ts2->type = TCG_TYPE_REG;
1931             ts2->temp_allocated = 1;
1932             ts2->temp_subindex = i;
1933             ts2->kind = kind;
1934         }
1935     }
1936     return ts;
1937 }
1938 
1939 TCGv_i32 tcg_temp_new_i32(void)
1940 {
1941     return temp_tcgv_i32(tcg_temp_new_internal(TCG_TYPE_I32, TEMP_TB));
1942 }
1943 
1944 TCGv_i32 tcg_temp_ebb_new_i32(void)
1945 {
1946     return temp_tcgv_i32(tcg_temp_new_internal(TCG_TYPE_I32, TEMP_EBB));
1947 }
1948 
1949 TCGv_i64 tcg_temp_new_i64(void)
1950 {
1951     return temp_tcgv_i64(tcg_temp_new_internal(TCG_TYPE_I64, TEMP_TB));
1952 }
1953 
1954 TCGv_i64 tcg_temp_ebb_new_i64(void)
1955 {
1956     return temp_tcgv_i64(tcg_temp_new_internal(TCG_TYPE_I64, TEMP_EBB));
1957 }
1958 
1959 TCGv_ptr tcg_temp_new_ptr(void)
1960 {
1961     return temp_tcgv_ptr(tcg_temp_new_internal(TCG_TYPE_PTR, TEMP_TB));
1962 }
1963 
1964 TCGv_ptr tcg_temp_ebb_new_ptr(void)
1965 {
1966     return temp_tcgv_ptr(tcg_temp_new_internal(TCG_TYPE_PTR, TEMP_EBB));
1967 }
1968 
1969 TCGv_i128 tcg_temp_new_i128(void)
1970 {
1971     return temp_tcgv_i128(tcg_temp_new_internal(TCG_TYPE_I128, TEMP_TB));
1972 }
1973 
1974 TCGv_i128 tcg_temp_ebb_new_i128(void)
1975 {
1976     return temp_tcgv_i128(tcg_temp_new_internal(TCG_TYPE_I128, TEMP_EBB));
1977 }
1978 
1979 TCGv_vec tcg_temp_new_vec(TCGType type)
1980 {
1981     TCGTemp *t;
1982 
1983 #ifdef CONFIG_DEBUG_TCG
1984     switch (type) {
1985     case TCG_TYPE_V64:
1986         assert(TCG_TARGET_HAS_v64);
1987         break;
1988     case TCG_TYPE_V128:
1989         assert(TCG_TARGET_HAS_v128);
1990         break;
1991     case TCG_TYPE_V256:
1992         assert(TCG_TARGET_HAS_v256);
1993         break;
1994     default:
1995         g_assert_not_reached();
1996     }
1997 #endif
1998 
1999     t = tcg_temp_new_internal(type, TEMP_EBB);
2000     return temp_tcgv_vec(t);
2001 }
2002 
2003 /* Create a new temp of the same type as an existing temp.  */
2004 TCGv_vec tcg_temp_new_vec_matching(TCGv_vec match)
2005 {
2006     TCGTemp *t = tcgv_vec_temp(match);
2007 
2008     tcg_debug_assert(t->temp_allocated != 0);
2009 
2010     t = tcg_temp_new_internal(t->base_type, TEMP_EBB);
2011     return temp_tcgv_vec(t);
2012 }
2013 
2014 void tcg_temp_free_internal(TCGTemp *ts)
2015 {
2016     TCGContext *s = tcg_ctx;
2017 
2018     switch (ts->kind) {
2019     case TEMP_CONST:
2020     case TEMP_TB:
2021         /* Silently ignore free. */
2022         break;
2023     case TEMP_EBB:
2024         tcg_debug_assert(ts->temp_allocated != 0);
2025         ts->temp_allocated = 0;
2026         set_bit(temp_idx(ts), s->free_temps[ts->base_type].l);
2027         break;
2028     default:
2029         /* It never made sense to free TEMP_FIXED or TEMP_GLOBAL. */
2030         g_assert_not_reached();
2031     }
2032 }
2033 
2034 void tcg_temp_free_i32(TCGv_i32 arg)
2035 {
2036     tcg_temp_free_internal(tcgv_i32_temp(arg));
2037 }
2038 
2039 void tcg_temp_free_i64(TCGv_i64 arg)
2040 {
2041     tcg_temp_free_internal(tcgv_i64_temp(arg));
2042 }
2043 
2044 void tcg_temp_free_i128(TCGv_i128 arg)
2045 {
2046     tcg_temp_free_internal(tcgv_i128_temp(arg));
2047 }
2048 
2049 void tcg_temp_free_ptr(TCGv_ptr arg)
2050 {
2051     tcg_temp_free_internal(tcgv_ptr_temp(arg));
2052 }
2053 
2054 void tcg_temp_free_vec(TCGv_vec arg)
2055 {
2056     tcg_temp_free_internal(tcgv_vec_temp(arg));
2057 }
2058 
2059 TCGTemp *tcg_constant_internal(TCGType type, int64_t val)
2060 {
2061     TCGContext *s = tcg_ctx;
2062     GHashTable *h = s->const_table[type];
2063     TCGTemp *ts;
2064 
2065     if (h == NULL) {
2066         h = g_hash_table_new(g_int64_hash, g_int64_equal);
2067         s->const_table[type] = h;
2068     }
2069 
2070     ts = g_hash_table_lookup(h, &val);
2071     if (ts == NULL) {
2072         int64_t *val_ptr;
2073 
2074         ts = tcg_temp_alloc(s);
2075 
2076         if (TCG_TARGET_REG_BITS == 32 && type == TCG_TYPE_I64) {
2077             TCGTemp *ts2 = tcg_temp_alloc(s);
2078 
2079             tcg_debug_assert(ts2 == ts + 1);
2080 
2081             ts->base_type = TCG_TYPE_I64;
2082             ts->type = TCG_TYPE_I32;
2083             ts->kind = TEMP_CONST;
2084             ts->temp_allocated = 1;
2085 
2086             ts2->base_type = TCG_TYPE_I64;
2087             ts2->type = TCG_TYPE_I32;
2088             ts2->kind = TEMP_CONST;
2089             ts2->temp_allocated = 1;
2090             ts2->temp_subindex = 1;
2091 
2092             /*
2093              * Retain the full value of the 64-bit constant in the low
2094              * part, so that the hash table works.  Actual uses will
2095              * truncate the value to the low part.
2096              */
2097             ts[HOST_BIG_ENDIAN].val = val;
2098             ts[!HOST_BIG_ENDIAN].val = val >> 32;
2099             val_ptr = &ts[HOST_BIG_ENDIAN].val;
2100         } else {
2101             ts->base_type = type;
2102             ts->type = type;
2103             ts->kind = TEMP_CONST;
2104             ts->temp_allocated = 1;
2105             ts->val = val;
2106             val_ptr = &ts->val;
2107         }
2108         g_hash_table_insert(h, val_ptr, ts);
2109     }
2110 
2111     return ts;
2112 }
2113 
2114 TCGv_i32 tcg_constant_i32(int32_t val)
2115 {
2116     return temp_tcgv_i32(tcg_constant_internal(TCG_TYPE_I32, val));
2117 }
2118 
2119 TCGv_i64 tcg_constant_i64(int64_t val)
2120 {
2121     return temp_tcgv_i64(tcg_constant_internal(TCG_TYPE_I64, val));
2122 }
2123 
2124 TCGv_ptr tcg_constant_ptr_int(intptr_t val)
2125 {
2126     return temp_tcgv_ptr(tcg_constant_internal(TCG_TYPE_PTR, val));
2127 }
2128 
2129 TCGv_vec tcg_constant_vec(TCGType type, unsigned vece, int64_t val)
2130 {
2131     val = dup_const(vece, val);
2132     return temp_tcgv_vec(tcg_constant_internal(type, val));
2133 }
2134 
2135 TCGv_vec tcg_constant_vec_matching(TCGv_vec match, unsigned vece, int64_t val)
2136 {
2137     TCGTemp *t = tcgv_vec_temp(match);
2138 
2139     tcg_debug_assert(t->temp_allocated != 0);
2140     return tcg_constant_vec(t->base_type, vece, val);
2141 }
2142 
2143 #ifdef CONFIG_DEBUG_TCG
2144 size_t temp_idx(TCGTemp *ts)
2145 {
2146     ptrdiff_t n = ts - tcg_ctx->temps;
2147     assert(n >= 0 && n < tcg_ctx->nb_temps);
2148     return n;
2149 }
2150 
2151 TCGTemp *tcgv_i32_temp(TCGv_i32 v)
2152 {
2153     uintptr_t o = (uintptr_t)v - offsetof(TCGContext, temps);
2154 
2155     assert(o < sizeof(TCGTemp) * tcg_ctx->nb_temps);
2156     assert(o % sizeof(TCGTemp) == 0);
2157 
2158     return (void *)tcg_ctx + (uintptr_t)v;
2159 }
2160 #endif /* CONFIG_DEBUG_TCG */
2161 
2162 /*
2163  * Return true if OP may appear in the opcode stream with TYPE.
2164  * Test the runtime variable that controls each opcode.
2165  */
2166 bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
2167 {
2168     bool has_type;
2169 
2170     switch (type) {
2171     case TCG_TYPE_I32:
2172         has_type = true;
2173         break;
2174     case TCG_TYPE_I64:
2175         has_type = TCG_TARGET_REG_BITS == 64;
2176         break;
2177     case TCG_TYPE_V64:
2178         has_type = TCG_TARGET_HAS_v64;
2179         break;
2180     case TCG_TYPE_V128:
2181         has_type = TCG_TARGET_HAS_v128;
2182         break;
2183     case TCG_TYPE_V256:
2184         has_type = TCG_TARGET_HAS_v256;
2185         break;
2186     default:
2187         has_type = false;
2188         break;
2189     }
2190 
2191     switch (op) {
2192     case INDEX_op_discard:
2193     case INDEX_op_set_label:
2194     case INDEX_op_call:
2195     case INDEX_op_br:
2196     case INDEX_op_mb:
2197     case INDEX_op_insn_start:
2198     case INDEX_op_exit_tb:
2199     case INDEX_op_goto_tb:
2200     case INDEX_op_goto_ptr:
2201     case INDEX_op_qemu_ld_i32:
2202     case INDEX_op_qemu_st_i32:
2203     case INDEX_op_qemu_ld_i64:
2204     case INDEX_op_qemu_st_i64:
2205         return true;
2206 
2207     case INDEX_op_qemu_st8_i32:
2208         return TCG_TARGET_HAS_qemu_st8_i32;
2209 
2210     case INDEX_op_qemu_ld_i128:
2211     case INDEX_op_qemu_st_i128:
2212         return TCG_TARGET_HAS_qemu_ldst_i128;
2213 
2214     case INDEX_op_add:
2215     case INDEX_op_and:
2216     case INDEX_op_mov:
2217     case INDEX_op_or:
2218     case INDEX_op_xor:
2219         return has_type;
2220 
2221     case INDEX_op_setcond_i32:
2222     case INDEX_op_brcond_i32:
2223     case INDEX_op_movcond_i32:
2224     case INDEX_op_ld8u_i32:
2225     case INDEX_op_ld8s_i32:
2226     case INDEX_op_ld16u_i32:
2227     case INDEX_op_ld16s_i32:
2228     case INDEX_op_ld_i32:
2229     case INDEX_op_st8_i32:
2230     case INDEX_op_st16_i32:
2231     case INDEX_op_st_i32:
2232     case INDEX_op_sub_i32:
2233     case INDEX_op_neg_i32:
2234     case INDEX_op_mul_i32:
2235     case INDEX_op_shl_i32:
2236     case INDEX_op_shr_i32:
2237     case INDEX_op_sar_i32:
2238     case INDEX_op_extract_i32:
2239     case INDEX_op_sextract_i32:
2240     case INDEX_op_deposit_i32:
2241         return true;
2242 
2243     case INDEX_op_negsetcond_i32:
2244         return TCG_TARGET_HAS_negsetcond_i32;
2245     case INDEX_op_div_i32:
2246     case INDEX_op_divu_i32:
2247         return TCG_TARGET_HAS_div_i32;
2248     case INDEX_op_rem_i32:
2249     case INDEX_op_remu_i32:
2250         return TCG_TARGET_HAS_rem_i32;
2251     case INDEX_op_div2_i32:
2252     case INDEX_op_divu2_i32:
2253         return TCG_TARGET_HAS_div2_i32;
2254     case INDEX_op_rotl_i32:
2255     case INDEX_op_rotr_i32:
2256         return TCG_TARGET_HAS_rot_i32;
2257     case INDEX_op_extract2_i32:
2258         return TCG_TARGET_HAS_extract2_i32;
2259     case INDEX_op_add2_i32:
2260         return TCG_TARGET_HAS_add2_i32;
2261     case INDEX_op_sub2_i32:
2262         return TCG_TARGET_HAS_sub2_i32;
2263     case INDEX_op_mulu2_i32:
2264         return TCG_TARGET_HAS_mulu2_i32;
2265     case INDEX_op_muls2_i32:
2266         return TCG_TARGET_HAS_muls2_i32;
2267     case INDEX_op_muluh_i32:
2268         return TCG_TARGET_HAS_muluh_i32;
2269     case INDEX_op_mulsh_i32:
2270         return TCG_TARGET_HAS_mulsh_i32;
2271     case INDEX_op_bswap16_i32:
2272         return TCG_TARGET_HAS_bswap16_i32;
2273     case INDEX_op_bswap32_i32:
2274         return TCG_TARGET_HAS_bswap32_i32;
2275     case INDEX_op_not_i32:
2276         return TCG_TARGET_HAS_not_i32;
2277     case INDEX_op_nand_i32:
2278         return TCG_TARGET_HAS_nand_i32;
2279     case INDEX_op_nor_i32:
2280         return TCG_TARGET_HAS_nor_i32;
2281     case INDEX_op_clz_i32:
2282         return TCG_TARGET_HAS_clz_i32;
2283     case INDEX_op_ctz_i32:
2284         return TCG_TARGET_HAS_ctz_i32;
2285     case INDEX_op_ctpop_i32:
2286         return TCG_TARGET_HAS_ctpop_i32;
2287 
2288     case INDEX_op_brcond2_i32:
2289     case INDEX_op_setcond2_i32:
2290         return TCG_TARGET_REG_BITS == 32;
2291 
2292     case INDEX_op_setcond_i64:
2293     case INDEX_op_brcond_i64:
2294     case INDEX_op_movcond_i64:
2295     case INDEX_op_ld8u_i64:
2296     case INDEX_op_ld8s_i64:
2297     case INDEX_op_ld16u_i64:
2298     case INDEX_op_ld16s_i64:
2299     case INDEX_op_ld32u_i64:
2300     case INDEX_op_ld32s_i64:
2301     case INDEX_op_ld_i64:
2302     case INDEX_op_st8_i64:
2303     case INDEX_op_st16_i64:
2304     case INDEX_op_st32_i64:
2305     case INDEX_op_st_i64:
2306     case INDEX_op_sub_i64:
2307     case INDEX_op_neg_i64:
2308     case INDEX_op_mul_i64:
2309     case INDEX_op_shl_i64:
2310     case INDEX_op_shr_i64:
2311     case INDEX_op_sar_i64:
2312     case INDEX_op_ext_i32_i64:
2313     case INDEX_op_extu_i32_i64:
2314     case INDEX_op_extract_i64:
2315     case INDEX_op_sextract_i64:
2316     case INDEX_op_deposit_i64:
2317         return TCG_TARGET_REG_BITS == 64;
2318 
2319     case INDEX_op_negsetcond_i64:
2320         return TCG_TARGET_HAS_negsetcond_i64;
2321     case INDEX_op_div_i64:
2322     case INDEX_op_divu_i64:
2323         return TCG_TARGET_HAS_div_i64;
2324     case INDEX_op_rem_i64:
2325     case INDEX_op_remu_i64:
2326         return TCG_TARGET_HAS_rem_i64;
2327     case INDEX_op_div2_i64:
2328     case INDEX_op_divu2_i64:
2329         return TCG_TARGET_HAS_div2_i64;
2330     case INDEX_op_rotl_i64:
2331     case INDEX_op_rotr_i64:
2332         return TCG_TARGET_HAS_rot_i64;
2333     case INDEX_op_extract2_i64:
2334         return TCG_TARGET_HAS_extract2_i64;
2335     case INDEX_op_extrl_i64_i32:
2336     case INDEX_op_extrh_i64_i32:
2337         return TCG_TARGET_HAS_extr_i64_i32;
2338     case INDEX_op_bswap16_i64:
2339         return TCG_TARGET_HAS_bswap16_i64;
2340     case INDEX_op_bswap32_i64:
2341         return TCG_TARGET_HAS_bswap32_i64;
2342     case INDEX_op_bswap64_i64:
2343         return TCG_TARGET_HAS_bswap64_i64;
2344     case INDEX_op_not_i64:
2345         return TCG_TARGET_HAS_not_i64;
2346     case INDEX_op_nand_i64:
2347         return TCG_TARGET_HAS_nand_i64;
2348     case INDEX_op_nor_i64:
2349         return TCG_TARGET_HAS_nor_i64;
2350     case INDEX_op_clz_i64:
2351         return TCG_TARGET_HAS_clz_i64;
2352     case INDEX_op_ctz_i64:
2353         return TCG_TARGET_HAS_ctz_i64;
2354     case INDEX_op_ctpop_i64:
2355         return TCG_TARGET_HAS_ctpop_i64;
2356     case INDEX_op_add2_i64:
2357         return TCG_TARGET_HAS_add2_i64;
2358     case INDEX_op_sub2_i64:
2359         return TCG_TARGET_HAS_sub2_i64;
2360     case INDEX_op_mulu2_i64:
2361         return TCG_TARGET_HAS_mulu2_i64;
2362     case INDEX_op_muls2_i64:
2363         return TCG_TARGET_HAS_muls2_i64;
2364     case INDEX_op_muluh_i64:
2365         return TCG_TARGET_HAS_muluh_i64;
2366     case INDEX_op_mulsh_i64:
2367         return TCG_TARGET_HAS_mulsh_i64;
2368 
2369     case INDEX_op_mov_vec:
2370     case INDEX_op_dup_vec:
2371     case INDEX_op_dupm_vec:
2372     case INDEX_op_ld_vec:
2373     case INDEX_op_st_vec:
2374     case INDEX_op_add_vec:
2375     case INDEX_op_sub_vec:
2376     case INDEX_op_and_vec:
2377     case INDEX_op_or_vec:
2378     case INDEX_op_xor_vec:
2379     case INDEX_op_cmp_vec:
2380         return has_type;
2381     case INDEX_op_dup2_vec:
2382         return has_type && TCG_TARGET_REG_BITS == 32;
2383     case INDEX_op_not_vec:
2384         return has_type && TCG_TARGET_HAS_not_vec;
2385     case INDEX_op_neg_vec:
2386         return has_type && TCG_TARGET_HAS_neg_vec;
2387     case INDEX_op_abs_vec:
2388         return has_type && TCG_TARGET_HAS_abs_vec;
2389     case INDEX_op_andc_vec:
2390         return has_type && TCG_TARGET_HAS_andc_vec;
2391     case INDEX_op_orc_vec:
2392         return has_type && TCG_TARGET_HAS_orc_vec;
2393     case INDEX_op_nand_vec:
2394         return has_type && TCG_TARGET_HAS_nand_vec;
2395     case INDEX_op_nor_vec:
2396         return has_type && TCG_TARGET_HAS_nor_vec;
2397     case INDEX_op_eqv_vec:
2398         return has_type && TCG_TARGET_HAS_eqv_vec;
2399     case INDEX_op_mul_vec:
2400         return has_type && TCG_TARGET_HAS_mul_vec;
2401     case INDEX_op_shli_vec:
2402     case INDEX_op_shri_vec:
2403     case INDEX_op_sari_vec:
2404         return has_type && TCG_TARGET_HAS_shi_vec;
2405     case INDEX_op_shls_vec:
2406     case INDEX_op_shrs_vec:
2407     case INDEX_op_sars_vec:
2408         return has_type && TCG_TARGET_HAS_shs_vec;
2409     case INDEX_op_shlv_vec:
2410     case INDEX_op_shrv_vec:
2411     case INDEX_op_sarv_vec:
2412         return has_type && TCG_TARGET_HAS_shv_vec;
2413     case INDEX_op_rotli_vec:
2414         return has_type && TCG_TARGET_HAS_roti_vec;
2415     case INDEX_op_rotls_vec:
2416         return has_type && TCG_TARGET_HAS_rots_vec;
2417     case INDEX_op_rotlv_vec:
2418     case INDEX_op_rotrv_vec:
2419         return has_type && TCG_TARGET_HAS_rotv_vec;
2420     case INDEX_op_ssadd_vec:
2421     case INDEX_op_usadd_vec:
2422     case INDEX_op_sssub_vec:
2423     case INDEX_op_ussub_vec:
2424         return has_type && TCG_TARGET_HAS_sat_vec;
2425     case INDEX_op_smin_vec:
2426     case INDEX_op_umin_vec:
2427     case INDEX_op_smax_vec:
2428     case INDEX_op_umax_vec:
2429         return has_type && TCG_TARGET_HAS_minmax_vec;
2430     case INDEX_op_bitsel_vec:
2431         return has_type && TCG_TARGET_HAS_bitsel_vec;
2432     case INDEX_op_cmpsel_vec:
2433         return has_type && TCG_TARGET_HAS_cmpsel_vec;
2434 
2435     default:
2436         if (op < INDEX_op_last_generic) {
2437             const TCGOutOp *outop;
2438             TCGConstraintSetIndex con_set;
2439 
2440             if (!has_type) {
2441                 return false;
2442             }
2443 
2444             outop = all_outop[op];
2445             tcg_debug_assert(outop != NULL);
2446 
2447             con_set = outop->static_constraint;
2448             if (con_set == C_Dynamic) {
2449                 con_set = outop->dynamic_constraint(type, flags);
2450             }
2451             if (con_set >= 0) {
2452                 return true;
2453             }
2454             tcg_debug_assert(con_set == C_NotImplemented);
2455             return false;
2456         }
2457         tcg_debug_assert(op < NB_OPS);
2458         return true;
2459 
2460     case INDEX_op_last_generic:
2461         g_assert_not_reached();
2462     }
2463 }
2464 
2465 bool tcg_op_deposit_valid(TCGType type, unsigned ofs, unsigned len)
2466 {
2467     unsigned width;
2468 
2469     tcg_debug_assert(type == TCG_TYPE_I32 || type == TCG_TYPE_I64);
2470     width = (type == TCG_TYPE_I32 ? 32 : 64);
2471 
2472     tcg_debug_assert(ofs < width);
2473     tcg_debug_assert(len > 0);
2474     tcg_debug_assert(len <= width - ofs);
2475 
2476     return TCG_TARGET_deposit_valid(type, ofs, len);
2477 }
2478 
2479 static TCGOp *tcg_op_alloc(TCGOpcode opc, unsigned nargs);
2480 
2481 static void tcg_gen_callN(void *func, TCGHelperInfo *info,
2482                           TCGTemp *ret, TCGTemp **args)
2483 {
2484     TCGv_i64 extend_free[MAX_CALL_IARGS];
2485     int n_extend = 0;
2486     TCGOp *op;
2487     int i, n, pi = 0, total_args;
2488 
2489     if (unlikely(g_once_init_enter(HELPER_INFO_INIT(info)))) {
2490         init_call_layout(info);
2491         g_once_init_leave(HELPER_INFO_INIT(info), HELPER_INFO_INIT_VAL(info));
2492     }
2493 
2494     total_args = info->nr_out + info->nr_in + 2;
2495     op = tcg_op_alloc(INDEX_op_call, total_args);
2496 
2497 #ifdef CONFIG_PLUGIN
2498     /* Flag helpers that may affect guest state */
2499     if (tcg_ctx->plugin_insn && !(info->flags & TCG_CALL_NO_SIDE_EFFECTS)) {
2500         tcg_ctx->plugin_insn->calls_helpers = true;
2501     }
2502 #endif
2503 
2504     TCGOP_CALLO(op) = n = info->nr_out;
2505     switch (n) {
2506     case 0:
2507         tcg_debug_assert(ret == NULL);
2508         break;
2509     case 1:
2510         tcg_debug_assert(ret != NULL);
2511         op->args[pi++] = temp_arg(ret);
2512         break;
2513     case 2:
2514     case 4:
2515         tcg_debug_assert(ret != NULL);
2516         tcg_debug_assert(ret->base_type == ret->type + ctz32(n));
2517         tcg_debug_assert(ret->temp_subindex == 0);
2518         for (i = 0; i < n; ++i) {
2519             op->args[pi++] = temp_arg(ret + i);
2520         }
2521         break;
2522     default:
2523         g_assert_not_reached();
2524     }
2525 
2526     TCGOP_CALLI(op) = n = info->nr_in;
2527     for (i = 0; i < n; i++) {
2528         const TCGCallArgumentLoc *loc = &info->in[i];
2529         TCGTemp *ts = args[loc->arg_idx] + loc->tmp_subindex;
2530 
2531         switch (loc->kind) {
2532         case TCG_CALL_ARG_NORMAL:
2533         case TCG_CALL_ARG_BY_REF:
2534         case TCG_CALL_ARG_BY_REF_N:
2535             op->args[pi++] = temp_arg(ts);
2536             break;
2537 
2538         case TCG_CALL_ARG_EXTEND_U:
2539         case TCG_CALL_ARG_EXTEND_S:
2540             {
2541                 TCGv_i64 temp = tcg_temp_ebb_new_i64();
2542                 TCGv_i32 orig = temp_tcgv_i32(ts);
2543 
2544                 if (loc->kind == TCG_CALL_ARG_EXTEND_S) {
2545                     tcg_gen_ext_i32_i64(temp, orig);
2546                 } else {
2547                     tcg_gen_extu_i32_i64(temp, orig);
2548                 }
2549                 op->args[pi++] = tcgv_i64_arg(temp);
2550                 extend_free[n_extend++] = temp;
2551             }
2552             break;
2553 
2554         default:
2555             g_assert_not_reached();
2556         }
2557     }
2558     op->args[pi++] = (uintptr_t)func;
2559     op->args[pi++] = (uintptr_t)info;
2560     tcg_debug_assert(pi == total_args);
2561 
2562     if (tcg_ctx->emit_before_op) {
2563         QTAILQ_INSERT_BEFORE(tcg_ctx->emit_before_op, op, link);
2564     } else {
2565         QTAILQ_INSERT_TAIL(&tcg_ctx->ops, op, link);
2566     }
2567 
2568     tcg_debug_assert(n_extend < ARRAY_SIZE(extend_free));
2569     for (i = 0; i < n_extend; ++i) {
2570         tcg_temp_free_i64(extend_free[i]);
2571     }
2572 }
2573 
2574 void tcg_gen_call0(void *func, TCGHelperInfo *info, TCGTemp *ret)
2575 {
2576     tcg_gen_callN(func, info, ret, NULL);
2577 }
2578 
2579 void tcg_gen_call1(void *func, TCGHelperInfo *info, TCGTemp *ret, TCGTemp *t1)
2580 {
