[PULL 000/110] Single binary patches

[PULL 000/110] Single binary patches

[Philippe Mathieu-Daudé]

The following changes since commit a85c588d07f8d3345ccad38b22026569a04571d1:

  Merge tag 'pull-monitor-2026-05-05' of https://repo.or.cz/qemu/armbru into staging (2026-05-05 10:11:49 -0400)

are available in the Git repository at:

  https://github.com/philmd/qemu.git tags/single-binary-20260506

for you to fetch changes up to 1927b5ec6ef486b3dfaecb885c5f093f85f6a65f:

  system/vl: inline qemu_opts_parse_noisily() result checks (2026-05-06 15:52:32 +0200)

----------------------------------------------------------------
Various patches related to single binary effort:

- Reduce "exec/cpu-defs.h" inclusions
- Build various target specific files once
- Remove need of per-target monitor handlers
- Reduce target_ulong uses in migration code
- Reduce uses of legacy native endianness & ld/st_phys APIs
- Removed MIPSCPU::mvp memory leak
- Clear dangling GLib event source tag
- Remove pointless variable initialization in *FOREACH*() macro uses
- Few checkpatch.pl updates

The following spurious checkpatch.pl error being deliberately ignored:

  Checking "target/mips: Reduce CPUState scope when used with CPU_FOREACH()"
  ERROR: space prohibited after that '&' (ctx:WxW)
  #44: FILE: target/mips/internal.h:294:
  +            ((other_env->CP0_VPControl >> CP0VPCtl_DIS) & 1)) {
                                                           ^
----------------------------------------------------------------

Akihiko Odaki (1):
  scripts/checkpatch: Avoid false positive on empty blocks

Bernhard Beschow (1):
  scripts/checkpatch: Reject another license boilerplate pattern

Bin Guo (1):
  system/vl: inline qemu_opts_parse_noisily() result checks

Peter Maydell (3):
  target/mips: Move 'mvp' field from CPUMIPSState to MIPSCPU
  target/mips: Free mvp in unrealize
  target/mips: Move count_clock to MIPSCPU struct

Philippe Mathieu-Daudé (100):
  monitor/hmp: : Include missing 'exec/target_long.h' header
  target-info: Include 'exec/cpu-defs.h' explicitly
  target/xtensa: Restrict inclusion of 'exec/cpu-defs.h' header
  target/hexagon: Include missing 'exec/target_long.h' header
  target/hppa: Include missing 'exec/target_long.h' header
  target/i386: Include missing 'exec/target_long.h' header
  target/m68k: Include missing 'exec/target_long.h' header
  target/mips: Include missing 'exec/target_long.h' header
  target/ppc: Include missing 'exec/target_long.h' header
  target/riscv: Include missing 'exec/target_long.h' header
  target/sparc: Include missing 'exec/target_long.h' header
  system/kvm_xen: Include missing 'exec/target_page.h' header
  target/s390x/tcg: Include missing '*cpu.h' headers
  exec/helper-head: Include missing 'exec/target_long.h' header
  target/cpu: Do not include 'exec/cpu-defs.h' anymore
  target/ppc/mmu: Remove unused hash32_store_hpte() helpers
  target/ppc/mmu: Restrict hash32_load_hpte() helpers scope
  target/sparc/monitor: Dump all registers as 32-bit
  monitor: Remove MonitorDef::type field and MD_TLONG / MD_I32
  monitor: Extract completion declarations to 'monitor/hmp-completion.h'
  target/loongarch: Replace legacy ldq_le_phys() ->
    address_space_ldq_le()
  configs/targets: Restrict the legacy ldst_phys() API on LoongArch64
  target/loongarch: Avoid target-specific migration headers in machine.c
  target/avr: Avoid target-specific migration headers in machine.c
  migration: Revert "Add VMSTATE_UINTTL_2DARRAY()"
  migration: Remove unused target-specific macros
  target/sparc: Inline qemu_get/put_betl()
  target/mips: Inline qemu_get/put_betls()
  target/i386: Expand VMSTATE_UINTTL_SUB_ARRAY for APX registers
  target/sparc: Replace VMSTATE_VARRAY_MULTIPLY -> VMSTATE_UINTTL_ARRAY
  cpus: Remove CPUClass::init_accel_cpu() left-over hook
  target/i386: Replace target_ulong -> uint64_t for TARGET_X86_64
  target/mips: Pass MemOpIdx argument to Load/Store Multiple helpers
  target/mips: Remove unnecessary target_ulong uses in LD/ST Multiple
  target/mips: Inline cpu_ld/st_mmuidx_ra() calls in LD/ST Multiple
  target/mips: Check alignment for microMIPS pre-R6 LD/ST multiple
  stubs: Rename monitor* -> qmp* files
  monitor/meson: Use SPICE with migration HMP commands
  monitor: Restrict monitor_set_cpu() method scope
  monitor: Make 'info via' a generic command
  monitor: Make Xen emulation commands generic ones
  system: Expose 'arch_init.h' as 'qemu/base-arch-defs.h'
  monitor: Introduce HMPCommand::arch_bitmask field
  hw/s390x: Reduce 'monitor/monitor.h' inclusions
  monitor: Do not check TARGET_S390X to build s390x commands
  monitor: Do not check TARGET_I386 to build target/i386/ commands
  monitor: Do not check TARGET_I386 to build 'info sgx' command
  monitor: Do not check TARGET_I386 to build 'info sev' command
  monitor: Do not check TARGET_I386/RISCV to build 'info mem' command
  monitor: Do not check multiple TARGET_* to build 'info tlb' command
  cpus: Introduce SysemuCPUOps::monitor_get_register() hook
  target/riscv: Register target_get_monitor_def in SysemuCPUOps
  monitor: Remove target_get_monitor_def()
  monitor: Have MonitorDef::get_value() always return int64_t type
  monitor: Reduce target-specific methods further
  monitor: Remove 'monitor/hmp-target.h' header
  monitor: Forward-declare the MonitorDef type
  cpus: Introduce SysemuCPUOps::monitor_defs hook
  target/i386: Replace target_monitor_defs -> SysemuCPUOps::monitor_defs
  target/m68k: Replace target_monitor_defs -> SysemuCPUOps::monitor_defs
  target/sparc: Replace target_monitor_defs ->
    SysemuCPUOps::monitor_defs
  monitor: Remove target_monitor_defs()
  monitor: Merge hmp-target.c code within hmp-cmds.c
  monitor: Remove hmp_info_pic() left-over declaration
  target/mips: Inline cpu_ld{uw,l}_code() calls in
    set_badinstr_registers
  accel/tcg: Remove non-explicit endian cpu_ld*_code() wrappers
  target/mips: Expand TCGv type as 32-bit for XBurst MXU
  target/mips: Expand TCGv type for 64-bit extensions
  target/mips: Pass MemOpIdx argument to Linked Load/Store helpers
  target/mips: Inline cpu_ld/st_mmuidx_ra() calls in Atomic LD/ST
    helpers
  target/mips: Inline translator_ld[uw,l,q]() calls
  target/mips: Remove last MO_TE use
  meson: Allow building with empty target_arch[] source set
  tcg: Include missing 'tcg/tcg-op-common.h' header in 'tcg-op-mem.h'
  target/microblaze: Fix endianness used to disassemble
  target/microblaze: Replace translator_ldl_swap() ->
    translator_ldl_end()
  target/microblaze: Introduce common system/user meson source set
  target/microblaze: Compile helper.c as common unit
  target/microblaze: Compile op_helper.c as common unit
  target/microblaze: Compile cpu.c as common unit
  target/microblaze: Include missing cpu-mmu-index.h header in
    translate.c
  target/microblaze: Compile translate.c as common unit
  target/s390x: Introduce common system/user meson source set
  target/s390x: Compile few files as common unit
  target/s390x: Compile translate.c as common unit
  target/s390x: Compile vec_helper.c as common unit
  target/s390x: Have MSA helper pass a mmu_idx argument
  target/s390x: Compile crypto_helper.c as common unit
  target/s390x: Replace cpu_stb_data_ra -> cpu_stb_mmu in STFLE opcode
  target/riscv: Iterate vCPUs using CPU_FOREACH() macro
  target/mips: Reduce CPUState scope when used with CPU_FOREACH()
  target/mips: Do not initialize variable used by CPU_FOREACH macro
  target/s390x: Do not compile KVM stubs for linux-user binary
  io: Clear dangling GLib event source tag
  io: use g_clear_handle_id() for GSource cleanup
  cocci: Do not initialize variable used by QLIST_FOREACH macro
  cocci: Do not initialize variable used by QSLIST_FOREACH macro
  cocci: Do not initialize variable used by QSIMPLEQ_FOREACH macro
  cocci: Do not initialize variable used by QTAILQ_FOREACH macro
  cocci: Do not initialize variable used by RAMBLOCK_FOREACH* macro

Pierrick Bouvier (4):
  hw/misc/allwinner-cpucfg.c: make compilation unit common
  meson.build: define stubs library per target base architecture
  target/arm: define stub library
  target/xtensa/core: register types using type_init

 MAINTAINERS                                   |   16 +-
 docs/devel/loads-stores.rst                   |   21 +-
 configs/targets/loongarch64-softmmu.mak       |    1 +
 meson.build                                   |   30 +-
 include/accel/tcg/cpu-ldst.h                  |   33 +-
 include/hw/core/cpu.h                         |    6 -
 include/hw/core/sysemu-cpu-ops.h              |   14 +
 include/hw/ppc/spapr_ovec.h                   |    2 +-
 include/hw/s390x/storage-attributes.h         |    4 -
 include/hw/s390x/storage-keys.h               |    3 -
 include/migration/cpu.h                       |   32 -
 include/monitor/hmp-completion.h              |   40 +
 include/monitor/hmp-target.h                  |   50 -
 include/monitor/hmp.h                         |   43 +-
 include/monitor/monitor.h                     |    1 -
 .../qemu/base-arch-defs.h                     |   10 +-
 include/qemu/typedefs.h                       |    1 +
 include/system/kvm_xen.h                      |    2 +
 include/tcg/tcg-op-mem.h                      |    2 +
 monitor/monitor-internal.h                    |   13 +-
 target/alpha/cpu.h                            |    1 -
 target/arm/cpu.h                              |    1 -
 target/avr/cpu.h                              |    1 -
 target/hexagon/cpu.h                          |    3 +-
 target/hexagon/mmvec/mmvec.h                  |    3 +
 target/hppa/cpu.h                             |    2 +-
 target/i386/cpu.h                             |   10 +-
 target/loongarch/cpu.h                        |    1 -
 target/m68k/cpu.h                             |    1 -
 target/microblaze/cpu.h                       |    8 -
 target/mips/cpu.h                             |    8 +-
 target/mips/helper.h                          |    4 +-
 target/mips/internal.h                        |   14 +-
 target/or1k/cpu.h                             |    1 -
 target/ppc/cpu.h                              |    2 +-
 target/ppc/mmu-hash32.h                       |   32 -
 target/riscv/cpu.h                            |    2 +-
 target/riscv/debug.h                          |    1 +
 target/riscv/internals.h                      |    3 +
 target/riscv/pmp.h                            |    1 +
 target/rx/cpu.h                               |    1 -
 target/s390x/cpu.h                            |    1 -
 target/s390x/tcg/tcg_s390x.h                  |    3 +
 target/sh4/cpu.h                              |    1 -
 target/sparc/cpu.h                            |    2 +-
 target/tricore/cpu.h                          |    1 -
 target/xtensa/cpu.h                           |    1 -
 target/xtensa/overlay_tool.h                  |    5 +-
 include/exec/helper-head.h.inc                |   15 +-
 accel/accel-common.c                          |   13 -
 block/blkdebug.c                              |    2 +-
 block/blkio.c                                 |    2 +-
 block/gluster.c                               |    4 +-
 chardev/char-hmp-cmds.c                       |    1 +
 ebpf/ebpf.c                                   |    2 +-
 hw/arm/virt-acpi-build.c                      |    2 +-
 hw/char/cmsdk-apb-uart.c                      |    5 +-
 hw/char/nrf51_uart.c                          |    5 +-
 hw/char/serial.c                              |    6 +-
 hw/char/stm32l4x5_usart.c                     |    5 +-
 hw/char/terminal3270.c                        |    5 +-
 hw/char/virtio-console.c                      |   10 +-
 hw/i386/kvm/xen-stubs.c                       |   12 +
 hw/i386/sgx-hmp-stub.c                        |   16 +
 hw/i386/sgx-stub.c                            |    6 -
 hw/i386/sgx.c                                 |    1 -
 hw/i386/xen/xen-hvm.c                         |    4 +-
 hw/mips/malta.c                               |    4 +-
 hw/misc/mips_cpc.c                            |    4 +-
 hw/misc/mos6522-stub.c                        |   16 +
 hw/misc/riscv_cmgcr.c                         |    1 +
 hw/pci/pci.c                                  |    2 +-
 hw/ppc/spapr.c                                |    2 +-
 hw/ppc/spapr_events.c                         |    4 +-
 hw/riscv/boot.c                               |    9 +-
 hw/riscv/riscv-iommu.c                        |    2 +-
 hw/s390x/s390-skeys.c                         |    2 +
 hw/s390x/s390-stattrib.c                      |    2 +
 hw/usb/redirect.c                             |    9 +-
 hw/vfio/cpr-legacy.c                          |    2 +-
 hw/vfio/listener.c                            |    4 +-
 hw/xen/xen_pt_config_init.c                   |    4 +-
 io/channel-websock.c                          |   21 +-
 migration/block-dirty-bitmap.c                |    2 +-
 migration/dirtyrate.c                         |    4 +-
 migration/migration-hmp-cmds.c                |    1 +
 monitor/hmp-cmds.c                            |   41 +-
 monitor/hmp-target.c                          |  124 --
 monitor/hmp.c                                 |   45 +-
 net/colo-compare.c                            |    4 +-
 net/net-hmp-cmds.c                            |    1 +
 net/net.c                                     |    2 +-
 net/passt.c                                   |    8 +-
 net/stream.c                                  |   15 +-
 net/stream_data.c                             |    5 +-
 net/vhost-user.c                              |    8 +-
 qom/qom-hmp-cmds.c                            |    1 +
 stubs/hmp-cmd-info_mem.c                      |   12 +
 stubs/hmp-cmd-info_sev.c                      |   16 +
 stubs/hmp-cmd-info_tlb.c                      |   12 +
 stubs/hmp-cmds-hw-s390x.c                     |   15 +
 stubs/hmp-cmds-target-i386.c                  |   13 +
 stubs/{monitor-arm-gic.c => qmp-arm-gic.c}    |    0
 ...or-cpu-s390x-kvm.c => qmp-cpu-s390x-kvm.c} |    0
 .../{monitor-cpu-s390x.c => qmp-cpu-s390x.c}  |    0
 stubs/{monitor-cpu.c => qmp-cpu.c}            |    0
 stubs/{monitor-i386-rtc.c => qmp-i386-rtc.c}  |    0
 stubs/{monitor-i386-sev.c => qmp-i386-sev.c}  |    0
 stubs/{monitor-i386-sgx.c => qmp-i386-sgx.c}  |    0
 stubs/{monitor-i386-xen.c => qmp-i386-xen.c}  |    0
 stubs/target-get-monitor-def.c                |   29 -
 stubs/target-monitor-defs.c                   |    7 -
 system/arch_init.c                            |    2 +-
 system/qdev-monitor.c                         |    3 +-
 system/runstate-hmp-cmds.c                    |    1 +
 system/vl.c                                   |   41 +-
 target-info-stub.c                            |    1 +
 target/avr/machine.c                          |    3 +-
 target/i386/cpu-apic.c                        |    1 -
 target/i386/cpu.c                             |   29 +
 target/i386/kvm/tdx-quote-generator.c         |    5 +-
 target/i386/machine.c                         |    2 +-
 target/i386/monitor.c                         |   26 -
 target/i386/sev-system-stub.c                 |    6 -
 target/i386/sev.c                             |    1 -
 target/loongarch/cpu_helper.c                 |   13 +-
 target/loongarch/machine.c                    |    2 +-
 target/loongarch/tcg/tlb_helper.c             |   10 +-
 target/m68k/cpu.c                             |   18 +
 target/m68k/m68k-semi.c                       |    2 +-
 target/m68k/monitor.c                         |   22 -
 target/microblaze/cpu.c                       |    6 +-
 target/microblaze/op_helper.c                 |    2 +-
 target/microblaze/translate.c                 |   11 +-
 target/mips/cpu.c                             |   18 +-
 target/mips/system/cp0_timer.c                |   12 +-
 target/mips/system/machine.c                  |   16 +-
 target/mips/tcg/lcsr_translate.c              |   16 +-
 target/mips/tcg/ldst_helper.c                 |  101 +-
 target/mips/tcg/loong_translate.c             |   92 +-
 target/mips/tcg/mxu_translate.c               | 1954 ++++++++---------
 target/mips/tcg/octeon_translate.c            |   60 +-
 target/mips/tcg/system/cp0_helper.c           |   63 +-
 target/mips/tcg/system/tlb_helper.c           |   25 +-
 target/mips/tcg/translate.c                   |   25 +-
 target/mips/tcg/tx79_translate.c              |   14 +-
 target/ppc/machine.c                          |    1 +
 target/ppc/mmu-hash32.c                       |   14 +
 target/ppc/monitor.c                          |    2 -
 target/riscv/cpu.c                            |    1 +
 target/riscv/monitor.c                        |   12 +-
 target/s390x/kvm/stsi-topology.c              |    2 +-
 target/s390x/tcg/crypto_helper.c              |   80 +-
 target/s390x/tcg/misc_helper.c                |    7 +-
 target/s390x/tcg/translate.c                  |    6 +-
 target/s390x/tcg/vec_helper.c                 |   34 +-
 target/sh4/monitor.c                          |    1 -
 target/sparc/cpu.c                            |   19 +
 target/sparc/machine.c                        |   24 +-
 target/sparc/monitor.c                        |   19 -
 target/xtensa/cpu.c                           |    1 +
 target/xtensa/monitor.c                       |    1 -
 trace/trace-hmp-cmds.c                        |    1 +
 ui/dbus-clipboard.c                           |    6 +-
 ui/input-barrier.c                            |    6 +-
 ui/ui-hmp-cmds.c                              |    1 +
 ui/vnc-auth-vencrypt.c                        |    6 +-
 ui/vnc-ws.c                                   |   12 +-
 target/mips/cpu-defs.c.inc                    |   10 +-
 target/mips/tcg/micromips_translate.c.inc     |   20 +-
 target/mips/tcg/mips16e_translate.c.inc       |    8 +-
 target/mips/tcg/nanomips_translate.c.inc      |    5 +-
 hmp-commands-info.hx                          |   26 +-
 hmp-commands.hx                               |   13 +-
 hw/i386/meson.build                           |    1 +
 hw/misc/meson.build                           |    3 +-
 migration/meson.build                         |    2 +-
 monitor/meson.build                           |    5 +-
 scripts/checkpatch.pl                         |    4 +-
 stubs/meson.build                             |   23 +-
 target/arm/meson.build                        |    8 +-
 target/arm/tcg/meson.build                    |    2 +-
 target/avr/meson.build                        |    3 +-
 target/loongarch/meson.build                  |    2 +-
 target/microblaze/meson.build                 |   12 +-
 target/s390x/kvm/meson.build                  |    2 +-
 target/s390x/meson.build                      |   25 +-
 target/s390x/tcg/meson.build                  |    8 +-
 188 files changed, 2018 insertions(+), 2030 deletions(-)
 create mode 100644 include/monitor/hmp-completion.h
 delete mode 100644 include/monitor/hmp-target.h
 rename system/arch_init.h => include/qemu/base-arch-defs.h (92%)
 create mode 100644 hw/i386/sgx-hmp-stub.c
 create mode 100644 hw/misc/mos6522-stub.c
 delete mode 100644 monitor/hmp-target.c
 create mode 100644 stubs/hmp-cmd-info_mem.c
 create mode 100644 stubs/hmp-cmd-info_sev.c
 create mode 100644 stubs/hmp-cmd-info_tlb.c
 create mode 100644 stubs/hmp-cmds-hw-s390x.c
 create mode 100644 stubs/hmp-cmds-target-i386.c
 rename stubs/{monitor-arm-gic.c => qmp-arm-gic.c} (100%)
 rename stubs/{monitor-cpu-s390x-kvm.c => qmp-cpu-s390x-kvm.c} (100%)
 rename stubs/{monitor-cpu-s390x.c => qmp-cpu-s390x.c} (100%)
 rename stubs/{monitor-cpu.c => qmp-cpu.c} (100%)
 rename stubs/{monitor-i386-rtc.c => qmp-i386-rtc.c} (100%)
 rename stubs/{monitor-i386-sev.c => qmp-i386-sev.c} (100%)
 rename stubs/{monitor-i386-sgx.c => qmp-i386-sgx.c} (100%)
 rename stubs/{monitor-i386-xen.c => qmp-i386-xen.c} (100%)
 delete mode 100644 stubs/target-get-monitor-def.c
 delete mode 100644 stubs/target-monitor-defs.c

-- 
2.53.0

[PULL 001/110] monitor/hmp: : Include missing 'exec/target_long.h' header

[Philippe Mathieu-Daudé]

The "exec/target_long.h" header is indirectly included, pulled
via "cpu.h" -> "exec/cpu-defs.h". Include it explicitly otherwise
we'd get when removing the latter:

  monitor/hmp-target.h:35:5: error: type name requires a specifier or qualifier
     35 |     target_long (*get_value)(Monitor *mon, const struct MonitorDef *md,
        |     ^

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260427080738.77138-2-philmd@linaro.org>
---
 include/monitor/hmp-target.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/monitor/hmp-target.h b/include/monitor/hmp-target.h
index 5167d17d41d..898473b3ed0 100644
--- a/include/monitor/hmp-target.h
+++ b/include/monitor/hmp-target.h
@@ -28,7 +28,7 @@
 typedef struct MonitorDef MonitorDef;
 
 #ifdef COMPILING_PER_TARGET
-#include "cpu.h"
+#include "exec/target_long.h"
 struct MonitorDef {
     const char *name;
     int offset;
-- 
2.53.0

[PULL 002/110] target-info: Include 'exec/cpu-defs.h' explicitly

[Philippe Mathieu-Daudé]

The "exec/target_long.h" header is indirectly included, pulled
via "cpu.h" -> "exec/cpu-defs.h". Include it explicitly otherwise
we'd get when removing the latter:

  ../target-info-stub.c:39:23: error: use of undeclared identifier 'TARGET_PAGE_BITS'
     39 |     .page_bits_init = TARGET_PAGE_BITS,
        |                       ^

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-6-philmd@linaro.org>
---
 target-info-stub.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target-info-stub.c b/target-info-stub.c
index f5896a72621..07d8647ed8e 100644
--- a/target-info-stub.c
+++ b/target-info-stub.c
@@ -11,6 +11,7 @@
 #include "qemu/target-info-impl.h"
 #include "hw/core/boards.h"
 #include "cpu.h"
+#include "exec/cpu-defs.h"
 #include "exec/page-vary.h"
 
 /* Validate correct placement of CPUArchState. */
-- 
2.53.0

[PULL 003/110] target/xtensa: Restrict inclusion of 'exec/cpu-defs.h' header

[Philippe Mathieu-Daudé]

Not all files including "target/xtensa/cpu.h" require the
"exec/cpu-defs.h": only 'cpu.c'. Restrict to it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-7-philmd@linaro.org>
---
 target/xtensa/cpu.h | 1 -
 target/xtensa/cpu.c | 1 +
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/xtensa/cpu.h b/target/xtensa/cpu.h
index 22192924841..dfd2ceab7cf 100644
--- a/target/xtensa/cpu.h
+++ b/target/xtensa/cpu.h
@@ -31,7 +31,6 @@
 #include "cpu-qom.h"
 #include "qemu/cpu-float.h"
 #include "exec/cpu-common.h"
-#include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "hw/core/clock.h"
 #include "xtensa-isa.h"
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index eebf40559bc..31429ec2f87 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -30,6 +30,7 @@
 
 #include "qemu/osdep.h"
 #include "qapi/error.h"
+#include "exec/cpu-defs.h"
 #include "cpu.h"
 #include "fpu/softfloat.h"
 #include "qemu/module.h"
-- 
2.53.0

[PULL 004/110] target/hexagon: Include missing 'exec/target_long.h' header

[Philippe Mathieu-Daudé]

The "exec/target_long.h" header is indirectly included, pulled
via "exec/cpu-defs.h". Include it explicitly otherwise we'd get
when removing the latter:

  ../target/hexagon/cpu.h:76:5: error: unknown type name ‘target_ulong’
     76 |     target_ulong gpr[TOTAL_PER_THREAD_REGS];
        |     ^~~~~~~~~~~~
  ../target/hexagon/mmvec/mmvec.h:69:5: error: unknown type name ‘target_ulong’
     69 |     target_ulong va[MAX_VEC_SIZE_BYTES];
        |     ^~~~~~~~~~~~

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-8-philmd@linaro.org>
---
 target/hexagon/cpu.h         | 2 ++
 target/hexagon/mmvec/mmvec.h | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/target/hexagon/cpu.h b/target/hexagon/cpu.h
index f99647dfb61..faa07a6e05b 100644
--- a/target/hexagon/cpu.h
+++ b/target/hexagon/cpu.h
@@ -23,9 +23,11 @@
 #include "cpu-qom.h"
 #include "exec/cpu-common.h"
 #include "exec/cpu-defs.h"
+#include "exec/target_long.h"
 #include "hex_regs.h"
 #include "mmvec/mmvec.h"
 #include "hw/core/registerfields.h"
+#include "qemu/bitmap.h"
 
 #ifndef CONFIG_USER_ONLY
 #error "Hexagon does not support system emulation"
diff --git a/target/hexagon/mmvec/mmvec.h b/target/hexagon/mmvec/mmvec.h
index 52d470709c0..4a4f6cc9805 100644
--- a/target/hexagon/mmvec/mmvec.h
+++ b/target/hexagon/mmvec/mmvec.h
@@ -18,6 +18,9 @@
 #ifndef HEXAGON_MMVEC_H
 #define HEXAGON_MMVEC_H
 
+#include "exec/target_long.h"
+#include "qemu/bitmap.h"
+
 #define MAX_VEC_SIZE_LOGBYTES 7
 #define MAX_VEC_SIZE_BYTES  (1 << MAX_VEC_SIZE_LOGBYTES)
 
-- 
2.53.0

[PULL 005/110] target/hppa: Include missing 'exec/target_long.h' header

[Philippe Mathieu-Daudé]

The "exec/target_long.h" header is indirectly included, pulled
via "exec/cpu-defs.h". Include it explicitly otherwise we'd get
when removing the latter:

  target/hppa/cpu.h:375:1: error: unknown type name 'target_ulong'
    375 | target_ulong cpu_hppa_get_psw(CPUHPPAState *env);
        | ^

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-9-philmd@linaro.org>
---
 target/hppa/cpu.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/hppa/cpu.h b/target/hppa/cpu.h
index 7d47afe8efa..6ea4c9b6826 100644
--- a/target/hppa/cpu.h
+++ b/target/hppa/cpu.h
@@ -24,6 +24,7 @@
 #include "exec/cpu-common.h"
 #include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
+#include "exec/target_long.h"
 #include "system/memory.h"
 #include "qemu/cpu-float.h"
 #include "qemu/interval-tree.h"
-- 
2.53.0

[PULL 006/110] target/i386: Include missing 'exec/target_long.h' header

[Philippe Mathieu-Daudé]

The "exec/target_long.h" header is indirectly included, pulled
via "exec/cpu-defs.h". Include it explicitly otherwise we'd get
when removing the latter:

  ../target/i386/cpu.h:2777:43: error: unknown type name 'target_ulong'
   2777 | void cpu_x86_update_cr3(CPUX86State *env, target_ulong new_cr3);
        |                                           ^

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-10-philmd@linaro.org>
---
 target/i386/cpu.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 16de67e5464..fd8d98a4bdd 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -26,6 +26,7 @@
 #include "exec/cpu-common.h"
 #include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
+#include "exec/target_long.h"
 #include "exec/memop.h"
 #include "hw/i386/apic.h"
 #include "hw/i386/topology.h"
-- 
2.53.0

[PULL 007/110] target/m68k: Include missing 'exec/target_long.h' header

[Philippe Mathieu-Daudé]

The "exec/target_long.h" header is indirectly included, pulled
via "exec/cpu-defs.h". Include it explicitly otherwise we'd get
when removing the latter:

  ../target/m68k/m68k-semi.c:53:5: error: use of undeclared identifier 'target_ulong'
     53 |     target_ulong args = env->dregs[1];
        |     ^

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-11-philmd@linaro.org>
---
 target/m68k/m68k-semi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/m68k/m68k-semi.c b/target/m68k/m68k-semi.c
index bdc798a28cb..d2a071ea677 100644
--- a/target/m68k/m68k-semi.c
+++ b/target/m68k/m68k-semi.c
@@ -22,7 +22,7 @@
  */
 
 #include "qemu/osdep.h"
-
+#include "exec/target_long.h"
 #include "cpu.h"
 #include "gdbstub/syscalls.h"
 #include "gdbstub/helpers.h"
-- 
2.53.0

[PULL 008/110] target/mips: Include missing 'exec/target_long.h' header

[Philippe Mathieu-Daudé]

The "exec/target_long.h" header is indirectly included, pulled
via "exec/cpu-defs.h". Include it explicitly otherwise we'd get
when removing the latter:

  target/mips/cpu.h:462:5: error: unknown type name 'target_ulong'
    462 |     target_ulong gpr[32];
        |     ^

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-12-philmd@linaro.org>
---
 target/mips/cpu.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/mips/cpu.h b/target/mips/cpu.h
index ed662135cb0..3517d2d42cf 100644
--- a/target/mips/cpu.h
+++ b/target/mips/cpu.h
@@ -5,6 +5,7 @@
 #include "exec/cpu-common.h"
 #include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
+#include "exec/target_long.h"
 #ifndef CONFIG_USER_ONLY
 #include "system/memory.h"
 #endif
-- 
2.53.0

[PULL 009/110] target/ppc: Include missing 'exec/target_long.h' header

[Philippe Mathieu-Daudé]

The "exec/target_long.h" header is indirectly included, pulled
via "exec/cpu-defs.h". Include it explicitly otherwise we'd get
when removing the latter:

  target/ppc/cpu.h:1281:5: error: unknown type name 'target_ulong'
   1281 |     target_ulong gpr[32];  /* general purpose registers */
        |     ^
  hw/ppc/spapr_ovec.h:76:44: error: unknown type name 'target_ulong'
         76 | SpaprOptionVector *spapr_ovec_parse_vector(target_ulong table_addr, int vector);
            |                                            ^

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-13-philmd@linaro.org>
---
 include/hw/ppc/spapr_ovec.h | 2 +-
 target/ppc/cpu.h            | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/hw/ppc/spapr_ovec.h b/include/hw/ppc/spapr_ovec.h
index c3e8b98e7e2..8d67f492d02 100644
--- a/include/hw/ppc/spapr_ovec.h
+++ b/include/hw/ppc/spapr_ovec.h
@@ -37,7 +37,7 @@
 #ifndef SPAPR_OVEC_H
 #define SPAPR_OVEC_H
 
-#include "cpu.h"
+#include "exec/target_long.h"
 
 typedef struct SpaprOptionVector SpaprOptionVector;
 
diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index d637a50798f..a0df7a467ed 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -25,6 +25,7 @@
 #include "exec/cpu-common.h"
 #include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
+#include "exec/target_long.h"
 #include "cpu-qom.h"
 #include "qom/object.h"
 #include "hw/core/registerfields.h"
-- 
2.53.0

[PULL 010/110] target/riscv: Include missing 'exec/target_long.h' header

[Philippe Mathieu-Daudé]

The "exec/target_long.h" header is indirectly included, pulled
via "exec/cpu-defs.h". Include it explicitly otherwise we'd get
when removing the latter:

  ../target/riscv/cpu.h:605:1: error: unknown type name ‘target_ulong’
    605 | target_ulong riscv_cpu_get_geilen(CPURISCVState *env);
        | ^~~~~~~~~~~~
  ../target/riscv/pmp.h:73:1: error: unknown type name 'target_ulong'
     73 | target_ulong mseccfg_csr_read(CPURISCVState *env);
        | ^
  ../target/riscv/debug.h:139:1: error: unknown type name 'target_ulong'
    139 | target_ulong tselect_csr_read(CPURISCVState *env);
        | ^
  ../hw/misc/riscv_cmgcr.c:112:15: error: unknown type name 'target_ulong'
    112 | static inline target_ulong get_exception_base(RISCVGCRVPState *vps)
        |               ^

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-14-philmd@linaro.org>
---
 target/riscv/cpu.h    | 1 +
 target/riscv/debug.h  | 1 +
 target/riscv/pmp.h    | 1 +
 hw/misc/riscv_cmgcr.c | 1 +
 4 files changed, 4 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 81c41e34296..df55a77c403 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -27,6 +27,7 @@
 #include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "exec/gdbstub.h"
+#include "exec/target_long.h"
 #include "qemu/cpu-float.h"
 #include "qom/object.h"
 #include "qemu/int128.h"
diff --git a/target/riscv/debug.h b/target/riscv/debug.h
index f76b8f944a2..066e9c585f1 100644
--- a/target/riscv/debug.h
+++ b/target/riscv/debug.h
@@ -23,6 +23,7 @@
 #define RISCV_DEBUG_H
 
 #include "exec/breakpoint.h"
+#include "exec/target_long.h"
 
 #define RV_MAX_TRIGGERS         2
 
diff --git a/target/riscv/pmp.h b/target/riscv/pmp.h
index 467fb6b4b1c..17307ef88af 100644
--- a/target/riscv/pmp.h
+++ b/target/riscv/pmp.h
@@ -22,6 +22,7 @@
 #ifndef RISCV_PMP_H
 #define RISCV_PMP_H
 
+#include "exec/target_long.h"
 #include "cpu.h"
 
 typedef enum {
diff --git a/hw/misc/riscv_cmgcr.c b/hw/misc/riscv_cmgcr.c
index ab9b6c7d878..0390996f78b 100644
--- a/hw/misc/riscv_cmgcr.c
+++ b/hw/misc/riscv_cmgcr.c
@@ -19,6 +19,7 @@
 #include "migration/vmstate.h"
 #include "hw/misc/riscv_cmgcr.h"
 #include "hw/core/qdev-properties.h"
+#include "exec/target_page.h"
 
 #include "target/riscv/cpu.h"
 
-- 
2.53.0

[PULL 011/110] target/sparc: Include missing 'exec/target_long.h' header

[Philippe Mathieu-Daudé]

The "exec/target_long.h" header is indirectly included, pulled
via "exec/cpu-defs.h". Include it explicitly otherwise we'd get
when removing the latter:

  ../target/sparc/cpu.h:615:1: error: unknown type name 'target_ulong'
    615 | target_ulong cpu_get_fsr(CPUSPARCState *);
        | ^

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-15-philmd@linaro.org>
---
 target/sparc/cpu.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/sparc/cpu.h b/target/sparc/cpu.h
index 0139732e4cc..155aa8ec637 100644
--- a/target/sparc/cpu.h
+++ b/target/sparc/cpu.h
@@ -5,6 +5,7 @@
 #include "cpu-qom.h"
 #include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
+#include "exec/target_long.h"
 #include "qemu/cpu-float.h"
 
 #if !defined(TARGET_SPARC64)
-- 
2.53.0

[PULL 012/110] system/kvm_xen: Include missing 'exec/target_page.h' header

[Philippe Mathieu-Daudé]

The "exec/target_page.h" header is indirectly included. Include
it explicitly otherwise we get when refactoring unrelated headers:

  include/system/kvm_xen.h:41:55: error: ‘TARGET_PAGE_BITS’ undeclared (first use in this function)
     41 | #define XEN_SPECIAL_PFN(x) ((XEN_SPECIAL_AREA_ADDR >> TARGET_PAGE_BITS) + \
        |                                                       ^~~~~~~~~~~~~~~~

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-16-philmd@linaro.org>
---
 include/system/kvm_xen.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/system/kvm_xen.h b/include/system/kvm_xen.h
index 7d0e69f1334..ed8c357193c 100644
--- a/include/system/kvm_xen.h
+++ b/include/system/kvm_xen.h
@@ -12,6 +12,8 @@
 #ifndef QEMU_SYSTEM_KVM_XEN_H
 #define QEMU_SYSTEM_KVM_XEN_H
 
+#include "exec/target_page.h"
+
 /* The KVM API uses these to indicate "no GPA" or "no GFN" */
 #define INVALID_GPA UINT64_MAX
 #define INVALID_GFN UINT64_MAX
-- 
2.53.0

[PULL 013/110] target/s390x/tcg: Include missing '*cpu.h' headers

[Philippe Mathieu-Daudé]

The "hw/core/cpu.h" header (declaring run_on_cpu_data) and
"target/s390x/cpu.h" are indirectly included. Include them
explicitly otherwise we get when refactoring unrelated headers:

  ../target/s390x/tcg/tcg_s390x.h:17:44: error: unknown type name 'CPUS390XState'; did you mean 'CPUSH4State'?
     17 | G_NORETURN void tcg_s390_program_interrupt(CPUS390XState *env,
        |                                            ^~~~~~~~~~~~~
        |                                            CPUSH4State

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-18-philmd@linaro.org>
---
 target/s390x/tcg/tcg_s390x.h | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/s390x/tcg/tcg_s390x.h b/target/s390x/tcg/tcg_s390x.h
index 7c8aede80d2..975f60085ac 100644
--- a/target/s390x/tcg/tcg_s390x.h
+++ b/target/s390x/tcg/tcg_s390x.h
@@ -13,6 +13,9 @@
 #ifndef TCG_S390X_H
 #define TCG_S390X_H
 
+#include "target/s390x/cpu.h"
+#include "hw/core/cpu.h"
+
 void tcg_s390_tod_updated(CPUState *cs, run_on_cpu_data opaque);
 G_NORETURN void tcg_s390_program_interrupt(CPUS390XState *env,
                                            uint32_t code, uintptr_t ra);
-- 
2.53.0

[PULL 014/110] exec/helper-head: Include missing 'exec/target_long.h' header

[Philippe Mathieu-Daudé]

TARGET_LONG_BITS is defined in "exec/target_long.h" (which
is currently included implicitly by various headers).

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-19-philmd@linaro.org>
---
 include/exec/helper-head.h.inc | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/include/exec/helper-head.h.inc b/include/exec/helper-head.h.inc
index 5b248fd7138..7dec5f5b067 100644
--- a/include/exec/helper-head.h.inc
+++ b/include/exec/helper-head.h.inc
@@ -46,14 +46,13 @@
 #define dh_ctype(t) dh_ctype_##t
 
 #ifdef COMPILING_PER_TARGET
-# ifdef TARGET_LONG_BITS
-#  if TARGET_LONG_BITS == 32
-#   define dh_alias_tl i32
-#   define dh_typecode_tl dh_typecode_i32
-#  else
-#   define dh_alias_tl i64
-#   define dh_typecode_tl dh_typecode_i64
-#  endif
+# include "exec/target_long.h"
+# if TARGET_LONG_BITS == 32
+#  define dh_alias_tl i32
+#  define dh_typecode_tl dh_typecode_i32
+# else
+#  define dh_alias_tl i64
+#  define dh_typecode_tl dh_typecode_i64
 # endif
 # define dh_ctype_tl target_ulong
 #endif /* COMPILING_PER_TARGET */
-- 
2.53.0

[PULL 015/110] target/cpu: Do not include 'exec/cpu-defs.h' anymore

[Philippe Mathieu-Daudé]

Nothing in all our target "cpu.h" directly uses definitions
from "exec/cpu-defs.h": no need to include it there. This
remove a lot of target-specificities, simplifying inclusion
of target "cpu.h" by common code.

Inspired-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-20-philmd@linaro.org>
---
 target/alpha/cpu.h      | 1 -
 target/arm/cpu.h        | 1 -
 target/avr/cpu.h        | 1 -
 target/hexagon/cpu.h    | 1 -
 target/hppa/cpu.h       | 1 -
 target/i386/cpu.h       | 1 -
 target/loongarch/cpu.h  | 1 -
 target/m68k/cpu.h       | 1 -
 target/microblaze/cpu.h | 1 -
 target/mips/cpu.h       | 1 -
 target/or1k/cpu.h       | 1 -
 target/ppc/cpu.h        | 1 -
 target/riscv/cpu.h      | 1 -
 target/rx/cpu.h         | 1 -
 target/s390x/cpu.h      | 1 -
 target/sh4/cpu.h        | 1 -
 target/sparc/cpu.h      | 1 -
 target/tricore/cpu.h    | 1 -
 18 files changed, 18 deletions(-)

diff --git a/target/alpha/cpu.h b/target/alpha/cpu.h
index b530cd0088b..2f611397782 100644
--- a/target/alpha/cpu.h
+++ b/target/alpha/cpu.h
@@ -22,7 +22,6 @@
 
 #include "cpu-qom.h"
 #include "exec/cpu-common.h"
-#include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "qemu/cpu-float.h"
 
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 5e4f12f1e77..0b9755533b0 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -25,7 +25,6 @@
 #include "hw/core/registerfields.h"
 #include "cpu-qom.h"
 #include "exec/cpu-common.h"
-#include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "exec/gdbstub.h"
 #include "exec/page-protection.h"
diff --git a/target/avr/cpu.h b/target/avr/cpu.h
index 518e243d812..3da885c7ccb 100644
--- a/target/avr/cpu.h
+++ b/target/avr/cpu.h
@@ -23,7 +23,6 @@
 
 #include "cpu-qom.h"
 #include "exec/cpu-common.h"
-#include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "system/memory.h"
 
diff --git a/target/hexagon/cpu.h b/target/hexagon/cpu.h
index faa07a6e05b..7c09c97db85 100644
--- a/target/hexagon/cpu.h
+++ b/target/hexagon/cpu.h
@@ -22,7 +22,6 @@
 
 #include "cpu-qom.h"
 #include "exec/cpu-common.h"
-#include "exec/cpu-defs.h"
 #include "exec/target_long.h"
 #include "hex_regs.h"
 #include "mmvec/mmvec.h"
diff --git a/target/hppa/cpu.h b/target/hppa/cpu.h
index 6ea4c9b6826..85f39401423 100644
--- a/target/hppa/cpu.h
+++ b/target/hppa/cpu.h
@@ -22,7 +22,6 @@
 
 #include "cpu-qom.h"
 #include "exec/cpu-common.h"
-#include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "exec/target_long.h"
 #include "system/memory.h"
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index fd8d98a4bdd..f57c99e8b4e 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -24,7 +24,6 @@
 #include "cpu-qom.h"
 #include "kvm/hyperv-proto.h"
 #include "exec/cpu-common.h"
-#include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "exec/target_long.h"
 #include "exec/memop.h"
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index 4d333806ed8..096d7789285 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -10,7 +10,6 @@
 
 #include "qemu/int128.h"
 #include "exec/cpu-common.h"
-#include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "fpu/softfloat-types.h"
 #include "hw/core/registerfields.h"
diff --git a/target/m68k/cpu.h b/target/m68k/cpu.h
index 7911ab9de30..d7f508a9e80 100644
--- a/target/m68k/cpu.h
+++ b/target/m68k/cpu.h
@@ -22,7 +22,6 @@
 #define M68K_CPU_H
 
 #include "exec/cpu-common.h"
-#include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "qemu/cpu-float.h"
 #include "cpu-qom.h"
diff --git a/target/microblaze/cpu.h b/target/microblaze/cpu.h
index 5a856edaaa9..5765786e6dc 100644
--- a/target/microblaze/cpu.h
+++ b/target/microblaze/cpu.h
@@ -22,7 +22,6 @@
 
 #include "cpu-qom.h"
 #include "exec/cpu-common.h"
-#include "exec/cpu-defs.h"
 #include "qemu/cpu-float.h"
 #include "exec/cpu-interrupt.h"
 
diff --git a/target/mips/cpu.h b/target/mips/cpu.h
index 3517d2d42cf..17e9f6039ec 100644
--- a/target/mips/cpu.h
+++ b/target/mips/cpu.h
@@ -3,7 +3,6 @@
 
 #include "cpu-qom.h"
 #include "exec/cpu-common.h"
-#include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "exec/target_long.h"
 #ifndef CONFIG_USER_ONLY
diff --git a/target/or1k/cpu.h b/target/or1k/cpu.h
index c8e2827930b..5bb39b67519 100644
--- a/target/or1k/cpu.h
+++ b/target/or1k/cpu.h
@@ -22,7 +22,6 @@
 
 #include "cpu-qom.h"
 #include "exec/cpu-common.h"
-#include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "fpu/softfloat-types.h"
 
diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index a0df7a467ed..aba8109bbba 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -23,7 +23,6 @@
 #include "qemu/int128.h"
 #include "qemu/cpu-float.h"
 #include "exec/cpu-common.h"
-#include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "exec/target_long.h"
 #include "cpu-qom.h"
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index df55a77c403..e42f3694089 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -24,7 +24,6 @@
 #include "hw/core/registerfields.h"
 #include "hw/core/qdev-properties.h"
 #include "exec/cpu-common.h"
-#include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "exec/gdbstub.h"
 #include "exec/target_long.h"
diff --git a/target/rx/cpu.h b/target/rx/cpu.h
index b3b1ecff5af..b500b7a2474 100644
--- a/target/rx/cpu.h
+++ b/target/rx/cpu.h
@@ -24,7 +24,6 @@
 #include "cpu-qom.h"
 
 #include "exec/cpu-common.h"
-#include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "qemu/cpu-float.h"
 
diff --git a/target/s390x/cpu.h b/target/s390x/cpu.h
index 40bc1f0741d..3acbe83f0fc 100644
--- a/target/s390x/cpu.h
+++ b/target/s390x/cpu.h
@@ -28,7 +28,6 @@
 #include "cpu-qom.h"
 #include "cpu_models.h"
 #include "exec/cpu-common.h"
-#include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "qemu/cpu-float.h"
 #include "qapi/qapi-types-machine-common.h"
diff --git a/target/sh4/cpu.h b/target/sh4/cpu.h
index b0759010c47..e36268b4256 100644
--- a/target/sh4/cpu.h
+++ b/target/sh4/cpu.h
@@ -22,7 +22,6 @@
 
 #include "cpu-qom.h"
 #include "exec/cpu-common.h"
-#include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "qemu/cpu-float.h"
 
diff --git a/target/sparc/cpu.h b/target/sparc/cpu.h
index 155aa8ec637..ac0eb9f0faa 100644
--- a/target/sparc/cpu.h
+++ b/target/sparc/cpu.h
@@ -3,7 +3,6 @@
 
 #include "qemu/bswap.h"
 #include "cpu-qom.h"
-#include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "exec/target_long.h"
 #include "qemu/cpu-float.h"
diff --git a/target/tricore/cpu.h b/target/tricore/cpu.h
index ab46192e261..604fb7792c6 100644
--- a/target/tricore/cpu.h
+++ b/target/tricore/cpu.h
@@ -23,7 +23,6 @@
 #include "cpu-qom.h"
 #include "hw/core/registerfields.h"
 #include "exec/cpu-common.h"
-#include "exec/cpu-defs.h"
 #include "qemu/cpu-float.h"
 #include "tricore-defs.h"
 
-- 
2.53.0

[PULL 016/110] target/mips: Move 'mvp' field from CPUMIPSState to MIPSCPU

[Philippe Mathieu-Daudé]

From: Peter Maydell <peter.maydell@linaro.org>

The 'mvp' field in the CPUMIPSState is a pointer to memory allocated
in mvp_init().  This is in theory fine, but in practice it clashes
with the current linux-user implementation of cpu_copy(), which
assumes it can do a shallow memcpy() copy of the CPU env struct in
order to clone the CPU when creating a new thread.

Almost all of the MIPS env struct is actually memcpy() copyable;
one of the exceptions is the mvp pointer. We don't need this
to be in the env struct; move it to the CPU object struct instead.

At the moment the memcpy() of the env->mvp pointer doesn't have any
obvious ill-effects, because we never free the memory and it
doesn't contain anything that varies at runtime for user-mode.
So thread 2 ends up pointing at thread 1's mvp struct, but it
still works OK. However, we would like to free the mvp memory to
avoid a leak when a user-mode thread exits, and unless we avoid
the shallow copy this will end up with a double-free when both
thread 1 and thread 2 free the same mvp struct.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260317175031.3035740-2-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/cpu.h                   |  3 ++-
 target/mips/internal.h              |  3 ++-
 hw/mips/malta.c                     |  4 ++--
 target/mips/cpu.c                   |  2 +-
 target/mips/system/machine.c        |  2 +-
 target/mips/tcg/system/cp0_helper.c | 35 ++++++++++++++++++-----------
 target/mips/tcg/translate.c         |  6 +++--
 target/mips/cpu-defs.c.inc          | 10 +++++----
 8 files changed, 40 insertions(+), 25 deletions(-)

diff --git a/target/mips/cpu.h b/target/mips/cpu.h
index 17e9f6039ec..42c5ca89154 100644
--- a/target/mips/cpu.h
+++ b/target/mips/cpu.h
@@ -1174,7 +1174,6 @@ typedef struct CPUArchState {
     struct {} end_reset_fields;
 
     /* Fields from here on are preserved across CPU reset. */
-    CPUMIPSMVPContext *mvp;
 #if !defined(CONFIG_USER_ONLY)
     CPUMIPSTLBContext *tlb;
     qemu_irq irq[8];
@@ -1209,6 +1208,8 @@ struct ArchCPU {
     Clock *clock;
     Clock *count_div; /* Divider for CP0_Count clock */
 
+    CPUMIPSMVPContext *mvp;
+
     /* Properties */
     bool is_big_endian;
 };
diff --git a/target/mips/internal.h b/target/mips/internal.h
index 28eb28936ba..95b8b7bb9c9 100644
--- a/target/mips/internal.h
+++ b/target/mips/internal.h
@@ -246,10 +246,11 @@ static inline void restore_pamask(CPUMIPSState *env)
 
 static inline int mips_vpe_active(CPUMIPSState *env)
 {
+    MIPSCPU *cpu = env_archcpu(env);
     int active = 1;
 
     /* Check that the VPE is enabled.  */
-    if (!(env->mvp->CP0_MVPControl & (1 << CP0MVPCo_EVP))) {
+    if (!(cpu->mvp->CP0_MVPControl & (1 << CP0MVPCo_EVP))) {
         active = 0;
     }
     /* Check that the VPE is activated.  */
diff --git a/hw/mips/malta.c b/hw/mips/malta.c
index 0cbe9956e74..845b8d339e8 100644
--- a/hw/mips/malta.c
+++ b/hw/mips/malta.c
@@ -968,10 +968,10 @@ static void malta_mips_config(MIPSCPU *cpu)
     CPUState *cs = CPU(cpu);
 
     if (ase_mt_available(env)) {
-        env->mvp->CP0_MVPConf0 = deposit32(env->mvp->CP0_MVPConf0,
+        cpu->mvp->CP0_MVPConf0 = deposit32(cpu->mvp->CP0_MVPConf0,
                                            CP0MVPC0_PTC, 8,
                                            smp_cpus * cs->nr_threads - 1);
-        env->mvp->CP0_MVPConf0 = deposit32(env->mvp->CP0_MVPConf0,
+        cpu->mvp->CP0_MVPConf0 = deposit32(cpu->mvp->CP0_MVPConf0,
                                            CP0MVPC0_PVPE, 4, smp_cpus - 1);
     }
 }
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index 5f88c077dbf..789ca188b5e 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -339,7 +339,7 @@ static void mips_cpu_reset_hold(Object *obj, ResetType type)
 
         if (cs->cpu_index == 0) {
             /* VPE0 starts up enabled.  */
-            env->mvp->CP0_MVPControl |= (1 << CP0MVPCo_EVP);
+            cpu->mvp->CP0_MVPControl |= (1 << CP0MVPCo_EVP);
             env->CP0_VPEConf0 |= (1 << CP0VPEC0_MVP) | (1 << CP0VPEC0_VPA);
 
             /* TC0 starts up unhalted.  */
diff --git a/target/mips/system/machine.c b/target/mips/system/machine.c
index 473d3ab0363..0a32665f835 100644
--- a/target/mips/system/machine.c
+++ b/target/mips/system/machine.c
@@ -251,7 +251,7 @@ const VMStateDescription vmstate_mips_cpu = {
                        CPUMIPSFPUContext),
 
         /* MVP */
-        VMSTATE_STRUCT_POINTER(env.mvp, MIPSCPU, vmstate_mvp,
+        VMSTATE_STRUCT_POINTER(mvp, MIPSCPU, vmstate_mvp,
                                CPUMIPSMVPContext),
 
         /* TLB */
diff --git a/target/mips/tcg/system/cp0_helper.c b/target/mips/tcg/system/cp0_helper.c
index b69e70d7fcf..123d5c217c1 100644
--- a/target/mips/tcg/system/cp0_helper.c
+++ b/target/mips/tcg/system/cp0_helper.c
@@ -229,17 +229,20 @@ uint32_t cpu_mips_get_random(CPUMIPSState *env)
 /* CP0 helpers */
 target_ulong helper_mfc0_mvpcontrol(CPUMIPSState *env)
 {
-    return env->mvp->CP0_MVPControl;
+    MIPSCPU *cpu = env_archcpu(env);
+    return cpu->mvp->CP0_MVPControl;
 }
 
 target_ulong helper_mfc0_mvpconf0(CPUMIPSState *env)
 {
-    return env->mvp->CP0_MVPConf0;
+    MIPSCPU *cpu = env_archcpu(env);
+    return cpu->mvp->CP0_MVPConf0;
 }
 
 target_ulong helper_mfc0_mvpconf1(CPUMIPSState *env)
 {
-    return env->mvp->CP0_MVPConf1;
+    MIPSCPU *cpu = env_archcpu(env);
+    return cpu->mvp->CP0_MVPConf1;
 }
 
 target_ulong helper_mfc0_random(CPUMIPSState *env)
@@ -514,6 +517,7 @@ void helper_mtc0_index(CPUMIPSState *env, target_ulong arg1)
 
 void helper_mtc0_mvpcontrol(CPUMIPSState *env, target_ulong arg1)
 {
+    MIPSCPU *cpu = env_archcpu(env);
     uint32_t mask = 0;
     uint32_t newval;
 
@@ -521,14 +525,14 @@ void helper_mtc0_mvpcontrol(CPUMIPSState *env, target_ulong arg1)
         mask |= (1 << CP0MVPCo_CPA) | (1 << CP0MVPCo_VPC) |
                 (1 << CP0MVPCo_EVP);
     }
-    if (env->mvp->CP0_MVPControl & (1 << CP0MVPCo_VPC)) {
+    if (cpu->mvp->CP0_MVPControl & (1 << CP0MVPCo_VPC)) {
         mask |= (1 << CP0MVPCo_STLB);
     }
-    newval = (env->mvp->CP0_MVPControl & ~mask) | (arg1 & mask);
+    newval = (cpu->mvp->CP0_MVPControl & ~mask) | (arg1 & mask);
 
     /* TODO: Enable/disable shared TLB, enable/disable VPEs. */
 
-    env->mvp->CP0_MVPControl = newval;
+    cpu->mvp->CP0_MVPControl = newval;
 }
 
 void helper_mtc0_vpecontrol(CPUMIPSState *env, target_ulong arg1)
@@ -616,10 +620,11 @@ void helper_mttc0_vpeconf0(CPUMIPSState *env, target_ulong arg1)
 
 void helper_mtc0_vpeconf1(CPUMIPSState *env, target_ulong arg1)
 {
+    MIPSCPU *cpu = env_archcpu(env);
     uint32_t mask = 0;
     uint32_t newval;
 
-    if (env->mvp->CP0_MVPControl & (1 << CP0MVPCo_VPC))
+    if (cpu->mvp->CP0_MVPControl & (1 << CP0MVPCo_VPC))
         mask |= (0xff << CP0VPEC1_NCX) | (0xff << CP0VPEC1_NCP2) |
                 (0xff << CP0VPEC1_NCP1);
     newval = (env->CP0_VPEConf1 & ~mask) | (arg1 & mask);
@@ -689,10 +694,11 @@ void helper_mttc0_tcstatus(CPUMIPSState *env, target_ulong arg1)
 
 void helper_mtc0_tcbind(CPUMIPSState *env, target_ulong arg1)
 {
+    MIPSCPU *cpu = env_archcpu(env);
     uint32_t mask = (1 << CP0TCBd_TBE);
     uint32_t newval;
 
-    if (env->mvp->CP0_MVPControl & (1 << CP0MVPCo_VPC)) {
+    if (cpu->mvp->CP0_MVPControl & (1 << CP0MVPCo_VPC)) {
         mask |= (1 << CP0TCBd_CurVPE);
     }
     newval = (env->active_tc.CP0_TCBind & ~mask) | (arg1 & mask);
@@ -705,8 +711,9 @@ void helper_mttc0_tcbind(CPUMIPSState *env, target_ulong arg1)
     uint32_t mask = (1 << CP0TCBd_TBE);
     uint32_t newval;
     CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
+    MIPSCPU *other_cpu = env_archcpu(other);
 
-    if (other->mvp->CP0_MVPControl & (1 << CP0MVPCo_VPC)) {
+    if (other_cpu->mvp->CP0_MVPControl & (1 << CP0MVPCo_VPC)) {
         mask |= (1 << CP0TCBd_CurVPE);
     }
     if (other_tc == other->current_tc) {
@@ -1560,14 +1567,15 @@ target_ulong helper_emt(void)
 target_ulong helper_dvpe(CPUMIPSState *env)
 {
     CPUState *other_cs = first_cpu;
-    target_ulong prev = env->mvp->CP0_MVPControl;
+    MIPSCPU *cpu = env_archcpu(env);
+    target_ulong prev = cpu->mvp->CP0_MVPControl;
 
     if (env->CP0_VPEConf0 & (1 << CP0VPEC0_MVP)) {
         CPU_FOREACH(other_cs) {
             MIPSCPU *other_cpu = MIPS_CPU(other_cs);
             /* Turn off all VPEs except the one executing the dvpe.  */
             if (&other_cpu->env != env) {
-                other_cpu->env.mvp->CP0_MVPControl &= ~(1 << CP0MVPCo_EVP);
+                other_cpu->mvp->CP0_MVPControl &= ~(1 << CP0MVPCo_EVP);
                 mips_vpe_sleep(other_cpu);
             }
         }
@@ -1578,7 +1586,8 @@ target_ulong helper_dvpe(CPUMIPSState *env)
 target_ulong helper_evpe(CPUMIPSState *env)
 {
     CPUState *other_cs = first_cpu;
-    target_ulong prev = env->mvp->CP0_MVPControl;
+    MIPSCPU *cpu = env_archcpu(env);
+    target_ulong prev = cpu->mvp->CP0_MVPControl;
 
     if (env->CP0_VPEConf0 & (1 << CP0VPEC0_MVP)) {
         CPU_FOREACH(other_cs) {
@@ -1588,7 +1597,7 @@ target_ulong helper_evpe(CPUMIPSState *env)
                 /* If the VPE is WFI, don't disturb its sleep.  */
                 && !mips_vpe_is_wfi(other_cpu)) {
                 /* Enable the VPE.  */
-                other_cpu->env.mvp->CP0_MVPControl |= (1 << CP0MVPCo_EVP);
+                other_cpu->mvp->CP0_MVPControl |= (1 << CP0MVPCo_EVP);
                 mips_vpe_wake(other_cpu); /* And wake it up.  */
             }
         }
diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
index 3426acd37b4..e334cf98b78 100644
--- a/target/mips/tcg/translate.c
+++ b/target/mips/tcg/translate.c
@@ -8085,6 +8085,7 @@ cp0_unimplemented:
 static void gen_mftr(CPUMIPSState *env, DisasContext *ctx, int rt, int rd,
                      int u, int sel, int h)
 {
+    MIPSCPU *cpu = env_archcpu(env);
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
     TCGv t0 = tcg_temp_new();
 
@@ -8093,7 +8094,7 @@ static void gen_mftr(CPUMIPSState *env, DisasContext *ctx, int rt, int rd,
          (env->active_tc.CP0_TCBind & (0xf << CP0TCBd_CurVPE)))) {
         tcg_gen_movi_tl(t0, -1);
     } else if ((env->CP0_VPEControl & (0xff << CP0VPECo_TargTC)) >
-               (env->mvp->CP0_MVPConf0 & (0xff << CP0MVPC0_PTC))) {
+               (cpu->mvp->CP0_MVPConf0 & (0xff << CP0MVPC0_PTC))) {
         tcg_gen_movi_tl(t0, -1);
     } else if (u == 0) {
         switch (rt) {
@@ -8309,6 +8310,7 @@ die:
 static void gen_mttr(CPUMIPSState *env, DisasContext *ctx, int rd, int rt,
                      int u, int sel, int h)
 {
+    MIPSCPU *cpu = env_archcpu(env);
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
     TCGv t0 = tcg_temp_new();
 
@@ -8319,7 +8321,7 @@ static void gen_mttr(CPUMIPSState *env, DisasContext *ctx, int rd, int rt,
         /* NOP */
         ;
     } else if ((env->CP0_VPEControl & (0xff << CP0VPECo_TargTC)) >
-             (env->mvp->CP0_MVPConf0 & (0xff << CP0MVPC0_PTC))) {
+             (cpu->mvp->CP0_MVPConf0 & (0xff << CP0MVPC0_PTC))) {
         /* NOP */
         ;
     } else if (u == 0) {
diff --git a/target/mips/cpu-defs.c.inc b/target/mips/cpu-defs.c.inc
index d93b9d341ac..faefab04738 100644
--- a/target/mips/cpu-defs.c.inc
+++ b/target/mips/cpu-defs.c.inc
@@ -1034,7 +1034,9 @@ static void fpu_init (CPUMIPSState *env, const mips_def_t *def)
 
 static void mvp_init(CPUMIPSState *env)
 {
-    env->mvp = g_malloc0(sizeof(CPUMIPSMVPContext));
+    MIPSCPU *cpu = env_archcpu(env);
+
+    cpu->mvp = g_malloc0(sizeof(CPUMIPSMVPContext));
 
     if (!ase_mt_available(env)) {
         return;
@@ -1044,7 +1046,7 @@ static void mvp_init(CPUMIPSState *env)
        programmable cache partitioning implemented, number of allocatable
        and shareable TLB entries, MVP has allocatable TCs, 2 VPEs
        implemented, 5 TCs implemented. */
-    env->mvp->CP0_MVPConf0 = (1U << CP0MVPC0_M) | (1 << CP0MVPC0_TLBS) |
+    cpu->mvp->CP0_MVPConf0 = (1U << CP0MVPC0_M) | (1 << CP0MVPC0_TLBS) |
                              (0 << CP0MVPC0_GS) | (1 << CP0MVPC0_PCP) |
 // TODO: actually do 2 VPEs.
 //                             (1 << CP0MVPC0_TCA) | (0x1 << CP0MVPC0_PVPE) |
@@ -1053,12 +1055,12 @@ static void mvp_init(CPUMIPSState *env)
                              (0x00 << CP0MVPC0_PTC);
 #if !defined(CONFIG_USER_ONLY)
     /* Usermode has no TLB support */
-    env->mvp->CP0_MVPConf0 |= (env->tlb->nb_tlb << CP0MVPC0_PTLBE);
+    cpu->mvp->CP0_MVPConf0 |= (env->tlb->nb_tlb << CP0MVPC0_PTLBE);
 #endif
 
     /* Allocatable CP1 have media extensions, allocatable CP1 have FP support,
        no UDI implemented, no CP2 implemented, 1 CP1 implemented. */
-    env->mvp->CP0_MVPConf1 = (1U << CP0MVPC1_CIM) | (1 << CP0MVPC1_CIF) |
+    cpu->mvp->CP0_MVPConf1 = (1U << CP0MVPC1_CIM) | (1 << CP0MVPC1_CIF) |
                              (0x0 << CP0MVPC1_PCX) | (0x0 << CP0MVPC1_PCP2) |
                              (0x1 << CP0MVPC1_PCP1);
 }
-- 
2.53.0

[PULL 017/110] target/mips: Free mvp in unrealize

[Philippe Mathieu-Daudé]

From: Peter Maydell <peter.maydell@linaro.org>

We allocate memory for cpu->mvp in mips_cpu_realizefn(), but we
never free it, which causes memory leaks like this:

    Direct leak of 24 byte(s) in 2 object(s) allocated from:
        #0 0x5f9458e61c8d in calloc (/home/pm215/qemu/build/san/qemu-mips+0x4d8c8d) (BuildId: 4153e33b3d08657a71ce2a04a82d0c2954966d9c)
        #1 0x74761891a771 in g_malloc0 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x63771) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3)
        #2 0x5f94590687aa in mvp_init /home/pm215/qemu/build/san/../../target/mips/cpu-defs.c.inc:1037:16
        #3 0x5f94590687aa in mips_cpu_realizefn /home/pm215/qemu/build/san/../../target/mips/cpu.c:489:5
        #4 0x5f9459366a3a in device_set_realized /home/pm215/qemu/build/san/../../hw/core/qdev.c:523:13
        #5 0x5f9459380a49 in property_set_bool /home/pm215/qemu/build/san/../../qom/object.c:2376:5
        #6 0x5f945937bace in object_property_set /home/pm215/qemu/build/san/../../qom/object.c:1450:5
        #7 0x5f945938816c in object_property_set_qobject /home/pm215/qemu/build/san/../../qom/qom-qobject.c:28:10
        #8 0x5f94592cc100 in cpu_copy /home/pm215/qemu/build/san/../../linux-user/main.c:240:25
        #9 0x5f9459309931 in do_syscall1 /home/pm215/qemu/build/san/../../linux-user/syscall.c
        #10 0x5f94593058d8 in do_syscall /home/pm215/qemu/build/san/../../linux-user/syscall.c:14422:15
        #11 0x5f945905c73e in cpu_loop /home/pm215/qemu/build/san/../../linux-user/mips/cpu_loop.c:124:23

for linux-user, where each new guest thread is a new CPU object that
we need to destroy on thread exit.