2581     tcg_gen_callN(func, info, ret, &t1);
2582 }
2583 
2584 void tcg_gen_call2(void *func, TCGHelperInfo *info, TCGTemp *ret,
2585                    TCGTemp *t1, TCGTemp *t2)
2586 {
2587     TCGTemp *args[2] = { t1, t2 };
2588     tcg_gen_callN(func, info, ret, args);
2589 }
2590 
2591 void tcg_gen_call3(void *func, TCGHelperInfo *info, TCGTemp *ret,
2592                    TCGTemp *t1, TCGTemp *t2, TCGTemp *t3)
2593 {
2594     TCGTemp *args[3] = { t1, t2, t3 };
2595     tcg_gen_callN(func, info, ret, args);
2596 }
2597 
2598 void tcg_gen_call4(void *func, TCGHelperInfo *info, TCGTemp *ret,
2599                    TCGTemp *t1, TCGTemp *t2, TCGTemp *t3, TCGTemp *t4)
2600 {
2601     TCGTemp *args[4] = { t1, t2, t3, t4 };
2602     tcg_gen_callN(func, info, ret, args);
2603 }
2604 
2605 void tcg_gen_call5(void *func, TCGHelperInfo *info, TCGTemp *ret, TCGTemp *t1,
2606                    TCGTemp *t2, TCGTemp *t3, TCGTemp *t4, TCGTemp *t5)
2607 {
2608     TCGTemp *args[5] = { t1, t2, t3, t4, t5 };
2609     tcg_gen_callN(func, info, ret, args);
2610 }
2611 
2612 void tcg_gen_call6(void *func, TCGHelperInfo *info, TCGTemp *ret,
2613                    TCGTemp *t1, TCGTemp *t2, TCGTemp *t3,
2614                    TCGTemp *t4, TCGTemp *t5, TCGTemp *t6)
2615 {
2616     TCGTemp *args[6] = { t1, t2, t3, t4, t5, t6 };
2617     tcg_gen_callN(func, info, ret, args);
2618 }
2619 
2620 void tcg_gen_call7(void *func, TCGHelperInfo *info, TCGTemp *ret, TCGTemp *t1,
2621                    TCGTemp *t2, TCGTemp *t3, TCGTemp *t4,
2622                    TCGTemp *t5, TCGTemp *t6, TCGTemp *t7)
2623 {
2624     TCGTemp *args[7] = { t1, t2, t3, t4, t5, t6, t7 };
2625     tcg_gen_callN(func, info, ret, args);
2626 }
2627 
2628 static void tcg_reg_alloc_start(TCGContext *s)
2629 {
2630     int i, n;
2631 
2632     for (i = 0, n = s->nb_temps; i < n; i++) {
2633         TCGTemp *ts = &s->temps[i];
2634         TCGTempVal val = TEMP_VAL_MEM;
2635 
2636         switch (ts->kind) {
2637         case TEMP_CONST:
2638             val = TEMP_VAL_CONST;
2639             break;
2640         case TEMP_FIXED:
2641             val = TEMP_VAL_REG;
2642             break;
2643         case TEMP_GLOBAL:
2644             break;
2645         case TEMP_EBB:
2646             val = TEMP_VAL_DEAD;
2647             /* fall through */
2648         case TEMP_TB:
2649             ts->mem_allocated = 0;
2650             break;
2651         default:
2652             g_assert_not_reached();
2653         }
2654         ts->val_type = val;
2655     }
2656 
2657     memset(s->reg_to_temp, 0, sizeof(s->reg_to_temp));
2658 }
2659 
2660 static char *tcg_get_arg_str_ptr(TCGContext *s, char *buf, int buf_size,
2661                                  TCGTemp *ts)
2662 {
2663     int idx = temp_idx(ts);
2664 
2665     switch (ts->kind) {
2666     case TEMP_FIXED:
2667     case TEMP_GLOBAL:
2668         pstrcpy(buf, buf_size, ts->name);
2669         break;
2670     case TEMP_TB:
2671         snprintf(buf, buf_size, "loc%d", idx - s->nb_globals);
2672         break;
2673     case TEMP_EBB:
2674         snprintf(buf, buf_size, "tmp%d", idx - s->nb_globals);
2675         break;
2676     case TEMP_CONST:
2677         switch (ts->type) {
2678         case TCG_TYPE_I32:
2679             snprintf(buf, buf_size, "$0x%x", (int32_t)ts->val);
2680             break;
2681 #if TCG_TARGET_REG_BITS > 32
2682         case TCG_TYPE_I64:
2683             snprintf(buf, buf_size, "$0x%" PRIx64, ts->val);
2684             break;
2685 #endif
2686         case TCG_TYPE_V64:
2687         case TCG_TYPE_V128:
2688         case TCG_TYPE_V256:
2689             snprintf(buf, buf_size, "v%d$0x%" PRIx64,
2690                      64 << (ts->type - TCG_TYPE_V64), ts->val);
2691             break;
2692         default:
2693             g_assert_not_reached();
2694         }
2695         break;
2696     }
2697     return buf;
2698 }
2699 
2700 static char *tcg_get_arg_str(TCGContext *s, char *buf,
2701                              int buf_size, TCGArg arg)
2702 {
2703     return tcg_get_arg_str_ptr(s, buf, buf_size, arg_temp(arg));
2704 }
2705 
2706 static const char * const cond_name[] =
2707 {
2708     [TCG_COND_NEVER] = "never",
2709     [TCG_COND_ALWAYS] = "always",
2710     [TCG_COND_EQ] = "eq",
2711     [TCG_COND_NE] = "ne",
2712     [TCG_COND_LT] = "lt",
2713     [TCG_COND_GE] = "ge",
2714     [TCG_COND_LE] = "le",
2715     [TCG_COND_GT] = "gt",
2716     [TCG_COND_LTU] = "ltu",
2717     [TCG_COND_GEU] = "geu",
2718     [TCG_COND_LEU] = "leu",
2719     [TCG_COND_GTU] = "gtu",
2720     [TCG_COND_TSTEQ] = "tsteq",
2721     [TCG_COND_TSTNE] = "tstne",
2722 };
2723 
2724 static const char * const ldst_name[(MO_BSWAP | MO_SSIZE) + 1] =
2725 {
2726     [MO_UB]   = "ub",
2727     [MO_SB]   = "sb",
2728     [MO_LEUW] = "leuw",
2729     [MO_LESW] = "lesw",
2730     [MO_LEUL] = "leul",
2731     [MO_LESL] = "lesl",
2732     [MO_LEUQ] = "leq",
2733     [MO_BEUW] = "beuw",
2734     [MO_BESW] = "besw",
2735     [MO_BEUL] = "beul",
2736     [MO_BESL] = "besl",
2737     [MO_BEUQ] = "beq",
2738     [MO_128 + MO_BE] = "beo",
2739     [MO_128 + MO_LE] = "leo",
2740 };
2741 
2742 static const char * const alignment_name[(MO_AMASK >> MO_ASHIFT) + 1] = {
2743     [MO_UNALN >> MO_ASHIFT]    = "un+",
2744     [MO_ALIGN >> MO_ASHIFT]    = "al+",
2745     [MO_ALIGN_2 >> MO_ASHIFT]  = "al2+",
2746     [MO_ALIGN_4 >> MO_ASHIFT]  = "al4+",
2747     [MO_ALIGN_8 >> MO_ASHIFT]  = "al8+",
2748     [MO_ALIGN_16 >> MO_ASHIFT] = "al16+",
2749     [MO_ALIGN_32 >> MO_ASHIFT] = "al32+",
2750     [MO_ALIGN_64 >> MO_ASHIFT] = "al64+",
2751 };
2752 
2753 static const char * const atom_name[(MO_ATOM_MASK >> MO_ATOM_SHIFT) + 1] = {
2754     [MO_ATOM_IFALIGN >> MO_ATOM_SHIFT] = "",
2755     [MO_ATOM_IFALIGN_PAIR >> MO_ATOM_SHIFT] = "pair+",
2756     [MO_ATOM_WITHIN16 >> MO_ATOM_SHIFT] = "w16+",
2757     [MO_ATOM_WITHIN16_PAIR >> MO_ATOM_SHIFT] = "w16p+",
2758     [MO_ATOM_SUBALIGN >> MO_ATOM_SHIFT] = "sub+",
2759     [MO_ATOM_NONE >> MO_ATOM_SHIFT] = "noat+",
2760 };
2761 
2762 static const char bswap_flag_name[][6] = {
2763     [TCG_BSWAP_IZ] = "iz",
2764     [TCG_BSWAP_OZ] = "oz",
2765     [TCG_BSWAP_OS] = "os",
2766     [TCG_BSWAP_IZ | TCG_BSWAP_OZ] = "iz,oz",
2767     [TCG_BSWAP_IZ | TCG_BSWAP_OS] = "iz,os",
2768 };
2769 
2770 #ifdef CONFIG_PLUGIN
2771 static const char * const plugin_from_name[] = {
2772     "from-tb",
2773     "from-insn",
2774     "after-insn",
2775     "after-tb",
2776 };
2777 #endif
2778 
2779 static inline bool tcg_regset_single(TCGRegSet d)
2780 {
2781     return (d & (d - 1)) == 0;
2782 }
2783 
2784 static inline TCGReg tcg_regset_first(TCGRegSet d)
2785 {
2786     if (TCG_TARGET_NB_REGS <= 32) {
2787         return ctz32(d);
2788     } else {
2789         return ctz64(d);
2790     }
2791 }
2792 
2793 /* Return only the number of characters output -- no error return. */
2794 #define ne_fprintf(...) \
2795     ({ int ret_ = fprintf(__VA_ARGS__); ret_ >= 0 ? ret_ : 0; })
2796 
2797 void tcg_dump_ops(TCGContext *s, FILE *f, bool have_prefs)
2798 {
2799     char buf[128];
2800     TCGOp *op;
2801 
2802     QTAILQ_FOREACH(op, &s->ops, link) {
2803         int i, k, nb_oargs, nb_iargs, nb_cargs;
2804         const TCGOpDef *def;
2805         TCGOpcode c;
2806         int col = 0;
2807 
2808         c = op->opc;
2809         def = &tcg_op_defs[c];
2810 
2811         if (c == INDEX_op_insn_start) {
2812             nb_oargs = 0;
2813             col += ne_fprintf(f, "\n ----");
2814 
2815             for (i = 0, k = s->insn_start_words; i < k; ++i) {
2816                 col += ne_fprintf(f, " %016" PRIx64,
2817                                   tcg_get_insn_start_param(op, i));
2818             }
2819         } else if (c == INDEX_op_call) {
2820             const TCGHelperInfo *info = tcg_call_info(op);
2821             void *func = tcg_call_func(op);
2822 
2823             /* variable number of arguments */
2824             nb_oargs = TCGOP_CALLO(op);
2825             nb_iargs = TCGOP_CALLI(op);
2826             nb_cargs = def->nb_cargs;
2827 
2828             col += ne_fprintf(f, " %s ", def->name);
2829 
2830             /*
2831              * Print the function name from TCGHelperInfo, if available.
2832              * Note that plugins have a template function for the info,
2833              * but the actual function pointer comes from the plugin.
2834              */
2835             if (func == info->func) {
2836                 col += ne_fprintf(f, "%s", info->name);
2837             } else {
2838                 col += ne_fprintf(f, "plugin(%p)", func);
2839             }
2840 
2841             col += ne_fprintf(f, ",$0x%x,$%d", info->flags, nb_oargs);
2842             for (i = 0; i < nb_oargs; i++) {
2843                 col += ne_fprintf(f, ",%s", tcg_get_arg_str(s, buf, sizeof(buf),
2844                                                             op->args[i]));
2845             }
2846             for (i = 0; i < nb_iargs; i++) {
2847                 TCGArg arg = op->args[nb_oargs + i];
2848                 const char *t = tcg_get_arg_str(s, buf, sizeof(buf), arg);
2849                 col += ne_fprintf(f, ",%s", t);
2850             }
2851         } else {
2852             if (def->flags & TCG_OPF_INT) {
2853                 col += ne_fprintf(f, " %s_i%d ",
2854                                   def->name,
2855                                   8 * tcg_type_size(TCGOP_TYPE(op)));
2856             } else if (def->flags & TCG_OPF_VECTOR) {
2857                 col += ne_fprintf(f, "%s v%d,e%d,",
2858                                   def->name,
2859                                   8 * tcg_type_size(TCGOP_TYPE(op)),
2860                                   8 << TCGOP_VECE(op));
2861             } else {
2862                 col += ne_fprintf(f, " %s ", def->name);
2863             }
2864 
2865             nb_oargs = def->nb_oargs;
2866             nb_iargs = def->nb_iargs;
2867             nb_cargs = def->nb_cargs;
2868 
2869             k = 0;
2870             for (i = 0; i < nb_oargs; i++) {
2871                 const char *sep =  k ? "," : "";
2872                 col += ne_fprintf(f, "%s%s", sep,
2873                                   tcg_get_arg_str(s, buf, sizeof(buf),
2874                                                   op->args[k++]));
2875             }
2876             for (i = 0; i < nb_iargs; i++) {
2877                 const char *sep =  k ? "," : "";
2878                 col += ne_fprintf(f, "%s%s", sep,
2879                                   tcg_get_arg_str(s, buf, sizeof(buf),
2880                                                   op->args[k++]));
2881             }
2882             switch (c) {
2883             case INDEX_op_brcond_i32:
2884             case INDEX_op_setcond_i32:
2885             case INDEX_op_negsetcond_i32:
2886             case INDEX_op_movcond_i32:
2887             case INDEX_op_brcond2_i32:
2888             case INDEX_op_setcond2_i32:
2889             case INDEX_op_brcond_i64:
2890             case INDEX_op_setcond_i64:
2891             case INDEX_op_negsetcond_i64:
2892             case INDEX_op_movcond_i64:
2893             case INDEX_op_cmp_vec:
2894             case INDEX_op_cmpsel_vec:
2895                 if (op->args[k] < ARRAY_SIZE(cond_name)
2896                     && cond_name[op->args[k]]) {
2897                     col += ne_fprintf(f, ",%s", cond_name[op->args[k++]]);
2898                 } else {
2899                     col += ne_fprintf(f, ",$0x%" TCG_PRIlx, op->args[k++]);
2900                 }
2901                 i = 1;
2902                 break;
2903             case INDEX_op_qemu_ld_i32:
2904             case INDEX_op_qemu_st_i32:
2905             case INDEX_op_qemu_st8_i32:
2906             case INDEX_op_qemu_ld_i64:
2907             case INDEX_op_qemu_st_i64:
2908             case INDEX_op_qemu_ld_i128:
2909             case INDEX_op_qemu_st_i128:
2910                 {
2911                     const char *s_al, *s_op, *s_at;
2912                     MemOpIdx oi = op->args[k++];
2913                     MemOp mop = get_memop(oi);
2914                     unsigned ix = get_mmuidx(oi);
2915 
2916                     s_al = alignment_name[(mop & MO_AMASK) >> MO_ASHIFT];
2917                     s_op = ldst_name[mop & (MO_BSWAP | MO_SSIZE)];
2918                     s_at = atom_name[(mop & MO_ATOM_MASK) >> MO_ATOM_SHIFT];
2919                     mop &= ~(MO_AMASK | MO_BSWAP | MO_SSIZE | MO_ATOM_MASK);
2920 
2921                     /* If all fields are accounted for, print symbolically. */
2922                     if (!mop && s_al && s_op && s_at) {
2923                         col += ne_fprintf(f, ",%s%s%s,%u",
2924                                           s_at, s_al, s_op, ix);
2925                     } else {
2926                         mop = get_memop(oi);
2927                         col += ne_fprintf(f, ",$0x%x,%u", mop, ix);
2928                     }
2929                     i = 1;
2930                 }
2931                 break;
2932             case INDEX_op_bswap16_i32:
2933             case INDEX_op_bswap16_i64:
2934             case INDEX_op_bswap32_i32:
2935             case INDEX_op_bswap32_i64:
2936             case INDEX_op_bswap64_i64:
2937                 {
2938                     TCGArg flags = op->args[k];
2939                     const char *name = NULL;
2940 
2941                     if (flags < ARRAY_SIZE(bswap_flag_name)) {
2942                         name = bswap_flag_name[flags];
2943                     }
2944                     if (name) {
2945                         col += ne_fprintf(f, ",%s", name);
2946                     } else {
2947                         col += ne_fprintf(f, ",$0x%" TCG_PRIlx, flags);
2948                     }
2949                     i = k = 1;
2950                 }
2951                 break;
2952 #ifdef CONFIG_PLUGIN
2953             case INDEX_op_plugin_cb:
2954                 {
2955                     TCGArg from = op->args[k++];
2956                     const char *name = NULL;
2957 
2958                     if (from < ARRAY_SIZE(plugin_from_name)) {
2959                         name = plugin_from_name[from];
2960                     }
2961                     if (name) {
2962                         col += ne_fprintf(f, "%s", name);
2963                     } else {
2964                         col += ne_fprintf(f, "$0x%" TCG_PRIlx, from);
2965                     }
2966                     i = 1;
2967                 }
2968                 break;
2969 #endif
2970             default:
2971                 i = 0;
2972                 break;
2973             }
2974             switch (c) {
2975             case INDEX_op_set_label:
2976             case INDEX_op_br:
2977             case INDEX_op_brcond_i32:
2978             case INDEX_op_brcond_i64:
2979             case INDEX_op_brcond2_i32:
2980                 col += ne_fprintf(f, "%s$L%d", k ? "," : "",
2981                                   arg_label(op->args[k])->id);
2982                 i++, k++;
2983                 break;
2984             case INDEX_op_mb:
2985                 {
2986                     TCGBar membar = op->args[k];
2987                     const char *b_op, *m_op;
2988 
2989                     switch (membar & TCG_BAR_SC) {
2990                     case 0:
2991                         b_op = "none";
2992                         break;
2993                     case TCG_BAR_LDAQ:
2994                         b_op = "acq";
2995                         break;
2996                     case TCG_BAR_STRL:
2997                         b_op = "rel";
2998                         break;
2999                     case TCG_BAR_SC:
3000                         b_op = "seq";
3001                         break;
3002                     default:
3003                         g_assert_not_reached();
3004                     }
3005 
3006                     switch (membar & TCG_MO_ALL) {
3007                     case 0:
3008                         m_op = "none";
3009                         break;
3010                     case TCG_MO_LD_LD:
3011                         m_op = "rr";
3012                         break;
3013                     case TCG_MO_LD_ST:
3014                         m_op = "rw";
3015                         break;
3016                     case TCG_MO_ST_LD:
3017                         m_op = "wr";
3018                         break;
3019                     case TCG_MO_ST_ST:
3020                         m_op = "ww";
3021                         break;
3022                     case TCG_MO_LD_LD | TCG_MO_LD_ST:
3023                         m_op = "rr+rw";
3024                         break;
3025                     case TCG_MO_LD_LD | TCG_MO_ST_LD:
3026                         m_op = "rr+wr";
3027                         break;
3028                     case TCG_MO_LD_LD | TCG_MO_ST_ST:
3029                         m_op = "rr+ww";
3030                         break;
3031                     case TCG_MO_LD_ST | TCG_MO_ST_LD:
3032                         m_op = "rw+wr";
3033                         break;
3034                     case TCG_MO_LD_ST | TCG_MO_ST_ST:
3035                         m_op = "rw+ww";
3036                         break;
3037                     case TCG_MO_ST_LD | TCG_MO_ST_ST:
3038                         m_op = "wr+ww";
3039                         break;
3040                     case TCG_MO_LD_LD | TCG_MO_LD_ST | TCG_MO_ST_LD:
3041                         m_op = "rr+rw+wr";
3042                         break;
3043                     case TCG_MO_LD_LD | TCG_MO_LD_ST | TCG_MO_ST_ST:
3044                         m_op = "rr+rw+ww";
3045                         break;
3046                     case TCG_MO_LD_LD | TCG_MO_ST_LD | TCG_MO_ST_ST:
3047                         m_op = "rr+wr+ww";
3048                         break;
3049                     case TCG_MO_LD_ST | TCG_MO_ST_LD | TCG_MO_ST_ST:
3050                         m_op = "rw+wr+ww";
3051                         break;
3052                     case TCG_MO_ALL:
3053                         m_op = "all";
3054                         break;
3055                     default:
3056                         g_assert_not_reached();
3057                     }
3058 
3059                     col += ne_fprintf(f, "%s%s:%s", (k ? "," : ""), b_op, m_op);
3060                     i++, k++;
3061                 }
3062                 break;
3063             default:
3064                 break;
3065             }
3066             for (; i < nb_cargs; i++, k++) {
3067                 col += ne_fprintf(f, "%s$0x%" TCG_PRIlx, k ? "," : "",
3068                                   op->args[k]);
3069             }
3070         }
3071 
3072         if (have_prefs || op->life) {
3073             for (; col < 40; ++col) {
3074                 putc(' ', f);
3075             }
3076         }
3077 
3078         if (op->life) {
3079             unsigned life = op->life;
3080 
3081             if (life & (SYNC_ARG * 3)) {
3082                 ne_fprintf(f, "  sync:");
3083                 for (i = 0; i < 2; ++i) {
3084                     if (life & (SYNC_ARG << i)) {
3085                         ne_fprintf(f, " %d", i);
3086                     }
3087                 }
3088             }
3089             life /= DEAD_ARG;
3090             if (life) {
3091                 ne_fprintf(f, "  dead:");
3092                 for (i = 0; life; ++i, life >>= 1) {
3093                     if (life & 1) {
3094                         ne_fprintf(f, " %d", i);
3095                     }
3096                 }
3097             }
3098         }
3099 
3100         if (have_prefs) {
3101             for (i = 0; i < nb_oargs; ++i) {
3102                 TCGRegSet set = output_pref(op, i);
3103 
3104                 if (i == 0) {
3105                     ne_fprintf(f, "  pref=");
3106                 } else {
3107                     ne_fprintf(f, ",");
3108                 }
3109                 if (set == 0) {
3110                     ne_fprintf(f, "none");
3111                 } else if (set == MAKE_64BIT_MASK(0, TCG_TARGET_NB_REGS)) {
3112                     ne_fprintf(f, "all");
3113 #ifdef CONFIG_DEBUG_TCG
3114                 } else if (tcg_regset_single(set)) {
3115                     TCGReg reg = tcg_regset_first(set);
3116                     ne_fprintf(f, "%s", tcg_target_reg_names[reg]);
3117 #endif
3118                 } else if (TCG_TARGET_NB_REGS <= 32) {
3119                     ne_fprintf(f, "0x%x", (uint32_t)set);
3120                 } else {
3121                     ne_fprintf(f, "0x%" PRIx64, (uint64_t)set);
3122                 }
3123             }
3124         }
3125 
3126         putc('\n', f);
3127     }
3128 }
3129 
3130 /* we give more priority to constraints with less registers */
3131 static int get_constraint_priority(const TCGArgConstraint *arg_ct, int k)
3132 {
3133     int n;
3134 
3135     arg_ct += k;
3136     n = ctpop64(arg_ct->regs);
3137 
3138     /*
3139      * Sort constraints of a single register first, which includes output
3140      * aliases (which must exactly match the input already allocated).
3141      */
3142     if (n == 1 || arg_ct->oalias) {
3143         return INT_MAX;
3144     }
3145 
3146     /*
3147      * Sort register pairs next, first then second immediately after.
3148      * Arbitrarily sort multiple pairs by the index of the first reg;
3149      * there shouldn't be many pairs.
3150      */
3151     switch (arg_ct->pair) {
3152     case 1:
3153     case 3:
3154         return (k + 1) * 2;
3155     case 2:
3156         return (arg_ct->pair_index + 1) * 2 - 1;
3157     }
3158 
3159     /* Finally, sort by decreasing register count. */
3160     assert(n > 1);
3161     return -n;
3162 }
3163 
3164 /* sort from highest priority to lowest */
3165 static void sort_constraints(TCGArgConstraint *a, int start, int n)
3166 {
3167     int i, j;
3168 
3169     for (i = 0; i < n; i++) {
3170         a[start + i].sort_index = start + i;
3171     }
3172     if (n <= 1) {
3173         return;
3174     }
3175     for (i = 0; i < n - 1; i++) {
3176         for (j = i + 1; j < n; j++) {
3177             int p1 = get_constraint_priority(a, a[start + i].sort_index);
3178             int p2 = get_constraint_priority(a, a[start + j].sort_index);
3179             if (p1 < p2) {
3180                 int tmp = a[start + i].sort_index;
3181                 a[start + i].sort_index = a[start + j].sort_index;
3182                 a[start + j].sort_index = tmp;
3183             }
3184         }
3185     }
3186 }
3187 
3188 static const TCGArgConstraint empty_cts[TCG_MAX_OP_ARGS];
3189 static TCGArgConstraint all_cts[ARRAY_SIZE(constraint_sets)][TCG_MAX_OP_ARGS];
3190 
3191 static void process_constraint_sets(void)
3192 {
3193     for (size_t c = 0; c < ARRAY_SIZE(constraint_sets); ++c) {
3194         const TCGConstraintSet *tdefs = &constraint_sets[c];
3195         TCGArgConstraint *args_ct = all_cts[c];
3196         int nb_oargs = tdefs->nb_oargs;
3197         int nb_iargs = tdefs->nb_iargs;
3198         int nb_args = nb_oargs + nb_iargs;
3199         bool saw_alias_pair = false;
3200 
3201         for (int i = 0; i < nb_args; i++) {
3202             const char *ct_str = tdefs->args_ct_str[i];
3203             bool input_p = i >= nb_oargs;
3204             int o;
3205 
3206             switch (*ct_str) {
3207             case '0' ... '9':
3208                 o = *ct_str - '0';
3209                 tcg_debug_assert(input_p);
3210                 tcg_debug_assert(o < nb_oargs);
3211                 tcg_debug_assert(args_ct[o].regs != 0);
3212                 tcg_debug_assert(!args_ct[o].oalias);
3213                 args_ct[i] = args_ct[o];
3214                 /* The output sets oalias.  */
3215                 args_ct[o].oalias = 1;
3216                 args_ct[o].alias_index = i;
3217                 /* The input sets ialias. */
3218                 args_ct[i].ialias = 1;
3219                 args_ct[i].alias_index = o;
3220                 if (args_ct[i].pair) {
3221                     saw_alias_pair = true;
3222                 }
3223                 tcg_debug_assert(ct_str[1] == '\0');
3224                 continue;
3225 
3226             case '&':
3227                 tcg_debug_assert(!input_p);
3228                 args_ct[i].newreg = true;
3229                 ct_str++;
3230                 break;
3231 
3232             case 'p': /* plus */
3233                 /* Allocate to the register after the previous. */
3234                 tcg_debug_assert(i > (input_p ? nb_oargs : 0));
3235                 o = i - 1;
3236                 tcg_debug_assert(!args_ct[o].pair);
3237                 tcg_debug_assert(!args_ct[o].ct);
3238                 args_ct[i] = (TCGArgConstraint){
3239                     .pair = 2,
3240                     .pair_index = o,
3241                     .regs = args_ct[o].regs << 1,
3242                     .newreg = args_ct[o].newreg,
3243                 };
3244                 args_ct[o].pair = 1;
3245                 args_ct[o].pair_index = i;
3246                 tcg_debug_assert(ct_str[1] == '\0');
3247                 continue;
3248 
3249             case 'm': /* minus */
3250                 /* Allocate to the register before the previous. */
3251                 tcg_debug_assert(i > (input_p ? nb_oargs : 0));
3252                 o = i - 1;
3253                 tcg_debug_assert(!args_ct[o].pair);
3254                 tcg_debug_assert(!args_ct[o].ct);
3255                 args_ct[i] = (TCGArgConstraint){
3256                     .pair = 1,
3257                     .pair_index = o,
3258                     .regs = args_ct[o].regs >> 1,
3259                     .newreg = args_ct[o].newreg,
3260                 };
3261                 args_ct[o].pair = 2;
3262                 args_ct[o].pair_index = i;
3263                 tcg_debug_assert(ct_str[1] == '\0');
3264                 continue;
3265             }
3266 
3267             do {
3268                 switch (*ct_str) {
3269                 case 'i':
3270                     args_ct[i].ct |= TCG_CT_CONST;
3271                     break;
3272 #ifdef TCG_REG_ZERO
3273                 case 'z':
3274                     args_ct[i].ct |= TCG_CT_REG_ZERO;
3275                     break;
3276 #endif
3277 
3278                 /* Include all of the target-specific constraints. */
3279 
3280 #undef CONST
3281 #define CONST(CASE, MASK) \
3282     case CASE: args_ct[i].ct |= MASK; break;
3283 #define REGS(CASE, MASK) \
3284     case CASE: args_ct[i].regs |= MASK; break;
3285 
3286 #include "tcg-target-con-str.h"
3287 
3288 #undef REGS
3289 #undef CONST
3290                 default:
3291                 case '0' ... '9':
3292                 case '&':
3293                 case 'p':
3294                 case 'm':
3295                     /* Typo in TCGConstraintSet constraint. */
3296                     g_assert_not_reached();
3297                 }
3298             } while (*++ct_str != '\0');
3299         }
3300 
3301         /*
3302          * Fix up output pairs that are aliased with inputs.
3303          * When we created the alias, we copied pair from the output.
3304          * There are three cases:
3305          *    (1a) Pairs of inputs alias pairs of outputs.
3306          *    (1b) One input aliases the first of a pair of outputs.
3307          *    (2)  One input aliases the second of a pair of outputs.
3308          *
3309          * Case 1a is handled by making sure that the pair_index'es are
3310          * properly updated so that they appear the same as a pair of inputs.
3311          *
3312          * Case 1b is handled by setting the pair_index of the input to
3313          * itself, simply so it doesn't point to an unrelated argument.
3314          * Since we don't encounter the "second" during the input allocation
3315          * phase, nothing happens with the second half of the input pair.
3316          *
3317          * Case 2 is handled by setting the second input to pair=3, the
3318          * first output to pair=3, and the pair_index'es to match.
3319          */
3320         if (saw_alias_pair) {
3321             for (int i = nb_oargs; i < nb_args; i++) {
3322                 int o, o2, i2;
3323 
3324                 /*
3325                  * Since [0-9pm] must be alone in the constraint string,
3326                  * the only way they can both be set is if the pair comes
3327                  * from the output alias.
3328                  */
3329                 if (!args_ct[i].ialias) {
3330                     continue;
3331                 }
3332                 switch (args_ct[i].pair) {
3333                 case 0:
3334                     break;
3335                 case 1:
3336                     o = args_ct[i].alias_index;
3337                     o2 = args_ct[o].pair_index;
3338                     tcg_debug_assert(args_ct[o].pair == 1);
3339                     tcg_debug_assert(args_ct[o2].pair == 2);
3340                     if (args_ct[o2].oalias) {
3341                         /* Case 1a */
3342                         i2 = args_ct[o2].alias_index;
3343                         tcg_debug_assert(args_ct[i2].pair == 2);
3344                         args_ct[i2].pair_index = i;
3345                         args_ct[i].pair_index = i2;
3346                     } else {
3347                         /* Case 1b */
3348                         args_ct[i].pair_index = i;
3349                     }
3350                     break;
3351                 case 2:
3352                     o = args_ct[i].alias_index;
3353                     o2 = args_ct[o].pair_index;
3354                     tcg_debug_assert(args_ct[o].pair == 2);
3355                     tcg_debug_assert(args_ct[o2].pair == 1);
3356                     if (args_ct[o2].oalias) {
3357                         /* Case 1a */
3358                         i2 = args_ct[o2].alias_index;
3359                         tcg_debug_assert(args_ct[i2].pair == 1);
3360                         args_ct[i2].pair_index = i;
3361                         args_ct[i].pair_index = i2;
3362                     } else {
3363                         /* Case 2 */
3364                         args_ct[i].pair = 3;
3365                         args_ct[o2].pair = 3;
3366                         args_ct[i].pair_index = o2;
3367                         args_ct[o2].pair_index = i;
3368                     }
3369                     break;
3370                 default:
3371                     g_assert_not_reached();
3372                 }
3373             }
3374         }
3375 
3376         /* sort the constraints (XXX: this is just an heuristic) */
3377         sort_constraints(args_ct, 0, nb_oargs);
3378         sort_constraints(args_ct, nb_oargs, nb_iargs);
3379     }
3380 }
3381 
3382 static const TCGArgConstraint *opcode_args_ct(const TCGOp *op)
3383 {
3384     TCGOpcode opc = op->opc;
3385     TCGType type = TCGOP_TYPE(op);
3386     unsigned flags = TCGOP_FLAGS(op);
3387     const TCGOpDef *def = &tcg_op_defs[opc];
3388     const TCGOutOp *outop = all_outop[opc];
3389     TCGConstraintSetIndex con_set;
3390 
3391     if (def->flags & TCG_OPF_NOT_PRESENT) {
3392         return empty_cts;
3393     }
3394 
3395     if (outop) {
3396         con_set = outop->static_constraint;
3397         if (con_set == C_Dynamic) {
3398             con_set = outop->dynamic_constraint(type, flags);
3399         }
3400     } else {
3401         con_set = tcg_target_op_def(opc, type, flags);
3402     }
3403     tcg_debug_assert(con_set >= 0);
3404     tcg_debug_assert(con_set < ARRAY_SIZE(constraint_sets));
3405 
3406     /* The constraint arguments must match TCGOpcode arguments. */
3407     tcg_debug_assert(constraint_sets[con_set].nb_oargs == def->nb_oargs);
3408     tcg_debug_assert(constraint_sets[con_set].nb_iargs == def->nb_iargs);
3409 
3410     return all_cts[con_set];
3411 }
3412 
3413 static void remove_label_use(TCGOp *op, int idx)
3414 {
3415     TCGLabel *label = arg_label(op->args[idx]);
3416     TCGLabelUse *use;
3417 
3418     QSIMPLEQ_FOREACH(use, &label->branches, next) {
3419         if (use->op == op) {
3420             QSIMPLEQ_REMOVE(&label->branches, use, TCGLabelUse, next);
3421             return;
3422         }
3423     }
3424     g_assert_not_reached();
3425 }
3426 
3427 void tcg_op_remove(TCGContext *s, TCGOp *op)
3428 {
3429     switch (op->opc) {
3430     case INDEX_op_br:
3431         remove_label_use(op, 0);
3432         break;
3433     case INDEX_op_brcond_i32:
3434     case INDEX_op_brcond_i64:
3435         remove_label_use(op, 3);
3436         break;
3437     case INDEX_op_brcond2_i32:
3438         remove_label_use(op, 5);
3439         break;
3440     default:
3441         break;
3442     }
3443 
3444     QTAILQ_REMOVE(&s->ops, op, link);
3445     QTAILQ_INSERT_TAIL(&s->free_ops, op, link);
3446     s->nb_ops--;
3447 }
3448 
3449 void tcg_remove_ops_after(TCGOp *op)
3450 {
3451     TCGContext *s = tcg_ctx;
3452 
3453     while (true) {
3454         TCGOp *last = tcg_last_op();
3455         if (last == op) {
3456             return;
3457         }
3458         tcg_op_remove(s, last);
3459     }
3460 }
3461 
3462 static TCGOp *tcg_op_alloc(TCGOpcode opc, unsigned nargs)
3463 {
3464     TCGContext *s = tcg_ctx;
3465     TCGOp *op = NULL;
3466 
3467     if (unlikely(!QTAILQ_EMPTY(&s->free_ops))) {
3468         QTAILQ_FOREACH(op, &s->free_ops, link) {
3469             if (nargs <= op->nargs) {
3470                 QTAILQ_REMOVE(&s->free_ops, op, link);
3471                 nargs = op->nargs;
3472                 goto found;
3473             }
3474         }
3475     }
3476 
3477     /* Most opcodes have 3 or 4 operands: reduce fragmentation. */
3478     nargs = MAX(4, nargs);
3479     op = tcg_malloc(sizeof(TCGOp) + sizeof(TCGArg) * nargs);
3480 
3481  found:
3482     memset(op, 0, offsetof(TCGOp, link));
3483     op->opc = opc;
3484     op->nargs = nargs;
3485 
3486     /* Check for bitfield overflow. */
3487     tcg_debug_assert(op->nargs == nargs);
3488 
3489     s->nb_ops++;
3490     return op;
3491 }
3492 
3493 TCGOp *tcg_emit_op(TCGOpcode opc, unsigned nargs)
3494 {
3495     TCGOp *op = tcg_op_alloc(opc, nargs);
3496 
3497     if (tcg_ctx->emit_before_op) {
3498         QTAILQ_INSERT_BEFORE(tcg_ctx->emit_before_op, op, link);
3499     } else {
3500         QTAILQ_INSERT_TAIL(&tcg_ctx->ops, op, link);
3501     }
3502     return op;
3503 }
3504 
3505 TCGOp *tcg_op_insert_before(TCGContext *s, TCGOp *old_op,
3506                             TCGOpcode opc, TCGType type, unsigned nargs)
3507 {
3508     TCGOp *new_op = tcg_op_alloc(opc, nargs);
3509 
3510     TCGOP_TYPE(new_op) = type;
3511     QTAILQ_INSERT_BEFORE(old_op, new_op, link);
3512     return new_op;
3513 }
3514 
3515 TCGOp *tcg_op_insert_after(TCGContext *s, TCGOp *old_op,
3516                            TCGOpcode opc, TCGType type, unsigned nargs)
3517 {
3518     TCGOp *new_op = tcg_op_alloc(opc, nargs);
3519 
3520     TCGOP_TYPE(new_op) = type;
3521     QTAILQ_INSERT_AFTER(&s->ops, old_op, new_op, link);
3522     return new_op;
3523 }
3524 
3525 static void move_label_uses(TCGLabel *to, TCGLabel *from)
3526 {
3527     TCGLabelUse *u;
3528 
3529     QSIMPLEQ_FOREACH(u, &from->branches, next) {
3530         TCGOp *op = u->op;
3531         switch (op->opc) {
3532         case INDEX_op_br:
3533             op->args[0] = label_arg(to);
3534             break;
3535         case INDEX_op_brcond_i32:
3536         case INDEX_op_brcond_i64:
3537             op->args[3] = label_arg(to);
3538             break;
3539         case INDEX_op_brcond2_i32:
3540             op->args[5] = label_arg(to);
3541             break;
3542         default:
3543             g_assert_not_reached();
3544         }
3545     }
3546 
3547     QSIMPLEQ_CONCAT(&to->branches, &from->branches);
3548 }
3549 
3550 /* Reachable analysis : remove unreachable code.  */
3551 static void __attribute__((noinline))
3552 reachable_code_pass(TCGContext *s)
3553 {
3554     TCGOp *op, *op_next, *op_prev;
3555     bool dead = false;
3556 
3557     QTAILQ_FOREACH_SAFE(op, &s->ops, link, op_next) {
3558         bool remove = dead;
3559         TCGLabel *label;
3560 
3561         switch (op->opc) {
3562         case INDEX_op_set_label:
3563             label = arg_label(op->args[0]);
3564 
3565             /*
3566              * Note that the first op in the TB is always a load,
3567              * so there is always something before a label.
3568              */
3569             op_prev = QTAILQ_PREV(op, link);
3570 
3571             /*
3572              * If we find two sequential labels, move all branches to
3573              * reference the second label and remove the first label.
3574              * Do this before branch to next optimization, so that the
3575              * middle label is out of the way.
3576              */
3577             if (op_prev->opc == INDEX_op_set_label) {
3578                 move_label_uses(label, arg_label(op_prev->args[0]));
3579                 tcg_op_remove(s, op_prev);
3580                 op_prev = QTAILQ_PREV(op, link);
3581             }
3582 
3583             /*
3584              * Optimization can fold conditional branches to unconditional.
3585              * If we find a label which is preceded by an unconditional
3586              * branch to next, remove the branch.  We couldn't do this when
3587              * processing the branch because any dead code between the branch
3588              * and label had not yet been removed.
3589              */
3590             if (op_prev->opc == INDEX_op_br &&
3591                 label == arg_label(op_prev->args[0])) {
3592                 tcg_op_remove(s, op_prev);
3593                 /* Fall through means insns become live again.  */
3594                 dead = false;
3595             }
3596 
3597             if (QSIMPLEQ_EMPTY(&label->branches)) {
3598                 /*
3599                  * While there is an occasional backward branch, virtually
3600                  * all branches generated by the translators are forward.
3601                  * Which means that generally we will have already removed
3602                  * all references to the label that will be, and there is
3603                  * little to be gained by iterating.
3604                  */
3605                 remove = true;
3606             } else {
3607                 /* Once we see a label, insns become live again.  */
3608                 dead = false;
3609                 remove = false;
3610             }
3611             break;
3612 
3613         case INDEX_op_br:
3614         case INDEX_op_exit_tb:
3615         case INDEX_op_goto_ptr:
3616             /* Unconditional branches; everything following is dead.  */
3617             dead = true;
3618             break;
3619 
3620         case INDEX_op_call:
3621             /* Notice noreturn helper calls, raising exceptions.  */
3622             if (tcg_call_flags(op) & TCG_CALL_NO_RETURN) {
3623                 dead = true;
3624             }
3625             break;
3626 
3627         case INDEX_op_insn_start:
3628             /* Never remove -- we need to keep these for unwind.  */
3629             remove = false;
3630             break;
3631 
3632         default:
3633             break;
3634         }
3635 
3636         if (remove) {
3637             tcg_op_remove(s, op);
3638         }
3639     }
3640 }
3641 
3642 #define TS_DEAD  1
3643 #define TS_MEM   2
3644 
3645 #define IS_DEAD_ARG(n)   (arg_life & (DEAD_ARG << (n)))
3646 #define NEED_SYNC_ARG(n) (arg_life & (SYNC_ARG << (n)))
3647 
3648 /* For liveness_pass_1, the register preferences for a given temp.  */
3649 static inline TCGRegSet *la_temp_pref(TCGTemp *ts)
3650 {
3651     return ts->state_ptr;
3652 }
3653 
3654 /* For liveness_pass_1, reset the preferences for a given temp to the
3655  * maximal regset for its type.
3656  */
3657 static inline void la_reset_pref(TCGTemp *ts)
3658 {
3659     *la_temp_pref(ts)
3660         = (ts->state == TS_DEAD ? 0 : tcg_target_available_regs[ts->type]);
3661 }
3662 
3663 /* liveness analysis: end of function: all temps are dead, and globals
3664    should be in memory. */
3665 static void la_func_end(TCGContext *s, int ng, int nt)
3666 {
3667     int i;
3668 
3669     for (i = 0; i < ng; ++i) {
3670         s->temps[i].state = TS_DEAD | TS_MEM;
3671         la_reset_pref(&s->temps[i]);
3672     }
3673     for (i = ng; i < nt; ++i) {
3674         s->temps[i].state = TS_DEAD;
3675         la_reset_pref(&s->temps[i]);
3676     }
3677 }
3678 
3679 /* liveness analysis: end of basic block: all temps are dead, globals
3680    and local temps should be in memory. */
3681 static void la_bb_end(TCGContext *s, int ng, int nt)
3682 {
3683     int i;
3684 
3685     for (i = 0; i < nt; ++i) {
3686         TCGTemp *ts = &s->temps[i];
3687         int state;
3688 
3689         switch (ts->kind) {
3690         case TEMP_FIXED:
3691         case TEMP_GLOBAL:
3692         case TEMP_TB:
3693             state = TS_DEAD | TS_MEM;
3694             break;
3695         case TEMP_EBB:
3696         case TEMP_CONST:
3697             state = TS_DEAD;
3698             break;
3699         default:
3700             g_assert_not_reached();
3701         }
3702         ts->state = state;
3703         la_reset_pref(ts);
3704     }
3705 }
3706 
3707 /* liveness analysis: sync globals back to memory.  */
3708 static void la_global_sync(TCGContext *s, int ng)
3709 {
3710     int i;
3711 
3712     for (i = 0; i < ng; ++i) {
3713         int state = s->temps[i].state;
3714         s->temps[i].state = state | TS_MEM;
3715         if (state == TS_DEAD) {
3716             /* If the global was previously dead, reset prefs.  */
3717             la_reset_pref(&s->temps[i]);
3718         }
3719     }
3720 }
3721 
3722 /*
3723  * liveness analysis: conditional branch: all temps are dead unless
3724  * explicitly live-across-conditional-branch, globals and local temps
3725  * should be synced.
3726  */
3727 static void la_bb_sync(TCGContext *s, int ng, int nt)
3728 {
3729     la_global_sync(s, ng);
3730 
3731     for (int i = ng; i < nt; ++i) {
3732         TCGTemp *ts = &s->temps[i];
3733         int state;
3734 
3735         switch (ts->kind) {
3736         case TEMP_TB:
3737             state = ts->state;
3738             ts->state = state | TS_MEM;
3739             if (state != TS_DEAD) {
3740                 continue;
3741             }
3742             break;
3743         case TEMP_EBB:
3744         case TEMP_CONST:
3745             continue;
3746         default:
3747             g_assert_not_reached();
3748         }
3749         la_reset_pref(&s->temps[i]);
3750     }
3751 }
3752 
3753 /* liveness analysis: sync globals back to memory and kill.  */
3754 static void la_global_kill(TCGContext *s, int ng)
3755 {
3756     int i;
3757 
3758     for (i = 0; i < ng; i++) {
3759         s->temps[i].state = TS_DEAD | TS_MEM;
3760         la_reset_pref(&s->temps[i]);
3761     }
3762 }
3763 
3764 /* liveness analysis: note live globals crossing calls.  */
3765 static void la_cross_call(TCGContext *s, int nt)
3766 {
3767     TCGRegSet mask = ~tcg_target_call_clobber_regs;
3768     int i;
3769 
3770     for (i = 0; i < nt; i++) {
3771         TCGTemp *ts = &s->temps[i];
3772         if (!(ts->state & TS_DEAD)) {
3773             TCGRegSet *pset = la_temp_pref(ts);
3774             TCGRegSet set = *pset;
3775 
3776             set &= mask;
3777             /* If the combination is not possible, restart.  */
3778             if (set == 0) {
3779                 set = tcg_target_available_regs[ts->type] & mask;
3780             }
3781             *pset = set;
3782         }
3783     }
3784 }
3785 
3786 /*
3787  * Liveness analysis: Verify the lifetime of TEMP_TB, and reduce
3788  * to TEMP_EBB, if possible.
3789  */
3790 static void __attribute__((noinline))
3791 liveness_pass_0(TCGContext *s)
3792 {
3793     void * const multiple_ebb = (void *)(uintptr_t)-1;
3794     int nb_temps = s->nb_temps;
3795     TCGOp *op, *ebb;
3796 
3797     for (int i = s->nb_globals; i < nb_temps; ++i) {
3798         s->temps[i].state_ptr = NULL;
3799     }
3800 
3801     /*
3802      * Represent each EBB by the op at which it begins.  In the case of
3803      * the first EBB, this is the first op, otherwise it is a label.
3804      * Collect the uses of each TEMP_TB: NULL for unused, EBB for use
3805      * within a single EBB, else MULTIPLE_EBB.