Add an unrealize method which frees this memory.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260317175031.3035740-3-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/cpu.h |  1 +
 target/mips/cpu.c | 12 ++++++++++++
 2 files changed, 13 insertions(+)

diff --git a/target/mips/cpu.h b/target/mips/cpu.h
index 42c5ca89154..efb6a6df4cd 100644
--- a/target/mips/cpu.h
+++ b/target/mips/cpu.h
@@ -1225,6 +1225,7 @@ struct MIPSCPUClass {
     CPUClass parent_class;
 
     DeviceRealize parent_realize;
+    DeviceUnrealize parent_unrealize;
     ResettablePhases parent_phases;
     const struct mips_def_t *cpu_def;
 
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index 789ca188b5e..0663cda0036 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -502,6 +502,16 @@ static void mips_cpu_realizefn(DeviceState *dev, Error **errp)
     mcc->parent_realize(dev, errp);
 }
 
+static void mips_cpu_unrealizefn(DeviceState *dev)
+{
+    MIPSCPU *cpu = MIPS_CPU(dev);
+    MIPSCPUClass *mcc = MIPS_CPU_GET_CLASS(dev);
+
+    g_free(cpu->mvp);
+
+    mcc->parent_unrealize(dev);
+}
+
 static void mips_cpu_initfn(Object *obj)
 {
     MIPSCPU *cpu = MIPS_CPU(obj);
@@ -606,6 +616,8 @@ static void mips_cpu_class_init(ObjectClass *c, const void *data)
     device_class_set_props(dc, mips_cpu_properties);
     device_class_set_parent_realize(dc, mips_cpu_realizefn,
                                     &mcc->parent_realize);
+    device_class_set_parent_unrealize(dc, mips_cpu_unrealizefn,
+                                      &mcc->parent_unrealize);
     resettable_class_set_parent_phases(rc, NULL, mips_cpu_reset_hold, NULL,
                                        &mcc->parent_phases);
 
-- 
2.53.0

[PULL 018/110] target/mips: Move count_clock to MIPSCPU struct

[Philippe Mathieu-Daudé]

From: Peter Maydell <peter.maydell@linaro.org>

The count_clock pointer is not something we can do a shallow copy of,
as linux-user cpu_copy() does, and although it is a system-mode piece
of state we unconditionally create it, so it is present also in
user-mode.

There isn't any need to keep this in the env struct rather than the
CPU struct, so move it to avoid possible memory leaks or
double-usage. This also puts it next to the other Clocks that this
CPU has.

I haven't seen any sanitizer reports about this field, so this is
averting a possible problem rather than correcting an observed one.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260317175031.3035740-4-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/cpu.h              |  2 +-
 target/mips/cpu.c              |  4 ++--
 target/mips/system/cp0_timer.c | 12 ++++++++----
 3 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/target/mips/cpu.h b/target/mips/cpu.h
index efb6a6df4cd..cbb9b3e1b1c 100644
--- a/target/mips/cpu.h
+++ b/target/mips/cpu.h
@@ -1188,7 +1188,6 @@ typedef struct CPUArchState {
 
     const mips_def_t *cpu_model;
     QEMUTimer *timer; /* Internal timer */
-    Clock *count_clock; /* CP0_Count clock */
     target_ulong exception_base; /* ExceptionBase input to the core */
 } CPUMIPSState;
 
@@ -1206,6 +1205,7 @@ struct ArchCPU {
     CPUMIPSState env;
 
     Clock *clock;
+    Clock *count_clock; /* CP0_Count clock */
     Clock *count_div; /* Divider for CP0_Count clock */
 
     CPUMIPSMVPContext *mvp;
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index 0663cda0036..f803d477632 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -449,7 +449,7 @@ static void mips_cp0_period_set(MIPSCPU *cpu)
 
     clock_set_mul_div(cpu->count_div, env->cpu_model->CCRes, 1);
     clock_set_source(cpu->count_div, cpu->clock);
-    clock_set_source(env->count_clock, cpu->count_div);
+    clock_set_source(cpu->count_clock, cpu->count_div);
 }
 
 static void mips_cpu_realizefn(DeviceState *dev, Error **errp)
@@ -520,7 +520,7 @@ static void mips_cpu_initfn(Object *obj)
 
     cpu->clock = qdev_init_clock_in(DEVICE(obj), "clk-in", NULL, cpu, 0);
     cpu->count_div = clock_new(OBJECT(obj), "clk-div-count");
-    env->count_clock = clock_new(OBJECT(obj), "clk-count");
+    cpu->count_clock = clock_new(OBJECT(obj), "clk-count");
     env->cpu_model = mcc->cpu_def;
 }
 
diff --git a/target/mips/system/cp0_timer.c b/target/mips/system/cp0_timer.c
index afa163c3196..634c2a66bbd 100644
--- a/target/mips/system/cp0_timer.c
+++ b/target/mips/system/cp0_timer.c
@@ -29,14 +29,16 @@
 /* MIPS R4K timer */
 static uint32_t cpu_mips_get_count_val(CPUMIPSState *env)
 {
+    MIPSCPU *cpu = env_archcpu(env);
     int64_t now_ns;
     now_ns = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
     return env->CP0_Count +
-            (uint32_t)clock_ns_to_ticks(env->count_clock, now_ns);
+            (uint32_t)clock_ns_to_ticks(cpu->count_clock, now_ns);
 }
 
 static void cpu_mips_timer_update(CPUMIPSState *env)
 {
+    MIPSCPU *cpu = env_archcpu(env);
     uint64_t now_ns, next_ns;
     uint32_t wait;
 
@@ -46,7 +48,7 @@ static void cpu_mips_timer_update(CPUMIPSState *env)
     if (!wait) {
         wait = UINT32_MAX;
     }
-    next_ns = now_ns + clock_ticks_to_ns(env->count_clock, wait);
+    next_ns = now_ns + clock_ticks_to_ns(cpu->count_clock, wait);
     timer_mod(env->timer, next_ns);
 }
 
@@ -85,11 +87,12 @@ void cpu_mips_store_count(CPUMIPSState *env, uint32_t count)
      * So env->timer may be NULL, which is also the case with KVM enabled so
      * treat timer as disabled in that case.
      */
+    MIPSCPU *cpu = env_archcpu(env);
     if (env->CP0_Cause & (1 << CP0Ca_DC) || !env->timer) {
         env->CP0_Count = count;
     } else {
         /* Store new count register */
-        env->CP0_Count = count - (uint32_t)clock_ns_to_ticks(env->count_clock,
+        env->CP0_Count = count - (uint32_t)clock_ns_to_ticks(cpu->count_clock,
                         qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
         /* Update timer timer */
         cpu_mips_timer_update(env);
@@ -116,7 +119,8 @@ void cpu_mips_start_count(CPUMIPSState *env)
 void cpu_mips_stop_count(CPUMIPSState *env)
 {
     /* Store the current value */
-    env->CP0_Count += (uint32_t)clock_ns_to_ticks(env->count_clock,
+    MIPSCPU *cpu = env_archcpu(env);
+    env->CP0_Count += (uint32_t)clock_ns_to_ticks(cpu->count_clock,
                         qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
 }
 
-- 
2.53.0

[PULL 019/110] target/ppc/mmu: Remove unused hash32_store_hpte() helpers

[Philippe Mathieu-Daudé]

The hash32_store_hpte() helpers are unused since commit
6e8a65abbbd ("ppc/hash32: Rework R and C bit updates"),
7 years ago. Remove them.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Message-Id: <20260319111936.68041-4-philmd@linaro.org>
---
 target/ppc/mmu-hash32.h | 16 ----------------
 1 file changed, 16 deletions(-)

diff --git a/target/ppc/mmu-hash32.h b/target/ppc/mmu-hash32.h
index 04c23ea75ed..5705f57935b 100644
--- a/target/ppc/mmu-hash32.h
+++ b/target/ppc/mmu-hash32.h
@@ -87,22 +87,6 @@ static inline target_ulong ppc_hash32_load_hpte1(PowerPCCPU *cpu,
     return ldl_phys(CPU(cpu)->as, base + pte_offset + HASH_PTE_SIZE_32 / 2);
 }
 
-static inline void ppc_hash32_store_hpte0(PowerPCCPU *cpu,
-                                          hwaddr pte_offset, target_ulong pte0)
-{
-    target_ulong base = ppc_hash32_hpt_base(cpu);
-
-    stl_phys(CPU(cpu)->as, base + pte_offset, pte0);
-}
-
-static inline void ppc_hash32_store_hpte1(PowerPCCPU *cpu,
-                                          hwaddr pte_offset, target_ulong pte1)
-{
-    target_ulong base = ppc_hash32_hpt_base(cpu);
-
-    stl_phys(CPU(cpu)->as, base + pte_offset + HASH_PTE_SIZE_32 / 2, pte1);
-}
-
 static inline hwaddr get_pteg_offset32(PowerPCCPU *cpu, hwaddr hash)
 {
     return (hash * HASH_PTEG_SIZE_32) & ppc_hash32_hpt_mask(cpu);
-- 
2.53.0

[PULL 020/110] target/ppc/mmu: Restrict hash32_load_hpte() helpers scope

[Philippe Mathieu-Daudé]

hash32_load_hpte() helpers are only used within mmu-hash32.c,
no need to have each file including "mmu-hash32.h" to compile
them. Move their definition to this source file.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Message-Id: <20260319111936.68041-5-philmd@linaro.org>
---
 target/ppc/mmu-hash32.h | 16 ----------------
 target/ppc/mmu-hash32.c | 14 ++++++++++++++
 2 files changed, 14 insertions(+), 16 deletions(-)

diff --git a/target/ppc/mmu-hash32.h b/target/ppc/mmu-hash32.h
index 5705f57935b..bfea03ea872 100644
--- a/target/ppc/mmu-hash32.h
+++ b/target/ppc/mmu-hash32.h
@@ -71,22 +71,6 @@ static inline hwaddr ppc_hash32_hpt_mask(PowerPCCPU *cpu)
     return ((cpu->env.spr[SPR_SDR1] & SDR_32_HTABMASK) << 16) | 0xFFFF;
 }
 
-static inline target_ulong ppc_hash32_load_hpte0(PowerPCCPU *cpu,
-                                                 hwaddr pte_offset)
-{
-    target_ulong base = ppc_hash32_hpt_base(cpu);
-
-    return ldl_phys(CPU(cpu)->as, base + pte_offset);
-}
-
-static inline target_ulong ppc_hash32_load_hpte1(PowerPCCPU *cpu,
-                                                 hwaddr pte_offset)
-{
-    target_ulong base = ppc_hash32_hpt_base(cpu);
-
-    return ldl_phys(CPU(cpu)->as, base + pte_offset + HASH_PTE_SIZE_32 / 2);
-}
-
 static inline hwaddr get_pteg_offset32(PowerPCCPU *cpu, hwaddr hash)
 {
     return (hash * HASH_PTEG_SIZE_32) & ppc_hash32_hpt_mask(cpu);
diff --git a/target/ppc/mmu-hash32.c b/target/ppc/mmu-hash32.c
index 8b980a5aa90..08c9f63a132 100644
--- a/target/ppc/mmu-hash32.c
+++ b/target/ppc/mmu-hash32.c
@@ -201,6 +201,20 @@ static bool ppc_hash32_direct_store(PowerPCCPU *cpu, target_ulong sr,
     return false;
 }
 
+static target_ulong ppc_hash32_load_hpte0(PowerPCCPU *cpu, hwaddr pte_offset)
+{
+    target_ulong base = ppc_hash32_hpt_base(cpu);
+
+    return ldl_phys(CPU(cpu)->as, base + pte_offset);
+}
+
+static target_ulong ppc_hash32_load_hpte1(PowerPCCPU *cpu, hwaddr pte_offset)
+{
+    target_ulong base = ppc_hash32_hpt_base(cpu);
+
+    return ldl_phys(CPU(cpu)->as, base + pte_offset + HASH_PTE_SIZE_32 / 2);
+}
+
 static hwaddr ppc_hash32_pteg_search(PowerPCCPU *cpu, hwaddr pteg_off,
                                      bool secondary, target_ulong ptem,
                                      ppc_hash_pte32_t *pte)
-- 
2.53.0

[PULL 021/110] target/sparc/monitor: Dump all registers as 32-bit

[Philippe Mathieu-Daudé]

All these SPARC64 registers are 32-bit since their introduction
in commit 3475187dd81 ("sparc64 merge"), see target/sparc/cpu.h:

  511 #if defined(TARGET_SPARC64)
  ...
  515     uint32_t asi;
  516     uint32_t pstate;
  ...
  519     uint32_t cansave, canrestore, otherwin, wstate, cleanwin;

Set MonitorDef::type to MD_I32 to dump them as 32-bit.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260320091019.59902-2-philmd@linaro.org>
---
 target/sparc/monitor.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/target/sparc/monitor.c b/target/sparc/monitor.c
index a60671a60a4..e9300ded4ad 100644
--- a/target/sparc/monitor.c
+++ b/target/sparc/monitor.c
@@ -41,13 +41,13 @@ void hmp_info_tlb(Monitor *mon, const QDict *qdict)
 
 const MonitorDef monitor_defs[] = {
 #ifdef TARGET_SPARC64
-    { "asi", offsetof(CPUSPARCState, asi) },
-    { "pstate", offsetof(CPUSPARCState, pstate) },
-    { "cansave", offsetof(CPUSPARCState, cansave) },
-    { "canrestore", offsetof(CPUSPARCState, canrestore) },
-    { "otherwin", offsetof(CPUSPARCState, otherwin) },
-    { "wstate", offsetof(CPUSPARCState, wstate) },
-    { "cleanwin", offsetof(CPUSPARCState, cleanwin) },
+    { "asi", offsetof(CPUSPARCState, asi), NULL, MD_I32 },
+    { "pstate", offsetof(CPUSPARCState, pstate), NULL, MD_I32 },
+    { "cansave", offsetof(CPUSPARCState, cansave), NULL, MD_I32 },
+    { "canrestore", offsetof(CPUSPARCState, canrestore), NULL, MD_I32 },
+    { "otherwin", offsetof(CPUSPARCState, otherwin), NULL, MD_I32 },
+    { "wstate", offsetof(CPUSPARCState, wstate), NULL, MD_I32 },
+    { "cleanwin", offsetof(CPUSPARCState, cleanwin), NULL, MD_I32 },
 #endif
     { NULL },
 };
-- 
2.53.0

[PULL 022/110] monitor: Remove MonitorDef::type field and MD_TLONG / MD_I32

[Philippe Mathieu-Daudé]

None of the few targets still using MonitorDef use MD_TLONG,
they either use MD_I32 or the %get_value handler. Remove the
MonitorDef::type and its definitions altogether: simply check
for the %get_value handler, if NULL then consider 32-bit.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260320091019.59902-3-philmd@linaro.org>
---
 include/monitor/hmp-target.h |  4 ----
 monitor/hmp-target.c         | 12 +-----------
 target/i386/monitor.c        |  2 +-
 target/m68k/monitor.c        | 24 ++++++++++++------------
 target/sparc/monitor.c       | 14 +++++++-------
 5 files changed, 21 insertions(+), 35 deletions(-)

diff --git a/include/monitor/hmp-target.h b/include/monitor/hmp-target.h
index 898473b3ed0..ce0bb1983cc 100644
--- a/include/monitor/hmp-target.h
+++ b/include/monitor/hmp-target.h
@@ -34,13 +34,9 @@ struct MonitorDef {
     int offset;
     target_long (*get_value)(Monitor *mon, const struct MonitorDef *md,
                              int val);
-    int type;
 };
 #endif
 
-#define MD_TLONG 0
-#define MD_I32   1
-
 const MonitorDef *target_monitor_defs(void);
 int target_get_monitor_def(CPUState *cs, const char *name, uint64_t *pval);
 
diff --git a/monitor/hmp-target.c b/monitor/hmp-target.c
index 420969bd6eb..3f019ae2a28 100644
--- a/monitor/hmp-target.c
+++ b/monitor/hmp-target.c
@@ -82,17 +82,7 @@ int get_monitor_def(Monitor *mon, int64_t *pval, const char *name)
             } else {
                 CPUArchState *env = mon_get_cpu_env(mon);
                 ptr = (uint8_t *)env + md->offset;
-                switch(md->type) {
-                case MD_I32:
-                    *pval = *(int32_t *)ptr;
-                    break;
-                case MD_TLONG:
-                    *pval = *(target_long *)ptr;
-                    break;
-                default:
-                    *pval = 0;
-                    break;
-                }
+                *pval = *(int32_t *)ptr;
             }
             return 0;
         }
diff --git a/target/i386/monitor.c b/target/i386/monitor.c
index 446428602ef..977f65fe16c 100644
--- a/target/i386/monitor.c
+++ b/target/i386/monitor.c
@@ -602,7 +602,7 @@ static target_long monitor_get_pc(Monitor *mon, const struct MonitorDef *md,
 
 const MonitorDef monitor_defs[] = {
 #define SEG(name, seg) \
-    { name ".limit", offsetof(CPUX86State, segs[seg].limit), NULL, MD_I32 },
+    { name ".limit", offsetof(CPUX86State, segs[seg].limit) },
     SEG("cs", R_CS)
     SEG("ds", R_DS)
     SEG("es", R_ES)
diff --git a/target/m68k/monitor.c b/target/m68k/monitor.c
index 08ced037b47..94bb12833af 100644
--- a/target/m68k/monitor.c
+++ b/target/m68k/monitor.c
@@ -24,18 +24,18 @@ void hmp_info_tlb(Monitor *mon, const QDict *qdict)
 }
 
 static const MonitorDef monitor_defs[] = {
-    { "ssp", offsetof(CPUM68KState, sp[0]), NULL, MD_I32 },
-    { "usp", offsetof(CPUM68KState, sp[1]), NULL, MD_I32 },
-    { "isp", offsetof(CPUM68KState, sp[2]), NULL, MD_I32 },
-    { "sfc", offsetof(CPUM68KState, sfc), NULL, MD_I32 },
-    { "dfc", offsetof(CPUM68KState, dfc), NULL, MD_I32 },
-    { "urp", offsetof(CPUM68KState, mmu.urp), NULL, MD_I32 },
-    { "srp", offsetof(CPUM68KState, mmu.srp), NULL, MD_I32 },
-    { "dttr0", offsetof(CPUM68KState, mmu.ttr[M68K_DTTR0]), NULL, MD_I32 },
-    { "dttr1", offsetof(CPUM68KState, mmu.ttr[M68K_DTTR1]), NULL, MD_I32 },
-    { "ittr0", offsetof(CPUM68KState, mmu.ttr[M68K_ITTR0]), NULL, MD_I32 },
-    { "ittr1", offsetof(CPUM68KState, mmu.ttr[M68K_ITTR1]), NULL, MD_I32 },
-    { "mmusr", offsetof(CPUM68KState, mmu.mmusr), NULL, MD_I32 },
+    { "ssp", offsetof(CPUM68KState, sp[0]) },
+    { "usp", offsetof(CPUM68KState, sp[1]) },
+    { "isp", offsetof(CPUM68KState, sp[2]) },
+    { "sfc", offsetof(CPUM68KState, sfc) },
+    { "dfc", offsetof(CPUM68KState, dfc) },
+    { "urp", offsetof(CPUM68KState, mmu.urp) },
+    { "srp", offsetof(CPUM68KState, mmu.srp) },
+    { "dttr0", offsetof(CPUM68KState, mmu.ttr[M68K_DTTR0]) },
+    { "dttr1", offsetof(CPUM68KState, mmu.ttr[M68K_DTTR1]) },
+    { "ittr0", offsetof(CPUM68KState, mmu.ttr[M68K_ITTR0]) },
+    { "ittr1", offsetof(CPUM68KState, mmu.ttr[M68K_ITTR1]) },
+    { "mmusr", offsetof(CPUM68KState, mmu.mmusr) },
     { NULL },
 };
 
diff --git a/target/sparc/monitor.c b/target/sparc/monitor.c
index e9300ded4ad..a60671a60a4 100644
--- a/target/sparc/monitor.c
+++ b/target/sparc/monitor.c
@@ -41,13 +41,13 @@ void hmp_info_tlb(Monitor *mon, const QDict *qdict)
 
 const MonitorDef monitor_defs[] = {
 #ifdef TARGET_SPARC64
-    { "asi", offsetof(CPUSPARCState, asi), NULL, MD_I32 },
-    { "pstate", offsetof(CPUSPARCState, pstate), NULL, MD_I32 },
-    { "cansave", offsetof(CPUSPARCState, cansave), NULL, MD_I32 },
-    { "canrestore", offsetof(CPUSPARCState, canrestore), NULL, MD_I32 },
-    { "otherwin", offsetof(CPUSPARCState, otherwin), NULL, MD_I32 },
-    { "wstate", offsetof(CPUSPARCState, wstate), NULL, MD_I32 },
-    { "cleanwin", offsetof(CPUSPARCState, cleanwin), NULL, MD_I32 },
+    { "asi", offsetof(CPUSPARCState, asi) },
+    { "pstate", offsetof(CPUSPARCState, pstate) },
+    { "cansave", offsetof(CPUSPARCState, cansave) },
+    { "canrestore", offsetof(CPUSPARCState, canrestore) },
+    { "otherwin", offsetof(CPUSPARCState, otherwin) },
+    { "wstate", offsetof(CPUSPARCState, wstate) },
+    { "cleanwin", offsetof(CPUSPARCState, cleanwin) },
 #endif
     { NULL },
 };
-- 
2.53.0

[PULL 023/110] monitor: Extract completion declarations to 'monitor/hmp-completion.h'

[Philippe Mathieu-Daudé]

Many files include "monitor/hmp.h", but few of them really need
the completion declarations: move them to a distinct header.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260320160811.28611-2-philmd@linaro.org>
---
 MAINTAINERS                      |  2 ++
 include/monitor/hmp-completion.h | 40 ++++++++++++++++++++++++++++++++
 include/monitor/hmp.h            | 21 -----------------
 chardev/char-hmp-cmds.c          |  1 +
 migration/migration-hmp-cmds.c   |  1 +
 monitor/hmp-target.c             |  1 +
 net/net-hmp-cmds.c               |  1 +
 qom/qom-hmp-cmds.c               |  1 +
 system/qdev-monitor.c            |  1 +
 system/runstate-hmp-cmds.c       |  1 +
 trace/trace-hmp-cmds.c           |  1 +
 ui/ui-hmp-cmds.c                 |  1 +
 12 files changed, 51 insertions(+), 21 deletions(-)
 create mode 100644 include/monitor/hmp-completion.h

diff --git a/MAINTAINERS b/MAINTAINERS
index afa178c5cce..ac47299fd83 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3403,6 +3403,8 @@ F: monitor/monitor.c
 F: monitor/hmp*
 F: hmp.h
 F: hmp-commands*.hx
+F: include/monitor/hmp.h
+F: include/monitor/hmp-completion.h
 F: include/monitor/hmp-target.h
 F: tests/qtest/test-hmp.c
 F: include/qemu/qemu-print.h
diff --git a/include/monitor/hmp-completion.h b/include/monitor/hmp-completion.h
new file mode 100644
index 00000000000..dab21867dc9
--- /dev/null
+++ b/include/monitor/hmp-completion.h
@@ -0,0 +1,40 @@
+/*
+ * Human Monitor Completion handlers
+ *
+ * Copyright IBM, Corp. 2011
+ *
+ * Authors:
+ *  Anthony Liguori   <aliguori@us.ibm.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HMP_COMPLETION_H
+#define HMP_COMPLETION_H
+
+#include "qemu/readline.h"
+
+void object_add_completion(ReadLineState *rs, int nb_args, const char *str);
+void object_del_completion(ReadLineState *rs, int nb_args, const char *str);
+void device_add_completion(ReadLineState *rs, int nb_args, const char *str);
+void device_del_completion(ReadLineState *rs, int nb_args, const char *str);
+void sendkey_completion(ReadLineState *rs, int nb_args, const char *str);
+void chardev_remove_completion(ReadLineState *rs, int nb_args, const char *str);
+void chardev_add_completion(ReadLineState *rs, int nb_args, const char *str);
+void set_link_completion(ReadLineState *rs, int nb_args, const char *str);
+void netdev_add_completion(ReadLineState *rs, int nb_args, const char *str);
+void netdev_del_completion(ReadLineState *rs, int nb_args, const char *str);
+void ringbuf_write_completion(ReadLineState *rs, int nb_args, const char *str);
+void info_trace_events_completion(ReadLineState *rs, int nb_args,
+                                  const char *str);
+void trace_event_completion(ReadLineState *rs, int nb_args, const char *str);
+void watchdog_action_completion(ReadLineState *rs, int nb_args,
+                                const char *str);
+void migrate_set_capability_completion(ReadLineState *rs, int nb_args,
+                                       const char *str);
+void migrate_set_parameter_completion(ReadLineState *rs, int nb_args,
+                                      const char *str);
+void delvm_completion(ReadLineState *rs, int nb_args, const char *str);
+void loadvm_completion(ReadLineState *rs, int nb_args, const char *str);
+
+#endif
diff --git a/include/monitor/hmp.h b/include/monitor/hmp.h
index 9b66458d21f..27ce1c303f4 100644
--- a/include/monitor/hmp.h
+++ b/include/monitor/hmp.h
@@ -114,27 +114,6 @@ void hmp_vhost_queue_status(Monitor *mon, const QDict *qdict);
 void hmp_virtio_queue_element(Monitor *mon, const QDict *qdict);
 void hmp_xen_event_inject(Monitor *mon, const QDict *qdict);
 void hmp_xen_event_list(Monitor *mon, const QDict *qdict);
-void object_add_completion(ReadLineState *rs, int nb_args, const char *str);
-void object_del_completion(ReadLineState *rs, int nb_args, const char *str);
-void device_add_completion(ReadLineState *rs, int nb_args, const char *str);
-void device_del_completion(ReadLineState *rs, int nb_args, const char *str);
-void sendkey_completion(ReadLineState *rs, int nb_args, const char *str);
-void chardev_remove_completion(ReadLineState *rs, int nb_args, const char *str);
-void chardev_add_completion(ReadLineState *rs, int nb_args, const char *str);
-void set_link_completion(ReadLineState *rs, int nb_args, const char *str);
-void netdev_add_completion(ReadLineState *rs, int nb_args, const char *str);
-void netdev_del_completion(ReadLineState *rs, int nb_args, const char *str);
-void ringbuf_write_completion(ReadLineState *rs, int nb_args, const char *str);
-void info_trace_events_completion(ReadLineState *rs, int nb_args, const char *str);
-void trace_event_completion(ReadLineState *rs, int nb_args, const char *str);
-void watchdog_action_completion(ReadLineState *rs, int nb_args,
-                                const char *str);
-void migrate_set_capability_completion(ReadLineState *rs, int nb_args,
-                                       const char *str);
-void migrate_set_parameter_completion(ReadLineState *rs, int nb_args,
-                                      const char *str);
-void delvm_completion(ReadLineState *rs, int nb_args, const char *str);
-void loadvm_completion(ReadLineState *rs, int nb_args, const char *str);
 void hmp_rocker(Monitor *mon, const QDict *qdict);
 void hmp_rocker_ports(Monitor *mon, const QDict *qdict);
 void hmp_rocker_of_dpa_flows(Monitor *mon, const QDict *qdict);
diff --git a/chardev/char-hmp-cmds.c b/chardev/char-hmp-cmds.c
index 8e9e1c1c021..f377e00b699 100644
--- a/chardev/char-hmp-cmds.c
+++ b/chardev/char-hmp-cmds.c
@@ -16,6 +16,7 @@
 #include "qemu/osdep.h"
 #include "chardev/char.h"
 #include "monitor/hmp.h"
+#include "monitor/hmp-completion.h"
 #include "monitor/monitor.h"
 #include "qapi/error.h"
 #include "qapi/qapi-commands-char.h"
diff --git a/migration/migration-hmp-cmds.c b/migration/migration-hmp-cmds.c
index 0a193b8f54a..d5712d11b8c 100644
--- a/migration/migration-hmp-cmds.c
+++ b/migration/migration-hmp-cmds.c
@@ -17,6 +17,7 @@
 #include "block/qapi.h"
 #include "migration/snapshot.h"
 #include "monitor/hmp.h"
+#include "monitor/hmp-completion.h"
 #include "monitor/monitor.h"
 #include "qapi/error.h"
 #include "qapi/qapi-commands-migration.h"
diff --git a/monitor/hmp-target.c b/monitor/hmp-target.c
index 3f019ae2a28..da7dd7f31f2 100644
--- a/monitor/hmp-target.c
+++ b/monitor/hmp-target.c
@@ -29,6 +29,7 @@
 #include "system/device_tree.h"
 #include "monitor/hmp-target.h"
 #include "monitor/hmp.h"
+#include "monitor/hmp-completion.h"
 #include "block/block-hmp-cmds.h"
 #include "qapi/qapi-commands-control.h"
 #include "qapi/qapi-commands-misc.h"
diff --git a/net/net-hmp-cmds.c b/net/net-hmp-cmds.c
index e7c55d27876..2b24c9e6049 100644
--- a/net/net-hmp-cmds.c
+++ b/net/net-hmp-cmds.c
@@ -16,6 +16,7 @@
 #include "qemu/osdep.h"
 #include "migration/misc.h"
 #include "monitor/hmp.h"
+#include "monitor/hmp-completion.h"
 #include "monitor/monitor.h"
 #include "net/net.h"
 #include "net/hub.h"
diff --git a/qom/qom-hmp-cmds.c b/qom/qom-hmp-cmds.c
index 32e40630c96..47110ca58c0 100644
--- a/qom/qom-hmp-cmds.c
+++ b/qom/qom-hmp-cmds.c
@@ -8,6 +8,7 @@
 #include "qemu/osdep.h"
 #include "hw/core/qdev.h"
 #include "monitor/hmp.h"
+#include "monitor/hmp-completion.h"
 #include "monitor/monitor.h"
 #include "qapi/error.h"
 #include "qapi/qapi-commands-qom.h"
diff --git a/system/qdev-monitor.c b/system/qdev-monitor.c
index 5c00bbf483b..e90eb6247ea 100644
--- a/system/qdev-monitor.c
+++ b/system/qdev-monitor.c
@@ -20,6 +20,7 @@
 #include "qemu/osdep.h"
 #include "hw/core/sysbus.h"
 #include "monitor/hmp.h"
+#include "monitor/hmp-completion.h"
 #include "monitor/monitor.h"
 #include "monitor/qdev.h"
 #include "system/arch_init.h"
diff --git a/system/runstate-hmp-cmds.c b/system/runstate-hmp-cmds.c
index be1d6769926..02d1d42bf39 100644
--- a/system/runstate-hmp-cmds.c
+++ b/system/runstate-hmp-cmds.c
@@ -16,6 +16,7 @@
 #include "qemu/osdep.h"
 #include "exec/cpu-common.h"
 #include "monitor/hmp.h"
+#include "monitor/hmp-completion.h"
 #include "monitor/monitor.h"
 #include "qapi/error.h"
 #include "qapi/qapi-commands-run-state.h"
diff --git a/trace/trace-hmp-cmds.c b/trace/trace-hmp-cmds.c
index 45f4335ff5d..390173095cf 100644
--- a/trace/trace-hmp-cmds.c
+++ b/trace/trace-hmp-cmds.c
@@ -24,6 +24,7 @@
 
 #include "qemu/osdep.h"
 #include "monitor/hmp.h"
+#include "monitor/hmp-completion.h"
 #include "monitor/monitor.h"
 #include "qapi/error.h"
 #include "qapi/qapi-commands-trace.h"
diff --git a/ui/ui-hmp-cmds.c b/ui/ui-hmp-cmds.c
index 6c93d452c9c..1e9bc77bd80 100644
--- a/ui/ui-hmp-cmds.c
+++ b/ui/ui-hmp-cmds.c
@@ -18,6 +18,7 @@
 #include <spice/enums.h>
 #endif
 #include "monitor/hmp.h"
+#include "monitor/hmp-completion.h"
 #include "monitor/monitor-internal.h"
 #include "qapi/error.h"
 #include "qapi/qapi-commands-ui.h"
-- 
2.53.0

[PULL 024/110] hw/misc/allwinner-cpucfg.c: make compilation unit common

[Philippe Mathieu-Daudé]

From: Pierrick Bouvier <pierrick.bouvier@linaro.org>

include "target/arm/cpu.h" is needed because of:
bool target_aa64 = arm_feature(cpu_env(target_cpu), ARM_FEATURE_AARCH64);

This file is reused between various allwinner boards, including 32 and
64 bits cpus.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20260312224702.1608408-3-pierrick.bouvier@linaro.org>
---
 hw/misc/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index 245ab9b98cc..cd084a19363 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -46,7 +46,7 @@ system_ss.add(when: 'CONFIG_ALLWINNER_SRAMC', if_true: files('allwinner-sramc.c'
 system_ss.add(when: 'CONFIG_ALLWINNER_A10_CCM', if_true: files('allwinner-a10-ccm.c'))
 system_ss.add(when: 'CONFIG_ALLWINNER_A10_DRAMC', if_true: files('allwinner-a10-dramc.c'))
 system_ss.add(when: 'CONFIG_ALLWINNER_H3', if_true: files('allwinner-h3-ccu.c'))
-specific_ss.add(when: 'CONFIG_ALLWINNER_H3', if_true: files('allwinner-cpucfg.c'))
+system_ss.add(when: 'CONFIG_ALLWINNER_H3', if_true: files('allwinner-cpucfg.c'))
 system_ss.add(when: 'CONFIG_ALLWINNER_H3', if_true: files('allwinner-h3-dramc.c'))
 system_ss.add(when: 'CONFIG_ALLWINNER_H3', if_true: files('allwinner-h3-sysctrl.c'))
 system_ss.add(when: 'CONFIG_ALLWINNER_H3', if_true: files('allwinner-sid.c'))
-- 
2.53.0

[PULL 025/110] target/loongarch: Replace legacy ldq_le_phys() -> address_space_ldq_le()

[Philippe Mathieu-Daudé]

Prefer the address_space_ld/st API over the legacy ld/st_phys()
because it allow checking for bus access fault (although the
modified code doesn't check that). There is no logical change.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20260319104944.66690-2-philmd@linaro.org>
---
 target/loongarch/cpu_helper.c     | 13 +++++++++----
 target/loongarch/tcg/tlb_helper.c | 10 +++++++---
 2 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/target/loongarch/cpu_helper.c b/target/loongarch/cpu_helper.c
index 60441687667..4b7743c4f28 100644
--- a/target/loongarch/cpu_helper.c
+++ b/target/loongarch/cpu_helper.c
@@ -7,6 +7,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "system/memory.h"
 #include "system/tcg.h"
 #include "cpu.h"
 #include "accel/tcg/cpu-mmu-index.h"
@@ -145,6 +146,7 @@ static MemTxResult loongarch_cmpxchg_phys(CPUState *cs, hwaddr phys,
 TLBRet loongarch_ptw(CPULoongArchState *env, MMUContext *context,
                      int access_type, int mmu_idx, int debug)
 {
+    const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
     CPUState *cs = env_cpu(env);
     hwaddr index = 0, phys = 0;
     uint64_t palen_mask = loongarch_palen_mask(env);
@@ -174,7 +176,7 @@ TLBRet loongarch_ptw(CPULoongArchState *env, MMUContext *context,
         /* get next level page directory */
         index = (address >> dir_base) & ((1 << dir_width) - 1);
         phys = base | index << 3;
-        base = ldq_le_phys(cs->as, phys);
+        base = address_space_ldq_le(cs->as, phys, attrs, NULL);
         if (level) {
             if (FIELD_EX64(base, TLBENTRY, HUGE)) {
                 /* base is a huge pte */
@@ -204,10 +206,13 @@ restart:
         context->pte_buddy[1 - index] = base + BIT_ULL(dir_base);
         base += (BIT_ULL(dir_base) & address);
     } else if (cpu_has_ptw(env)) {
+        uint64_t val;
+
         index &= 1;
         context->pte_buddy[index] = base;
-        context->pte_buddy[1 - index] = ldq_le_phys(cs->as,
-                                                    phys + 8 * (1 - 2 * index));
+        val = address_space_ldq_le(cs->as, phys + 8 * (1 - 2 * index),
+                                   attrs, NULL);
+        context->pte_buddy[1 - index] = val;
     }
 
     context->ps = dir_base;
@@ -239,7 +244,7 @@ restart:
         ret1 = loongarch_cmpxchg_phys(cs, phys, pte, base);
         /* PTE updated by other CPU, reload PTE entry */
         if (ret1 == MEMTX_DECODE_ERROR) {
-            base = ldq_le_phys(cs->as, phys);
+            base = address_space_ldq_le(cs->as, phys, attrs, NULL);
             goto restart;
         }
 
diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index c0fd8527fe9..892e0eb4738 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -20,6 +20,7 @@
 #include "exec/log.h"
 #include "cpu-csr.h"
 #include "tcg/tcg_loongarch.h"
+#include "system/memory.h"
 
 typedef bool (*tlb_match)(bool global, int asid, int tlb_asid);
 
@@ -709,7 +710,7 @@ target_ulong helper_lddir(CPULoongArchState *env, target_ulong base,
     hwaddr index, phys;
     uint64_t palen_mask = loongarch_palen_mask(env);
     uint64_t dir_base, dir_width;
-
+    uint64_t val;
 
     if (unlikely((level == 0) || (level > 4))) {
         qemu_log_mask(LOG_GUEST_ERROR,
@@ -736,7 +737,9 @@ target_ulong helper_lddir(CPULoongArchState *env, target_ulong base,
     get_dir_base_width(env, &dir_base, &dir_width, level);
     index = (badvaddr >> dir_base) & ((1 << dir_width) - 1);
     phys = base | index << 3;
-    return ldq_le_phys(cs->as, phys) & palen_mask;
+    val = address_space_ldq_le(cs->as, phys, MEMTXATTRS_UNSPECIFIED, NULL);
+
+    return val & palen_mask;
 }
 
 void helper_ldpte(CPULoongArchState *env, target_ulong base, target_ulong odd,
@@ -802,7 +805,8 @@ void helper_ldpte(CPULoongArchState *env, target_ulong base, target_ulong odd,
         ptoffset0 = ptindex << 3;
         ptoffset1 = (ptindex + 1) << 3;
         phys = base | (odd ? ptoffset1 : ptoffset0);
-        pte_raw = ldq_le_phys(cs->as, phys);
+        pte_raw = address_space_ldq_le(cs->as, phys,
+                                       MEMTXATTRS_UNSPECIFIED, NULL);
         tmp0 = loongarch_sanitize_hw_pte(env, pte_raw);
         ps = ptbase;
     }
-- 
2.53.0

[PULL 026/110] configs/targets: Restrict the legacy ldst_phys() API on LoongArch64

[Philippe Mathieu-Daudé]

The LoongArch64 target doesn't use the legacy ldst_phys() API
anymore. Set the TARGET_NOT_USING_LEGACY_LDST_PHYS_API variable
to hide the legacy API to the qemu-system-loongarch64 binary,
avoiding further API uses to creep in.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20260319104944.66690-3-philmd@linaro.org>
---
 configs/targets/loongarch64-softmmu.mak | 1 +
 1 file changed, 1 insertion(+)

diff --git a/configs/targets/loongarch64-softmmu.mak b/configs/targets/loongarch64-softmmu.mak
index 476407f9413..a425b3dbaae 100644
--- a/configs/targets/loongarch64-softmmu.mak
+++ b/configs/targets/loongarch64-softmmu.mak
@@ -6,3 +6,4 @@ TARGET_XML_FILES= loongarch-base32.xml loongarch-base64.xml loongarch-fpu.xml lo
 TARGET_NEED_FDT=y
 TARGET_LONG_BITS=64
 TARGET_NOT_USING_LEGACY_NATIVE_ENDIAN_API=y
+TARGET_NOT_USING_LEGACY_LDST_PHYS_API=y
-- 
2.53.0

[PULL 027/110] target/loongarch: Avoid target-specific migration headers in machine.c

[Philippe Mathieu-Daudé]

machine.c doesn't use any target-specific macro defined by
the "migration/cpu.h" header. Use the minimum header required:
"migration/qemu-file-types.h" which is not target-specific.
This allows to build this file as common object.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260325211728.89204-3-philmd@linaro.org>
---
 target/loongarch/machine.c   | 2 +-
 target/loongarch/meson.build | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/loongarch/machine.c b/target/loongarch/machine.c
index 28b9079d04e..4db53fec267 100644
--- a/target/loongarch/machine.c
+++ b/target/loongarch/machine.c
@@ -7,7 +7,7 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "migration/cpu.h"
+#include "migration/vmstate.h"
 #include "system/tcg.h"
 #include "vec.h"
 
diff --git a/target/loongarch/meson.build b/target/loongarch/meson.build
index 2ae96d68695..c5a2953b29c 100644
--- a/target/loongarch/meson.build
+++ b/target/loongarch/meson.build
@@ -10,6 +10,7 @@ loongarch_user_ss.add(files('gdbstub.c'))
 
 loongarch_common_system_ss = ss.source_set()
 loongarch_common_system_ss.add(files('gdbstub.c'))
+loongarch_common_system_ss.add(files('machine.c'))
 
 loongarch_system_ss = ss.source_set()
 loongarch_system_ss.add(files(
@@ -17,7 +18,6 @@ loongarch_system_ss.add(files(
   'cpu_helper.c',
   'csr.c',
   'loongarch-qmp-cmds.c',
-  'machine.c',
 ))
 
 common_ss.add(when: 'CONFIG_LOONGARCH_DIS', if_true: [files('disas.c'), gen])
-- 
2.53.0

[PULL 028/110] target/avr: Avoid target-specific migration headers in machine.c

[Philippe Mathieu-Daudé]

machine.c doesn't use any target-specific macro defined by
the "migration/cpu.h" header. Use the minimum headers required:
"migration/qemu-file-types.h" and "migration/vmstate.h", which
are not target-specific. This allows to build this file as
common object.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260325211728.89204-2-philmd@linaro.org>
---
 target/avr/machine.c   | 3 ++-
 target/avr/meson.build | 3 +--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/avr/machine.c b/target/avr/machine.c
index 4402862fb96..8064a7214a3 100644
--- a/target/avr/machine.c
+++ b/target/avr/machine.c
@@ -20,7 +20,8 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "migration/cpu.h"
+#include "migration/qemu-file-types.h"
+#include "migration/vmstate.h"
 
 static int get_sreg(QEMUFile *f, void *opaque, size_t size,
                     const VMStateField *field)
diff --git a/target/avr/meson.build b/target/avr/meson.build
index af5e7d63741..39e5eb02c2b 100644
--- a/target/avr/meson.build
+++ b/target/avr/meson.build
@@ -15,8 +15,7 @@ avr_ss.add(files(
 
 avr_common_system_ss = ss.source_set()
 avr_common_system_ss.add(files('gdbstub.c'))
-
-avr_system_ss.add(files('machine.c'))
+avr_common_system_ss.add(files('machine.c'))
 
 target_arch += {'avr': avr_ss}
 target_system_arch += {'avr': avr_system_ss}
-- 
2.53.0

[PULL 029/110] migration: Revert "Add VMSTATE_UINTTL_2DARRAY()"

[Philippe Mathieu-Daudé]

The VMSTATE_UINTTL_2DARRAY() macro was never used, remove it.

This reverts commit 4597992f624c015ceb51fedb4628b3fdb1e5bbaa.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Peter Xu <peterx@redhat.com>
Message-Id: <20260325211728.89204-4-philmd@linaro.org>
---
 include/migration/cpu.h | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/include/migration/cpu.h b/include/migration/cpu.h
index 1335abe2230..e3d6c06b7d4 100644
--- a/include/migration/cpu.h
+++ b/include/migration/cpu.h
@@ -23,8 +23,6 @@
     VMSTATE_UINT64_ARRAY_V(_f, _s, _n, _v)
 #define VMSTATE_UINTTL_SUB_ARRAY(_f, _s, _start, _num)                \
     VMSTATE_UINT64_SUB_ARRAY(_f, _s, _start, _num)
-#define VMSTATE_UINTTL_2DARRAY_V(_f, _s, _n1, _n2, _v)                \
-    VMSTATE_UINT64_2DARRAY_V(_f, _s, _n1, _n2, _v)
 #define VMSTATE_UINTTL_TEST(_f, _s, _t)                               \
     VMSTATE_UINT64_TEST(_f, _s, _t)
 #define vmstate_info_uinttl vmstate_info_uint64
@@ -44,8 +42,6 @@
     VMSTATE_UINT32_ARRAY_V(_f, _s, _n, _v)
 #define VMSTATE_UINTTL_SUB_ARRAY(_f, _s, _start, _num)                \
     VMSTATE_UINT32_SUB_ARRAY(_f, _s, _start, _num)
-#define VMSTATE_UINTTL_2DARRAY_V(_f, _s, _n1, _n2, _v)                \
-    VMSTATE_UINT32_2DARRAY_V(_f, _s, _n1, _n2, _v)
 #define VMSTATE_UINTTL_TEST(_f, _s, _t)                               \
     VMSTATE_UINT32_TEST(_f, _s, _t)
 #define vmstate_info_uinttl vmstate_info_uint32
@@ -55,8 +51,6 @@
     VMSTATE_UINTTL_V(_f, _s, 0)
 #define VMSTATE_UINTTL_ARRAY(_f, _s, _n)                              \
     VMSTATE_UINTTL_ARRAY_V(_f, _s, _n, 0)
-#define VMSTATE_UINTTL_2DARRAY(_f, _s, _n1, _n2)                      \
-    VMSTATE_UINTTL_2DARRAY_V(_f, _s, _n1, _n2, 0)
 
 
 #endif
-- 
2.53.0

[PULL 030/110] migration: Remove unused target-specific macros

[Philippe Mathieu-Daudé]

Last use of VMSTATE_UINTTL_TEST() was removed in commit 445d3facffe
("ppc/spapr: remove deprecated machine pseries-2.7").

The following definitions were added in commit b6c4f71f508 ("Resurrect
the safe part of r5274") but never used:

 - qemu_put_sbetl qemu_put_sbe64
 - qemu_get_sbetl qemu_get_sbe64
 - qemu_put_sbetls qemu_put_sbe64s
 - qemu_get_sbetls qemu_get_sbe64s

Remove all as unused.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Peter Xu <peterx@redhat.com>
Message-Id: <20260325211728.89204-5-philmd@linaro.org>
---
 include/migration/cpu.h | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/include/migration/cpu.h b/include/migration/cpu.h
index e3d6c06b7d4..bb8ecfbeea5 100644
--- a/include/migration/cpu.h
+++ b/include/migration/cpu.h
@@ -12,10 +12,6 @@
 #define qemu_get_betl qemu_get_be64
 #define qemu_put_betls qemu_put_be64s
 #define qemu_get_betls qemu_get_be64s
-#define qemu_put_sbetl qemu_put_sbe64
-#define qemu_get_sbetl qemu_get_sbe64
-#define qemu_put_sbetls qemu_put_sbe64s
-#define qemu_get_sbetls qemu_get_sbe64s
 
 #define VMSTATE_UINTTL_V(_f, _s, _v)                                  \
     VMSTATE_UINT64_V(_f, _s, _v)
@@ -23,18 +19,12 @@
     VMSTATE_UINT64_ARRAY_V(_f, _s, _n, _v)
 #define VMSTATE_UINTTL_SUB_ARRAY(_f, _s, _start, _num)                \
     VMSTATE_UINT64_SUB_ARRAY(_f, _s, _start, _num)
-#define VMSTATE_UINTTL_TEST(_f, _s, _t)                               \
-    VMSTATE_UINT64_TEST(_f, _s, _t)
 #define vmstate_info_uinttl vmstate_info_uint64
 #else
 #define qemu_put_betl qemu_put_be32
 #define qemu_get_betl qemu_get_be32
 #define qemu_put_betls qemu_put_be32s
 #define qemu_get_betls qemu_get_be32s
-#define qemu_put_sbetl qemu_put_sbe32
-#define qemu_get_sbetl qemu_get_sbe32
-#define qemu_put_sbetls qemu_put_sbe32s
-#define qemu_get_sbetls qemu_get_sbe32s
 
 #define VMSTATE_UINTTL_V(_f, _s, _v)                                  \
     VMSTATE_UINT32_V(_f, _s, _v)
@@ -42,8 +32,6 @@
     VMSTATE_UINT32_ARRAY_V(_f, _s, _n, _v)
 #define VMSTATE_UINTTL_SUB_ARRAY(_f, _s, _start, _num)                \
     VMSTATE_UINT32_SUB_ARRAY(_f, _s, _start, _num)
-#define VMSTATE_UINTTL_TEST(_f, _s, _t)                               \
-    VMSTATE_UINT32_TEST(_f, _s, _t)
 #define vmstate_info_uinttl vmstate_info_uint32
 #endif
 
@@ -52,5 +40,4 @@
 #define VMSTATE_UINTTL_ARRAY(_f, _s, _n)                              \
     VMSTATE_UINTTL_ARRAY_V(_f, _s, _n, 0)
 
-
 #endif
-- 
2.53.0

[PULL 031/110] target/sparc: Inline qemu_get/put_betl()

[Philippe Mathieu-Daudé]

Use TargetInfo target_long_bits() helper at runtime to migrate
the FSR register as 32 or 64-bits.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260325211728.89204-6-philmd@linaro.org>
---
 include/migration/cpu.h |  4 ----
 target/sparc/machine.c  | 17 +++++++++++++----
 2 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/include/migration/cpu.h b/include/migration/cpu.h
index bb8ecfbeea5..87ca977a3fd 100644
--- a/include/migration/cpu.h
+++ b/include/migration/cpu.h
@@ -8,8 +8,6 @@
 #include "migration/vmstate.h"
 
 #if TARGET_LONG_BITS == 64
-#define qemu_put_betl qemu_put_be64
-#define qemu_get_betl qemu_get_be64
 #define qemu_put_betls qemu_put_be64s
 #define qemu_get_betls qemu_get_be64s
 
@@ -21,8 +19,6 @@
     VMSTATE_UINT64_SUB_ARRAY(_f, _s, _start, _num)
 #define vmstate_info_uinttl vmstate_info_uint64
 #else
-#define qemu_put_betl qemu_put_be32
-#define qemu_get_betl qemu_get_be32
 #define qemu_put_betls qemu_put_be32s
 #define qemu_get_betls qemu_get_be32s
 
diff --git a/target/sparc/machine.c b/target/sparc/machine.c
index 4dd75aff74a..0a449f2f8c6 100644
--- a/target/sparc/machine.c
+++ b/target/sparc/machine.c
@@ -1,8 +1,10 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
+#include "qemu/target-info.h"
 #include "qemu/timer.h"
 
 #include "migration/cpu.h"
+#include "migration/qemu-file-types.h"
 
 #ifdef TARGET_SPARC64
 static const VMStateDescription vmstate_cpu_timer = {
@@ -86,9 +88,13 @@ static int get_fsr(QEMUFile *f, void *opaque, size_t size,
                    const VMStateField *field)
 {
     SPARCCPU *cpu = opaque;
-    target_ulong val = qemu_get_betl(f);
 
-    cpu_put_fsr(&cpu->env, val);
+    if (target_long_bits() == 64) {
+        cpu_put_fsr(&cpu->env, qemu_get_be64(f));
+    } else {
+        cpu_put_fsr(&cpu->env, qemu_get_be32(f));
+    }
+
     return 0;
 }
 
@@ -96,9 +102,12 @@ static int put_fsr(QEMUFile *f, void *opaque, size_t size,
                    const VMStateField *field, JSONWriter *vmdesc)
 {
     SPARCCPU *cpu = opaque;
-    target_ulong val = cpu_get_fsr(&cpu->env);
 
-    qemu_put_betl(f, val);
+    if (target_long_bits() == 64) {
+        qemu_put_be64(f, cpu_get_fsr(&cpu->env));
+    } else {
+        qemu_put_be32(f, cpu_get_fsr(&cpu->env));
+    }
     return 0;
 }
 
-- 
2.53.0

[PULL 032/110] target/mips: Inline qemu_get/put_betls()

[Philippe Mathieu-Daudé]

Use TargetInfo target_long_bits() helper at runtime to migrate
the VPN register as 32 or 64-bits.

The "migration/qemu-file-types.h" isn't required anymore in
"migration/cpu.h", however it was missing in "ppc/machine.c".

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260325211728.89204-7-philmd@linaro.org>
---
 include/migration/cpu.h      |  7 -------
 target/mips/system/machine.c | 14 ++++++++++++--
 target/ppc/machine.c         |  1 +
 3 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/include/migration/cpu.h b/include/migration/cpu.h
index 87ca977a3fd..8260ce0a3b7 100644
--- a/include/migration/cpu.h
+++ b/include/migration/cpu.h
@@ -4,13 +4,9 @@
 #define MIGRATION_CPU_H
 
 #include "exec/cpu-defs.h"
-#include "migration/qemu-file-types.h"
 #include "migration/vmstate.h"
 
 #if TARGET_LONG_BITS == 64
-#define qemu_put_betls qemu_put_be64s
-#define qemu_get_betls qemu_get_be64s
-
 #define VMSTATE_UINTTL_V(_f, _s, _v)                                  \
     VMSTATE_UINT64_V(_f, _s, _v)
 #define VMSTATE_UINTTL_ARRAY_V(_f, _s, _n, _v)                        \
@@ -19,9 +15,6 @@
     VMSTATE_UINT64_SUB_ARRAY(_f, _s, _start, _num)
 #define vmstate_info_uinttl vmstate_info_uint64
 #else
-#define qemu_put_betls qemu_put_be32s
-#define qemu_get_betls qemu_get_be32s
-
 #define VMSTATE_UINTTL_V(_f, _s, _v)                                  \
     VMSTATE_UINT32_V(_f, _s, _v)
 #define VMSTATE_UINTTL_ARRAY_V(_f, _s, _n, _v)                        \
diff --git a/target/mips/system/machine.c b/target/mips/system/machine.c
index 0a32665f835..5880b401b07 100644
--- a/target/mips/system/machine.c
+++ b/target/mips/system/machine.c
@@ -1,7 +1,9 @@
 #include "qemu/osdep.h"
+#include "qemu/target-info.h"
 #include "cpu.h"
 #include "internal.h"
 #include "migration/cpu.h"
+#include "migration/qemu-file-types.h"
 #include "fpu_helper.h"
 #include "qemu/timer.h"
 
@@ -140,7 +142,11 @@ static int get_tlb(QEMUFile *f, void *pv, size_t size,
     r4k_tlb_t *v = pv;
     uint16_t flags;
 
-    qemu_get_betls(f, &v->VPN);
+    if (target_long_bits() == 64) {
+        v->VPN = qemu_get_be64(f);
+    } else {
+        v->VPN = qemu_get_be32(f);
+    }
     qemu_get_be32s(f, &v->PageMask);
     qemu_get_be16s(f, &v->ASID);
     qemu_get_be32s(f, &v->MMID);
@@ -183,7 +189,11 @@ static int put_tlb(QEMUFile *f, void *pv, size_t size,
                       (v->D0 << 1) |
                       (v->D1 << 0));
 
-    qemu_put_betls(f, &v->VPN);
+    if (target_long_bits() == 64) {
+        qemu_put_be64(f, v->VPN);
+    } else {
+        qemu_put_be32(f, v->VPN);
+    }
     qemu_put_be32s(f, &v->PageMask);
     qemu_put_be16s(f, &asid);
     qemu_put_be32s(f, &mmid);
diff --git a/target/ppc/machine.c b/target/ppc/machine.c
index 9eae0ff647d..569536bd02d 100644
--- a/target/ppc/machine.c
+++ b/target/ppc/machine.c
@@ -5,6 +5,7 @@
 #include "helper_regs.h"
 #include "mmu-hash64.h"
 #include "migration/cpu.h"
+#include "migration/qemu-file-types.h"
 #include "qapi/error.h"
 #include "kvm_ppc.h"
 #include "power8-pmu.h"
-- 
2.53.0

[PULL 033/110] target/i386: Expand VMSTATE_UINTTL_SUB_ARRAY for APX registers

[Philippe Mathieu-Daudé]

APX registers are only migrated for 64-bit binaries, so
VMSTATE_UINTTL_SUB_ARRAY() expands to VMSTATE_UINT64_SUB_ARRAY().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260325211728.89204-8-philmd@linaro.org>
---
 target/i386/machine.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/i386/machine.c b/target/i386/machine.c
index 48a2a4b3190..1f5c517e562 100644
--- a/target/i386/machine.c
+++ b/target/i386/machine.c
@@ -1756,7 +1756,7 @@ static const VMStateDescription vmstate_apx = {
     .minimum_version_id = 1,
     .needed = apx_needed,
     .fields = (VMStateField[]) {
-        VMSTATE_UINTTL_SUB_ARRAY(env.regs, X86CPU, CPU_NB_REGS,
+        VMSTATE_UINT64_SUB_ARRAY(env.regs, X86CPU, CPU_NB_REGS,
                                  CPU_NB_EREGS - CPU_NB_REGS),
         VMSTATE_END_OF_LIST()
     }
-- 
2.53.0

[PULL 034/110] target/sparc: Replace VMSTATE_VARRAY_MULTIPLY -> VMSTATE_UINTTL_ARRAY

[Philippe Mathieu-Daudé]

VMSTATE_VARRAY_MULTIPLY() seems to be an "optimized" version
of VMSTATE_UINTTL_ARRAY(), and is only used once. Prefer the
generic macro. Bump the SPARC CPU migration stream version.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260325211728.89204-10-philmd@linaro.org>
---
 include/migration/cpu.h | 2 --
 target/sparc/machine.c  | 7 +++----
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/include/migration/cpu.h b/include/migration/cpu.h
index 8260ce0a3b7..8d15783b8c1 100644
--- a/include/migration/cpu.h
+++ b/include/migration/cpu.h
@@ -13,7 +13,6 @@
     VMSTATE_UINT64_ARRAY_V(_f, _s, _n, _v)
 #define VMSTATE_UINTTL_SUB_ARRAY(_f, _s, _start, _num)                \
     VMSTATE_UINT64_SUB_ARRAY(_f, _s, _start, _num)
-#define vmstate_info_uinttl vmstate_info_uint64
 #else
 #define VMSTATE_UINTTL_V(_f, _s, _v)                                  \
     VMSTATE_UINT32_V(_f, _s, _v)
@@ -21,7 +20,6 @@
     VMSTATE_UINT32_ARRAY_V(_f, _s, _n, _v)
 #define VMSTATE_UINTTL_SUB_ARRAY(_f, _s, _start, _num)                \
     VMSTATE_UINT32_SUB_ARRAY(_f, _s, _start, _num)
-#define vmstate_info_uinttl vmstate_info_uint32
 #endif
 
 #define VMSTATE_UINTTL(_f, _s)                                        \
diff --git a/target/sparc/machine.c b/target/sparc/machine.c
index 0a449f2f8c6..5f402e098cf 100644
--- a/target/sparc/machine.c
+++ b/target/sparc/machine.c
@@ -189,9 +189,9 @@ static int cpu_pre_save(void *opaque)
  * versions are different.
  */
 #ifndef TARGET_SPARC64
-#define SPARC_VMSTATE_VER 7
+#define SPARC_VMSTATE_VER 8
 #else
-#define SPARC_VMSTATE_VER 9
+#define SPARC_VMSTATE_VER 10
 #endif
 
 const VMStateDescription vmstate_sparc_cpu = {
@@ -202,8 +202,7 @@ const VMStateDescription vmstate_sparc_cpu = {
     .fields = (const VMStateField[]) {
         VMSTATE_UINTTL_ARRAY(env.gregs, SPARCCPU, 8),
         VMSTATE_UINT32(env.nwindows, SPARCCPU),
-        VMSTATE_VARRAY_MULTIPLY(env.regbase, SPARCCPU, env.nwindows, 16,
-                                vmstate_info_uinttl, target_ulong),
+        VMSTATE_UINTTL_ARRAY(env.regbase, SPARCCPU, MAX_NWINDOWS * 16 + 8),
         VMSTATE_CPUDOUBLE_ARRAY(env.fpr, SPARCCPU, TARGET_DPREGS),
         VMSTATE_UINTTL(env.pc, SPARCCPU),
         VMSTATE_UINTTL(env.npc, SPARCCPU),
-- 
2.53.0

[PULL 035/110] cpus: Remove CPUClass::init_accel_cpu() left-over hook

[Philippe Mathieu-Daudé]

Commits f50d0f335a6 and a522b04bb9c ("target/riscv,i386: Remove
AccelCPUClass::cpu_class_init need") removed the last uses of
the CPUClass::init_accel_cpu hook. Remove it as unused.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260412212547.29645-1-philmd@linaro.org>
---
 include/hw/core/cpu.h |  6 ------
 accel/accel-common.c  | 13 -------------
 2 files changed, 19 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index 207a7a1becb..c9fea797435 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -186,12 +186,6 @@ struct CPUClass {
     /* when TCG is not available, this pointer is NULL */
     const TCGCPUOps *tcg_ops;
 
-    /*
-     * if not NULL, this is called in order for the CPUClass to initialize
-     * class data that depends on the accelerator, see accel/accel-common.c.
-     */
-    void (*init_accel_cpu)(struct AccelCPUClass *accel_cpu, CPUClass *cc);
-
     /*
      * Keep non-pointer data at the end to minimize holes.
      */
diff --git a/accel/accel-common.c b/accel/accel-common.c
index eecb2a292af..9c5b4111c8d 100644
--- a/accel/accel-common.c
+++ b/accel/accel-common.c
@@ -37,23 +37,10 @@ static void accel_init_cpu_int_aux(ObjectClass *klass, void *opaque)
     CPUClass *cc = CPU_CLASS(klass);
     AccelCPUClass *accel_cpu = opaque;
 
-    /*
-     * The first callback allows accel-cpu to run initializations
-     * for the CPU, customizing CPU behavior according to the accelerator.
-     *
-     * The second one allows the CPU to customize the accel-cpu
-     * behavior according to the CPU.
-     *
-     * The second is currently only used by TCG, to specialize the
-     * TCGCPUOps depending on the CPU type.
-     */
     cc->accel_cpu = accel_cpu;
     if (accel_cpu->cpu_class_init) {
         accel_cpu->cpu_class_init(cc);
     }
-    if (cc->init_accel_cpu) {
-        cc->init_accel_cpu(accel_cpu, cc);
-    }
 }
 
 /* initialize the arch-specific accel CpuClass interfaces */
-- 
2.53.0

[PULL 036/110] target/i386: Replace target_ulong -> uint64_t for TARGET_X86_64

[Philippe Mathieu-Daudé]

These registers are only available on 64-bit builds, thus
always handled as 64-bit. This isn't even a migration break
because they are migrated as 64-bit since the beginning
(see commit 02536f8b1f9 "x86_64 save/restore").