3806      */
3807     ebb = QTAILQ_FIRST(&s->ops);
3808     QTAILQ_FOREACH(op, &s->ops, link) {
3809         const TCGOpDef *def;
3810         int nb_oargs, nb_iargs;
3811 
3812         switch (op->opc) {
3813         case INDEX_op_set_label:
3814             ebb = op;
3815             continue;
3816         case INDEX_op_discard:
3817             continue;
3818         case INDEX_op_call:
3819             nb_oargs = TCGOP_CALLO(op);
3820             nb_iargs = TCGOP_CALLI(op);
3821             break;
3822         default:
3823             def = &tcg_op_defs[op->opc];
3824             nb_oargs = def->nb_oargs;
3825             nb_iargs = def->nb_iargs;
3826             break;
3827         }
3828 
3829         for (int i = 0; i < nb_oargs + nb_iargs; ++i) {
3830             TCGTemp *ts = arg_temp(op->args[i]);
3831 
3832             if (ts->kind != TEMP_TB) {
3833                 continue;
3834             }
3835             if (ts->state_ptr == NULL) {
3836                 ts->state_ptr = ebb;
3837             } else if (ts->state_ptr != ebb) {
3838                 ts->state_ptr = multiple_ebb;
3839             }
3840         }
3841     }
3842 
3843     /*
3844      * For TEMP_TB that turned out not to be used beyond one EBB,
3845      * reduce the liveness to TEMP_EBB.
3846      */
3847     for (int i = s->nb_globals; i < nb_temps; ++i) {
3848         TCGTemp *ts = &s->temps[i];
3849         if (ts->kind == TEMP_TB && ts->state_ptr != multiple_ebb) {
3850             ts->kind = TEMP_EBB;
3851         }
3852     }
3853 }
3854 
3855 /* Liveness analysis : update the opc_arg_life array to tell if a
3856    given input arguments is dead. Instructions updating dead
3857    temporaries are removed. */
3858 static void __attribute__((noinline))
3859 liveness_pass_1(TCGContext *s)
3860 {
3861     int nb_globals = s->nb_globals;
3862     int nb_temps = s->nb_temps;
3863     TCGOp *op, *op_prev;
3864     TCGRegSet *prefs;
3865     int i;
3866 
3867     prefs = tcg_malloc(sizeof(TCGRegSet) * nb_temps);
3868     for (i = 0; i < nb_temps; ++i) {
3869         s->temps[i].state_ptr = prefs + i;
3870     }
3871 
3872     /* ??? Should be redundant with the exit_tb that ends the TB.  */
3873     la_func_end(s, nb_globals, nb_temps);
3874 
3875     QTAILQ_FOREACH_REVERSE_SAFE(op, &s->ops, link, op_prev) {
3876         int nb_iargs, nb_oargs;
3877         TCGOpcode opc_new, opc_new2;
3878         bool have_opc_new2;
3879         TCGLifeData arg_life = 0;
3880         TCGTemp *ts;
3881         TCGOpcode opc = op->opc;
3882         const TCGOpDef *def = &tcg_op_defs[opc];
3883         const TCGArgConstraint *args_ct;
3884 
3885         switch (opc) {
3886         case INDEX_op_call:
3887             {
3888                 const TCGHelperInfo *info = tcg_call_info(op);
3889                 int call_flags = tcg_call_flags(op);
3890 
3891                 nb_oargs = TCGOP_CALLO(op);
3892                 nb_iargs = TCGOP_CALLI(op);
3893 
3894                 /* pure functions can be removed if their result is unused */
3895                 if (call_flags & TCG_CALL_NO_SIDE_EFFECTS) {
3896                     for (i = 0; i < nb_oargs; i++) {
3897                         ts = arg_temp(op->args[i]);
3898                         if (ts->state != TS_DEAD) {
3899                             goto do_not_remove_call;
3900                         }
3901                     }
3902                     goto do_remove;
3903                 }
3904             do_not_remove_call:
3905 
3906                 /* Output args are dead.  */
3907                 for (i = 0; i < nb_oargs; i++) {
3908                     ts = arg_temp(op->args[i]);
3909                     if (ts->state & TS_DEAD) {
3910                         arg_life |= DEAD_ARG << i;
3911                     }
3912                     if (ts->state & TS_MEM) {
3913                         arg_life |= SYNC_ARG << i;
3914                     }
3915                     ts->state = TS_DEAD;
3916                     la_reset_pref(ts);
3917                 }
3918 
3919                 /* Not used -- it will be tcg_target_call_oarg_reg().  */
3920                 memset(op->output_pref, 0, sizeof(op->output_pref));
3921 
3922                 if (!(call_flags & (TCG_CALL_NO_WRITE_GLOBALS |
3923                                     TCG_CALL_NO_READ_GLOBALS))) {
3924                     la_global_kill(s, nb_globals);
3925                 } else if (!(call_flags & TCG_CALL_NO_READ_GLOBALS)) {
3926                     la_global_sync(s, nb_globals);
3927                 }
3928 
3929                 /* Record arguments that die in this helper.  */
3930                 for (i = nb_oargs; i < nb_iargs + nb_oargs; i++) {
3931                     ts = arg_temp(op->args[i]);
3932                     if (ts->state & TS_DEAD) {
3933                         arg_life |= DEAD_ARG << i;
3934                     }
3935                 }
3936 
3937                 /* For all live registers, remove call-clobbered prefs.  */
3938                 la_cross_call(s, nb_temps);
3939 
3940                 /*
3941                  * Input arguments are live for preceding opcodes.
3942                  *
3943                  * For those arguments that die, and will be allocated in
3944                  * registers, clear the register set for that arg, to be
3945                  * filled in below.  For args that will be on the stack,
3946                  * reset to any available reg.  Process arguments in reverse
3947                  * order so that if a temp is used more than once, the stack
3948                  * reset to max happens before the register reset to 0.
3949                  */
3950                 for (i = nb_iargs - 1; i >= 0; i--) {
3951                     const TCGCallArgumentLoc *loc = &info->in[i];
3952                     ts = arg_temp(op->args[nb_oargs + i]);
3953 
3954                     if (ts->state & TS_DEAD) {
3955                         switch (loc->kind) {
3956                         case TCG_CALL_ARG_NORMAL:
3957                         case TCG_CALL_ARG_EXTEND_U:
3958                         case TCG_CALL_ARG_EXTEND_S:
3959                             if (arg_slot_reg_p(loc->arg_slot)) {
3960                                 *la_temp_pref(ts) = 0;
3961                                 break;
3962                             }
3963                             /* fall through */
3964                         default:
3965                             *la_temp_pref(ts) =
3966                                 tcg_target_available_regs[ts->type];
3967                             break;
3968                         }
3969                         ts->state &= ~TS_DEAD;
3970                     }
3971                 }
3972 
3973                 /*
3974                  * For each input argument, add its input register to prefs.
3975                  * If a temp is used once, this produces a single set bit;
3976                  * if a temp is used multiple times, this produces a set.
3977                  */
3978                 for (i = 0; i < nb_iargs; i++) {
3979                     const TCGCallArgumentLoc *loc = &info->in[i];
3980                     ts = arg_temp(op->args[nb_oargs + i]);
3981 
3982                     switch (loc->kind) {
3983                     case TCG_CALL_ARG_NORMAL:
3984                     case TCG_CALL_ARG_EXTEND_U:
3985                     case TCG_CALL_ARG_EXTEND_S:
3986                         if (arg_slot_reg_p(loc->arg_slot)) {
3987                             tcg_regset_set_reg(*la_temp_pref(ts),
3988                                 tcg_target_call_iarg_regs[loc->arg_slot]);
3989                         }
3990                         break;
3991                     default:
3992                         break;
3993                     }
3994                 }
3995             }
3996             break;
3997         case INDEX_op_insn_start:
3998             break;
3999         case INDEX_op_discard:
4000             /* mark the temporary as dead */
4001             ts = arg_temp(op->args[0]);
4002             ts->state = TS_DEAD;
4003             la_reset_pref(ts);
4004             break;
4005 
4006         case INDEX_op_add2_i32:
4007         case INDEX_op_add2_i64:
4008             opc_new = INDEX_op_add;
4009             goto do_addsub2;
4010         case INDEX_op_sub2_i32:
4011             opc_new = INDEX_op_sub_i32;
4012             goto do_addsub2;
4013         case INDEX_op_sub2_i64:
4014             opc_new = INDEX_op_sub_i64;
4015         do_addsub2:
4016             nb_iargs = 4;
4017             nb_oargs = 2;
4018             /* Test if the high part of the operation is dead, but not
4019                the low part.  The result can be optimized to a simple
4020                add or sub.  This happens often for x86_64 guest when the
4021                cpu mode is set to 32 bit.  */
4022             if (arg_temp(op->args[1])->state == TS_DEAD) {
4023                 if (arg_temp(op->args[0])->state == TS_DEAD) {
4024                     goto do_remove;
4025                 }
4026                 /* Replace the opcode and adjust the args in place,
4027                    leaving 3 unused args at the end.  */
4028                 op->opc = opc = opc_new;
4029                 op->args[1] = op->args[2];
4030                 op->args[2] = op->args[4];
4031                 /* Fall through and mark the single-word operation live.  */
4032                 nb_iargs = 2;
4033                 nb_oargs = 1;
4034             }
4035             goto do_not_remove;
4036 
4037         case INDEX_op_mulu2_i32:
4038             opc_new = INDEX_op_mul_i32;
4039             opc_new2 = INDEX_op_muluh_i32;
4040             have_opc_new2 = TCG_TARGET_HAS_muluh_i32;
4041             goto do_mul2;
4042         case INDEX_op_muls2_i32:
4043             opc_new = INDEX_op_mul_i32;
4044             opc_new2 = INDEX_op_mulsh_i32;
4045             have_opc_new2 = TCG_TARGET_HAS_mulsh_i32;
4046             goto do_mul2;
4047         case INDEX_op_mulu2_i64:
4048             opc_new = INDEX_op_mul_i64;
4049             opc_new2 = INDEX_op_muluh_i64;
4050             have_opc_new2 = TCG_TARGET_HAS_muluh_i64;
4051             goto do_mul2;
4052         case INDEX_op_muls2_i64:
4053             opc_new = INDEX_op_mul_i64;
4054             opc_new2 = INDEX_op_mulsh_i64;
4055             have_opc_new2 = TCG_TARGET_HAS_mulsh_i64;
4056             goto do_mul2;
4057         do_mul2:
4058             nb_iargs = 2;
4059             nb_oargs = 2;
4060             if (arg_temp(op->args[1])->state == TS_DEAD) {
4061                 if (arg_temp(op->args[0])->state == TS_DEAD) {
4062                     /* Both parts of the operation are dead.  */
4063                     goto do_remove;
4064                 }
4065                 /* The high part of the operation is dead; generate the low. */
4066                 op->opc = opc = opc_new;
4067                 op->args[1] = op->args[2];
4068                 op->args[2] = op->args[3];
4069             } else if (arg_temp(op->args[0])->state == TS_DEAD && have_opc_new2) {
4070                 /* The low part of the operation is dead; generate the high. */
4071                 op->opc = opc = opc_new2;
4072                 op->args[0] = op->args[1];
4073                 op->args[1] = op->args[2];
4074                 op->args[2] = op->args[3];
4075             } else {
4076                 goto do_not_remove;
4077             }
4078             /* Mark the single-word operation live.  */
4079             nb_oargs = 1;
4080             goto do_not_remove;
4081 
4082         default:
4083             /* XXX: optimize by hardcoding common cases (e.g. triadic ops) */
4084             nb_iargs = def->nb_iargs;
4085             nb_oargs = def->nb_oargs;
4086 
4087             /* Test if the operation can be removed because all
4088                its outputs are dead. We assume that nb_oargs == 0
4089                implies side effects */
4090             if (!(def->flags & TCG_OPF_SIDE_EFFECTS) && nb_oargs != 0) {
4091                 for (i = 0; i < nb_oargs; i++) {
4092                     if (arg_temp(op->args[i])->state != TS_DEAD) {
4093                         goto do_not_remove;
4094                     }
4095                 }
4096                 goto do_remove;
4097             }
4098             goto do_not_remove;
4099 
4100         do_remove:
4101             tcg_op_remove(s, op);
4102             break;
4103 
4104         do_not_remove:
4105             for (i = 0; i < nb_oargs; i++) {
4106                 ts = arg_temp(op->args[i]);
4107 
4108                 /* Remember the preference of the uses that followed.  */
4109                 if (i < ARRAY_SIZE(op->output_pref)) {
4110                     op->output_pref[i] = *la_temp_pref(ts);
4111                 }
4112 
4113                 /* Output args are dead.  */
4114                 if (ts->state & TS_DEAD) {
4115                     arg_life |= DEAD_ARG << i;
4116                 }
4117                 if (ts->state & TS_MEM) {
4118                     arg_life |= SYNC_ARG << i;
4119                 }
4120                 ts->state = TS_DEAD;
4121                 la_reset_pref(ts);
4122             }
4123 
4124             /* If end of basic block, update.  */
4125             if (def->flags & TCG_OPF_BB_EXIT) {
4126                 la_func_end(s, nb_globals, nb_temps);
4127             } else if (def->flags & TCG_OPF_COND_BRANCH) {
4128                 la_bb_sync(s, nb_globals, nb_temps);
4129             } else if (def->flags & TCG_OPF_BB_END) {
4130                 la_bb_end(s, nb_globals, nb_temps);
4131             } else if (def->flags & TCG_OPF_SIDE_EFFECTS) {
4132                 la_global_sync(s, nb_globals);
4133                 if (def->flags & TCG_OPF_CALL_CLOBBER) {
4134                     la_cross_call(s, nb_temps);
4135                 }
4136             }
4137 
4138             /* Record arguments that die in this opcode.  */
4139             for (i = nb_oargs; i < nb_oargs + nb_iargs; i++) {
4140                 ts = arg_temp(op->args[i]);
4141                 if (ts->state & TS_DEAD) {
4142                     arg_life |= DEAD_ARG << i;
4143                 }
4144             }
4145 
4146             /* Input arguments are live for preceding opcodes.  */
4147             for (i = nb_oargs; i < nb_oargs + nb_iargs; i++) {
4148                 ts = arg_temp(op->args[i]);
4149                 if (ts->state & TS_DEAD) {
4150                     /* For operands that were dead, initially allow
4151                        all regs for the type.  */
4152                     *la_temp_pref(ts) = tcg_target_available_regs[ts->type];
4153                     ts->state &= ~TS_DEAD;
4154                 }
4155             }
4156 
4157             /* Incorporate constraints for this operand.  */
4158             switch (opc) {
4159             case INDEX_op_mov:
4160                 /* Note that these are TCG_OPF_NOT_PRESENT and do not
4161                    have proper constraints.  That said, special case
4162                    moves to propagate preferences backward.  */
4163                 if (IS_DEAD_ARG(1)) {
4164                     *la_temp_pref(arg_temp(op->args[0]))
4165                         = *la_temp_pref(arg_temp(op->args[1]));
4166                 }
4167                 break;
4168 
4169             default:
4170                 args_ct = opcode_args_ct(op);
4171                 for (i = nb_oargs; i < nb_oargs + nb_iargs; i++) {
4172                     const TCGArgConstraint *ct = &args_ct[i];
4173                     TCGRegSet set, *pset;
4174 
4175                     ts = arg_temp(op->args[i]);
4176                     pset = la_temp_pref(ts);
4177                     set = *pset;
4178 
4179                     set &= ct->regs;
4180                     if (ct->ialias) {
4181                         set &= output_pref(op, ct->alias_index);
4182                     }
4183                     /* If the combination is not possible, restart.  */
4184                     if (set == 0) {
4185                         set = ct->regs;
4186                     }
4187                     *pset = set;
4188                 }
4189                 break;
4190             }
4191             break;
4192         }
4193         op->life = arg_life;
4194     }
4195 }
4196 
4197 /* Liveness analysis: Convert indirect regs to direct temporaries.  */
4198 static bool __attribute__((noinline))
4199 liveness_pass_2(TCGContext *s)
4200 {
4201     int nb_globals = s->nb_globals;
4202     int nb_temps, i;
4203     bool changes = false;
4204     TCGOp *op, *op_next;
4205 
4206     /* Create a temporary for each indirect global.  */
4207     for (i = 0; i < nb_globals; ++i) {
4208         TCGTemp *its = &s->temps[i];
4209         if (its->indirect_reg) {
4210             TCGTemp *dts = tcg_temp_alloc(s);
4211             dts->type = its->type;
4212             dts->base_type = its->base_type;
4213             dts->temp_subindex = its->temp_subindex;
4214             dts->kind = TEMP_EBB;
4215             its->state_ptr = dts;
4216         } else {
4217             its->state_ptr = NULL;
4218         }
4219         /* All globals begin dead.  */
4220         its->state = TS_DEAD;
4221     }
4222     for (nb_temps = s->nb_temps; i < nb_temps; ++i) {
4223         TCGTemp *its = &s->temps[i];
4224         its->state_ptr = NULL;
4225         its->state = TS_DEAD;
4226     }
4227 
4228     QTAILQ_FOREACH_SAFE(op, &s->ops, link, op_next) {
4229         TCGOpcode opc = op->opc;
4230         const TCGOpDef *def = &tcg_op_defs[opc];
4231         TCGLifeData arg_life = op->life;
4232         int nb_iargs, nb_oargs, call_flags;
4233         TCGTemp *arg_ts, *dir_ts;
4234 
4235         if (opc == INDEX_op_call) {
4236             nb_oargs = TCGOP_CALLO(op);
4237             nb_iargs = TCGOP_CALLI(op);
4238             call_flags = tcg_call_flags(op);
4239         } else {
4240             nb_iargs = def->nb_iargs;
4241             nb_oargs = def->nb_oargs;
4242 
4243             /* Set flags similar to how calls require.  */
4244             if (def->flags & TCG_OPF_COND_BRANCH) {
4245                 /* Like reading globals: sync_globals */
4246                 call_flags = TCG_CALL_NO_WRITE_GLOBALS;
4247             } else if (def->flags & TCG_OPF_BB_END) {
4248                 /* Like writing globals: save_globals */
4249                 call_flags = 0;
4250             } else if (def->flags & TCG_OPF_SIDE_EFFECTS) {
4251                 /* Like reading globals: sync_globals */
4252                 call_flags = TCG_CALL_NO_WRITE_GLOBALS;
4253             } else {
4254                 /* No effect on globals.  */
4255                 call_flags = (TCG_CALL_NO_READ_GLOBALS |
4256                               TCG_CALL_NO_WRITE_GLOBALS);
4257             }
4258         }
4259 
4260         /* Make sure that input arguments are available.  */
4261         for (i = nb_oargs; i < nb_iargs + nb_oargs; i++) {
4262             arg_ts = arg_temp(op->args[i]);
4263             dir_ts = arg_ts->state_ptr;
4264             if (dir_ts && arg_ts->state == TS_DEAD) {
4265                 TCGOpcode lopc = (arg_ts->type == TCG_TYPE_I32
4266                                   ? INDEX_op_ld_i32
4267                                   : INDEX_op_ld_i64);
4268                 TCGOp *lop = tcg_op_insert_before(s, op, lopc,
4269                                                   arg_ts->type, 3);
4270 
4271                 lop->args[0] = temp_arg(dir_ts);
4272                 lop->args[1] = temp_arg(arg_ts->mem_base);
4273                 lop->args[2] = arg_ts->mem_offset;
4274 
4275                 /* Loaded, but synced with memory.  */
4276                 arg_ts->state = TS_MEM;
4277             }
4278         }
4279 
4280         /* Perform input replacement, and mark inputs that became dead.
4281            No action is required except keeping temp_state up to date
4282            so that we reload when needed.  */
4283         for (i = nb_oargs; i < nb_iargs + nb_oargs; i++) {
4284             arg_ts = arg_temp(op->args[i]);
4285             dir_ts = arg_ts->state_ptr;
4286             if (dir_ts) {
4287                 op->args[i] = temp_arg(dir_ts);
4288                 changes = true;
4289                 if (IS_DEAD_ARG(i)) {
4290                     arg_ts->state = TS_DEAD;
4291                 }
4292             }
4293         }
4294 
4295         /* Liveness analysis should ensure that the following are
4296            all correct, for call sites and basic block end points.  */
4297         if (call_flags & TCG_CALL_NO_READ_GLOBALS) {
4298             /* Nothing to do */
4299         } else if (call_flags & TCG_CALL_NO_WRITE_GLOBALS) {
4300             for (i = 0; i < nb_globals; ++i) {
4301                 /* Liveness should see that globals are synced back,
4302                    that is, either TS_DEAD or TS_MEM.  */
4303                 arg_ts = &s->temps[i];
4304                 tcg_debug_assert(arg_ts->state_ptr == 0
4305                                  || arg_ts->state != 0);
4306             }
4307         } else {
4308             for (i = 0; i < nb_globals; ++i) {
4309                 /* Liveness should see that globals are saved back,
4310                    that is, TS_DEAD, waiting to be reloaded.  */
4311                 arg_ts = &s->temps[i];
4312                 tcg_debug_assert(arg_ts->state_ptr == 0
4313                                  || arg_ts->state == TS_DEAD);
4314             }
4315         }
4316 
4317         /* Outputs become available.  */
4318         if (opc == INDEX_op_mov) {
4319             arg_ts = arg_temp(op->args[0]);
4320             dir_ts = arg_ts->state_ptr;
4321             if (dir_ts) {
4322                 op->args[0] = temp_arg(dir_ts);
4323                 changes = true;
4324 
4325                 /* The output is now live and modified.  */
4326                 arg_ts->state = 0;
4327 
4328                 if (NEED_SYNC_ARG(0)) {
4329                     TCGOpcode sopc = (arg_ts->type == TCG_TYPE_I32
4330                                       ? INDEX_op_st_i32
4331                                       : INDEX_op_st_i64);
4332                     TCGOp *sop = tcg_op_insert_after(s, op, sopc,
4333                                                      arg_ts->type, 3);
4334                     TCGTemp *out_ts = dir_ts;
4335 
4336                     if (IS_DEAD_ARG(0)) {
4337                         out_ts = arg_temp(op->args[1]);
4338                         arg_ts->state = TS_DEAD;
4339                         tcg_op_remove(s, op);
4340                     } else {
4341                         arg_ts->state = TS_MEM;
4342                     }
4343 
4344                     sop->args[0] = temp_arg(out_ts);
4345                     sop->args[1] = temp_arg(arg_ts->mem_base);
4346                     sop->args[2] = arg_ts->mem_offset;
4347                 } else {
4348                     tcg_debug_assert(!IS_DEAD_ARG(0));
4349                 }
4350             }
4351         } else {
4352             for (i = 0; i < nb_oargs; i++) {
4353                 arg_ts = arg_temp(op->args[i]);
4354                 dir_ts = arg_ts->state_ptr;
4355                 if (!dir_ts) {
4356                     continue;
4357                 }
4358                 op->args[i] = temp_arg(dir_ts);
4359                 changes = true;
4360 
4361                 /* The output is now live and modified.  */
4362                 arg_ts->state = 0;
4363 
4364                 /* Sync outputs upon their last write.  */
4365                 if (NEED_SYNC_ARG(i)) {
4366                     TCGOpcode sopc = (arg_ts->type == TCG_TYPE_I32
4367                                       ? INDEX_op_st_i32
4368                                       : INDEX_op_st_i64);
4369                     TCGOp *sop = tcg_op_insert_after(s, op, sopc,
4370                                                      arg_ts->type, 3);
4371 
4372                     sop->args[0] = temp_arg(dir_ts);
4373                     sop->args[1] = temp_arg(arg_ts->mem_base);
4374                     sop->args[2] = arg_ts->mem_offset;
4375 
4376                     arg_ts->state = TS_MEM;
4377                 }
4378                 /* Drop outputs that are dead.  */
4379                 if (IS_DEAD_ARG(i)) {
4380                     arg_ts->state = TS_DEAD;
4381                 }
4382             }
4383         }
4384     }
4385 
4386     return changes;
4387 }
4388 
4389 static void temp_allocate_frame(TCGContext *s, TCGTemp *ts)
4390 {
4391     intptr_t off;
4392     int size, align;
4393 
4394     /* When allocating an object, look at the full type. */
4395     size = tcg_type_size(ts->base_type);
4396     switch (ts->base_type) {
4397     case TCG_TYPE_I32:
4398         align = 4;
4399         break;
4400     case TCG_TYPE_I64:
4401     case TCG_TYPE_V64:
4402         align = 8;
4403         break;
4404     case TCG_TYPE_I128:
4405     case TCG_TYPE_V128:
4406     case TCG_TYPE_V256:
4407         /*
4408          * Note that we do not require aligned storage for V256,
4409          * and that we provide alignment for I128 to match V128,
4410          * even if that's above what the host ABI requires.
4411          */
4412         align = 16;
4413         break;
4414     default:
4415         g_assert_not_reached();
4416     }
4417 
4418     /*
4419      * Assume the stack is sufficiently aligned.
4420      * This affects e.g. ARM NEON, where we have 8 byte stack alignment
4421      * and do not require 16 byte vector alignment.  This seems slightly
4422      * easier than fully parameterizing the above switch statement.