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20260315165319.39727-1-philmd@linaro.org>
---
 target/i386/cpu.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index f57c99e8b4e..a836efd45ee 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2061,10 +2061,10 @@ typedef struct CPUArchState {
     uint64_t vm_hsave;
 
 #ifdef TARGET_X86_64
-    target_ulong lstar;
-    target_ulong cstar;
-    target_ulong fmask;
-    target_ulong kernelgsbase;
+    uint64_t lstar;
+    uint64_t cstar;
+    uint64_t fmask;
+    uint64_t kernelgsbase;
 
     /* FRED MSRs */
     uint64_t fred_rsp0;
-- 
2.53.0

[PULL 037/110] target/mips: Pass MemOpIdx argument to Load/Store Multiple helpers

[Philippe Mathieu-Daudé]

In preparation of using the MemOp content in the next commit,
pass it as MemOpIdx. Include the access size.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260417035734.32334-2-philmd@linaro.org>
---
 target/mips/tcg/ldst_helper.c             | 16 ++++++++++++----
 target/mips/tcg/micromips_translate.c.inc | 16 ++++++++++------
 2 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/target/mips/tcg/ldst_helper.c b/target/mips/tcg/ldst_helper.c
index 10319bf03a6..ffe1895706a 100644
--- a/target/mips/tcg/ldst_helper.c
+++ b/target/mips/tcg/ldst_helper.c
@@ -212,8 +212,10 @@ void helper_sdr(CPUMIPSState *env, target_ulong arg1, target_ulong arg2,
 static const int multiple_regs[] = { 16, 17, 18, 19, 20, 21, 22, 23, 30 };
 
 void helper_lwm(CPUMIPSState *env, target_ulong addr, target_ulong reglist,
-                uint32_t mem_idx)
+                uint32_t memop_idx)
 {
+    MemOpIdx oi = memop_idx;
+    unsigned mem_idx = get_mmuidx(oi);
     target_ulong base_reglist = reglist & 0xf;
     target_ulong do_r31 = reglist & 0x10;
 
@@ -234,8 +236,10 @@ void helper_lwm(CPUMIPSState *env, target_ulong addr, target_ulong reglist,
 }
 
 void helper_swm(CPUMIPSState *env, target_ulong addr, target_ulong reglist,
-                uint32_t mem_idx)
+                uint32_t memop_idx)
 {
+    MemOpIdx oi = memop_idx;
+    unsigned mem_idx = get_mmuidx(oi);
     target_ulong base_reglist = reglist & 0xf;
     target_ulong do_r31 = reglist & 0x10;
 
@@ -256,8 +260,10 @@ void helper_swm(CPUMIPSState *env, target_ulong addr, target_ulong reglist,
 
 #if defined(TARGET_MIPS64)
 void helper_ldm(CPUMIPSState *env, target_ulong addr, target_ulong reglist,
-                uint32_t mem_idx)
+                uint32_t memop_idx)
 {
+    MemOpIdx oi = memop_idx;
+    unsigned mem_idx = get_mmuidx(oi);
     target_ulong base_reglist = reglist & 0xf;
     target_ulong do_r31 = reglist & 0x10;
 
@@ -278,8 +284,10 @@ void helper_ldm(CPUMIPSState *env, target_ulong addr, target_ulong reglist,
 }
 
 void helper_sdm(CPUMIPSState *env, target_ulong addr, target_ulong reglist,
-                uint32_t mem_idx)
+                uint32_t memop_idx)
 {
+    MemOpIdx oi = memop_idx;
+    unsigned mem_idx = get_mmuidx(oi);
     target_ulong base_reglist = reglist & 0xf;
     target_ulong do_r31 = reglist & 0x10;
 
diff --git a/target/mips/tcg/micromips_translate.c.inc b/target/mips/tcg/micromips_translate.c.inc
index 8fda7c8a214..4dca11b84b4 100644
--- a/target/mips/tcg/micromips_translate.c.inc
+++ b/target/mips/tcg/micromips_translate.c.inc
@@ -693,7 +693,8 @@ static void gen_ldst_multiple(DisasContext *ctx, uint32_t opc, int reglist,
                               int base, int16_t offset)
 {
     TCGv t0, t1;
-    TCGv_i32 t2;
+    MemOp mop = MO_UNALN;
+    MemOpIdx oi;
 
     if (ctx->hflags & MIPS_HFLAG_BMASK) {
         gen_reserved_instruction(ctx);
@@ -705,22 +706,25 @@ static void gen_ldst_multiple(DisasContext *ctx, uint32_t opc, int reglist,
     gen_base_offset_addr(ctx, t0, base, offset);
 
     t1 = tcg_constant_tl(reglist);
-    t2 = tcg_constant_i32(ctx->mem_idx);
 
     save_cpu_state(ctx, 1);
     switch (opc) {
     case LWM32:
-        gen_helper_lwm(tcg_env, t0, t1, t2);
+        oi = make_memop_idx(mop | MO_UL, ctx->mem_idx);
+        gen_helper_lwm(tcg_env, t0, t1, tcg_constant_i32(oi));
         break;
     case SWM32:
-        gen_helper_swm(tcg_env, t0, t1, t2);
+        oi = make_memop_idx(mop | MO_UL, ctx->mem_idx);
+        gen_helper_swm(tcg_env, t0, t1, tcg_constant_i32(oi));
         break;
 #ifdef TARGET_MIPS64
     case LDM:
-        gen_helper_ldm(tcg_env, t0, t1, t2);
+        oi = make_memop_idx(mop | MO_UQ, ctx->mem_idx);
+        gen_helper_ldm(tcg_env, t0, t1, tcg_constant_i32(oi));
         break;
     case SDM:
-        gen_helper_sdm(tcg_env, t0, t1, t2);
+        oi = make_memop_idx(mop | MO_UQ, ctx->mem_idx);
+        gen_helper_sdm(tcg_env, t0, t1, tcg_constant_i32(oi));
         break;
 #endif
     }
-- 
2.53.0

[PULL 038/110] target/mips: Remove unnecessary target_ulong uses in LD/ST Multiple

[Philippe Mathieu-Daudé]

@do_r31 is a boolean, @base_reglist an unsigned size
and @i an unsigned index.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260417035734.32334-3-philmd@linaro.org>
---
 target/mips/tcg/ldst_helper.c | 32 ++++++++++++--------------------
 1 file changed, 12 insertions(+), 20 deletions(-)

diff --git a/target/mips/tcg/ldst_helper.c b/target/mips/tcg/ldst_helper.c
index ffe1895706a..0def1f296ae 100644
--- a/target/mips/tcg/ldst_helper.c
+++ b/target/mips/tcg/ldst_helper.c
@@ -216,13 +216,11 @@ void helper_lwm(CPUMIPSState *env, target_ulong addr, target_ulong reglist,
 {
     MemOpIdx oi = memop_idx;
     unsigned mem_idx = get_mmuidx(oi);
-    target_ulong base_reglist = reglist & 0xf;
-    target_ulong do_r31 = reglist & 0x10;
+    unsigned base_reglist = reglist & 0xf;
+    bool do_r31 = reglist & 0x10;
 
     if (base_reglist > 0 && base_reglist <= ARRAY_SIZE(multiple_regs)) {
-        target_ulong i;
-
-        for (i = 0; i < base_reglist; i++) {
+        for (unsigned i = 0; i < base_reglist; i++) {
             env->active_tc.gpr[multiple_regs[i]] =
                 (target_long)cpu_ldl_mmuidx_ra(env, addr, mem_idx, GETPC());
             addr += 4;
@@ -240,13 +238,11 @@ void helper_swm(CPUMIPSState *env, target_ulong addr, target_ulong reglist,
 {
     MemOpIdx oi = memop_idx;
     unsigned mem_idx = get_mmuidx(oi);
-    target_ulong base_reglist = reglist & 0xf;
-    target_ulong do_r31 = reglist & 0x10;
+    unsigned base_reglist = reglist & 0xf;
+    bool do_r31 = reglist & 0x10;
 
     if (base_reglist > 0 && base_reglist <= ARRAY_SIZE(multiple_regs)) {
-        target_ulong i;
-
-        for (i = 0; i < base_reglist; i++) {
+        for (unsigned i = 0; i < base_reglist; i++) {
             cpu_stl_mmuidx_ra(env, addr, env->active_tc.gpr[multiple_regs[i]],
                               mem_idx, GETPC());
             addr += 4;
@@ -264,13 +260,11 @@ void helper_ldm(CPUMIPSState *env, target_ulong addr, target_ulong reglist,
 {
     MemOpIdx oi = memop_idx;
     unsigned mem_idx = get_mmuidx(oi);
-    target_ulong base_reglist = reglist & 0xf;
-    target_ulong do_r31 = reglist & 0x10;
+    unsigned base_reglist = reglist & 0xf;
+    bool do_r31 = reglist & 0x10;
 
     if (base_reglist > 0 && base_reglist <= ARRAY_SIZE(multiple_regs)) {
-        target_ulong i;
-
-        for (i = 0; i < base_reglist; i++) {
+        for (unsigned i = 0; i < base_reglist; i++) {
             env->active_tc.gpr[multiple_regs[i]] =
                 cpu_ldq_mmuidx_ra(env, addr, mem_idx, GETPC());
             addr += 8;
@@ -288,13 +282,11 @@ void helper_sdm(CPUMIPSState *env, target_ulong addr, target_ulong reglist,
 {
     MemOpIdx oi = memop_idx;
     unsigned mem_idx = get_mmuidx(oi);
-    target_ulong base_reglist = reglist & 0xf;
-    target_ulong do_r31 = reglist & 0x10;
+    unsigned base_reglist = reglist & 0xf;
+    bool do_r31 = reglist & 0x10;
 
     if (base_reglist > 0 && base_reglist <= ARRAY_SIZE(multiple_regs)) {
-        target_ulong i;
-
-        for (i = 0; i < base_reglist; i++) {
+        for (unsigned i = 0; i < base_reglist; i++) {
             cpu_stq_mmuidx_ra(env, addr, env->active_tc.gpr[multiple_regs[i]],
                               mem_idx, GETPC());
             addr += 8;
-- 
2.53.0

[PULL 039/110] target/mips: Inline cpu_ld/st_mmuidx_ra() calls in LD/ST Multiple

[Philippe Mathieu-Daudé]

In preparation of removing the cpu_ld*_mmuidx_ra() and
cpu_st*_mmuidx_ra() calls, inline them. Expand MO_TE to
mo_endian_env(env) in gen_ldst_multiple().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260417035734.32334-4-philmd@linaro.org>
---
 target/mips/tcg/ldst_helper.c             | 34 +++++++++++------------
 target/mips/tcg/micromips_translate.c.inc |  2 ++
 2 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/target/mips/tcg/ldst_helper.c b/target/mips/tcg/ldst_helper.c
index 0def1f296ae..537f3e87bc0 100644
--- a/target/mips/tcg/ldst_helper.c
+++ b/target/mips/tcg/ldst_helper.c
@@ -215,21 +215,20 @@ void helper_lwm(CPUMIPSState *env, target_ulong addr, target_ulong reglist,
                 uint32_t memop_idx)
 {
     MemOpIdx oi = memop_idx;
-    unsigned mem_idx = get_mmuidx(oi);
     unsigned base_reglist = reglist & 0xf;
     bool do_r31 = reglist & 0x10;
+    target_ulong *gpr = env->active_tc.gpr;
+    uintptr_t ra = GETPC();
 
     if (base_reglist > 0 && base_reglist <= ARRAY_SIZE(multiple_regs)) {
         for (unsigned i = 0; i < base_reglist; i++) {
-            env->active_tc.gpr[multiple_regs[i]] =
-                (target_long)cpu_ldl_mmuidx_ra(env, addr, mem_idx, GETPC());
+            gpr[multiple_regs[i]] = (target_long)cpu_ldl_mmu(env, addr, oi, ra);
             addr += 4;
         }
     }
 
     if (do_r31) {
-        env->active_tc.gpr[31] =
-            (target_long)cpu_ldl_mmuidx_ra(env, addr, mem_idx, GETPC());
+        gpr[31] = (target_long)cpu_ldl_mmu(env, addr, oi, ra);
     }
 }
 
@@ -237,20 +236,20 @@ void helper_swm(CPUMIPSState *env, target_ulong addr, target_ulong reglist,
                 uint32_t memop_idx)
 {
     MemOpIdx oi = memop_idx;
-    unsigned mem_idx = get_mmuidx(oi);
     unsigned base_reglist = reglist & 0xf;
     bool do_r31 = reglist & 0x10;
+    target_ulong *gpr = env->active_tc.gpr;
+    uintptr_t ra = GETPC();
 
     if (base_reglist > 0 && base_reglist <= ARRAY_SIZE(multiple_regs)) {
         for (unsigned i = 0; i < base_reglist; i++) {
-            cpu_stl_mmuidx_ra(env, addr, env->active_tc.gpr[multiple_regs[i]],
-                              mem_idx, GETPC());
+            cpu_stl_mmu(env, addr, gpr[multiple_regs[i]], oi, ra);
             addr += 4;
         }
     }
 
     if (do_r31) {
-        cpu_stl_mmuidx_ra(env, addr, env->active_tc.gpr[31], mem_idx, GETPC());
+        cpu_stl_mmu(env, addr, gpr[31], oi, ra);
     }
 }
 
@@ -259,21 +258,20 @@ void helper_ldm(CPUMIPSState *env, target_ulong addr, target_ulong reglist,
                 uint32_t memop_idx)
 {
     MemOpIdx oi = memop_idx;
-    unsigned mem_idx = get_mmuidx(oi);
     unsigned base_reglist = reglist & 0xf;
     bool do_r31 = reglist & 0x10;
+    target_ulong *gpr = env->active_tc.gpr;
+    uintptr_t ra = GETPC();
 
     if (base_reglist > 0 && base_reglist <= ARRAY_SIZE(multiple_regs)) {
         for (unsigned i = 0; i < base_reglist; i++) {
-            env->active_tc.gpr[multiple_regs[i]] =
-                cpu_ldq_mmuidx_ra(env, addr, mem_idx, GETPC());
+            gpr[multiple_regs[i]] = cpu_ldq_mmu(env, addr, oi, ra);
             addr += 8;
         }
     }
 
     if (do_r31) {
-        env->active_tc.gpr[31] =
-            cpu_ldq_mmuidx_ra(env, addr, mem_idx, GETPC());
+        gpr[31] = cpu_ldq_mmu(env, addr, oi, ra);
     }
 }
 
@@ -281,20 +279,20 @@ void helper_sdm(CPUMIPSState *env, target_ulong addr, target_ulong reglist,
                 uint32_t memop_idx)
 {
     MemOpIdx oi = memop_idx;
-    unsigned mem_idx = get_mmuidx(oi);
     unsigned base_reglist = reglist & 0xf;
     bool do_r31 = reglist & 0x10;
+    target_ulong *gpr = env->active_tc.gpr;
+    uintptr_t ra = GETPC();
 
     if (base_reglist > 0 && base_reglist <= ARRAY_SIZE(multiple_regs)) {
         for (unsigned i = 0; i < base_reglist; i++) {
-            cpu_stq_mmuidx_ra(env, addr, env->active_tc.gpr[multiple_regs[i]],
-                              mem_idx, GETPC());
+            cpu_stq_mmu(env, addr, gpr[multiple_regs[i]], oi, ra);
             addr += 8;
         }
     }
 
     if (do_r31) {
-        cpu_stq_mmuidx_ra(env, addr, env->active_tc.gpr[31], mem_idx, GETPC());
+        cpu_stq_mmu(env, addr, gpr[31], oi, ra);
     }
 }
 
diff --git a/target/mips/tcg/micromips_translate.c.inc b/target/mips/tcg/micromips_translate.c.inc
index 4dca11b84b4..fb107eb91fe 100644
--- a/target/mips/tcg/micromips_translate.c.inc
+++ b/target/mips/tcg/micromips_translate.c.inc
@@ -701,6 +701,8 @@ static void gen_ldst_multiple(DisasContext *ctx, uint32_t opc, int reglist,
         return;
     }
 
+    mop |= mo_endian(ctx);
+
     t0 = tcg_temp_new();
 
     gen_base_offset_addr(ctx, t0, base, offset);
-- 
2.53.0

[PULL 040/110] target/mips: Check alignment for microMIPS pre-R6 LD/ST multiple

[Philippe Mathieu-Daudé]

Pre-REL6 microMIPS requires alignment while REL6 microMIPS does not.
Use @default_tcg_memop_mask in gen_ldst_multiple(), it is set to
MO_UNALN for REL6 but MO_ALIGN for pre-REL6.

Fixes: 3c824109da0 ("target-mips: microMIPS ASE support")
Reported-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260417035734.32334-5-philmd@linaro.org>
---
 target/mips/tcg/micromips_translate.c.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/mips/tcg/micromips_translate.c.inc b/target/mips/tcg/micromips_translate.c.inc
index fb107eb91fe..da2419792eb 100644
--- a/target/mips/tcg/micromips_translate.c.inc
+++ b/target/mips/tcg/micromips_translate.c.inc
@@ -693,7 +693,7 @@ static void gen_ldst_multiple(DisasContext *ctx, uint32_t opc, int reglist,
                               int base, int16_t offset)
 {
     TCGv t0, t1;
-    MemOp mop = MO_UNALN;
+    MemOp mop = ctx->default_tcg_memop_mask;
     MemOpIdx oi;
 
     if (ctx->hflags & MIPS_HFLAG_BMASK) {
-- 
2.53.0

[PULL 041/110] stubs: Rename monitor* -> qmp* files

[Philippe Mathieu-Daudé]

We use 'HMP' for Human monitor and 'QMP' for 'Machine protocol'.
These files aren't about human monitor but QMP, so rename them
for clarity using the 'qmp-' prefix instead of 'monitor-'.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Eric Farman <farman@linux.ibm.com>
Message-Id: <20260427080738.77138-6-philmd@linaro.org>
---
 MAINTAINERS                                      |  6 ++++++
 stubs/{monitor-arm-gic.c => qmp-arm-gic.c}       |  0
 ...nitor-cpu-s390x-kvm.c => qmp-cpu-s390x-kvm.c} |  0
 stubs/{monitor-cpu-s390x.c => qmp-cpu-s390x.c}   |  0
 stubs/{monitor-cpu.c => qmp-cpu.c}               |  0
 stubs/{monitor-i386-rtc.c => qmp-i386-rtc.c}     |  0
 stubs/{monitor-i386-sev.c => qmp-i386-sev.c}     |  0
 stubs/{monitor-i386-sgx.c => qmp-i386-sgx.c}     |  0
 stubs/{monitor-i386-xen.c => qmp-i386-xen.c}     |  0
 stubs/meson.build                                | 16 ++++++++--------
 10 files changed, 14 insertions(+), 8 deletions(-)
 rename stubs/{monitor-arm-gic.c => qmp-arm-gic.c} (100%)
 rename stubs/{monitor-cpu-s390x-kvm.c => qmp-cpu-s390x-kvm.c} (100%)
 rename stubs/{monitor-cpu-s390x.c => qmp-cpu-s390x.c} (100%)
 rename stubs/{monitor-cpu.c => qmp-cpu.c} (100%)
 rename stubs/{monitor-i386-rtc.c => qmp-i386-rtc.c} (100%)
 rename stubs/{monitor-i386-sev.c => qmp-i386-sev.c} (100%)
 rename stubs/{monitor-i386-sgx.c => qmp-i386-sgx.c} (100%)
 rename stubs/{monitor-i386-xen.c => qmp-i386-xen.c} (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index ac47299fd83..f560853ea41 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -121,6 +121,7 @@ F: include/hw/s390x/
 F: include/hw/watchdog/wdt_diag288.h
 F: pc-bios/s390-ccw/
 F: pc-bios/s390-ccw.img
+F: stubs/qmp-cpu-s390x.c
 F: target/s390x/
 F: docs/system/target-s390x.rst
 F: docs/system/s390x/
@@ -497,6 +498,7 @@ M: Christian Borntraeger <borntraeger@linux.ibm.com>
 R: Eric Farman <farman@linux.ibm.com>
 R: Matthew Rosato <mjrosato@linux.ibm.com>
 S: Supported
+F: stubs/qmp-cpu-s390x-kvm.c
 F: target/s390x/kvm/
 F: target/s390x/machine.c
 F: target/s390x/sigp.c
@@ -510,6 +512,8 @@ L: kvm@vger.kernel.org
 S: Supported
 F: docs/system/i386/amd-memory-encryption.rst
 F: docs/system/i386/sgx.rst
+F: stubs/qmp-i386-sev.c
+F: stubs/qmp-i386-sgx.c
 F: target/i386/kvm/
 F: target/i386/sev*
 F: scripts/kvm/vmxcap
@@ -522,6 +526,7 @@ S: Supported
 F: include/system/kvm_xen.h
 F: target/i386/kvm/xen*
 F: hw/i386/kvm/xen*
+F: stubs/qmp-i386-xen.c
 F: tests/functional/x86_64/test_kvm_xen.py
 
 Guest CPU Cores (other accelerators)
@@ -797,6 +802,7 @@ F: include/hw/timer/a9gtimer.h
 F: include/hw/timer/arm_mptimer.h
 F: include/hw/timer/armv7m_systick.h
 F: include/hw/misc/armv7m_ras.h
+F: stubs/qmp-arm-gic.c
 F: tests/qtest/test-arm-mptimer.c
 
 Bananapi M2U
diff --git a/stubs/monitor-arm-gic.c b/stubs/qmp-arm-gic.c
similarity index 100%
rename from stubs/monitor-arm-gic.c
rename to stubs/qmp-arm-gic.c
diff --git a/stubs/monitor-cpu-s390x-kvm.c b/stubs/qmp-cpu-s390x-kvm.c
similarity index 100%
rename from stubs/monitor-cpu-s390x-kvm.c
rename to stubs/qmp-cpu-s390x-kvm.c
diff --git a/stubs/monitor-cpu-s390x.c b/stubs/qmp-cpu-s390x.c
similarity index 100%
rename from stubs/monitor-cpu-s390x.c
rename to stubs/qmp-cpu-s390x.c
diff --git a/stubs/monitor-cpu.c b/stubs/qmp-cpu.c
similarity index 100%
rename from stubs/monitor-cpu.c
rename to stubs/qmp-cpu.c
diff --git a/stubs/monitor-i386-rtc.c b/stubs/qmp-i386-rtc.c
similarity index 100%
rename from stubs/monitor-i386-rtc.c
rename to stubs/qmp-i386-rtc.c
diff --git a/stubs/monitor-i386-sev.c b/stubs/qmp-i386-sev.c
similarity index 100%
rename from stubs/monitor-i386-sev.c
rename to stubs/qmp-i386-sev.c
diff --git a/stubs/monitor-i386-sgx.c b/stubs/qmp-i386-sgx.c
similarity index 100%
rename from stubs/monitor-i386-sgx.c
rename to stubs/qmp-i386-sgx.c
diff --git a/stubs/monitor-i386-xen.c b/stubs/qmp-i386-xen.c
similarity index 100%
rename from stubs/monitor-i386-xen.c
rename to stubs/qmp-i386-xen.c
diff --git a/stubs/meson.build b/stubs/meson.build
index f33b1d2a089..af4051e6c5e 100644
--- a/stubs/meson.build
+++ b/stubs/meson.build
@@ -79,14 +79,14 @@ if have_system
   stub_ss.add(files('target-monitor-defs.c'))
   stub_ss.add(files('win32-kbd-hook.c'))
   stub_ss.add(files('xen-hw-stub.c'))
-  stub_ss.add(files('monitor-arm-gic.c'))
-  stub_ss.add(files('monitor-i386-rtc.c'))
-  stub_ss.add(files('monitor-i386-sev.c'))
-  stub_ss.add(files('monitor-i386-sgx.c'))
-  stub_ss.add(files('monitor-i386-xen.c'))
-  stub_ss.add(files('monitor-cpu.c'))
-  stub_ss.add(files('monitor-cpu-s390x.c'))
-  stub_ss.add(files('monitor-cpu-s390x-kvm.c'))
+  stub_ss.add(files('qmp-arm-gic.c'))
+  stub_ss.add(files('qmp-i386-rtc.c'))
+  stub_ss.add(files('qmp-i386-sev.c'))
+  stub_ss.add(files('qmp-i386-sgx.c'))
+  stub_ss.add(files('qmp-i386-xen.c'))
+  stub_ss.add(files('qmp-cpu.c'))
+  stub_ss.add(files('qmp-cpu-s390x.c'))
+  stub_ss.add(files('qmp-cpu-s390x-kvm.c'))
 endif
 
 if have_system or have_user
-- 
2.53.0

[PULL 042/110] monitor/meson: Use SPICE with migration HMP commands

[Philippe Mathieu-Daudé]

When moving code around in commit 27be86351ec ("migration: Move
the QMP command from monitor/ to migration/") we forgot to update
the meson rule about SPICE pkg-config flags.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260427080738.77138-7-philmd@linaro.org>
---
 migration/meson.build | 2 +-
 monitor/meson.build   | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/migration/meson.build b/migration/meson.build
index c9f0f5f9f21..e583822dec6 100644
--- a/migration/meson.build
+++ b/migration/meson.build
@@ -23,7 +23,6 @@ system_ss.add(files(
   'fd.c',
   'file.c',
   'global_state.c',
-  'migration-hmp-cmds.c',
   'migration.c',
   'multifd.c',
   'multifd-device-state.c',
@@ -37,6 +36,7 @@ system_ss.add(files(
   'socket.c',
   'tls.c',
 ), gnutls, zlib)
+system_ss.add([spice_headers, files('migration-hmp-cmds.c'), spice])
 
 if get_option('replication').allowed()
   system_ss.add(files('colo-failover.c', 'colo.c', 'multifd-colo.c'))
diff --git a/monitor/meson.build b/monitor/meson.build
index 2647100e04c..585251804e4 100644
--- a/monitor/meson.build
+++ b/monitor/meson.build
@@ -5,8 +5,8 @@ system_ss.add(files(
   'hmp-cmds.c',
   'hmp.c',
   'qemu-config-qmp.c',
+  'qmp-cmds.c',
 ))
-system_ss.add([spice_headers, files('qmp-cmds.c')])
 
 specific_ss.add(when: 'CONFIG_SYSTEM_ONLY',
-                if_true: [files('hmp-target.c'), spice])
+                if_true: [files('hmp-target.c')])
-- 
2.53.0

[PULL 043/110] monitor: Restrict monitor_set_cpu() method scope

[Philippe Mathieu-Daudé]

As mentioned in commit 755f196898e ("qapi: Convert the cpu
command") 15 years ago, the monitor_set_cpu() method is a
temporary bridge between QMP -> HMP and shouldn't be used
elsewhere. Make its scope internal to monitor/.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260427080738.77138-8-philmd@linaro.org>
---
 include/monitor/monitor.h  | 1 -
 monitor/monitor-internal.h | 1 +
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/monitor/monitor.h b/include/monitor/monitor.h
index 296690e1f1c..55649a86641 100644
--- a/include/monitor/monitor.h
+++ b/include/monitor/monitor.h
@@ -37,7 +37,6 @@ int monitor_vprintf(Monitor *mon, const char *fmt, va_list ap)
 int monitor_printf(Monitor *mon, const char *fmt, ...) G_GNUC_PRINTF(2, 3);
 void monitor_printc(Monitor *mon, int ch);
 void monitor_flush(Monitor *mon);
-int monitor_set_cpu(Monitor *mon, int cpu_index);
 int monitor_get_cpu_index(Monitor *mon);
 
 int monitor_puts_locked(Monitor *mon, const char *str);
diff --git a/monitor/monitor-internal.h b/monitor/monitor-internal.h
index feca111ae31..80b4a8150bf 100644
--- a/monitor/monitor-internal.h
+++ b/monitor/monitor-internal.h
@@ -175,6 +175,7 @@ void monitor_data_destroy(Monitor *mon);
 int monitor_can_read(void *opaque);
 void monitor_list_append(Monitor *mon);
 void monitor_fdsets_cleanup(void);
+int monitor_set_cpu(Monitor *mon, int cpu_index);
 
 void qmp_send_response(MonitorQMP *mon, const QDict *rsp);
 void monitor_data_destroy_qmp(MonitorQMP *mon);
-- 
2.53.0

[PULL 044/110] monitor: Make 'info via' a generic command

[Philippe Mathieu-Daudé]

In order to build hmp-commands-info.hx once we need to stop
using device target-specific check. Use the generic pattern
to make the command available on all targets, providing a
stub with kind error message when the device is not available.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260427080738.77138-9-philmd@linaro.org>
---
 MAINTAINERS            |  2 +-
 hw/misc/mos6522-stub.c | 16 ++++++++++++++++
 hmp-commands-info.hx   |  2 --
 hw/misc/meson.build    |  1 +
 4 files changed, 18 insertions(+), 3 deletions(-)
 create mode 100644 hw/misc/mos6522-stub.c

diff --git a/MAINTAINERS b/MAINTAINERS
index f560853ea41..b05e4d2097e 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1566,7 +1566,7 @@ F: hw/ppc/mac_newworld.c
 F: hw/pci-host/uninorth.c
 F: hw/pci-bridge/dec.[hc]
 F: hw/misc/macio/
-F: hw/misc/mos6522.c
+F: hw/misc/mos6522*.c
 F: hw/nvram/mac_nvram.c
 F: hw/ppc/fw_cfg.c
 F: hw/input/adb*
diff --git a/hw/misc/mos6522-stub.c b/hw/misc/mos6522-stub.c
new file mode 100644
index 00000000000..85eb0ee36ee
--- /dev/null
+++ b/hw/misc/mos6522-stub.c
@@ -0,0 +1,16 @@
+/*
+ * QEMU MOS6522 VIA stubs
+ *
+ * Copyright (c) Linaro
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "monitor/monitor.h"
+#include "monitor/hmp.h"
+
+void hmp_info_via(Monitor *mon, const QDict *qdict)
+{
+    monitor_printf(mon, "MOS6522 VIA is not available in this QEMU\n");
+}
diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
index 964eed004c0..0138c7ec4e7 100644
--- a/hmp-commands-info.hx
+++ b/hmp-commands-info.hx
@@ -878,7 +878,6 @@ SRST
     Show intel SGX information.
 ERST
 
-#if defined(CONFIG_MOS6522)
     {
         .name         = "via",
         .args_type    = "",
@@ -886,7 +885,6 @@ ERST
         .help         = "show guest mos6522 VIA devices",
         .cmd          = hmp_info_via,
     },
-#endif
 
 SRST
   ``info via``
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index cd084a19363..fa6a961ac9a 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -20,6 +20,7 @@ system_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('armv7m_ras.c'))
 
 # Mac devices
 system_ss.add(when: 'CONFIG_MOS6522', if_true: files('mos6522.c'))
+stub_ss.add(files('mos6522-stub.c'))
 system_ss.add(when: 'CONFIG_DJMEMC', if_true: files('djmemc.c'))
 system_ss.add(when: 'CONFIG_IOSB', if_true: files('iosb.c'))
 
-- 
2.53.0

[PULL 045/110] monitor: Make Xen emulation commands generic ones

[Philippe Mathieu-Daudé]

In order to build hmp-commands.hx once we need to stop using
device target-specific check. Use the generic pattern to make
the command available on all targets, providing a stub with
kind error message when the feature is not available.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: David Woodhouse <dwmw@amazon.co.uk>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260427080738.77138-10-philmd@linaro.org>
---
 hw/i386/kvm/xen-stubs.c | 12 ++++++++++++
 hmp-commands.hx         |  2 --
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/hw/i386/kvm/xen-stubs.c b/hw/i386/kvm/xen-stubs.c
index ce73119ee7a..bf6ac28bef4 100644
--- a/hw/i386/kvm/xen-stubs.c
+++ b/hw/i386/kvm/xen-stubs.c
@@ -12,6 +12,8 @@
 #include "qemu/osdep.h"
 
 #include "qapi/error.h"
+#include "monitor/monitor.h"
+#include "monitor/hmp.h"
 
 #include "xen_evtchn.h"
 #include "xen_primary_console.h"
@@ -37,3 +39,13 @@ void xen_primary_console_create(void)
 void xen_primary_console_set_be_port(uint16_t port)
 {
 }
+
+void hmp_xen_event_list(Monitor *mon, const QDict *qdict)
+{
+    monitor_printf(mon, "XEN emulation is not available in this QEMU\n");
+}
+
+void hmp_xen_event_inject(Monitor *mon, const QDict *qdict)
+{
+    monitor_printf(mon, "XEN emulation is not available in this QEMU\n");
+}
diff --git a/hmp-commands.hx b/hmp-commands.hx
index b806ec5635c..dd6243bf2da 100644
--- a/hmp-commands.hx
+++ b/hmp-commands.hx
@@ -1843,7 +1843,6 @@ SRST
 ERST
 #endif
 
-#if defined(CONFIG_XEN_EMU)
     {
         .name       = "xen-event-inject",
         .args_type  = "port:i",
@@ -1870,7 +1869,6 @@ SRST
 ``xen-event-list``
   List event channels in the guest
 ERST
-#endif
 
 HXCOMM *** MUST BE LAST ENTRY **
     {
-- 
2.53.0

[PULL 046/110] system: Expose 'arch_init.h' as 'qemu/base-arch-defs.h'

[Philippe Mathieu-Daudé]

We already have a file unit outside of the local system'
folder which include "system/arch_init.h". We want more files
to use it, so make it official it is a generic header by moving
it under include. Rename as "qemu/base-arch-defs.h" which is
more descriptive.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260427080738.77138-11-philmd@linaro.org>
---
 system/arch_init.h => include/qemu/base-arch-defs.h | 10 ++++++++--
 hw/pci/pci.c                                        |  2 +-
 system/arch_init.c                                  |  2 +-
 system/qdev-monitor.c                               |  2 +-
 system/vl.c                                         |  2 +-
 5 files changed, 12 insertions(+), 6 deletions(-)
 rename system/arch_init.h => include/qemu/base-arch-defs.h (92%)

diff --git a/system/arch_init.h b/include/qemu/base-arch-defs.h
similarity index 92%
rename from system/arch_init.h
rename to include/qemu/base-arch-defs.h
index 0c2b1f3a5d0..f33465738c9 100644
--- a/system/arch_init.h
+++ b/include/qemu/base-arch-defs.h
@@ -1,5 +1,11 @@
-#ifndef QEMU_ARCH_INIT_H
-#define QEMU_ARCH_INIT_H
+/*
+ * QEMU base architecture bit definitions
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef QEMU_BASE_ARCH_DEFS_H
+#define QEMU_BASE_ARCH_DEFS_H
 
 #include "qapi/qapi-types-machine.h"
 
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index a0dbb81fd90..4298adf5a0a 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -36,7 +36,7 @@
 #include "migration/qemu-file-types.h"
 #include "migration/vmstate.h"
 #include "net/net.h"
-#include "system/arch_init.h"
+#include "qemu/base-arch-defs.h"
 #include "system/numa.h"
 #include "system/runstate.h"
 #include "system/system.h"
diff --git a/system/arch_init.c b/system/arch_init.c
index 604d5909ed0..1ad2f3d6f78 100644
--- a/system/arch_init.c
+++ b/system/arch_init.c
@@ -22,7 +22,7 @@
  * THE SOFTWARE.
  */
 #include "qemu/osdep.h"
-#include "system/arch_init.h"
+#include "qemu/base-arch-defs.h"
 #include "qemu/bitops.h"
 #include "qemu/target-info-qapi.h"
 
diff --git a/system/qdev-monitor.c b/system/qdev-monitor.c
index e90eb6247ea..e5b55e3004c 100644
--- a/system/qdev-monitor.c
+++ b/system/qdev-monitor.c
@@ -23,7 +23,7 @@
 #include "monitor/hmp-completion.h"
 #include "monitor/monitor.h"
 #include "monitor/qdev.h"
-#include "system/arch_init.h"
+#include "qemu/base-arch-defs.h"
 #include "system/runstate.h"
 #include "qapi/error.h"
 #include "qapi/qapi-commands-qdev.h"
diff --git a/system/vl.c b/system/vl.c
index 516ed7890b4..705f0d3a4a9 100644
--- a/system/vl.c
+++ b/system/vl.c
@@ -112,7 +112,7 @@
 #include "trace/control.h"
 #include "qemu/plugin.h"
 #include "qemu/queue.h"
-#include "system/arch_init.h"
+#include "qemu/base-arch-defs.h"
 #include "system/confidential-guest-support.h"
 
 #include "ui/qemu-spice.h"
-- 
2.53.0

[PULL 047/110] monitor: Introduce HMPCommand::arch_bitmask field

[Philippe Mathieu-Daudé]

Add the @arch_bitmask field to the HMPCommand structure,
allowing to restrict a command to a set of target
architectures (represented by the QEMU_ARCH_* enum constants).

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260427080738.77138-12-philmd@linaro.org>
---
 monitor/monitor-internal.h | 11 ++++++++++-
 monitor/hmp-target.c       |  1 +
 monitor/hmp.c              |  4 ++++
 3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/monitor/monitor-internal.h b/monitor/monitor-internal.h
index 80b4a8150bf..eaf9a607783 100644
--- a/monitor/monitor-internal.h
+++ b/monitor/monitor-internal.h
@@ -82,7 +82,6 @@ typedef struct HMPCommand {
      * the formatted text.
      */
     HumanReadableText *(*cmd_info_hrt)(Error **errp);
-    bool coroutine;
     /*
      * @sub_table is a list of 2nd level of commands. If it does not exist,
      * cmd should be used. If it exists, sub_table[?].cmd should be
@@ -90,6 +89,16 @@ typedef struct HMPCommand {
      */
     struct HMPCommand *sub_table;
     void (*command_completion)(ReadLineState *rs, int nb_args, const char *str);
+
+    /* Keep non-pointer data at the end to minimize holes. */
+
+    /**
+     * @arch_bitmask: bitmask of QEMU_ARCH_* constants
+     *     Allow to restrict the command for a particular set of
+     *     target architectures.
+     */
+    uint32_t arch_bitmask;
+    bool coroutine;
 } HMPCommand;
 
 struct Monitor {
diff --git a/monitor/hmp-target.c b/monitor/hmp-target.c
index da7dd7f31f2..f6dce326cf5 100644
--- a/monitor/hmp-target.c
+++ b/monitor/hmp-target.c
@@ -23,6 +23,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/base-arch-defs.h"
 #include "monitor-internal.h"
 #include "monitor/qdev.h"
 #include "net/slirp.h"
diff --git a/monitor/hmp.c b/monitor/hmp.c
index 0e5913fabb1..e881c26c305 100644
--- a/monitor/hmp.c
+++ b/monitor/hmp.c
@@ -36,6 +36,7 @@
 #include "qemu/cutils.h"
 #include "qemu/log.h"
 #include "qemu/option.h"
+#include "qemu/base-arch-defs.h"
 #include "qemu/target-info.h"
 #include "qemu/units.h"
 #include "exec/gdbstub.h"
@@ -219,6 +220,9 @@ static bool cmd_can_preconfig(const HMPCommand *cmd)
 
 static bool cmd_available(const HMPCommand *cmd)
 {
+    if (cmd->arch_bitmask && !qemu_arch_available(cmd->arch_bitmask)) {
+        return false;
+    }
     return phase_check(PHASE_MACHINE_READY) || cmd_can_preconfig(cmd);
 }
 
-- 
2.53.0

[PULL 048/110] hw/s390x: Reduce 'monitor/monitor.h' inclusions

[Philippe Mathieu-Daudé]

We want to make the HMP commands available for all targets,
move the declarations to "monitor/hmp.h" where all other
are, and only include the monitor headers in the source files.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Message-Id: <20260427080738.77138-13-philmd@linaro.org>
---
 include/hw/s390x/storage-attributes.h | 4 ----
 include/hw/s390x/storage-keys.h       | 3 ---
 include/monitor/hmp.h                 | 5 +++++
 hw/s390x/s390-skeys.c                 | 2 ++
 hw/s390x/s390-stattrib.c              | 2 ++
 5 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/include/hw/s390x/storage-attributes.h b/include/hw/s390x/storage-attributes.h
index 66716a97c05..0305873b019 100644
--- a/include/hw/s390x/storage-attributes.h
+++ b/include/hw/s390x/storage-attributes.h
@@ -13,7 +13,6 @@
 #define S390_STORAGE_ATTRIBUTES_H
 
 #include "hw/core/qdev.h"
-#include "monitor/monitor.h"
 #include "qom/object.h"
 
 #define TYPE_S390_STATTRIB "s390-storage_attributes"
@@ -72,7 +71,4 @@ static inline Object *kvm_s390_stattrib_create(void)
 }
 #endif
 
-void hmp_info_cmma(Monitor *mon, const QDict *qdict);
-void hmp_migrationmode(Monitor *mon, const QDict *qdict);
-
 #endif /* S390_STORAGE_ATTRIBUTES_H */
diff --git a/include/hw/s390x/storage-keys.h b/include/hw/s390x/storage-keys.h
index 2d02936c31c..666c05e2996 100644
--- a/include/hw/s390x/storage-keys.h
+++ b/include/hw/s390x/storage-keys.h
@@ -13,7 +13,6 @@
 #define S390_STORAGE_KEYS_H
 
 #include "hw/core/qdev.h"
-#include "monitor/monitor.h"
 #include "qom/object.h"
 
 #define TYPE_S390_SKEYS "s390-skeys"
@@ -123,8 +122,6 @@ int s390_skeys_set(S390SKeysState *ks, uint64_t start_gfn,
 S390SKeysState *s390_get_skeys_device(void);
 
 void s390_qmp_dump_skeys(const char *filename, Error **errp);
-void hmp_dump_skeys(Monitor *mon, const QDict *qdict);
-void hmp_info_skeys(Monitor *mon, const QDict *qdict);
 
 #define TYPE_DUMP_SKEYS_INTERFACE "dump-skeys-interface"
 
diff --git a/include/monitor/hmp.h b/include/monitor/hmp.h
index 27ce1c303f4..3ba17008255 100644
--- a/include/monitor/hmp.h
+++ b/include/monitor/hmp.h
@@ -174,4 +174,9 @@ void hmp_gva2gpa(Monitor *mon, const QDict *qdict);
 void hmp_gpa2hva(Monitor *mon, const QDict *qdict);
 void hmp_gpa2hpa(Monitor *mon, const QDict *qdict);
 
+void hmp_dump_skeys(Monitor *mon, const QDict *qdict);
+void hmp_info_skeys(Monitor *mon, const QDict *qdict);
+void hmp_info_cmma(Monitor *mon, const QDict *qdict);
+void hmp_migrationmode(Monitor *mon, const QDict *qdict);
+
 #endif
diff --git a/hw/s390x/s390-skeys.c b/hw/s390x/s390-skeys.c
index d974d97b5e7..7dca67d6618 100644
--- a/hw/s390x/s390-skeys.c
+++ b/hw/s390x/s390-skeys.c
@@ -24,6 +24,8 @@
 #include "system/kvm.h"
 #include "migration/qemu-file-types.h"
 #include "migration/register.h"
+#include "monitor/hmp.h"
+#include "monitor/monitor.h"
 #include "trace.h"
 
 #define S390_SKEYS_BUFFER_SIZE (128 * KiB)  /* Room for 128k storage keys */
diff --git a/hw/s390x/s390-stattrib.c b/hw/s390x/s390-stattrib.c
index 2e83aa211cd..74b23b0a995 100644
--- a/hw/s390x/s390-stattrib.c
+++ b/hw/s390x/s390-stattrib.c
@@ -15,6 +15,8 @@
 #include "system/ram_addr.h"
 #include "migration/qemu-file.h"
 #include "migration/register.h"
+#include "monitor/hmp.h"
+#include "monitor/monitor.h"
 #include "hw/core/qdev-properties.h"
 #include "hw/s390x/storage-attributes.h"
 #include "qemu/error-report.h"
-- 
2.53.0

[PULL 049/110] monitor: Do not check TARGET_S390X to build s390x commands

[Philippe Mathieu-Daudé]

These commands are filtered at build-time for s390x binary.
By using the recently introduced HMPCommand::arch_bitmask flag
we can filter them at runtime, making it possible to compile
hmp-commands[-info].hx files once.

Since the methods are used inconditionally within hw/s390x/,
define them in the same stub file.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Message-Id: <20260427080738.77138-14-philmd@linaro.org>
---
 MAINTAINERS               |  1 +
 include/monitor/hmp.h     |  7 +++++++
 monitor/hmp-target.c      |  5 -----
 stubs/hmp-cmds-hw-s390x.c | 15 +++++++++++++++
 hmp-commands-info.hx      |  6 ++----
 hmp-commands.hx           |  6 ++----
 stubs/meson.build         |  1 +
 7 files changed, 28 insertions(+), 13 deletions(-)
 create mode 100644 stubs/hmp-cmds-hw-s390x.c

diff --git a/MAINTAINERS b/MAINTAINERS
index b05e4d2097e..c57a01131c4 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -122,6 +122,7 @@ F: include/hw/watchdog/wdt_diag288.h
 F: pc-bios/s390-ccw/
 F: pc-bios/s390-ccw.img
 F: stubs/qmp-cpu-s390x.c
+F: stubs/hmp-cmds-hw-s390x.c
 F: target/s390x/
 F: docs/system/target-s390x.rst
 F: docs/system/s390x/
diff --git a/include/monitor/hmp.h b/include/monitor/hmp.h
index 3ba17008255..930ffa31aba 100644
--- a/include/monitor/hmp.h
+++ b/include/monitor/hmp.h
@@ -16,6 +16,13 @@
 
 #include "qemu/readline.h"
 #include "qapi/qapi-types-common.h"
+#include "monitor/monitor.h"
+
+#define HMP_STUB(cmd) \
+    void hmp_##cmd(Monitor *mon, const QDict *qdict) \
+    { \
+        g_assert_not_reached(); \
+    }
 
 bool hmp_handle_error(Monitor *mon, Error *err);
 void hmp_help_cmd(Monitor *mon, const char *name);
diff --git a/monitor/hmp-target.c b/monitor/hmp-target.c
index f6dce326cf5..a222fd4c96a 100644
--- a/monitor/hmp-target.c
+++ b/monitor/hmp-target.c
@@ -36,11 +36,6 @@
 #include "qapi/qapi-commands-misc.h"
 #include "qapi/qapi-commands-machine.h"
 
-#if defined(TARGET_S390X)
-#include "hw/s390x/storage-keys.h"
-#include "hw/s390x/storage-attributes.h"
-#endif
-
 /* Make devices configuration available for use in hmp-commands*.hx templates */
 #include CONFIG_DEVICES
 
diff --git a/stubs/hmp-cmds-hw-s390x.c b/stubs/hmp-cmds-hw-s390x.c
new file mode 100644
index 00000000000..2b4f4cac79f
--- /dev/null
+++ b/stubs/hmp-cmds-hw-s390x.c
@@ -0,0 +1,15 @@
+/*
+ * Human Monitor hw/s390x stubs
+ *
+ * Copyright (c) Linaro
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "monitor/hmp.h"
+
+HMP_STUB(dump_skeys)
+HMP_STUB(info_cmma)
+HMP_STUB(info_skeys)
+HMP_STUB(migrationmode)
diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
index 0138c7ec4e7..b1e2bf3c059 100644
--- a/hmp-commands-info.hx
+++ b/hmp-commands-info.hx
@@ -710,30 +710,28 @@ SRST
     Show rocker OF-DPA groups.
 ERST
 
-#if defined(TARGET_S390X)
     {
         .name       = "skeys",
         .args_type  = "addr:l",
         .params     = "address",
         .help       = "Display the value of a storage key",
         .cmd        = hmp_info_skeys,
+        .arch_bitmask = QEMU_ARCH_S390X,
     },
-#endif
 
 SRST
   ``info skeys`` *address*
     Display the value of a storage key (s390 only)
 ERST
 
-#if defined(TARGET_S390X)
     {
         .name       = "cmma",
         .args_type  = "addr:l,count:l?",
         .params     = "address [count]",
         .help       = "Display the values of the CMMA storage attributes for a range of pages",
         .cmd        = hmp_info_cmma,
+        .arch_bitmask = QEMU_ARCH_S390X,
     },
-#endif
 
 SRST
   ``info cmma`` *address*
diff --git a/hmp-commands.hx b/hmp-commands.hx
index dd6243bf2da..b41f44f5ad4 100644
--- a/hmp-commands.hx
+++ b/hmp-commands.hx
@@ -1139,30 +1139,28 @@ SRST
 
 ERST
 
-#if defined(TARGET_S390X)
     {
         .name       = "dump-skeys",
         .args_type  = "filename:F",
         .params     = "",
         .help       = "Save guest storage keys into file 'filename'.\n",
         .cmd        = hmp_dump_skeys,
+        .arch_bitmask = QEMU_ARCH_S390X,
     },
-#endif
 
 SRST
 ``dump-skeys`` *filename*
   Save guest storage keys to a file.
 ERST
 
-#if defined(TARGET_S390X)
     {
         .name       = "migration_mode",
         .args_type  = "mode:i",
         .params     = "mode",
         .help       = "Enables or disables migration mode\n",
         .cmd        = hmp_migrationmode,
+        .arch_bitmask = QEMU_ARCH_S390X,
     },
-#endif
 
 SRST
 ``migration_mode`` *mode*
diff --git a/stubs/meson.build b/stubs/meson.build
index af4051e6c5e..99a89c00066 100644
--- a/stubs/meson.build
+++ b/stubs/meson.build
@@ -87,6 +87,7 @@ if have_system
   stub_ss.add(files('qmp-cpu.c'))
   stub_ss.add(files('qmp-cpu-s390x.c'))
   stub_ss.add(files('qmp-cpu-s390x-kvm.c'))
+  stub_ss.add(files('hmp-cmds-hw-s390x.c'))
 endif
 
 if have_system or have_user
-- 
2.53.0

[PULL 050/110] monitor: Do not check TARGET_I386 to build target/i386/ commands

[Philippe Mathieu-Daudé]

These commands are filtered at build-time for i386/x86_64 binaries.
By using the recently introduced HMPCommand::arch_bitmask flag
we can filter them at runtime, making it possible to compile
hmp-commands[-info].hx files once.

Since these methods are used inconditionally within target/i386/,
define them in the same stub file.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260427080738.77138-15-philmd@linaro.org>
---
 MAINTAINERS                  |  1 +
 stubs/hmp-cmds-target-i386.c | 13 +++++++++++++
 hmp-commands-info.hx         |  4 +---
 hmp-commands.hx              |  5 +----
 stubs/meson.build            |  1 +
 5 files changed, 17 insertions(+), 7 deletions(-)
 create mode 100644 stubs/hmp-cmds-target-i386.c

diff --git a/MAINTAINERS b/MAINTAINERS
index c57a01131c4..d022070a74c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -149,6 +149,7 @@ F: configs/targets/i386-softmmu.mak
 F: configs/targets/x86_64-softmmu.mak
 F: docs/system/i386/
 F: docs/system/target-i386*
+F: stubs/hmp-cmds-target-i386.c
 F: target/i386/*.[ch]
 F: target/i386/Kconfig
 F: target/i386/meson.build
diff --git a/stubs/hmp-cmds-target-i386.c b/stubs/hmp-cmds-target-i386.c
new file mode 100644
index 00000000000..43a167056d5
--- /dev/null
+++ b/stubs/hmp-cmds-target-i386.c
@@ -0,0 +1,13 @@
+/*
+ * Human Monitor x86 stubs
+ *
+ * Copyright (c) Linaro
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "monitor/hmp.h"
+
+HMP_STUB(info_local_apic)
+HMP_STUB(mce)
diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
index b1e2bf3c059..65af86278b4 100644
--- a/hmp-commands-info.hx
+++ b/hmp-commands-info.hx
@@ -106,16 +106,14 @@ SRST
     Show the cpu registers.
 ERST
 
-#if defined(TARGET_I386)
     {
         .name       = "lapic",
         .args_type  = "apic-id:i?",
         .params     = "[apic-id]",
         .help       = "show local apic state (apic-id: local apic to read, default is which of current CPU)",
-
         .cmd        = hmp_info_local_apic,
+        .arch_bitmask = QEMU_ARCH_I386,
     },
-#endif
 
 SRST
   ``info lapic``
diff --git a/hmp-commands.hx b/hmp-commands.hx
index b41f44f5ad4..c3a1a95c5fb 100644
--- a/hmp-commands.hx
+++ b/hmp-commands.hx
@@ -1502,18 +1502,15 @@ SRST
   Stop the QEMU embedded NBD server.
 ERST
 
-
-#if defined(TARGET_I386)
-
     {
         .name       = "mce",
         .args_type  = "broadcast:-b,cpu_index:i,bank:i,status:l,mcg_status:l,addr:l,misc:l",
         .params     = "[-b] cpu bank status mcgstatus addr misc",
         .help       = "inject a MCE on the given CPU [and broadcast to other CPUs with -b option]",
         .cmd        = hmp_mce,
+        .arch_bitmask = QEMU_ARCH_I386,
     },
 
-#endif
 SRST
 ``mce`` *cpu* *bank* *status* *mcgstatus* *addr* *misc*
   Inject an MCE on the given CPU (x86 only).
diff --git a/stubs/meson.build b/stubs/meson.build
index 99a89c00066..6142e0f4d9d 100644
--- a/stubs/meson.build
+++ b/stubs/meson.build
@@ -88,6 +88,7 @@ if have_system
   stub_ss.add(files('qmp-cpu-s390x.c'))
   stub_ss.add(files('qmp-cpu-s390x-kvm.c'))
   stub_ss.add(files('hmp-cmds-hw-s390x.c'))
+  stub_ss.add(files('hmp-cmds-target-i386.c'))
 endif
 
 if have_system or have_user
-- 
2.53.0

[PULL 051/110] monitor: Do not check TARGET_I386 to build 'info sgx' command

[Philippe Mathieu-Daudé]

This command is filtered at build-time for i386/x86_64 binaries.
By using the recently introduced HMPCommand::arch_bitmask flag
we can filter it at runtime, making it possible to compile
hmp-commands-info.hx once.

Since the method depends on the CONFIG_SGX definition, define it
in its own stub file.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260427080738.77138-16-philmd@linaro.org>
---
 MAINTAINERS            |  1 +
 hw/i386/sgx-hmp-stub.c | 16 ++++++++++++++++
 hw/i386/sgx-stub.c     |  5 -----
 hmp-commands-info.hx   |  3 +--
 hw/i386/meson.build    |  1 +
 5 files changed, 19 insertions(+), 7 deletions(-)
 create mode 100644 hw/i386/sgx-hmp-stub.c

diff --git a/MAINTAINERS b/MAINTAINERS
index d022070a74c..7515025e09b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -514,6 +514,7 @@ L: kvm@vger.kernel.org
 S: Supported
 F: docs/system/i386/amd-memory-encryption.rst
 F: docs/system/i386/sgx.rst
+F: hw/i386/sgx*
 F: stubs/qmp-i386-sev.c
 F: stubs/qmp-i386-sgx.c
 F: target/i386/kvm/
diff --git a/hw/i386/sgx-hmp-stub.c b/hw/i386/sgx-hmp-stub.c
new file mode 100644
index 00000000000..cf1d9a6344b
--- /dev/null
+++ b/hw/i386/sgx-hmp-stub.c
@@ -0,0 +1,16 @@
+/*
+ * Human Monitor 'info sgx' stub (CONFIG_SGX)
+ *
+ * Copyright (c) Linaro
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "monitor/hmp.h"
+#include "monitor/monitor.h"
+
+void hmp_info_sgx(Monitor *mon, const QDict *qdict)
+{
+    monitor_printf(mon, "SGX is not available in this QEMU\n");
+}
diff --git a/hw/i386/sgx-stub.c b/hw/i386/sgx-stub.c
index 1dd8d9afbfa..2b083c77bc1 100644
--- a/hw/i386/sgx-stub.c
+++ b/hw/i386/sgx-stub.c
@@ -23,11 +23,6 @@ SgxInfo *qmp_query_sgx_capabilities(Error **errp)
     return NULL;
 }
 
-void hmp_info_sgx(Monitor *mon, const QDict *qdict)
-{
-    monitor_printf(mon, "SGX is not available in this QEMU\n");
-}
-
 void pc_machine_init_sgx_epc(PCMachineState *pcms)
 {
     memset(&pcms->sgx_epc, 0, sizeof(SGXEPCState));
diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
index 65af86278b4..576adbbf5a6 100644
--- a/hmp-commands-info.hx
+++ b/hmp-commands-info.hx
@@ -859,15 +859,14 @@ SRST
     Display the vcpu dirty page limit information.
 ERST
 
-#if defined(TARGET_I386)
     {
         .name       = "sgx",
         .args_type  = "",
         .params     = "",
         .help       = "show intel SGX information",
         .cmd        = hmp_info_sgx,
+        .arch_bitmask = QEMU_ARCH_I386,
     },
-#endif
 
 SRST
   ``info sgx``
diff --git a/hw/i386/meson.build b/hw/i386/meson.build
index 63ae57baa51..b611fbb5a7f 100644
--- a/hw/i386/meson.build
+++ b/hw/i386/meson.build
@@ -24,6 +24,7 @@ i386_ss.add(when: 'CONFIG_VTD', if_true: files('intel_iommu.c'))
 i386_ss.add(when: 'CONFIG_VTD_ACCEL', if_true: files('intel_iommu_accel.c'))
 i386_ss.add(when: 'CONFIG_SGX', if_true: files('sgx-epc.c','sgx.c'),
                                 if_false: files('sgx-stub.c'))
+stub_ss.add(files('sgx-hmp-stub.c'))
 
 i386_ss.add(when: 'CONFIG_ACPI', if_true: files('acpi-common.c'))
 i386_ss.add(when: 'CONFIG_PC', if_true: files(
-- 
2.53.0

[PULL 052/110] monitor: Do not check TARGET_I386 to build 'info sev' command

[Philippe Mathieu-Daudé]

This command is filtered at build-time for i386/x86_64 binaries.
By using the recently introduced HMPCommand::arch_bitmask flag
we can filter it at runtime, making it possible to compile
hmp-commands-info.hx once.

Since the method depends on the CONFIG_SEV definition, define it
in its own stub file.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260427080738.77138-17-philmd@linaro.org>
---
 MAINTAINERS                   |  1 +
 stubs/hmp-cmd-info_sev.c      | 16 ++++++++++++++++
 target/i386/sev-system-stub.c |  5 -----
 hmp-commands-info.hx          |  3 +--
 stubs/meson.build             |  1 +
 5 files changed, 19 insertions(+), 7 deletions(-)
 create mode 100644 stubs/hmp-cmd-info_sev.c

diff --git a/MAINTAINERS b/MAINTAINERS
index 7515025e09b..1eb7903268b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -515,6 +515,7 @@ S: Supported
 F: docs/system/i386/amd-memory-encryption.rst
 F: docs/system/i386/sgx.rst
 F: hw/i386/sgx*
+F: stubs/hmp-cmd-info_sev.c
 F: stubs/qmp-i386-sev.c
 F: stubs/qmp-i386-sgx.c
 F: target/i386/kvm/
diff --git a/stubs/hmp-cmd-info_sev.c b/stubs/hmp-cmd-info_sev.c
new file mode 100644
index 00000000000..f3624423a33
--- /dev/null
+++ b/stubs/hmp-cmd-info_sev.c
@@ -0,0 +1,16 @@
+/*
+ * Human Monitor 'info sev' stub (CONFIG_SEV)
+ *
+ * Copyright (c) Linaro
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "monitor/hmp.h"
+#include "monitor/monitor.h"
+
+void hmp_info_sev(Monitor *mon, const QDict *qdict)
+{
+    monitor_printf(mon, "SEV is not available in this QEMU\n");
+}
diff --git a/target/i386/sev-system-stub.c b/target/i386/sev-system-stub.c
index fb84aee94d2..2ea85597cf9 100644
--- a/target/i386/sev-system-stub.c
+++ b/target/i386/sev-system-stub.c
@@ -32,11 +32,6 @@ int sev_es_save_reset_vector(void *flash_ptr, uint64_t flash_size)
     g_assert_not_reached();
 }
 
-void hmp_info_sev(Monitor *mon, const QDict *qdict)
-{
-    monitor_printf(mon, "SEV is not available in this QEMU\n");
-}
-
 void pc_system_parse_sev_metadata(uint8_t *flash_ptr, size_t flash_size)
 {
 }
diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
index 576adbbf5a6..480a5a79ecb 100644
--- a/hmp-commands-info.hx
+++ b/hmp-commands-info.hx
@@ -805,15 +805,14 @@ SRST
     enabled) memory in bytes.
 ERST
 
-#if defined(TARGET_I386)
     {
         .name       = "sev",
         .args_type  = "",
         .params     = "",
         .help       = "show SEV information",
         .cmd        = hmp_info_sev,
+        .arch_bitmask = QEMU_ARCH_I386,
     },
-#endif
 
 SRST
   ``info sev``
diff --git a/stubs/meson.build b/stubs/meson.build
index 6142e0f4d9d..f086521cde4 100644
--- a/stubs/meson.build
+++ b/stubs/meson.build
@@ -87,6 +87,7 @@ if have_system
   stub_ss.add(files('qmp-cpu.c'))
   stub_ss.add(files('qmp-cpu-s390x.c'))
   stub_ss.add(files('qmp-cpu-s390x-kvm.c'))
+  stub_ss.add(files('hmp-cmd-info_sev.c'))
   stub_ss.add(files('hmp-cmds-hw-s390x.c'))
   stub_ss.add(files('hmp-cmds-target-i386.c'))
 endif
-- 
2.53.0

[PULL 053/110] monitor: Do not check TARGET_I386/RISCV to build 'info mem' command

[Philippe Mathieu-Daudé]

This command is filtered at build-time for i386/x86_64 and
riscv32/riscv64 binaries. By using the recently introduced
HMPCommand::arch_bitmask flag we can filter it at runtime,
making it possible to compile hmp-commands-info.hx once.

Since the method depends on a pair of distinct targets,
define it in its own stub file.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20260427080738.77138-18-philmd@linaro.org>
---
 stubs/hmp-cmd-info_mem.c | 12 ++++++++++++
 hmp-commands-info.hx     |  3 +--
 stubs/meson.build        |  1 +
 3 files changed, 14 insertions(+), 2 deletions(-)
 create mode 100644 stubs/hmp-cmd-info_mem.c

diff --git a/stubs/hmp-cmd-info_mem.c b/stubs/hmp-cmd-info_mem.c
new file mode 100644
index 00000000000..8a53e367a9f
--- /dev/null
+++ b/stubs/hmp-cmd-info_mem.c
@@ -0,0 +1,12 @@
+/*
+ * Human Monitor 'info mem' stub
+ *
+ * Copyright (c) Linaro
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "monitor/hmp.h"
+
+HMP_STUB(info_mem)
diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
index 480a5a79ecb..c93c049daea 100644
--- a/hmp-commands-info.hx
+++ b/hmp-commands-info.hx
@@ -202,15 +202,14 @@ SRST
     Show virtual to physical memory mappings.
 ERST
 
-#if defined(TARGET_I386) || defined(TARGET_RISCV)
     {
         .name       = "mem",
         .args_type  = "",
         .params     = "",
         .help       = "show the active virtual memory mappings",
         .cmd        = hmp_info_mem,
+        .arch_bitmask = QEMU_ARCH_I386 | QEMU_ARCH_RISCV,
     },
-#endif
 
 SRST
   ``info mem``
diff --git a/stubs/meson.build b/stubs/meson.build
index f086521cde4..33053d932c8 100644
--- a/stubs/meson.build
+++ b/stubs/meson.build
@@ -87,6 +87,7 @@ if have_system
   stub_ss.add(files('qmp-cpu.c'))
   stub_ss.add(files('qmp-cpu-s390x.c'))
   stub_ss.add(files('qmp-cpu-s390x-kvm.c'))
+  stub_ss.add(files('hmp-cmd-info_mem.c'))
   stub_ss.add(files('hmp-cmd-info_sev.c'))
   stub_ss.add(files('hmp-cmds-hw-s390x.c'))
   stub_ss.add(files('hmp-cmds-target-i386.c'))
-- 
2.53.0

[PULL 054/110] monitor: Do not check multiple TARGET_* to build 'info tlb' command

[Philippe Mathieu-Daudé]

This command is filtered at build-time for a selection of binaries.
By using the recently introduced HMPCommand::arch_bitmask flag we
can filter them at runtime, making it possible to compile
hmp-commands-info.hx once.