4423      */
4424     align = MIN(TCG_TARGET_STACK_ALIGN, align);
4425     off = ROUND_UP(s->current_frame_offset, align);
4426 
4427     /* If we've exhausted the stack frame, restart with a smaller TB. */
4428     if (off + size > s->frame_end) {
4429         tcg_raise_tb_overflow(s);
4430     }
4431     s->current_frame_offset = off + size;
4432 #if defined(__sparc__)
4433     off += TCG_TARGET_STACK_BIAS;
4434 #endif
4435 
4436     /* If the object was subdivided, assign memory to all the parts. */
4437     if (ts->base_type != ts->type) {
4438         int part_size = tcg_type_size(ts->type);
4439         int part_count = size / part_size;
4440 
4441         /*
4442          * Each part is allocated sequentially in tcg_temp_new_internal.
4443          * Jump back to the first part by subtracting the current index.
4444          */
4445         ts -= ts->temp_subindex;
4446         for (int i = 0; i < part_count; ++i) {
4447             ts[i].mem_offset = off + i * part_size;
4448             ts[i].mem_base = s->frame_temp;
4449             ts[i].mem_allocated = 1;
4450         }
4451     } else {
4452         ts->mem_offset = off;
4453         ts->mem_base = s->frame_temp;
4454         ts->mem_allocated = 1;
4455     }
4456 }
4457 
4458 /* Assign @reg to @ts, and update reg_to_temp[]. */
4459 static void set_temp_val_reg(TCGContext *s, TCGTemp *ts, TCGReg reg)
4460 {
4461     if (ts->val_type == TEMP_VAL_REG) {
4462         TCGReg old = ts->reg;
4463         tcg_debug_assert(s->reg_to_temp[old] == ts);
4464         if (old == reg) {
4465             return;
4466         }
4467         s->reg_to_temp[old] = NULL;
4468     }
4469     tcg_debug_assert(s->reg_to_temp[reg] == NULL);
4470     s->reg_to_temp[reg] = ts;
4471     ts->val_type = TEMP_VAL_REG;
4472     ts->reg = reg;
4473 }
4474 
4475 /* Assign a non-register value type to @ts, and update reg_to_temp[]. */
4476 static void set_temp_val_nonreg(TCGContext *s, TCGTemp *ts, TCGTempVal type)
4477 {
4478     tcg_debug_assert(type != TEMP_VAL_REG);
4479     if (ts->val_type == TEMP_VAL_REG) {
4480         TCGReg reg = ts->reg;
4481         tcg_debug_assert(s->reg_to_temp[reg] == ts);
4482         s->reg_to_temp[reg] = NULL;
4483     }
4484     ts->val_type = type;
4485 }
4486 
4487 static void temp_load(TCGContext *, TCGTemp *, TCGRegSet, TCGRegSet, TCGRegSet);
4488 
4489 /* Mark a temporary as free or dead.  If 'free_or_dead' is negative,
4490    mark it free; otherwise mark it dead.  */
4491 static void temp_free_or_dead(TCGContext *s, TCGTemp *ts, int free_or_dead)
4492 {
4493     TCGTempVal new_type;
4494 
4495     switch (ts->kind) {
4496     case TEMP_FIXED:
4497         return;
4498     case TEMP_GLOBAL:
4499     case TEMP_TB:
4500         new_type = TEMP_VAL_MEM;
4501         break;
4502     case TEMP_EBB:
4503         new_type = free_or_dead < 0 ? TEMP_VAL_MEM : TEMP_VAL_DEAD;
4504         break;
4505     case TEMP_CONST:
4506         new_type = TEMP_VAL_CONST;
4507         break;
4508     default:
4509         g_assert_not_reached();
4510     }
4511     set_temp_val_nonreg(s, ts, new_type);
4512 }
4513 
4514 /* Mark a temporary as dead.  */
4515 static inline void temp_dead(TCGContext *s, TCGTemp *ts)
4516 {
4517     temp_free_or_dead(s, ts, 1);
4518 }
4519 
4520 /* Sync a temporary to memory. 'allocated_regs' is used in case a temporary
4521    registers needs to be allocated to store a constant.  If 'free_or_dead'
4522    is non-zero, subsequently release the temporary; if it is positive, the
4523    temp is dead; if it is negative, the temp is free.  */
4524 static void temp_sync(TCGContext *s, TCGTemp *ts, TCGRegSet allocated_regs,
4525                       TCGRegSet preferred_regs, int free_or_dead)
4526 {
4527     if (!temp_readonly(ts) && !ts->mem_coherent) {
4528         if (!ts->mem_allocated) {
4529             temp_allocate_frame(s, ts);
4530         }
4531         switch (ts->val_type) {
4532         case TEMP_VAL_CONST:
4533             /* If we're going to free the temp immediately, then we won't
4534                require it later in a register, so attempt to store the
4535                constant to memory directly.  */
4536             if (free_or_dead
4537                 && tcg_out_sti(s, ts->type, ts->val,
4538                                ts->mem_base->reg, ts->mem_offset)) {
4539                 break;
4540             }
4541             temp_load(s, ts, tcg_target_available_regs[ts->type],
4542                       allocated_regs, preferred_regs);
4543             /* fallthrough */
4544 
4545         case TEMP_VAL_REG:
4546             tcg_out_st(s, ts->type, ts->reg,
4547                        ts->mem_base->reg, ts->mem_offset);
4548             break;
4549 
4550         case TEMP_VAL_MEM:
4551             break;
4552 
4553         case TEMP_VAL_DEAD:
4554         default:
4555             g_assert_not_reached();
4556         }
4557         ts->mem_coherent = 1;
4558     }
4559     if (free_or_dead) {
4560         temp_free_or_dead(s, ts, free_or_dead);
4561     }
4562 }
4563 
4564 /* free register 'reg' by spilling the corresponding temporary if necessary */
4565 static void tcg_reg_free(TCGContext *s, TCGReg reg, TCGRegSet allocated_regs)
4566 {
4567     TCGTemp *ts = s->reg_to_temp[reg];
4568     if (ts != NULL) {
4569         temp_sync(s, ts, allocated_regs, 0, -1);
4570     }
4571 }
4572 
4573 /**
4574  * tcg_reg_alloc:
4575  * @required_regs: Set of registers in which we must allocate.
4576  * @allocated_regs: Set of registers which must be avoided.
4577  * @preferred_regs: Set of registers we should prefer.
4578  * @rev: True if we search the registers in "indirect" order.
4579  *
4580  * The allocated register must be in @required_regs & ~@allocated_regs,
4581  * but if we can put it in @preferred_regs we may save a move later.
4582  */
4583 static TCGReg tcg_reg_alloc(TCGContext *s, TCGRegSet required_regs,
4584                             TCGRegSet allocated_regs,
4585                             TCGRegSet preferred_regs, bool rev)
4586 {
4587     int i, j, f, n = ARRAY_SIZE(tcg_target_reg_alloc_order);
4588     TCGRegSet reg_ct[2];
4589     const int *order;
4590 
4591     reg_ct[1] = required_regs & ~allocated_regs;
4592     tcg_debug_assert(reg_ct[1] != 0);
4593     reg_ct[0] = reg_ct[1] & preferred_regs;
4594 
4595     /* Skip the preferred_regs option if it cannot be satisfied,
4596        or if the preference made no difference.  */
4597     f = reg_ct[0] == 0 || reg_ct[0] == reg_ct[1];
4598 
4599     order = rev ? indirect_reg_alloc_order : tcg_target_reg_alloc_order;
4600 
4601     /* Try free registers, preferences first.  */
4602     for (j = f; j < 2; j++) {
4603         TCGRegSet set = reg_ct[j];
4604 
4605         if (tcg_regset_single(set)) {
4606             /* One register in the set.  */
4607             TCGReg reg = tcg_regset_first(set);
4608             if (s->reg_to_temp[reg] == NULL) {
4609                 return reg;
4610             }
4611         } else {
4612             for (i = 0; i < n; i++) {
4613                 TCGReg reg = order[i];
4614                 if (s->reg_to_temp[reg] == NULL &&
4615                     tcg_regset_test_reg(set, reg)) {
4616                     return reg;
4617                 }
4618             }
4619         }
4620     }
4621 
4622     /* We must spill something.  */
4623     for (j = f; j < 2; j++) {
4624         TCGRegSet set = reg_ct[j];
4625 
4626         if (tcg_regset_single(set)) {
4627             /* One register in the set.  */
4628             TCGReg reg = tcg_regset_first(set);
4629             tcg_reg_free(s, reg, allocated_regs);
4630             return reg;
4631         } else {
4632             for (i = 0; i < n; i++) {
4633                 TCGReg reg = order[i];
4634                 if (tcg_regset_test_reg(set, reg)) {
4635                     tcg_reg_free(s, reg, allocated_regs);
4636                     return reg;
4637                 }
4638             }
4639         }
4640     }
4641 
4642     g_assert_not_reached();
4643 }
4644 
4645 static TCGReg tcg_reg_alloc_pair(TCGContext *s, TCGRegSet required_regs,
4646                                  TCGRegSet allocated_regs,
4647                                  TCGRegSet preferred_regs, bool rev)
4648 {
4649     int i, j, k, fmin, n = ARRAY_SIZE(tcg_target_reg_alloc_order);
4650     TCGRegSet reg_ct[2];
4651     const int *order;
4652 
4653     /* Ensure that if I is not in allocated_regs, I+1 is not either. */
4654     reg_ct[1] = required_regs & ~(allocated_regs | (allocated_regs >> 1));
4655     tcg_debug_assert(reg_ct[1] != 0);
4656     reg_ct[0] = reg_ct[1] & preferred_regs;
4657 
4658     order = rev ? indirect_reg_alloc_order : tcg_target_reg_alloc_order;
4659 
4660     /*
4661      * Skip the preferred_regs option if it cannot be satisfied,
4662      * or if the preference made no difference.
4663      */
4664     k = reg_ct[0] == 0 || reg_ct[0] == reg_ct[1];
4665 
4666     /*
4667      * Minimize the number of flushes by looking for 2 free registers first,
4668      * then a single flush, then two flushes.
4669      */
4670     for (fmin = 2; fmin >= 0; fmin--) {
4671         for (j = k; j < 2; j++) {
4672             TCGRegSet set = reg_ct[j];
4673 
4674             for (i = 0; i < n; i++) {
4675                 TCGReg reg = order[i];
4676 
4677                 if (tcg_regset_test_reg(set, reg)) {
4678                     int f = !s->reg_to_temp[reg] + !s->reg_to_temp[reg + 1];
4679                     if (f >= fmin) {
4680                         tcg_reg_free(s, reg, allocated_regs);
4681                         tcg_reg_free(s, reg + 1, allocated_regs);
4682                         return reg;
4683                     }
4684                 }
4685             }
4686         }
4687     }
4688     g_assert_not_reached();
4689 }
4690 
4691 /* Make sure the temporary is in a register.  If needed, allocate the register
4692    from DESIRED while avoiding ALLOCATED.  */
4693 static void temp_load(TCGContext *s, TCGTemp *ts, TCGRegSet desired_regs,
4694                       TCGRegSet allocated_regs, TCGRegSet preferred_regs)
4695 {
4696     TCGReg reg;
4697 
4698     switch (ts->val_type) {
4699     case TEMP_VAL_REG:
4700         return;
4701     case TEMP_VAL_CONST:
4702         reg = tcg_reg_alloc(s, desired_regs, allocated_regs,
4703                             preferred_regs, ts->indirect_base);
4704         if (ts->type <= TCG_TYPE_I64) {
4705             tcg_out_movi(s, ts->type, reg, ts->val);
4706         } else {
4707             uint64_t val = ts->val;
4708             MemOp vece = MO_64;
4709 
4710             /*
4711              * Find the minimal vector element that matches the constant.
4712              * The targets will, in general, have to do this search anyway,
4713              * do this generically.
4714              */
4715             if (val == dup_const(MO_8, val)) {
4716                 vece = MO_8;
4717             } else if (val == dup_const(MO_16, val)) {
4718                 vece = MO_16;
4719             } else if (val == dup_const(MO_32, val)) {
4720                 vece = MO_32;
4721             }
4722 
4723             tcg_out_dupi_vec(s, ts->type, vece, reg, ts->val);
4724         }
4725         ts->mem_coherent = 0;
4726         break;
4727     case TEMP_VAL_MEM:
4728         if (!ts->mem_allocated) {
4729             temp_allocate_frame(s, ts);
4730         }
4731         reg = tcg_reg_alloc(s, desired_regs, allocated_regs,
4732                             preferred_regs, ts->indirect_base);
4733         tcg_out_ld(s, ts->type, reg, ts->mem_base->reg, ts->mem_offset);
4734         ts->mem_coherent = 1;
4735         break;
4736     case TEMP_VAL_DEAD:
4737     default:
4738         g_assert_not_reached();
4739     }
4740     set_temp_val_reg(s, ts, reg);
4741 }
4742 
4743 /* Save a temporary to memory. 'allocated_regs' is used in case a
4744    temporary registers needs to be allocated to store a constant.  */
4745 static void temp_save(TCGContext *s, TCGTemp *ts, TCGRegSet allocated_regs)
4746 {
4747     /* The liveness analysis already ensures that globals are back
4748        in memory. Keep an tcg_debug_assert for safety. */
4749     tcg_debug_assert(ts->val_type == TEMP_VAL_MEM || temp_readonly(ts));
4750 }
4751 
4752 /* save globals to their canonical location and assume they can be
4753    modified be the following code. 'allocated_regs' is used in case a
4754    temporary registers needs to be allocated to store a constant. */
4755 static void save_globals(TCGContext *s, TCGRegSet allocated_regs)
4756 {
4757     int i, n;
4758 
4759     for (i = 0, n = s->nb_globals; i < n; i++) {
4760         temp_save(s, &s->temps[i], allocated_regs);
4761     }
4762 }
4763 
4764 /* sync globals to their canonical location and assume they can be
4765    read by the following code. 'allocated_regs' is used in case a
4766    temporary registers needs to be allocated to store a constant. */
4767 static void sync_globals(TCGContext *s, TCGRegSet allocated_regs)
4768 {
4769     int i, n;
4770 
4771     for (i = 0, n = s->nb_globals; i < n; i++) {
4772         TCGTemp *ts = &s->temps[i];
4773         tcg_debug_assert(ts->val_type != TEMP_VAL_REG
4774                          || ts->kind == TEMP_FIXED
4775                          || ts->mem_coherent);
4776     }
4777 }
4778 
4779 /* at the end of a basic block, we assume all temporaries are dead and
4780    all globals are stored at their canonical location. */
4781 static void tcg_reg_alloc_bb_end(TCGContext *s, TCGRegSet allocated_regs)
4782 {
4783     int i;
4784 
4785     for (i = s->nb_globals; i < s->nb_temps; i++) {
4786         TCGTemp *ts = &s->temps[i];
4787 
4788         switch (ts->kind) {
4789         case TEMP_TB:
4790             temp_save(s, ts, allocated_regs);
4791             break;
4792         case TEMP_EBB:
4793             /* The liveness analysis already ensures that temps are dead.
4794                Keep an tcg_debug_assert for safety. */
4795             tcg_debug_assert(ts->val_type == TEMP_VAL_DEAD);
4796             break;
4797         case TEMP_CONST:
4798             /* Similarly, we should have freed any allocated register. */
4799             tcg_debug_assert(ts->val_type == TEMP_VAL_CONST);
4800             break;
4801         default:
4802             g_assert_not_reached();
4803         }
4804     }
4805 
4806     save_globals(s, allocated_regs);
4807 }
4808 
4809 /*
4810  * At a conditional branch, we assume all temporaries are dead unless
4811  * explicitly live-across-conditional-branch; all globals and local
4812  * temps are synced to their location.
4813  */
4814 static void tcg_reg_alloc_cbranch(TCGContext *s, TCGRegSet allocated_regs)
4815 {
4816     sync_globals(s, allocated_regs);
4817 
4818     for (int i = s->nb_globals; i < s->nb_temps; i++) {
4819         TCGTemp *ts = &s->temps[i];
4820         /*
4821          * The liveness analysis already ensures that temps are dead.
4822          * Keep tcg_debug_asserts for safety.
4823          */
4824         switch (ts->kind) {
4825         case TEMP_TB:
4826             tcg_debug_assert(ts->val_type != TEMP_VAL_REG || ts->mem_coherent);
4827             break;
4828         case TEMP_EBB:
4829         case TEMP_CONST:
4830             break;
4831         default:
4832             g_assert_not_reached();
4833         }
4834     }
4835 }
4836 
4837 /*
4838  * Specialized code generation for INDEX_op_mov_* with a constant.
4839  */
4840 static void tcg_reg_alloc_do_movi(TCGContext *s, TCGTemp *ots,
4841                                   tcg_target_ulong val, TCGLifeData arg_life,
4842                                   TCGRegSet preferred_regs)
4843 {
4844     /* ENV should not be modified.  */
4845     tcg_debug_assert(!temp_readonly(ots));
4846 
4847     /* The movi is not explicitly generated here.  */
4848     set_temp_val_nonreg(s, ots, TEMP_VAL_CONST);
4849     ots->val = val;
4850     ots->mem_coherent = 0;
4851     if (NEED_SYNC_ARG(0)) {
4852         temp_sync(s, ots, s->reserved_regs, preferred_regs, IS_DEAD_ARG(0));
4853     } else if (IS_DEAD_ARG(0)) {
4854         temp_dead(s, ots);
4855     }
4856 }
4857 
4858 /*
4859  * Specialized code generation for INDEX_op_mov_*.
4860  */
4861 static void tcg_reg_alloc_mov(TCGContext *s, const TCGOp *op)
4862 {
4863     const TCGLifeData arg_life = op->life;
4864     TCGRegSet allocated_regs, preferred_regs;
4865     TCGTemp *ts, *ots;
4866     TCGType otype, itype;
4867     TCGReg oreg, ireg;
4868 
4869     allocated_regs = s->reserved_regs;
4870     preferred_regs = output_pref(op, 0);
4871     ots = arg_temp(op->args[0]);
4872     ts = arg_temp(op->args[1]);
4873 
4874     /* ENV should not be modified.  */
4875     tcg_debug_assert(!temp_readonly(ots));
4876 
4877     /* Note that otype != itype for no-op truncation.  */
4878     otype = ots->type;
4879     itype = ts->type;
4880 
4881     if (ts->val_type == TEMP_VAL_CONST) {
4882         /* propagate constant or generate sti */
4883         tcg_target_ulong val = ts->val;
4884         if (IS_DEAD_ARG(1)) {
4885             temp_dead(s, ts);
4886         }
4887         tcg_reg_alloc_do_movi(s, ots, val, arg_life, preferred_regs);
4888         return;
4889     }
4890 
4891     /* If the source value is in memory we're going to be forced
4892        to have it in a register in order to perform the copy.  Copy
4893        the SOURCE value into its own register first, that way we
4894        don't have to reload SOURCE the next time it is used. */
4895     if (ts->val_type == TEMP_VAL_MEM) {
4896         temp_load(s, ts, tcg_target_available_regs[itype],
4897                   allocated_regs, preferred_regs);
4898     }
4899     tcg_debug_assert(ts->val_type == TEMP_VAL_REG);
4900     ireg = ts->reg;
4901 
4902     if (IS_DEAD_ARG(0)) {
4903         /* mov to a non-saved dead register makes no sense (even with
4904            liveness analysis disabled). */
4905         tcg_debug_assert(NEED_SYNC_ARG(0));
4906         if (!ots->mem_allocated) {
4907             temp_allocate_frame(s, ots);
4908         }
4909         tcg_out_st(s, otype, ireg, ots->mem_base->reg, ots->mem_offset);
4910         if (IS_DEAD_ARG(1)) {
4911             temp_dead(s, ts);
4912         }
4913         temp_dead(s, ots);
4914         return;
4915     }
4916 
4917     if (IS_DEAD_ARG(1) && ts->kind != TEMP_FIXED) {
4918         /*
4919          * The mov can be suppressed.  Kill input first, so that it
4920          * is unlinked from reg_to_temp, then set the output to the
4921          * reg that we saved from the input.
4922          */
4923         temp_dead(s, ts);
4924         oreg = ireg;
4925     } else {
4926         if (ots->val_type == TEMP_VAL_REG) {
4927             oreg = ots->reg;
4928         } else {
4929             /* Make sure to not spill the input register during allocation. */
4930             oreg = tcg_reg_alloc(s, tcg_target_available_regs[otype],
4931                                  allocated_regs | ((TCGRegSet)1 << ireg),
4932                                  preferred_regs, ots->indirect_base);
4933         }
4934         if (!tcg_out_mov(s, otype, oreg, ireg)) {
4935             /*
4936              * Cross register class move not supported.
4937              * Store the source register into the destination slot
4938              * and leave the destination temp as TEMP_VAL_MEM.
4939              */
4940             assert(!temp_readonly(ots));
4941             if (!ts->mem_allocated) {
4942                 temp_allocate_frame(s, ots);
4943             }
4944             tcg_out_st(s, ts->type, ireg, ots->mem_base->reg, ots->mem_offset);
4945             set_temp_val_nonreg(s, ts, TEMP_VAL_MEM);
4946             ots->mem_coherent = 1;
4947             return;
4948         }
4949     }
4950     set_temp_val_reg(s, ots, oreg);
4951     ots->mem_coherent = 0;
4952 
4953     if (NEED_SYNC_ARG(0)) {
4954         temp_sync(s, ots, allocated_regs, 0, 0);
4955     }
4956 }
4957 
4958 /*
4959  * Specialized code generation for INDEX_op_dup_vec.
4960  */
4961 static void tcg_reg_alloc_dup(TCGContext *s, const TCGOp *op)
4962 {
4963     const TCGLifeData arg_life = op->life;
4964     TCGRegSet dup_out_regs, dup_in_regs;
4965     const TCGArgConstraint *dup_args_ct;
4966     TCGTemp *its, *ots;
4967     TCGType itype, vtype;
4968     unsigned vece;
4969     int lowpart_ofs;
4970     bool ok;
4971 
4972     ots = arg_temp(op->args[0]);
4973     its = arg_temp(op->args[1]);
4974 
4975     /* ENV should not be modified.  */
4976     tcg_debug_assert(!temp_readonly(ots));
4977 
4978     itype = its->type;
4979     vece = TCGOP_VECE(op);
4980     vtype = TCGOP_TYPE(op);
4981 
4982     if (its->val_type == TEMP_VAL_CONST) {
4983         /* Propagate constant via movi -> dupi.  */
4984         tcg_target_ulong val = its->val;
4985         if (IS_DEAD_ARG(1)) {
4986             temp_dead(s, its);
4987         }
4988         tcg_reg_alloc_do_movi(s, ots, val, arg_life, output_pref(op, 0));
4989         return;
4990     }
4991 
4992     dup_args_ct = opcode_args_ct(op);
4993     dup_out_regs = dup_args_ct[0].regs;
4994     dup_in_regs = dup_args_ct[1].regs;
4995 
4996     /* Allocate the output register now.  */
4997     if (ots->val_type != TEMP_VAL_REG) {
4998         TCGRegSet allocated_regs = s->reserved_regs;
4999         TCGReg oreg;
5000 
5001         if (!IS_DEAD_ARG(1) && its->val_type == TEMP_VAL_REG) {
5002             /* Make sure to not spill the input register. */
5003             tcg_regset_set_reg(allocated_regs, its->reg);
5004         }
5005         oreg = tcg_reg_alloc(s, dup_out_regs, allocated_regs,
5006                              output_pref(op, 0), ots->indirect_base);
5007         set_temp_val_reg(s, ots, oreg);
5008     }
5009 
5010     switch (its->val_type) {
5011     case TEMP_VAL_REG:
5012         /*
5013          * The dup constriaints must be broad, covering all possible VECE.
5014          * However, tcg_op_dup_vec() gets to see the VECE and we allow it
5015          * to fail, indicating that extra moves are required for that case.
5016          */
5017         if (tcg_regset_test_reg(dup_in_regs, its->reg)) {
5018             if (tcg_out_dup_vec(s, vtype, vece, ots->reg, its->reg)) {
5019                 goto done;
5020             }
5021             /* Try again from memory or a vector input register.  */
5022         }
5023         if (!its->mem_coherent) {
5024             /*
5025              * The input register is not synced, and so an extra store
5026              * would be required to use memory.  Attempt an integer-vector
5027              * register move first.  We do not have a TCGRegSet for this.