Since the method depends on a pair of distinct targets,
define it in its own stub file.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260427080738.77138-19-philmd@linaro.org>
---
 stubs/hmp-cmd-info_tlb.c | 12 ++++++++++++
 hmp-commands-info.hx     |  5 ++---
 stubs/meson.build        |  1 +
 3 files changed, 15 insertions(+), 3 deletions(-)
 create mode 100644 stubs/hmp-cmd-info_tlb.c

diff --git a/stubs/hmp-cmd-info_tlb.c b/stubs/hmp-cmd-info_tlb.c
new file mode 100644
index 00000000000..a144e68c1c7
--- /dev/null
+++ b/stubs/hmp-cmd-info_tlb.c
@@ -0,0 +1,12 @@
+/*
+ * Human Monitor 'info tlb' stub
+ *
+ * Copyright (c) Linaro
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "monitor/hmp.h"
+
+HMP_STUB(info_tlb)
diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
index c93c049daea..82134eb6c21 100644
--- a/hmp-commands-info.hx
+++ b/hmp-commands-info.hx
@@ -186,16 +186,15 @@ SRST
     Show PCI information.
 ERST
 
-#if defined(TARGET_I386) || defined(TARGET_SH4) || defined(TARGET_SPARC) || \
-    defined(TARGET_PPC) || defined(TARGET_XTENSA) || defined(TARGET_M68K)
     {
         .name       = "tlb",
         .args_type  = "",
         .params     = "",
         .help       = "show virtual to physical memory mappings",
         .cmd        = hmp_info_tlb,
+        .arch_bitmask = QEMU_ARCH_I386 | QEMU_ARCH_SH4 | QEMU_ARCH_SPARC \
+                        | QEMU_ARCH_PPC | QEMU_ARCH_XTENSA | QEMU_ARCH_M68K,
     },
-#endif
 
 SRST
   ``info tlb``
diff --git a/stubs/meson.build b/stubs/meson.build
index 33053d932c8..2f4e1ab4300 100644
--- a/stubs/meson.build
+++ b/stubs/meson.build
@@ -89,6 +89,7 @@ if have_system
   stub_ss.add(files('qmp-cpu-s390x-kvm.c'))
   stub_ss.add(files('hmp-cmd-info_mem.c'))
   stub_ss.add(files('hmp-cmd-info_sev.c'))
+  stub_ss.add(files('hmp-cmd-info_tlb.c'))
   stub_ss.add(files('hmp-cmds-hw-s390x.c'))
   stub_ss.add(files('hmp-cmds-target-i386.c'))
 endif
-- 
2.53.0

[PULL 055/110] cpus: Introduce SysemuCPUOps::monitor_get_register() hook

[Philippe Mathieu-Daudé]

Allow targets to register their legacy target_get_monitor_def()
in SysemuCPUOps; check it first in get_monitor_def() otherwise
fall back to previous per-target helper.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260427080738.77138-20-philmd@linaro.org>
---
 include/hw/core/sysemu-cpu-ops.h |  8 ++++++++
 monitor/hmp-target.c             | 11 ++++++++---
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/include/hw/core/sysemu-cpu-ops.h b/include/hw/core/sysemu-cpu-ops.h
index 7b2d2d2610f..5b831393cf4 100644
--- a/include/hw/core/sysemu-cpu-ops.h
+++ b/include/hw/core/sysemu-cpu-ops.h
@@ -85,6 +85,14 @@ typedef struct SysemuCPUOps {
      */
     bool (*internal_is_big_endian)(CPUState *cpu);
 
+    /**
+     * @monitor_get_register: Callback to fill @pval with register @name value.
+     *                        This field is legacy, use @gdb_core_xml_file
+     *                        to dump registers instead.
+     * Returns: 0 on success or negative errno on failure.
+     */
+    int (*monitor_get_register)(CPUState *cs, const char *name, int64_t *pval);
+
     /**
      * @legacy_vmsd: Legacy state for migration.
      *               Do not use in new targets, use #DeviceClass::vmsd instead.
diff --git a/monitor/hmp-target.c b/monitor/hmp-target.c
index a222fd4c96a..46ccbd14aec 100644
--- a/monitor/hmp-target.c
+++ b/monitor/hmp-target.c
@@ -35,6 +35,7 @@
 #include "qapi/qapi-commands-control.h"
 #include "qapi/qapi-commands-misc.h"
 #include "qapi/qapi-commands-machine.h"
+#include "hw/core/sysemu-cpu-ops.h"
 
 /* Make devices configuration available for use in hmp-commands*.hx templates */
 #include CONFIG_DEVICES
@@ -85,9 +86,13 @@ int get_monitor_def(Monitor *mon, int64_t *pval, const char *name)
         }
     }
 
-    ret = target_get_monitor_def(cs, name, &tmp);
-    if (!ret) {
-        *pval = (target_long) tmp;
+    if (cs->cc->sysemu_ops->monitor_get_register) {
+        ret = cs->cc->sysemu_ops->monitor_get_register(cs, name, pval);
+    } else {
+        ret = target_get_monitor_def(cs, name, &tmp);
+        if (!ret) {
+            *pval = (target_long) tmp;
+        }
     }
 
     return ret;
-- 
2.53.0

[PULL 056/110] target/riscv: Register target_get_monitor_def in SysemuCPUOps

[Philippe Mathieu-Daudé]

Rename target_get_monitor_def() as riscv_monitor_get_register_legacy()
and register it as SysemuCPUOps::monitor_get_register() handler.
Take care to sign-extend values for 32-bit HARTs.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20260427080738.77138-21-philmd@linaro.org>
---
 target/riscv/internals.h |  3 +++
 target/riscv/cpu.c       |  1 +
 target/riscv/monitor.c   | 11 +++++++----
 3 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/target/riscv/internals.h b/target/riscv/internals.h
index bac6c8032a2..8c24af0d855 100644
--- a/target/riscv/internals.h
+++ b/target/riscv/internals.h
@@ -250,4 +250,7 @@ static inline int insn_len(uint16_t first_word)
     return (first_word & 3) == 3 ? 4 : 2;
 }
 
+int riscv_monitor_get_register_legacy(CPUState *cs, const char *name,
+                                      int64_t *pval);
+
 #endif
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index ce15a17c37d..a13727c0d4b 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -2733,6 +2733,7 @@ static const struct SysemuCPUOps riscv_sysemu_ops = {
     .get_phys_page_debug = riscv_cpu_get_phys_page_debug,
     .write_elf64_note = riscv_cpu_write_elf64_note,
     .write_elf32_note = riscv_cpu_write_elf32_note,
+    .monitor_get_register = riscv_monitor_get_register_legacy,
     .legacy_vmsd = &vmstate_riscv_cpu,
 };
 #endif
diff --git a/target/riscv/monitor.c b/target/riscv/monitor.c
index bca04a7580c..3898595a3cb 100644
--- a/target/riscv/monitor.c
+++ b/target/riscv/monitor.c
@@ -27,6 +27,7 @@
 #include "monitor/hmp.h"
 #include "monitor/hmp-target.h"
 #include "system/memory.h"
+#include "internals.h"
 
 #ifdef TARGET_RISCV64
 #define PTE_HEADER_FIELDS       "vaddr            paddr            "\
@@ -311,16 +312,18 @@ static bool reg_is_vreg(const char *name)
     return false;
 }
 
-int target_get_monitor_def(CPUState *cs, const char *name, uint64_t *pval)
+int riscv_monitor_get_register_legacy(CPUState *cs, const char *name,
+                                      int64_t *pval)
 {
-    CPURISCVState *env = &RISCV_CPU(cs)->env;
+    RISCVCPU *hart = RISCV_CPU(cs);
+    CPURISCVState *env = cpu_env(cs);
     target_ulong val = 0;
     uint64_t val64 = 0;
     int i;
 
     if (reg_is_ulong_integer(env, name, &val, false) ||
         reg_is_ulong_integer(env, name, &val, true)) {
-        *pval = val;
+        *pval = riscv_cpu_is_32bit(hart) ? (int32_t)val : val;
         return 0;
     }
 
@@ -369,7 +372,7 @@ int target_get_monitor_def(CPUState *cs, const char *name, uint64_t *pval)
          * to do the filtering of the registers that are present.
          */
         if (res == RISCV_EXCP_NONE) {
-            *pval = val;
+            *pval = riscv_cpu_is_32bit(hart) ? (int32_t)val : val;
             return 0;
         }
     }
-- 
2.53.0

[PULL 057/110] monitor: Remove target_get_monitor_def()

[Philippe Mathieu-Daudé]

target_get_monitor_def() is now only a dead stub. Remove as pointless.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260427080738.77138-22-philmd@linaro.org>
---
 include/monitor/hmp-target.h   |  1 -
 monitor/hmp-target.c           | 14 +++-----------
 stubs/target-get-monitor-def.c | 29 -----------------------------
 stubs/meson.build              |  1 -
 4 files changed, 3 insertions(+), 42 deletions(-)
 delete mode 100644 stubs/target-get-monitor-def.c

diff --git a/include/monitor/hmp-target.h b/include/monitor/hmp-target.h
index ce0bb1983cc..008c1a6570c 100644
--- a/include/monitor/hmp-target.h
+++ b/include/monitor/hmp-target.h
@@ -38,7 +38,6 @@ struct MonitorDef {
 #endif
 
 const MonitorDef *target_monitor_defs(void);
-int target_get_monitor_def(CPUState *cs, const char *name, uint64_t *pval);
 
 CPUArchState *mon_get_cpu_env(Monitor *mon);
 CPUState *mon_get_cpu(Monitor *mon);
diff --git a/monitor/hmp-target.c b/monitor/hmp-target.c
index 46ccbd14aec..c2ddcd67e51 100644
--- a/monitor/hmp-target.c
+++ b/monitor/hmp-target.c
@@ -66,8 +66,6 @@ int get_monitor_def(Monitor *mon, int64_t *pval, const char *name)
     const MonitorDef *md = target_monitor_defs();
     CPUState *cs = mon_get_cpu(mon);
     void *ptr;
-    uint64_t tmp = 0;
-    int ret;
 
     if (cs == NULL || md == NULL) {
         return -1;
@@ -86,16 +84,10 @@ int get_monitor_def(Monitor *mon, int64_t *pval, const char *name)
         }
     }
 
-    if (cs->cc->sysemu_ops->monitor_get_register) {
-        ret = cs->cc->sysemu_ops->monitor_get_register(cs, name, pval);
-    } else {
-        ret = target_get_monitor_def(cs, name, &tmp);
-        if (!ret) {
-            *pval = (target_long) tmp;
-        }
+    if (!cs->cc->sysemu_ops->monitor_get_register) {
+        return -1;
     }
-
-    return ret;
+    return cs->cc->sysemu_ops->monitor_get_register(cs, name, pval);
 }
 
 static int
diff --git a/stubs/target-get-monitor-def.c b/stubs/target-get-monitor-def.c
deleted file mode 100644
index 394e0f9a7d2..00000000000
--- a/stubs/target-get-monitor-def.c
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- *  Stub for target_get_monitor_def.
- *
- *  Copyright IBM Corp., 2015
- *
- *  Author: Alexey Kardashevskiy <aik@ozlabs.ru>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License,
- *  or (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, see <http://www.gnu.org/licenses/>.
- */
-
-#include "qemu/osdep.h"
-
-int target_get_monitor_def(CPUState *cs, const char *name, uint64_t *pval);
-
-int target_get_monitor_def(CPUState *cs, const char *name, uint64_t *pval)
-{
-    return -1;
-}
diff --git a/stubs/meson.build b/stubs/meson.build
index 2f4e1ab4300..3489b1f20dd 100644
--- a/stubs/meson.build
+++ b/stubs/meson.build
@@ -75,7 +75,6 @@ if have_system
     stub_ss.add(files('igvm.c'))
   endif
   stub_ss.add(files('kvm.c'))
-  stub_ss.add(files('target-get-monitor-def.c'))
   stub_ss.add(files('target-monitor-defs.c'))
   stub_ss.add(files('win32-kbd-hook.c'))
   stub_ss.add(files('xen-hw-stub.c'))
-- 
2.53.0

[PULL 058/110] monitor: Have MonitorDef::get_value() always return int64_t type

[Philippe Mathieu-Daudé]

Simplify MonitorDef::get_value() handler by having it always
return a int64_t type.

Let the single caller (x86 targets) sign-extend the returned
value, directly handling 64-bit CPUs in 32-bit or 16-bit mode.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260427080738.77138-23-philmd@linaro.org>
---
 include/monitor/hmp-target.h |  6 +-----
 target/i386/monitor.c        | 11 ++++++++---
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/include/monitor/hmp-target.h b/include/monitor/hmp-target.h
index 008c1a6570c..ae34ca65ded 100644
--- a/include/monitor/hmp-target.h
+++ b/include/monitor/hmp-target.h
@@ -27,15 +27,11 @@
 
 typedef struct MonitorDef MonitorDef;
 
-#ifdef COMPILING_PER_TARGET
-#include "exec/target_long.h"
 struct MonitorDef {
     const char *name;
     int offset;
-    target_long (*get_value)(Monitor *mon, const struct MonitorDef *md,
-                             int val);
+    int64_t (*get_value)(Monitor *mon, const MonitorDef *md, int offset);
 };
-#endif
 
 const MonitorDef *target_monitor_defs(void);
 
diff --git a/target/i386/monitor.c b/target/i386/monitor.c
index 977f65fe16c..98df5c7fd12 100644
--- a/target/i386/monitor.c
+++ b/target/i386/monitor.c
@@ -593,11 +593,16 @@ void hmp_mce(Monitor *mon, const QDict *qdict)
     }
 }
 
-static target_long monitor_get_pc(Monitor *mon, const struct MonitorDef *md,
-                                  int val)
+static int64_t monitor_get_pc(Monitor *mon, const struct MonitorDef *md,
+                              int offset)
 {
     CPUArchState *env = mon_get_cpu_env(mon);
-    return env->eip + env->segs[R_CS].base;
+    int64_t ret = env->eip + env->segs[R_CS].base;
+
+    if (!(env->hflags & HF_CS64_MASK)) {
+        ret = (int32_t)ret;
+    }
+    return ret;
 }
 
 const MonitorDef monitor_defs[] = {
-- 
2.53.0

[PULL 059/110] monitor: Reduce target-specific methods further

[Philippe Mathieu-Daudé]

get_monitor_def() doesn't use any target-specific declaration
anymore, move it to hmp.c to compile it once.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Dr. David Alan Gilbert <dave@treblig.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260427080738.77138-24-philmd@linaro.org>
---
 monitor/monitor-internal.h |  1 -
 monitor/hmp-target.c       | 33 ---------------------------------
 monitor/hmp.c              | 36 ++++++++++++++++++++++++++++++++++++
 3 files changed, 36 insertions(+), 34 deletions(-)

diff --git a/monitor/monitor-internal.h b/monitor/monitor-internal.h
index eaf9a607783..a5c4aba306e 100644
--- a/monitor/monitor-internal.h
+++ b/monitor/monitor-internal.h
@@ -191,7 +191,6 @@ void monitor_data_destroy_qmp(MonitorQMP *mon);
 void coroutine_fn monitor_qmp_dispatcher_co(void *data);
 void qmp_dispatcher_co_wake(void);
 
-int get_monitor_def(Monitor *mon, int64_t *pval, const char *name);
 void handle_hmp_command(MonitorHMP *mon, const char *cmdline);
 int hmp_compare_cmd(const char *name, const char *list);
 
diff --git a/monitor/hmp-target.c b/monitor/hmp-target.c
index c2ddcd67e51..550a7178052 100644
--- a/monitor/hmp-target.c
+++ b/monitor/hmp-target.c
@@ -57,39 +57,6 @@ HMPCommand *hmp_cmds_for_target(bool info_command)
     return info_command ? hmp_info_cmds : hmp_cmds;
 }
 
-/*
- * Set @pval to the value in the register identified by @name.
- * return 0 if OK, -1 if not found
- */
-int get_monitor_def(Monitor *mon, int64_t *pval, const char *name)
-{
-    const MonitorDef *md = target_monitor_defs();
-    CPUState *cs = mon_get_cpu(mon);
-    void *ptr;
-
-    if (cs == NULL || md == NULL) {
-        return -1;
-    }
-
-    for(; md->name != NULL; md++) {
-        if (hmp_compare_cmd(name, md->name)) {
-            if (md->get_value) {
-                *pval = md->get_value(mon, md, md->offset);
-            } else {
-                CPUArchState *env = mon_get_cpu_env(mon);
-                ptr = (uint8_t *)env + md->offset;
-                *pval = *(int32_t *)ptr;
-            }
-            return 0;
-        }
-    }
-
-    if (!cs->cc->sysemu_ops->monitor_get_register) {
-        return -1;
-    }
-    return cs->cc->sysemu_ops->monitor_get_register(cs, name, pval);
-}
-
 static int
 compare_mon_cmd(const void *a, const void *b)
 {
diff --git a/monitor/hmp.c b/monitor/hmp.c
index e881c26c305..fe2f5560013 100644
--- a/monitor/hmp.c
+++ b/monitor/hmp.c
@@ -25,6 +25,7 @@
 #include "qemu/osdep.h"
 #include <dirent.h>
 #include "hw/core/qdev.h"
+#include "hw/core/sysemu-cpu-ops.h"
 #include "monitor-internal.h"
 #include "monitor/hmp.h"
 #include "monitor/hmp-target.h"
@@ -359,6 +360,8 @@ static bool gdb_get_register(Monitor *mon, int64_t *pval, const char *name)
 static const char *pch;
 static sigjmp_buf expr_env;
 
+static int get_monitor_def(Monitor *mon, int64_t *pval, const char *name);
+
 static G_NORETURN G_GNUC_PRINTF(2, 3)
 void expr_error(Monitor *mon, const char *fmt, ...)
 {
@@ -1599,3 +1602,36 @@ void monitor_register_hmp_info_hrt(const char *name,
     }
     g_assert_not_reached();
 }
+
+/*
+ * Set @pval to the value in the register identified by @name.
+ * return 0 if OK, -1 if not found
+ */
+static int get_monitor_def(Monitor *mon, int64_t *pval, const char *name)
+{
+    const MonitorDef *md = target_monitor_defs();
+    CPUState *cs = mon_get_cpu(mon);
+    void *ptr;
+
+    if (cs == NULL || md == NULL) {
+        return -1;
+    }
+
+    for (; md->name != NULL; md++) {
+        if (hmp_compare_cmd(name, md->name)) {
+            if (md->get_value) {
+                *pval = md->get_value(mon, md, md->offset);
+            } else {
+                CPUArchState *env = mon_get_cpu_env(mon);
+                ptr = (uint8_t *)env + md->offset;
+                *pval = *(int32_t *)ptr;
+            }
+            return 0;
+        }
+    }
+
+    if (!cs->cc->sysemu_ops->monitor_get_register) {
+        return -1;
+    }
+    return cs->cc->sysemu_ops->monitor_get_register(cs, name, pval);
+}
-- 
2.53.0

[PULL 060/110] monitor: Remove 'monitor/hmp-target.h' header

[Philippe Mathieu-Daudé]

The "monitor/hmp-target.h" header doesn't contain any
target-specific declarations anymore. Merge it with
"monitor/hmp.h", its target-agnostic counterpart.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Dr. David Alan Gilbert <dave@treblig.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260427080738.77138-25-philmd@linaro.org>
---
 MAINTAINERS                   |  1 -
 include/monitor/hmp-target.h  | 41 -----------------------------------
 include/monitor/hmp.h         | 11 ++++++++++
 hw/i386/sgx-stub.c            |  1 -
 hw/i386/sgx.c                 |  1 -
 monitor/hmp-cmds.c            |  1 -
 monitor/hmp-target.c          |  1 -
 monitor/hmp.c                 |  1 -
 stubs/target-monitor-defs.c   |  2 +-
 target/i386/cpu-apic.c        |  1 -
 target/i386/monitor.c         |  1 -
 target/i386/sev-system-stub.c |  1 -
 target/i386/sev.c             |  1 -
 target/m68k/monitor.c         |  1 -
 target/ppc/monitor.c          |  2 --
 target/riscv/monitor.c        |  1 -
 target/sh4/monitor.c          |  1 -
 target/sparc/monitor.c        |  1 -
 target/xtensa/monitor.c       |  1 -
 19 files changed, 12 insertions(+), 59 deletions(-)
 delete mode 100644 include/monitor/hmp-target.h

diff --git a/MAINTAINERS b/MAINTAINERS
index 1eb7903268b..c4f78ac07f7 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3415,7 +3415,6 @@ F: hmp.h
 F: hmp-commands*.hx
 F: include/monitor/hmp.h
 F: include/monitor/hmp-completion.h
-F: include/monitor/hmp-target.h
 F: tests/qtest/test-hmp.c
 F: include/qemu/qemu-print.h
 F: util/qemu-print.c
diff --git a/include/monitor/hmp-target.h b/include/monitor/hmp-target.h
deleted file mode 100644
index ae34ca65ded..00000000000
--- a/include/monitor/hmp-target.h
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * QEMU monitor
- *
- * Copyright (c) 2003-2004 Fabrice Bellard
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-
-#ifndef MONITOR_HMP_TARGET_H
-#define MONITOR_HMP_TARGET_H
-
-typedef struct MonitorDef MonitorDef;
-
-struct MonitorDef {
-    const char *name;
-    int offset;
-    int64_t (*get_value)(Monitor *mon, const MonitorDef *md, int offset);
-};
-
-const MonitorDef *target_monitor_defs(void);
-
-CPUArchState *mon_get_cpu_env(Monitor *mon);
-CPUState *mon_get_cpu(Monitor *mon);
-
-#endif /* MONITOR_HMP_TARGET_H */
diff --git a/include/monitor/hmp.h b/include/monitor/hmp.h
index 930ffa31aba..357fc972885 100644
--- a/include/monitor/hmp.h
+++ b/include/monitor/hmp.h
@@ -24,6 +24,17 @@
         g_assert_not_reached(); \
     }
 
+typedef struct MonitorDef {
+    const char *name;
+    int offset;
+    int64_t (*get_value)(Monitor *mon, const struct MonitorDef *md, int offset);
+} MonitorDef;
+
+const MonitorDef *target_monitor_defs(void);
+
+CPUArchState *mon_get_cpu_env(Monitor *mon);
+CPUState *mon_get_cpu(Monitor *mon);
+
 bool hmp_handle_error(Monitor *mon, Error *err);
 void hmp_help_cmd(Monitor *mon, const char *name);
 strList *hmp_split_at_comma(const char *str);
diff --git a/hw/i386/sgx-stub.c b/hw/i386/sgx-stub.c
index 2b083c77bc1..59d58926311 100644
--- a/hw/i386/sgx-stub.c
+++ b/hw/i386/sgx-stub.c
@@ -1,7 +1,6 @@
 #include "qemu/osdep.h"
 #include "monitor/monitor.h"
 #include "monitor/hmp.h"
-#include "monitor/hmp-target.h"
 #include "hw/i386/pc.h"
 #include "hw/i386/sgx-epc.h"
 #include "qapi/qapi-commands-misc-i386.h"
diff --git a/hw/i386/sgx.c b/hw/i386/sgx.c
index 5e792e8e6e9..7e4c509f5a4 100644
--- a/hw/i386/sgx.c
+++ b/hw/i386/sgx.c
@@ -17,7 +17,6 @@
 #include "monitor/qdev.h"
 #include "monitor/monitor.h"
 #include "monitor/hmp.h"
-#include "monitor/hmp-target.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "qapi/qapi-commands-misc-i386.h"
diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
index 1b44d07c18d..682bb62e91b 100644
--- a/monitor/hmp-cmds.c
+++ b/monitor/hmp-cmds.c
@@ -22,7 +22,6 @@
 #include "monitor/hmp.h"
 #include "qemu/help_option.h"
 #include "monitor/hmp.h"
-#include "monitor/hmp-target.h"
 #include "monitor/monitor-internal.h"
 #include "qapi/error.h"
 #include "qapi/qapi-commands-control.h"
diff --git a/monitor/hmp-target.c b/monitor/hmp-target.c
index 550a7178052..2739383607d 100644
--- a/monitor/hmp-target.c
+++ b/monitor/hmp-target.c
@@ -28,7 +28,6 @@
 #include "monitor/qdev.h"
 #include "net/slirp.h"
 #include "system/device_tree.h"
-#include "monitor/hmp-target.h"
 #include "monitor/hmp.h"
 #include "monitor/hmp-completion.h"
 #include "block/block-hmp-cmds.h"
diff --git a/monitor/hmp.c b/monitor/hmp.c
index fe2f5560013..02e9d72e672 100644
--- a/monitor/hmp.c
+++ b/monitor/hmp.c
@@ -28,7 +28,6 @@
 #include "hw/core/sysemu-cpu-ops.h"
 #include "monitor-internal.h"
 #include "monitor/hmp.h"
-#include "monitor/hmp-target.h"
 #include "qobject/qdict.h"
 #include "qobject/qnum.h"
 #include "qemu/bswap.h"
diff --git a/stubs/target-monitor-defs.c b/stubs/target-monitor-defs.c
index 35a0a342772..0dd4cdb34f6 100644
--- a/stubs/target-monitor-defs.c
+++ b/stubs/target-monitor-defs.c
@@ -1,5 +1,5 @@
 #include "qemu/osdep.h"
-#include "monitor/hmp-target.h"
+#include "monitor/hmp.h"
 
 const MonitorDef *target_monitor_defs(void)
 {
diff --git a/target/i386/cpu-apic.c b/target/i386/cpu-apic.c
index eaa10ad2a3d..5599a4675c5 100644
--- a/target/i386/cpu-apic.c
+++ b/target/i386/cpu-apic.c
@@ -11,7 +11,6 @@
 #include "qapi/error.h"
 #include "monitor/monitor.h"
 #include "monitor/hmp.h"
-#include "monitor/hmp-target.h"
 #include "system/hw_accel.h"
 #include "system/kvm.h"
 #include "system/xen.h"
diff --git a/target/i386/monitor.c b/target/i386/monitor.c
index 98df5c7fd12..1befb8ea824 100644
--- a/target/i386/monitor.c
+++ b/target/i386/monitor.c
@@ -25,7 +25,6 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "monitor/monitor.h"
-#include "monitor/hmp-target.h"
 #include "monitor/hmp.h"
 #include "qobject/qdict.h"
 #include "qapi/error.h"
diff --git a/target/i386/sev-system-stub.c b/target/i386/sev-system-stub.c
index 2ea85597cf9..d97536cca1c 100644
--- a/target/i386/sev-system-stub.c
+++ b/target/i386/sev-system-stub.c
@@ -14,7 +14,6 @@
 #include "qemu/osdep.h"
 #include "monitor/monitor.h"
 #include "monitor/hmp.h"
-#include "monitor/hmp-target.h"
 #include "qapi/error.h"
 #include "sev.h"
 
diff --git a/target/i386/sev.c b/target/i386/sev.c
index 261b6aaa37b..b44b5a1c2b9 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -40,7 +40,6 @@
 #include "qom/object.h"
 #include "monitor/monitor.h"
 #include "monitor/hmp.h"
-#include "monitor/hmp-target.h"
 #include "qapi/qapi-commands-misc-i386.h"
 #include "confidential-guest.h"
 #include "hw/i386/pc.h"
diff --git a/target/m68k/monitor.c b/target/m68k/monitor.c
index 94bb12833af..be7411edca6 100644
--- a/target/m68k/monitor.c
+++ b/target/m68k/monitor.c
@@ -8,7 +8,6 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "monitor/hmp.h"
-#include "monitor/hmp-target.h"
 #include "monitor/monitor.h"
 
 void hmp_info_tlb(Monitor *mon, const QDict *qdict)
diff --git a/target/ppc/monitor.c b/target/ppc/monitor.c
index 776a76602ea..7c88e0e2bda 100644
--- a/target/ppc/monitor.c
+++ b/target/ppc/monitor.c
@@ -7,9 +7,7 @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu/ctype.h"
 #include "monitor/monitor.h"
-#include "monitor/hmp-target.h"
 #include "monitor/hmp.h"
 #include "cpu.h"
 
diff --git a/target/riscv/monitor.c b/target/riscv/monitor.c
index 3898595a3cb..63806002417 100644
--- a/target/riscv/monitor.c
+++ b/target/riscv/monitor.c
@@ -25,7 +25,6 @@
 #include "cpu_bits.h"
 #include "monitor/monitor.h"
 #include "monitor/hmp.h"
-#include "monitor/hmp-target.h"
 #include "system/memory.h"
 #include "internals.h"
 
diff --git a/target/sh4/monitor.c b/target/sh4/monitor.c
index 2da6a5426eb..50324d3600c 100644
--- a/target/sh4/monitor.c
+++ b/target/sh4/monitor.c
@@ -24,7 +24,6 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "monitor/monitor.h"
-#include "monitor/hmp-target.h"
 #include "monitor/hmp.h"
 
 static void print_tlb(Monitor *mon, int idx, tlb_t *tlb)
diff --git a/target/sparc/monitor.c b/target/sparc/monitor.c
index a60671a60a4..99abddbf1e0 100644
--- a/target/sparc/monitor.c
+++ b/target/sparc/monitor.c
@@ -24,7 +24,6 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "monitor/monitor.h"
-#include "monitor/hmp-target.h"
 #include "monitor/hmp.h"
 
 
diff --git a/target/xtensa/monitor.c b/target/xtensa/monitor.c
index fbf60d55530..2af84934f83 100644
--- a/target/xtensa/monitor.c
+++ b/target/xtensa/monitor.c
@@ -24,7 +24,6 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "monitor/monitor.h"
-#include "monitor/hmp-target.h"
 #include "monitor/hmp.h"
 
 void hmp_info_tlb(Monitor *mon, const QDict *qdict)
-- 
2.53.0

[PULL 061/110] monitor: Forward-declare the MonitorDef type

[Philippe Mathieu-Daudé]

Rather than having core header forced to include "monitor/hmp.h"
to get the MonitorDef type declaration, forward-declare it in
"qemu/typedefs.h".

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260427080738.77138-26-philmd@linaro.org>
---
 include/monitor/hmp.h   | 6 +++---
 include/qemu/typedefs.h | 1 +
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/include/monitor/hmp.h b/include/monitor/hmp.h
index 357fc972885..d423f54f904 100644
--- a/include/monitor/hmp.h
+++ b/include/monitor/hmp.h
@@ -24,11 +24,11 @@
         g_assert_not_reached(); \
     }
 
-typedef struct MonitorDef {
+struct MonitorDef {
     const char *name;
     int offset;
-    int64_t (*get_value)(Monitor *mon, const struct MonitorDef *md, int offset);
-} MonitorDef;
+    int64_t (*get_value)(Monitor *mon, const MonitorDef *md, int offset);
+};
 
 const MonitorDef *target_monitor_defs(void);
 
diff --git a/include/qemu/typedefs.h b/include/qemu/typedefs.h
index 416a8c9acea..07f2ae7c9f1 100644
--- a/include/qemu/typedefs.h
+++ b/include/qemu/typedefs.h
@@ -72,6 +72,7 @@ typedef struct MemoryRegionSection MemoryRegionSection;
 typedef struct MigrationIncomingState MigrationIncomingState;
 typedef struct MigrationState MigrationState;
 typedef struct Monitor Monitor;
+typedef struct MonitorDef MonitorDef;
 typedef struct MSIMessage MSIMessage;
 typedef struct NetClientState NetClientState;
 typedef struct NetFilterState NetFilterState;
-- 
2.53.0

[PULL 062/110] cpus: Introduce SysemuCPUOps::monitor_defs hook

[Philippe Mathieu-Daudé]

Allow targets to register their legacy target_monitor_defs()
in SysemuCPUOps; check it first in get_monitor_def() otherwise
fall back to previous per-target helper.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260427080738.77138-27-philmd@linaro.org>
---
 include/hw/core/sysemu-cpu-ops.h | 6 ++++++
 monitor/hmp.c                    | 8 ++++++--
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/include/hw/core/sysemu-cpu-ops.h b/include/hw/core/sysemu-cpu-ops.h
index 5b831393cf4..94e36ecdd18 100644
--- a/include/hw/core/sysemu-cpu-ops.h
+++ b/include/hw/core/sysemu-cpu-ops.h
@@ -93,6 +93,12 @@ typedef struct SysemuCPUOps {
      */
     int (*monitor_get_register)(CPUState *cs, const char *name, int64_t *pval);
 
+    /**
+     * @monitor_defs: Array of MonitorDef entries. This field is legacy,
+     *                use @gdb_core_xml_file to dump registers instead.
+     */
+    const MonitorDef *monitor_defs;
+
     /**
      * @legacy_vmsd: Legacy state for migration.
      *               Do not use in new targets, use #DeviceClass::vmsd instead.
diff --git a/monitor/hmp.c b/monitor/hmp.c
index 02e9d72e672..ad8b0d1a72e 100644
--- a/monitor/hmp.c
+++ b/monitor/hmp.c
@@ -1608,11 +1608,15 @@ void monitor_register_hmp_info_hrt(const char *name,
  */
 static int get_monitor_def(Monitor *mon, int64_t *pval, const char *name)
 {
-    const MonitorDef *md = target_monitor_defs();
     CPUState *cs = mon_get_cpu(mon);
+    const MonitorDef *md;
     void *ptr;
 
-    if (cs == NULL || md == NULL) {
+    if (cs == NULL) {
+        return -1;
+    }
+    md = cs->cc->sysemu_ops->monitor_defs ?: target_monitor_defs();
+    if (md == NULL) {
         return -1;
     }
 
-- 
2.53.0

[PULL 063/110] target/i386: Replace target_monitor_defs -> SysemuCPUOps::monitor_defs

[Philippe Mathieu-Daudé]

Restrict x86_monitor_defs[] to cpu.c, register it as
SysemuCPUOps::monitor_defs hook, allowing to remove
the target_monitor_defs() method.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260427080738.77138-28-philmd@linaro.org>
---
 target/i386/cpu.c     | 29 +++++++++++++++++++++++++++++
 target/i386/monitor.c | 30 ------------------------------
 2 files changed, 29 insertions(+), 30 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index efe7ba014d3..97c66c22262 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -41,6 +41,7 @@
 #include "exec/watchpoint.h"
 #ifndef CONFIG_USER_ONLY
 #include "confidential-guest.h"
+#include "monitor/hmp.h"
 #include "system/reset.h"
 #include "qapi/qapi-commands-machine.h"
 #include "system/address-spaces.h"
@@ -10843,6 +10844,33 @@ static const Property x86_cpu_properties[] = {
 };
 
 #ifndef CONFIG_USER_ONLY
+
+static int64_t monitor_get_pc(Monitor *mon, const struct MonitorDef *md,
+                              int offset)
+{
+    CPUArchState *env = mon_get_cpu_env(mon);
+    int64_t ret = env->eip + env->segs[R_CS].base;
+
+    if (!(env->hflags & HF_CS64_MASK)) {
+        ret = (int32_t)ret;
+    }
+    return ret;
+}
+
+static const MonitorDef x86_monitor_defs[] = {
+#define SEG(name, seg) \
+    { name ".limit", offsetof(CPUX86State, segs[seg].limit) },
+    SEG("cs", R_CS)
+    SEG("ds", R_DS)
+    SEG("es", R_ES)
+    SEG("ss", R_SS)
+    SEG("fs", R_FS)
+    SEG("gs", R_GS)
+    { "pc", 0, monitor_get_pc, },
+    { NULL },
+#undef SEG
+};
+
 #include "hw/core/sysemu-cpu-ops.h"
 
 static const struct SysemuCPUOps i386_sysemu_ops = {
@@ -10856,6 +10884,7 @@ static const struct SysemuCPUOps i386_sysemu_ops = {
     .write_elf64_note = x86_cpu_write_elf64_note,
     .write_elf32_qemunote = x86_cpu_write_elf32_qemunote,
     .write_elf64_qemunote = x86_cpu_write_elf64_qemunote,
+    .monitor_defs = x86_monitor_defs,
     .legacy_vmsd = &vmstate_x86_cpu,
 };
 #endif
diff --git a/target/i386/monitor.c b/target/i386/monitor.c
index 1befb8ea824..a536712c755 100644
--- a/target/i386/monitor.c
+++ b/target/i386/monitor.c
@@ -591,33 +591,3 @@ void hmp_mce(Monitor *mon, const QDict *qdict)
                            flags);
     }
 }
-
-static int64_t monitor_get_pc(Monitor *mon, const struct MonitorDef *md,
-                              int offset)
-{
-    CPUArchState *env = mon_get_cpu_env(mon);
-    int64_t ret = env->eip + env->segs[R_CS].base;
-
-    if (!(env->hflags & HF_CS64_MASK)) {
-        ret = (int32_t)ret;
-    }
-    return ret;
-}
-
-const MonitorDef monitor_defs[] = {
-#define SEG(name, seg) \
-    { name ".limit", offsetof(CPUX86State, segs[seg].limit) },
-    SEG("cs", R_CS)
-    SEG("ds", R_DS)
-    SEG("es", R_ES)
-    SEG("ss", R_SS)
-    SEG("fs", R_FS)
-    SEG("gs", R_GS)
-    { "pc", 0, monitor_get_pc, },
-    { NULL },
-};
-
-const MonitorDef *target_monitor_defs(void)
-{
-    return monitor_defs;
-}
-- 
2.53.0

[PULL 064/110] target/m68k: Replace target_monitor_defs -> SysemuCPUOps::monitor_defs

[Philippe Mathieu-Daudé]

Restrict m68k_monitor_defs[] to cpu.c, register it as
SysemuCPUOps::monitor_defs hook, allowing to remove
the target_monitor_defs() method.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260427080738.77138-29-philmd@linaro.org>
---
 target/m68k/cpu.c     | 18 ++++++++++++++++++
 target/m68k/monitor.c | 21 ---------------------
 2 files changed, 18 insertions(+), 21 deletions(-)

diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index d849a4a90fc..f704a6af613 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -25,6 +25,7 @@
 
 #ifndef CONFIG_USER_ONLY
 #include "migration/vmstate.h"
+#include "monitor/hmp.h"
 #endif
 
 #include "cpu.h"
@@ -602,11 +603,28 @@ static const VMStateDescription vmstate_m68k_cpu = {
     },
 };
 
+static const MonitorDef m68k_monitor_defs[] = {
+    { "ssp", offsetof(CPUM68KState, sp[0]) },
+    { "usp", offsetof(CPUM68KState, sp[1]) },
+    { "isp", offsetof(CPUM68KState, sp[2]) },
+    { "sfc", offsetof(CPUM68KState, sfc) },
+    { "dfc", offsetof(CPUM68KState, dfc) },
+    { "urp", offsetof(CPUM68KState, mmu.urp) },
+    { "srp", offsetof(CPUM68KState, mmu.srp) },
+    { "dttr0", offsetof(CPUM68KState, mmu.ttr[M68K_DTTR0]) },
+    { "dttr1", offsetof(CPUM68KState, mmu.ttr[M68K_DTTR1]) },
+    { "ittr0", offsetof(CPUM68KState, mmu.ttr[M68K_ITTR0]) },
+    { "ittr1", offsetof(CPUM68KState, mmu.ttr[M68K_ITTR1]) },
+    { "mmusr", offsetof(CPUM68KState, mmu.mmusr) },
+    { NULL },
+};
+
 #include "hw/core/sysemu-cpu-ops.h"
 
 static const struct SysemuCPUOps m68k_sysemu_ops = {
     .has_work = m68k_cpu_has_work,
     .get_phys_page_debug = m68k_cpu_get_phys_page_debug,
+    .monitor_defs = m68k_monitor_defs,
 };
 #endif /* !CONFIG_USER_ONLY */
 
diff --git a/target/m68k/monitor.c b/target/m68k/monitor.c
index be7411edca6..3e0df40a6b8 100644
--- a/target/m68k/monitor.c
+++ b/target/m68k/monitor.c
@@ -21,24 +21,3 @@ void hmp_info_tlb(Monitor *mon, const QDict *qdict)
 
     dump_mmu(env1);
 }
-
-static const MonitorDef monitor_defs[] = {
-    { "ssp", offsetof(CPUM68KState, sp[0]) },
-    { "usp", offsetof(CPUM68KState, sp[1]) },
-    { "isp", offsetof(CPUM68KState, sp[2]) },
-    { "sfc", offsetof(CPUM68KState, sfc) },
-    { "dfc", offsetof(CPUM68KState, dfc) },
-    { "urp", offsetof(CPUM68KState, mmu.urp) },
-    { "srp", offsetof(CPUM68KState, mmu.srp) },
-    { "dttr0", offsetof(CPUM68KState, mmu.ttr[M68K_DTTR0]) },
-    { "dttr1", offsetof(CPUM68KState, mmu.ttr[M68K_DTTR1]) },
-    { "ittr0", offsetof(CPUM68KState, mmu.ttr[M68K_ITTR0]) },
-    { "ittr1", offsetof(CPUM68KState, mmu.ttr[M68K_ITTR1]) },
-    { "mmusr", offsetof(CPUM68KState, mmu.mmusr) },
-    { NULL },
-};
-
-const MonitorDef *target_monitor_defs(void)
-{
-    return monitor_defs;
-}
-- 
2.53.0

[PULL 065/110] target/sparc: Replace target_monitor_defs -> SysemuCPUOps::monitor_defs

[Philippe Mathieu-Daudé]

Restrict sparc64_monitor_defs[] to cpu.c, register it
as SysemuCPUOps::monitor_defs hook (taking care to not
register it on 32-bit SPARC target), allowing to remove
the target_monitor_defs() method.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260427080738.77138-30-philmd@linaro.org>
---
 target/sparc/cpu.c     | 19 +++++++++++++++++++
 target/sparc/monitor.c | 18 ------------------
 2 files changed, 19 insertions(+), 18 deletions(-)

diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index 77046104284..c6989229da6 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -993,12 +993,31 @@ static const Property sparc_cpu_properties[] = {
 };
 
 #ifndef CONFIG_USER_ONLY
+
+#ifdef TARGET_SPARC64
+#include "monitor/hmp.h"
+
+static const MonitorDef sparc64_monitor_defs[] = {
+    { "asi", offsetof(CPUSPARCState, asi) },
+    { "pstate", offsetof(CPUSPARCState, pstate) },
+    { "cansave", offsetof(CPUSPARCState, cansave) },
+    { "canrestore", offsetof(CPUSPARCState, canrestore) },
+    { "otherwin", offsetof(CPUSPARCState, otherwin) },
+    { "wstate", offsetof(CPUSPARCState, wstate) },
+    { "cleanwin", offsetof(CPUSPARCState, cleanwin) },
+    { NULL },
+};
+#endif
+
 #include "hw/core/sysemu-cpu-ops.h"
 
 static const struct SysemuCPUOps sparc_sysemu_ops = {
     .has_work = sparc_cpu_has_work,
     .get_phys_page_debug = sparc_cpu_get_phys_page_debug,
     .legacy_vmsd = &vmstate_sparc_cpu,
+#if defined(TARGET_SPARC64)
+    .monitor_defs = sparc64_monitor_defs,
+#endif
 };
 #endif
 
diff --git a/target/sparc/monitor.c b/target/sparc/monitor.c
index 99abddbf1e0..36f3d8d58e9 100644
--- a/target/sparc/monitor.c
+++ b/target/sparc/monitor.c
@@ -37,21 +37,3 @@ void hmp_info_tlb(Monitor *mon, const QDict *qdict)
     }
     dump_mmu(env1);
 }
-
-const MonitorDef monitor_defs[] = {
-#ifdef TARGET_SPARC64
-    { "asi", offsetof(CPUSPARCState, asi) },
-    { "pstate", offsetof(CPUSPARCState, pstate) },
-    { "cansave", offsetof(CPUSPARCState, cansave) },
-    { "canrestore", offsetof(CPUSPARCState, canrestore) },
-    { "otherwin", offsetof(CPUSPARCState, otherwin) },
-    { "wstate", offsetof(CPUSPARCState, wstate) },
-    { "cleanwin", offsetof(CPUSPARCState, cleanwin) },
-#endif
-    { NULL },
-};
-
-const MonitorDef *target_monitor_defs(void)
-{
-    return monitor_defs;
-}
-- 
2.53.0

[PULL 066/110] monitor: Remove target_monitor_defs()

[Philippe Mathieu-Daudé]

target_monitor_defs() is now only a dead stub. Remove as pointless.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260427080738.77138-31-philmd@linaro.org>
---
 include/monitor/hmp.h       | 2 --
 monitor/hmp.c               | 2 +-
 stubs/target-monitor-defs.c | 7 -------
 stubs/meson.build           | 1 -
 4 files changed, 1 insertion(+), 11 deletions(-)
 delete mode 100644 stubs/target-monitor-defs.c

diff --git a/include/monitor/hmp.h b/include/monitor/hmp.h
index d423f54f904..9bf46795bd4 100644
--- a/include/monitor/hmp.h
+++ b/include/monitor/hmp.h
@@ -30,8 +30,6 @@ struct MonitorDef {
     int64_t (*get_value)(Monitor *mon, const MonitorDef *md, int offset);
 };
 
-const MonitorDef *target_monitor_defs(void);
-
 CPUArchState *mon_get_cpu_env(Monitor *mon);
 CPUState *mon_get_cpu(Monitor *mon);
 
diff --git a/monitor/hmp.c b/monitor/hmp.c
index ad8b0d1a72e..cc4390486e1 100644
--- a/monitor/hmp.c
+++ b/monitor/hmp.c
@@ -1615,7 +1615,7 @@ static int get_monitor_def(Monitor *mon, int64_t *pval, const char *name)
     if (cs == NULL) {
         return -1;
     }
-    md = cs->cc->sysemu_ops->monitor_defs ?: target_monitor_defs();
+    md = cs->cc->sysemu_ops->monitor_defs;
     if (md == NULL) {
         return -1;
     }
diff --git a/stubs/target-monitor-defs.c b/stubs/target-monitor-defs.c
deleted file mode 100644
index 0dd4cdb34f6..00000000000
--- a/stubs/target-monitor-defs.c
+++ /dev/null
@@ -1,7 +0,0 @@
-#include "qemu/osdep.h"
-#include "monitor/hmp.h"
-
-const MonitorDef *target_monitor_defs(void)
-{
-    return NULL;
-}
diff --git a/stubs/meson.build b/stubs/meson.build
index 3489b1f20dd..3b2f2680b19 100644
--- a/stubs/meson.build
+++ b/stubs/meson.build
@@ -75,7 +75,6 @@ if have_system
     stub_ss.add(files('igvm.c'))
   endif
   stub_ss.add(files('kvm.c'))
-  stub_ss.add(files('target-monitor-defs.c'))
   stub_ss.add(files('win32-kbd-hook.c'))
   stub_ss.add(files('xen-hw-stub.c'))
   stub_ss.add(files('qmp-arm-gic.c'))
-- 
2.53.0

[PULL 067/110] monitor: Merge hmp-target.c code within hmp-cmds.c

[Philippe Mathieu-Daudé]

hmp-target.c doesn't contain any target-specific code anymore.
Merge it within hmp-cmds.c (which is already built once).

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260427080738.77138-32-philmd@linaro.org>
---
 MAINTAINERS          |  1 -
 monitor/hmp-cmds.c   | 40 ++++++++++++++++++++++++
 monitor/hmp-target.c | 74 --------------------------------------------
 monitor/meson.build  |  3 --
 4 files changed, 40 insertions(+), 78 deletions(-)
 delete mode 100644 monitor/hmp-target.c

diff --git a/MAINTAINERS b/MAINTAINERS
index c4f78ac07f7..10bf7b761b1 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3408,7 +3408,6 @@ Human Monitor (HMP)
 M: Dr. David Alan Gilbert <dave@treblig.org>
 S: Maintained
 F: monitor/monitor-internal.h
-F: monitor/hmp-target.c
 F: monitor/monitor.c
 F: monitor/hmp*
 F: hmp.h
diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
index 682bb62e91b..db92d6cb86b 100644
--- a/monitor/hmp-cmds.c
+++ b/monitor/hmp-cmds.c
@@ -14,6 +14,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/base-arch-defs.h"
 #include "system/address-spaces.h"
 #include "system/ioport.h"
 #include "exec/gdbstub.h"
@@ -22,19 +23,58 @@
 #include "monitor/hmp.h"
 #include "qemu/help_option.h"
 #include "monitor/hmp.h"
+#include "monitor/hmp-completion.h"
 #include "monitor/monitor-internal.h"
+#include "monitor/qdev.h"
 #include "qapi/error.h"
 #include "qapi/qapi-commands-control.h"
 #include "qapi/qapi-commands-machine.h"
 #include "qapi/qapi-commands-misc.h"
+#include "block/block-hmp-cmds.h"
 #include "qobject/qdict.h"
 #include "qemu/cutils.h"
 #include "qemu/log.h"
+#include "net/slirp.h"
+#include "system/device_tree.h"
 #include "system/hw_accel.h"
 #include "system/memory.h"
 #include "system/system.h"
 #include "disas/disas.h"
 
+/* Please update hmp-commands.hx when adding or changing commands */
+static HMPCommand hmp_info_cmds[] = {
+#include "hmp-commands-info.h"
+    { NULL, NULL, },
+};
+
+/* hmp_cmds and hmp_info_cmds would be sorted at runtime */
+static HMPCommand hmp_cmds[] = {
+#include "hmp-commands.h"
+    { NULL, NULL, },
+};
+
+HMPCommand *hmp_cmds_for_target(bool info_command)
+{
+    return info_command ? hmp_info_cmds : hmp_cmds;
+}
+
+static int
+compare_mon_cmd(const void *a, const void *b)
+{
+    return strcmp(((const HMPCommand *)a)->name,
+            ((const HMPCommand *)b)->name);
+}
+
+static void __attribute__((__constructor__)) sortcmdlist(void)
+{
+    qsort(hmp_cmds, ARRAY_SIZE(hmp_cmds) - 1,
+          sizeof(*hmp_cmds),
+          compare_mon_cmd);
+    qsort(hmp_info_cmds, ARRAY_SIZE(hmp_info_cmds) - 1,
+          sizeof(*hmp_info_cmds),
+          compare_mon_cmd);
+}
+
 bool hmp_handle_error(Monitor *mon, Error *err)
 {
     if (err) {
diff --git a/monitor/hmp-target.c b/monitor/hmp-target.c
deleted file mode 100644
index 2739383607d..00000000000
--- a/monitor/hmp-target.c
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * QEMU monitor, target-dependent part
- *
- * Copyright (c) 2003-2004 Fabrice Bellard
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-
-#include "qemu/osdep.h"
-#include "qemu/base-arch-defs.h"
-#include "monitor-internal.h"
-#include "monitor/qdev.h"
-#include "net/slirp.h"
-#include "system/device_tree.h"
-#include "monitor/hmp.h"
-#include "monitor/hmp-completion.h"
-#include "block/block-hmp-cmds.h"
-#include "qapi/qapi-commands-control.h"
-#include "qapi/qapi-commands-misc.h"
-#include "qapi/qapi-commands-machine.h"
-#include "hw/core/sysemu-cpu-ops.h"
-
-/* Make devices configuration available for use in hmp-commands*.hx templates */
-#include CONFIG_DEVICES
-
-/* Please update hmp-commands.hx when adding or changing commands */
-static HMPCommand hmp_info_cmds[] = {
-#include "hmp-commands-info.h"
-    { NULL, NULL, },
-};
-
-/* hmp_cmds and hmp_info_cmds would be sorted at runtime */
-static HMPCommand hmp_cmds[] = {
-#include "hmp-commands.h"
-    { NULL, NULL, },
-};
-
-HMPCommand *hmp_cmds_for_target(bool info_command)
-{
-    return info_command ? hmp_info_cmds : hmp_cmds;
-}
-
-static int
-compare_mon_cmd(const void *a, const void *b)
-{
-    return strcmp(((const HMPCommand *)a)->name,
-            ((const HMPCommand *)b)->name);
-}
-
-static void __attribute__((__constructor__)) sortcmdlist(void)
-{
-    qsort(hmp_cmds, ARRAY_SIZE(hmp_cmds) - 1,
-          sizeof(*hmp_cmds),
-          compare_mon_cmd);
-    qsort(hmp_info_cmds, ARRAY_SIZE(hmp_info_cmds) - 1,
-          sizeof(*hmp_info_cmds),
-          compare_mon_cmd);
-}
diff --git a/monitor/meson.build b/monitor/meson.build
index 585251804e4..4c58dd148c0 100644
--- a/monitor/meson.build
+++ b/monitor/meson.build
@@ -7,6 +7,3 @@ system_ss.add(files(
   'qemu-config-qmp.c',
   'qmp-cmds.c',
 ))
-
-specific_ss.add(when: 'CONFIG_SYSTEM_ONLY',
-                if_true: [files('hmp-target.c')])
-- 
2.53.0

[PULL 068/110] monitor: Remove hmp_info_pic() left-over declaration

[Philippe Mathieu-Daudé]

When converting 'info pic' to QMP in commit 795eaa62fa6 ("hw/intc:
Introduce x-query-interrupt-controllers QMP command"), we forgot
to remove the hmp_info_pic() declaration. Do it now.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260427080738.77138-33-philmd@linaro.org>
---
 include/monitor/hmp.h | 1 -
 1 file changed, 1 deletion(-)

diff --git a/include/monitor/hmp.h b/include/monitor/hmp.h
index 9bf46795bd4..9258a049bff 100644
--- a/include/monitor/hmp.h
+++ b/include/monitor/hmp.h
@@ -52,7 +52,6 @@ void hmp_info_cpus(Monitor *mon, const QDict *qdict);
 void hmp_info_vnc(Monitor *mon, const QDict *qdict);
 void hmp_info_spice(Monitor *mon, const QDict *qdict);
 void hmp_info_balloon(Monitor *mon, const QDict *qdict);
-void hmp_info_pic(Monitor *mon, const QDict *qdict);
 void hmp_info_pci(Monitor *mon, const QDict *qdict);
 void hmp_info_tpm(Monitor *mon, const QDict *qdict);
 void hmp_info_iothreads(Monitor *mon, const QDict *qdict);
-- 
2.53.0

[PULL 069/110] target/mips: Inline cpu_ld{uw, l}_code() calls in set_badinstr_registers

[Philippe Mathieu-Daudé]

In preparation of removing the cpu_lduw_code() and cpu_ldl_code()
wrappers, inline them. Directly replace MO_TE by mo_endian_env(env).

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260320074555.33974-2-philmd@linaro.org>
---
 target/mips/tcg/system/tlb_helper.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/target/mips/tcg/system/tlb_helper.c b/target/mips/tcg/system/tlb_helper.c
index 566924b079e..b989c7e5bd5 100644
--- a/target/mips/tcg/system/tlb_helper.c
+++ b/target/mips/tcg/system/tlb_helper.c
@@ -999,16 +999,22 @@ static void set_hflags_for_handler(CPUMIPSState *env)
 
 static inline void set_badinstr_registers(CPUMIPSState *env)
 {
+    CPUState *cs = env_cpu(env);
+    MemOpIdx oi;
+
     if (env->insn_flags & ISA_NANOMIPS32) {
         if (env->CP0_Config3 & (1 << CP0C3_BI)) {
-            uint32_t instr = (cpu_lduw_code(env, env->active_tc.PC)) << 16;
+            uint32_t instr;
+
+            oi = make_memop_idx(mo_endian_env(env) | MO_UW, cpu_mmu_index(cs, true));
+            instr =  cpu_ldw_code_mmu(env, env->active_tc.PC, oi, 0) << 16;
             if ((instr & 0x10000000) == 0) {
-                instr |= cpu_lduw_code(env, env->active_tc.PC + 2);
+                instr |= cpu_ldw_code_mmu(env, env->active_tc.PC + 2, oi, 0);
             }
             env->CP0_BadInstr = instr;
 
             if ((instr & 0xFC000000) == 0x60000000) {
-                instr = cpu_lduw_code(env, env->active_tc.PC + 4) << 16;
+                instr =  cpu_ldw_code_mmu(env, env->active_tc.PC + 4, oi, 0) << 16;
                 env->CP0_BadInstrX = instr;
             }
         }
@@ -1019,12 +1025,14 @@ static inline void set_badinstr_registers(CPUMIPSState *env)
         /* TODO: add BadInstr support for microMIPS */
         return;
     }
+
+    oi = make_memop_idx(mo_endian_env(env) | MO_UL, cpu_mmu_index(cs, true));
     if (env->CP0_Config3 & (1 << CP0C3_BI)) {
-        env->CP0_BadInstr = cpu_ldl_code(env, env->active_tc.PC);
+        env->CP0_BadInstr = cpu_ldl_code_mmu(env, env->active_tc.PC, oi, 0);
     }
     if ((env->CP0_Config3 & (1 << CP0C3_BP)) &&
         (env->hflags & MIPS_HFLAG_BMASK)) {
-        env->CP0_BadInstrP = cpu_ldl_code(env, env->active_tc.PC - 4);
+        env->CP0_BadInstrP = cpu_ldl_code_mmu(env, env->active_tc.PC - 4, oi, 0);
     }
 }
 
-- 
2.53.0

[PULL 070/110] accel/tcg: Remove non-explicit endian cpu_ld*_code() wrappers

[Philippe Mathieu-Daudé]

All uses were converted to the cpu_ld*_code_mmu() helpers:
remove them. Update the documentation.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260320074555.33974-3-philmd@linaro.org>
---
 docs/devel/loads-stores.rst  | 21 +++++++++------------
 include/accel/tcg/cpu-ldst.h | 33 ++-------------------------------
 2 files changed, 11 insertions(+), 43 deletions(-)

diff --git a/docs/devel/loads-stores.rst b/docs/devel/loads-stores.rst
index 57892e814cd..c719241a7f5 100644
--- a/docs/devel/loads-stores.rst
+++ b/docs/devel/loads-stores.rst
@@ -235,16 +235,13 @@ Regexes for git grep:
  - ``\<cpu_ld[us]\?[bwlq]\(_[bl]e\)\?_data\>``
  - ``\<cpu_st[bwlq]\(_[bl]e\)\?_data\+\>``
 
-``cpu_ld*_code``
-~~~~~~~~~~~~~~~~
+``cpu_ld*_code_mmu``
+~~~~~~~~~~~~~~~~~~~~
 
-These functions perform a read for instruction execution.  The ``mmuidx``
-parameter is taken from the current mode of the guest CPU, as determined
-by ``cpu_mmu_index(env, true)``.  The ``retaddr`` parameter is 0, and
-thus does not unwind guest CPU state, because CPU state is always
-synchronized while translating instructions.  Any guest CPU exception
-that is raised will indicate an instruction execution fault rather than
-a data read fault.
+These functions work like the ``cpu_{ld,st}*_mmu`` functions
+except that they perform a read for instruction execution.
+Any guest CPU exception that is raised will indicate an instruction
+execution fault rather than a data read fault.
 
 In general these functions should not be used directly during translation.
 There are wrapper functions that are to be used which also take care of
@@ -252,7 +249,7 @@ plugins for tracing.
 
 Function names follow the pattern:
 
-load: ``cpu_ld{sign}{size}_code(env, ptr)``
+load: ``cpu_ld{sign}{size}_code_mmu(env, addr, oi, retaddr)``
 
 ``sign``
  - (empty) : for 32 or 64 bit sizes
@@ -266,12 +263,12 @@ load: ``cpu_ld{sign}{size}_code(env, ptr)``
  - ``q`` : 64 bits
 
 Regexes for git grep:
- - ``\<cpu_ld[us]\?[bwlq]_code\>``
+ - ``\<cpu_ld[us]\?[bwlq]_code_mmu\>``
 
 ``translator_ld*``
 ~~~~~~~~~~~~~~~~~~
 
-These functions are a wrapper for ``cpu_ld*_code`` which also perform
+These functions are a wrapper for ``cpu_ld*_code_mmu`` which also perform
 any actions required by any tracing plugins.  They are only to be
 called during the translator callback ``translate_insn``.
 
diff --git a/include/accel/tcg/cpu-ldst.h b/include/accel/tcg/cpu-ldst.h
index ea2cbf40fe4..1facabccb23 100644
--- a/include/accel/tcg/cpu-ldst.h
+++ b/include/accel/tcg/cpu-ldst.h
@@ -51,10 +51,9 @@
  *     _be: for forced big endian
  *     _le: for forced little endian
  *
- * mmusuffix is one of the generic suffixes "data" or "code", or "mmuidx".
+ * mmusuffix is one of the generic suffixes "data" or "mmuidx".
  * The "mmuidx" suffix carries an extra mmu_idx argument that specifies
- * the index to use; the "data" and "code" suffixes take the index from
- * cpu_mmu_index().
+ * the index to use; the "data" suffix take the index from cpu_mmu_index().
  *
  * The "mmu" suffix carries the full MemOpIdx, with both mmu_idx and the
  * MemOp including alignment requirements.  The alignment will be enforced.
@@ -470,34 +469,6 @@ cpu_stq_le_data(CPUArchState *env, abi_ptr addr, uint64_t val)
 # define cpu_stl_mmuidx_ra    cpu_stl_le_mmuidx_ra
 # define cpu_stq_mmuidx_ra    cpu_stq_le_mmuidx_ra
 #endif
-
-static inline uint32_t cpu_ldub_code(CPUArchState *env, abi_ptr addr)
-{
-    CPUState *cs = env_cpu(env);
-    MemOpIdx oi = make_memop_idx(MO_UB, cpu_mmu_index(cs, true));
-    return cpu_ldb_code_mmu(env, addr, oi, 0);
-}
-
-static inline uint32_t cpu_lduw_code(CPUArchState *env, abi_ptr addr)
-{
-    CPUState *cs = env_cpu(env);
-    MemOpIdx oi = make_memop_idx(MO_TEUW, cpu_mmu_index(cs, true));
-    return cpu_ldw_code_mmu(env, addr, oi, 0);
-}
-
-static inline uint32_t cpu_ldl_code(CPUArchState *env, abi_ptr addr)
-{
-    CPUState *cs = env_cpu(env);
-    MemOpIdx oi = make_memop_idx(MO_TEUL, cpu_mmu_index(cs, true));
-    return cpu_ldl_code_mmu(env, addr, oi, 0);
-}
-
-static inline uint64_t cpu_ldq_code(CPUArchState *env, abi_ptr addr)
-{
-    CPUState *cs = env_cpu(env);
-    MemOpIdx oi = make_memop_idx(MO_TEUQ, cpu_mmu_index(cs, true));
-    return cpu_ldq_code_mmu(env, addr, oi, 0);
-}
 #endif /* TARGET_NOT_USING_LEGACY_NATIVE_ENDIAN_API */
 
 #endif /* ACCEL_TCG_CPU_LDST_H */
-- 
2.53.0

[PULL 071/110] target/mips: Expand TCGv type as 32-bit for XBurst MXU

[Philippe Mathieu-Daudé]

The MXU extension is only built as 32-bit, so TCGv expands
to TCGv_i32. Use the latter which is more explicit.

In gen_mxu_s32madd_sub() directly expand:

 - tcg_gen_ext[u]_tl_i64 -> tcg_gen_ext[u]_i32_i64
 - tcg_gen_concat_tl_i64 -> tcg_gen_concat_i32_i64

the rest being mechanical changes.

Cc: Siarhei Volkau <lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260401144503.80510-2-philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 1954 +++++++++++++++----------------
 1 file changed, 977 insertions(+), 977 deletions(-)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index 35ebb0397da..7961b073144 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -606,8 +606,8 @@ enum {
 #define MXU_OPTN3_PTN7  7
 
 /* MXU registers */
-static TCGv mxu_gpr[NUMBER_OF_MXU_REGISTERS - 1];
-static TCGv mxu_CR;
+static TCGv_i32 mxu_gpr[NUMBER_OF_MXU_REGISTERS - 1];
+static TCGv_i32 mxu_CR;
 
 static const char mxuregnames[NUMBER_OF_MXU_REGISTERS][4] = {
     "XR1",  "XR2",  "XR3",  "XR4",  "XR5",  "XR6",  "XR7",  "XR8",
@@ -628,42 +628,42 @@ void mxu_translate_init(void)
 }
 
 /* MXU General purpose registers moves. */
-static inline void gen_load_mxu_gpr(TCGv t, unsigned int reg)
+static inline void gen_load_mxu_gpr(TCGv_i32 t, unsigned int reg)
 {
     if (reg == 0) {
-        tcg_gen_movi_tl(t, 0);
+        tcg_gen_movi_i32(t, 0);
     } else if (reg <= 15) {
-        tcg_gen_mov_tl(t, mxu_gpr[reg - 1]);
+        tcg_gen_mov_i32(t, mxu_gpr[reg - 1]);
     }
 }
 
-static inline void gen_store_mxu_gpr(TCGv t, unsigned int reg)
+static inline void gen_store_mxu_gpr(TCGv_i32 t, unsigned int reg)
 {
     if (reg > 0 && reg <= 15) {
-        tcg_gen_mov_tl(mxu_gpr[reg - 1], t);
+        tcg_gen_mov_i32(mxu_gpr[reg - 1], t);
     }
 }
 
-static inline void gen_extract_mxu_gpr(TCGv t, unsigned int reg,
+static inline void gen_extract_mxu_gpr(TCGv_i32 t, unsigned int reg,
                                        unsigned int ofs, unsigned int len)
 {
     if (reg == 0) {
-        tcg_gen_movi_tl(t, 0);
+        tcg_gen_movi_i32(t, 0);
     } else if (reg <= 15) {
-        tcg_gen_extract_tl(t, mxu_gpr[reg - 1], ofs, len);
+        tcg_gen_extract_i32(t, mxu_gpr[reg - 1], ofs, len);
     }
 }
 
 /* MXU control register moves. */
-static inline void gen_load_mxu_cr(TCGv t)
+static inline void gen_load_mxu_cr(TCGv_i32 t)
 {
-    tcg_gen_mov_tl(t, mxu_CR);
+    tcg_gen_mov_i32(t, mxu_CR);
 }
 
-static inline void gen_store_mxu_cr(TCGv t)
+static inline void gen_store_mxu_cr(TCGv_i32 t)
 {
     /* TODO: Add handling of RW rules for MXU_CR. */
-    tcg_gen_mov_tl(mxu_CR, t);
+    tcg_gen_mov_i32(mxu_CR, t);
 }
 
 /*
@@ -671,10 +671,10 @@ static inline void gen_store_mxu_cr(TCGv t)
  */
 static void gen_mxu_s32i2m(DisasContext *ctx)
 {
-    TCGv t0;
+    TCGv_i32 t0;
     uint32_t XRa, Rb;
 
-    t0 = tcg_temp_new();
+    t0 = tcg_temp_new_i32();
 
     XRa = extract32(ctx->opcode, 6, 5);
     Rb = extract32(ctx->opcode, 16, 5);
@@ -692,10 +692,10 @@ static void gen_mxu_s32i2m(DisasContext *ctx)
  */
 static void gen_mxu_s32m2i(DisasContext *ctx)
 {
-    TCGv t0;
+    TCGv_i32 t0;
     uint32_t XRa, Rb;
 
-    t0 = tcg_temp_new();
+    t0 = tcg_temp_new_i32();
 
     XRa = extract32(ctx->opcode, 6, 5);
     Rb = extract32(ctx->opcode, 16, 5);
@@ -717,11 +717,11 @@ static void gen_mxu_s32m2i(DisasContext *ctx)
  */
 static void gen_mxu_s8ldd(DisasContext *ctx, bool postmodify)
 {
-    TCGv t0, t1;
+    TCGv_i32 t0, t1;
     uint32_t XRa, Rb, s8, optn3;
 
-    t0 = tcg_temp_new();
-    t1 = tcg_temp_new();
+    t0 = tcg_temp_new_i32();
+    t1 = tcg_temp_new_i32();
 
     XRa = extract32(ctx->opcode, 6, 4);
     s8 = extract32(ctx->opcode, 10, 8);
@@ -729,7 +729,7 @@ static void gen_mxu_s8ldd(DisasContext *ctx, bool postmodify)
     Rb = extract32(ctx->opcode, 21, 5);
 
     gen_load_gpr(t0, Rb);
-    tcg_gen_addi_tl(t0, t0, (int8_t)s8);
+    tcg_gen_addi_i32(t0, t0, (int8_t)s8);
     if (postmodify) {
         gen_store_gpr(t0, Rb);
     }
@@ -737,52 +737,52 @@ static void gen_mxu_s8ldd(DisasContext *ctx, bool postmodify)
     switch (optn3) {
     /* XRa[7:0] = tmp8 */
     case MXU_OPTN3_PTN0:
-        tcg_gen_qemu_ld_tl(t1, t0, ctx->mem_idx, MO_UB);
+        tcg_gen_qemu_ld_i32(t1, t0, ctx->mem_idx, MO_UB);
         gen_load_mxu_gpr(t0, XRa);
-        tcg_gen_deposit_tl(t0, t0, t1, 0, 8);
+        tcg_gen_deposit_i32(t0, t0, t1, 0, 8);
         break;
     /* XRa[15:8] = tmp8 */
     case MXU_OPTN3_PTN1:
-        tcg_gen_qemu_ld_tl(t1, t0, ctx->mem_idx, MO_UB);
+        tcg_gen_qemu_ld_i32(t1, t0, ctx->mem_idx, MO_UB);
         gen_load_mxu_gpr(t0, XRa);
-        tcg_gen_deposit_tl(t0, t0, t1, 8, 8);
+        tcg_gen_deposit_i32(t0, t0, t1, 8, 8);
         break;
     /* XRa[23:16] = tmp8 */
     case MXU_OPTN3_PTN2:
-        tcg_gen_qemu_ld_tl(t1, t0, ctx->mem_idx, MO_UB);
+        tcg_gen_qemu_ld_i32(t1, t0, ctx->mem_idx, MO_UB);
         gen_load_mxu_gpr(t0, XRa);
-        tcg_gen_deposit_tl(t0, t0, t1, 16, 8);
+        tcg_gen_deposit_i32(t0, t0, t1, 16, 8);
         break;
     /* XRa[31:24] = tmp8 */
     case MXU_OPTN3_PTN3:
-        tcg_gen_qemu_ld_tl(t1, t0, ctx->mem_idx, MO_UB);
+        tcg_gen_qemu_ld_i32(t1, t0, ctx->mem_idx, MO_UB);
         gen_load_mxu_gpr(t0, XRa);
-        tcg_gen_deposit_tl(t0, t0, t1, 24, 8);
+        tcg_gen_deposit_i32(t0, t0, t1, 24, 8);
         break;
     /* XRa = {8'b0, tmp8, 8'b0, tmp8} */
     case MXU_OPTN3_PTN4:
-        tcg_gen_qemu_ld_tl(t1, t0, ctx->mem_idx, MO_UB);
-        tcg_gen_deposit_tl(t0, t1, t1, 16, 16);
+        tcg_gen_qemu_ld_i32(t1, t0, ctx->mem_idx, MO_UB);
+        tcg_gen_deposit_i32(t0, t1, t1, 16, 16);
         break;
     /* XRa = {tmp8, 8'b0, tmp8, 8'b0} */
     case MXU_OPTN3_PTN5:
-        tcg_gen_qemu_ld_tl(t1, t0, ctx->mem_idx, MO_UB);
-        tcg_gen_shli_tl(t1, t1, 8);
-        tcg_gen_deposit_tl(t0, t1, t1, 16, 16);
+        tcg_gen_qemu_ld_i32(t1, t0, ctx->mem_idx, MO_UB);
+        tcg_gen_shli_i32(t1, t1, 8);
+        tcg_gen_deposit_i32(t0, t1, t1, 16, 16);
         break;
     /* XRa = {{8{sign of tmp8}}, tmp8, {8{sign of tmp8}}, tmp8} */
     case MXU_OPTN3_PTN6:
-        tcg_gen_qemu_ld_tl(t1, t0, ctx->mem_idx, MO_SB);
-        tcg_gen_mov_tl(t0, t1);
-        tcg_gen_andi_tl(t0, t0, 0xFF00FFFF);
-        tcg_gen_shli_tl(t1, t1, 16);
-        tcg_gen_or_tl(t0, t0, t1);
+        tcg_gen_qemu_ld_i32(t1, t0, ctx->mem_idx, MO_SB);
+        tcg_gen_mov_i32(t0, t1);
+        tcg_gen_andi_i32(t0, t0, 0xFF00FFFF);
+        tcg_gen_shli_i32(t1, t1, 16);
+        tcg_gen_or_i32(t0, t0, t1);
         break;
     /* XRa = {tmp8, tmp8, tmp8, tmp8} */
     case MXU_OPTN3_PTN7:
-        tcg_gen_qemu_ld_tl(t1, t0, ctx->mem_idx, MO_UB);
-        tcg_gen_deposit_tl(t1, t1, t1, 8, 8);
-        tcg_gen_deposit_tl(t0, t1, t1, 16, 16);
+        tcg_gen_qemu_ld_i32(t1, t0, ctx->mem_idx, MO_UB);
+        tcg_gen_deposit_i32(t1, t1, t1, 8, 8);
+        tcg_gen_deposit_i32(t0, t1, t1, 16, 16);
         break;
     }
 
@@ -797,11 +797,11 @@ static void gen_mxu_s8ldd(DisasContext *ctx, bool postmodify)
  */
 static void gen_mxu_s8std(DisasContext *ctx, bool postmodify)
 {
-    TCGv t0, t1;
+    TCGv_i32 t0, t1;
     uint32_t XRa, Rb, s8, optn3;
 
-    t0 = tcg_temp_new();
-    t1 = tcg_temp_new();
+    t0 = tcg_temp_new_i32();
+    t1 = tcg_temp_new_i32();
 
     XRa = extract32(ctx->opcode, 6, 4);
     s8 = extract32(ctx->opcode, 10, 8);
@@ -814,7 +814,7 @@ static void gen_mxu_s8std(DisasContext *ctx, bool postmodify)
     }
 
     gen_load_gpr(t0, Rb);
-    tcg_gen_addi_tl(t0, t0, (int8_t)s8);
+    tcg_gen_addi_i32(t0, t0, (int8_t)s8);
     if (postmodify) {
         gen_store_gpr(t0, Rb);
     }
@@ -823,23 +823,23 @@ static void gen_mxu_s8std(DisasContext *ctx, bool postmodify)
     switch (optn3) {
     /* XRa[7:0] => tmp8 */
     case MXU_OPTN3_PTN0:
-        tcg_gen_extract_tl(t1, t1, 0, 8);
+        tcg_gen_extract_i32(t1, t1, 0, 8);
         break;
     /* XRa[15:8] => tmp8 */
     case MXU_OPTN3_PTN1:
-        tcg_gen_extract_tl(t1, t1, 8, 8);
+        tcg_gen_extract_i32(t1, t1, 8, 8);
         break;
     /* XRa[23:16] => tmp8 */
     case MXU_OPTN3_PTN2:
-        tcg_gen_extract_tl(t1, t1, 16, 8);
+        tcg_gen_extract_i32(t1, t1, 16, 8);
         break;
     /* XRa[31:24] => tmp8 */
     case MXU_OPTN3_PTN3:
-        tcg_gen_extract_tl(t1, t1, 24, 8);
+        tcg_gen_extract_i32(t1, t1, 24, 8);
         break;
     }
 
-    tcg_gen_qemu_st_tl(t1, t0, ctx->mem_idx, MO_UB);
+    tcg_gen_qemu_st_i32(t1, t0, ctx->mem_idx, MO_UB);
 }
 
 /*
@@ -850,12 +850,12 @@ static void gen_mxu_s8std(DisasContext *ctx, bool postmodify)
  */
 static void gen_mxu_s16ldd(DisasContext *ctx, bool postmodify)
 {
-    TCGv t0, t1;
+    TCGv_i32 t0, t1;
     uint32_t XRa, Rb, optn2;
     int32_t s10;
 
-    t0 = tcg_temp_new();
-    t1 = tcg_temp_new();
+    t0 = tcg_temp_new_i32();
+    t1 = tcg_temp_new_i32();
 
     XRa   = extract32(ctx->opcode,   6, 4);
     s10   = sextract32(ctx->opcode, 10, 9) * 2;
@@ -863,7 +863,7 @@ static void gen_mxu_s16ldd(DisasContext *ctx, bool postmodify)
     Rb    = extract32(ctx->opcode,  21, 5);
 
     gen_load_gpr(t0, Rb);
-    tcg_gen_addi_tl(t0, t0, s10);
+    tcg_gen_addi_i32(t0, t0, s10);
     if (postmodify) {
         gen_store_gpr(t0, Rb);
     }
@@ -871,25 +871,25 @@ static void gen_mxu_s16ldd(DisasContext *ctx, bool postmodify)
     switch (optn2) {
     /* XRa[15:0] = tmp16 */
     case MXU_OPTN2_PTN0:
-        tcg_gen_qemu_ld_tl(t1, t0, ctx->mem_idx, MO_UW);
+        tcg_gen_qemu_ld_i32(t1, t0, ctx->mem_idx, MO_UW);
         gen_load_mxu_gpr(t0, XRa);
-        tcg_gen_deposit_tl(t0, t0, t1, 0, 16);
+        tcg_gen_deposit_i32(t0, t0, t1, 0, 16);
         break;
     /* XRa[31:16] = tmp16 */
     case MXU_OPTN2_PTN1:
-        tcg_gen_qemu_ld_tl(t1, t0, ctx->mem_idx, MO_UW);
+        tcg_gen_qemu_ld_i32(t1, t0, ctx->mem_idx, MO_UW);
         gen_load_mxu_gpr(t0, XRa);
-        tcg_gen_deposit_tl(t0, t0, t1, 16, 16);
+        tcg_gen_deposit_i32(t0, t0, t1, 16, 16);
         break;
     /* XRa = sign_extend(tmp16) */
     case MXU_OPTN2_PTN2:
-        tcg_gen_qemu_ld_tl(t0, t0, ctx->mem_idx, MO_SW);
+        tcg_gen_qemu_ld_i32(t0, t0, ctx->mem_idx, MO_SW);
         break;
     /* XRa = {tmp16, tmp16} */
     case MXU_OPTN2_PTN3:
-        tcg_gen_qemu_ld_tl(t1, t0, ctx->mem_idx, MO_UW);
-        tcg_gen_deposit_tl(t0, t1, t1,  0, 16);
-        tcg_gen_deposit_tl(t0, t1, t1, 16, 16);
+        tcg_gen_qemu_ld_i32(t1, t0, ctx->mem_idx, MO_UW);
+        tcg_gen_deposit_i32(t0, t1, t1,  0, 16);
+        tcg_gen_deposit_i32(t0, t1, t1, 16, 16);
         break;
     }
 
@@ -904,12 +904,12 @@ static void gen_mxu_s16ldd(DisasContext *ctx, bool postmodify)
  */
 static void gen_mxu_s16std(DisasContext *ctx, bool postmodify)
 {
-    TCGv t0, t1;
+    TCGv_i32 t0, t1;
     uint32_t XRa, Rb, optn2;
     int32_t s10;
 
-    t0 = tcg_temp_new();
-    t1 = tcg_temp_new();
+    t0 = tcg_temp_new_i32();
+    t1 = tcg_temp_new_i32();
 
     XRa = extract32(ctx->opcode, 6, 4);
     s10 = sextract32(ctx->opcode, 10, 9) * 2;
@@ -922,7 +922,7 @@ static void gen_mxu_s16std(DisasContext *ctx, bool postmodify)
     }
 
     gen_load_gpr(t0, Rb);
-    tcg_gen_addi_tl(t0, t0, s10);
+    tcg_gen_addi_i32(t0, t0, s10);
     if (postmodify) {
         gen_store_gpr(t0, Rb);
     }
@@ -931,15 +931,15 @@ static void gen_mxu_s16std(DisasContext *ctx, bool postmodify)
     switch (optn2) {
     /* XRa[15:0] => tmp16 */
     case MXU_OPTN2_PTN0:
-        tcg_gen_extract_tl(t1, t1, 0, 16);
+        tcg_gen_extract_i32(t1, t1, 0, 16);
         break;
     /* XRa[31:16] => tmp16 */
     case MXU_OPTN2_PTN1:
-        tcg_gen_extract_tl(t1, t1, 16, 16);
+        tcg_gen_extract_i32(t1, t1, 16, 16);
         break;
     }
 
-    tcg_gen_qemu_st_tl(t1, t0, ctx->mem_idx, MO_UW);
+    tcg_gen_qemu_st_i32(t1, t0, ctx->mem_idx, MO_UW);
 }
 
 /*
@@ -953,11 +953,11 @@ static void gen_mxu_s16std(DisasContext *ctx, bool postmodify)
  */
 static void gen_mxu_s32mul(DisasContext *ctx, bool mulu)
 {
-    TCGv t0, t1;
+    TCGv_i32 t0, t1;
     uint32_t XRa, XRd, rs, rt;
 
-    t0 = tcg_temp_new();
-    t1 = tcg_temp_new();
+    t0 = tcg_temp_new_i32();
+    t1 = tcg_temp_new_i32();
 
     XRa = extract32(ctx->opcode,  6, 4);
     XRd = extract32(ctx->opcode, 10, 4);
@@ -965,20 +965,20 @@ static void gen_mxu_s32mul(DisasContext *ctx, bool mulu)
     rt  = extract32(ctx->opcode, 21, 5);
 
     if (unlikely(rs == 0 || rt == 0)) {
-        tcg_gen_movi_tl(t0, 0);
-        tcg_gen_movi_tl(t1, 0);
+        tcg_gen_movi_i32(t0, 0);
+        tcg_gen_movi_i32(t1, 0);
     } else {
         gen_load_gpr(t0, rs);
         gen_load_gpr(t1, rt);
 
         if (mulu) {
-            tcg_gen_mulu2_tl(t0, t1, t0, t1);
+            tcg_gen_mulu2_i32(t0, t1, t0, t1);
         } else {
-            tcg_gen_muls2_tl(t0, t1, t0, t1);
+            tcg_gen_muls2_i32(t0, t1, t0, t1);
         }
     }
-    tcg_gen_mov_tl(cpu_HI[0], t1);
-    tcg_gen_mov_tl(cpu_LO[0], t0);
+    tcg_gen_mov_i32(cpu_HI[0], t1);
+    tcg_gen_mov_i32(cpu_LO[0], t0);
     gen_store_mxu_gpr(t1, XRa);
     gen_store_mxu_gpr(t0, XRd);
 }
@@ -993,13 +993,13 @@ static void gen_mxu_s32mul(DisasContext *ctx, bool mulu)
 static void gen_mxu_d16mul(DisasContext *ctx, bool fractional,
                            bool packed_result)
 {
-    TCGv t0, t1, t2, t3;
+    TCGv_i32 t0, t1, t2, t3;
     uint32_t XRa, XRb, XRc, XRd, optn2;
 
-    t0 = tcg_temp_new();
-    t1 = tcg_temp_new();
-    t2 = tcg_temp_new();
-    t3 = tcg_temp_new();
+    t0 = tcg_temp_new_i32();
+    t1 = tcg_temp_new_i32();
+    t2 = tcg_temp_new_i32();
+    t3 = tcg_temp_new_i32();
 
     XRa = extract32(ctx->opcode, 6, 4);
     XRb = extract32(ctx->opcode, 10, 4);
@@ -1014,64 +1014,64 @@ static void gen_mxu_d16mul(DisasContext *ctx, bool fractional,
      */
 
     gen_load_mxu_gpr(t1, XRb);
-    tcg_gen_sextract_tl(t0, t1, 0, 16);
-    tcg_gen_sextract_tl(t1, t1, 16, 16);
+    tcg_gen_sextract_i32(t0, t1, 0, 16);
+    tcg_gen_sextract_i32(t1, t1, 16, 16);
     gen_load_mxu_gpr(t3, XRc);
-    tcg_gen_sextract_tl(t2, t3, 0, 16);
-    tcg_gen_sextract_tl(t3, t3, 16, 16);
+    tcg_gen_sextract_i32(t2, t3, 0, 16);
+    tcg_gen_sextract_i32(t3, t3, 16, 16);
 
     switch (optn2) {
     case MXU_OPTN2_WW: /* XRB.H*XRC.H == lop, XRB.L*XRC.L == rop */
-        tcg_gen_mul_tl(t3, t1, t3);
-        tcg_gen_mul_tl(t2, t0, t2);
+        tcg_gen_mul_i32(t3, t1, t3);
+        tcg_gen_mul_i32(t2, t0, t2);
         break;
     case MXU_OPTN2_LW: /* XRB.L*XRC.H == lop, XRB.L*XRC.L == rop */
-        tcg_gen_mul_tl(t3, t0, t3);
-        tcg_gen_mul_tl(t2, t0, t2);
+        tcg_gen_mul_i32(t3, t0, t3);
+        tcg_gen_mul_i32(t2, t0, t2);
         break;
     case MXU_OPTN2_HW: /* XRB.H*XRC.H == lop, XRB.H*XRC.L == rop */
-        tcg_gen_mul_tl(t3, t1, t3);
-        tcg_gen_mul_tl(t2, t1, t2);
+        tcg_gen_mul_i32(t3, t1, t3);
+        tcg_gen_mul_i32(t2, t1, t2);
         break;
     case MXU_OPTN2_XW: /* XRB.L*XRC.H == lop, XRB.H*XRC.L == rop */
-        tcg_gen_mul_tl(t3, t0, t3);
-        tcg_gen_mul_tl(t2, t1, t2);
+        tcg_gen_mul_i32(t3, t0, t3);
+        tcg_gen_mul_i32(t2, t1, t2);
         break;
     }
     if (fractional) {
         TCGLabel *l_done = gen_new_label();
-        TCGv rounding = tcg_temp_new();
+        TCGv_i32 rounding = tcg_temp_new_i32();
 
-        tcg_gen_shli_tl(t3, t3, 1);
-        tcg_gen_shli_tl(t2, t2, 1);
-        tcg_gen_andi_tl(rounding, mxu_CR, 0x2);
-        tcg_gen_brcondi_tl(TCG_COND_EQ, rounding, 0, l_done);
+        tcg_gen_shli_i32(t3, t3, 1);
+        tcg_gen_shli_i32(t2, t2, 1);
+        tcg_gen_andi_i32(rounding, mxu_CR, 0x2);
+        tcg_gen_brcondi_i32(TCG_COND_EQ, rounding, 0, l_done);
         if (packed_result) {
             TCGLabel *l_apply_bias_l = gen_new_label();
             TCGLabel *l_apply_bias_r = gen_new_label();
             TCGLabel *l_half_done = gen_new_label();
-            TCGv bias = tcg_temp_new();
+            TCGv_i32 bias = tcg_temp_new_i32();
 
             /*
              * D16MULF supports unbiased rounding aka "bankers rounding",
              * "round to even", "convergent rounding"
              */
-            tcg_gen_andi_tl(bias, mxu_CR, 0x4);
-            tcg_gen_brcondi_tl(TCG_COND_NE, bias, 0, l_apply_bias_l);
-            tcg_gen_andi_tl(t0, t3, 0x1ffff);
-            tcg_gen_brcondi_tl(TCG_COND_EQ, t0, 0x8000, l_half_done);
+            tcg_gen_andi_i32(bias, mxu_CR, 0x4);
+            tcg_gen_brcondi_i32(TCG_COND_NE, bias, 0, l_apply_bias_l);
+            tcg_gen_andi_i32(t0, t3, 0x1ffff);
+            tcg_gen_brcondi_i32(TCG_COND_EQ, t0, 0x8000, l_half_done);
             gen_set_label(l_apply_bias_l);
-            tcg_gen_addi_tl(t3, t3, 0x8000);
+            tcg_gen_addi_i32(t3, t3, 0x8000);
             gen_set_label(l_half_done);
-            tcg_gen_brcondi_tl(TCG_COND_NE, bias, 0, l_apply_bias_r);
-            tcg_gen_andi_tl(t0, t2, 0x1ffff);
-            tcg_gen_brcondi_tl(TCG_COND_EQ, t0, 0x8000, l_done);
+            tcg_gen_brcondi_i32(TCG_COND_NE, bias, 0, l_apply_bias_r);
+            tcg_gen_andi_i32(t0, t2, 0x1ffff);
+            tcg_gen_brcondi_i32(TCG_COND_EQ, t0, 0x8000, l_done);
             gen_set_label(l_apply_bias_r);
-            tcg_gen_addi_tl(t2, t2, 0x8000);
+            tcg_gen_addi_i32(t2, t2, 0x8000);
         } else {
             /* D16MULE doesn't support unbiased rounding */
-            tcg_gen_addi_tl(t3, t3, 0x8000);
-            tcg_gen_addi_tl(t2, t2, 0x8000);
+            tcg_gen_addi_i32(t3, t3, 0x8000);
+            tcg_gen_addi_i32(t2, t2, 0x8000);
         }
         gen_set_label(l_done);
     }
@@ -1079,9 +1079,9 @@ static void gen_mxu_d16mul(DisasContext *ctx, bool fractional,
         gen_store_mxu_gpr(t3, XRa);
         gen_store_mxu_gpr(t2, XRd);
     } else {
-        tcg_gen_andi_tl(t3, t3, 0xffff0000);
-        tcg_gen_shri_tl(t2, t2, 16);
-        tcg_gen_or_tl(t3, t3, t2);
+        tcg_gen_andi_i32(t3, t3, 0xffff0000);
+        tcg_gen_shri_i32(t2, t2, 16);
+        tcg_gen_or_i32(t3, t3, t2);
         gen_store_mxu_gpr(t3, XRa);
     }
 }
@@ -1097,13 +1097,13 @@ static void gen_mxu_d16mul(DisasContext *ctx, bool fractional,
 static void gen_mxu_d16mac(DisasContext *ctx, bool fractional,
                            bool packed_result)
 {
-    TCGv t0, t1, t2, t3;
+    TCGv_i32 t0, t1, t2, t3;
     uint32_t XRa, XRb, XRc, XRd, optn2, aptn2;
 
-    t0 = tcg_temp_new();
-    t1 = tcg_temp_new();
-    t2 = tcg_temp_new();
-    t3 = tcg_temp_new();
+    t0 = tcg_temp_new_i32();
+    t1 = tcg_temp_new_i32();
+    t2 = tcg_temp_new_i32();
+    t3 = tcg_temp_new_i32();
 
     XRa = extract32(ctx->opcode, 6, 4);
     XRb = extract32(ctx->opcode, 10, 4);
@@ -1113,90 +1113,90 @@ static void gen_mxu_d16mac(DisasContext *ctx, bool fractional,
     aptn2 = extract32(ctx->opcode, 24, 2);
 
     gen_load_mxu_gpr(t1, XRb);
-    tcg_gen_sextract_tl(t0, t1, 0, 16);
-    tcg_gen_sextract_tl(t1, t1, 16, 16);
+    tcg_gen_sextract_i32(t0, t1, 0, 16);
+    tcg_gen_sextract_i32(t1, t1, 16, 16);
 
     gen_load_mxu_gpr(t3, XRc);
-    tcg_gen_sextract_tl(t2, t3, 0, 16);
-    tcg_gen_sextract_tl(t3, t3, 16, 16);
+    tcg_gen_sextract_i32(t2, t3, 0, 16);
+    tcg_gen_sextract_i32(t3, t3, 16, 16);
 
     switch (optn2) {
     case MXU_OPTN2_WW: /* XRB.H*XRC.H == lop, XRB.L*XRC.L == rop */
-        tcg_gen_mul_tl(t3, t1, t3);
-        tcg_gen_mul_tl(t2, t0, t2);
+        tcg_gen_mul_i32(t3, t1, t3);
+        tcg_gen_mul_i32(t2, t0, t2);
         break;
     case MXU_OPTN2_LW: /* XRB.L*XRC.H == lop, XRB.L*XRC.L == rop */
-        tcg_gen_mul_tl(t3, t0, t3);
-        tcg_gen_mul_tl(t2, t0, t2);
+        tcg_gen_mul_i32(t3, t0, t3);
+        tcg_gen_mul_i32(t2, t0, t2);
         break;
     case MXU_OPTN2_HW: /* XRB.H*XRC.H == lop, XRB.H*XRC.L == rop */
-        tcg_gen_mul_tl(t3, t1, t3);
-        tcg_gen_mul_tl(t2, t1, t2);
+        tcg_gen_mul_i32(t3, t1, t3);
+        tcg_gen_mul_i32(t2, t1, t2);
         break;
     case MXU_OPTN2_XW: /* XRB.L*XRC.H == lop, XRB.H*XRC.L == rop */
-        tcg_gen_mul_tl(t3, t0, t3);
-        tcg_gen_mul_tl(t2, t1, t2);
+        tcg_gen_mul_i32(t3, t0, t3);
+        tcg_gen_mul_i32(t2, t1, t2);
         break;
     }
 
     if (fractional) {
-        tcg_gen_shli_tl(t3, t3, 1);
-        tcg_gen_shli_tl(t2, t2, 1);
+        tcg_gen_shli_i32(t3, t3, 1);
+        tcg_gen_shli_i32(t2, t2, 1);
     }
     gen_load_mxu_gpr(t0, XRa);
     gen_load_mxu_gpr(t1, XRd);
 
     switch (aptn2) {
     case MXU_APTN2_AA:
-        tcg_gen_add_tl(t3, t0, t3);
-        tcg_gen_add_tl(t2, t1, t2);
+        tcg_gen_add_i32(t3, t0, t3);
+        tcg_gen_add_i32(t2, t1, t2);
         break;
     case MXU_APTN2_AS:
-        tcg_gen_add_tl(t3, t0, t3);
-        tcg_gen_sub_tl(t2, t1, t2);
+        tcg_gen_add_i32(t3, t0, t3);
+        tcg_gen_sub_i32(t2, t1, t2);
         break;
     case MXU_APTN2_SA:
-        tcg_gen_sub_tl(t3, t0, t3);
-        tcg_gen_add_tl(t2, t1, t2);
+        tcg_gen_sub_i32(t3, t0, t3);
+        tcg_gen_add_i32(t2, t1, t2);
         break;
     case MXU_APTN2_SS:
-        tcg_gen_sub_tl(t3, t0, t3);
-        tcg_gen_sub_tl(t2, t1, t2);
+        tcg_gen_sub_i32(t3, t0, t3);
+        tcg_gen_sub_i32(t2, t1, t2);
         break;
     }
 
     if (fractional) {
         TCGLabel *l_done = gen_new_label();
-        TCGv rounding = tcg_temp_new();
+        TCGv_i32 rounding = tcg_temp_new_i32();
 
-        tcg_gen_andi_tl(rounding, mxu_CR, 0x2);
-        tcg_gen_brcondi_tl(TCG_COND_EQ, rounding, 0, l_done);
+        tcg_gen_andi_i32(rounding, mxu_CR, 0x2);
+        tcg_gen_brcondi_i32(TCG_COND_EQ, rounding, 0, l_done);
         if (packed_result) {
             TCGLabel *l_apply_bias_l = gen_new_label();
             TCGLabel *l_apply_bias_r = gen_new_label();
             TCGLabel *l_half_done = gen_new_label();
-            TCGv bias = tcg_temp_new();
+            TCGv_i32 bias = tcg_temp_new_i32();
 
             /*
              * D16MACF supports unbiased rounding aka "bankers rounding",
              * "round to even", "convergent rounding"
              */
-            tcg_gen_andi_tl(bias, mxu_CR, 0x4);
-            tcg_gen_brcondi_tl(TCG_COND_NE, bias, 0, l_apply_bias_l);
-            tcg_gen_andi_tl(t0, t3, 0x1ffff);
-            tcg_gen_brcondi_tl(TCG_COND_EQ, t0, 0x8000, l_half_done);
+            tcg_gen_andi_i32(bias, mxu_CR, 0x4);
+            tcg_gen_brcondi_i32(TCG_COND_NE, bias, 0, l_apply_bias_l);
+            tcg_gen_andi_i32(t0, t3, 0x1ffff);
+            tcg_gen_brcondi_i32(TCG_COND_EQ, t0, 0x8000, l_half_done);
             gen_set_label(l_apply_bias_l);
-            tcg_gen_addi_tl(t3, t3, 0x8000);
+            tcg_gen_addi_i32(t3, t3, 0x8000);
             gen_set_label(l_half_done);
-            tcg_gen_brcondi_tl(TCG_COND_NE, bias, 0, l_apply_bias_r);
-            tcg_gen_andi_tl(t0, t2, 0x1ffff);
-            tcg_gen_brcondi_tl(TCG_COND_EQ, t0, 0x8000, l_done);
+            tcg_gen_brcondi_i32(TCG_COND_NE, bias, 0, l_apply_bias_r);
+            tcg_gen_andi_i32(t0, t2, 0x1ffff);
+            tcg_gen_brcondi_i32(TCG_COND_EQ, t0, 0x8000, l_done);
             gen_set_label(l_apply_bias_r);
-            tcg_gen_addi_tl(t2, t2, 0x8000);
+            tcg_gen_addi_i32(t2, t2, 0x8000);
         } else {
             /* D16MACE doesn't support unbiased rounding */
-            tcg_gen_addi_tl(t3, t3, 0x8000);
-            tcg_gen_addi_tl(t2, t2, 0x8000);
+            tcg_gen_addi_i32(t3, t3, 0x8000);
+            tcg_gen_addi_i32(t2, t2, 0x8000);
         }
         gen_set_label(l_done);
     }
@@ -1205,9 +1205,9 @@ static void gen_mxu_d16mac(DisasContext *ctx, bool fractional,
         gen_store_mxu_gpr(t3, XRa);
         gen_store_mxu_gpr(t2, XRd);
     } else {
-        tcg_gen_andi_tl(t3, t3, 0xffff0000);
-        tcg_gen_shri_tl(t2, t2, 16);
-        tcg_gen_or_tl(t3, t3, t2);
+        tcg_gen_andi_i32(t3, t3, 0xffff0000);
+        tcg_gen_shri_i32(t2, t2, 16);
+        tcg_gen_or_i32(t3, t3, t2);
         gen_store_mxu_gpr(t3, XRa);
     }
 }
@@ -1218,13 +1218,13 @@ static void gen_mxu_d16mac(DisasContext *ctx, bool fractional,
  */
 static void gen_mxu_d16madl(DisasContext *ctx)
 {
-    TCGv t0, t1, t2, t3;
+    TCGv_i32 t0, t1, t2, t3;
     uint32_t XRa, XRb, XRc, XRd, optn2, aptn2;
 
-    t0 = tcg_temp_new();
-    t1 = tcg_temp_new();
-    t2 = tcg_temp_new();
-    t3 = tcg_temp_new();
+    t0 = tcg_temp_new_i32();
+    t1 = tcg_temp_new_i32();
+    t2 = tcg_temp_new_i32();
+    t3 = tcg_temp_new_i32();
 
     XRa = extract32(ctx->opcode, 6, 4);
     XRb = extract32(ctx->opcode, 10, 4);
@@ -1234,60 +1234,60 @@ static void gen_mxu_d16madl(DisasContext *ctx)
     aptn2 = extract32(ctx->opcode, 24, 2);
 
     gen_load_mxu_gpr(t1, XRb);
-    tcg_gen_sextract_tl(t0, t1,  0, 16);
-    tcg_gen_sextract_tl(t1, t1, 16, 16);
+    tcg_gen_sextract_i32(t0, t1,  0, 16);
+    tcg_gen_sextract_i32(t1, t1, 16, 16);
 
     gen_load_mxu_gpr(t3, XRc);
-    tcg_gen_sextract_tl(t2, t3,  0, 16);
-    tcg_gen_sextract_tl(t3, t3, 16, 16);
+    tcg_gen_sextract_i32(t2, t3,  0, 16);
+    tcg_gen_sextract_i32(t3, t3, 16, 16);
 
     switch (optn2) {
     case MXU_OPTN2_WW: /* XRB.H*XRC.H == lop, XRB.L*XRC.L == rop */
-        tcg_gen_mul_tl(t3, t1, t3);
-        tcg_gen_mul_tl(t2, t0, t2);
+        tcg_gen_mul_i32(t3, t1, t3);
+        tcg_gen_mul_i32(t2, t0, t2);
         break;
     case MXU_OPTN2_LW: /* XRB.L*XRC.H == lop, XRB.L*XRC.L == rop */
-        tcg_gen_mul_tl(t3, t0, t3);
-        tcg_gen_mul_tl(t2, t0, t2);
+        tcg_gen_mul_i32(t3, t0, t3);
+        tcg_gen_mul_i32(t2, t0, t2);
         break;
     case MXU_OPTN2_HW: /* XRB.H*XRC.H == lop, XRB.H*XRC.L == rop */
-        tcg_gen_mul_tl(t3, t1, t3);
-        tcg_gen_mul_tl(t2, t1, t2);
+        tcg_gen_mul_i32(t3, t1, t3);
+        tcg_gen_mul_i32(t2, t1, t2);
         break;
     case MXU_OPTN2_XW: /* XRB.L*XRC.H == lop, XRB.H*XRC.L == rop */
-        tcg_gen_mul_tl(t3, t0, t3);
-        tcg_gen_mul_tl(t2, t1, t2);
+        tcg_gen_mul_i32(t3, t0, t3);
+        tcg_gen_mul_i32(t2, t1, t2);
         break;
     }
-    tcg_gen_extract_tl(t2, t2, 0, 16);
-    tcg_gen_extract_tl(t3, t3, 0, 16);
+    tcg_gen_extract_i32(t2, t2, 0, 16);
+    tcg_gen_extract_i32(t3, t3, 0, 16);
 
     gen_load_mxu_gpr(t1, XRa);
-    tcg_gen_extract_tl(t0, t1,  0, 16);
-    tcg_gen_extract_tl(t1, t1, 16, 16);
+    tcg_gen_extract_i32(t0, t1,  0, 16);
+    tcg_gen_extract_i32(t1, t1, 16, 16);
 
     switch (aptn2) {
     case MXU_APTN2_AA:
-        tcg_gen_add_tl(t3, t1, t3);
-        tcg_gen_add_tl(t2, t0, t2);
+        tcg_gen_add_i32(t3, t1, t3);
+        tcg_gen_add_i32(t2, t0, t2);
         break;
     case MXU_APTN2_AS:
-        tcg_gen_add_tl(t3, t1, t3);
-        tcg_gen_sub_tl(t2, t0, t2);
+        tcg_gen_add_i32(t3, t1, t3);
+        tcg_gen_sub_i32(t2, t0, t2);
         break;
     case MXU_APTN2_SA:
-        tcg_gen_sub_tl(t3, t1, t3);
-        tcg_gen_add_tl(t2, t0, t2);
+        tcg_gen_sub_i32(t3, t1, t3);
+        tcg_gen_add_i32(t2, t0, t2);
         break;
     case MXU_APTN2_SS:
-        tcg_gen_sub_tl(t3, t1, t3);
-        tcg_gen_sub_tl(t2, t0, t2);
+        tcg_gen_sub_i32(t3, t1, t3);
+        tcg_gen_sub_i32(t2, t0, t2);
         break;
     }
 
-    tcg_gen_andi_tl(t2, t2, 0xffff);
-    tcg_gen_shli_tl(t3, t3, 16);
-    tcg_gen_or_tl(mxu_gpr[XRd - 1], t3, t2);
+    tcg_gen_andi_i32(t2, t2, 0xffff);
+    tcg_gen_shli_i32(t3, t3, 16);
+    tcg_gen_or_i32(mxu_gpr[XRd - 1], t3, t2);
 }
 
 /*
@@ -1296,11 +1296,11 @@ static void gen_mxu_d16madl(DisasContext *ctx)
  */
 static void gen_mxu_s16mad(DisasContext *ctx)
 {
-    TCGv t0, t1;
+    TCGv_i32 t0, t1;
     uint32_t XRa, XRb, XRc, XRd, optn2, aptn1, pad;
 
-    t0 = tcg_temp_new();
-    t1 = tcg_temp_new();
+    t0 = tcg_temp_new_i32();
+    t1 = tcg_temp_new_i32();
 
     XRa = extract32(ctx->opcode, 6, 4);
     XRb = extract32(ctx->opcode, 10, 4);
@@ -1319,32 +1319,32 @@ static void gen_mxu_s16mad(DisasContext *ctx)
 
     switch (optn2) {
     case MXU_OPTN2_WW: /* XRB.H*XRC.H */
-        tcg_gen_sextract_tl(t0, t0, 16, 16);
-        tcg_gen_sextract_tl(t1, t1, 16, 16);
+        tcg_gen_sextract_i32(t0, t0, 16, 16);
+        tcg_gen_sextract_i32(t1, t1, 16, 16);
         break;
     case MXU_OPTN2_LW: /* XRB.L*XRC.L */
-        tcg_gen_sextract_tl(t0, t0,  0, 16);
-        tcg_gen_sextract_tl(t1, t1,  0, 16);
+        tcg_gen_sextract_i32(t0, t0,  0, 16);
+        tcg_gen_sextract_i32(t1, t1,  0, 16);
         break;
     case MXU_OPTN2_HW: /* XRB.H*XRC.L */
-        tcg_gen_sextract_tl(t0, t0, 16, 16);
-        tcg_gen_sextract_tl(t1, t1,  0, 16);
+        tcg_gen_sextract_i32(t0, t0, 16, 16);
+        tcg_gen_sextract_i32(t1, t1,  0, 16);
         break;
     case MXU_OPTN2_XW: /* XRB.L*XRC.H */
-        tcg_gen_sextract_tl(t0, t0,  0, 16);
-        tcg_gen_sextract_tl(t1, t1, 16, 16);
+        tcg_gen_sextract_i32(t0, t0,  0, 16);
+        tcg_gen_sextract_i32(t1, t1, 16, 16);
         break;
     }
-    tcg_gen_mul_tl(t0, t0, t1);
+    tcg_gen_mul_i32(t0, t0, t1);
 
     gen_load_mxu_gpr(t1, XRa);
 
     switch (aptn1) {
     case MXU_APTN1_A:
-        tcg_gen_add_tl(t1, t1, t0);
+        tcg_gen_add_i32(t1, t1, t0);
         break;
     case MXU_APTN1_S:
-        tcg_gen_sub_tl(t1, t1, t0);
+        tcg_gen_sub_i32(t1, t1, t0);
         break;
     }
 
@@ -1361,17 +1361,17 @@ static void gen_mxu_s16mad(DisasContext *ctx)
  */
 static void gen_mxu_q8mul_mac(DisasContext *ctx, bool su, bool mac)
 {
-    TCGv t0, t1, t2, t3, t4, t5, t6, t7;
+    TCGv_i32 t0, t1, t2, t3, t4, t5, t6, t7;
     uint32_t XRa, XRb, XRc, XRd, aptn2;
 
-    t0 = tcg_temp_new();
-    t1 = tcg_temp_new();
-    t2 = tcg_temp_new();
-    t3 = tcg_temp_new();
-    t4 = tcg_temp_new();
-    t5 = tcg_temp_new();
-    t6 = tcg_temp_new();
-    t7 = tcg_temp_new();
+    t0 = tcg_temp_new_i32();
+    t1 = tcg_temp_new_i32();
+    t2 = tcg_temp_new_i32();
+    t3 = tcg_temp_new_i32();
+    t4 = tcg_temp_new_i32();
+    t5 = tcg_temp_new_i32();
+    t6 = tcg_temp_new_i32();
+    t7 = tcg_temp_new_i32();
 
     XRa = extract32(ctx->opcode, 6, 4);
     XRb = extract32(ctx->opcode, 10, 4);
@@ -1384,53 +1384,53 @@ static void gen_mxu_q8mul_mac(DisasContext *ctx, bool su, bool mac)
 
     if (su) {
         /* Q8MULSU / Q8MACSU */
-        tcg_gen_sextract_tl(t0, t3,  0, 8);
-        tcg_gen_sextract_tl(t1, t3,  8, 8);
-        tcg_gen_sextract_tl(t2, t3, 16, 8);
-        tcg_gen_sextract_tl(t3, t3, 24, 8);
+        tcg_gen_sextract_i32(t0, t3,  0, 8);
+        tcg_gen_sextract_i32(t1, t3,  8, 8);
+        tcg_gen_sextract_i32(t2, t3, 16, 8);
+        tcg_gen_sextract_i32(t3, t3, 24, 8);
     } else {
         /* Q8MUL / Q8MAC */
-        tcg_gen_extract_tl(t0, t3,  0, 8);
-        tcg_gen_extract_tl(t1, t3,  8, 8);
-        tcg_gen_extract_tl(t2, t3, 16, 8);
-        tcg_gen_extract_tl(t3, t3, 24, 8);
+        tcg_gen_extract_i32(t0, t3,  0, 8);
+        tcg_gen_extract_i32(t1, t3,  8, 8);
+        tcg_gen_extract_i32(t2, t3, 16, 8);
+        tcg_gen_extract_i32(t3, t3, 24, 8);
     }
 
-    tcg_gen_extract_tl(t4, t7,  0, 8);
-    tcg_gen_extract_tl(t5, t7,  8, 8);
-    tcg_gen_extract_tl(t6, t7, 16, 8);
-    tcg_gen_extract_tl(t7, t7, 24, 8);
+    tcg_gen_extract_i32(t4, t7,  0, 8);
+    tcg_gen_extract_i32(t5, t7,  8, 8);
+    tcg_gen_extract_i32(t6, t7, 16, 8);
+    tcg_gen_extract_i32(t7, t7, 24, 8);
 
-    tcg_gen_mul_tl(t0, t0, t4);
-    tcg_gen_mul_tl(t1, t1, t5);
-    tcg_gen_mul_tl(t2, t2, t6);
-    tcg_gen_mul_tl(t3, t3, t7);
+    tcg_gen_mul_i32(t0, t0, t4);
+    tcg_gen_mul_i32(t1, t1, t5);
+    tcg_gen_mul_i32(t2, t2, t6);
+    tcg_gen_mul_i32(t3, t3, t7);
 
     if (mac) {
         gen_load_mxu_gpr(t4, XRd);
         gen_load_mxu_gpr(t5, XRa);
-        tcg_gen_extract_tl(t6, t4,  0, 16);
-        tcg_gen_extract_tl(t7, t4, 16, 16);
+        tcg_gen_extract_i32(t6, t4,  0, 16);
+        tcg_gen_extract_i32(t7, t4, 16, 16);
         if (aptn2 & 1) {
-            tcg_gen_sub_tl(t0, t6, t0);
-            tcg_gen_sub_tl(t1, t7, t1);
+            tcg_gen_sub_i32(t0, t6, t0);
+            tcg_gen_sub_i32(t1, t7, t1);
         } else {
-            tcg_gen_add_tl(t0, t6, t0);
-            tcg_gen_add_tl(t1, t7, t1);
+            tcg_gen_add_i32(t0, t6, t0);
+            tcg_gen_add_i32(t1, t7, t1);
         }
-        tcg_gen_extract_tl(t6, t5,  0, 16);
-        tcg_gen_extract_tl(t7, t5, 16, 16);
+        tcg_gen_extract_i32(t6, t5,  0, 16);
+        tcg_gen_extract_i32(t7, t5, 16, 16);
         if (aptn2 & 2) {
-            tcg_gen_sub_tl(t2, t6, t2);
-            tcg_gen_sub_tl(t3, t7, t3);
+            tcg_gen_sub_i32(t2, t6, t2);
+            tcg_gen_sub_i32(t3, t7, t3);
         } else {
-            tcg_gen_add_tl(t2, t6, t2);
-            tcg_gen_add_tl(t3, t7, t3);
+            tcg_gen_add_i32(t2, t6, t2);
+            tcg_gen_add_i32(t3, t7, t3);
         }
     }
 
-    tcg_gen_deposit_tl(t0, t0, t1, 16, 16);
-    tcg_gen_deposit_tl(t1, t2, t3, 16, 16);
+    tcg_gen_deposit_i32(t0, t0, t1, 16, 16);
+    tcg_gen_deposit_i32(t1, t2, t3, 16, 16);
 
     gen_store_mxu_gpr(t0, XRd);
     gen_store_mxu_gpr(t1, XRa);
@@ -1443,17 +1443,17 @@ static void gen_mxu_q8mul_mac(DisasContext *ctx, bool su, bool mac)
  */
 static void gen_mxu_q8madl(DisasContext *ctx)
 {
-    TCGv t0, t1, t2, t3, t4, t5, t6, t7;
+    TCGv_i32 t0, t1, t2, t3, t4, t5, t6, t7;
     uint32_t XRa, XRb, XRc, XRd, aptn2;
 
-    t0 = tcg_temp_new();
-    t1 = tcg_temp_new();
-    t2 = tcg_temp_new();
-    t3 = tcg_temp_new();
-    t4 = tcg_temp_new();
-    t5 = tcg_temp_new();
-    t6 = tcg_temp_new();
-    t7 = tcg_temp_new();
+    t0 = tcg_temp_new_i32();
+    t1 = tcg_temp_new_i32();
+    t2 = tcg_temp_new_i32();
+    t3 = tcg_temp_new_i32();
+    t4 = tcg_temp_new_i32();
+    t5 = tcg_temp_new_i32();
+    t6 = tcg_temp_new_i32();
+    t7 = tcg_temp_new_i32();
 
     XRa = extract32(ctx->opcode, 6, 4);
     XRb = extract32(ctx->opcode, 10, 4);
@@ -1464,45 +1464,45 @@ static void gen_mxu_q8madl(DisasContext *ctx)
     gen_load_mxu_gpr(t3, XRb);
     gen_load_mxu_gpr(t7, XRc);
 
-    tcg_gen_extract_tl(t0, t3,  0, 8);
-    tcg_gen_extract_tl(t1, t3,  8, 8);
-    tcg_gen_extract_tl(t2, t3, 16, 8);
-    tcg_gen_extract_tl(t3, t3, 24, 8);
+    tcg_gen_extract_i32(t0, t3,  0, 8);
+    tcg_gen_extract_i32(t1, t3,  8, 8);
+    tcg_gen_extract_i32(t2, t3, 16, 8);
+    tcg_gen_extract_i32(t3, t3, 24, 8);
 
-    tcg_gen_extract_tl(t4, t7,  0, 8);
-    tcg_gen_extract_tl(t5, t7,  8, 8);
-    tcg_gen_extract_tl(t6, t7, 16, 8);
-    tcg_gen_extract_tl(t7, t7, 24, 8);
+    tcg_gen_extract_i32(t4, t7,  0, 8);
+    tcg_gen_extract_i32(t5, t7,  8, 8);
+    tcg_gen_extract_i32(t6, t7, 16, 8);
+    tcg_gen_extract_i32(t7, t7, 24, 8);
 
-    tcg_gen_mul_tl(t0, t0, t4);
-    tcg_gen_mul_tl(t1, t1, t5);
-    tcg_gen_mul_tl(t2, t2, t6);
-    tcg_gen_mul_tl(t3, t3, t7);
+    tcg_gen_mul_i32(t0, t0, t4);
+    tcg_gen_mul_i32(t1, t1, t5);
+    tcg_gen_mul_i32(t2, t2, t6);
+    tcg_gen_mul_i32(t3, t3, t7);
 
     gen_load_mxu_gpr(t4, XRa);
-    tcg_gen_extract_tl(t6, t4, 0, 8);
-    tcg_gen_extract_tl(t7, t4, 8, 8);
+    tcg_gen_extract_i32(t6, t4, 0, 8);
+    tcg_gen_extract_i32(t7, t4, 8, 8);
     if (aptn2 & 1) {
-        tcg_gen_sub_tl(t0, t6, t0);
-        tcg_gen_sub_tl(t1, t7, t1);
+        tcg_gen_sub_i32(t0, t6, t0);
+        tcg_gen_sub_i32(t1, t7, t1);
     } else {
-        tcg_gen_add_tl(t0, t6, t0);
-        tcg_gen_add_tl(t1, t7, t1);
+        tcg_gen_add_i32(t0, t6, t0);
+        tcg_gen_add_i32(t1, t7, t1);
     }
-    tcg_gen_extract_tl(t6, t4, 16, 8);
-    tcg_gen_extract_tl(t7, t4, 24, 8);
+    tcg_gen_extract_i32(t6, t4, 16, 8);
+    tcg_gen_extract_i32(t7, t4, 24, 8);
     if (aptn2 & 2) {
-        tcg_gen_sub_tl(t2, t6, t2);
-        tcg_gen_sub_tl(t3, t7, t3);
+        tcg_gen_sub_i32(t2, t6, t2);
+        tcg_gen_sub_i32(t3, t7, t3);
     } else {
-        tcg_gen_add_tl(t2, t6, t2);
-        tcg_gen_add_tl(t3, t7, t3);
+        tcg_gen_add_i32(t2, t6, t2);
+        tcg_gen_add_i32(t3, t7, t3);
     }
 
-    tcg_gen_andi_tl(t5, t0, 0xff);
-    tcg_gen_deposit_tl(t5, t5, t1,  8, 8);
-    tcg_gen_deposit_tl(t5, t5, t2, 16, 8);
-    tcg_gen_deposit_tl(t5, t5, t3, 24, 8);
+    tcg_gen_andi_i32(t5, t0, 0xff);
+    tcg_gen_deposit_i32(t5, t5, t1,  8, 8);
+    tcg_gen_deposit_i32(t5, t5, t2, 16, 8);
+    tcg_gen_deposit_i32(t5, t5, t3, 24, 8);
 
     gen_store_mxu_gpr(t5, XRd);
 }
@@ -1518,21 +1518,21 @@ static void gen_mxu_q8madl(DisasContext *ctx)
  */
 static void gen_mxu_s32ldxx(DisasContext *ctx, bool reversed, bool postinc)
 {
-    TCGv t0, t1;
+    TCGv_i32 t0, t1;
     uint32_t XRa, Rb, s12;
 
-    t0 = tcg_temp_new();
-    t1 = tcg_temp_new();
+    t0 = tcg_temp_new_i32();
+    t1 = tcg_temp_new_i32();
 
     XRa = extract32(ctx->opcode, 6, 4);
     s12 = sextract32(ctx->opcode, 10, 10);
     Rb = extract32(ctx->opcode, 21, 5);
 
     gen_load_gpr(t0, Rb);
-    tcg_gen_movi_tl(t1, s12 * 4);
-    tcg_gen_add_tl(t0, t0, t1);
+    tcg_gen_movi_i32(t1, s12 * 4);
+    tcg_gen_add_i32(t0, t0, t1);
 
-    tcg_gen_qemu_ld_tl(t1, t0, ctx->mem_idx,
+    tcg_gen_qemu_ld_i32(t1, t0, ctx->mem_idx,
                        MO_SL | mo_endian_rev(ctx, reversed) |
                         ctx->default_tcg_memop_mask);
     gen_store_mxu_gpr(t1, XRa);
@@ -1553,22 +1553,22 @@ static void gen_mxu_s32ldxx(DisasContext *ctx, bool reversed, bool postinc)
  */
 static void gen_mxu_s32stxx(DisasContext *ctx, bool reversed, bool postinc)
 {
-    TCGv t0, t1;
+    TCGv_i32 t0, t1;
     uint32_t XRa, Rb, s12;
 
-    t0 = tcg_temp_new();
-    t1 = tcg_temp_new();
+    t0 = tcg_temp_new_i32();
+    t1 = tcg_temp_new_i32();
 
     XRa = extract32(ctx->opcode, 6, 4);
     s12 = sextract32(ctx->opcode, 10, 10);
     Rb = extract32(ctx->opcode, 21, 5);
 
     gen_load_gpr(t0, Rb);
-    tcg_gen_movi_tl(t1, s12 * 4);
-    tcg_gen_add_tl(t0, t0, t1);
+    tcg_gen_movi_i32(t1, s12 * 4);
+    tcg_gen_add_i32(t0, t0, t1);
 
     gen_load_mxu_gpr(t1, XRa);
-    tcg_gen_qemu_st_tl(t1, t0, ctx->mem_idx,
+    tcg_gen_qemu_st_i32(t1, t0, ctx->mem_idx,
                        MO_SL | mo_endian_rev(ctx, reversed) |
                         ctx->default_tcg_memop_mask);
 
@@ -1589,11 +1589,11 @@ static void gen_mxu_s32stxx(DisasContext *ctx, bool reversed, bool postinc)
 static void gen_mxu_s32ldxvx(DisasContext *ctx, bool reversed,
                              bool postinc, uint32_t strd2)
 {
-    TCGv t0, t1;
+    TCGv_i32 t0, t1;
     uint32_t XRa, Rb, Rc;
 
-    t0 = tcg_temp_new();
-    t1 = tcg_temp_new();
+    t0 = tcg_temp_new_i32();
+    t1 = tcg_temp_new_i32();
 
     XRa = extract32(ctx->opcode, 6, 4);
     Rc = extract32(ctx->opcode, 16, 5);
@@ -1601,10 +1601,10 @@ static void gen_mxu_s32ldxvx(DisasContext *ctx, bool reversed,
 
     gen_load_gpr(t0, Rb);
     gen_load_gpr(t1, Rc);
-    tcg_gen_shli_tl(t1, t1, strd2);
-    tcg_gen_add_tl(t0, t0, t1);
+    tcg_gen_shli_i32(t1, t1, strd2);
+    tcg_gen_add_i32(t0, t0, t1);
 
-    tcg_gen_qemu_ld_tl(t1, t0, ctx->mem_idx,
+    tcg_gen_qemu_ld_i32(t1, t0, ctx->mem_idx,
                        MO_SL | mo_endian_rev(ctx, reversed) |
                         ctx->default_tcg_memop_mask);
     gen_store_mxu_gpr(t1, XRa);
@@ -1627,11 +1627,11 @@ static void gen_mxu_s32ldxvx(DisasContext *ctx, bool reversed,
  */
 static void gen_mxu_lxx(DisasContext *ctx, uint32_t strd2, MemOp mop)
 {
-    TCGv t0, t1;
+    TCGv_i32 t0, t1;
     uint32_t Ra, Rb, Rc;
 
-    t0 = tcg_temp_new();
-    t1 = tcg_temp_new();
+    t0 = tcg_temp_new_i32();
+    t1 = tcg_temp_new_i32();
 
     Ra = extract32(ctx->opcode, 11, 5);
     Rc = extract32(ctx->opcode, 16, 5);
@@ -1639,10 +1639,10 @@ static void gen_mxu_lxx(DisasContext *ctx, uint32_t strd2, MemOp mop)
 
     gen_load_gpr(t0, Rb);
     gen_load_gpr(t1, Rc);
-    tcg_gen_shli_tl(t1, t1, strd2);
-    tcg_gen_add_tl(t0, t0, t1);
+    tcg_gen_shli_i32(t1, t1, strd2);
+    tcg_gen_add_i32(t0, t0, t1);
 
-    tcg_gen_qemu_ld_tl(t1, t0, ctx->mem_idx, mop | ctx->default_tcg_memop_mask);
+    tcg_gen_qemu_ld_i32(t1, t0, ctx->mem_idx, mop | ctx->default_tcg_memop_mask);
     gen_store_gpr(t1, Ra);
 }
 
@@ -1658,11 +1658,11 @@ static void gen_mxu_lxx(DisasContext *ctx, uint32_t strd2, MemOp mop)
 static void gen_mxu_s32stxvx(DisasContext *ctx, bool reversed,
                              bool postinc, uint32_t strd2)
 {
-    TCGv t0, t1;
+    TCGv_i32 t0, t1;
     uint32_t XRa, Rb, Rc;
 
-    t0 = tcg_temp_new();
-    t1 = tcg_temp_new();
+    t0 = tcg_temp_new_i32();
+    t1 = tcg_temp_new_i32();
 
     XRa = extract32(ctx->opcode, 6, 4);
     Rc = extract32(ctx->opcode, 16, 5);
@@ -1670,11 +1670,11 @@ static void gen_mxu_s32stxvx(DisasContext *ctx, bool reversed,
 
     gen_load_gpr(t0, Rb);
     gen_load_gpr(t1, Rc);
-    tcg_gen_shli_tl(t1, t1, strd2);
-    tcg_gen_add_tl(t0, t0, t1);
+    tcg_gen_shli_i32(t1, t1, strd2);
+    tcg_gen_add_i32(t0, t0, t1);
 
     gen_load_mxu_gpr(t1, XRa);
-    tcg_gen_qemu_st_tl(t1, t0, ctx->mem_idx,
+    tcg_gen_qemu_st_i32(t1, t0, ctx->mem_idx,
                        MO_SL | mo_endian_rev(ctx, reversed) |
                         ctx->default_tcg_memop_mask);
 
@@ -1859,23 +1859,23 @@ static void gen_mxu_d32sxx(DisasContext *ctx, bool right, bool arithmetic)
     XRd  = extract32(ctx->opcode, 18, 4);
     sft4 = extract32(ctx->opcode, 22, 4);
 
-    TCGv t0 = tcg_temp_new();
-    TCGv t1 = tcg_temp_new();
+    TCGv_i32 t0 = tcg_temp_new_i32();
+    TCGv_i32 t1 = tcg_temp_new_i32();
 
     gen_load_mxu_gpr(t0, XRb);
     gen_load_mxu_gpr(t1, XRc);
 
     if (right) {
         if (arithmetic) {
-            tcg_gen_sari_tl(t0, t0, sft4);
-            tcg_gen_sari_tl(t1, t1, sft4);
+            tcg_gen_sari_i32(t0, t0, sft4);
+            tcg_gen_sari_i32(t1, t1, sft4);
         } else {
-            tcg_gen_shri_tl(t0, t0, sft4);
-            tcg_gen_shri_tl(t1, t1, sft4);
+            tcg_gen_shri_i32(t0, t0, sft4);
+            tcg_gen_shri_i32(t1, t1, sft4);
         }
     } else {
-        tcg_gen_shli_tl(t0, t0, sft4);
-        tcg_gen_shli_tl(t1, t1, sft4);
+        tcg_gen_shli_i32(t0, t0, sft4);
+        tcg_gen_shli_i32(t1, t1, sft4);
     }
     gen_store_mxu_gpr(t0, XRa);
     gen_store_mxu_gpr(t1, XRd);
@@ -1900,26 +1900,26 @@ static void gen_mxu_d32sxxv(DisasContext *ctx, bool right, bool arithmetic)
     XRd = extract32(ctx->opcode, 14, 4);
     rs  = extract32(ctx->opcode, 21, 5);
 
-    TCGv t0 = tcg_temp_new();
-    TCGv t1 = tcg_temp_new();
-    TCGv t2 = tcg_temp_new();
+    TCGv_i32 t0 = tcg_temp_new_i32();
+    TCGv_i32 t1 = tcg_temp_new_i32();
+    TCGv_i32 t2 = tcg_temp_new_i32();
 
     gen_load_mxu_gpr(t0, XRa);
     gen_load_mxu_gpr(t1, XRd);
     gen_load_gpr(t2, rs);
-    tcg_gen_andi_tl(t2, t2, 0x0f);
+    tcg_gen_andi_i32(t2, t2, 0x0f);
 
     if (right) {
         if (arithmetic) {
-            tcg_gen_sar_tl(t0, t0, t2);
-            tcg_gen_sar_tl(t1, t1, t2);
+            tcg_gen_sar_i32(t0, t0, t2);
+            tcg_gen_sar_i32(t1, t1, t2);
         } else {
-            tcg_gen_shr_tl(t0, t0, t2);
-            tcg_gen_shr_tl(t1, t1, t2);
+            tcg_gen_shr_i32(t0, t0, t2);
+            tcg_gen_shr_i32(t1, t1, t2);
         }
     } else {
-        tcg_gen_shl_tl(t0, t0, t2);
-        tcg_gen_shl_tl(t1, t1, t2);
+        tcg_gen_shl_i32(t0, t0, t2);
+        tcg_gen_shl_i32(t1, t1, t2);
     }
     gen_store_mxu_gpr(t0, XRa);
     gen_store_mxu_gpr(t1, XRd);
@@ -1946,23 +1946,23 @@ static void gen_mxu_d32sarl(DisasContext *ctx, bool sarw)
     if (unlikely(XRa == 0)) {
         /* destination is zero register -> do nothing */
     } else {
-        TCGv t0 = tcg_temp_new();
-        TCGv t1 = tcg_temp_new();
-        TCGv t2 = tcg_temp_new();
+        TCGv_i32 t0 = tcg_temp_new_i32();
+        TCGv_i32 t1 = tcg_temp_new_i32();
+        TCGv_i32 t2 = tcg_temp_new_i32();
 
         if (!sarw) {
             /* Make SFT4 from rb field */
-            tcg_gen_movi_tl(t2, rb >> 1);
+            tcg_gen_movi_i32(t2, rb >> 1);
         } else {
             gen_load_gpr(t2, rb);
-            tcg_gen_andi_tl(t2, t2, 0x0f);
+            tcg_gen_andi_i32(t2, t2, 0x0f);
         }
         gen_load_mxu_gpr(t0, XRb);
         gen_load_mxu_gpr(t1, XRc);
-        tcg_gen_sar_tl(t0, t0, t2);
-        tcg_gen_sar_tl(t1, t1, t2);
-        tcg_gen_extract_tl(t2, t1, 0, 16);
-        tcg_gen_deposit_tl(t2, t2, t0, 16, 16);
+        tcg_gen_sar_i32(t0, t0, t2);
+        tcg_gen_sar_i32(t1, t1, t2);
+        tcg_gen_extract_i32(t2, t1, 0, 16);
+        tcg_gen_deposit_i32(t2, t2, t0, 16, 16);
         gen_store_mxu_gpr(t2, XRa);
     }
 }
@@ -1988,46 +1988,46 @@ static void gen_mxu_q16sxx(DisasContext *ctx, bool right, bool arithmetic)
     XRd  = extract32(ctx->opcode, 18, 4);
     sft4 = extract32(ctx->opcode, 22, 4);
 
-    TCGv t0 = tcg_temp_new();
-    TCGv t1 = tcg_temp_new();
-    TCGv t2 = tcg_temp_new();
-    TCGv t3 = tcg_temp_new();
+    TCGv_i32 t0 = tcg_temp_new_i32();
+    TCGv_i32 t1 = tcg_temp_new_i32();
+    TCGv_i32 t2 = tcg_temp_new_i32();
+    TCGv_i32 t3 = tcg_temp_new_i32();
 
     gen_load_mxu_gpr(t0, XRb);
     gen_load_mxu_gpr(t2, XRc);
 
     if (arithmetic) {
-        tcg_gen_sextract_tl(t1, t0, 16, 16);
-        tcg_gen_sextract_tl(t0, t0,  0, 16);
-        tcg_gen_sextract_tl(t3, t2, 16, 16);
-        tcg_gen_sextract_tl(t2, t2,  0, 16);
+        tcg_gen_sextract_i32(t1, t0, 16, 16);
+        tcg_gen_sextract_i32(t0, t0,  0, 16);
+        tcg_gen_sextract_i32(t3, t2, 16, 16);
+        tcg_gen_sextract_i32(t2, t2,  0, 16);
     } else {
-        tcg_gen_extract_tl(t1, t0, 16, 16);
-        tcg_gen_extract_tl(t0, t0,  0, 16);
-        tcg_gen_extract_tl(t3, t2, 16, 16);
-        tcg_gen_extract_tl(t2, t2,  0, 16);
+        tcg_gen_extract_i32(t1, t0, 16, 16);
+        tcg_gen_extract_i32(t0, t0,  0, 16);
+        tcg_gen_extract_i32(t3, t2, 16, 16);
+        tcg_gen_extract_i32(t2, t2,  0, 16);
     }
 
     if (right) {
         if (arithmetic) {
-            tcg_gen_sari_tl(t0, t0, sft4);
-            tcg_gen_sari_tl(t1, t1, sft4);
-            tcg_gen_sari_tl(t2, t2, sft4);
-            tcg_gen_sari_tl(t3, t3, sft4);
+            tcg_gen_sari_i32(t0, t0, sft4);
+            tcg_gen_sari_i32(t1, t1, sft4);
+            tcg_gen_sari_i32(t2, t2, sft4);
+            tcg_gen_sari_i32(t3, t3, sft4);
         } else {
-            tcg_gen_shri_tl(t0, t0, sft4);
-            tcg_gen_shri_tl(t1, t1, sft4);
-            tcg_gen_shri_tl(t2, t2, sft4);
-            tcg_gen_shri_tl(t3, t3, sft4);
+            tcg_gen_shri_i32(t0, t0, sft4);
+            tcg_gen_shri_i32(t1, t1, sft4);