5028              */
5029             if (tcg_out_mov(s, itype, ots->reg, its->reg)) {
5030                 break;
5031             }
5032             /* Sync the temp back to its slot and load from there.  */
5033             temp_sync(s, its, s->reserved_regs, 0, 0);
5034         }
5035         /* fall through */
5036 
5037     case TEMP_VAL_MEM:
5038         lowpart_ofs = 0;
5039         if (HOST_BIG_ENDIAN) {
5040             lowpart_ofs = tcg_type_size(itype) - (1 << vece);
5041         }
5042         if (tcg_out_dupm_vec(s, vtype, vece, ots->reg, its->mem_base->reg,
5043                              its->mem_offset + lowpart_ofs)) {
5044             goto done;
5045         }
5046         /* Load the input into the destination vector register. */
5047         tcg_out_ld(s, itype, ots->reg, its->mem_base->reg, its->mem_offset);
5048         break;
5049 
5050     default:
5051         g_assert_not_reached();
5052     }
5053 
5054     /* We now have a vector input register, so dup must succeed. */
5055     ok = tcg_out_dup_vec(s, vtype, vece, ots->reg, ots->reg);
5056     tcg_debug_assert(ok);
5057 
5058  done:
5059     ots->mem_coherent = 0;
5060     if (IS_DEAD_ARG(1)) {
5061         temp_dead(s, its);
5062     }
5063     if (NEED_SYNC_ARG(0)) {
5064         temp_sync(s, ots, s->reserved_regs, 0, 0);
5065     }
5066     if (IS_DEAD_ARG(0)) {
5067         temp_dead(s, ots);
5068     }
5069 }
5070 
5071 static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
5072 {
5073     const TCGLifeData arg_life = op->life;
5074     const TCGOpDef * const def = &tcg_op_defs[op->opc];
5075     TCGRegSet i_allocated_regs;
5076     TCGRegSet o_allocated_regs;
5077     int i, k, nb_iargs, nb_oargs;
5078     TCGReg reg;
5079     TCGArg arg;
5080     const TCGArgConstraint *args_ct;
5081     const TCGArgConstraint *arg_ct;
5082     TCGTemp *ts;
5083     TCGArg new_args[TCG_MAX_OP_ARGS];
5084     int const_args[TCG_MAX_OP_ARGS];
5085     TCGCond op_cond;
5086 
5087     nb_oargs = def->nb_oargs;
5088     nb_iargs = def->nb_iargs;
5089 
5090     /* copy constants */
5091     memcpy(new_args + nb_oargs + nb_iargs,
5092            op->args + nb_oargs + nb_iargs,
5093            sizeof(TCGArg) * def->nb_cargs);
5094 
5095     i_allocated_regs = s->reserved_regs;
5096     o_allocated_regs = s->reserved_regs;
5097 
5098     switch (op->opc) {
5099     case INDEX_op_brcond_i32:
5100     case INDEX_op_brcond_i64:
5101         op_cond = op->args[2];
5102         break;
5103     case INDEX_op_setcond_i32:
5104     case INDEX_op_setcond_i64:
5105     case INDEX_op_negsetcond_i32:
5106     case INDEX_op_negsetcond_i64:
5107     case INDEX_op_cmp_vec:
5108         op_cond = op->args[3];
5109         break;
5110     case INDEX_op_brcond2_i32:
5111         op_cond = op->args[4];
5112         break;
5113     case INDEX_op_movcond_i32:
5114     case INDEX_op_movcond_i64:
5115     case INDEX_op_setcond2_i32:
5116     case INDEX_op_cmpsel_vec:
5117         op_cond = op->args[5];
5118         break;
5119     default:
5120         /* No condition within opcode. */
5121         op_cond = TCG_COND_ALWAYS;
5122         break;
5123     }
5124 
5125     args_ct = opcode_args_ct(op);
5126 
5127     /* satisfy input constraints */
5128     for (k = 0; k < nb_iargs; k++) {
5129         TCGRegSet i_preferred_regs, i_required_regs;
5130         bool allocate_new_reg, copyto_new_reg;
5131         TCGTemp *ts2;
5132         int i1, i2;
5133 
5134         i = args_ct[nb_oargs + k].sort_index;
5135         arg = op->args[i];
5136         arg_ct = &args_ct[i];
5137         ts = arg_temp(arg);
5138 
5139         if (ts->val_type == TEMP_VAL_CONST) {
5140 #ifdef TCG_REG_ZERO
5141             if (ts->val == 0 && (arg_ct->ct & TCG_CT_REG_ZERO)) {
5142                 /* Hardware zero register: indicate register via non-const. */
5143                 const_args[i] = 0;
5144                 new_args[i] = TCG_REG_ZERO;
5145                 continue;
5146             }
5147 #endif
5148 
5149             if (tcg_target_const_match(ts->val, arg_ct->ct, ts->type,
5150                                        op_cond, TCGOP_VECE(op))) {
5151                 /* constant is OK for instruction */
5152                 const_args[i] = 1;
5153                 new_args[i] = ts->val;
5154                 continue;
5155             }
5156         }
5157 
5158         reg = ts->reg;
5159         i_preferred_regs = 0;
5160         i_required_regs = arg_ct->regs;
5161         allocate_new_reg = false;
5162         copyto_new_reg = false;
5163 
5164         switch (arg_ct->pair) {
5165         case 0: /* not paired */
5166             if (arg_ct->ialias) {
5167                 i_preferred_regs = output_pref(op, arg_ct->alias_index);
5168 
5169                 /*
5170                  * If the input is readonly, then it cannot also be an
5171                  * output and aliased to itself.  If the input is not
5172                  * dead after the instruction, we must allocate a new
5173                  * register and move it.
5174                  */
5175                 if (temp_readonly(ts) || !IS_DEAD_ARG(i)
5176                     || args_ct[arg_ct->alias_index].newreg) {
5177                     allocate_new_reg = true;
5178                 } else if (ts->val_type == TEMP_VAL_REG) {
5179                     /*
5180                      * Check if the current register has already been
5181                      * allocated for another input.
5182                      */
5183                     allocate_new_reg =
5184                         tcg_regset_test_reg(i_allocated_regs, reg);
5185                 }
5186             }
5187             if (!allocate_new_reg) {
5188                 temp_load(s, ts, i_required_regs, i_allocated_regs,
5189                           i_preferred_regs);
5190                 reg = ts->reg;
5191                 allocate_new_reg = !tcg_regset_test_reg(i_required_regs, reg);
5192             }
5193             if (allocate_new_reg) {
5194                 /*
5195                  * Allocate a new register matching the constraint
5196                  * and move the temporary register into it.
5197                  */
5198                 temp_load(s, ts, tcg_target_available_regs[ts->type],
5199                           i_allocated_regs, 0);
5200                 reg = tcg_reg_alloc(s, i_required_regs, i_allocated_regs,
5201                                     i_preferred_regs, ts->indirect_base);
5202                 copyto_new_reg = true;
5203             }
5204             break;
5205 
5206         case 1:
5207             /* First of an input pair; if i1 == i2, the second is an output. */
5208             i1 = i;
5209             i2 = arg_ct->pair_index;
5210             ts2 = i1 != i2 ? arg_temp(op->args[i2]) : NULL;
5211 
5212             /*
5213              * It is easier to default to allocating a new pair
5214              * and to identify a few cases where it's not required.
5215              */
5216             if (arg_ct->ialias) {
5217                 i_preferred_regs = output_pref(op, arg_ct->alias_index);
5218                 if (IS_DEAD_ARG(i1) &&
5219                     IS_DEAD_ARG(i2) &&
5220                     !temp_readonly(ts) &&
5221                     ts->val_type == TEMP_VAL_REG &&
5222                     ts->reg < TCG_TARGET_NB_REGS - 1 &&
5223                     tcg_regset_test_reg(i_required_regs, reg) &&
5224                     !tcg_regset_test_reg(i_allocated_regs, reg) &&
5225                     !tcg_regset_test_reg(i_allocated_regs, reg + 1) &&
5226                     (ts2
5227                      ? ts2->val_type == TEMP_VAL_REG &&
5228                        ts2->reg == reg + 1 &&
5229                        !temp_readonly(ts2)
5230                      : s->reg_to_temp[reg + 1] == NULL)) {
5231                     break;
5232                 }
5233             } else {
5234                 /* Without aliasing, the pair must also be an input. */
5235                 tcg_debug_assert(ts2);
5236                 if (ts->val_type == TEMP_VAL_REG &&
5237                     ts2->val_type == TEMP_VAL_REG &&
5238                     ts2->reg == reg + 1 &&
5239                     tcg_regset_test_reg(i_required_regs, reg)) {
5240                     break;
5241                 }
5242             }
5243             reg = tcg_reg_alloc_pair(s, i_required_regs, i_allocated_regs,
5244                                      0, ts->indirect_base);
5245             goto do_pair;
5246 
5247         case 2: /* pair second */
5248             reg = new_args[arg_ct->pair_index] + 1;
5249             goto do_pair;
5250 
5251         case 3: /* ialias with second output, no first input */
5252             tcg_debug_assert(arg_ct->ialias);
5253             i_preferred_regs = output_pref(op, arg_ct->alias_index);
5254 
5255             if (IS_DEAD_ARG(i) &&
5256                 !temp_readonly(ts) &&
5257                 ts->val_type == TEMP_VAL_REG &&
5258                 reg > 0 &&
5259                 s->reg_to_temp[reg - 1] == NULL &&
5260                 tcg_regset_test_reg(i_required_regs, reg) &&
5261                 !tcg_regset_test_reg(i_allocated_regs, reg) &&
5262                 !tcg_regset_test_reg(i_allocated_regs, reg - 1)) {
5263                 tcg_regset_set_reg(i_allocated_regs, reg - 1);
5264                 break;
5265             }
5266             reg = tcg_reg_alloc_pair(s, i_required_regs >> 1,
5267                                      i_allocated_regs, 0,
5268                                      ts->indirect_base);
5269             tcg_regset_set_reg(i_allocated_regs, reg);
5270             reg += 1;
5271             goto do_pair;
5272 
5273         do_pair:
5274             /*
5275              * If an aliased input is not dead after the instruction,
5276              * we must allocate a new register and move it.
5277              */
5278             if (arg_ct->ialias && (!IS_DEAD_ARG(i) || temp_readonly(ts))) {
5279                 TCGRegSet t_allocated_regs = i_allocated_regs;
5280 
5281                 /*
5282                  * Because of the alias, and the continued life, make sure
5283                  * that the temp is somewhere *other* than the reg pair,
5284                  * and we get a copy in reg.
5285                  */
5286                 tcg_regset_set_reg(t_allocated_regs, reg);
5287                 tcg_regset_set_reg(t_allocated_regs, reg + 1);
5288                 if (ts->val_type == TEMP_VAL_REG && ts->reg == reg) {
5289                     /* If ts was already in reg, copy it somewhere else. */
5290                     TCGReg nr;
5291                     bool ok;
5292 
5293                     tcg_debug_assert(ts->kind != TEMP_FIXED);
5294                     nr = tcg_reg_alloc(s, tcg_target_available_regs[ts->type],
5295                                        t_allocated_regs, 0, ts->indirect_base);
5296                     ok = tcg_out_mov(s, ts->type, nr, reg);
5297                     tcg_debug_assert(ok);
5298 
5299                     set_temp_val_reg(s, ts, nr);
5300                 } else {
5301                     temp_load(s, ts, tcg_target_available_regs[ts->type],
5302                               t_allocated_regs, 0);
5303                     copyto_new_reg = true;
5304                 }
5305             } else {
5306                 /* Preferably allocate to reg, otherwise copy. */
5307                 i_required_regs = (TCGRegSet)1 << reg;
5308                 temp_load(s, ts, i_required_regs, i_allocated_regs,
5309                           i_preferred_regs);
5310                 copyto_new_reg = ts->reg != reg;
5311             }
5312             break;
5313 
5314         default:
5315             g_assert_not_reached();
5316         }
5317 
5318         if (copyto_new_reg) {
5319             if (!tcg_out_mov(s, ts->type, reg, ts->reg)) {
5320                 /*
5321                  * Cross register class move not supported.  Sync the
5322                  * temp back to its slot and load from there.
5323                  */
5324                 temp_sync(s, ts, i_allocated_regs, 0, 0);
5325                 tcg_out_ld(s, ts->type, reg,
5326                            ts->mem_base->reg, ts->mem_offset);
5327             }
5328         }
5329         new_args[i] = reg;
5330         const_args[i] = 0;
5331         tcg_regset_set_reg(i_allocated_regs, reg);
5332     }
5333 
5334     /* mark dead temporaries and free the associated registers */
5335     for (i = nb_oargs; i < nb_oargs + nb_iargs; i++) {
5336         if (IS_DEAD_ARG(i)) {
5337             temp_dead(s, arg_temp(op->args[i]));
5338         }
5339     }
5340 
5341     if (def->flags & TCG_OPF_COND_BRANCH) {
5342         tcg_reg_alloc_cbranch(s, i_allocated_regs);
5343     } else if (def->flags & TCG_OPF_BB_END) {
5344         tcg_reg_alloc_bb_end(s, i_allocated_regs);
5345     } else {
5346         if (def->flags & TCG_OPF_CALL_CLOBBER) {
5347             /* XXX: permit generic clobber register list ? */
5348             for (i = 0; i < TCG_TARGET_NB_REGS; i++) {
5349                 if (tcg_regset_test_reg(tcg_target_call_clobber_regs, i)) {
5350                     tcg_reg_free(s, i, i_allocated_regs);
5351                 }
5352             }
5353         }
5354         if (def->flags & TCG_OPF_SIDE_EFFECTS) {
5355             /* sync globals if the op has side effects and might trigger
5356                an exception. */
5357             sync_globals(s, i_allocated_regs);
5358         }
5359 
5360         /* satisfy the output constraints */
5361         for (k = 0; k < nb_oargs; k++) {
5362             i = args_ct[k].sort_index;
5363             arg = op->args[i];
5364             arg_ct = &args_ct[i];
5365             ts = arg_temp(arg);
5366 
5367             /* ENV should not be modified.  */
5368             tcg_debug_assert(!temp_readonly(ts));
5369 
5370             switch (arg_ct->pair) {
5371             case 0: /* not paired */
5372                 if (arg_ct->oalias && !const_args[arg_ct->alias_index]) {
5373                     reg = new_args[arg_ct->alias_index];
5374                 } else if (arg_ct->newreg) {
5375                     reg = tcg_reg_alloc(s, arg_ct->regs,
5376                                         i_allocated_regs | o_allocated_regs,
5377                                         output_pref(op, k), ts->indirect_base);
5378                 } else {
5379                     reg = tcg_reg_alloc(s, arg_ct->regs, o_allocated_regs,
5380                                         output_pref(op, k), ts->indirect_base);
5381                 }
5382                 break;
5383 
5384             case 1: /* first of pair */
5385                 if (arg_ct->oalias) {
5386                     reg = new_args[arg_ct->alias_index];
5387                 } else if (arg_ct->newreg) {
5388                     reg = tcg_reg_alloc_pair(s, arg_ct->regs,
5389                                              i_allocated_regs | o_allocated_regs,
5390                                              output_pref(op, k),
5391                                              ts->indirect_base);
5392                 } else {
5393                     reg = tcg_reg_alloc_pair(s, arg_ct->regs, o_allocated_regs,
5394                                              output_pref(op, k),
5395                                              ts->indirect_base);
5396                 }
5397                 break;
5398 
5399             case 2: /* second of pair */
5400                 if (arg_ct->oalias) {
5401                     reg = new_args[arg_ct->alias_index];
5402                 } else {
5403                     reg = new_args[arg_ct->pair_index] + 1;
5404                 }
5405                 break;
5406 
5407             case 3: /* first of pair, aliasing with a second input */
5408                 tcg_debug_assert(!arg_ct->newreg);
5409                 reg = new_args[arg_ct->pair_index] - 1;
5410                 break;
5411 
5412             default:
5413                 g_assert_not_reached();
5414             }
5415             tcg_regset_set_reg(o_allocated_regs, reg);
5416             set_temp_val_reg(s, ts, reg);
5417             ts->mem_coherent = 0;
5418             new_args[i] = reg;
5419         }
5420     }
5421 
5422     /* emit instruction */
5423     TCGType type = TCGOP_TYPE(op);
5424     switch (op->opc) {
5425     case INDEX_op_ext_i32_i64:
5426         tcg_out_exts_i32_i64(s, new_args[0], new_args[1]);
5427         break;
5428     case INDEX_op_extu_i32_i64:
5429         tcg_out_extu_i32_i64(s, new_args[0], new_args[1]);
5430         break;
5431     case INDEX_op_extrl_i64_i32:
5432         tcg_out_extrl_i64_i32(s, new_args[0], new_args[1]);
5433         break;
5434 
5435     case INDEX_op_add:
5436     case INDEX_op_and:
5437     case INDEX_op_andc:
5438     case INDEX_op_eqv:
5439     case INDEX_op_or:
5440     case INDEX_op_orc:
5441     case INDEX_op_xor:
5442         {
5443             const TCGOutOpBinary *out =
5444                 container_of(all_outop[op->opc], TCGOutOpBinary, base);
5445 
5446             /* Constants should never appear in the first source operand. */
5447             tcg_debug_assert(!const_args[1]);
5448             if (const_args[2]) {
5449                 out->out_rri(s, type, new_args[0], new_args[1], new_args[2]);
5450             } else {
5451                 out->out_rrr(s, type, new_args[0], new_args[1], new_args[2]);
5452             }
5453         }
5454         break;
5455 
5456     default:
5457         if (def->flags & TCG_OPF_VECTOR) {
5458             tcg_out_vec_op(s, op->opc, type - TCG_TYPE_V64,
5459                            TCGOP_VECE(op), new_args, const_args);
5460         } else {
5461             tcg_out_op(s, op->opc, type, new_args, const_args);
5462         }
5463         break;
5464     }
5465 
5466     /* move the outputs in the correct register if needed */
5467     for(i = 0; i < nb_oargs; i++) {
5468         ts = arg_temp(op->args[i]);
5469 
5470         /* ENV should not be modified.  */
5471         tcg_debug_assert(!temp_readonly(ts));
5472 
5473         if (NEED_SYNC_ARG(i)) {
5474             temp_sync(s, ts, o_allocated_regs, 0, IS_DEAD_ARG(i));
5475         } else if (IS_DEAD_ARG(i)) {
5476             temp_dead(s, ts);
5477         }
5478     }
5479 }
5480 
5481 static bool tcg_reg_alloc_dup2(TCGContext *s, const TCGOp *op)
5482 {
5483     const TCGLifeData arg_life = op->life;
5484     TCGTemp *ots, *itsl, *itsh;
5485     TCGType vtype = TCGOP_TYPE(op);
5486 
5487     /* This opcode is only valid for 32-bit hosts, for 64-bit elements. */
5488     tcg_debug_assert(TCG_TARGET_REG_BITS == 32);
5489     tcg_debug_assert(TCGOP_VECE(op) == MO_64);
5490 
5491     ots = arg_temp(op->args[0]);
5492     itsl = arg_temp(op->args[1]);
5493     itsh = arg_temp(op->args[2]);
5494 
5495     /* ENV should not be modified.  */
5496     tcg_debug_assert(!temp_readonly(ots));
5497 
5498     /* Allocate the output register now.  */
5499     if (ots->val_type != TEMP_VAL_REG) {
5500         TCGRegSet allocated_regs = s->reserved_regs;
5501         TCGRegSet dup_out_regs = opcode_args_ct(op)[0].regs;
5502         TCGReg oreg;
5503 
5504         /* Make sure to not spill the input registers. */
5505         if (!IS_DEAD_ARG(1) && itsl->val_type == TEMP_VAL_REG) {
5506             tcg_regset_set_reg(allocated_regs, itsl->reg);
5507         }
5508         if (!IS_DEAD_ARG(2) && itsh->val_type == TEMP_VAL_REG) {
5509             tcg_regset_set_reg(allocated_regs, itsh->reg);
5510         }
5511 
5512         oreg = tcg_reg_alloc(s, dup_out_regs, allocated_regs,
5513                              output_pref(op, 0), ots->indirect_base);
5514         set_temp_val_reg(s, ots, oreg);
5515     }
5516 
5517     /* Promote dup2 of immediates to dupi_vec. */
5518     if (itsl->val_type == TEMP_VAL_CONST && itsh->val_type == TEMP_VAL_CONST) {
5519         uint64_t val = deposit64(itsl->val, 32, 32, itsh->val);
5520         MemOp vece = MO_64;
5521 
5522         if (val == dup_const(MO_8, val)) {
5523             vece = MO_8;
5524         } else if (val == dup_const(MO_16, val)) {
5525             vece = MO_16;
5526         } else if (val == dup_const(MO_32, val)) {
5527             vece = MO_32;
5528         }
5529 
5530         tcg_out_dupi_vec(s, vtype, vece, ots->reg, val);
5531         goto done;
5532     }
5533 
5534     /* If the two inputs form one 64-bit value, try dupm_vec. */
5535     if (itsl->temp_subindex == HOST_BIG_ENDIAN &&
5536         itsh->temp_subindex == !HOST_BIG_ENDIAN &&
5537         itsl == itsh + (HOST_BIG_ENDIAN ? 1 : -1)) {
5538         TCGTemp *its = itsl - HOST_BIG_ENDIAN;
5539 
5540         temp_sync(s, its + 0, s->reserved_regs, 0, 0);
5541         temp_sync(s, its + 1, s->reserved_regs, 0, 0);
5542 
5543         if (tcg_out_dupm_vec(s, vtype, MO_64, ots->reg,
5544                              its->mem_base->reg, its->mem_offset)) {
5545             goto done;
5546         }
5547     }
5548 
5549     /* Fall back to generic expansion. */
5550     return false;
5551 
5552  done:
5553     ots->mem_coherent = 0;
5554     if (IS_DEAD_ARG(1)) {
5555         temp_dead(s, itsl);
5556     }
5557     if (IS_DEAD_ARG(2)) {
5558         temp_dead(s, itsh);
5559     }
5560     if (NEED_SYNC_ARG(0)) {
5561         temp_sync(s, ots, s->reserved_regs, 0, IS_DEAD_ARG(0));
5562     } else if (IS_DEAD_ARG(0)) {
5563         temp_dead(s, ots);
5564     }
5565     return true;
5566 }
5567 
5568 static void load_arg_reg(TCGContext *s, TCGReg reg, TCGTemp *ts,
5569                          TCGRegSet allocated_regs)
5570 {
5571     if (ts->val_type == TEMP_VAL_REG) {
5572         if (ts->reg != reg) {
5573             tcg_reg_free(s, reg, allocated_regs);
5574             if (!tcg_out_mov(s, ts->type, reg, ts->reg)) {
5575                 /*
5576                  * Cross register class move not supported.  Sync the
5577                  * temp back to its slot and load from there.
5578                  */
5579                 temp_sync(s, ts, allocated_regs, 0, 0);
5580                 tcg_out_ld(s, ts->type, reg,
5581                            ts->mem_base->reg, ts->mem_offset);
5582             }
5583         }
5584     } else {
5585         TCGRegSet arg_set = 0;
5586 
5587         tcg_reg_free(s, reg, allocated_regs);
5588         tcg_regset_set_reg(arg_set, reg);
5589         temp_load(s, ts, arg_set, allocated_regs, 0);
5590     }
5591 }
5592 
5593 static void load_arg_stk(TCGContext *s, unsigned arg_slot, TCGTemp *ts,
5594                          TCGRegSet allocated_regs)
5595 {
5596     /*
5597      * When the destination is on the stack, load up the temp and store.
5598      * If there are many call-saved registers, the temp might live to
5599      * see another use; otherwise it'll be discarded.
5600      */
5601     temp_load(s, ts, tcg_target_available_regs[ts->type], allocated_regs, 0);
5602     tcg_out_st(s, ts->type, ts->reg, TCG_REG_CALL_STACK,
5603                arg_slot_stk_ofs(arg_slot));
5604 }
5605 
5606 static void load_arg_normal(TCGContext *s, const TCGCallArgumentLoc *l,
5607                             TCGTemp *ts, TCGRegSet *allocated_regs)
5608 {
5609     if (arg_slot_reg_p(l->arg_slot)) {
5610         TCGReg reg = tcg_target_call_iarg_regs[l->arg_slot];
5611         load_arg_reg(s, reg, ts, *allocated_regs);
5612         tcg_regset_set_reg(*allocated_regs, reg);
5613     } else {
5614         load_arg_stk(s, l->arg_slot, ts, *allocated_regs);
5615     }
5616 }
5617 
5618 static void load_arg_ref(TCGContext *s, unsigned arg_slot, TCGReg ref_base,
5619                          intptr_t ref_off, TCGRegSet *allocated_regs)
5620 {
5621     TCGReg reg;
5622 
5623     if (arg_slot_reg_p(arg_slot)) {
5624         reg = tcg_target_call_iarg_regs[arg_slot];
5625         tcg_reg_free(s, reg, *allocated_regs);
5626         tcg_out_addi_ptr(s, reg, ref_base, ref_off);
5627         tcg_regset_set_reg(*allocated_regs, reg);
5628     } else {
5629         reg = tcg_reg_alloc(s, tcg_target_available_regs[TCG_TYPE_PTR],
5630                             *allocated_regs, 0, false);
5631         tcg_out_addi_ptr(s, reg, ref_base, ref_off);
5632         tcg_out_st(s, TCG_TYPE_PTR, reg, TCG_REG_CALL_STACK,
5633                    arg_slot_stk_ofs(arg_slot));
5634     }
5635 }
5636 
5637 static void tcg_reg_alloc_call(TCGContext *s, TCGOp *op)
5638 {
5639     const int nb_oargs = TCGOP_CALLO(op);
5640     const int nb_iargs = TCGOP_CALLI(op);
5641     const TCGLifeData arg_life = op->life;
5642     const TCGHelperInfo *info = tcg_call_info(op);
5643     TCGRegSet allocated_regs = s->reserved_regs;
5644     int i;
5645 
5646     /*
5647      * Move inputs into place in reverse order,
5648      * so that we place stacked arguments first.
5649      */
5650     for (i = nb_iargs - 1; i >= 0; --i) {
5651         const TCGCallArgumentLoc *loc = &info->in[i];
5652         TCGTemp *ts = arg_temp(op->args[nb_oargs + i]);
5653 
5654         switch (loc->kind) {
5655         case TCG_CALL_ARG_NORMAL:
5656         case TCG_CALL_ARG_EXTEND_U:
5657         case TCG_CALL_ARG_EXTEND_S:
5658             load_arg_normal(s, loc, ts, &allocated_regs);
5659             break;
5660         case TCG_CALL_ARG_BY_REF:
5661             load_arg_stk(s, loc->ref_slot, ts, allocated_regs);
5662             load_arg_ref(s, loc->arg_slot, TCG_REG_CALL_STACK,
5663                          arg_slot_stk_ofs(loc->ref_slot),
5664                          &allocated_regs);
5665             break;
5666         case TCG_CALL_ARG_BY_REF_N:
5667             load_arg_stk(s, loc->ref_slot, ts, allocated_regs);
5668             break;
5669         default:
5670             g_assert_not_reached();
5671         }
5672     }
5673 
5674     /* Mark dead temporaries and free the associated registers.  */
5675     for (i = nb_oargs; i < nb_iargs + nb_oargs; i++) {
5676         if (IS_DEAD_ARG(i)) {
5677             temp_dead(s, arg_temp(op->args[i]));
5678         }
5679     }
5680 
5681     /* Clobber call registers.  */
5682     for (i = 0; i < TCG_TARGET_NB_REGS; i++) {
5683         if (tcg_regset_test_reg(tcg_target_call_clobber_regs, i)) {
5684             tcg_reg_free(s, i, allocated_regs);
5685         }
5686     }
5687 
5688     /*
5689      * Save globals if they might be written by the helper,
5690      * sync them if they might be read.
5691      */
5692     if (info->flags & TCG_CALL_NO_READ_GLOBALS) {
5693         /* Nothing to do */
5694     } else if (info->flags & TCG_CALL_NO_WRITE_GLOBALS) {
5695         sync_globals(s, allocated_regs);
5696     } else {
5697         save_globals(s, allocated_regs);
5698     }
5699 
5700     /*
5701      * If the ABI passes a pointer to the returned struct as the first
5702      * argument, load that now.  Pass a pointer to the output home slot.
5703      */
5704     if (info->out_kind == TCG_CALL_RET_BY_REF) {
5705         TCGTemp *ts = arg_temp(op->args[0]);
5706 
5707         if (!ts->mem_allocated) {
5708             temp_allocate_frame(s, ts);
5709         }
5710         load_arg_ref(s, 0, ts->mem_base->reg, ts->mem_offset, &allocated_regs);
5711     }
5712 
5713     tcg_out_call(s, tcg_call_func(op), info);
5714 
5715     /* Assign output registers and emit moves if needed.  */
5716     switch (info->out_kind) {
5717     case TCG_CALL_RET_NORMAL:
5718         for (i = 0; i < nb_oargs; i++) {
5719             TCGTemp *ts = arg_temp(op->args[i]);
5720             TCGReg reg = tcg_target_call_oarg_reg(TCG_CALL_RET_NORMAL, i);
5721 
5722             /* ENV should not be modified.  */
5723             tcg_debug_assert(!temp_readonly(ts));
5724 
5725             set_temp_val_reg(s, ts, reg);
5726             ts->mem_coherent = 0;
5727         }
5728         break;
5729 
5730     case TCG_CALL_RET_BY_VEC:
5731         {
5732             TCGTemp *ts = arg_temp(op->args[0]);
5733 
5734             tcg_debug_assert(ts->base_type == TCG_TYPE_I128);
5735             tcg_debug_assert(ts->temp_subindex == 0);
5736             if (!ts->mem_allocated) {
5737                 temp_allocate_frame(s, ts);
5738             }
5739             tcg_out_st(s, TCG_TYPE_V128,
5740                        tcg_target_call_oarg_reg(TCG_CALL_RET_BY_VEC, 0),
5741                        ts->mem_base->reg, ts->mem_offset);
5742         }
5743         /* fall through to mark all parts in memory */
5744 
5745     case TCG_CALL_RET_BY_REF:
5746         /* The callee has performed a write through the reference. */
5747         for (i = 0; i < nb_oargs; i++) {
5748             TCGTemp *ts = arg_temp(op->args[i]);
5749             ts->val_type = TEMP_VAL_MEM;
5750         }
5751         break;
5752 
5753     default:
5754         g_assert_not_reached();
5755     }
5756 
5757     /* Flush or discard output registers as needed. */
5758     for (i = 0; i < nb_oargs; i++) {
5759         TCGTemp *ts = arg_temp(op->args[i]);
5760         if (NEED_SYNC_ARG(i)) {
5761             temp_sync(s, ts, s->reserved_regs, 0, IS_DEAD_ARG(i));
5762         } else if (IS_DEAD_ARG(i)) {
5763             temp_dead(s, ts);
5764         }
5765     }
5766 }
5767 
5768 /**
5769  * atom_and_align_for_opc:
5770  * @s: tcg context
5771  * @opc: memory operation code
5772  * @host_atom: MO_ATOM_{IFALIGN,WITHIN16,SUBALIGN} for host operations
5773  * @allow_two_ops: true if we are prepared to issue two operations
5774  *
5775  * Return the alignment and atomicity to use for the inline fast path
5776  * for the given memory operation.  The alignment may be larger than
5777  * that specified in @opc, and the correct alignment will be diagnosed
5778  * by the slow path helper.
5779  *
5780  * If @allow_two_ops, the host is prepared to test for 2x alignment,
5781  * and issue two loads or stores for subalignment.
5782  */
5783 static TCGAtomAlign atom_and_align_for_opc(TCGContext *s, MemOp opc,
5784                                            MemOp host_atom, bool allow_two_ops)
5785 {
5786     MemOp align = memop_alignment_bits(opc);
5787     MemOp size = opc & MO_SIZE;
5788     MemOp half = size ? size - 1 : 0;
5789     MemOp atom = opc & MO_ATOM_MASK;
5790     MemOp atmax;
5791 
5792     switch (atom) {
5793     case MO_ATOM_NONE:
5794         /* The operation requires no specific atomicity. */
5795         atmax = MO_8;
5796         break;
5797 
5798     case MO_ATOM_IFALIGN:
5799         atmax = size;
5800         break;
5801 
5802     case MO_ATOM_IFALIGN_PAIR:
5803         atmax = half;
5804         break;
5805 
5806     case MO_ATOM_WITHIN16:
5807         atmax = size;
5808         if (size == MO_128) {
5809             /* Misalignment implies !within16, and therefore no atomicity. */
5810         } else if (host_atom != MO_ATOM_WITHIN16) {
5811             /* The host does not implement within16, so require alignment. */
5812             align = MAX(align, size);
5813         }
5814         break;
5815 
5816     case MO_ATOM_WITHIN16_PAIR:
5817         atmax = size;
5818         /*
5819          * Misalignment implies !within16, and therefore half atomicity.
5820          * Any host prepared for two operations can implement this with
5821          * half alignment.
5822          */
5823         if (host_atom != MO_ATOM_WITHIN16 && allow_two_ops) {
5824             align = MAX(align, half);
5825         }
5826         break;
5827 
5828     case MO_ATOM_SUBALIGN:
5829         atmax = size;
5830         if (host_atom != MO_ATOM_SUBALIGN) {
5831             /* If unaligned but not odd, there are subobjects up to half. */
5832             if (allow_two_ops) {
5833                 align = MAX(align, half);
5834             } else {
5835                 align = MAX(align, size);
5836             }
5837         }
5838         break;
5839 
5840     default:
5841         g_assert_not_reached();
5842     }
5843 
5844     return (TCGAtomAlign){ .atom = atmax, .align = align };
5845 }
5846 
5847 /*
5848  * Similarly for qemu_ld/st slow path helpers.
5849  * We must re-implement tcg_gen_callN and tcg_reg_alloc_call simultaneously,
5850  * using only the provided backend tcg_out_* functions.
5851  */
5852 
5853 static int tcg_out_helper_stk_ofs(TCGType type, unsigned slot)
5854 {
5855     int ofs = arg_slot_stk_ofs(slot);
5856 
5857     /*
5858      * Each stack slot is TCG_TARGET_LONG_BITS.  If the host does not
5859      * require extension to uint64_t, adjust the address for uint32_t.
5860      */
5861     if (HOST_BIG_ENDIAN &&
5862         TCG_TARGET_REG_BITS == 64 &&
5863         type == TCG_TYPE_I32) {
5864         ofs += 4;
5865     }
5866     return ofs;
5867 }
5868 
5869 static void tcg_out_helper_load_slots(TCGContext *s,
5870                                       unsigned nmov, TCGMovExtend *mov,
5871                                       const TCGLdstHelperParam *parm)
5872 {
5873     unsigned i;
5874     TCGReg dst3;
5875 
5876     /*
5877      * Start from the end, storing to the stack first.
5878      * This frees those registers, so we need not consider overlap.
5879      */
5880     for (i = nmov; i-- > 0; ) {
5881         unsigned slot = mov[i].dst;
5882 
5883         if (arg_slot_reg_p(slot)) {
5884             goto found_reg;
5885         }
5886 
5887         TCGReg src = mov[i].src;
5888         TCGType dst_type = mov[i].dst_type;
5889         MemOp dst_mo = dst_type == TCG_TYPE_I32 ? MO_32 : MO_64;
5890 
5891         /* The argument is going onto the stack; extend into scratch. */
5892         if ((mov[i].src_ext & MO_SIZE) != dst_mo) {
5893             tcg_debug_assert(parm->ntmp != 0);
5894             mov[i].dst = src = parm->tmp[0];
5895             tcg_out_movext1(s, &mov[i]);
5896         }
5897 
5898         tcg_out_st(s, dst_type, src, TCG_REG_CALL_STACK,
5899                    tcg_out_helper_stk_ofs(dst_type, slot));
5900     }
5901     return;
5902 
5903  found_reg:
5904     /*
5905      * The remaining arguments are in registers.
5906      * Convert slot numbers to argument registers.
5907      */
5908     nmov = i + 1;
5909     for (i = 0; i < nmov; ++i) {
5910         mov[i].dst = tcg_target_call_iarg_regs[mov[i].dst];
5911     }
5912 
5913     switch (nmov) {
5914     case 4:
5915         /* The backend must have provided enough temps for the worst case. */
5916         tcg_debug_assert(parm->ntmp >= 2);
5917 
5918         dst3 = mov[3].dst;
5919         for (unsigned j = 0; j < 3; ++j) {
5920             if (dst3 == mov[j].src) {
5921                 /*
5922                  * Conflict. Copy the source to a temporary, perform the
5923                  * remaining moves, then the extension from our scratch
5924                  * on the way out.
5925                  */
5926                 TCGReg scratch = parm->tmp[1];
5927 
5928                 tcg_out_mov(s, mov[3].src_type, scratch, mov[3].src);
5929                 tcg_out_movext3(s, mov, mov + 1, mov + 2, parm->tmp[0]);
5930                 tcg_out_movext1_new_src(s, &mov[3], scratch);
5931                 break;
5932             }
5933         }
5934 
5935         /* No conflicts: perform this move and continue. */
5936         tcg_out_movext1(s, &mov[3]);
5937         /* fall through */
5938 
5939     case 3:
5940         tcg_out_movext3(s, mov, mov + 1, mov + 2,
5941                         parm->ntmp ? parm->tmp[0] : -1);
5942         break;
5943     case 2:
5944         tcg_out_movext2(s, mov, mov + 1,
5945                         parm->ntmp ? parm->tmp[0] : -1);
5946         break;
5947     case 1:
5948         tcg_out_movext1(s, mov);
5949         break;
5950     default:
5951         g_assert_not_reached();
5952     }
5953 }
5954 
5955 static void tcg_out_helper_load_imm(TCGContext *s, unsigned slot,
5956                                     TCGType type, tcg_target_long imm,
5957                                     const TCGLdstHelperParam *parm)
5958 {
5959     if (arg_slot_reg_p(slot)) {
5960         tcg_out_movi(s, type, tcg_target_call_iarg_regs[slot], imm);
5961     } else {
5962         int ofs = tcg_out_helper_stk_ofs(type, slot);
5963         if (!tcg_out_sti(s, type, imm, TCG_REG_CALL_STACK, ofs)) {
5964             tcg_debug_assert(parm->ntmp != 0);
5965             tcg_out_movi(s, type, parm->tmp[0], imm);
5966             tcg_out_st(s, type, parm->tmp[0], TCG_REG_CALL_STACK, ofs);
5967         }
5968     }
5969 }
5970 
5971 static void tcg_out_helper_load_common_args(TCGContext *s,
5972                                             const TCGLabelQemuLdst *ldst,
5973                                             const TCGLdstHelperParam *parm,
5974                                             const TCGHelperInfo *info,
5975                                             unsigned next_arg)
5976 {
5977     TCGMovExtend ptr_mov = {
5978         .dst_type = TCG_TYPE_PTR,
5979         .src_type = TCG_TYPE_PTR,
5980         .src_ext = sizeof(void *) == 4 ? MO_32 : MO_64
5981     };
5982     const TCGCallArgumentLoc *loc = &info->in[0];
5983     TCGType type;
5984     unsigned slot;
5985     tcg_target_ulong imm;
5986 
5987     /*
5988      * Handle env, which is always first.
5989      */
5990     ptr_mov.dst = loc->arg_slot;
5991     ptr_mov.src = TCG_AREG0;
5992     tcg_out_helper_load_slots(s, 1, &ptr_mov, parm);
5993 
5994     /*
5995      * Handle oi.
5996      */
5997     imm = ldst->oi;
5998     loc = &info->in[next_arg];
5999     type = TCG_TYPE_I32;
6000     switch (loc->kind) {
6001     case TCG_CALL_ARG_NORMAL:
6002         break;
6003     case TCG_CALL_ARG_EXTEND_U:
6004     case TCG_CALL_ARG_EXTEND_S:
6005         /* No extension required for MemOpIdx. */
6006         tcg_debug_assert(imm <= INT32_MAX);
6007         type = TCG_TYPE_REG;
6008         break;
6009     default:
6010         g_assert_not_reached();
6011     }
6012     tcg_out_helper_load_imm(s, loc->arg_slot, type, imm, parm);
6013     next_arg++;
6014 
6015     /*
6016      * Handle ra.
6017      */
6018     loc = &info->in[next_arg];
6019     slot = loc->arg_slot;
6020     if (parm->ra_gen) {
6021         int arg_reg = -1;
6022         TCGReg ra_reg;
6023 
6024         if (arg_slot_reg_p(slot)) {
6025             arg_reg = tcg_target_call_iarg_regs[slot];
6026         }
6027         ra_reg = parm->ra_gen(s, ldst, arg_reg);
6028 
6029         ptr_mov.dst = slot;
6030         ptr_mov.src = ra_reg;
6031         tcg_out_helper_load_slots(s, 1, &ptr_mov, parm);
6032     } else {
6033         imm = (uintptr_t)ldst->raddr;
6034         tcg_out_helper_load_imm(s, slot, TCG_TYPE_PTR, imm, parm);
6035     }
6036 }
6037 
6038 static unsigned tcg_out_helper_add_mov(TCGMovExtend *mov,
6039                                        const TCGCallArgumentLoc *loc,
6040                                        TCGType dst_type, TCGType src_type,
6041                                        TCGReg lo, TCGReg hi)
6042 {
6043     MemOp reg_mo;
6044 
6045     if (dst_type <= TCG_TYPE_REG) {
6046         MemOp src_ext;
6047 
6048         switch (loc->kind) {
6049         case TCG_CALL_ARG_NORMAL:
6050             src_ext = src_type == TCG_TYPE_I32 ? MO_32 : MO_64;
6051             break;
6052         case TCG_CALL_ARG_EXTEND_U:
6053             dst_type = TCG_TYPE_REG;
6054             src_ext = MO_UL;
6055             break;
6056         case TCG_CALL_ARG_EXTEND_S:
6057             dst_type = TCG_TYPE_REG;
6058             src_ext = MO_SL;
6059             break;
6060         default:
6061             g_assert_not_reached();
6062         }
6063 
6064         mov[0].dst = loc->arg_slot;
6065         mov[0].dst_type = dst_type;
6066         mov[0].src = lo;
6067         mov[0].src_type = src_type;
6068         mov[0].src_ext = src_ext;
6069         return 1;
6070     }
6071 
6072     if (TCG_TARGET_REG_BITS == 32) {
6073         assert(dst_type == TCG_TYPE_I64);
6074         reg_mo = MO_32;
6075     } else {
6076         assert(dst_type == TCG_TYPE_I128);
6077         reg_mo = MO_64;
6078     }
6079 
6080     mov[0].dst = loc[HOST_BIG_ENDIAN].arg_slot;
6081     mov[0].src = lo;
6082     mov[0].dst_type = TCG_TYPE_REG;
6083     mov[0].src_type = TCG_TYPE_REG;
6084     mov[0].src_ext = reg_mo;
6085 
6086     mov[1].dst = loc[!HOST_BIG_ENDIAN].arg_slot;
6087     mov[1].src = hi;
6088     mov[1].dst_type = TCG_TYPE_REG;
6089     mov[1].src_type = TCG_TYPE_REG;
6090     mov[1].src_ext = reg_mo;
6091 
6092     return 2;
6093 }
6094 
6095 static void tcg_out_ld_helper_args(TCGContext *s, const TCGLabelQemuLdst *ldst,
6096                                    const TCGLdstHelperParam *parm)
6097 {
6098     const TCGHelperInfo *info;
6099     const TCGCallArgumentLoc *loc;
6100     TCGMovExtend mov[2];
6101     unsigned next_arg, nmov;
6102     MemOp mop = get_memop(ldst->oi);
6103 
6104     switch (mop & MO_SIZE) {
6105     case MO_8:
6106     case MO_16:
6107     case MO_32:
6108         info = &info_helper_ld32_mmu;
6109         break;
6110     case MO_64:
6111         info = &info_helper_ld64_mmu;
6112         break;
6113     case MO_128:
6114         info = &info_helper_ld128_mmu;
6115         break;
6116     default:
6117         g_assert_not_reached();
6118     }
6119 
6120     /* Defer env argument. */
6121     next_arg = 1;
6122 
6123     loc = &info->in[next_arg];
6124     if (TCG_TARGET_REG_BITS == 32 && s->addr_type == TCG_TYPE_I32) {
6125         /*
6126          * 32-bit host with 32-bit guest: zero-extend the guest address
6127          * to 64-bits for the helper by storing the low part, then
6128          * load a zero for the high part.
6129          */
6130         tcg_out_helper_add_mov(mov, loc + HOST_BIG_ENDIAN,
6131                                TCG_TYPE_I32, TCG_TYPE_I32,
6132                                ldst->addr_reg, -1);
6133         tcg_out_helper_load_slots(s, 1, mov, parm);
6134 
6135         tcg_out_helper_load_imm(s, loc[!HOST_BIG_ENDIAN].arg_slot,
6136                                 TCG_TYPE_I32, 0, parm);
6137         next_arg += 2;
6138     } else {
6139         nmov = tcg_out_helper_add_mov(mov, loc, TCG_TYPE_I64, s->addr_type,
6140                                       ldst->addr_reg, -1);
6141         tcg_out_helper_load_slots(s, nmov, mov, parm);
6142         next_arg += nmov;
6143     }
6144 
6145     switch (info->out_kind) {
6146     case TCG_CALL_RET_NORMAL:
6147     case TCG_CALL_RET_BY_VEC:
6148         break;
6149     case TCG_CALL_RET_BY_REF:
6150         /*
6151          * The return reference is in the first argument slot.
6152          * We need memory in which to return: re-use the top of stack.
6153          */
6154         {
6155             int ofs_slot0 = TCG_TARGET_CALL_STACK_OFFSET;
6156 
6157             if (arg_slot_reg_p(0)) {
6158                 tcg_out_addi_ptr(s, tcg_target_call_iarg_regs[0],
6159                                  TCG_REG_CALL_STACK, ofs_slot0);
6160             } else {
6161                 tcg_debug_assert(parm->ntmp != 0);
6162                 tcg_out_addi_ptr(s, parm->tmp[0],
6163                                  TCG_REG_CALL_STACK, ofs_slot0);
6164                 tcg_out_st(s, TCG_TYPE_PTR, parm->tmp[0],
6165                            TCG_REG_CALL_STACK, ofs_slot0);
6166             }
6167         }
6168         break;
6169     default:
6170         g_assert_not_reached();
6171     }
6172 
6173     tcg_out_helper_load_common_args(s, ldst, parm, info, next_arg);
6174 }
6175 
6176 static void tcg_out_ld_helper_ret(TCGContext *s, const TCGLabelQemuLdst *ldst,
6177                                   bool load_sign,
6178                                   const TCGLdstHelperParam *parm)
6179 {
6180     MemOp mop = get_memop(ldst->oi);
6181     TCGMovExtend mov[2];
6182     int ofs_slot0;
6183 
6184     switch (ldst->type) {
6185     case TCG_TYPE_I64:
6186         if (TCG_TARGET_REG_BITS == 32) {
6187             break;
6188         }
6189         /* fall through */
6190 
6191     case TCG_TYPE_I32:
6192         mov[0].dst = ldst->datalo_reg;
6193         mov[0].src = tcg_target_call_oarg_reg(TCG_CALL_RET_NORMAL, 0);
6194         mov[0].dst_type = ldst->type;
6195         mov[0].src_type = TCG_TYPE_REG;
6196 
6197         /*
6198          * If load_sign, then we allowed the helper to perform the
6199          * appropriate sign extension to tcg_target_ulong, and all
6200          * we need now is a plain move.
6201          *
6202          * If they do not, then we expect the relevant extension
6203          * instruction to be no more expensive than a move, and
6204          * we thus save the icache etc by only using one of two
6205          * helper functions.