+            tcg_gen_shri_i32(t2, t2, sft4);
+            tcg_gen_shri_i32(t3, t3, sft4);
         }
     } else {
-        tcg_gen_shli_tl(t0, t0, sft4);
-        tcg_gen_shli_tl(t1, t1, sft4);
-        tcg_gen_shli_tl(t2, t2, sft4);
-        tcg_gen_shli_tl(t3, t3, sft4);
+        tcg_gen_shli_i32(t0, t0, sft4);
+        tcg_gen_shli_i32(t1, t1, sft4);
+        tcg_gen_shli_i32(t2, t2, sft4);
+        tcg_gen_shli_i32(t3, t3, sft4);
     }
-    tcg_gen_deposit_tl(t0, t0, t1, 16, 16);
-    tcg_gen_deposit_tl(t2, t2, t3, 16, 16);
+    tcg_gen_deposit_i32(t0, t0, t1, 16, 16);
+    tcg_gen_deposit_i32(t2, t2, t3, 16, 16);
 
     gen_store_mxu_gpr(t0, XRa);
     gen_store_mxu_gpr(t2, XRd);
@@ -2052,50 +2052,50 @@ static void gen_mxu_q16sxxv(DisasContext *ctx, bool right, bool arithmetic)
     XRd = extract32(ctx->opcode, 14, 4);
     rs  = extract32(ctx->opcode, 21, 5);
 
-    TCGv t0 = tcg_temp_new();
-    TCGv t1 = tcg_temp_new();
-    TCGv t2 = tcg_temp_new();
-    TCGv t3 = tcg_temp_new();
-    TCGv t5 = tcg_temp_new();
+    TCGv_i32 t0 = tcg_temp_new_i32();
+    TCGv_i32 t1 = tcg_temp_new_i32();
+    TCGv_i32 t2 = tcg_temp_new_i32();
+    TCGv_i32 t3 = tcg_temp_new_i32();
+    TCGv_i32 t5 = tcg_temp_new_i32();
 
     gen_load_mxu_gpr(t0, XRa);
     gen_load_mxu_gpr(t2, XRd);
     gen_load_gpr(t5, rs);
-    tcg_gen_andi_tl(t5, t5, 0x0f);
+    tcg_gen_andi_i32(t5, t5, 0x0f);
 
 
     if (arithmetic) {
-        tcg_gen_sextract_tl(t1, t0, 16, 16);
-        tcg_gen_sextract_tl(t0, t0,  0, 16);
-        tcg_gen_sextract_tl(t3, t2, 16, 16);
-        tcg_gen_sextract_tl(t2, t2,  0, 16);
+        tcg_gen_sextract_i32(t1, t0, 16, 16);
+        tcg_gen_sextract_i32(t0, t0,  0, 16);
+        tcg_gen_sextract_i32(t3, t2, 16, 16);
+        tcg_gen_sextract_i32(t2, t2,  0, 16);
     } else {
-        tcg_gen_extract_tl(t1, t0, 16, 16);
-        tcg_gen_extract_tl(t0, t0,  0, 16);
-        tcg_gen_extract_tl(t3, t2, 16, 16);
-        tcg_gen_extract_tl(t2, t2,  0, 16);
+        tcg_gen_extract_i32(t1, t0, 16, 16);
+        tcg_gen_extract_i32(t0, t0,  0, 16);
+        tcg_gen_extract_i32(t3, t2, 16, 16);
+        tcg_gen_extract_i32(t2, t2,  0, 16);
     }
 
     if (right) {
         if (arithmetic) {
-            tcg_gen_sar_tl(t0, t0, t5);
-            tcg_gen_sar_tl(t1, t1, t5);
-            tcg_gen_sar_tl(t2, t2, t5);
-            tcg_gen_sar_tl(t3, t3, t5);
+            tcg_gen_sar_i32(t0, t0, t5);
+            tcg_gen_sar_i32(t1, t1, t5);
+            tcg_gen_sar_i32(t2, t2, t5);
+            tcg_gen_sar_i32(t3, t3, t5);
         } else {
-            tcg_gen_shr_tl(t0, t0, t5);
-            tcg_gen_shr_tl(t1, t1, t5);
-            tcg_gen_shr_tl(t2, t2, t5);
-            tcg_gen_shr_tl(t3, t3, t5);
+            tcg_gen_shr_i32(t0, t0, t5);
+            tcg_gen_shr_i32(t1, t1, t5);
+            tcg_gen_shr_i32(t2, t2, t5);
+            tcg_gen_shr_i32(t3, t3, t5);
         }
     } else {
-        tcg_gen_shl_tl(t0, t0, t5);
-        tcg_gen_shl_tl(t1, t1, t5);
-        tcg_gen_shl_tl(t2, t2, t5);
-        tcg_gen_shl_tl(t3, t3, t5);
+        tcg_gen_shl_i32(t0, t0, t5);
+        tcg_gen_shl_i32(t1, t1, t5);
+        tcg_gen_shl_i32(t2, t2, t5);
+        tcg_gen_shl_i32(t3, t3, t5);
     }
-    tcg_gen_deposit_tl(t0, t0, t1, 16, 16);
-    tcg_gen_deposit_tl(t2, t2, t3, 16, 16);
+    tcg_gen_deposit_i32(t0, t0, t1, 16, 16);
+    tcg_gen_deposit_i32(t2, t2, t3, 16, 16);
 
     gen_store_mxu_gpr(t0, XRa);
     gen_store_mxu_gpr(t2, XRd);
@@ -2195,9 +2195,9 @@ static void gen_mxu_D16MAX_D16MIN(DisasContext *ctx)
         /* exactly one operand is zero register - find which one is not...*/
         uint32_t XRx = XRb ? XRb : XRc;
         /* ...and do half-word-wise max/min with one operand 0 */
-        TCGv_i32 t0 = tcg_temp_new();
+        TCGv_i32 t0 = tcg_temp_new_i32();
         TCGv_i32 t1 = tcg_constant_i32(0);
-        TCGv_i32 t2 = tcg_temp_new();
+        TCGv_i32 t2 = tcg_temp_new_i32();
 
         /* the left half-word first */
         tcg_gen_andi_i32(t0, mxu_gpr[XRx - 1], 0xFFFF0000);
@@ -2226,9 +2226,9 @@ static void gen_mxu_D16MAX_D16MIN(DisasContext *ctx)
         tcg_gen_mov_i32(mxu_gpr[XRa - 1], mxu_gpr[XRb - 1]);
     } else {
         /* the most general case */
-        TCGv_i32 t0 = tcg_temp_new();
-        TCGv_i32 t1 = tcg_temp_new();
-        TCGv_i32 t2 = tcg_temp_new();
+        TCGv_i32 t0 = tcg_temp_new_i32();
+        TCGv_i32 t1 = tcg_temp_new_i32();
+        TCGv_i32 t2 = tcg_temp_new_i32();
 
         /* the left half-word first */
         tcg_gen_andi_i32(t0, mxu_gpr[XRb - 1], 0xFFFF0000);
@@ -2288,9 +2288,9 @@ static void gen_mxu_Q8MAX_Q8MIN(DisasContext *ctx)
         /* exactly one operand is zero register - make it be the first...*/
         uint32_t XRx = XRb ? XRb : XRc;
         /* ...and do byte-wise max/min with one operand 0 */
-        TCGv_i32 t0 = tcg_temp_new();
+        TCGv_i32 t0 = tcg_temp_new_i32();
         TCGv_i32 t1 = tcg_constant_i32(0);
-        TCGv_i32 t2 = tcg_temp_new();
+        TCGv_i32 t2 = tcg_temp_new_i32();
         int32_t i;
 
         /* the leftmost byte (byte 3) first */
@@ -2324,9 +2324,9 @@ static void gen_mxu_Q8MAX_Q8MIN(DisasContext *ctx)
         tcg_gen_mov_i32(mxu_gpr[XRa - 1], mxu_gpr[XRb - 1]);
     } else {
         /* the most general case */
-        TCGv_i32 t0 = tcg_temp_new();
-        TCGv_i32 t1 = tcg_temp_new();
-        TCGv_i32 t2 = tcg_temp_new();
+        TCGv_i32 t0 = tcg_temp_new_i32();
+        TCGv_i32 t1 = tcg_temp_new_i32();
+        TCGv_i32 t2 = tcg_temp_new_i32();
         int32_t i;
 
         /* the leftmost bytes (bytes 3) first */
@@ -2387,32 +2387,32 @@ static void gen_mxu_q8slt(DisasContext *ctx, bool sltu)
         /* destination is zero register -> do nothing */
     } else if (unlikely((XRb == 0) && (XRc == 0))) {
         /* both operands zero registers -> just set destination to zero */
-        tcg_gen_movi_tl(mxu_gpr[XRa - 1], 0);
+        tcg_gen_movi_i32(mxu_gpr[XRa - 1], 0);
     } else if (unlikely(XRb == XRc)) {
         /* both operands same registers -> just set destination to zero */
-        tcg_gen_movi_tl(mxu_gpr[XRa - 1], 0);
+        tcg_gen_movi_i32(mxu_gpr[XRa - 1], 0);
     } else {
         /* the most general case */
-        TCGv t0 = tcg_temp_new();
-        TCGv t1 = tcg_temp_new();
-        TCGv t2 = tcg_temp_new();
-        TCGv t3 = tcg_temp_new();
-        TCGv t4 = tcg_temp_new();
+        TCGv_i32 t0 = tcg_temp_new_i32();
+        TCGv_i32 t1 = tcg_temp_new_i32();
+        TCGv_i32 t2 = tcg_temp_new_i32();
+        TCGv_i32 t3 = tcg_temp_new_i32();
+        TCGv_i32 t4 = tcg_temp_new_i32();
 
         gen_load_mxu_gpr(t3, XRb);
         gen_load_mxu_gpr(t4, XRc);
-        tcg_gen_movi_tl(t2, 0);
+        tcg_gen_movi_i32(t2, 0);
 
         for (int i = 0; i < 4; i++) {
             if (sltu) {
-                tcg_gen_extract_tl(t0, t3, 8 * i, 8);
-                tcg_gen_extract_tl(t1, t4, 8 * i, 8);
+                tcg_gen_extract_i32(t0, t3, 8 * i, 8);
+                tcg_gen_extract_i32(t1, t4, 8 * i, 8);
             } else {
-                tcg_gen_sextract_tl(t0, t3, 8 * i, 8);
-                tcg_gen_sextract_tl(t1, t4, 8 * i, 8);
+                tcg_gen_sextract_i32(t0, t3, 8 * i, 8);
+                tcg_gen_sextract_i32(t1, t4, 8 * i, 8);
             }
-            tcg_gen_setcond_tl(TCG_COND_LT, t0, t0, t1);
-            tcg_gen_deposit_tl(t2, t2, t0, 8 * i, 8);
+            tcg_gen_setcond_i32(TCG_COND_LT, t0, t0, t1);
+            tcg_gen_deposit_i32(t2, t2, t0, 8 * i, 8);
         }
         gen_store_mxu_gpr(t2, XRa);
     }
@@ -2438,18 +2438,18 @@ static void gen_mxu_S32SLT(DisasContext *ctx)
         /* destination is zero register -> do nothing */
     } else if (unlikely((XRb == 0) && (XRc == 0))) {
         /* both operands zero registers -> just set destination to zero */
-        tcg_gen_movi_tl(mxu_gpr[XRa - 1], 0);
+        tcg_gen_movi_i32(mxu_gpr[XRa - 1], 0);
     } else if (unlikely(XRb == XRc)) {
         /* both operands same registers -> just set destination to zero */
-        tcg_gen_movi_tl(mxu_gpr[XRa - 1], 0);
+        tcg_gen_movi_i32(mxu_gpr[XRa - 1], 0);
     } else {
         /* the most general case */
-        TCGv t0 = tcg_temp_new();
-        TCGv t1 = tcg_temp_new();
+        TCGv_i32 t0 = tcg_temp_new_i32();
+        TCGv_i32 t1 = tcg_temp_new_i32();
 
         gen_load_mxu_gpr(t0, XRb);
         gen_load_mxu_gpr(t1, XRc);
-        tcg_gen_setcond_tl(TCG_COND_LT, mxu_gpr[XRa - 1], t0, t1);
+        tcg_gen_setcond_i32(TCG_COND_LT, mxu_gpr[XRa - 1], t0, t1);
     }
 }
 
@@ -2474,28 +2474,28 @@ static void gen_mxu_D16SLT(DisasContext *ctx)
         /* destination is zero register -> do nothing */
     } else if (unlikely((XRb == 0) && (XRc == 0))) {
         /* both operands zero registers -> just set destination to zero */
-        tcg_gen_movi_tl(mxu_gpr[XRa - 1], 0);
+        tcg_gen_movi_i32(mxu_gpr[XRa - 1], 0);
     } else if (unlikely(XRb == XRc)) {
         /* both operands same registers -> just set destination to zero */
-        tcg_gen_movi_tl(mxu_gpr[XRa - 1], 0);
+        tcg_gen_movi_i32(mxu_gpr[XRa - 1], 0);
     } else {
         /* the most general case */
-        TCGv t0 = tcg_temp_new();
-        TCGv t1 = tcg_temp_new();
-        TCGv t2 = tcg_temp_new();
-        TCGv t3 = tcg_temp_new();
-        TCGv t4 = tcg_temp_new();
+        TCGv_i32 t0 = tcg_temp_new_i32();
+        TCGv_i32 t1 = tcg_temp_new_i32();
+        TCGv_i32 t2 = tcg_temp_new_i32();
+        TCGv_i32 t3 = tcg_temp_new_i32();
+        TCGv_i32 t4 = tcg_temp_new_i32();
 
         gen_load_mxu_gpr(t3, XRb);
         gen_load_mxu_gpr(t4, XRc);
-        tcg_gen_sextract_tl(t0, t3, 16, 16);
-        tcg_gen_sextract_tl(t1, t4, 16, 16);
-        tcg_gen_setcond_tl(TCG_COND_LT, t0, t0, t1);
-        tcg_gen_shli_tl(t2, t0, 16);
-        tcg_gen_sextract_tl(t0, t3,  0, 16);
-        tcg_gen_sextract_tl(t1, t4,  0, 16);
-        tcg_gen_setcond_tl(TCG_COND_LT, t0, t0, t1);
-        tcg_gen_or_tl(mxu_gpr[XRa - 1], t2, t0);
+        tcg_gen_sextract_i32(t0, t3, 16, 16);
+        tcg_gen_sextract_i32(t1, t4, 16, 16);
+        tcg_gen_setcond_i32(TCG_COND_LT, t0, t0, t1);
+        tcg_gen_shli_i32(t2, t0, 16);
+        tcg_gen_sextract_i32(t0, t3,  0, 16);
+        tcg_gen_sextract_i32(t1, t4,  0, 16);
+        tcg_gen_setcond_i32(TCG_COND_LT, t0, t0, t1);
+        tcg_gen_or_i32(mxu_gpr[XRa - 1], t2, t0);
     }
 }
 
@@ -2525,36 +2525,36 @@ static void gen_mxu_d16avg(DisasContext *ctx, bool round45)
         /* destination is zero register -> do nothing */
     } else if (unlikely((XRb == 0) && (XRc == 0))) {
         /* both operands zero registers -> just set destination to zero */
-        tcg_gen_movi_tl(mxu_gpr[XRa - 1], 0);
+        tcg_gen_movi_i32(mxu_gpr[XRa - 1], 0);
     } else if (unlikely(XRb == XRc)) {
         /* both operands same registers -> just set destination to same */
-        tcg_gen_mov_tl(mxu_gpr[XRa - 1], mxu_gpr[XRb - 1]);
+        tcg_gen_mov_i32(mxu_gpr[XRa - 1], mxu_gpr[XRb - 1]);
     } else {
         /* the most general case */
-        TCGv t0 = tcg_temp_new();
-        TCGv t1 = tcg_temp_new();
-        TCGv t2 = tcg_temp_new();
-        TCGv t3 = tcg_temp_new();
-        TCGv t4 = tcg_temp_new();
+        TCGv_i32 t0 = tcg_temp_new_i32();
+        TCGv_i32 t1 = tcg_temp_new_i32();
+        TCGv_i32 t2 = tcg_temp_new_i32();
+        TCGv_i32 t3 = tcg_temp_new_i32();
+        TCGv_i32 t4 = tcg_temp_new_i32();
 
         gen_load_mxu_gpr(t3, XRb);
         gen_load_mxu_gpr(t4, XRc);
-        tcg_gen_sextract_tl(t0, t3, 16, 16);
-        tcg_gen_sextract_tl(t1, t4, 16, 16);
-        tcg_gen_add_tl(t0, t0, t1);
+        tcg_gen_sextract_i32(t0, t3, 16, 16);
+        tcg_gen_sextract_i32(t1, t4, 16, 16);
+        tcg_gen_add_i32(t0, t0, t1);
         if (round45) {
-            tcg_gen_addi_tl(t0, t0, 1);
+            tcg_gen_addi_i32(t0, t0, 1);
         }
-        tcg_gen_shli_tl(t2, t0, 15);
-        tcg_gen_andi_tl(t2, t2, 0xffff0000);
-        tcg_gen_sextract_tl(t0, t3,  0, 16);
-        tcg_gen_sextract_tl(t1, t4,  0, 16);
-        tcg_gen_add_tl(t0, t0, t1);
+        tcg_gen_shli_i32(t2, t0, 15);
+        tcg_gen_andi_i32(t2, t2, 0xffff0000);
+        tcg_gen_sextract_i32(t0, t3,  0, 16);
+        tcg_gen_sextract_i32(t1, t4,  0, 16);
+        tcg_gen_add_i32(t0, t0, t1);
         if (round45) {
-            tcg_gen_addi_tl(t0, t0, 1);
+            tcg_gen_addi_i32(t0, t0, 1);
         }
-        tcg_gen_shri_tl(t0, t0, 1);
-        tcg_gen_deposit_tl(t2, t2, t0, 0, 16);
+        tcg_gen_shri_i32(t0, t0, 1);
+        tcg_gen_deposit_i32(t2, t2, t0, 0, 16);
         gen_store_mxu_gpr(t2, XRa);
     }
 }
@@ -2585,31 +2585,31 @@ static void gen_mxu_q8avg(DisasContext *ctx, bool round45)
         /* destination is zero register -> do nothing */
     } else if (unlikely((XRb == 0) && (XRc == 0))) {
         /* both operands zero registers -> just set destination to zero */
-        tcg_gen_movi_tl(mxu_gpr[XRa - 1], 0);
+        tcg_gen_movi_i32(mxu_gpr[XRa - 1], 0);
     } else if (unlikely(XRb == XRc)) {
         /* both operands same registers -> just set destination to same */
-        tcg_gen_mov_tl(mxu_gpr[XRa - 1], mxu_gpr[XRb - 1]);
+        tcg_gen_mov_i32(mxu_gpr[XRa - 1], mxu_gpr[XRb - 1]);
     } else {
         /* the most general case */
-        TCGv t0 = tcg_temp_new();
-        TCGv t1 = tcg_temp_new();
-        TCGv t2 = tcg_temp_new();
-        TCGv t3 = tcg_temp_new();
-        TCGv t4 = tcg_temp_new();
+        TCGv_i32 t0 = tcg_temp_new_i32();
+        TCGv_i32 t1 = tcg_temp_new_i32();
+        TCGv_i32 t2 = tcg_temp_new_i32();
+        TCGv_i32 t3 = tcg_temp_new_i32();
+        TCGv_i32 t4 = tcg_temp_new_i32();
 
         gen_load_mxu_gpr(t3, XRb);
         gen_load_mxu_gpr(t4, XRc);
-        tcg_gen_movi_tl(t2, 0);
+        tcg_gen_movi_i32(t2, 0);
 
         for (int i = 0; i < 4; i++) {
-            tcg_gen_extract_tl(t0, t3, 8 * i, 8);
-            tcg_gen_extract_tl(t1, t4, 8 * i, 8);
-            tcg_gen_add_tl(t0, t0, t1);
+            tcg_gen_extract_i32(t0, t3, 8 * i, 8);
+            tcg_gen_extract_i32(t1, t4, 8 * i, 8);
+            tcg_gen_add_i32(t0, t0, t1);
             if (round45) {
-                tcg_gen_addi_tl(t0, t0, 1);
+                tcg_gen_addi_i32(t0, t0, 1);
             }
-            tcg_gen_shri_tl(t0, t0, 1);
-            tcg_gen_deposit_tl(t2, t2, t0, 8 * i, 8);
+            tcg_gen_shri_i32(t0, t0, 1);
+            tcg_gen_deposit_i32(t2, t2, t0, 8 * i, 8);
         }
         gen_store_mxu_gpr(t2, XRa);
     }
@@ -2636,10 +2636,10 @@ static void gen_mxu_q8movzn(DisasContext *ctx, TCGCond cond)
     XRb = extract32(ctx->opcode, 10, 4);
     XRc = extract32(ctx->opcode, 14, 4);
 
-    TCGv t0 = tcg_temp_new();
-    TCGv t1 = tcg_temp_new();
-    TCGv t2 = tcg_temp_new();
-    TCGv t3 = tcg_temp_new();
+    TCGv_i32 t0 = tcg_temp_new_i32();
+    TCGv_i32 t1 = tcg_temp_new_i32();
+    TCGv_i32 t2 = tcg_temp_new_i32();
+    TCGv_i32 t3 = tcg_temp_new_i32();
     TCGLabel *l_quarterdone = gen_new_label();
     TCGLabel *l_halfdone = gen_new_label();
     TCGLabel *l_quarterrest = gen_new_label();
@@ -2649,28 +2649,28 @@ static void gen_mxu_q8movzn(DisasContext *ctx, TCGCond cond)
     gen_load_mxu_gpr(t1, XRb);
     gen_load_mxu_gpr(t2, XRa);
 
-    tcg_gen_extract_tl(t3, t1, 24, 8);
-    tcg_gen_brcondi_tl(cond, t3, 0, l_quarterdone);
-    tcg_gen_extract_tl(t3, t0, 24, 8);
-    tcg_gen_deposit_tl(t2, t2, t3, 24, 8);
+    tcg_gen_extract_i32(t3, t1, 24, 8);
+    tcg_gen_brcondi_i32(cond, t3, 0, l_quarterdone);
+    tcg_gen_extract_i32(t3, t0, 24, 8);
+    tcg_gen_deposit_i32(t2, t2, t3, 24, 8);
 
     gen_set_label(l_quarterdone);
-    tcg_gen_extract_tl(t3, t1, 16, 8);
-    tcg_gen_brcondi_tl(cond, t3, 0, l_halfdone);
-    tcg_gen_extract_tl(t3, t0, 16, 8);
-    tcg_gen_deposit_tl(t2, t2, t3, 16, 8);
+    tcg_gen_extract_i32(t3, t1, 16, 8);
+    tcg_gen_brcondi_i32(cond, t3, 0, l_halfdone);
+    tcg_gen_extract_i32(t3, t0, 16, 8);
+    tcg_gen_deposit_i32(t2, t2, t3, 16, 8);
 
     gen_set_label(l_halfdone);
-    tcg_gen_extract_tl(t3, t1, 8, 8);
-    tcg_gen_brcondi_tl(cond, t3, 0, l_quarterrest);
-    tcg_gen_extract_tl(t3, t0, 8, 8);
-    tcg_gen_deposit_tl(t2, t2, t3, 8, 8);
+    tcg_gen_extract_i32(t3, t1, 8, 8);
+    tcg_gen_brcondi_i32(cond, t3, 0, l_quarterrest);
+    tcg_gen_extract_i32(t3, t0, 8, 8);
+    tcg_gen_deposit_i32(t2, t2, t3, 8, 8);
 
     gen_set_label(l_quarterrest);
-    tcg_gen_extract_tl(t3, t1, 0, 8);
-    tcg_gen_brcondi_tl(cond, t3, 0, l_done);
-    tcg_gen_extract_tl(t3, t0, 0, 8);
-    tcg_gen_deposit_tl(t2, t2, t3, 0, 8);
+    tcg_gen_extract_i32(t3, t1, 0, 8);
+    tcg_gen_brcondi_i32(cond, t3, 0, l_done);
+    tcg_gen_extract_i32(t3, t0, 0, 8);
+    tcg_gen_deposit_i32(t2, t2, t3, 0, 8);
 
     gen_set_label(l_done);
     gen_store_mxu_gpr(t2, XRa);
@@ -2697,10 +2697,10 @@ static void gen_mxu_d16movzn(DisasContext *ctx, TCGCond cond)
     XRb = extract32(ctx->opcode, 10, 4);
     XRc = extract32(ctx->opcode, 14, 4);
 
-    TCGv t0 = tcg_temp_new();
-    TCGv t1 = tcg_temp_new();
-    TCGv t2 = tcg_temp_new();
-    TCGv t3 = tcg_temp_new();
+    TCGv_i32 t0 = tcg_temp_new_i32();
+    TCGv_i32 t1 = tcg_temp_new_i32();
+    TCGv_i32 t2 = tcg_temp_new_i32();
+    TCGv_i32 t3 = tcg_temp_new_i32();
     TCGLabel *l_halfdone = gen_new_label();
     TCGLabel *l_done = gen_new_label();
 
@@ -2708,16 +2708,16 @@ static void gen_mxu_d16movzn(DisasContext *ctx, TCGCond cond)
     gen_load_mxu_gpr(t1, XRb);
     gen_load_mxu_gpr(t2, XRa);
 
-    tcg_gen_extract_tl(t3, t1, 16, 16);
-    tcg_gen_brcondi_tl(cond, t3, 0, l_halfdone);
-    tcg_gen_extract_tl(t3, t0, 16, 16);
-    tcg_gen_deposit_tl(t2, t2, t3, 16, 16);
+    tcg_gen_extract_i32(t3, t1, 16, 16);
+    tcg_gen_brcondi_i32(cond, t3, 0, l_halfdone);
+    tcg_gen_extract_i32(t3, t0, 16, 16);
+    tcg_gen_deposit_i32(t2, t2, t3, 16, 16);
 
     gen_set_label(l_halfdone);
-    tcg_gen_extract_tl(t3, t1, 0, 16);
-    tcg_gen_brcondi_tl(cond, t3, 0, l_done);
-    tcg_gen_extract_tl(t3, t0, 0, 16);
-    tcg_gen_deposit_tl(t2, t2, t3, 0, 16);
+    tcg_gen_extract_i32(t3, t1, 0, 16);
+    tcg_gen_brcondi_i32(cond, t3, 0, l_done);
+    tcg_gen_extract_i32(t3, t0, 0, 16);
+    tcg_gen_deposit_i32(t2, t2, t3, 0, 16);
 
     gen_set_label(l_done);
     gen_store_mxu_gpr(t2, XRa);
@@ -2744,14 +2744,14 @@ static void gen_mxu_s32movzn(DisasContext *ctx, TCGCond cond)
     XRb = extract32(ctx->opcode, 10, 4);
     XRc = extract32(ctx->opcode, 14, 4);
 
-    TCGv t0 = tcg_temp_new();
-    TCGv t1 = tcg_temp_new();
+    TCGv_i32 t0 = tcg_temp_new_i32();
+    TCGv_i32 t1 = tcg_temp_new_i32();
     TCGLabel *l_done = gen_new_label();
 
     gen_load_mxu_gpr(t0, XRc);
     gen_load_mxu_gpr(t1, XRb);
 
-    tcg_gen_brcondi_tl(cond, t1, 0, l_done);
+    tcg_gen_brcondi_i32(cond, t1, 0, l_done);
     gen_store_mxu_gpr(t0, XRa);
     gen_set_label(l_done);
 }
@@ -2784,18 +2784,18 @@ static void gen_mxu_S32CPS(DisasContext *ctx)
         /* destination is zero register -> do nothing */
     } else if (unlikely(XRb == 0)) {
         /* XRc make no sense 0 - 0 = 0 -> just set destination to zero */
-        tcg_gen_movi_tl(mxu_gpr[XRa - 1], 0);
+        tcg_gen_movi_i32(mxu_gpr[XRa - 1], 0);
     } else if (unlikely(XRc == 0)) {
         /* condition always false -> just move XRb to XRa */
-        tcg_gen_mov_tl(mxu_gpr[XRa - 1], mxu_gpr[XRb - 1]);
+        tcg_gen_mov_i32(mxu_gpr[XRa - 1], mxu_gpr[XRb - 1]);
     } else {
         /* the most general case */
-        TCGv t0 = tcg_temp_new();
+        TCGv_i32 t0 = tcg_temp_new_i32();
         TCGLabel *l_not_less = gen_new_label();
         TCGLabel *l_done = gen_new_label();
 
-        tcg_gen_brcondi_tl(TCG_COND_GE, mxu_gpr[XRc - 1], 0, l_not_less);
-        tcg_gen_neg_tl(t0, mxu_gpr[XRb - 1]);
+        tcg_gen_brcondi_i32(TCG_COND_GE, mxu_gpr[XRc - 1], 0, l_not_less);
+        tcg_gen_neg_i32(t0, mxu_gpr[XRb - 1]);
         tcg_gen_br(l_done);
         gen_set_label(l_not_less);
         gen_load_mxu_gpr(t0, XRb);
@@ -2824,37 +2824,37 @@ static void gen_mxu_D16CPS(DisasContext *ctx)
         /* destination is zero register -> do nothing */
     } else if (unlikely(XRb == 0)) {
         /* XRc make no sense 0 - 0 = 0 -> just set destination to zero */
-        tcg_gen_movi_tl(mxu_gpr[XRa - 1], 0);
+        tcg_gen_movi_i32(mxu_gpr[XRa - 1], 0);
     } else if (unlikely(XRc == 0)) {
         /* condition always false -> just move XRb to XRa */
-        tcg_gen_mov_tl(mxu_gpr[XRa - 1], mxu_gpr[XRb - 1]);
+        tcg_gen_mov_i32(mxu_gpr[XRa - 1], mxu_gpr[XRb - 1]);
     } else {
         /* the most general case */
-        TCGv t0 = tcg_temp_new();
-        TCGv t1 = tcg_temp_new();
+        TCGv_i32 t0 = tcg_temp_new_i32();
+        TCGv_i32 t1 = tcg_temp_new_i32();
         TCGLabel *l_done_hi = gen_new_label();
         TCGLabel *l_not_less_lo = gen_new_label();
         TCGLabel *l_done_lo = gen_new_label();
 
-        tcg_gen_sextract_tl(t0, mxu_gpr[XRc - 1], 16, 16);
-        tcg_gen_sextract_tl(t1, mxu_gpr[XRb - 1], 16, 16);
-        tcg_gen_brcondi_tl(TCG_COND_GE, t0, 0, l_done_hi);
-        tcg_gen_subfi_tl(t1, 0, t1);
+        tcg_gen_sextract_i32(t0, mxu_gpr[XRc - 1], 16, 16);
+        tcg_gen_sextract_i32(t1, mxu_gpr[XRb - 1], 16, 16);
+        tcg_gen_brcondi_i32(TCG_COND_GE, t0, 0, l_done_hi);
+        tcg_gen_subfi_i32(t1, 0, t1);
 
         gen_set_label(l_done_hi);
         tcg_gen_shli_i32(t1, t1, 16);
 
-        tcg_gen_sextract_tl(t0, mxu_gpr[XRc - 1],  0, 16);
-        tcg_gen_brcondi_tl(TCG_COND_GE, t0, 0, l_not_less_lo);
-        tcg_gen_sextract_tl(t0, mxu_gpr[XRb - 1],  0, 16);
-        tcg_gen_subfi_tl(t0, 0, t0);
+        tcg_gen_sextract_i32(t0, mxu_gpr[XRc - 1],  0, 16);
+        tcg_gen_brcondi_i32(TCG_COND_GE, t0, 0, l_not_less_lo);
+        tcg_gen_sextract_i32(t0, mxu_gpr[XRb - 1],  0, 16);
+        tcg_gen_subfi_i32(t0, 0, t0);
         tcg_gen_br(l_done_lo);
 
         gen_set_label(l_not_less_lo);
-        tcg_gen_extract_tl(t0, mxu_gpr[XRb - 1],  0, 16);
+        tcg_gen_extract_i32(t0, mxu_gpr[XRb - 1],  0, 16);
 
         gen_set_label(l_done_lo);
-        tcg_gen_deposit_tl(mxu_gpr[XRa - 1], t1, t0, 0, 16);
+        tcg_gen_deposit_i32(mxu_gpr[XRa - 1], t1, t0, 0, 16);
     }
 }
 
@@ -2880,27 +2880,27 @@ static void gen_mxu_Q8ABD(DisasContext *ctx)
         /* destination is zero register -> do nothing */
     } else if (unlikely((XRb == 0) && (XRc == 0))) {
         /* both operands zero registers -> just set destination to zero */
-        tcg_gen_movi_tl(mxu_gpr[XRa - 1], 0);
+        tcg_gen_movi_i32(mxu_gpr[XRa - 1], 0);
     } else {
         /* the most general case */
-        TCGv t0 = tcg_temp_new();
-        TCGv t1 = tcg_temp_new();
-        TCGv t2 = tcg_temp_new();
-        TCGv t3 = tcg_temp_new();
-        TCGv t4 = tcg_temp_new();
+        TCGv_i32 t0 = tcg_temp_new_i32();
+        TCGv_i32 t1 = tcg_temp_new_i32();
+        TCGv_i32 t2 = tcg_temp_new_i32();
+        TCGv_i32 t3 = tcg_temp_new_i32();
+        TCGv_i32 t4 = tcg_temp_new_i32();
 
         gen_load_mxu_gpr(t3, XRb);
         gen_load_mxu_gpr(t4, XRc);
-        tcg_gen_movi_tl(t2, 0);
+        tcg_gen_movi_i32(t2, 0);
 
         for (int i = 0; i < 4; i++) {
-            tcg_gen_extract_tl(t0, t3, 8 * i, 8);
-            tcg_gen_extract_tl(t1, t4, 8 * i, 8);
+            tcg_gen_extract_i32(t0, t3, 8 * i, 8);
+            tcg_gen_extract_i32(t1, t4, 8 * i, 8);
 
-            tcg_gen_sub_tl(t0, t0, t1);
-            tcg_gen_abs_tl(t0, t0);
+            tcg_gen_sub_i32(t0, t0, t1);
+            tcg_gen_abs_i32(t0, t0);
 
-            tcg_gen_deposit_tl(t2, t2, t0, 8 * i, 8);
+            tcg_gen_deposit_i32(t2, t2, t0, 8 * i, 8);
         }
         gen_store_mxu_gpr(t2, XRa);
     }
@@ -2930,41 +2930,41 @@ static void gen_mxu_Q8ADD(DisasContext *ctx)
         tcg_gen_movi_i32(mxu_gpr[XRa - 1], 0);
     } else {
         /* the most general case */
-        TCGv t0 = tcg_temp_new();
-        TCGv t1 = tcg_temp_new();
-        TCGv t2 = tcg_temp_new();
-        TCGv t3 = tcg_temp_new();
-        TCGv t4 = tcg_temp_new();
+        TCGv_i32 t0 = tcg_temp_new_i32();
+        TCGv_i32 t1 = tcg_temp_new_i32();
+        TCGv_i32 t2 = tcg_temp_new_i32();
+        TCGv_i32 t3 = tcg_temp_new_i32();
+        TCGv_i32 t4 = tcg_temp_new_i32();
 
         gen_load_mxu_gpr(t3, XRb);
         gen_load_mxu_gpr(t4, XRc);
 
         for (int i = 0; i < 4; i++) {
-            tcg_gen_andi_tl(t0, t3, 0xff);
-            tcg_gen_andi_tl(t1, t4, 0xff);
+            tcg_gen_andi_i32(t0, t3, 0xff);
+            tcg_gen_andi_i32(t1, t4, 0xff);
 
             if (i < 2) {
                 if (aptn2 & 0x01) {
-                    tcg_gen_sub_tl(t0, t0, t1);
+                    tcg_gen_sub_i32(t0, t0, t1);
                 } else {
-                    tcg_gen_add_tl(t0, t0, t1);
+                    tcg_gen_add_i32(t0, t0, t1);
                 }
             } else {
                 if (aptn2 & 0x02) {
-                    tcg_gen_sub_tl(t0, t0, t1);
+                    tcg_gen_sub_i32(t0, t0, t1);
                 } else {
-                    tcg_gen_add_tl(t0, t0, t1);
+                    tcg_gen_add_i32(t0, t0, t1);
                 }
             }
             if (i < 3) {
-                tcg_gen_shri_tl(t3, t3, 8);
-                tcg_gen_shri_tl(t4, t4, 8);
+                tcg_gen_shri_i32(t3, t3, 8);
+                tcg_gen_shri_i32(t4, t4, 8);
             }
             if (i > 0) {
-                tcg_gen_deposit_tl(t2, t2, t0, 8 * i, 8);
+                tcg_gen_deposit_i32(t2, t2, t0, 8 * i, 8);
             } else {
-                tcg_gen_andi_tl(t0, t0, 0xff);
-                tcg_gen_mov_tl(t2, t0);
+                tcg_gen_andi_i32(t0, t0, 0xff);
+                tcg_gen_mov_i32(t2, t0);
             }
         }
         gen_store_mxu_gpr(t2, XRa);
@@ -2999,19 +2999,19 @@ static void gen_mxu_q8adde(DisasContext *ctx, bool accumulate)
     if (unlikely((XRb == 0) && (XRc == 0))) {
         /* both operands zero registers -> just set destination to zero */
         if (XRa != 0) {
-            tcg_gen_movi_tl(mxu_gpr[XRa - 1], 0);
+            tcg_gen_movi_i32(mxu_gpr[XRa - 1], 0);
         }
         if (XRd != 0) {
-            tcg_gen_movi_tl(mxu_gpr[XRd - 1], 0);
+            tcg_gen_movi_i32(mxu_gpr[XRd - 1], 0);
         }
     } else {
         /* the most general case */
-        TCGv t0 = tcg_temp_new();
-        TCGv t1 = tcg_temp_new();
-        TCGv t2 = tcg_temp_new();
-        TCGv t3 = tcg_temp_new();
-        TCGv t4 = tcg_temp_new();
-        TCGv t5 = tcg_temp_new();
+        TCGv_i32 t0 = tcg_temp_new_i32();
+        TCGv_i32 t1 = tcg_temp_new_i32();
+        TCGv_i32 t2 = tcg_temp_new_i32();
+        TCGv_i32 t3 = tcg_temp_new_i32();
+        TCGv_i32 t4 = tcg_temp_new_i32();
+        TCGv_i32 t5 = tcg_temp_new_i32();
 
         if (XRa != 0) {
             gen_extract_mxu_gpr(t0, XRb, 16, 8);
@@ -3019,22 +3019,22 @@ static void gen_mxu_q8adde(DisasContext *ctx, bool accumulate)
             gen_extract_mxu_gpr(t2, XRb, 24, 8);
             gen_extract_mxu_gpr(t3, XRc, 24, 8);
             if (aptn2 & 2) {
-                tcg_gen_sub_tl(t0, t0, t1);
-                tcg_gen_sub_tl(t2, t2, t3);
+                tcg_gen_sub_i32(t0, t0, t1);
+                tcg_gen_sub_i32(t2, t2, t3);
             } else {
-                tcg_gen_add_tl(t0, t0, t1);
-                tcg_gen_add_tl(t2, t2, t3);
+                tcg_gen_add_i32(t0, t0, t1);
+                tcg_gen_add_i32(t2, t2, t3);
             }
             if (accumulate) {
                 gen_load_mxu_gpr(t5, XRa);
-                tcg_gen_extract_tl(t1, t5,  0, 16);
-                tcg_gen_extract_tl(t3, t5, 16, 16);
-                tcg_gen_add_tl(t0, t0, t1);
-                tcg_gen_add_tl(t2, t2, t3);
+                tcg_gen_extract_i32(t1, t5,  0, 16);
+                tcg_gen_extract_i32(t3, t5, 16, 16);
+                tcg_gen_add_i32(t0, t0, t1);
+                tcg_gen_add_i32(t2, t2, t3);
             }
-            tcg_gen_shli_tl(t2, t2, 16);
-            tcg_gen_extract_tl(t0, t0, 0, 16);
-            tcg_gen_or_tl(t4, t2, t0);
+            tcg_gen_shli_i32(t2, t2, 16);
+            tcg_gen_extract_i32(t0, t0, 0, 16);
+            tcg_gen_or_i32(t4, t2, t0);
         }
         if (XRd != 0) {
             gen_extract_mxu_gpr(t0, XRb, 0, 8);
@@ -3042,22 +3042,22 @@ static void gen_mxu_q8adde(DisasContext *ctx, bool accumulate)
             gen_extract_mxu_gpr(t2, XRb, 8, 8);
             gen_extract_mxu_gpr(t3, XRc, 8, 8);
             if (aptn2 & 1) {
-                tcg_gen_sub_tl(t0, t0, t1);
-                tcg_gen_sub_tl(t2, t2, t3);
+                tcg_gen_sub_i32(t0, t0, t1);
+                tcg_gen_sub_i32(t2, t2, t3);
             } else {
-                tcg_gen_add_tl(t0, t0, t1);
-                tcg_gen_add_tl(t2, t2, t3);
+                tcg_gen_add_i32(t0, t0, t1);
+                tcg_gen_add_i32(t2, t2, t3);
             }
             if (accumulate) {
                 gen_load_mxu_gpr(t5, XRd);
-                tcg_gen_extract_tl(t1, t5,  0, 16);
-                tcg_gen_extract_tl(t3, t5, 16, 16);
-                tcg_gen_add_tl(t0, t0, t1);
-                tcg_gen_add_tl(t2, t2, t3);
+                tcg_gen_extract_i32(t1, t5,  0, 16);
+                tcg_gen_extract_i32(t3, t5, 16, 16);
+                tcg_gen_add_i32(t0, t0, t1);
+                tcg_gen_add_i32(t2, t2, t3);
             }
-            tcg_gen_shli_tl(t2, t2, 16);
-            tcg_gen_extract_tl(t0, t0, 0, 16);
-            tcg_gen_or_tl(t5, t2, t0);
+            tcg_gen_shli_i32(t2, t2, 16);
+            tcg_gen_extract_i32(t0, t0, 0, 16);
+            tcg_gen_or_i32(t5, t2, t0);
         }
 
         gen_store_mxu_gpr(t4, XRa);
@@ -3090,46 +3090,46 @@ static void gen_mxu_d8sum(DisasContext *ctx, bool sumc)
         /* destination is zero register -> do nothing */
     } else if (unlikely((XRb == 0) && (XRc == 0))) {
         /* both operands zero registers -> just set destination to zero */
-        tcg_gen_movi_tl(mxu_gpr[XRa - 1], 0);
+        tcg_gen_movi_i32(mxu_gpr[XRa - 1], 0);
     } else {
         /* the most general case */
-        TCGv t0 = tcg_temp_new();
-        TCGv t1 = tcg_temp_new();
-        TCGv t2 = tcg_temp_new();
-        TCGv t3 = tcg_temp_new();
-        TCGv t4 = tcg_temp_new();
-        TCGv t5 = tcg_temp_new();
+        TCGv_i32 t0 = tcg_temp_new_i32();
+        TCGv_i32 t1 = tcg_temp_new_i32();
+        TCGv_i32 t2 = tcg_temp_new_i32();
+        TCGv_i32 t3 = tcg_temp_new_i32();
+        TCGv_i32 t4 = tcg_temp_new_i32();
+        TCGv_i32 t5 = tcg_temp_new_i32();
 
         if (XRb != 0) {
-            tcg_gen_extract_tl(t0, mxu_gpr[XRb - 1],  0, 8);
-            tcg_gen_extract_tl(t1, mxu_gpr[XRb - 1],  8, 8);
-            tcg_gen_extract_tl(t2, mxu_gpr[XRb - 1], 16, 8);
-            tcg_gen_extract_tl(t3, mxu_gpr[XRb - 1], 24, 8);
-            tcg_gen_add_tl(t4, t0, t1);
-            tcg_gen_add_tl(t4, t4, t2);
-            tcg_gen_add_tl(t4, t4, t3);
+            tcg_gen_extract_i32(t0, mxu_gpr[XRb - 1],  0, 8);
+            tcg_gen_extract_i32(t1, mxu_gpr[XRb - 1],  8, 8);
+            tcg_gen_extract_i32(t2, mxu_gpr[XRb - 1], 16, 8);
+            tcg_gen_extract_i32(t3, mxu_gpr[XRb - 1], 24, 8);
+            tcg_gen_add_i32(t4, t0, t1);
+            tcg_gen_add_i32(t4, t4, t2);
+            tcg_gen_add_i32(t4, t4, t3);
         } else {
-            tcg_gen_mov_tl(t4, 0);
+            tcg_gen_mov_i32(t4, 0);
         }
         if (XRc != 0) {
-            tcg_gen_extract_tl(t0, mxu_gpr[XRc - 1],  0, 8);
-            tcg_gen_extract_tl(t1, mxu_gpr[XRc - 1],  8, 8);
-            tcg_gen_extract_tl(t2, mxu_gpr[XRc - 1], 16, 8);
-            tcg_gen_extract_tl(t3, mxu_gpr[XRc - 1], 24, 8);
-            tcg_gen_add_tl(t5, t0, t1);
-            tcg_gen_add_tl(t5, t5, t2);
-            tcg_gen_add_tl(t5, t5, t3);
+            tcg_gen_extract_i32(t0, mxu_gpr[XRc - 1],  0, 8);
+            tcg_gen_extract_i32(t1, mxu_gpr[XRc - 1],  8, 8);
+            tcg_gen_extract_i32(t2, mxu_gpr[XRc - 1], 16, 8);
+            tcg_gen_extract_i32(t3, mxu_gpr[XRc - 1], 24, 8);
+            tcg_gen_add_i32(t5, t0, t1);
+            tcg_gen_add_i32(t5, t5, t2);
+            tcg_gen_add_i32(t5, t5, t3);
         } else {
-            tcg_gen_mov_tl(t5, 0);
+            tcg_gen_mov_i32(t5, 0);
         }
 
         if (sumc) {
-            tcg_gen_addi_tl(t4, t4, 2);
-            tcg_gen_addi_tl(t5, t5, 2);
+            tcg_gen_addi_i32(t4, t4, 2);
+            tcg_gen_addi_i32(t5, t5, 2);
         }
-        tcg_gen_shli_tl(t4, t4, 16);
+        tcg_gen_shli_i32(t4, t4, 16);
 
-        tcg_gen_or_tl(mxu_gpr[XRa - 1], t4, t5);
+        tcg_gen_or_i32(mxu_gpr[XRa - 1], t4, t5);
     }
 }
 
@@ -3148,74 +3148,74 @@ static void gen_mxu_q16add(DisasContext *ctx)
     XRb   = extract32(ctx->opcode, 10, 4);
     XRa   = extract32(ctx->opcode,  6, 4);
 
-    TCGv t0 = tcg_temp_new();
-    TCGv t1 = tcg_temp_new();
-    TCGv t2 = tcg_temp_new();
-    TCGv t3 = tcg_temp_new();
-    TCGv t4 = tcg_temp_new();
-    TCGv t5 = tcg_temp_new();
+    TCGv_i32 t0 = tcg_temp_new_i32();
+    TCGv_i32 t1 = tcg_temp_new_i32();
+    TCGv_i32 t2 = tcg_temp_new_i32();
+    TCGv_i32 t3 = tcg_temp_new_i32();
+    TCGv_i32 t4 = tcg_temp_new_i32();
+    TCGv_i32 t5 = tcg_temp_new_i32();
 
     gen_load_mxu_gpr(t1, XRb);
-    tcg_gen_extract_tl(t0, t1,  0, 16);
-    tcg_gen_extract_tl(t1, t1, 16, 16);
+    tcg_gen_extract_i32(t0, t1,  0, 16);
+    tcg_gen_extract_i32(t1, t1, 16, 16);
 
     gen_load_mxu_gpr(t3, XRc);
-    tcg_gen_extract_tl(t2, t3,  0, 16);
-    tcg_gen_extract_tl(t3, t3, 16, 16);
+    tcg_gen_extract_i32(t2, t3,  0, 16);
+    tcg_gen_extract_i32(t3, t3, 16, 16);
 
     switch (optn2) {
     case MXU_OPTN2_WW: /* XRB.H+XRC.H == lop, XRB.L+XRC.L == rop */
-        tcg_gen_mov_tl(t4, t1);
-        tcg_gen_mov_tl(t5, t0);
+        tcg_gen_mov_i32(t4, t1);
+        tcg_gen_mov_i32(t5, t0);
         break;
     case MXU_OPTN2_LW: /* XRB.L+XRC.H == lop, XRB.L+XRC.L == rop */
-        tcg_gen_mov_tl(t4, t0);
-        tcg_gen_mov_tl(t5, t0);
+        tcg_gen_mov_i32(t4, t0);
+        tcg_gen_mov_i32(t5, t0);
         break;
     case MXU_OPTN2_HW: /* XRB.H+XRC.H == lop, XRB.H+XRC.L == rop */
-        tcg_gen_mov_tl(t4, t1);
-        tcg_gen_mov_tl(t5, t1);
+        tcg_gen_mov_i32(t4, t1);
+        tcg_gen_mov_i32(t5, t1);
         break;
     case MXU_OPTN2_XW: /* XRB.L+XRC.H == lop, XRB.H+XRC.L == rop */
-        tcg_gen_mov_tl(t4, t0);
-        tcg_gen_mov_tl(t5, t1);
+        tcg_gen_mov_i32(t4, t0);
+        tcg_gen_mov_i32(t5, t1);
         break;
     }
 
     switch (aptn2) {
     case MXU_APTN2_AA: /* lop +, rop + */
-        tcg_gen_add_tl(t0, t4, t3);
-        tcg_gen_add_tl(t1, t5, t2);
-        tcg_gen_add_tl(t4, t4, t3);
-        tcg_gen_add_tl(t5, t5, t2);
+        tcg_gen_add_i32(t0, t4, t3);
+        tcg_gen_add_i32(t1, t5, t2);
+        tcg_gen_add_i32(t4, t4, t3);
+        tcg_gen_add_i32(t5, t5, t2);
         break;
     case MXU_APTN2_AS: /* lop +, rop + */
-        tcg_gen_sub_tl(t0, t4, t3);
-        tcg_gen_sub_tl(t1, t5, t2);
-        tcg_gen_add_tl(t4, t4, t3);
-        tcg_gen_add_tl(t5, t5, t2);
+        tcg_gen_sub_i32(t0, t4, t3);
+        tcg_gen_sub_i32(t1, t5, t2);
+        tcg_gen_add_i32(t4, t4, t3);
+        tcg_gen_add_i32(t5, t5, t2);
         break;
     case MXU_APTN2_SA: /* lop +, rop + */
-        tcg_gen_add_tl(t0, t4, t3);
-        tcg_gen_add_tl(t1, t5, t2);
-        tcg_gen_sub_tl(t4, t4, t3);
-        tcg_gen_sub_tl(t5, t5, t2);
+        tcg_gen_add_i32(t0, t4, t3);
+        tcg_gen_add_i32(t1, t5, t2);
+        tcg_gen_sub_i32(t4, t4, t3);
+        tcg_gen_sub_i32(t5, t5, t2);
         break;
     case MXU_APTN2_SS: /* lop +, rop + */
-        tcg_gen_sub_tl(t0, t4, t3);
-        tcg_gen_sub_tl(t1, t5, t2);
-        tcg_gen_sub_tl(t4, t4, t3);
-        tcg_gen_sub_tl(t5, t5, t2);
+        tcg_gen_sub_i32(t0, t4, t3);
+        tcg_gen_sub_i32(t1, t5, t2);
+        tcg_gen_sub_i32(t4, t4, t3);
+        tcg_gen_sub_i32(t5, t5, t2);
         break;
     }
 
-    tcg_gen_shli_tl(t0, t0, 16);
-    tcg_gen_extract_tl(t1, t1, 0, 16);
-    tcg_gen_shli_tl(t4, t4, 16);
-    tcg_gen_extract_tl(t5, t5, 0, 16);
+    tcg_gen_shli_i32(t0, t0, 16);
+    tcg_gen_extract_i32(t1, t1, 0, 16);
+    tcg_gen_shli_i32(t4, t4, 16);
+    tcg_gen_extract_i32(t5, t5, 0, 16);
 
-    tcg_gen_or_tl(mxu_gpr[XRa - 1], t4, t5);
-    tcg_gen_or_tl(mxu_gpr[XRd - 1], t0, t1);
+    tcg_gen_or_i32(mxu_gpr[XRa - 1], t4, t5);
+    tcg_gen_or_i32(mxu_gpr[XRd - 1], t0, t1);
 }
 
 /*
@@ -3232,66 +3232,66 @@ static void gen_mxu_q16acc(DisasContext *ctx)
     XRb   = extract32(ctx->opcode, 10, 4);
     XRa   = extract32(ctx->opcode,  6, 4);
 
-    TCGv t0 = tcg_temp_new();
-    TCGv t1 = tcg_temp_new();
-    TCGv t2 = tcg_temp_new();
-    TCGv t3 = tcg_temp_new();
-    TCGv s3 = tcg_temp_new();
-    TCGv s2 = tcg_temp_new();
-    TCGv s1 = tcg_temp_new();
-    TCGv s0 = tcg_temp_new();
+    TCGv_i32 t0 = tcg_temp_new_i32();
+    TCGv_i32 t1 = tcg_temp_new_i32();
+    TCGv_i32 t2 = tcg_temp_new_i32();
+    TCGv_i32 t3 = tcg_temp_new_i32();
+    TCGv_i32 s3 = tcg_temp_new_i32();
+    TCGv_i32 s2 = tcg_temp_new_i32();
+    TCGv_i32 s1 = tcg_temp_new_i32();
+    TCGv_i32 s0 = tcg_temp_new_i32();
 
     gen_load_mxu_gpr(t1, XRb);
-    tcg_gen_extract_tl(t0, t1,  0, 16);
-    tcg_gen_extract_tl(t1, t1, 16, 16);
+    tcg_gen_extract_i32(t0, t1,  0, 16);
+    tcg_gen_extract_i32(t1, t1, 16, 16);
 
     gen_load_mxu_gpr(t3, XRc);
-    tcg_gen_extract_tl(t2, t3,  0, 16);
-    tcg_gen_extract_tl(t3, t3, 16, 16);
+    tcg_gen_extract_i32(t2, t3,  0, 16);
+    tcg_gen_extract_i32(t3, t3, 16, 16);
 
     switch (aptn2) {
     case MXU_APTN2_AA: /* lop +, rop + */
-        tcg_gen_add_tl(s3, t1, t3);
-        tcg_gen_add_tl(s2, t0, t2);
-        tcg_gen_add_tl(s1, t1, t3);
-        tcg_gen_add_tl(s0, t0, t2);
+        tcg_gen_add_i32(s3, t1, t3);
+        tcg_gen_add_i32(s2, t0, t2);
+        tcg_gen_add_i32(s1, t1, t3);
+        tcg_gen_add_i32(s0, t0, t2);
         break;
     case MXU_APTN2_AS: /* lop +, rop - */
-        tcg_gen_sub_tl(s3, t1, t3);
-        tcg_gen_sub_tl(s2, t0, t2);
-        tcg_gen_add_tl(s1, t1, t3);
-        tcg_gen_add_tl(s0, t0, t2);
+        tcg_gen_sub_i32(s3, t1, t3);
+        tcg_gen_sub_i32(s2, t0, t2);
+        tcg_gen_add_i32(s1, t1, t3);
+        tcg_gen_add_i32(s0, t0, t2);
         break;
     case MXU_APTN2_SA: /* lop -, rop + */
-        tcg_gen_add_tl(s3, t1, t3);
-        tcg_gen_add_tl(s2, t0, t2);
-        tcg_gen_sub_tl(s1, t1, t3);
-        tcg_gen_sub_tl(s0, t0, t2);
+        tcg_gen_add_i32(s3, t1, t3);
+        tcg_gen_add_i32(s2, t0, t2);
+        tcg_gen_sub_i32(s1, t1, t3);
+        tcg_gen_sub_i32(s0, t0, t2);
         break;
     case MXU_APTN2_SS: /* lop -, rop - */
-        tcg_gen_sub_tl(s3, t1, t3);
-        tcg_gen_sub_tl(s2, t0, t2);
-        tcg_gen_sub_tl(s1, t1, t3);
-        tcg_gen_sub_tl(s0, t0, t2);
+        tcg_gen_sub_i32(s3, t1, t3);
+        tcg_gen_sub_i32(s2, t0, t2);
+        tcg_gen_sub_i32(s1, t1, t3);
+        tcg_gen_sub_i32(s0, t0, t2);
         break;
     }
 
     if (XRa != 0) {
-        tcg_gen_add_tl(t0, mxu_gpr[XRa - 1], s0);
-        tcg_gen_extract_tl(t0, t0, 0, 16);
-        tcg_gen_extract_tl(t1, mxu_gpr[XRa - 1], 16, 16);
-        tcg_gen_add_tl(t1, t1, s1);
-        tcg_gen_shli_tl(t1, t1, 16);
-        tcg_gen_or_tl(mxu_gpr[XRa - 1], t1, t0);
+        tcg_gen_add_i32(t0, mxu_gpr[XRa - 1], s0);
+        tcg_gen_extract_i32(t0, t0, 0, 16);
+        tcg_gen_extract_i32(t1, mxu_gpr[XRa - 1], 16, 16);
+        tcg_gen_add_i32(t1, t1, s1);
+        tcg_gen_shli_i32(t1, t1, 16);
+        tcg_gen_or_i32(mxu_gpr[XRa - 1], t1, t0);
     }
 
     if (XRd != 0) {
-        tcg_gen_add_tl(t0, mxu_gpr[XRd - 1], s2);
-        tcg_gen_extract_tl(t0, t0, 0, 16);
-        tcg_gen_extract_tl(t1, mxu_gpr[XRd - 1], 16, 16);
-        tcg_gen_add_tl(t1, t1, s3);
-        tcg_gen_shli_tl(t1, t1, 16);
-        tcg_gen_or_tl(mxu_gpr[XRd - 1], t1, t0);
+        tcg_gen_add_i32(t0, mxu_gpr[XRd - 1], s2);
+        tcg_gen_extract_i32(t0, t0, 0, 16);
+        tcg_gen_extract_i32(t1, mxu_gpr[XRd - 1], 16, 16);
+        tcg_gen_add_i32(t1, t1, s3);
+        tcg_gen_shli_i32(t1, t1, 16);
+        tcg_gen_or_i32(mxu_gpr[XRd - 1], t1, t0);
     }
 }
 
@@ -3309,58 +3309,58 @@ static void gen_mxu_q16accm(DisasContext *ctx)
     XRb   = extract32(ctx->opcode, 10, 4);
     XRa   = extract32(ctx->opcode,  6, 4);
 
-    TCGv t0 = tcg_temp_new();
-    TCGv t1 = tcg_temp_new();
-    TCGv t2 = tcg_temp_new();
-    TCGv t3 = tcg_temp_new();
+    TCGv_i32 t0 = tcg_temp_new_i32();
+    TCGv_i32 t1 = tcg_temp_new_i32();
+    TCGv_i32 t2 = tcg_temp_new_i32();
+    TCGv_i32 t3 = tcg_temp_new_i32();
 
     gen_load_mxu_gpr(t2, XRb);
     gen_load_mxu_gpr(t3, XRc);
 
     if (XRa != 0) {
-        TCGv a0 = tcg_temp_new();
-        TCGv a1 = tcg_temp_new();
+        TCGv_i32 a0 = tcg_temp_new_i32();
+        TCGv_i32 a1 = tcg_temp_new_i32();
 
-        tcg_gen_extract_tl(t0, t2,  0, 16);
-        tcg_gen_extract_tl(t1, t2, 16, 16);
+        tcg_gen_extract_i32(t0, t2,  0, 16);
+        tcg_gen_extract_i32(t1, t2, 16, 16);
 
         gen_load_mxu_gpr(a1, XRa);
-        tcg_gen_extract_tl(a0, a1,  0, 16);
-        tcg_gen_extract_tl(a1, a1, 16, 16);
+        tcg_gen_extract_i32(a0, a1,  0, 16);
+        tcg_gen_extract_i32(a1, a1, 16, 16);
 
         if (aptn2 & 2) {
-            tcg_gen_sub_tl(a0, a0, t0);
-            tcg_gen_sub_tl(a1, a1, t1);
+            tcg_gen_sub_i32(a0, a0, t0);
+            tcg_gen_sub_i32(a1, a1, t1);
         } else {
-            tcg_gen_add_tl(a0, a0, t0);
-            tcg_gen_add_tl(a1, a1, t1);
+            tcg_gen_add_i32(a0, a0, t0);
+            tcg_gen_add_i32(a1, a1, t1);
         }
-        tcg_gen_extract_tl(a0, a0, 0, 16);
-        tcg_gen_shli_tl(a1, a1, 16);
-        tcg_gen_or_tl(mxu_gpr[XRa - 1], a1, a0);
+        tcg_gen_extract_i32(a0, a0, 0, 16);
+        tcg_gen_shli_i32(a1, a1, 16);
+        tcg_gen_or_i32(mxu_gpr[XRa - 1], a1, a0);
     }
 
     if (XRd != 0) {
-        TCGv a0 = tcg_temp_new();
-        TCGv a1 = tcg_temp_new();
+        TCGv_i32 a0 = tcg_temp_new_i32();
+        TCGv_i32 a1 = tcg_temp_new_i32();
 
-        tcg_gen_extract_tl(t0, t3,  0, 16);
-        tcg_gen_extract_tl(t1, t3, 16, 16);
+        tcg_gen_extract_i32(t0, t3,  0, 16);
+        tcg_gen_extract_i32(t1, t3, 16, 16);
 
         gen_load_mxu_gpr(a1, XRd);
-        tcg_gen_extract_tl(a0, a1,  0, 16);
-        tcg_gen_extract_tl(a1, a1, 16, 16);
+        tcg_gen_extract_i32(a0, a1,  0, 16);
+        tcg_gen_extract_i32(a1, a1, 16, 16);
 
         if (aptn2 & 1) {
-            tcg_gen_sub_tl(a0, a0, t0);
-            tcg_gen_sub_tl(a1, a1, t1);
+            tcg_gen_sub_i32(a0, a0, t0);
+            tcg_gen_sub_i32(a1, a1, t1);
         } else {
-            tcg_gen_add_tl(a0, a0, t0);
-            tcg_gen_add_tl(a1, a1, t1);
+            tcg_gen_add_i32(a0, a0, t0);
+            tcg_gen_add_i32(a1, a1, t1);
         }
-        tcg_gen_extract_tl(a0, a0, 0, 16);
-        tcg_gen_shli_tl(a1, a1, 16);
-        tcg_gen_or_tl(mxu_gpr[XRd - 1], a1, a0);
+        tcg_gen_extract_i32(a0, a0, 0, 16);
+        tcg_gen_shli_i32(a1, a1, 16);
+        tcg_gen_or_i32(mxu_gpr[XRd - 1], a1, a0);
     }
 }
 
@@ -3379,33 +3379,33 @@ static void gen_mxu_d16asum(DisasContext *ctx)
     XRb   = extract32(ctx->opcode, 10, 4);
     XRa   = extract32(ctx->opcode,  6, 4);
 
-    TCGv t0 = tcg_temp_new();
-    TCGv t1 = tcg_temp_new();
-    TCGv t2 = tcg_temp_new();
-    TCGv t3 = tcg_temp_new();
+    TCGv_i32 t0 = tcg_temp_new_i32();
+    TCGv_i32 t1 = tcg_temp_new_i32();
+    TCGv_i32 t2 = tcg_temp_new_i32();
+    TCGv_i32 t3 = tcg_temp_new_i32();
 
     gen_load_mxu_gpr(t2, XRb);
     gen_load_mxu_gpr(t3, XRc);
 
     if (XRa != 0) {
-        tcg_gen_sextract_tl(t0, t2,  0, 16);
-        tcg_gen_sextract_tl(t1, t2, 16, 16);
-        tcg_gen_add_tl(t0, t0, t1);
+        tcg_gen_sextract_i32(t0, t2,  0, 16);
+        tcg_gen_sextract_i32(t1, t2, 16, 16);
+        tcg_gen_add_i32(t0, t0, t1);
         if (aptn2 & 2) {
-            tcg_gen_sub_tl(mxu_gpr[XRa - 1], mxu_gpr[XRa - 1], t0);
+            tcg_gen_sub_i32(mxu_gpr[XRa - 1], mxu_gpr[XRa - 1], t0);
         } else {
-            tcg_gen_add_tl(mxu_gpr[XRa - 1], mxu_gpr[XRa - 1], t0);
+            tcg_gen_add_i32(mxu_gpr[XRa - 1], mxu_gpr[XRa - 1], t0);
         }
     }
 
     if (XRd != 0) {
-        tcg_gen_sextract_tl(t0, t3,  0, 16);
-        tcg_gen_sextract_tl(t1, t3, 16, 16);
-        tcg_gen_add_tl(t0, t0, t1);
+        tcg_gen_sextract_i32(t0, t3,  0, 16);
+        tcg_gen_sextract_i32(t1, t3, 16, 16);
+        tcg_gen_add_i32(t0, t0, t1);
         if (aptn2 & 1) {
-            tcg_gen_sub_tl(mxu_gpr[XRd - 1], mxu_gpr[XRd - 1], t0);
+            tcg_gen_sub_i32(mxu_gpr[XRd - 1], mxu_gpr[XRd - 1], t0);
         } else {
-            tcg_gen_add_tl(mxu_gpr[XRd - 1], mxu_gpr[XRd - 1], t0);
+            tcg_gen_add_i32(mxu_gpr[XRd - 1], mxu_gpr[XRd - 1], t0);
         }
     }
 }
@@ -3428,10 +3428,10 @@ static void gen_mxu_d32add(DisasContext *ctx)
     XRb   = extract32(ctx->opcode, 10, 4);
     XRa   = extract32(ctx->opcode,  6, 4);
 
-    TCGv t0 = tcg_temp_new();
-    TCGv t1 = tcg_temp_new();
-    TCGv t2 = tcg_temp_new();
-    TCGv cr = tcg_temp_new();
+    TCGv_i32 t0 = tcg_temp_new_i32();
+    TCGv_i32 t1 = tcg_temp_new_i32();
+    TCGv_i32 t2 = tcg_temp_new_i32();
+    TCGv_i32 cr = tcg_temp_new_i32();
 
     if (unlikely(addc > 1)) {
         /* opcode incorrect -> do nothing */
@@ -3445,14 +3445,14 @@ static void gen_mxu_d32add(DisasContext *ctx)
             gen_load_mxu_gpr(t1, XRc);
             gen_load_mxu_cr(cr);
             if (XRa != 0) {
-                tcg_gen_extract_tl(t2, cr, 31, 1);
-                tcg_gen_add_tl(t0, t0, t2);
-                tcg_gen_add_tl(mxu_gpr[XRa - 1], mxu_gpr[XRa - 1], t0);
+                tcg_gen_extract_i32(t2, cr, 31, 1);
+                tcg_gen_add_i32(t0, t0, t2);
+                tcg_gen_add_i32(mxu_gpr[XRa - 1], mxu_gpr[XRa - 1], t0);
             }
             if (XRd != 0) {
-                tcg_gen_extract_tl(t2, cr, 30, 1);
-                tcg_gen_add_tl(t1, t1, t2);
-                tcg_gen_add_tl(mxu_gpr[XRd - 1], mxu_gpr[XRd - 1], t1);
+                tcg_gen_extract_i32(t2, cr, 30, 1);
+                tcg_gen_add_i32(t1, t1, t2);
+                tcg_gen_add_i32(mxu_gpr[XRd - 1], mxu_gpr[XRd - 1], t1);
             }
         }
     } else if (unlikely(XRa == 0 && XRd == 0)) {
@@ -3460,7 +3460,7 @@ static void gen_mxu_d32add(DisasContext *ctx)
     } else {
         /* common case */
         /* FIXME ??? What if XRa == XRd ??? */
-        TCGv carry = tcg_temp_new();
+        TCGv_i32 carry = tcg_temp_new_i32();
 
         gen_load_mxu_gpr(t0, XRb);
         gen_load_mxu_gpr(t1, XRc);
@@ -3468,27 +3468,27 @@ static void gen_mxu_d32add(DisasContext *ctx)
         if (XRa != 0) {
             if (aptn2 & 2) {
                 tcg_gen_sub_i32(t2, t0, t1);
-                tcg_gen_setcond_tl(TCG_COND_GTU, carry, t0, t1);
+                tcg_gen_setcond_i32(TCG_COND_GTU, carry, t0, t1);
             } else {
                 tcg_gen_add_i32(t2, t0, t1);
-                tcg_gen_setcond_tl(TCG_COND_GTU, carry, t0, t2);
+                tcg_gen_setcond_i32(TCG_COND_GTU, carry, t0, t2);
             }
-            tcg_gen_andi_tl(cr, cr, 0x7fffffff);
-            tcg_gen_shli_tl(carry, carry, 31);
-            tcg_gen_or_tl(cr, cr, carry);
+            tcg_gen_andi_i32(cr, cr, 0x7fffffff);
+            tcg_gen_shli_i32(carry, carry, 31);
+            tcg_gen_or_i32(cr, cr, carry);
             gen_store_mxu_gpr(t2, XRa);
         }
         if (XRd != 0) {
             if (aptn2 & 1) {
                 tcg_gen_sub_i32(t2, t0, t1);
-                tcg_gen_setcond_tl(TCG_COND_GTU, carry, t0, t1);
+                tcg_gen_setcond_i32(TCG_COND_GTU, carry, t0, t1);
             } else {
                 tcg_gen_add_i32(t2, t0, t1);
-                tcg_gen_setcond_tl(TCG_COND_GTU, carry, t0, t2);
+                tcg_gen_setcond_i32(TCG_COND_GTU, carry, t0, t2);
             }
-            tcg_gen_andi_tl(cr, cr, 0xbfffffff);
-            tcg_gen_shli_tl(carry, carry, 30);
-            tcg_gen_or_tl(cr, cr, carry);
+            tcg_gen_andi_i32(cr, cr, 0xbfffffff);
+            tcg_gen_shli_i32(carry, carry, 30);
+            tcg_gen_or_i32(cr, cr, carry);
             gen_store_mxu_gpr(t2, XRd);
         }
         gen_store_mxu_cr(cr);
@@ -3509,9 +3509,9 @@ static void gen_mxu_d32acc(DisasContext *ctx)
     XRb   = extract32(ctx->opcode, 10, 4);
     XRa   = extract32(ctx->opcode,  6, 4);
 
-    TCGv t0 = tcg_temp_new();
-    TCGv t1 = tcg_temp_new();
-    TCGv t2 = tcg_temp_new();
+    TCGv_i32 t0 = tcg_temp_new_i32();
+    TCGv_i32 t1 = tcg_temp_new_i32();
+    TCGv_i32 t2 = tcg_temp_new_i32();
 
     if (unlikely(XRa == 0 && XRd == 0)) {
         /* destinations are zero register -> do nothing */
@@ -3521,19 +3521,19 @@ static void gen_mxu_d32acc(DisasContext *ctx)
         gen_load_mxu_gpr(t1, XRc);
         if (XRa != 0) {
             if (aptn2 & 2) {
-                tcg_gen_sub_tl(t2, t0, t1);
+                tcg_gen_sub_i32(t2, t0, t1);
             } else {
-                tcg_gen_add_tl(t2, t0, t1);
+                tcg_gen_add_i32(t2, t0, t1);
             }
-            tcg_gen_add_tl(mxu_gpr[XRa - 1], mxu_gpr[XRa - 1], t2);
+            tcg_gen_add_i32(mxu_gpr[XRa - 1], mxu_gpr[XRa - 1], t2);
         }
         if (XRd != 0) {
             if (aptn2 & 1) {
-                tcg_gen_sub_tl(t2, t0, t1);
+                tcg_gen_sub_i32(t2, t0, t1);
             } else {
-                tcg_gen_add_tl(t2, t0, t1);
+                tcg_gen_add_i32(t2, t0, t1);
             }
-            tcg_gen_add_tl(mxu_gpr[XRd - 1], mxu_gpr[XRd - 1], t2);
+            tcg_gen_add_i32(mxu_gpr[XRd - 1], mxu_gpr[XRd - 1], t2);
         }
     }
 }
@@ -3552,9 +3552,9 @@ static void gen_mxu_d32accm(DisasContext *ctx)
     XRb   = extract32(ctx->opcode, 10, 4);
     XRa   = extract32(ctx->opcode,  6, 4);
 
-    TCGv t0 = tcg_temp_new();
-    TCGv t1 = tcg_temp_new();
-    TCGv t2 = tcg_temp_new();
+    TCGv_i32 t0 = tcg_temp_new_i32();
+    TCGv_i32 t1 = tcg_temp_new_i32();
+    TCGv_i32 t2 = tcg_temp_new_i32();
 
     if (unlikely(XRa == 0 && XRd == 0)) {
         /* destinations are zero register -> do nothing */
@@ -3563,19 +3563,19 @@ static void gen_mxu_d32accm(DisasContext *ctx)
         gen_load_mxu_gpr(t0, XRb);
         gen_load_mxu_gpr(t1, XRc);
         if (XRa != 0) {
-            tcg_gen_add_tl(t2, t0, t1);
+            tcg_gen_add_i32(t2, t0, t1);
             if (aptn2 & 2) {
-                tcg_gen_sub_tl(mxu_gpr[XRa - 1], mxu_gpr[XRa - 1], t2);
+                tcg_gen_sub_i32(mxu_gpr[XRa - 1], mxu_gpr[XRa - 1], t2);
             } else {
-                tcg_gen_add_tl(mxu_gpr[XRa - 1], mxu_gpr[XRa - 1], t2);
+                tcg_gen_add_i32(mxu_gpr[XRa - 1], mxu_gpr[XRa - 1], t2);
             }
         }
         if (XRd != 0) {
-            tcg_gen_sub_tl(t2, t0, t1);
+            tcg_gen_sub_i32(t2, t0, t1);
             if (aptn2 & 1) {
-                tcg_gen_sub_tl(mxu_gpr[XRd - 1], mxu_gpr[XRd - 1], t2);
+                tcg_gen_sub_i32(mxu_gpr[XRd - 1], mxu_gpr[XRd - 1], t2);
             } else {
-                tcg_gen_add_tl(mxu_gpr[XRd - 1], mxu_gpr[XRd - 1], t2);
+                tcg_gen_add_i32(mxu_gpr[XRd - 1], mxu_gpr[XRd - 1], t2);
             }
         }
     }
@@ -3595,8 +3595,8 @@ static void gen_mxu_d32asum(DisasContext *ctx)
     XRb   = extract32(ctx->opcode, 10, 4);
     XRa   = extract32(ctx->opcode,  6, 4);
 
-    TCGv t0 = tcg_temp_new();
-    TCGv t1 = tcg_temp_new();
+    TCGv_i32 t0 = tcg_temp_new_i32();
+    TCGv_i32 t1 = tcg_temp_new_i32();
 
     if (unlikely(XRa == 0 && XRd == 0)) {
         /* destinations are zero register -> do nothing */
@@ -3606,16 +3606,16 @@ static void gen_mxu_d32asum(DisasContext *ctx)
         gen_load_mxu_gpr(t1, XRc);
         if (XRa != 0) {
             if (aptn2 & 2) {
-                tcg_gen_sub_tl(mxu_gpr[XRa - 1], mxu_gpr[XRa - 1], t0);
+                tcg_gen_sub_i32(mxu_gpr[XRa - 1], mxu_gpr[XRa - 1], t0);
             } else {
-                tcg_gen_add_tl(mxu_gpr[XRa - 1], mxu_gpr[XRa - 1], t0);
+                tcg_gen_add_i32(mxu_gpr[XRa - 1], mxu_gpr[XRa - 1], t0);
             }
         }
         if (XRd != 0) {
             if (aptn2 & 1) {
-                tcg_gen_sub_tl(mxu_gpr[XRd - 1], mxu_gpr[XRd - 1], t1);
+                tcg_gen_sub_i32(mxu_gpr[XRd - 1], mxu_gpr[XRd - 1], t1);
             } else {
-                tcg_gen_add_tl(mxu_gpr[XRd - 1], mxu_gpr[XRd - 1], t1);
+                tcg_gen_add_i32(mxu_gpr[XRd - 1], mxu_gpr[XRd - 1], t1);
             }
         }
     }
@@ -3638,13 +3638,13 @@ static void gen_mxu_d32asum(DisasContext *ctx)
  */
 static void gen_mxu_s32extr(DisasContext *ctx)
 {
-    TCGv t0, t1, t2, t3;
+    TCGv_i32 t0, t1, t2, t3;
     uint32_t XRa, XRd, rs, bits5;
 
-    t0 = tcg_temp_new();
-    t1 = tcg_temp_new();
-    t2 = tcg_temp_new();
-    t3 = tcg_temp_new();
+    t0 = tcg_temp_new_i32();
+    t1 = tcg_temp_new_i32();
+    t2 = tcg_temp_new_i32();
+    t3 = tcg_temp_new_i32();
 
     XRa   = extract32(ctx->opcode,  6, 4);
     XRd   = extract32(ctx->opcode, 10, 4);
@@ -3660,23 +3660,23 @@ static void gen_mxu_s32extr(DisasContext *ctx)
         gen_load_mxu_gpr(t0, XRd);
         gen_load_mxu_gpr(t1, XRa);
         gen_load_gpr(t2, rs);
-        tcg_gen_andi_tl(t2, t2, 0x1f);
-        tcg_gen_subfi_tl(t2, 32, t2);
-        tcg_gen_brcondi_tl(TCG_COND_GE, t2, bits5, l_xra_only);
-        tcg_gen_subfi_tl(t2, bits5, t2);
-        tcg_gen_subfi_tl(t3, 32, t2);
-        tcg_gen_shr_tl(t0, t0, t3);
-        tcg_gen_shl_tl(t1, t1, t2);
-        tcg_gen_or_tl(t0, t0, t1);
+        tcg_gen_andi_i32(t2, t2, 0x1f);
+        tcg_gen_subfi_i32(t2, 32, t2);
+        tcg_gen_brcondi_i32(TCG_COND_GE, t2, bits5, l_xra_only);
+        tcg_gen_subfi_i32(t2, bits5, t2);
+        tcg_gen_subfi_i32(t3, 32, t2);
+        tcg_gen_shr_i32(t0, t0, t3);
+        tcg_gen_shl_i32(t1, t1, t2);
+        tcg_gen_or_i32(t0, t0, t1);
         tcg_gen_br(l_done);
         gen_set_label(l_xra_only);
-        tcg_gen_subi_tl(t2, t2, bits5);
-        tcg_gen_shr_tl(t0, t1, t2);
+        tcg_gen_subi_i32(t2, t2, bits5);
+        tcg_gen_shr_i32(t0, t1, t2);
         gen_set_label(l_done);
-        tcg_gen_extract_tl(t0, t0, 0, bits5);
+        tcg_gen_extract_i32(t0, t0, 0, bits5);
     } else {
         /* unspecified behavior but matches tests on real hardware*/
-        tcg_gen_movi_tl(t0, 0);
+        tcg_gen_movi_i32(t0, 0);
     }
     gen_store_mxu_gpr(t0, XRa);
 }
@@ -3688,14 +3688,14 @@ static void gen_mxu_s32extr(DisasContext *ctx)
  */
 static void gen_mxu_s32extrv(DisasContext *ctx)
 {
-    TCGv t0, t1, t2, t3, t4;
+    TCGv_i32 t0, t1, t2, t3, t4;
     uint32_t XRa, XRd, rs, rt;
 
-    t0 = tcg_temp_new();
-    t1 = tcg_temp_new();
-    t2 = tcg_temp_new();
-    t3 = tcg_temp_new();
-    t4 = tcg_temp_new();
+    t0 = tcg_temp_new_i32();
+    t1 = tcg_temp_new_i32();
+    t2 = tcg_temp_new_i32();
+    t3 = tcg_temp_new_i32();
+    t4 = tcg_temp_new_i32();
     TCGLabel *l_xra_only = gen_new_label();
     TCGLabel *l_done = gen_new_label();
     TCGLabel *l_zero = gen_new_label();
@@ -3711,32 +3711,32 @@ static void gen_mxu_s32extrv(DisasContext *ctx)
     gen_load_mxu_gpr(t1, XRa);
     gen_load_gpr(t2, rs);
     gen_load_gpr(t4, rt);
-    tcg_gen_brcondi_tl(TCG_COND_EQ, t4, 0, l_zero);
-    tcg_gen_andi_tl(t2, t2, 0x1f);
-    tcg_gen_subfi_tl(t2, 32, t2);
-    tcg_gen_brcond_tl(TCG_COND_GE, t2, t4, l_xra_only);
-    tcg_gen_sub_tl(t2, t4, t2);
-    tcg_gen_subfi_tl(t3, 32, t2);
-    tcg_gen_shr_tl(t0, t0, t3);
-    tcg_gen_shl_tl(t1, t1, t2);
-    tcg_gen_or_tl(t0, t0, t1);
+    tcg_gen_brcondi_i32(TCG_COND_EQ, t4, 0, l_zero);
+    tcg_gen_andi_i32(t2, t2, 0x1f);
+    tcg_gen_subfi_i32(t2, 32, t2);
+    tcg_gen_brcond_i32(TCG_COND_GE, t2, t4, l_xra_only);
+    tcg_gen_sub_i32(t2, t4, t2);
+    tcg_gen_subfi_i32(t3, 32, t2);
+    tcg_gen_shr_i32(t0, t0, t3);
+    tcg_gen_shl_i32(t1, t1, t2);
+    tcg_gen_or_i32(t0, t0, t1);
     tcg_gen_br(l_extract);
 
     gen_set_label(l_xra_only);
-    tcg_gen_sub_tl(t2, t2, t4);
-    tcg_gen_shr_tl(t0, t1, t2);
+    tcg_gen_sub_i32(t2, t2, t4);
+    tcg_gen_shr_i32(t0, t1, t2);
     tcg_gen_br(l_extract);
 
     /* unspecified behavior but matches tests on real hardware*/
     gen_set_label(l_zero);
-    tcg_gen_movi_tl(t0, 0);
+    tcg_gen_movi_i32(t0, 0);
     tcg_gen_br(l_done);
 
     /* {XRa} = extract({tmp}, 0, rt) */
     gen_set_label(l_extract);
-    tcg_gen_subfi_tl(t4, 32, t4);
-    tcg_gen_shl_tl(t0, t0, t4);
-    tcg_gen_shr_tl(t0, t0, t4);
+    tcg_gen_subfi_i32(t4, 32, t4);
+    tcg_gen_shl_i32(t0, t0, t4);
+    tcg_gen_shr_i32(t0, t0, t4);
 
     gen_set_label(l_done);
     gen_store_mxu_gpr(t0, XRa);
@@ -3762,33 +3762,33 @@ static void gen_mxu_s32lui(DisasContext *ctx)
         /* destination is zero register -> do nothing */
     } else {
         uint32_t s16;
-        TCGv t0 = tcg_temp_new();
+        TCGv_i32 t0 = tcg_temp_new_i32();
 
         switch (optn3) {
         case 0:
-            tcg_gen_movi_tl(t0, s8);
+            tcg_gen_movi_i32(t0, s8);
             break;
         case 1:
-            tcg_gen_movi_tl(t0, s8 << 8);
+            tcg_gen_movi_i32(t0, s8 << 8);
             break;
         case 2:
-            tcg_gen_movi_tl(t0, s8 << 16);
+            tcg_gen_movi_i32(t0, s8 << 16);
             break;
         case 3:
-            tcg_gen_movi_tl(t0, s8 << 24);
+            tcg_gen_movi_i32(t0, s8 << 24);
             break;
         case 4:
-            tcg_gen_movi_tl(t0, (s8 << 16) | s8);
+            tcg_gen_movi_i32(t0, (s8 << 16) | s8);
             break;
         case 5:
-            tcg_gen_movi_tl(t0, (s8 << 24) | (s8 << 8));
+            tcg_gen_movi_i32(t0, (s8 << 24) | (s8 << 8));
             break;
         case 6:
             s16 = (uint16_t)(int16_t)(int8_t)s8;
-            tcg_gen_movi_tl(t0, (s16 << 16) | s16);
+            tcg_gen_movi_i32(t0, (s16 << 16) | s16);
             break;
         case 7:
-            tcg_gen_movi_tl(t0, (s8 << 24) | (s8 << 16) | (s8 << 8) | s8);
+            tcg_gen_movi_i32(t0, (s8 << 24) | (s8 << 16) | (s8 << 8) | s8);
             break;
         }
         gen_store_mxu_gpr(t0, XRa);
@@ -3816,11 +3816,11 @@ static void gen_mxu_Q16SAT(DisasContext *ctx)
         /* destination is zero register -> do nothing */
     } else {
         /* the most general case */
-        TCGv t0 = tcg_temp_new();
-        TCGv t1 = tcg_temp_new();
-        TCGv t2 = tcg_temp_new();
+        TCGv_i32 t0 = tcg_temp_new_i32();
+        TCGv_i32 t1 = tcg_temp_new_i32();
+        TCGv_i32 t2 = tcg_temp_new_i32();
 
-        tcg_gen_movi_tl(t2, 0);
+        tcg_gen_movi_i32(t2, 0);
         if (XRb != 0) {
             TCGLabel *l_less_hi = gen_new_label();
             TCGLabel *l_less_lo = gen_new_label();
@@ -3829,32 +3829,32 @@ static void gen_mxu_Q16SAT(DisasContext *ctx)
             TCGLabel *l_greater_lo = gen_new_label();
             TCGLabel *l_done = gen_new_label();
 
-            tcg_gen_sari_tl(t0, mxu_gpr[XRb - 1], 16);
-            tcg_gen_brcondi_tl(TCG_COND_LT, t0, 0, l_less_hi);
-            tcg_gen_brcondi_tl(TCG_COND_GT, t0, 255, l_greater_hi);
+            tcg_gen_sari_i32(t0, mxu_gpr[XRb - 1], 16);
+            tcg_gen_brcondi_i32(TCG_COND_LT, t0, 0, l_less_hi);
+            tcg_gen_brcondi_i32(TCG_COND_GT, t0, 255, l_greater_hi);
             tcg_gen_br(l_lo);
             gen_set_label(l_less_hi);
-            tcg_gen_movi_tl(t0, 0);
+            tcg_gen_movi_i32(t0, 0);
             tcg_gen_br(l_lo);
             gen_set_label(l_greater_hi);
-            tcg_gen_movi_tl(t0, 255);
+            tcg_gen_movi_i32(t0, 255);
 
             gen_set_label(l_lo);
-            tcg_gen_shli_tl(t1, mxu_gpr[XRb - 1], 16);
-            tcg_gen_sari_tl(t1, t1, 16);
-            tcg_gen_brcondi_tl(TCG_COND_LT, t1, 0, l_less_lo);
-            tcg_gen_brcondi_tl(TCG_COND_GT, t1, 255, l_greater_lo);
+            tcg_gen_shli_i32(t1, mxu_gpr[XRb - 1], 16);
+            tcg_gen_sari_i32(t1, t1, 16);
+            tcg_gen_brcondi_i32(TCG_COND_LT, t1, 0, l_less_lo);
+            tcg_gen_brcondi_i32(TCG_COND_GT, t1, 255, l_greater_lo);
             tcg_gen_br(l_done);
             gen_set_label(l_less_lo);
-            tcg_gen_movi_tl(t1, 0);
+            tcg_gen_movi_i32(t1, 0);
             tcg_gen_br(l_done);
             gen_set_label(l_greater_lo);
-            tcg_gen_movi_tl(t1, 255);
+            tcg_gen_movi_i32(t1, 255);
 
             gen_set_label(l_done);
-            tcg_gen_shli_tl(t2, t0, 24);
-            tcg_gen_shli_tl(t1, t1, 16);
-            tcg_gen_or_tl(t2, t2, t1);
+            tcg_gen_shli_i32(t2, t0, 24);
+            tcg_gen_shli_i32(t1, t1, 16);
+            tcg_gen_or_i32(t2, t2, t1);
         }
 
         if (XRc != 0) {
@@ -3865,32 +3865,32 @@ static void gen_mxu_Q16SAT(DisasContext *ctx)
             TCGLabel *l_greater_lo = gen_new_label();
             TCGLabel *l_done = gen_new_label();
 
-            tcg_gen_sari_tl(t0, mxu_gpr[XRc - 1], 16);
-            tcg_gen_brcondi_tl(TCG_COND_LT, t0, 0, l_less_hi);
-            tcg_gen_brcondi_tl(TCG_COND_GT, t0, 255, l_greater_hi);
+            tcg_gen_sari_i32(t0, mxu_gpr[XRc - 1], 16);
+            tcg_gen_brcondi_i32(TCG_COND_LT, t0, 0, l_less_hi);
+            tcg_gen_brcondi_i32(TCG_COND_GT, t0, 255, l_greater_hi);
             tcg_gen_br(l_lo);
             gen_set_label(l_less_hi);
-            tcg_gen_movi_tl(t0, 0);
+            tcg_gen_movi_i32(t0, 0);
             tcg_gen_br(l_lo);
             gen_set_label(l_greater_hi);
-            tcg_gen_movi_tl(t0, 255);
+            tcg_gen_movi_i32(t0, 255);
 
             gen_set_label(l_lo);
-            tcg_gen_shli_tl(t1, mxu_gpr[XRc - 1], 16);
-            tcg_gen_sari_tl(t1, t1, 16);
-            tcg_gen_brcondi_tl(TCG_COND_LT, t1, 0, l_less_lo);
-            tcg_gen_brcondi_tl(TCG_COND_GT, t1, 255, l_greater_lo);
+            tcg_gen_shli_i32(t1, mxu_gpr[XRc - 1], 16);
+            tcg_gen_sari_i32(t1, t1, 16);
+            tcg_gen_brcondi_i32(TCG_COND_LT, t1, 0, l_less_lo);
+            tcg_gen_brcondi_i32(TCG_COND_GT, t1, 255, l_greater_lo);
             tcg_gen_br(l_done);
             gen_set_label(l_less_lo);
-            tcg_gen_movi_tl(t1, 0);
+            tcg_gen_movi_i32(t1, 0);
             tcg_gen_br(l_done);
             gen_set_label(l_greater_lo);
-            tcg_gen_movi_tl(t1, 255);
+            tcg_gen_movi_i32(t1, 255);
 
             gen_set_label(l_done);
-            tcg_gen_shli_tl(t0, t0, 8);
-            tcg_gen_or_tl(t2, t2, t0);
-            tcg_gen_or_tl(t2, t2, t1);
+            tcg_gen_shli_i32(t0, t0, 8);
+            tcg_gen_or_i32(t2, t2, t0);
+            tcg_gen_or_i32(t2, t2, t1);
         }
         gen_store_mxu_gpr(t2, XRa);
     }
@@ -3910,11 +3910,11 @@ static void gen_mxu_q16scop(DisasContext *ctx)
     XRb  = extract32(ctx->opcode, 10, 4);
     XRa  = extract32(ctx->opcode,  6, 4);
 
-    TCGv t0 = tcg_temp_new();
-    TCGv t1 = tcg_temp_new();
-    TCGv t2 = tcg_temp_new();
-    TCGv t3 = tcg_temp_new();
-    TCGv t4 = tcg_temp_new();
+    TCGv_i32 t0 = tcg_temp_new_i32();
+    TCGv_i32 t1 = tcg_temp_new_i32();
+    TCGv_i32 t2 = tcg_temp_new_i32();
+    TCGv_i32 t3 = tcg_temp_new_i32();
+    TCGv_i32 t4 = tcg_temp_new_i32();
 
     TCGLabel *l_b_hi_lt = gen_new_label();
     TCGLabel *l_b_hi_gt = gen_new_label();
@@ -3930,47 +3930,47 @@ static void gen_mxu_q16scop(DisasContext *ctx)
     gen_load_mxu_gpr(t0, XRb);
     gen_load_mxu_gpr(t1, XRc);
 
-    tcg_gen_sextract_tl(t2, t0, 16, 16);
-    tcg_gen_brcondi_tl(TCG_COND_LT, t2, 0, l_b_hi_lt);
-    tcg_gen_brcondi_tl(TCG_COND_GT, t2, 0, l_b_hi_gt);
-    tcg_gen_movi_tl(t3, 0);
+    tcg_gen_sextract_i32(t2, t0, 16, 16);
+    tcg_gen_brcondi_i32(TCG_COND_LT, t2, 0, l_b_hi_lt);
+    tcg_gen_brcondi_i32(TCG_COND_GT, t2, 0, l_b_hi_gt);
+    tcg_gen_movi_i32(t3, 0);
     tcg_gen_br(l_b_lo);
     gen_set_label(l_b_hi_lt);
-    tcg_gen_movi_tl(t3, 0xffff0000);
+    tcg_gen_movi_i32(t3, 0xffff0000);
     tcg_gen_br(l_b_lo);
     gen_set_label(l_b_hi_gt);
-    tcg_gen_movi_tl(t3, 0x00010000);
+    tcg_gen_movi_i32(t3, 0x00010000);
 
     gen_set_label(l_b_lo);
-    tcg_gen_sextract_tl(t2, t0, 0, 16);
-    tcg_gen_brcondi_tl(TCG_COND_EQ, t2, 0, l_c_hi);
-    tcg_gen_brcondi_tl(TCG_COND_LT, t2, 0, l_b_lo_lt);
-    tcg_gen_ori_tl(t3, t3, 0x00000001);
+    tcg_gen_sextract_i32(t2, t0, 0, 16);
+    tcg_gen_brcondi_i32(TCG_COND_EQ, t2, 0, l_c_hi);
+    tcg_gen_brcondi_i32(TCG_COND_LT, t2, 0, l_b_lo_lt);
+    tcg_gen_ori_i32(t3, t3, 0x00000001);
     tcg_gen_br(l_c_hi);
     gen_set_label(l_b_lo_lt);
-    tcg_gen_ori_tl(t3, t3, 0x0000ffff);
+    tcg_gen_ori_i32(t3, t3, 0x0000ffff);
     tcg_gen_br(l_c_hi);
 
     gen_set_label(l_c_hi);
-    tcg_gen_sextract_tl(t2, t1, 16, 16);
-    tcg_gen_brcondi_tl(TCG_COND_LT, t2, 0, l_c_hi_lt);
-    tcg_gen_brcondi_tl(TCG_COND_GT, t2, 0, l_c_hi_gt);
-    tcg_gen_movi_tl(t4, 0);
+    tcg_gen_sextract_i32(t2, t1, 16, 16);
+    tcg_gen_brcondi_i32(TCG_COND_LT, t2, 0, l_c_hi_lt);
+    tcg_gen_brcondi_i32(TCG_COND_GT, t2, 0, l_c_hi_gt);
+    tcg_gen_movi_i32(t4, 0);
     tcg_gen_br(l_c_lo);
     gen_set_label(l_c_hi_lt);
-    tcg_gen_movi_tl(t4, 0xffff0000);
+    tcg_gen_movi_i32(t4, 0xffff0000);
     tcg_gen_br(l_c_lo);
     gen_set_label(l_c_hi_gt);
-    tcg_gen_movi_tl(t4, 0x00010000);
+    tcg_gen_movi_i32(t4, 0x00010000);
 
     gen_set_label(l_c_lo);
-    tcg_gen_sextract_tl(t2, t1, 0, 16);
-    tcg_gen_brcondi_tl(TCG_COND_EQ, t2, 0, l_done);
-    tcg_gen_brcondi_tl(TCG_COND_LT, t2, 0, l_c_lo_lt);
-    tcg_gen_ori_tl(t4, t4, 0x00000001);
+    tcg_gen_sextract_i32(t2, t1, 0, 16);
+    tcg_gen_brcondi_i32(TCG_COND_EQ, t2, 0, l_done);
+    tcg_gen_brcondi_i32(TCG_COND_LT, t2, 0, l_c_lo_lt);
+    tcg_gen_ori_i32(t4, t4, 0x00000001);
     tcg_gen_br(l_done);
     gen_set_label(l_c_lo_lt);
-    tcg_gen_ori_tl(t4, t4, 0x0000ffff);
+    tcg_gen_ori_i32(t4, t4, 0x0000ffff);
 
     gen_set_label(l_done);
     gen_store_mxu_gpr(t3, XRa);
@@ -3991,62 +3991,62 @@ static void gen_mxu_s32sfl(DisasContext *ctx)
     XRa  = extract32(ctx->opcode,  6, 4);
     ptn2 = extract32(ctx->opcode, 24, 2);
 
-    TCGv t0 = tcg_temp_new();
-    TCGv t1 = tcg_temp_new();
-    TCGv t2 = tcg_temp_new();
-    TCGv t3 = tcg_temp_new();
+    TCGv_i32 t0 = tcg_temp_new_i32();
+    TCGv_i32 t1 = tcg_temp_new_i32();
+    TCGv_i32 t2 = tcg_temp_new_i32();
+    TCGv_i32 t3 = tcg_temp_new_i32();
 
     gen_load_mxu_gpr(t0, XRb);
     gen_load_mxu_gpr(t1, XRc);
 
     switch (ptn2) {
     case 0:
-        tcg_gen_andi_tl(t2, t0, 0xff000000);
-        tcg_gen_andi_tl(t3, t1, 0x000000ff);
-        tcg_gen_deposit_tl(t3, t3, t0,  8, 8);
-        tcg_gen_shri_tl(t0, t0,  8);
-        tcg_gen_shri_tl(t1, t1,  8);
-        tcg_gen_deposit_tl(t3, t3, t0, 24, 8);
-        tcg_gen_deposit_tl(t3, t3, t1, 16, 8);
-        tcg_gen_shri_tl(t0, t0,  8);
-        tcg_gen_shri_tl(t1, t1,  8);
-        tcg_gen_deposit_tl(t2, t2, t0,  8, 8);
-        tcg_gen_deposit_tl(t2, t2, t1,  0, 8);
-        tcg_gen_shri_tl(t1, t1,  8);
-        tcg_gen_deposit_tl(t2, t2, t1, 16, 8);
+        tcg_gen_andi_i32(t2, t0, 0xff000000);
+        tcg_gen_andi_i32(t3, t1, 0x000000ff);
+        tcg_gen_deposit_i32(t3, t3, t0,  8, 8);
+        tcg_gen_shri_i32(t0, t0,  8);
+        tcg_gen_shri_i32(t1, t1,  8);
+        tcg_gen_deposit_i32(t3, t3, t0, 24, 8);
+        tcg_gen_deposit_i32(t3, t3, t1, 16, 8);
+        tcg_gen_shri_i32(t0, t0,  8);
+        tcg_gen_shri_i32(t1, t1,  8);
+        tcg_gen_deposit_i32(t2, t2, t0,  8, 8);
+        tcg_gen_deposit_i32(t2, t2, t1,  0, 8);
+        tcg_gen_shri_i32(t1, t1,  8);
+        tcg_gen_deposit_i32(t2, t2, t1, 16, 8);
         break;
     case 1:
-        tcg_gen_andi_tl(t2, t0, 0xff000000);
-        tcg_gen_andi_tl(t3, t1, 0x000000ff);
-        tcg_gen_deposit_tl(t3, t3, t0, 16, 8);
-        tcg_gen_shri_tl(t0, t0,  8);
-        tcg_gen_shri_tl(t1, t1,  8);
-        tcg_gen_deposit_tl(t2, t2, t0, 16, 8);
-        tcg_gen_deposit_tl(t2, t2, t1,  0, 8);
-        tcg_gen_shri_tl(t0, t0,  8);
-        tcg_gen_shri_tl(t1, t1,  8);
-        tcg_gen_deposit_tl(t3, t3, t0, 24, 8);
-        tcg_gen_deposit_tl(t3, t3, t1,  8, 8);
-        tcg_gen_shri_tl(t1, t1,  8);
-        tcg_gen_deposit_tl(t2, t2, t1,  8, 8);
+        tcg_gen_andi_i32(t2, t0, 0xff000000);
+        tcg_gen_andi_i32(t3, t1, 0x000000ff);
+        tcg_gen_deposit_i32(t3, t3, t0, 16, 8);
+        tcg_gen_shri_i32(t0, t0,  8);
+        tcg_gen_shri_i32(t1, t1,  8);
+        tcg_gen_deposit_i32(t2, t2, t0, 16, 8);
+        tcg_gen_deposit_i32(t2, t2, t1,  0, 8);
+        tcg_gen_shri_i32(t0, t0,  8);
+        tcg_gen_shri_i32(t1, t1,  8);
+        tcg_gen_deposit_i32(t3, t3, t0, 24, 8);
+        tcg_gen_deposit_i32(t3, t3, t1,  8, 8);
+        tcg_gen_shri_i32(t1, t1,  8);
+        tcg_gen_deposit_i32(t2, t2, t1,  8, 8);
         break;
     case 2:
-        tcg_gen_andi_tl(t2, t0, 0xff00ff00);
-        tcg_gen_andi_tl(t3, t1, 0x00ff00ff);
-        tcg_gen_deposit_tl(t3, t3, t0,  8, 8);
-        tcg_gen_shri_tl(t0, t0, 16);
-        tcg_gen_shri_tl(t1, t1,  8);
-        tcg_gen_deposit_tl(t2, t2, t1,  0, 8);
-        tcg_gen_deposit_tl(t3, t3, t0, 24, 8);
-        tcg_gen_shri_tl(t1, t1, 16);
-        tcg_gen_deposit_tl(t2, t2, t1, 16, 8);
+        tcg_gen_andi_i32(t2, t0, 0xff00ff00);
+        tcg_gen_andi_i32(t3, t1, 0x00ff00ff);
+        tcg_gen_deposit_i32(t3, t3, t0,  8, 8);
+        tcg_gen_shri_i32(t0, t0, 16);
+        tcg_gen_shri_i32(t1, t1,  8);
+        tcg_gen_deposit_i32(t2, t2, t1,  0, 8);
+        tcg_gen_deposit_i32(t3, t3, t0, 24, 8);
+        tcg_gen_shri_i32(t1, t1, 16);
+        tcg_gen_deposit_i32(t2, t2, t1, 16, 8);
         break;
     case 3:
-        tcg_gen_andi_tl(t2, t0, 0xffff0000);
-        tcg_gen_andi_tl(t3, t1, 0x0000ffff);
-        tcg_gen_shri_tl(t1, t1, 16);
-        tcg_gen_deposit_tl(t2, t2, t1,  0, 16);
-        tcg_gen_deposit_tl(t3, t3, t0, 16, 16);
+        tcg_gen_andi_i32(t2, t0, 0xffff0000);
+        tcg_gen_andi_i32(t3, t1, 0x0000ffff);
+        tcg_gen_shri_i32(t1, t1, 16);
+        tcg_gen_deposit_i32(t2, t2, t1,  0, 16);
+        tcg_gen_deposit_i32(t3, t3, t0, 16, 16);
         break;
     }
 
@@ -4067,30 +4067,30 @@ static void gen_mxu_q8sad(DisasContext *ctx)
     XRb = extract32(ctx->opcode, 10, 4);
     XRa = extract32(ctx->opcode,  6, 4);
 
-    TCGv t0 = tcg_temp_new();
-    TCGv t1 = tcg_temp_new();
-    TCGv t2 = tcg_temp_new();
-    TCGv t3 = tcg_temp_new();
-    TCGv t4 = tcg_temp_new();
-    TCGv t5 = tcg_temp_new();
+    TCGv_i32 t0 = tcg_temp_new_i32();
+    TCGv_i32 t1 = tcg_temp_new_i32();
+    TCGv_i32 t2 = tcg_temp_new_i32();
+    TCGv_i32 t3 = tcg_temp_new_i32();
+    TCGv_i32 t4 = tcg_temp_new_i32();
+    TCGv_i32 t5 = tcg_temp_new_i32();
 
     gen_load_mxu_gpr(t2, XRb);
     gen_load_mxu_gpr(t3, XRc);
     gen_load_mxu_gpr(t5, XRd);
-    tcg_gen_movi_tl(t4, 0);
+    tcg_gen_movi_i32(t4, 0);
 
     for (int i = 0; i < 4; i++) {
-        tcg_gen_andi_tl(t0, t2, 0xff);
-        tcg_gen_andi_tl(t1, t3, 0xff);
-        tcg_gen_sub_tl(t0, t0, t1);
-        tcg_gen_abs_tl(t0, t0);
-        tcg_gen_add_tl(t4, t4, t0);
+        tcg_gen_andi_i32(t0, t2, 0xff);
+        tcg_gen_andi_i32(t1, t3, 0xff);
+        tcg_gen_sub_i32(t0, t0, t1);
+        tcg_gen_abs_i32(t0, t0);
+        tcg_gen_add_i32(t4, t4, t0);
         if (i < 3) {
-            tcg_gen_shri_tl(t2, t2, 8);
-            tcg_gen_shri_tl(t3, t3, 8);
+            tcg_gen_shri_i32(t2, t2, 8);
+            tcg_gen_shri_i32(t3, t3, 8);
         }
     }
-    tcg_gen_add_tl(t5, t5, t4);
+    tcg_gen_add_i32(t5, t5, t4);
     gen_store_mxu_gpr(t4, XRa);
     gen_store_mxu_gpr(t5, XRd);
 }
@@ -4196,8 +4196,8 @@ static void gen_mxu_S32ALNI(DisasContext *ctx)
                 /*               XRa                       */
                 /*                                         */
 
-                TCGv_i32 t0 = tcg_temp_new();
-                TCGv_i32 t1 = tcg_temp_new();
+                TCGv_i32 t0 = tcg_temp_new_i32();
+                TCGv_i32 t1 = tcg_temp_new_i32();
 
                 tcg_gen_andi_i32(t0, mxu_gpr[XRb - 1], 0x00FFFFFF);
                 tcg_gen_shli_i32(t0, t0, 8);
@@ -4219,8 +4219,8 @@ static void gen_mxu_S32ALNI(DisasContext *ctx)
                 /*                   XRa                   */
                 /*                                         */
 
-                TCGv_i32 t0 = tcg_temp_new();
-                TCGv_i32 t1 = tcg_temp_new();
+                TCGv_i32 t0 = tcg_temp_new_i32();
+                TCGv_i32 t1 = tcg_temp_new_i32();
 
                 tcg_gen_andi_i32(t0, mxu_gpr[XRb - 1], 0x0000FFFF);
                 tcg_gen_shli_i32(t0, t0, 16);
@@ -4242,8 +4242,8 @@ static void gen_mxu_S32ALNI(DisasContext *ctx)
                 /*                       XRa               */
                 /*                                         */
 
-                TCGv_i32 t0 = tcg_temp_new();
-                TCGv_i32 t1 = tcg_temp_new();
+                TCGv_i32 t0 = tcg_temp_new_i32();
+                TCGv_i32 t1 = tcg_temp_new_i32();
 
                 tcg_gen_andi_i32(t0, mxu_gpr[XRb - 1], 0x000000FF);
                 tcg_gen_shli_i32(t0, t0, 24);
@@ -4290,13 +4290,13 @@ static void gen_mxu_S32ALN(DisasContext *ctx)
         /* destination is zero register -> do nothing */
     } else if (unlikely((XRb == 0) && (XRc == 0))) {
         /* both operands zero registers -> just set destination to all 0s */
-        tcg_gen_movi_tl(mxu_gpr[XRa - 1], 0);
+        tcg_gen_movi_i32(mxu_gpr[XRa - 1], 0);
     } else {
         /* the most general case */
-        TCGv t0 = tcg_temp_new();
-        TCGv t1 = tcg_temp_new();
-        TCGv t2 = tcg_temp_new();
-        TCGv t3 = tcg_temp_new();
+        TCGv_i32 t0 = tcg_temp_new_i32();
+        TCGv_i32 t1 = tcg_temp_new_i32();
+        TCGv_i32 t2 = tcg_temp_new_i32();
+        TCGv_i32 t3 = tcg_temp_new_i32();
         TCGLabel *l_exit = gen_new_label();
         TCGLabel *l_b_only = gen_new_label();
         TCGLabel *l_c_only = gen_new_label();
@@ -4304,20 +4304,20 @@ static void gen_mxu_S32ALN(DisasContext *ctx)
         gen_load_mxu_gpr(t0, XRb);
         gen_load_mxu_gpr(t1, XRc);
         gen_load_gpr(t2, rs);
-        tcg_gen_andi_tl(t2, t2, 0x07);
+        tcg_gen_andi_i32(t2, t2, 0x07);
 
         /* do nothing for undefined cases */
-        tcg_gen_brcondi_tl(TCG_COND_GE, t2, 5, l_exit);
+        tcg_gen_brcondi_i32(TCG_COND_GE, t2, 5, l_exit);
 
-        tcg_gen_brcondi_tl(TCG_COND_EQ, t2, 0, l_b_only);
-        tcg_gen_brcondi_tl(TCG_COND_EQ, t2, 4, l_c_only);
+        tcg_gen_brcondi_i32(TCG_COND_EQ, t2, 0, l_b_only);
+        tcg_gen_brcondi_i32(TCG_COND_EQ, t2, 4, l_c_only);
 
-        tcg_gen_shli_tl(t2, t2, 3);
-        tcg_gen_subfi_tl(t3, 32, t2);
+        tcg_gen_shli_i32(t2, t2, 3);
+        tcg_gen_subfi_i32(t3, 32, t2);
 
-        tcg_gen_shl_tl(t0, t0, t2);
-        tcg_gen_shr_tl(t1, t1, t3);
-        tcg_gen_or_tl(mxu_gpr[XRa - 1], t0, t1);
+        tcg_gen_shl_i32(t0, t0, t2);
+        tcg_gen_shr_i32(t1, t1, t3);
+        tcg_gen_or_i32(mxu_gpr[XRa - 1], t0, t1);
         tcg_gen_br(l_exit);
 
         gen_set_label(l_b_only);
@@ -4359,8 +4359,8 @@ static void gen_mxu_s32madd_sub(DisasContext *ctx, bool sub, bool uns)
     } else if (unlikely(XRa == 0 && XRd == 0)) {
         /* do nothing because result just dropped */
     } else {
-        TCGv t0 = tcg_temp_new();
-        TCGv t1 = tcg_temp_new();
+        TCGv_i32 t0 = tcg_temp_new_i32();
+        TCGv_i32 t1 = tcg_temp_new_i32();
         TCGv_i64 t2 = tcg_temp_new_i64();
         TCGv_i64 t3 = tcg_temp_new_i64();
 
@@ -4368,18 +4368,18 @@ static void gen_mxu_s32madd_sub(DisasContext *ctx, bool sub, bool uns)
         gen_load_gpr(t1, Rc);
 
         if (uns) {
-            tcg_gen_extu_tl_i64(t2, t0);
-            tcg_gen_extu_tl_i64(t3, t1);
+            tcg_gen_extu_i32_i64(t2, t0);
+            tcg_gen_extu_i32_i64(t3, t1);
         } else {
-            tcg_gen_ext_tl_i64(t2, t0);
-            tcg_gen_ext_tl_i64(t3, t1);
+            tcg_gen_ext_i32_i64(t2, t0);
+            tcg_gen_ext_i32_i64(t3, t1);
         }
         tcg_gen_mul_i64(t2, t2, t3);
 
         gen_load_mxu_gpr(t0, XRa);
         gen_load_mxu_gpr(t1, XRd);
 
-        tcg_gen_concat_tl_i64(t3, t1, t0);
+        tcg_gen_concat_i32_i64(t3, t1, t0);
         if (sub) {
             tcg_gen_sub_i64(t3, t3, t2);
         } else {
@@ -4388,8 +4388,8 @@ static void gen_mxu_s32madd_sub(DisasContext *ctx, bool sub, bool uns)
         gen_move_low32(t1, t3);
         gen_move_high32(t0, t3);
 
-        tcg_gen_mov_tl(cpu_HI[0], t0);
-        tcg_gen_mov_tl(cpu_LO[0], t1);
+        tcg_gen_mov_i32(cpu_HI[0], t0);
+        tcg_gen_mov_i32(cpu_LO[0], t1);
 
         gen_store_mxu_gpr(t1, XRd);
         gen_store_mxu_gpr(t0, XRa);
@@ -4936,12 +4936,12 @@ bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
     }
 
     {
-        TCGv t_mxu_cr = tcg_temp_new();
+        TCGv_i32 t_mxu_cr = tcg_temp_new_i32();
         TCGLabel *l_exit = gen_new_label();
 
         gen_load_mxu_cr(t_mxu_cr);
-        tcg_gen_andi_tl(t_mxu_cr, t_mxu_cr, MXU_CR_MXU_EN);
-        tcg_gen_brcondi_tl(TCG_COND_NE, t_mxu_cr, MXU_CR_MXU_EN, l_exit);
+        tcg_gen_andi_i32(t_mxu_cr, t_mxu_cr, MXU_CR_MXU_EN);
+        tcg_gen_brcondi_i32(TCG_COND_NE, t_mxu_cr, MXU_CR_MXU_EN, l_exit);
 
         switch (opcode) {
         case OPC_MXU_S32MADD:
-- 
2.53.0

[PULL 072/110] target/mips: Expand TCGv type for 64-bit extensions

[Philippe Mathieu-Daudé]

These TX79, Octeon and Loongarch extensions are only built
as 64-bit, so TCGv expands to TCGv_i64. Use the latter which
is more explicit. Mechanical changes.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260401144503.80510-3-philmd@linaro.org>
---
 target/mips/tcg/lcsr_translate.c   | 16 +++---
 target/mips/tcg/loong_translate.c  | 92 +++++++++++++++---------------
 target/mips/tcg/octeon_translate.c | 60 +++++++++----------
 target/mips/tcg/tx79_translate.c   | 14 ++---
 4 files changed, 91 insertions(+), 91 deletions(-)

diff --git a/target/mips/tcg/lcsr_translate.c b/target/mips/tcg/lcsr_translate.c
index 352b0f43282..128c17a9181 100644
--- a/target/mips/tcg/lcsr_translate.c
+++ b/target/mips/tcg/lcsr_translate.c
@@ -18,8 +18,8 @@
 
 static bool trans_CPUCFG(DisasContext *ctx, arg_CPUCFG *a)
 {
-    TCGv dest = tcg_temp_new();
-    TCGv src1 = tcg_temp_new();
+    TCGv_i64 dest = tcg_temp_new_i64();
+    TCGv_i64 src1 = tcg_temp_new_i64();
 
     gen_load_gpr(src1, a->rs);
     gen_helper_lcsr_cpucfg(dest, tcg_env, src1);
@@ -30,10 +30,10 @@ static bool trans_CPUCFG(DisasContext *ctx, arg_CPUCFG *a)
 
 #ifndef CONFIG_USER_ONLY
 static bool gen_rdcsr(DisasContext *ctx, arg_r *a,
-                        void (*func)(TCGv, TCGv_ptr, TCGv))
+                        void (*func)(TCGv_i64, TCGv_ptr, TCGv_i64))
 {
-    TCGv dest = tcg_temp_new();
-    TCGv src1 = tcg_temp_new();
+    TCGv_i64 dest = tcg_temp_new_i64();
+    TCGv_i64 src1 = tcg_temp_new_i64();
 
     check_cp0_enabled(ctx);
     gen_load_gpr(src1, a->rs);
@@ -44,10 +44,10 @@ static bool gen_rdcsr(DisasContext *ctx, arg_r *a,
 }
 
 static bool gen_wrcsr(DisasContext *ctx, arg_r *a,
-                        void (*func)(TCGv_ptr, TCGv, TCGv))
+                        void (*func)(TCGv_ptr, TCGv_i64, TCGv_i64))
 {
-    TCGv val = tcg_temp_new();
-    TCGv addr = tcg_temp_new();
+    TCGv_i64 val = tcg_temp_new_i64();
+    TCGv_i64 addr = tcg_temp_new_i64();
 
     check_cp0_enabled(ctx);
     gen_load_gpr(addr, a->rs);
diff --git a/target/mips/tcg/loong_translate.c b/target/mips/tcg/loong_translate.c
index 7d74cc34f8a..797e3b5f721 100644
--- a/target/mips/tcg/loong_translate.c
+++ b/target/mips/tcg/loong_translate.c
@@ -28,7 +28,7 @@
 static bool gen_lext_DIV_G(DisasContext *s, int rd, int rs, int rt,
                            bool is_double)
 {
-    TCGv t0, t1;
+    TCGv_i64 t0, t1;
     TCGLabel *l1, *l2, *l3;
 
     if (rd == 0) {
@@ -36,8 +36,8 @@ static bool gen_lext_DIV_G(DisasContext *s, int rd, int rs, int rt,
         return true;
     }
 
-    t0 = tcg_temp_new();
-    t1 = tcg_temp_new();
+    t0 = tcg_temp_new_i64();
+    t1 = tcg_temp_new_i64();
     l1 = gen_new_label();
     l2 = gen_new_label();
     l3 = gen_new_label();
@@ -46,23 +46,23 @@ static bool gen_lext_DIV_G(DisasContext *s, int rd, int rs, int rt,
     gen_load_gpr(t1, rt);
 
     if (!is_double) {
-        tcg_gen_ext32s_tl(t0, t0);
-        tcg_gen_ext32s_tl(t1, t1);
+        tcg_gen_ext32s_i64(t0, t0);
+        tcg_gen_ext32s_i64(t1, t1);
     }
-    tcg_gen_brcondi_tl(TCG_COND_NE, t1, 0, l1);
-    tcg_gen_movi_tl(cpu_gpr[rd], 0);
+    tcg_gen_brcondi_i64(TCG_COND_NE, t1, 0, l1);
+    tcg_gen_movi_i64(cpu_gpr[rd], 0);
     tcg_gen_br(l3);
     gen_set_label(l1);
 
-    tcg_gen_brcondi_tl(TCG_COND_NE, t0, is_double ? LLONG_MIN : INT_MIN, l2);
-    tcg_gen_brcondi_tl(TCG_COND_NE, t1, -1LL, l2);
-    tcg_gen_mov_tl(cpu_gpr[rd], t0);
+    tcg_gen_brcondi_i64(TCG_COND_NE, t0, is_double ? LLONG_MIN : INT_MIN, l2);
+    tcg_gen_brcondi_i64(TCG_COND_NE, t1, -1LL, l2);
+    tcg_gen_mov_i64(cpu_gpr[rd], t0);
 
     tcg_gen_br(l3);
     gen_set_label(l2);
-    tcg_gen_div_tl(cpu_gpr[rd], t0, t1);
+    tcg_gen_div_i64(cpu_gpr[rd], t0, t1);
     if (!is_double) {
-        tcg_gen_ext32s_tl(cpu_gpr[rd], cpu_gpr[rd]);
+        tcg_gen_ext32s_i64(cpu_gpr[rd], cpu_gpr[rd]);
     }
     gen_set_label(l3);
 
@@ -82,7 +82,7 @@ static bool trans_DDIV_G(DisasContext *s, arg_muldiv *a)
 static bool gen_lext_DIVU_G(DisasContext *s, int rd, int rs, int rt,
                             bool is_double)
 {
-    TCGv t0, t1;
+    TCGv_i64 t0, t1;
     TCGLabel *l1, *l2;
 
     if (rd == 0) {
@@ -90,8 +90,8 @@ static bool gen_lext_DIVU_G(DisasContext *s, int rd, int rs, int rt,
         return true;
     }
 
-    t0 = tcg_temp_new();
-    t1 = tcg_temp_new();
+    t0 = tcg_temp_new_i64();
+    t1 = tcg_temp_new_i64();
     l1 = gen_new_label();
     l2 = gen_new_label();
 
@@ -99,17 +99,17 @@ static bool gen_lext_DIVU_G(DisasContext *s, int rd, int rs, int rt,
     gen_load_gpr(t1, rt);
 
     if (!is_double) {
-        tcg_gen_ext32u_tl(t0, t0);
-        tcg_gen_ext32u_tl(t1, t1);
+        tcg_gen_ext32u_i64(t0, t0);
+        tcg_gen_ext32u_i64(t1, t1);
     }
-    tcg_gen_brcondi_tl(TCG_COND_NE, t1, 0, l1);
-    tcg_gen_movi_tl(cpu_gpr[rd], 0);
+    tcg_gen_brcondi_i64(TCG_COND_NE, t1, 0, l1);
+    tcg_gen_movi_i64(cpu_gpr[rd], 0);
 
     tcg_gen_br(l2);
     gen_set_label(l1);
-    tcg_gen_divu_tl(cpu_gpr[rd], t0, t1);
+    tcg_gen_divu_i64(cpu_gpr[rd], t0, t1);
     if (!is_double) {
-        tcg_gen_ext32s_tl(cpu_gpr[rd], cpu_gpr[rd]);
+        tcg_gen_ext32s_i64(cpu_gpr[rd], cpu_gpr[rd]);
     }
     gen_set_label(l2);
 
@@ -129,7 +129,7 @@ static bool trans_DDIVU_G(DisasContext *s, arg_muldiv *a)
 static bool gen_lext_MOD_G(DisasContext *s, int rd, int rs, int rt,
                            bool is_double)
 {
-    TCGv t0, t1;
+    TCGv_i64 t0, t1;
     TCGLabel *l1, *l2, *l3;
 
     if (rd == 0) {
@@ -137,8 +137,8 @@ static bool gen_lext_MOD_G(DisasContext *s, int rd, int rs, int rt,
         return true;
     }
 
-    t0 = tcg_temp_new();
-    t1 = tcg_temp_new();
+    t0 = tcg_temp_new_i64();
+    t1 = tcg_temp_new_i64();
     l1 = gen_new_label();
     l2 = gen_new_label();
     l3 = gen_new_label();
@@ -147,19 +147,19 @@ static bool gen_lext_MOD_G(DisasContext *s, int rd, int rs, int rt,
     gen_load_gpr(t1, rt);
 
     if (!is_double) {
-        tcg_gen_ext32u_tl(t0, t0);
-        tcg_gen_ext32u_tl(t1, t1);
+        tcg_gen_ext32u_i64(t0, t0);
+        tcg_gen_ext32u_i64(t1, t1);
     }
-    tcg_gen_brcondi_tl(TCG_COND_EQ, t1, 0, l1);
-    tcg_gen_brcondi_tl(TCG_COND_NE, t0, is_double ? LLONG_MIN : INT_MIN, l2);
-    tcg_gen_brcondi_tl(TCG_COND_NE, t1, -1LL, l2);
+    tcg_gen_brcondi_i64(TCG_COND_EQ, t1, 0, l1);
+    tcg_gen_brcondi_i64(TCG_COND_NE, t0, is_double ? LLONG_MIN : INT_MIN, l2);
+    tcg_gen_brcondi_i64(TCG_COND_NE, t1, -1LL, l2);
     gen_set_label(l1);
-    tcg_gen_movi_tl(cpu_gpr[rd], 0);
+    tcg_gen_movi_i64(cpu_gpr[rd], 0);
     tcg_gen_br(l3);
     gen_set_label(l2);
-    tcg_gen_rem_tl(cpu_gpr[rd], t0, t1);
+    tcg_gen_rem_i64(cpu_gpr[rd], t0, t1);
     if (!is_double) {
-        tcg_gen_ext32s_tl(cpu_gpr[rd], cpu_gpr[rd]);
+        tcg_gen_ext32s_i64(cpu_gpr[rd], cpu_gpr[rd]);
     }
     gen_set_label(l3);
 
@@ -179,7 +179,7 @@ static bool trans_DMOD_G(DisasContext *s, arg_muldiv *a)
 static bool gen_lext_MODU_G(DisasContext *s, int rd, int rs, int rt,
                             bool is_double)
 {
-    TCGv t0, t1;
+    TCGv_i64 t0, t1;
     TCGLabel *l1, *l2;
 
     if (rd == 0) {
@@ -187,8 +187,8 @@ static bool gen_lext_MODU_G(DisasContext *s, int rd, int rs, int rt,
         return true;
     }
 
-    t0 = tcg_temp_new();
-    t1 = tcg_temp_new();
+    t0 = tcg_temp_new_i64();
+    t1 = tcg_temp_new_i64();
     l1 = gen_new_label();
     l2 = gen_new_label();
 
@@ -196,16 +196,16 @@ static bool gen_lext_MODU_G(DisasContext *s, int rd, int rs, int rt,
     gen_load_gpr(t1, rt);
 
     if (!is_double) {
-        tcg_gen_ext32u_tl(t0, t0);
-        tcg_gen_ext32u_tl(t1, t1);
+        tcg_gen_ext32u_i64(t0, t0);
+        tcg_gen_ext32u_i64(t1, t1);
     }
-    tcg_gen_brcondi_tl(TCG_COND_NE, t1, 0, l1);
-    tcg_gen_movi_tl(cpu_gpr[rd], 0);
+    tcg_gen_brcondi_i64(TCG_COND_NE, t1, 0, l1);
+    tcg_gen_movi_i64(cpu_gpr[rd], 0);
     tcg_gen_br(l2);
     gen_set_label(l1);
-    tcg_gen_remu_tl(cpu_gpr[rd], t0, t1);
+    tcg_gen_remu_i64(cpu_gpr[rd], t0, t1);
     if (!is_double) {
-        tcg_gen_ext32s_tl(cpu_gpr[rd], cpu_gpr[rd]);
+        tcg_gen_ext32s_i64(cpu_gpr[rd], cpu_gpr[rd]);
     }
     gen_set_label(l2);
 
@@ -225,22 +225,22 @@ static bool trans_DMODU_G(DisasContext *s, arg_muldiv *a)
 static bool gen_lext_MULT_G(DisasContext *s, int rd, int rs, int rt,
                             bool is_double)
 {
-    TCGv t0, t1;
+    TCGv_i64 t0, t1;
 
     if (rd == 0) {
         /* Treat as NOP. */
         return true;
     }
 
-    t0 = tcg_temp_new();
-    t1 = tcg_temp_new();
+    t0 = tcg_temp_new_i64();
+    t1 = tcg_temp_new_i64();
 
     gen_load_gpr(t0, rs);
     gen_load_gpr(t1, rt);
 
-    tcg_gen_mul_tl(cpu_gpr[rd], t0, t1);
+    tcg_gen_mul_i64(cpu_gpr[rd], t0, t1);
     if (!is_double) {
-        tcg_gen_ext32s_tl(cpu_gpr[rd], cpu_gpr[rd]);
+        tcg_gen_ext32s_i64(cpu_gpr[rd], cpu_gpr[rd]);
     }
 
     return true;
diff --git a/target/mips/tcg/octeon_translate.c b/target/mips/tcg/octeon_translate.c
index b2eca29e06c..e1f52d444aa 100644
--- a/target/mips/tcg/octeon_translate.c
+++ b/target/mips/tcg/octeon_translate.c
@@ -15,7 +15,7 @@
 
 static bool trans_BBIT(DisasContext *ctx, arg_BBIT *a)
 {
-    TCGv p;
+    TCGv_i64 p;
 
     if (ctx->hflags & MIPS_HFLAG_BMASK) {
         LOG_DISAS("Branch in delay / forbidden slot at PC 0x%" VADDR_PRIx "\n",
@@ -25,14 +25,14 @@ static bool trans_BBIT(DisasContext *ctx, arg_BBIT *a)
     }
 
     /* Load needed operands */
-    TCGv t0 = tcg_temp_new();
+    TCGv_i64 t0 = tcg_temp_new_i64();
     gen_load_gpr(t0, a->rs);
 
-    p = tcg_constant_tl(1ULL << a->p);
+    p = tcg_constant_i64(1ULL << a->p);
     if (a->set) {
-        tcg_gen_and_tl(bcond, p, t0);
+        tcg_gen_and_i64(bcond, p, t0);
     } else {
-        tcg_gen_andc_tl(bcond, p, t0);
+        tcg_gen_andc_i64(bcond, p, t0);
     }
 
     ctx->hflags |= MIPS_HFLAG_BC;
@@ -43,34 +43,34 @@ static bool trans_BBIT(DisasContext *ctx, arg_BBIT *a)
 
 static bool trans_BADDU(DisasContext *ctx, arg_BADDU *a)
 {
-    TCGv t0, t1;
+    TCGv_i64 t0, t1;
 
     if (a->rt == 0) {
         /* nop */
         return true;
     }
 
-    t0 = tcg_temp_new();
-    t1 = tcg_temp_new();
+    t0 = tcg_temp_new_i64();
+    t1 = tcg_temp_new_i64();
     gen_load_gpr(t0, a->rs);
     gen_load_gpr(t1, a->rt);
 
-    tcg_gen_add_tl(t0, t0, t1);
+    tcg_gen_add_i64(t0, t0, t1);
     tcg_gen_andi_i64(cpu_gpr[a->rd], t0, 0xff);
     return true;
 }
 
 static bool trans_DMUL(DisasContext *ctx, arg_DMUL *a)
 {
-    TCGv t0, t1;
+    TCGv_i64 t0, t1;
 
     if (a->rt == 0) {
         /* nop */
         return true;
     }
 
-    t0 = tcg_temp_new();
-    t1 = tcg_temp_new();
+    t0 = tcg_temp_new_i64();
+    t1 = tcg_temp_new_i64();
     gen_load_gpr(t0, a->rs);
     gen_load_gpr(t1, a->rt);
 
@@ -80,97 +80,97 @@ static bool trans_DMUL(DisasContext *ctx, arg_DMUL *a)
 
 static bool trans_EXTS(DisasContext *ctx, arg_EXTS *a)
 {
-    TCGv t0;
+    TCGv_i64 t0;
 
     if (a->rt == 0) {
         /* nop */
         return true;
     }
 
-    t0 = tcg_temp_new();
+    t0 = tcg_temp_new_i64();
     gen_load_gpr(t0, a->rs);
-    tcg_gen_sextract_tl(t0, t0, a->p, a->lenm1 + 1);
+    tcg_gen_sextract_i64(t0, t0, a->p, a->lenm1 + 1);
     gen_store_gpr(t0, a->rt);
     return true;
 }
 
 static bool trans_CINS(DisasContext *ctx, arg_CINS *a)
 {
-    TCGv t0;
+    TCGv_i64 t0;
 
     if (a->rt == 0) {
         /* nop */
         return true;
     }
 
-    t0 = tcg_temp_new();
+    t0 = tcg_temp_new_i64();
     gen_load_gpr(t0, a->rs);
-    tcg_gen_deposit_z_tl(t0, t0, a->p, a->lenm1 + 1);
+    tcg_gen_deposit_z_i64(t0, t0, a->p, a->lenm1 + 1);
     gen_store_gpr(t0, a->rt);
     return true;
 }
 
 static bool trans_POP(DisasContext *ctx, arg_POP *a)
 {
-    TCGv t0;
+    TCGv_i64 t0;
 
     if (a->rd == 0) {
         /* nop */
         return true;
     }
 
-    t0 = tcg_temp_new();
+    t0 = tcg_temp_new_i64();
     gen_load_gpr(t0, a->rs);
     if (!a->dw) {
         tcg_gen_andi_i64(t0, t0, 0xffffffff);
     }
-    tcg_gen_ctpop_tl(t0, t0);
+    tcg_gen_ctpop_i64(t0, t0);
     gen_store_gpr(t0, a->rd);
     return true;
 }
 
 static bool trans_SEQNE(DisasContext *ctx, arg_SEQNE *a)
 {
-    TCGv t0, t1;
+    TCGv_i64 t0, t1;
 
     if (a->rd == 0) {
         /* nop */
         return true;
     }
 
-    t0 = tcg_temp_new();
-    t1 = tcg_temp_new();
+    t0 = tcg_temp_new_i64();
+    t1 = tcg_temp_new_i64();
 
     gen_load_gpr(t0, a->rs);
     gen_load_gpr(t1, a->rt);
 
     if (a->ne) {
-        tcg_gen_setcond_tl(TCG_COND_NE, cpu_gpr[a->rd], t1, t0);
+        tcg_gen_setcond_i64(TCG_COND_NE, cpu_gpr[a->rd], t1, t0);
     } else {
-        tcg_gen_setcond_tl(TCG_COND_EQ, cpu_gpr[a->rd], t1, t0);
+        tcg_gen_setcond_i64(TCG_COND_EQ, cpu_gpr[a->rd], t1, t0);
     }
     return true;
 }
 
 static bool trans_SEQNEI(DisasContext *ctx, arg_SEQNEI *a)
 {
-    TCGv t0;
+    TCGv_i64 t0;
 
     if (a->rt == 0) {
         /* nop */
         return true;
     }
 
-    t0 = tcg_temp_new();
+    t0 = tcg_temp_new_i64();
 
     gen_load_gpr(t0, a->rs);
 
     /* Sign-extend to 64 bit value */
     target_ulong imm = a->imm;
     if (a->ne) {
-        tcg_gen_setcondi_tl(TCG_COND_NE, cpu_gpr[a->rt], t0, imm);
+        tcg_gen_setcondi_i64(TCG_COND_NE, cpu_gpr[a->rt], t0, imm);
     } else {
-        tcg_gen_setcondi_tl(TCG_COND_EQ, cpu_gpr[a->rt], t0, imm);
+        tcg_gen_setcondi_i64(TCG_COND_EQ, cpu_gpr[a->rt], t0, imm);
     }
     return true;
 }
diff --git a/target/mips/tcg/tx79_translate.c b/target/mips/tcg/tx79_translate.c
index ae3f5e19c43..e071c867631 100644
--- a/target/mips/tcg/tx79_translate.c
+++ b/target/mips/tcg/tx79_translate.c
@@ -241,8 +241,8 @@ static bool trans_parallel_compare(DisasContext *ctx, arg_r *a,
         return true;
     }
 
-    c0 = tcg_constant_tl(0);
-    c1 = tcg_constant_tl(0xffffffff);
+    c0 = tcg_constant_i64(0);
+    c1 = tcg_constant_i64(0xffffffff);
     ax = tcg_temp_new_i64();
     bx = tcg_temp_new_i64();
     t0 = tcg_temp_new_i64();
@@ -322,7 +322,7 @@ static bool trans_PCEQW(DisasContext *ctx, arg_r *a)
 static bool trans_LQ(DisasContext *ctx, arg_i *a)
 {
     TCGv_i64 t0;
-    TCGv addr;
+    TCGv_i64 addr;
 
     if (a->rt == 0) {
         /* nop */
@@ -330,14 +330,14 @@ static bool trans_LQ(DisasContext *ctx, arg_i *a)
     }
 
     t0 = tcg_temp_new_i64();
-    addr = tcg_temp_new();
+    addr = tcg_temp_new_i64();
 
     gen_base_offset_addr(ctx, addr, a->base, a->offset);
     /*
      * Clear least-significant four bits of the effective
      * address, effectively creating an aligned address.
      */
-    tcg_gen_andi_tl(addr, addr, ~0xf);
+    tcg_gen_andi_i64(addr, addr, ~0xf);
 
     /* Lower half */
     tcg_gen_qemu_ld_i64(t0, addr, ctx->mem_idx, mo_endian(ctx) | MO_UQ);
@@ -353,14 +353,14 @@ static bool trans_LQ(DisasContext *ctx, arg_i *a)
 static bool trans_SQ(DisasContext *ctx, arg_i *a)
 {
     TCGv_i64 t0 = tcg_temp_new_i64();
-    TCGv addr = tcg_temp_new();
+    TCGv_i64 addr = tcg_temp_new_i64();
 
     gen_base_offset_addr(ctx, addr, a->base, a->offset);
     /*
      * Clear least-significant four bits of the effective
      * address, effectively creating an aligned address.
      */
-    tcg_gen_andi_tl(addr, addr, ~0xf);
+    tcg_gen_andi_i64(addr, addr, ~0xf);
 
     /* Lower half */
     gen_load_gpr(t0, a->rt);
-- 
2.53.0

[PULL 073/110] target/mips: Pass MemOpIdx argument to Linked Load/Store helpers

[Philippe Mathieu-Daudé]

In preparation of using the MemOp content in the next commit
(thus stopping ignoring it), pass it as MemOpIdx.

The helper prototype declaration always took a TCGv_i32 as
last argument, correct that.

Rename the ignored 'mem_idx' argument on user emulation.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260417042620.35329-2-philmd@linaro.org>
---
 target/mips/helper.h          | 4 ++--
 target/mips/tcg/ldst_helper.c | 5 ++++-
 target/mips/tcg/translate.c   | 7 ++++---
 3 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/target/mips/helper.h b/target/mips/helper.h
index b6cd53c8538..e2b83a1d19d 100644
--- a/target/mips/helper.h
+++ b/target/mips/helper.h
@@ -10,9 +10,9 @@ DEF_HELPER_4(swl, void, env, tl, tl, int)
 DEF_HELPER_4(swr, void, env, tl, tl, int)
 
 #ifndef CONFIG_USER_ONLY
-DEF_HELPER_3(ll, tl, env, tl, int)
+DEF_HELPER_3(ll, tl, env, tl, i32)
 #ifdef TARGET_MIPS64
-DEF_HELPER_3(lld, tl, env, tl, int)
+DEF_HELPER_3(lld, tl, env, tl, i32)
 #endif
 #endif
 
diff --git a/target/mips/tcg/ldst_helper.c b/target/mips/tcg/ldst_helper.c
index 537f3e87bc0..b36b12d87d6 100644
--- a/target/mips/tcg/ldst_helper.c
+++ b/target/mips/tcg/ldst_helper.c
@@ -30,8 +30,11 @@
 #ifndef CONFIG_USER_ONLY
 
 #define HELPER_LD_ATOMIC(name, insn, almask, do_cast)                         \
-target_ulong helper_##name(CPUMIPSState *env, target_ulong arg, int mem_idx)  \
+target_ulong helper_##name(CPUMIPSState *env, target_ulong arg,               \
+                           uint32_t memop_idx)                                \
 {                                                                             \
+    MemOpIdx oi = memop_idx; \
+    unsigned mem_idx = get_mmuidx(oi); \
     if (arg & almask) {                                                       \
         if (!(env->hflags & MIPS_HFLAG_DM)) {                                 \
             env->CP0_BadVAddr = arg;                                          \
diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
index e334cf98b78..ee6199875cf 100644
--- a/target/mips/tcg/translate.c
+++ b/target/mips/tcg/translate.c
@@ -1922,7 +1922,7 @@ FOP_CONDNS(s, FMT_S, 32, gen_store_fpr32(ctx, fp0, fd))
 /* load/store instructions. */
 #ifdef CONFIG_USER_ONLY
 #define OP_LD_ATOMIC(insn, memop)                                          \
-static inline void op_ld_##insn(TCGv ret, TCGv arg1, int mem_idx,          \
+static inline void op_ld_##insn(TCGv ret, TCGv arg1, int mem_idx_ignored,  \
                                 DisasContext *ctx)                         \
 {                                                                          \
     TCGv t0 = tcg_temp_new();                                              \
@@ -1932,11 +1932,12 @@ static inline void op_ld_##insn(TCGv ret, TCGv arg1, int mem_idx,          \
     tcg_gen_st_tl(ret, tcg_env, offsetof(CPUMIPSState, llval));            \
 }
 #else
-#define OP_LD_ATOMIC(insn, ignored_memop)                                  \
+#define OP_LD_ATOMIC(insn, memop)                                          \
 static inline void op_ld_##insn(TCGv ret, TCGv arg1, int mem_idx,          \
                                 DisasContext *ctx)                         \
 {                                                                          \
-    gen_helper_##insn(ret, tcg_env, arg1, tcg_constant_i32(mem_idx));      \
+    MemOpIdx oi = make_memop_idx(memop, mem_idx);                          \
+    gen_helper_##insn(ret, tcg_env, arg1, tcg_constant_i32(oi));           \
 }
 #endif
 OP_LD_ATOMIC(ll, mo_endian(ctx) | MO_SL);
-- 
2.53.0

[PULL 074/110] target/mips: Inline cpu_ld/st_mmuidx_ra() calls in Atomic LD/ST helpers

[Philippe Mathieu-Daudé]

Have callers set MO_ALIGN in the MemOp bits.

Perform the access first, filling the TLB in the process.
If the tlb cannot be filled, access is not permitted, and
an exception is raised. Thus remove the now unnecessary
do_raise_exception() call.

Since the TLB is filled, use probe_access() to get CP0_LLAddr.

Move env->CP0_LLAddr and env->lladdr assignments so we
don't update them when an alignment fault occurs.

Since we have a handy MemOpIdx, replace the legacy
cpu_ld*_mmuidx_ra() calls by cpu_ld*_mmu() equivalent.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260417042620.35329-3-philmd@linaro.org>
---
 target/mips/tcg/ldst_helper.c | 26 +++++++++++++++-----------
 target/mips/tcg/translate.c   |  2 +-
 2 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/target/mips/tcg/ldst_helper.c b/target/mips/tcg/ldst_helper.c
index b36b12d87d6..1b25466b496 100644
--- a/target/mips/tcg/ldst_helper.c
+++ b/target/mips/tcg/ldst_helper.c
@@ -28,23 +28,27 @@
 #include "internal.h"
 
 #ifndef CONFIG_USER_ONLY
+#include "accel/tcg/probe.h"
+#include "exec/tlb-flags.h"
 
 #define HELPER_LD_ATOMIC(name, insn, almask, do_cast)                         \
 target_ulong helper_##name(CPUMIPSState *env, target_ulong arg,               \
                            uint32_t memop_idx)                                \
 {                                                                             \
-    MemOpIdx oi = memop_idx; \
-    unsigned mem_idx = get_mmuidx(oi); \
-    if (arg & almask) {                                                       \
-        if (!(env->hflags & MIPS_HFLAG_DM)) {                                 \