6206          */
6207         if (load_sign || !(mop & MO_SIGN)) {
6208             if (TCG_TARGET_REG_BITS == 32 || ldst->type == TCG_TYPE_I32) {
6209                 mov[0].src_ext = MO_32;
6210             } else {
6211                 mov[0].src_ext = MO_64;
6212             }
6213         } else {
6214             mov[0].src_ext = mop & MO_SSIZE;
6215         }
6216         tcg_out_movext1(s, mov);
6217         return;
6218 
6219     case TCG_TYPE_I128:
6220         tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
6221         ofs_slot0 = TCG_TARGET_CALL_STACK_OFFSET;
6222         switch (TCG_TARGET_CALL_RET_I128) {
6223         case TCG_CALL_RET_NORMAL:
6224             break;
6225         case TCG_CALL_RET_BY_VEC:
6226             tcg_out_st(s, TCG_TYPE_V128,
6227                        tcg_target_call_oarg_reg(TCG_CALL_RET_BY_VEC, 0),
6228                        TCG_REG_CALL_STACK, ofs_slot0);
6229             /* fall through */
6230         case TCG_CALL_RET_BY_REF:
6231             tcg_out_ld(s, TCG_TYPE_I64, ldst->datalo_reg,
6232                        TCG_REG_CALL_STACK, ofs_slot0 + 8 * HOST_BIG_ENDIAN);
6233             tcg_out_ld(s, TCG_TYPE_I64, ldst->datahi_reg,
6234                        TCG_REG_CALL_STACK, ofs_slot0 + 8 * !HOST_BIG_ENDIAN);
6235             return;
6236         default:
6237             g_assert_not_reached();
6238         }
6239         break;
6240 
6241     default:
6242         g_assert_not_reached();
6243     }
6244 
6245     mov[0].dst = ldst->datalo_reg;
6246     mov[0].src =
6247         tcg_target_call_oarg_reg(TCG_CALL_RET_NORMAL, HOST_BIG_ENDIAN);
6248     mov[0].dst_type = TCG_TYPE_REG;
6249     mov[0].src_type = TCG_TYPE_REG;
6250     mov[0].src_ext = TCG_TARGET_REG_BITS == 32 ? MO_32 : MO_64;
6251 
6252     mov[1].dst = ldst->datahi_reg;
6253     mov[1].src =
6254         tcg_target_call_oarg_reg(TCG_CALL_RET_NORMAL, !HOST_BIG_ENDIAN);
6255     mov[1].dst_type = TCG_TYPE_REG;
6256     mov[1].src_type = TCG_TYPE_REG;
6257     mov[1].src_ext = TCG_TARGET_REG_BITS == 32 ? MO_32 : MO_64;
6258 
6259     tcg_out_movext2(s, mov, mov + 1, parm->ntmp ? parm->tmp[0] : -1);
6260 }
6261 
6262 static void tcg_out_st_helper_args(TCGContext *s, const TCGLabelQemuLdst *ldst,
6263                                    const TCGLdstHelperParam *parm)
6264 {
6265     const TCGHelperInfo *info;
6266     const TCGCallArgumentLoc *loc;
6267     TCGMovExtend mov[4];
6268     TCGType data_type;
6269     unsigned next_arg, nmov, n;
6270     MemOp mop = get_memop(ldst->oi);
6271 
6272     switch (mop & MO_SIZE) {
6273     case MO_8:
6274     case MO_16:
6275     case MO_32:
6276         info = &info_helper_st32_mmu;
6277         data_type = TCG_TYPE_I32;
6278         break;
6279     case MO_64:
6280         info = &info_helper_st64_mmu;
6281         data_type = TCG_TYPE_I64;
6282         break;
6283     case MO_128:
6284         info = &info_helper_st128_mmu;
6285         data_type = TCG_TYPE_I128;
6286         break;
6287     default:
6288         g_assert_not_reached();
6289     }
6290 
6291     /* Defer env argument. */
6292     next_arg = 1;
6293     nmov = 0;
6294 
6295     /* Handle addr argument. */
6296     loc = &info->in[next_arg];
6297     tcg_debug_assert(s->addr_type <= TCG_TYPE_REG);
6298     if (TCG_TARGET_REG_BITS == 32) {
6299         /*
6300          * 32-bit host (and thus 32-bit guest): zero-extend the guest address
6301          * to 64-bits for the helper by storing the low part.  Later,
6302          * after we have processed the register inputs, we will load a
6303          * zero for the high part.
6304          */
6305         tcg_out_helper_add_mov(mov, loc + HOST_BIG_ENDIAN,
6306                                TCG_TYPE_I32, TCG_TYPE_I32,
6307                                ldst->addr_reg, -1);
6308         next_arg += 2;
6309         nmov += 1;
6310     } else {
6311         n = tcg_out_helper_add_mov(mov, loc, TCG_TYPE_I64, s->addr_type,
6312                                    ldst->addr_reg, -1);
6313         next_arg += n;
6314         nmov += n;
6315     }
6316 
6317     /* Handle data argument. */
6318     loc = &info->in[next_arg];
6319     switch (loc->kind) {
6320     case TCG_CALL_ARG_NORMAL:
6321     case TCG_CALL_ARG_EXTEND_U:
6322     case TCG_CALL_ARG_EXTEND_S:
6323         n = tcg_out_helper_add_mov(mov + nmov, loc, data_type, ldst->type,
6324                                    ldst->datalo_reg, ldst->datahi_reg);
6325         next_arg += n;
6326         nmov += n;
6327         tcg_out_helper_load_slots(s, nmov, mov, parm);
6328         break;
6329 
6330     case TCG_CALL_ARG_BY_REF:
6331         tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
6332         tcg_debug_assert(data_type == TCG_TYPE_I128);
6333         tcg_out_st(s, TCG_TYPE_I64,
6334                    HOST_BIG_ENDIAN ? ldst->datahi_reg : ldst->datalo_reg,
6335                    TCG_REG_CALL_STACK, arg_slot_stk_ofs(loc[0].ref_slot));
6336         tcg_out_st(s, TCG_TYPE_I64,
6337                    HOST_BIG_ENDIAN ? ldst->datalo_reg : ldst->datahi_reg,
6338                    TCG_REG_CALL_STACK, arg_slot_stk_ofs(loc[1].ref_slot));
6339 
6340         tcg_out_helper_load_slots(s, nmov, mov, parm);
6341 
6342         if (arg_slot_reg_p(loc->arg_slot)) {
6343             tcg_out_addi_ptr(s, tcg_target_call_iarg_regs[loc->arg_slot],
6344                              TCG_REG_CALL_STACK,
6345                              arg_slot_stk_ofs(loc->ref_slot));
6346         } else {
6347             tcg_debug_assert(parm->ntmp != 0);
6348             tcg_out_addi_ptr(s, parm->tmp[0], TCG_REG_CALL_STACK,
6349                              arg_slot_stk_ofs(loc->ref_slot));
6350             tcg_out_st(s, TCG_TYPE_PTR, parm->tmp[0],
6351                        TCG_REG_CALL_STACK, arg_slot_stk_ofs(loc->arg_slot));
6352         }
6353         next_arg += 2;
6354         break;
6355 
6356     default:
6357         g_assert_not_reached();
6358     }
6359 
6360     if (TCG_TARGET_REG_BITS == 32) {
6361         /* Zero extend the address by loading a zero for the high part. */
6362         loc = &info->in[1 + !HOST_BIG_ENDIAN];
6363         tcg_out_helper_load_imm(s, loc->arg_slot, TCG_TYPE_I32, 0, parm);
6364     }
6365 
6366     tcg_out_helper_load_common_args(s, ldst, parm, info, next_arg);
6367 }
6368 
6369 int tcg_gen_code(TCGContext *s, TranslationBlock *tb, uint64_t pc_start)
6370 {
6371     int i, start_words, num_insns;
6372     TCGOp *op;
6373 
6374     if (unlikely(qemu_loglevel_mask(CPU_LOG_TB_OP)
6375                  && qemu_log_in_addr_range(pc_start))) {
6376         FILE *logfile = qemu_log_trylock();
6377         if (logfile) {
6378             fprintf(logfile, "OP:\n");
6379             tcg_dump_ops(s, logfile, false);
6380             fprintf(logfile, "\n");
6381             qemu_log_unlock(logfile);
6382         }
6383     }
6384 
6385 #ifdef CONFIG_DEBUG_TCG
6386     /* Ensure all labels referenced have been emitted.  */
6387     {
6388         TCGLabel *l;
6389         bool error = false;
6390 
6391         QSIMPLEQ_FOREACH(l, &s->labels, next) {
6392             if (unlikely(!l->present) && !QSIMPLEQ_EMPTY(&l->branches)) {
6393                 qemu_log_mask(CPU_LOG_TB_OP,
6394                               "$L%d referenced but not present.\n", l->id);
6395                 error = true;
6396             }
6397         }
6398         assert(!error);
6399     }
6400 #endif
6401 
6402     /* Do not reuse any EBB that may be allocated within the TB. */
6403     tcg_temp_ebb_reset_freed(s);
6404 
6405     tcg_optimize(s);
6406 
6407     reachable_code_pass(s);
6408     liveness_pass_0(s);
6409     liveness_pass_1(s);
6410 
6411     if (s->nb_indirects > 0) {
6412         if (unlikely(qemu_loglevel_mask(CPU_LOG_TB_OP_IND)
6413                      && qemu_log_in_addr_range(pc_start))) {
6414             FILE *logfile = qemu_log_trylock();
6415             if (logfile) {
6416                 fprintf(logfile, "OP before indirect lowering:\n");
6417                 tcg_dump_ops(s, logfile, false);
6418                 fprintf(logfile, "\n");
6419                 qemu_log_unlock(logfile);
6420             }
6421         }
6422 
6423         /* Replace indirect temps with direct temps.  */
6424         if (liveness_pass_2(s)) {
6425             /* If changes were made, re-run liveness.  */
6426             liveness_pass_1(s);
6427         }
6428     }
6429 
6430     if (unlikely(qemu_loglevel_mask(CPU_LOG_TB_OP_OPT)
6431                  && qemu_log_in_addr_range(pc_start))) {
6432         FILE *logfile = qemu_log_trylock();
6433         if (logfile) {
6434             fprintf(logfile, "OP after optimization and liveness analysis:\n");
6435             tcg_dump_ops(s, logfile, true);
6436             fprintf(logfile, "\n");
6437             qemu_log_unlock(logfile);
6438         }
6439     }
6440 
6441     /* Initialize goto_tb jump offsets. */
6442     tb->jmp_reset_offset[0] = TB_JMP_OFFSET_INVALID;
6443     tb->jmp_reset_offset[1] = TB_JMP_OFFSET_INVALID;
6444     tb->jmp_insn_offset[0] = TB_JMP_OFFSET_INVALID;
6445     tb->jmp_insn_offset[1] = TB_JMP_OFFSET_INVALID;
6446 
6447     tcg_reg_alloc_start(s);
6448 
6449     /*
6450      * Reset the buffer pointers when restarting after overflow.
6451      * TODO: Move this into translate-all.c with the rest of the
6452      * buffer management.  Having only this done here is confusing.
6453      */
6454     s->code_buf = tcg_splitwx_to_rw(tb->tc.ptr);
6455     s->code_ptr = s->code_buf;
6456     s->data_gen_ptr = NULL;
6457 
6458     QSIMPLEQ_INIT(&s->ldst_labels);
6459     s->pool_labels = NULL;
6460 
6461     start_words = s->insn_start_words;
6462     s->gen_insn_data =
6463         tcg_malloc(sizeof(uint64_t) * s->gen_tb->icount * start_words);
6464 
6465     tcg_out_tb_start(s);
6466 
6467     num_insns = -1;
6468     QTAILQ_FOREACH(op, &s->ops, link) {
6469         TCGOpcode opc = op->opc;
6470 
6471         switch (opc) {
6472         case INDEX_op_mov:
6473         case INDEX_op_mov_vec:
6474             tcg_reg_alloc_mov(s, op);
6475             break;
6476         case INDEX_op_dup_vec:
6477             tcg_reg_alloc_dup(s, op);
6478             break;
6479         case INDEX_op_insn_start:
6480             if (num_insns >= 0) {
6481                 size_t off = tcg_current_code_size(s);
6482                 s->gen_insn_end_off[num_insns] = off;
6483                 /* Assert that we do not overflow our stored offset.  */
6484                 assert(s->gen_insn_end_off[num_insns] == off);
6485             }
6486             num_insns++;
6487             for (i = 0; i < start_words; ++i) {
6488                 s->gen_insn_data[num_insns * start_words + i] =
6489                     tcg_get_insn_start_param(op, i);
6490             }
6491             break;
6492         case INDEX_op_discard:
6493             temp_dead(s, arg_temp(op->args[0]));
6494             break;
6495         case INDEX_op_set_label:
6496             tcg_reg_alloc_bb_end(s, s->reserved_regs);
6497             tcg_out_label(s, arg_label(op->args[0]));
6498             break;
6499         case INDEX_op_call:
6500             tcg_reg_alloc_call(s, op);
6501             break;
6502         case INDEX_op_exit_tb:
6503             tcg_out_exit_tb(s, op->args[0]);
6504             break;
6505         case INDEX_op_goto_tb:
6506             tcg_out_goto_tb(s, op->args[0]);
6507             break;
6508         case INDEX_op_dup2_vec:
6509             if (tcg_reg_alloc_dup2(s, op)) {
6510                 break;
6511             }
6512             /* fall through */
6513         default:
6514             /* Sanity check that we've not introduced any unhandled opcodes. */
6515             tcg_debug_assert(tcg_op_supported(opc, TCGOP_TYPE(op),
6516                                               TCGOP_FLAGS(op)));
6517             /* Note: in order to speed up the code, it would be much
6518                faster to have specialized register allocator functions for
6519                some common argument patterns */
6520             tcg_reg_alloc_op(s, op);
6521             break;
6522         }
6523         /* Test for (pending) buffer overflow.  The assumption is that any
6524            one operation beginning below the high water mark cannot overrun
6525            the buffer completely.  Thus we can test for overflow after
6526            generating code without having to check during generation.  */
6527         if (unlikely((void *)s->code_ptr > s->code_gen_highwater)) {
6528             return -1;
6529         }
6530         /* Test for TB overflow, as seen by gen_insn_end_off.  */
6531         if (unlikely(tcg_current_code_size(s) > UINT16_MAX)) {
6532             return -2;
6533         }
6534     }
6535     tcg_debug_assert(num_insns + 1 == s->gen_tb->icount);
6536     s->gen_insn_end_off[num_insns] = tcg_current_code_size(s);
6537 
6538     /* Generate TB finalization at the end of block */
6539     i = tcg_out_ldst_finalize(s);
6540     if (i < 0) {
6541         return i;
6542     }
6543     i = tcg_out_pool_finalize(s);
6544     if (i < 0) {
6545         return i;
6546     }
6547     if (!tcg_resolve_relocs(s)) {
6548         return -2;
6549     }
6550 
6551 #ifndef CONFIG_TCG_INTERPRETER
6552     /* flush instruction cache */
6553     flush_idcache_range((uintptr_t)tcg_splitwx_to_rx(s->code_buf),
6554                         (uintptr_t)s->code_buf,
6555                         tcg_ptr_byte_diff(s->code_ptr, s->code_buf));
6556 #endif
6557 
6558     return tcg_current_code_size(s);
6559 }
6560 
6561 #ifdef ELF_HOST_MACHINE
6562 /* In order to use this feature, the backend needs to do three things:
6563 
6564    (1) Define ELF_HOST_MACHINE to indicate both what value to
6565        put into the ELF image and to indicate support for the feature.
6566 
6567    (2) Define tcg_register_jit.  This should create a buffer containing
6568        the contents of a .debug_frame section that describes the post-
6569        prologue unwind info for the tcg machine.
6570 
6571    (3) Call tcg_register_jit_int, with the constructed .debug_frame.
6572 */
6573 
6574 /* Begin GDB interface.  THE FOLLOWING MUST MATCH GDB DOCS.  */
6575 typedef enum {
6576     JIT_NOACTION = 0,
6577     JIT_REGISTER_FN,
6578     JIT_UNREGISTER_FN
6579 } jit_actions_t;
6580 
6581 struct jit_code_entry {
6582     struct jit_code_entry *next_entry;
6583     struct jit_code_entry *prev_entry;
6584     const void *symfile_addr;
6585     uint64_t symfile_size;
6586 };
6587 
6588 struct jit_descriptor {
6589     uint32_t version;
6590     uint32_t action_flag;
6591     struct jit_code_entry *relevant_entry;
6592     struct jit_code_entry *first_entry;
6593 };
6594 
6595 void __jit_debug_register_code(void) __attribute__((noinline));
6596 void __jit_debug_register_code(void)
6597 {
6598     asm("");
6599 }
6600 
6601 /* Must statically initialize the version, because GDB may check
6602    the version before we can set it.  */
6603 struct jit_descriptor __jit_debug_descriptor = { 1, 0, 0, 0 };
6604 
6605 /* End GDB interface.  */
6606 
6607 static int find_string(const char *strtab, const char *str)
6608 {
6609     const char *p = strtab + 1;
6610 
6611     while (1) {
6612         if (strcmp(p, str) == 0) {
6613             return p - strtab;
6614         }
6615         p += strlen(p) + 1;
6616     }
6617 }
6618 
6619 static void tcg_register_jit_int(const void *buf_ptr, size_t buf_size,
6620                                  const void *debug_frame,
6621                                  size_t debug_frame_size)
6622 {
6623     struct __attribute__((packed)) DebugInfo {
6624         uint32_t  len;
6625         uint16_t  version;
6626         uint32_t  abbrev;
6627         uint8_t   ptr_size;
6628         uint8_t   cu_die;
6629         uint16_t  cu_lang;
6630         uintptr_t cu_low_pc;
6631         uintptr_t cu_high_pc;
6632         uint8_t   fn_die;
6633         char      fn_name[16];
6634         uintptr_t fn_low_pc;
6635         uintptr_t fn_high_pc;
6636         uint8_t   cu_eoc;
6637     };
6638 
6639     struct ElfImage {
6640         ElfW(Ehdr) ehdr;
6641         ElfW(Phdr) phdr;
6642         ElfW(Shdr) shdr[7];
6643         ElfW(Sym)  sym[2];
6644         struct DebugInfo di;
6645         uint8_t    da[24];
6646         char       str[80];
6647     };
6648 
6649     struct ElfImage *img;
6650 
6651     static const struct ElfImage img_template = {
6652         .ehdr = {
6653             .e_ident[EI_MAG0] = ELFMAG0,
6654             .e_ident[EI_MAG1] = ELFMAG1,
6655             .e_ident[EI_MAG2] = ELFMAG2,
6656             .e_ident[EI_MAG3] = ELFMAG3,
6657             .e_ident[EI_CLASS] = ELF_CLASS,
6658             .e_ident[EI_DATA] = ELF_DATA,
6659             .e_ident[EI_VERSION] = EV_CURRENT,
6660             .e_type = ET_EXEC,
6661             .e_machine = ELF_HOST_MACHINE,
6662             .e_version = EV_CURRENT,
6663             .e_phoff = offsetof(struct ElfImage, phdr),
6664             .e_shoff = offsetof(struct ElfImage, shdr),
6665             .e_ehsize = sizeof(ElfW(Shdr)),
6666             .e_phentsize = sizeof(ElfW(Phdr)),
6667             .e_phnum = 1,
6668             .e_shentsize = sizeof(ElfW(Shdr)),
6669             .e_shnum = ARRAY_SIZE(img->shdr),
6670             .e_shstrndx = ARRAY_SIZE(img->shdr) - 1,
6671 #ifdef ELF_HOST_FLAGS
6672             .e_flags = ELF_HOST_FLAGS,
6673 #endif
6674 #ifdef ELF_OSABI
6675             .e_ident[EI_OSABI] = ELF_OSABI,
6676 #endif
6677         },
6678         .phdr = {
6679             .p_type = PT_LOAD,
6680             .p_flags = PF_X,
6681         },
6682         .shdr = {
6683             [0] = { .sh_type = SHT_NULL },
6684             /* Trick: The contents of code_gen_buffer are not present in
6685                this fake ELF file; that got allocated elsewhere.  Therefore
6686                we mark .text as SHT_NOBITS (similar to .bss) so that readers
6687                will not look for contents.  We can record any address.  */
6688             [1] = { /* .text */
6689                 .sh_type = SHT_NOBITS,
6690                 .sh_flags = SHF_EXECINSTR | SHF_ALLOC,
6691             },
6692             [2] = { /* .debug_info */
6693                 .sh_type = SHT_PROGBITS,
6694                 .sh_offset = offsetof(struct ElfImage, di),
6695                 .sh_size = sizeof(struct DebugInfo),
6696             },
6697             [3] = { /* .debug_abbrev */
6698                 .sh_type = SHT_PROGBITS,
6699                 .sh_offset = offsetof(struct ElfImage, da),
6700                 .sh_size = sizeof(img->da),
6701             },
6702             [4] = { /* .debug_frame */
6703                 .sh_type = SHT_PROGBITS,
6704                 .sh_offset = sizeof(struct ElfImage),
6705             },
6706             [5] = { /* .symtab */
6707                 .sh_type = SHT_SYMTAB,
6708                 .sh_offset = offsetof(struct ElfImage, sym),
6709                 .sh_size = sizeof(img->sym),
6710                 .sh_info = 1,
6711                 .sh_link = ARRAY_SIZE(img->shdr) - 1,
6712                 .sh_entsize = sizeof(ElfW(Sym)),
6713             },
6714             [6] = { /* .strtab */
6715                 .sh_type = SHT_STRTAB,
6716                 .sh_offset = offsetof(struct ElfImage, str),
6717                 .sh_size = sizeof(img->str),
6718             }
6719         },
6720         .sym = {
6721             [1] = { /* code_gen_buffer */
6722                 .st_info = ELF_ST_INFO(STB_GLOBAL, STT_FUNC),
6723                 .st_shndx = 1,
6724             }
6725         },
6726         .di = {
6727             .len = sizeof(struct DebugInfo) - 4,
6728             .version = 2,
6729             .ptr_size = sizeof(void *),
6730             .cu_die = 1,
6731             .cu_lang = 0x8001,  /* DW_LANG_Mips_Assembler */
6732             .fn_die = 2,
6733             .fn_name = "code_gen_buffer"
6734         },
6735         .da = {
6736             1,          /* abbrev number (the cu) */
6737             0x11, 1,    /* DW_TAG_compile_unit, has children */
6738             0x13, 0x5,  /* DW_AT_language, DW_FORM_data2 */
6739             0x11, 0x1,  /* DW_AT_low_pc, DW_FORM_addr */
6740             0x12, 0x1,  /* DW_AT_high_pc, DW_FORM_addr */
6741             0, 0,       /* end of abbrev */
6742             2,          /* abbrev number (the fn) */
6743             0x2e, 0,    /* DW_TAG_subprogram, no children */
6744             0x3, 0x8,   /* DW_AT_name, DW_FORM_string */
6745             0x11, 0x1,  /* DW_AT_low_pc, DW_FORM_addr */
6746             0x12, 0x1,  /* DW_AT_high_pc, DW_FORM_addr */
6747             0, 0,       /* end of abbrev */
6748             0           /* no more abbrev */
6749         },
6750         .str = "\0" ".text\0" ".debug_info\0" ".debug_abbrev\0"
6751                ".debug_frame\0" ".symtab\0" ".strtab\0" "code_gen_buffer",
6752     };
6753 
6754     /* We only need a single jit entry; statically allocate it.  */
6755     static struct jit_code_entry one_entry;
6756 
6757     uintptr_t buf = (uintptr_t)buf_ptr;
6758     size_t img_size = sizeof(struct ElfImage) + debug_frame_size;
6759     DebugFrameHeader *dfh;
6760 
6761     img = g_malloc(img_size);
6762     *img = img_template;
6763 
6764     img->phdr.p_vaddr = buf;
6765     img->phdr.p_paddr = buf;
6766     img->phdr.p_memsz = buf_size;
6767 
6768     img->shdr[1].sh_name = find_string(img->str, ".text");
6769     img->shdr[1].sh_addr = buf;
6770     img->shdr[1].sh_size = buf_size;
6771 
6772     img->shdr[2].sh_name = find_string(img->str, ".debug_info");
6773     img->shdr[3].sh_name = find_string(img->str, ".debug_abbrev");
6774 
6775     img->shdr[4].sh_name = find_string(img->str, ".debug_frame");
6776     img->shdr[4].sh_size = debug_frame_size;
6777 
6778     img->shdr[5].sh_name = find_string(img->str, ".symtab");
6779     img->shdr[6].sh_name = find_string(img->str, ".strtab");
6780 
6781     img->sym[1].st_name = find_string(img->str, "code_gen_buffer");
6782     img->sym[1].st_value = buf;
6783     img->sym[1].st_size = buf_size;
6784 
6785     img->di.cu_low_pc = buf;
6786     img->di.cu_high_pc = buf + buf_size;
6787     img->di.fn_low_pc = buf;
6788     img->di.fn_high_pc = buf + buf_size;
6789 
6790     dfh = (DebugFrameHeader *)(img + 1);
6791     memcpy(dfh, debug_frame, debug_frame_size);
6792     dfh->fde.func_start = buf;
6793     dfh->fde.func_len = buf_size;
6794 
6795 #ifdef DEBUG_JIT
6796     /* Enable this block to be able to debug the ELF image file creation.
6797        One can use readelf, objdump, or other inspection utilities.  */
6798     {
6799         g_autofree char *jit = g_strdup_printf("%s/qemu.jit", g_get_tmp_dir());
6800         FILE *f = fopen(jit, "w+b");
6801         if (f) {
6802             if (fwrite(img, img_size, 1, f) != img_size) {
6803                 /* Avoid stupid unused return value warning for fwrite.  */
6804             }
6805             fclose(f);
6806         }
6807     }
6808 #endif
6809 
6810     one_entry.symfile_addr = img;
6811     one_entry.symfile_size = img_size;
6812 
6813     __jit_debug_descriptor.action_flag = JIT_REGISTER_FN;
6814     __jit_debug_descriptor.relevant_entry = &one_entry;
6815     __jit_debug_descriptor.first_entry = &one_entry;
6816     __jit_debug_register_code();
6817 }
6818 #else
6819 /* No support for the feature.  Provide the entry point expected by exec.c,
6820    and implement the internal function we declared earlier.  */
6821 
6822 static void tcg_register_jit_int(const void *buf, size_t size,
6823                                  const void *debug_frame,
6824                                  size_t debug_frame_size)
6825 {
6826 }
6827 
6828 void tcg_register_jit(const void *buf, size_t buf_size)
6829 {
6830 }
6831 #endif /* ELF_HOST_MACHINE */
6832 
6833 #if !TCG_TARGET_MAYBE_vec
6834 void tcg_expand_vec_op(TCGOpcode o, TCGType t, unsigned e, TCGArg a0, ...)
6835 {
6836     g_assert_not_reached();
6837 }
6838 #endif
6839