-            env->CP0_BadVAddr = arg;                                          \
-        }                                                                     \
-        do_raise_exception(env, EXCP_AdEL, GETPC());                          \
-    }                                                                         \
-    env->CP0_LLAddr = cpu_mips_translate_address(env, arg, MMU_DATA_LOAD,     \
-                                                 GETPC());                    \
+    MemOpIdx oi = memop_idx;                                                  \
+    unsigned mem_idx = get_mmuidx(oi);                                        \
+    unsigned size = memop_size(get_memop(oi));                                \
+    uintptr_t ra = GETPC();                                                   \
+    CPUTLBEntryFull *full;                                                    \
+    void *host_unused;                                                        \
+    int flags;                                                                \
+                                                                              \
+    env->llval = do_cast cpu_##insn##_mmu(env, arg, oi, ra);                  \
+    flags = probe_access_full(env, arg, size, MMU_DATA_LOAD, mem_idx,         \
+                              true, &host_unused, &full, ra);                 \
+    assert(!(flags & TLB_INVALID_MASK));                                      \
+    env->CP0_LLAddr = full->phys_addr;                                        \
     env->lladdr = arg;                                                        \
-    env->llval = do_cast cpu_##insn##_mmuidx_ra(env, arg, mem_idx, GETPC());  \
     return env->llval;                                                        \
 }
 HELPER_LD_ATOMIC(ll, ldl, 0x3, (target_long)(int32_t))
diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
index ee6199875cf..fff6390f5d4 100644
--- a/target/mips/tcg/translate.c
+++ b/target/mips/tcg/translate.c
@@ -1936,7 +1936,7 @@ static inline void op_ld_##insn(TCGv ret, TCGv arg1, int mem_idx_ignored,  \
 static inline void op_ld_##insn(TCGv ret, TCGv arg1, int mem_idx,          \
                                 DisasContext *ctx)                         \
 {                                                                          \
-    MemOpIdx oi = make_memop_idx(memop, mem_idx);                          \
+    MemOpIdx oi = make_memop_idx(memop | MO_ALIGN, mem_idx);               \
     gen_helper_##insn(ret, tcg_env, arg1, tcg_constant_i32(oi));           \
 }
 #endif
-- 
2.53.0

[PULL 075/110] target/mips: Inline translator_ld[uw,l,q]() calls

[Philippe Mathieu-Daudé]

In preparation of removing the translator_ld[uw,l,q]() methods,
inline them for the MIPS target, expanding MO_TE by a runtime
check on mo_endian(ctx).

Mechanical change using the following Coccinelle 'spatch' script:

  @@
  expression env, db, pc;
  @@
  (
  - translator_lduw(env, db, pc)
  + translator_lduw_end(env, db, pc, mo_endian(ctx))
  |
  - translator_ldl(env, db, pc)
  + translator_ldl_end(env, db, pc, mo_endian(ctx))
  |
  - translator_ldq(env, db, pc)
  + translator_ldq_end(env, db, pc, mo_endian(ctx))
  )

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260417042620.35329-4-philmd@linaro.org>
---
 target/mips/tcg/translate.c               | 12 ++++++++----
 target/mips/tcg/micromips_translate.c.inc |  2 +-
 target/mips/tcg/mips16e_translate.c.inc   |  6 ++++--
 target/mips/tcg/nanomips_translate.c.inc  |  5 +++--
 4 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
index fff6390f5d4..54ed253a7d0 100644
--- a/target/mips/tcg/translate.c
+++ b/target/mips/tcg/translate.c
@@ -15149,17 +15149,21 @@ static void mips_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
 
     is_slot = ctx->hflags & MIPS_HFLAG_BMASK;
     if (ctx->insn_flags & ISA_NANOMIPS32) {
-        ctx->opcode = translator_lduw(env, &ctx->base, ctx->base.pc_next);
+        ctx->opcode = translator_lduw_end(env, &ctx->base, ctx->base.pc_next,
+                                          mo_endian(ctx));
         insn_bytes = decode_isa_nanomips(env, ctx);
     } else if (!(ctx->hflags & MIPS_HFLAG_M16)) {
-        ctx->opcode = translator_ldl(env, &ctx->base, ctx->base.pc_next);
+        ctx->opcode = translator_ldl_end(env, &ctx->base, ctx->base.pc_next,
+                                         mo_endian(ctx));
         insn_bytes = 4;
         decode_opc(env, ctx);
     } else if (ctx->insn_flags & ASE_MICROMIPS) {
-        ctx->opcode = translator_lduw(env, &ctx->base, ctx->base.pc_next);
+        ctx->opcode = translator_lduw_end(env, &ctx->base, ctx->base.pc_next,
+                                          mo_endian(ctx));
         insn_bytes = decode_isa_micromips(env, ctx);
     } else if (ctx->insn_flags & ASE_MIPS16) {
-        ctx->opcode = translator_lduw(env, &ctx->base, ctx->base.pc_next);
+        ctx->opcode = translator_lduw_end(env, &ctx->base, ctx->base.pc_next,
+                                          mo_endian(ctx));
         insn_bytes = decode_ase_mips16e(env, ctx);
     } else {
         gen_reserved_instruction(ctx);
diff --git a/target/mips/tcg/micromips_translate.c.inc b/target/mips/tcg/micromips_translate.c.inc
index da2419792eb..07172a6c7fe 100644
--- a/target/mips/tcg/micromips_translate.c.inc
+++ b/target/mips/tcg/micromips_translate.c.inc
@@ -1629,7 +1629,7 @@ static void decode_micromips32_opc(CPUMIPSState *env, DisasContext *ctx)
     uint32_t op, minor, minor2, mips32_op;
     uint32_t cond, fmt, cc;
 
-    insn = translator_lduw(env, &ctx->base, ctx->base.pc_next + 2);
+    insn = translator_lduw_end(env, &ctx->base, ctx->base.pc_next + 2, mo_endian(ctx));
     ctx->opcode = (ctx->opcode << 16) | insn;
 
     rt = (ctx->opcode >> 21) & 0x1f;
diff --git a/target/mips/tcg/mips16e_translate.c.inc b/target/mips/tcg/mips16e_translate.c.inc
index 97da3456ea5..beb5b04ea29 100644
--- a/target/mips/tcg/mips16e_translate.c.inc
+++ b/target/mips/tcg/mips16e_translate.c.inc
@@ -453,7 +453,8 @@ static void decode_i64_mips16(DisasContext *ctx,
 
 static int decode_extended_mips16_opc(CPUMIPSState *env, DisasContext *ctx)
 {
-    int extend = translator_lduw(env, &ctx->base, ctx->base.pc_next + 2);
+    int extend = translator_lduw_end(env, &ctx->base, ctx->base.pc_next + 2,
+                                     mo_endian(ctx));
     int op, rx, ry, funct, sa;
     int16_t imm, offset;
 
@@ -686,7 +687,8 @@ static int decode_ase_mips16e(CPUMIPSState *env, DisasContext *ctx)
         /* No delay slot, so just process as a normal instruction */
         break;
     case M16_OPC_JAL:
-        offset = translator_lduw(env, &ctx->base, ctx->base.pc_next + 2);
+        offset = translator_lduw_end(env, &ctx->base, ctx->base.pc_next + 2,
+                                     mo_endian(ctx));
         offset = (((ctx->opcode & 0x1f) << 21)
                   | ((ctx->opcode >> 5) & 0x1f) << 16
                   | offset) << 2;
diff --git a/target/mips/tcg/nanomips_translate.c.inc b/target/mips/tcg/nanomips_translate.c.inc
index 9d4e0bee81f..4b0b01ba37a 100644
--- a/target/mips/tcg/nanomips_translate.c.inc
+++ b/target/mips/tcg/nanomips_translate.c.inc
@@ -3551,7 +3551,7 @@ static int decode_nanomips_32_48_opc(CPUMIPSState *env, DisasContext *ctx)
     int offset;
     int imm;
 
-    insn = translator_lduw(env, &ctx->base, ctx->base.pc_next + 2);
+    insn = translator_lduw_end(env, &ctx->base, ctx->base.pc_next + 2, mo_endian(ctx));
     ctx->opcode = (ctx->opcode << 16) | insn;
 
     rt = extract32(ctx->opcode, 21, 5);
@@ -3665,7 +3665,8 @@ static int decode_nanomips_32_48_opc(CPUMIPSState *env, DisasContext *ctx)
         break;
     case NM_P48I:
         {
-            insn = translator_lduw(env, &ctx->base, ctx->base.pc_next + 4);
+            insn = translator_lduw_end(env, &ctx->base, ctx->base.pc_next + 4,
+                                       mo_endian(ctx));
             target_long addr_off = extract32(ctx->opcode, 0, 16) | insn << 16;
             switch (extract32(ctx->opcode, 16, 5)) {
             case NM_LI48:
-- 
2.53.0

[PULL 076/110] target/mips: Remove last MO_TE use

[Philippe Mathieu-Daudé]

Unfortunately commit 54821ff6e90 ("target/mips: Convert mips16e
decr_and_load/store() macros to functions") got rebased on top
of commit 2803e24694c ("target/mips: Replace MO_TE by mo_endian")
and we missed the replacement. Fix that.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260417042620.35329-5-philmd@linaro.org>
---
 target/mips/tcg/mips16e_translate.c.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/mips/tcg/mips16e_translate.c.inc b/target/mips/tcg/mips16e_translate.c.inc
index beb5b04ea29..e83587971d4 100644
--- a/target/mips/tcg/mips16e_translate.c.inc
+++ b/target/mips/tcg/mips16e_translate.c.inc
@@ -293,7 +293,7 @@ static void decr_and_load(DisasContext *ctx, unsigned regidx, TCGv t0)
 
     tcg_gen_movi_tl(t2, -4);
     gen_op_addr_add(ctx, t0, t0, t2);
-    tcg_gen_qemu_ld_tl(t1, t0, ctx->mem_idx, MO_TE | MO_SL |
+    tcg_gen_qemu_ld_tl(t1, t0, ctx->mem_idx, mo_endian(ctx) | MO_SL |
                        ctx->default_tcg_memop_mask);
     gen_store_gpr(t1, regidx);
 }
-- 
2.53.0

[PULL 077/110] meson: Allow building with empty target_arch[] source set

[Philippe Mathieu-Daudé]

Complete commit 83d5db95d38 ("meson: Allow system binaries
to not have target-specific units") with yet another guard,
allowing empty target_arch[] source sets for some targets.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-Id: <20260506133216.18730-1-philmd@linaro.org>
---
 meson.build | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/meson.build b/meson.build
index 4176d020c21..987f33bacee 100644
--- a/meson.build
+++ b/meson.build
@@ -4332,9 +4332,11 @@ foreach target : target_dirs
     arch_srcs += files('target-info-stub.c')
   endif
 
-  t = target_arch[target_base_arch].apply(config_target, strict: false)
-  arch_srcs += t.sources()
-  arch_deps += t.dependencies()
+  if target_base_arch in target_arch
+    t = target_arch[target_base_arch].apply(config_target, strict: false)
+    arch_srcs += t.sources()
+    arch_deps += t.dependencies()
+  endif
 
   target_common = common_ss.apply(config_target, strict: false)
   objects = [common_all.extract_objects(target_common.sources())]
-- 
2.53.0

[PULL 078/110] meson.build: define stubs library per target base architecture

[Philippe Mathieu-Daudé]

From: Pierrick Bouvier <pierrick.bouvier@linaro.org>

QEMU stubs (from stubs folder) have a unique feature: they emulate weak
symbols. Weak symbols are not supported on Windows with gcc. This is
achieved by defining a static library, so the linker can pick a file
only when one of its symbol is needed.

The problem is that common stubs are embedded in qemuutil, which is
defined and created before any target code. Thus, to benefit from the
same feature for target code, we need to create stub static libraries
for each target architecture.

To keep things simple, we declare one library per target base
architecture. This implies that stubs are compiled only once, and we
choose them to be system common files. This is not a big issue, since
stubs definition have no specific behaviour, out of returning a default
value, or stopping execution, which makes this safe to link them in user
binaries also.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20260424230103.1579600-2-pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 meson.build | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/meson.build b/meson.build
index 987f33bacee..5fbdc75a0fc 100644
--- a/meson.build
+++ b/meson.build
@@ -3738,6 +3738,7 @@ target_user_arch = {}
 hw_common_arch = {}
 target_common_arch = {}
 target_common_system_arch = {}
+target_stubs_arch = {}
 
 # NOTE: the trace/ subdirectory needs the qapi_trace_events variable
 # that is filled in by qapi/.
@@ -4143,6 +4144,7 @@ common_all = static_library('common',
 # construct common libraries per base architecture
 target_common_arch_libs = {}
 target_common_system_arch_libs = {}
+target_stubs_arch_libs = {}
 foreach target_base_arch, config_base_arch : config_base_arch_mak
   target_inc = [include_directories('target' / target_base_arch)]
   inc = [common_user_inc + target_inc]
@@ -4202,6 +4204,15 @@ foreach target_base_arch, config_base_arch : config_base_arch_mak
       dependencies: src.all_dependencies() + common_deps + system_deps)
     target_common_system_arch_libs += {target_base_arch: lib}
   endif
+
+  if target_base_arch in target_stubs_arch
+    src = target_stubs_arch[target_base_arch]
+    lib = static_library('stubs_' + target_base_arch,
+                         sources: src.all_sources() + genh,
+                         include_directories: inc,
+                         c_args: target_system_c_args)
+    target_stubs_arch_libs += {target_base_arch: lib}
+  endif
 endforeach
 
 if have_rust
@@ -4363,6 +4374,11 @@ foreach target : target_dirs
     objects += lib.extract_objects(src.sources())
     arch_deps += src.dependencies()
   endif
+  lib_target_stubs = []
+  if target_base_arch in target_stubs_arch_libs
+    lib_target_stubs = [target_stubs_arch_libs[target_base_arch]]
+  endif
+  target_stubs = declare_dependency(link_with: lib_target_stubs)
 
   target_specific = specific_ss.apply(config_target, strict: false)
   arch_srcs += target_specific.sources()
@@ -4408,14 +4424,14 @@ foreach target : target_dirs
       'name': 'qemu-system-' + target_name,
       'win_subsystem': 'console',
       'sources': [main_rs, files('system/main.c')],
-      'dependencies': [sdl]
+      'dependencies': [sdl, target_stubs],
     }]
     if host_os == 'windows' and (sdl.found() or gtk.found())
       execs += [{
         'name': 'qemu-system-' + target_name + 'w',
         'win_subsystem': 'windows',
         'sources': [main_rs, files('system/main.c')],
-        'dependencies': [sdl]
+        'dependencies': [sdl, target_stubs],
       }]
     endif
     if get_option('fuzzing')
@@ -4432,7 +4448,7 @@ foreach target : target_dirs
       'name': 'qemu-' + target_name,
       'win_subsystem': 'console',
       'sources': [],
-      'dependencies': []
+      'dependencies': [target_stubs]
     }]
   endif
   foreach exe: execs
-- 
2.53.0

[PULL 079/110] tcg: Include missing 'tcg/tcg-op-common.h' header in 'tcg-op-mem.h'

[Philippe Mathieu-Daudé]

"tcg-op-mem.h" uses methods declared in "tcg/tcg-op-common.h".
Include the latter to avoid when including the former:

  include/tcg/tcg-op-mem.h:34:5: error: call to undeclared function 'tcg_gen_qemu_ld_i32_chk'
   34 |     tcg_gen_qemu_ld_i32_chk(v, tcgv_va_temp(a), i, m, TCG_TYPE_VA);
      |     ^

  $ git grep -w tcg_gen_qemu_ld_i32_chk
  include/tcg/tcg-op-common.h:328:void tcg_gen_qemu_ld_i32_chk(TCGv_i32, TCGTemp *, TCGArg, MemOp, TCGType);
  include/tcg/tcg-op-mem.h:35:    tcg_gen_qemu_ld_i32_chk(v, tcgv_va_temp(a), i, m, TCG_TYPE_VA);
  tcg/tcg-op-ldst.c:286:void tcg_gen_qemu_ld_i32_chk(TCGv_i32 val, TCGTemp *addr, TCGArg idx,

Cc: qemu-stable@nongnu.org
Fixes: a8af0fb24da ("include/tcg/tcg-op: extract memory operations to tcg-op-mem.h")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20260423135035.50126-2-philmd@linaro.org>
---
 include/tcg/tcg-op-mem.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/tcg/tcg-op-mem.h b/include/tcg/tcg-op-mem.h
index 36931d1dd57..ea35a02fb40 100644
--- a/include/tcg/tcg-op-mem.h
+++ b/include/tcg/tcg-op-mem.h
@@ -12,6 +12,8 @@
 #error TCG_ADDRESS_BITS must be defined
 #endif
 
+#include "tcg/tcg-op-common.h"
+
 #if TCG_ADDRESS_BITS == 32
 typedef TCGv_i32 TCGv_va;
 #define TCG_TYPE_VA TCG_TYPE_I32
-- 
2.53.0

[PULL 080/110] target/arm: define stub library

[Philippe Mathieu-Daudé]

From: Pierrick Bouvier <pierrick.bouvier@linaro.org>

We use the mechanic introduced in previous commit to define a arm stubs
library. With this, we are able to eliminate symbol conflicts when
linking arm and aarch64 targets, and get one step closer to having a
single-binary.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20260424230103.1579600-3-pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/arm/meson.build     | 8 +++-----
 target/arm/tcg/meson.build | 2 +-
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/target/arm/meson.build b/target/arm/meson.build
index 192ac7c31ee..4723f9f170a 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -2,6 +2,7 @@ arm_ss = ss.source_set()
 arm_common_ss = ss.source_set()
 arm_common_system_ss = ss.source_set()
 arm_system_ss = ss.source_set()
+arm_stubs_ss = ss.source_set()
 arm_user_ss = ss.source_set()
 
 arm_common_system_ss.add(files('gdbstub.c'))
@@ -23,9 +24,7 @@ arm_system_ss.add(when: 'CONFIG_KVM', if_true: files('hyp_gdbstub.c', 'kvm.c'))
 arm_system_ss.add(when: 'CONFIG_HVF', if_true: files('hyp_gdbstub.c'))
 
 arm_user_ss.add(files('cpu.c'))
-arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files(
-  'cpu32-stubs.c',
-))
+arm_stubs_ss.add(files('cpu32-stubs.c'))
 arm_user_ss.add(files(
   'cpregs-gcs.c',
   'cpregs-pmu.c',
@@ -39,8 +38,6 @@ arm_user_ss.add(when: 'CONFIG_ARM_COMPATIBLE_SEMIHOSTING',
 		        if_true: files('common-semi-target.c'))
 
 arm_common_system_ss.add(files('cpu.c'))
-arm_common_system_ss.add(when: 'TARGET_AARCH64', if_false: files(
-  'cpu32-stubs.c'))
 arm_common_system_ss.add(when: 'CONFIG_KVM', if_false: files('kvm-stub.c'))
 arm_common_system_ss.add(when: 'CONFIG_ARM_COMPATIBLE_SEMIHOSTING',
 		                 if_true: files('common-semi-target.c'))
@@ -73,3 +70,4 @@ target_system_arch += {'arm': arm_system_ss}
 target_user_arch += {'arm': arm_user_ss}
 target_common_arch += {'arm': arm_common_ss}
 target_common_system_arch += {'arm': arm_common_system_ss}
+target_stubs_arch += {'arm': arm_stubs_ss}
diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
index 02774409e56..d2364aa39c4 100644
--- a/target/arm/tcg/meson.build
+++ b/target/arm/tcg/meson.build
@@ -28,7 +28,7 @@ translate32_d = [
 ]
 
 arm_ss.add(when: 'TARGET_AARCH64', if_true: gen_a64)
-arm_ss.add(when: 'TARGET_AARCH64', if_false: files('stubs32.c'))
+arm_stubs_ss.add(files('stubs32.c'))
 
 arm_ss.add(files(
   'cpu32.c',
-- 
2.53.0

[PULL 081/110] target/microblaze: Fix endianness used to disassemble

[Philippe Mathieu-Daudé]

MicroBlaze CPU model has a "little-endian" property, pointing to
the @endi internal field. Commit c36ec3a9655 ("hw/microblaze:
Explicit CPU endianness") took care of having all MicroBlaze
boards with an explicit default endianness (similarly with
commit 91fc6d8101d for linux-user binaries), so later commit
415aae543ed ("target/microblaze: Consider endianness while
translating code") could infer the endianness at runtime from
the @endi field, and not a compile time via the TARGET_BIG_ENDIAN
definition. Doing so, we forgot to propagate that runtime change
to the disassemble_info structure. Do it now to display the
opcodes in correct endianness order.

Cc: qemu-stable@nongnu.org
Fixes: 415aae543ed ("target/microblaze: Consider endianness while translating code")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Message-Id: <20260423100612.27278-3-philmd@linaro.org>
---
 target/microblaze/cpu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index ec513ae82d4..639f46b525e 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -237,8 +237,8 @@ static void mb_disas_set_info(const CPUState *cpu, disassemble_info *info)
 {
     info->mach = bfd_arch_microblaze;
     info->print_insn = print_insn_microblaze;
-    info->endian = TARGET_BIG_ENDIAN ? BFD_ENDIAN_BIG
-                                     : BFD_ENDIAN_LITTLE;
+    info->endian = MICROBLAZE_CPU(cpu)->cfg.endi ? BFD_ENDIAN_LITTLE
+                                                 : BFD_ENDIAN_BIG;
 }
 
 static void mb_cpu_realizefn(DeviceState *dev, Error **errp)
-- 
2.53.0

[PULL 082/110] target/microblaze: Replace translator_ldl_swap() -> translator_ldl_end()

[Philippe Mathieu-Daudé]

In preparation of removing the translator_ld[uw,l,q]() methods,
inline them for the microblaze targets, using mo_endian(ctx) --
which we introduced in commit 2c9e8ddd7699 -- instead of MO_TE.
Remove mb_cpu_is_big_endian() which is now unused.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Message-Id: <20260423100612.27278-4-philmd@linaro.org>
---
 target/microblaze/cpu.h       | 7 -------
 target/microblaze/translate.c | 4 ++--
 2 files changed, 2 insertions(+), 9 deletions(-)

diff --git a/target/microblaze/cpu.h b/target/microblaze/cpu.h
index 5765786e6dc..ad5a4a8e7bf 100644
--- a/target/microblaze/cpu.h
+++ b/target/microblaze/cpu.h
@@ -412,13 +412,6 @@ void mb_translate_code(CPUState *cs, TranslationBlock *tb,
 /* Ensure there is no overlap between the two masks. */
 QEMU_BUILD_BUG_ON(MSR_TB_MASK & IFLAGS_TB_MASK);
 
-static inline bool mb_cpu_is_big_endian(CPUState *cs)
-{
-    MicroBlazeCPU *cpu = MICROBLAZE_CPU(cs);
-
-    return !cpu->cfg.endi;
-}
-
 #if !defined(CONFIG_USER_ONLY)
 bool mb_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                      MMUAccessType access_type, int mmu_idx,
diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index 5e8bb4ed77b..8fee5dbc337 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -1646,8 +1646,8 @@ static void mb_tr_translate_insn(DisasContextBase *dcb, CPUState *cs)
 
     dc->tb_flags_to_set = 0;
 
-    ir = translator_ldl_swap(cpu_env(cs), &dc->base, dc->base.pc_next,
-                             mb_cpu_is_big_endian(cs) != TARGET_BIG_ENDIAN);
+    ir = translator_ldl_end(cpu_env(cs), &dc->base, dc->base.pc_next,
+                            mo_endian(dc));
     if (!decode(dc, ir)) {
         trap_illegal(dc, true);
     }
-- 
2.53.0

[PULL 083/110] target/microblaze: Introduce common system/user meson source set

[Philippe Mathieu-Daudé]

Introduce a source set common to system / user.
No logical change intended.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Message-Id: <20260423100612.27278-5-philmd@linaro.org>
---
 target/microblaze/meson.build | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/target/microblaze/meson.build b/target/microblaze/meson.build
index b86b37d9238..7f7d27d4efa 100644
--- a/target/microblaze/meson.build
+++ b/target/microblaze/meson.build
@@ -1,5 +1,10 @@
 gen = decodetree.process('insns.decode')
 
+microblaze_common_ss = ss.source_set()
+microblaze_common_ss.add(files(
+  'gdbstub.c',
+))
+
 microblaze_ss = ss.source_set()
 microblaze_ss.add(gen)
 microblaze_ss.add(files(
@@ -10,10 +15,10 @@ microblaze_ss.add(files(
 ))
 
 microblaze_user_ss = ss.source_set()
-microblaze_user_ss.add(files('gdbstub.c'))
+microblaze_user_ss.add_all(microblaze_common_ss)
 
 microblaze_common_system_ss = ss.source_set()
-microblaze_common_system_ss.add(files('gdbstub.c'))
+microblaze_common_system_ss.add_all(microblaze_common_ss)
 
 microblaze_system_ss = ss.source_set()
 microblaze_system_ss.add(files(
-- 
2.53.0

[PULL 084/110] target/microblaze: Compile helper.c as common unit

[Philippe Mathieu-Daudé]

Nothing in helper.c prevents it to be built as common unit.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Message-Id: <20260423100612.27278-6-philmd@linaro.org>
---
 target/microblaze/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/microblaze/meson.build b/target/microblaze/meson.build
index 7f7d27d4efa..94c76de39bd 100644
--- a/target/microblaze/meson.build
+++ b/target/microblaze/meson.build
@@ -3,13 +3,13 @@ gen = decodetree.process('insns.decode')
 microblaze_common_ss = ss.source_set()
 microblaze_common_ss.add(files(
   'gdbstub.c',
+  'helper.c',
 ))
 
 microblaze_ss = ss.source_set()
 microblaze_ss.add(gen)
 microblaze_ss.add(files(
   'cpu.c',
-  'helper.c',
   'op_helper.c',
   'translate.c',
 ))
-- 
2.53.0

[PULL 085/110] target/microblaze: Compile op_helper.c as common unit

[Philippe Mathieu-Daudé]

In order do build op_helper.c as a common unit we simply
need to use the common version of "accel/tcg/cpu-ldst.h".

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Message-Id: <20260423100612.27278-7-philmd@linaro.org>
---
 target/microblaze/op_helper.c | 2 +-
 target/microblaze/meson.build | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/microblaze/op_helper.c b/target/microblaze/op_helper.c
index 31da2c7c3ae..84c60c2636e 100644
--- a/target/microblaze/op_helper.c
+++ b/target/microblaze/op_helper.c
@@ -23,7 +23,7 @@
 #include "cpu.h"
 #include "exec/helper-proto.h"
 #include "qemu/host-utils.h"
-#include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/cpu-ldst-common.h"
 #include "fpu/softfloat.h"
 
 void helper_put(uint32_t id, uint32_t ctrl, uint32_t data)
diff --git a/target/microblaze/meson.build b/target/microblaze/meson.build
index 94c76de39bd..add3e6ca9f9 100644
--- a/target/microblaze/meson.build
+++ b/target/microblaze/meson.build
@@ -4,13 +4,13 @@ microblaze_common_ss = ss.source_set()
 microblaze_common_ss.add(files(
   'gdbstub.c',
   'helper.c',
+  'op_helper.c',
 ))
 
 microblaze_ss = ss.source_set()
 microblaze_ss.add(gen)
 microblaze_ss.add(files(
   'cpu.c',
-  'op_helper.c',
   'translate.c',
 ))
 
-- 
2.53.0

[PULL 086/110] target/microblaze: Compile cpu.c as common unit

[Philippe Mathieu-Daudé]

In order do build cpu.c as a common unit we simply need
to use the common version of "accel/tcg/cpu-ldst.h".

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Message-Id: <20260423100612.27278-8-philmd@linaro.org>
---
 target/microblaze/cpu.c       | 2 +-
 target/microblaze/meson.build | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index 639f46b525e..04d31536888 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -27,7 +27,7 @@
 #include "cpu.h"
 #include "qemu/module.h"
 #include "hw/core/qdev-properties.h"
-#include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/cpu-ldst-common.h"
 #include "exec/gdbstub.h"
 #include "exec/translation-block.h"
 #include "fpu/softfloat-helpers.h"
diff --git a/target/microblaze/meson.build b/target/microblaze/meson.build
index add3e6ca9f9..2ce50f35397 100644
--- a/target/microblaze/meson.build
+++ b/target/microblaze/meson.build
@@ -2,6 +2,7 @@ gen = decodetree.process('insns.decode')
 
 microblaze_common_ss = ss.source_set()
 microblaze_common_ss.add(files(
+  'cpu.c',
   'gdbstub.c',
   'helper.c',
   'op_helper.c',
@@ -10,7 +11,6 @@ microblaze_common_ss.add(files(
 microblaze_ss = ss.source_set()
 microblaze_ss.add(gen)
 microblaze_ss.add(files(
-  'cpu.c',
   'translate.c',
 ))
 
-- 
2.53.0

[PULL 087/110] target/microblaze: Include missing cpu-mmu-index.h header in translate.c

[Philippe Mathieu-Daudé]

translate.c calls cpu_mmu_index(), itself defined in
"accel/tcg/cpu-mmu-index.h". This header is pulled in
indirectly via "accel/tcg/cpu-ldst.h", but since we'll
remove the latter in the next commit, make the inclusion
explicit, otherwise we'd get:

  ../target/microblaze/translate.c:1620:21: error: call to undeclared function 'cpu_mmu_index'
   1620 |     dc->mem_index = cpu_mmu_index(cs, false);
        |                     ^

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Message-Id: <20260423100612.27278-9-philmd@linaro.org>
---
 target/microblaze/translate.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index 8fee5dbc337..bf8f864c324 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -21,6 +21,7 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/cpu-mmu-index.h"
 #include "tcg/tcg-op.h"
 #include "exec/helper-proto.h"
 #include "exec/helper-gen.h"
-- 
2.53.0

[PULL 088/110] target/microblaze: Compile translate.c as common unit

[Philippe Mathieu-Daudé]

In order do build translate.c as a common unit we need to
replace:

  "accel/tcg/cpu-ldst.h" -> "accel/tcg/cpu-ldst-common.h"

and:

  #include "tcg/tcg-op.h" -> #include "tcg/tcg-op-common.h"
                          -> #include "tcg/tcg-op-mem.h"

taking care to define TCG_ADDRESS_BITS, which is fixed
for these 32-bit targets.

Remove the now empty microblaze_ss[] source set.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Message-Id: <20260423100612.27278-10-philmd@linaro.org>
---
 target/microblaze/translate.c | 6 ++++--
 target/microblaze/meson.build | 7 +------
 2 files changed, 5 insertions(+), 8 deletions(-)

diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index bf8f864c324..74b5420ed24 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -20,9 +20,11 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/cpu-ldst-common.h"
 #include "accel/tcg/cpu-mmu-index.h"
-#include "tcg/tcg-op.h"
+#define TCG_ADDRESS_BITS 32
+#include "tcg/tcg-op-common.h"
+#include "tcg/tcg-op-mem.h"
 #include "exec/helper-proto.h"
 #include "exec/helper-gen.h"
 #include "exec/translator.h"
diff --git a/target/microblaze/meson.build b/target/microblaze/meson.build
index 2ce50f35397..9c1ecd1cf1c 100644
--- a/target/microblaze/meson.build
+++ b/target/microblaze/meson.build
@@ -1,16 +1,12 @@
 gen = decodetree.process('insns.decode')
 
 microblaze_common_ss = ss.source_set()
+microblaze_common_ss.add(gen)
 microblaze_common_ss.add(files(
   'cpu.c',
   'gdbstub.c',
   'helper.c',
   'op_helper.c',
-))
-
-microblaze_ss = ss.source_set()
-microblaze_ss.add(gen)
-microblaze_ss.add(files(
   'translate.c',
 ))
 
@@ -26,7 +22,6 @@ microblaze_system_ss.add(files(
   'machine.c',
 ))
 
-target_arch += {'microblaze': microblaze_ss}
 target_user_arch += {'microblaze': microblaze_user_ss}
 target_system_arch += {'microblaze': microblaze_system_ss}
 target_common_system_arch += {'microblaze': microblaze_common_system_ss}
-- 
2.53.0

[PULL 089/110] target/s390x: Introduce common system/user meson source set

[Philippe Mathieu-Daudé]

Introduce a source set common to system / user. Start it
with the files built in both sets: 'cpu_models_user.c'
and 'gdbstub.c' No logical change intended.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20260423135035.50126-4-philmd@linaro.org>
---
 target/s390x/meson.build | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/target/s390x/meson.build b/target/s390x/meson.build
index 6f98ce34d73..44f58ac2919 100644
--- a/target/s390x/meson.build
+++ b/target/s390x/meson.build
@@ -1,4 +1,9 @@
 s390x_ss = ss.source_set()
+s390x_common_ss = ss.source_set()
+s390x_common_system_ss = ss.source_set()
+s390x_system_ss = ss.source_set()
+s390x_user_ss = ss.source_set()
+
 s390x_ss.add(files(
   'cpu.c',
   'cpu_features.c',
@@ -15,15 +20,16 @@ gen_features_h = custom_target('gen-features.h',
                                capture: true,
                                command: gen_features)
 
-s390x_ss.add(gen_features_h)
+s390x_common_ss.add(gen_features_h)
+s390x_common_ss.add(files(
+  'cpu_models_user.c',
+  'gdbstub.c',
+))
 
-s390x_system_ss = ss.source_set()
 s390x_system_ss.add(files(
   'ioinst.c',
 ))
 
-s390x_common_system_ss = ss.source_set()
-s390x_common_system_ss.add(gen_features_h)
 s390x_common_system_ss.add(files(
   'helper.c',
   'arch_dump.c',
@@ -32,19 +38,14 @@ s390x_common_system_ss.add(files(
   'mmu_helper.c',
   'sigp.c',
   'cpu-system.c',
-  'cpu_models_system.c',
-  'gdbstub.c',
-))
-
-s390x_user_ss = ss.source_set()
-s390x_user_ss.add(files(
-  'cpu_models_user.c',
-  'gdbstub.c',
 ))
 
 subdir('tcg')
 subdir('kvm')
 
+s390x_common_system_ss.add_all(s390x_common_ss)
+s390x_user_ss.add_all(s390x_common_ss)
+
 target_arch += {'s390x': s390x_ss}
 target_system_arch += {'s390x': s390x_system_ss}
 target_common_system_arch += {'s390x': s390x_common_system_ss}
-- 
2.53.0

Re: [PULL 089/110] target/s390x: Introduce common system/user meson source set

[Cédric Le Goater]

Hello,

On 5/6/26 15:55, Philippe Mathieu-Daudé wrote:
> Introduce a source set common to system / user. Start it
> with the files built in both sets: 'cpu_models_user.c'
> and 'gdbstub.c' No logical change intended.
> 
> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
> Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
> Message-Id: <20260423135035.50126-4-philmd@linaro.org>

This change introduced a regression with PCI passthrough which
stopped working. Guest kernel reports :

   [    0.156501] zpci: PCI is not supported because CPU facilities 69 or 71 are not available

and other devices (ap, ccw) are impacted too I think.

> ---
>   target/s390x/meson.build | 25 +++++++++++++------------
>   1 file changed, 13 insertions(+), 12 deletions(-)
> 
> diff --git a/target/s390x/meson.build b/target/s390x/meson.build
> index 6f98ce34d73..44f58ac2919 100644
> --- a/target/s390x/meson.build
> +++ b/target/s390x/meson.build
> @@ -1,4 +1,9 @@
>   s390x_ss = ss.source_set()
> +s390x_common_ss = ss.source_set()
> +s390x_common_system_ss = ss.source_set()
> +s390x_system_ss = ss.source_set()
> +s390x_user_ss = ss.source_set()
> +
>   s390x_ss.add(files(
>     'cpu.c',
>     'cpu_features.c',
> @@ -15,15 +20,16 @@ gen_features_h = custom_target('gen-features.h',
>                                  capture: true,
>                                  command: gen_features)
>   
> -s390x_ss.add(gen_features_h)
> +s390x_common_ss.add(gen_features_h)
> +s390x_common_ss.add(files(
> +  'cpu_models_user.c',
> +  'gdbstub.c',
> +))
>   
> -s390x_system_ss = ss.source_set()
>   s390x_system_ss.add(files(
>     'ioinst.c',
>   ))
>   
> -s390x_common_system_ss = ss.source_set()
> -s390x_common_system_ss.add(gen_features_h)
>   s390x_common_system_ss.add(files(
>     'helper.c',
>     'arch_dump.c',
> @@ -32,19 +38,14 @@ s390x_common_system_ss.add(files(
>     'mmu_helper.c',
>     'sigp.c',
>     'cpu-system.c',
> -  'cpu_models_system.c',

This file is compiled anymore and the CPU features and facilities are
not propagated to the guest anymore.

Without this patch, cpuinfo reports :

   features	: esan3 zarch stfle msa ldisp eimm dfp edat etf3eh highgprs te vx vxd vxe gs vxe2 vxp sort dflt vxp2 nnpa
   facilities      : 0 1 2 3 4 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 30 31 32 33 34 35 36 37 38 40 41 42 43 44 45 47 48 49 50 51 52 53 54 57 58 59 60 61 64 65 69 71 72 73 74 75 76 77 78 80 81 82 129 130 131 133 134 135 138 139 140 146 147 148 150 151 152 155 156 165 192 193 194 196 197

with :

   features	: esan3 zarch stfle msa ldisp eimm dfp edat etf3eh highgprs te vx vxd vxe gs vxe2 vxp sort dflt vxp2
   acilities      : 0 1 2 3 4 6 7 8 9 10 11 13 14 16 17 18 19 20 21 22 23 24 25 26 27 28 30 31 32 33 34 35 36 37 38 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 57 58 59 60 61 64 72 73 74 75 76 77 78 80 81 82 129 130 131 133 134 135 138 139 146 147 148 150 151 152 155 192


Thanks,

C.


> -  'gdbstub.c',
> -))
> -
> -s390x_user_ss = ss.source_set()
> -s390x_user_ss.add(files(
> -  'cpu_models_user.c',
> -  'gdbstub.c',
>   ))
>   
>   subdir('tcg')
>   subdir('kvm')
>   
> +s390x_common_system_ss.add_all(s390x_common_ss)
> +s390x_user_ss.add_all(s390x_common_ss)
> +
>   target_arch += {'s390x': s390x_ss}
>   target_system_arch += {'s390x': s390x_system_ss}
>   target_common_system_arch += {'s390x': s390x_common_system_ss}

Re: [PULL 089/110] target/s390x: Introduce common system/user meson source set

[Eric Farman]

On Mon, 2026-05-11 at 17:48 +0200, Cédric Le Goater wrote:
> Hello,
> 
> On 5/6/26 15:55, Philippe Mathieu-Daudé wrote:
> > Introduce a source set common to system / user. Start it
> > with the files built in both sets: 'cpu_models_user.c'
> > and 'gdbstub.c' No logical change intended.
> > 
> > Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
> > Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
> > Message-Id: <20260423135035.50126-4-philmd@linaro.org>
> 
> This change introduced a regression with PCI passthrough which
> stopped working. Guest kernel reports :
> 
>    [    0.156501] zpci: PCI is not supported because CPU facilities 69 or 71 are not available
> 
> and other devices (ap, ccw) are impacted too I think.
> 
> > ---
> >   target/s390x/meson.build | 25 +++++++++++++------------
> >   1 file changed, 13 insertions(+), 12 deletions(-)
> > 
> > diff --git a/target/s390x/meson.build b/target/s390x/meson.build
> > index 6f98ce34d73..44f58ac2919 100644
> > --- a/target/s390x/meson.build
> > +++ b/target/s390x/meson.build
> > @@ -1,4 +1,9 @@
> >   s390x_ss = ss.source_set()
> > +s390x_common_ss = ss.source_set()
> > +s390x_common_system_ss = ss.source_set()
> > +s390x_system_ss = ss.source_set()
> > +s390x_user_ss = ss.source_set()
> > +
> >   s390x_ss.add(files(
> >     'cpu.c',
> >     'cpu_features.c',
> > @@ -15,15 +20,16 @@ gen_features_h = custom_target('gen-features.h',
> >                                  capture: true,
> >                                  command: gen_features)
> >   
> > -s390x_ss.add(gen_features_h)
> > +s390x_common_ss.add(gen_features_h)
> > +s390x_common_ss.add(files(
> > +  'cpu_models_user.c',
> > +  'gdbstub.c',
> > +))
> >   
> > -s390x_system_ss = ss.source_set()
> >   s390x_system_ss.add(files(
> >     'ioinst.c',
> >   ))
> >   
> > -s390x_common_system_ss = ss.source_set()
> > -s390x_common_system_ss.add(gen_features_h)
> >   s390x_common_system_ss.add(files(
> >     'helper.c',
> >     'arch_dump.c',
> > @@ -32,19 +38,14 @@ s390x_common_system_ss.add(files(
> >     'mmu_helper.c',
> >     'sigp.c',
> >     'cpu-system.c',
> > -  'cpu_models_system.c',
> 
> This file is compiled anymore and the CPU features and facilities are
> not propagated to the guest anymore.
> 
> Without this patch, cpuinfo reports :
> 
>    features	: esan3 zarch stfle msa ldisp eimm dfp edat etf3eh highgprs te vx vxd vxe gs vxe2 vxp sort dflt vxp2 nnpa
>    facilities      : 0 1 2 3 4 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 30 31 32 33 34 35 36 37 38 40 41 42 43 44 45 47 48 49 50 51 52 53 54 57 58 59 60 61 64 65 69 71 72 73 74 75 76 77 78 80 81 82 129 130 131 133 134 135 138 139 140 146 147 148 150 151 152 155 156 165 192 193 194 196 197
> 
> with :
> 
>    features	: esan3 zarch stfle msa ldisp eimm dfp edat etf3eh highgprs te vx vxd vxe gs vxe2 vxp sort dflt vxp2
>    acilities      : 0 1 2 3 4 6 7 8 9 10 11 13 14 16 17 18 19 20 21 22 23 24 25 26 27 28 30 31 32 33 34 35 36 37 38 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 57 58 59 60 61 64 72 73 74 75 76 77 78 80 81 82 129 130 131 133 134 135 138 139 146 147 148 150 151 152 155 192
> 

Thanks, Cedric... I wonder if the above is addressed by this patch? (I haven't checked yet, but will
do that now.)

https://lore.kernel.org/qemu-devel/20260510204640.2178926-1-marcandre.lureau@redhat.com/

Thanks,
Eric

> 
> Thanks,
> 
> C.
> 
> 
> > -  'gdbstub.c',
> > -))
> > -
> > -s390x_user_ss = ss.source_set()
> > -s390x_user_ss.add(files(
> > -  'cpu_models_user.c',
> > -  'gdbstub.c',
> >   ))
> >   
> >   subdir('tcg')
> >   subdir('kvm')
> >   
> > +s390x_common_system_ss.add_all(s390x_common_ss)
> > +s390x_user_ss.add_all(s390x_common_ss)
> > +
> >   target_arch += {'s390x': s390x_ss}
> >   target_system_arch += {'s390x': s390x_system_ss}
> >   target_common_system_arch += {'s390x': s390x_common_system_ss}

Re: [PULL 089/110] target/s390x: Introduce common system/user meson source set

[Cédric Le Goater]

On 5/11/26 17:58, Eric Farman wrote:
> On Mon, 2026-05-11 at 17:48 +0200, Cédric Le Goater wrote:
>> Hello,
>>
>> On 5/6/26 15:55, Philippe Mathieu-Daudé wrote:
>>> Introduce a source set common to system / user. Start it
>>> with the files built in both sets: 'cpu_models_user.c'
>>> and 'gdbstub.c' No logical change intended.
>>>
>>> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
>>> Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
>>> Message-Id: <20260423135035.50126-4-philmd@linaro.org>
>>
>> This change introduced a regression with PCI passthrough which
>> stopped working. Guest kernel reports :
>>
>>     [    0.156501] zpci: PCI is not supported because CPU facilities 69 or 71 are not available
>>
>> and other devices (ap, ccw) are impacted too I think.
>>
>>> ---
>>>    target/s390x/meson.build | 25 +++++++++++++------------
>>>    1 file changed, 13 insertions(+), 12 deletions(-)
>>>
>>> diff --git a/target/s390x/meson.build b/target/s390x/meson.build
>>> index 6f98ce34d73..44f58ac2919 100644
>>> --- a/target/s390x/meson.build
>>> +++ b/target/s390x/meson.build
>>> @@ -1,4 +1,9 @@
>>>    s390x_ss = ss.source_set()
>>> +s390x_common_ss = ss.source_set()
>>> +s390x_common_system_ss = ss.source_set()
>>> +s390x_system_ss = ss.source_set()
>>> +s390x_user_ss = ss.source_set()
>>> +
>>>    s390x_ss.add(files(
>>>      'cpu.c',
>>>      'cpu_features.c',
>>> @@ -15,15 +20,16 @@ gen_features_h = custom_target('gen-features.h',
>>>                                   capture: true,
>>>                                   command: gen_features)
>>>    
>>> -s390x_ss.add(gen_features_h)
>>> +s390x_common_ss.add(gen_features_h)
>>> +s390x_common_ss.add(files(
>>> +  'cpu_models_user.c',
>>> +  'gdbstub.c',
>>> +))
>>>    
>>> -s390x_system_ss = ss.source_set()
>>>    s390x_system_ss.add(files(
>>>      'ioinst.c',
>>>    ))
>>>    
>>> -s390x_common_system_ss = ss.source_set()
>>> -s390x_common_system_ss.add(gen_features_h)
>>>    s390x_common_system_ss.add(files(
>>>      'helper.c',
>>>      'arch_dump.c',
>>> @@ -32,19 +38,14 @@ s390x_common_system_ss.add(files(
>>>      'mmu_helper.c',
>>>      'sigp.c',
>>>      'cpu-system.c',
>>> -  'cpu_models_system.c',
>>
>> This file is compiled anymore and the CPU features and facilities are
>> not propagated to the guest anymore.
>>
>> Without this patch, cpuinfo reports :
>>
>>     features	: esan3 zarch stfle msa ldisp eimm dfp edat etf3eh highgprs te vx vxd vxe gs vxe2 vxp sort dflt vxp2 nnpa
>>     facilities      : 0 1 2 3 4 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 30 31 32 33 34 35 36 37 38 40 41 42 43 44 45 47 48 49 50 51 52 53 54 57 58 59 60 61 64 65 69 71 72 73 74 75 76 77 78 80 81 82 129 130 131 133 134 135 138 139 140 146 147 148 150 151 152 155 156 165 192 193 194 196 197
>>
>> with :
>>
>>     features	: esan3 zarch stfle msa ldisp eimm dfp edat etf3eh highgprs te vx vxd vxe gs vxe2 vxp sort dflt vxp2
>>     acilities      : 0 1 2 3 4 6 7 8 9 10 11 13 14 16 17 18 19 20 21 22 23 24 25 26 27 28 30 31 32 33 34 35 36 37 38 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 57 58 59 60 61 64 72 73 74 75 76 77 78 80 81 82 129 130 131 133 134 135 138 139 146 147 148 150 151 152 155 192
>>
> 
> Thanks, Cedric... I wonder if the above is addressed by this patch? (I haven't checked yet, but will
> do that now.)
> 
> https://lore.kernel.org/qemu-devel/20260510204640.2178926-1-marcandre.lureau@redhat.com/

Something like below seems to work.

C.


@@ -22,7 +22,6 @@ gen_features_h = custom_target('gen-feat
  
  s390x_common_ss.add(gen_features_h)
  s390x_common_ss.add(files(
-  'cpu_models_user.c',
    'gdbstub.c',
  ))
  
@@ -38,8 +37,11 @@ s390x_common_system_ss.add(files(
    'mmu_helper.c',
    'sigp.c',
    'cpu-system.c',
+  'cpu_models_system.c',
  ))
  
+s390x_user_ss.add(files('cpu_models_user.c'))
+
  subdir('tcg')
  subdir('kvm')
  

Re: [PULL 089/110] target/s390x: Introduce common system/user meson source set

[Philippe Mathieu-Daudé]

On 11/5/26 18:36, Cédric Le Goater wrote:
> On 5/11/26 17:58, Eric Farman wrote:
>> On Mon, 2026-05-11 at 17:48 +0200, Cédric Le Goater wrote:
>>> Hello,
>>>
>>> On 5/6/26 15:55, Philippe Mathieu-Daudé wrote:
>>>> Introduce a source set common to system / user. Start it
>>>> with the files built in both sets: 'cpu_models_user.c'
>>>> and 'gdbstub.c' No logical change intended.
>>>>
>>>> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
>>>> Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
>>>> Message-Id: <20260423135035.50126-4-philmd@linaro.org>
>>>
>>> This change introduced a regression with PCI passthrough which
>>> stopped working. Guest kernel reports :
>>>
>>>     [    0.156501] zpci: PCI is not supported because CPU facilities 
>>> 69 or 71 are not available
>>>
>>> and other devices (ap, ccw) are impacted too I think.
>>>
>>>> ---
>>>>    target/s390x/meson.build | 25 +++++++++++++------------
>>>>    1 file changed, 13 insertions(+), 12 deletions(-)
>>>>
>>>> diff --git a/target/s390x/meson.build b/target/s390x/meson.build
>>>> index 6f98ce34d73..44f58ac2919 100644
>>>> --- a/target/s390x/meson.build
>>>> +++ b/target/s390x/meson.build
>>>> @@ -1,4 +1,9 @@
>>>>    s390x_ss = ss.source_set()
>>>> +s390x_common_ss = ss.source_set()
>>>> +s390x_common_system_ss = ss.source_set()
>>>> +s390x_system_ss = ss.source_set()
>>>> +s390x_user_ss = ss.source_set()
>>>> +
>>>>    s390x_ss.add(files(
>>>>      'cpu.c',
>>>>      'cpu_features.c',
>>>> @@ -15,15 +20,16 @@ gen_features_h = custom_target('gen-features.h',
>>>>                                   capture: true,
>>>>                                   command: gen_features)
>>>> -s390x_ss.add(gen_features_h)
>>>> +s390x_common_ss.add(gen_features_h)
>>>> +s390x_common_ss.add(files(
>>>> +  'cpu_models_user.c',
>>>> +  'gdbstub.c',
>>>> +))
>>>> -s390x_system_ss = ss.source_set()
>>>>    s390x_system_ss.add(files(
>>>>      'ioinst.c',
>>>>    ))
>>>> -s390x_common_system_ss = ss.source_set()
>>>> -s390x_common_system_ss.add(gen_features_h)
>>>>    s390x_common_system_ss.add(files(
>>>>      'helper.c',
>>>>      'arch_dump.c',
>>>> @@ -32,19 +38,14 @@ s390x_common_system_ss.add(files(
>>>>      'mmu_helper.c',
>>>>      'sigp.c',
>>>>      'cpu-system.c',
>>>> -  'cpu_models_system.c',
>>>
>>> This file is compiled anymore and the CPU features and facilities are
>>> not propagated to the guest anymore.
>>>
>>> Without this patch, cpuinfo reports :
>>>
>>>     features    : esan3 zarch stfle msa ldisp eimm dfp edat etf3eh 
>>> highgprs te vx vxd vxe gs vxe2 vxp sort dflt vxp2 nnpa
>>>     facilities      : 0 1 2 3 4 6 7 8 9 10 11 12 13 14 15 16 17 18 19 
>>> 20 21 22 23 24 25 26 27 28 30 31 32 33 34 35 36 37 38 40 41 42 43 44 
>>> 45 47 48 49 50 51 52 53 54 57 58 59 60 61 64 65 69 71 72 73 74 75 76 
>>> 77 78 80 81 82 129 130 131 133 134 135 138 139 140 146 147 148 150 
>>> 151 152 155 156 165 192 193 194 196 197
>>>
>>> with :
>>>
>>>     features    : esan3 zarch stfle msa ldisp eimm dfp edat etf3eh 
>>> highgprs te vx vxd vxe gs vxe2 vxp sort dflt vxp2
>>>     acilities      : 0 1 2 3 4 6 7 8 9 10 11 13 14 16 17 18 19 20 21 
>>> 22 23 24 25 26 27 28 30 31 32 33 34 35 36 37 38 40 41 42 43 44 45 46 
>>> 47 48 49 50 51 52 53 54 55 57 58 59 60 61 64 72 73 74 75 76 77 78 80 
>>> 81 82 129 130 131 133 134 135 138 139 146 147 148 150 151 152 155 192
>>>
>>
>> Thanks, Cedric... I wonder if the above is addressed by this patch? (I 
>> haven't checked yet, but will
>> do that now.)
>>
>> https://lore.kernel.org/qemu-devel/20260510204640.2178926-1- 
>> marcandre.lureau@redhat.com/
> 
> Something like below seems to work.
> 
> C.
> 
> 
> @@ -22,7 +22,6 @@ gen_features_h = custom_target('gen-feat
> 
>   s390x_common_ss.add(gen_features_h)
>   s390x_common_ss.add(files(
> -  'cpu_models_user.c',
>     'gdbstub.c',
>   ))
> 
> @@ -38,8 +37,11 @@ s390x_common_system_ss.add(files(
>     'mmu_helper.c',
>     'sigp.c',
>     'cpu-system.c',
> +  'cpu_models_system.c',
>   ))
> 
> +s390x_user_ss.add(files('cpu_models_user.c'))
> +
>   subdir('tcg')
>   subdir('kvm')

Right. I wonder how I could screw that change...

Re: [PULL 089/110] target/s390x: Introduce common system/user meson source set

[Pierrick Bouvier]

On 5/11/2026 10:47 AM, Philippe Mathieu-Daudé wrote:
> On 11/5/26 18:36, Cédric Le Goater wrote:
>> On 5/11/26 17:58, Eric Farman wrote:
>>> On Mon, 2026-05-11 at 17:48 +0200, Cédric Le Goater wrote:
>>>> Hello,
>>>>
>>>> On 5/6/26 15:55, Philippe Mathieu-Daudé wrote:
>>>>> Introduce a source set common to system / user. Start it
>>>>> with the files built in both sets: 'cpu_models_user.c'
>>>>> and 'gdbstub.c' No logical change intended.
>>>>>
>>>>> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
>>>>> Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
>>>>> Message-Id: <20260423135035.50126-4-philmd@linaro.org>
>>>>
>>>> This change introduced a regression with PCI passthrough which
>>>> stopped working. Guest kernel reports :
>>>>
>>>>     [    0.156501] zpci: PCI is not supported because CPU facilities
>>>> 69 or 71 are not available
>>>>
>>>> and other devices (ap, ccw) are impacted too I think.
>>>>
>>>>> ---
>>>>>    target/s390x/meson.build | 25 +++++++++++++------------
>>>>>    1 file changed, 13 insertions(+), 12 deletions(-)
>>>>>
>>>>> diff --git a/target/s390x/meson.build b/target/s390x/meson.build
>>>>> index 6f98ce34d73..44f58ac2919 100644
>>>>> --- a/target/s390x/meson.build
>>>>> +++ b/target/s390x/meson.build
>>>>> @@ -1,4 +1,9 @@
>>>>>    s390x_ss = ss.source_set()
>>>>> +s390x_common_ss = ss.source_set()
>>>>> +s390x_common_system_ss = ss.source_set()
>>>>> +s390x_system_ss = ss.source_set()
>>>>> +s390x_user_ss = ss.source_set()
>>>>> +
>>>>>    s390x_ss.add(files(
>>>>>      'cpu.c',
>>>>>      'cpu_features.c',
>>>>> @@ -15,15 +20,16 @@ gen_features_h = custom_target('gen-features.h',
>>>>>                                   capture: true,
>>>>>                                   command: gen_features)
>>>>> -s390x_ss.add(gen_features_h)
>>>>> +s390x_common_ss.add(gen_features_h)
>>>>> +s390x_common_ss.add(files(
>>>>> +  'cpu_models_user.c',
>>>>> +  'gdbstub.c',
>>>>> +))
>>>>> -s390x_system_ss = ss.source_set()
>>>>>    s390x_system_ss.add(files(
>>>>>      'ioinst.c',
>>>>>    ))
>>>>> -s390x_common_system_ss = ss.source_set()
>>>>> -s390x_common_system_ss.add(gen_features_h)
>>>>>    s390x_common_system_ss.add(files(
>>>>>      'helper.c',
>>>>>      'arch_dump.c',
>>>>> @@ -32,19 +38,14 @@ s390x_common_system_ss.add(files(
>>>>>      'mmu_helper.c',
>>>>>      'sigp.c',
>>>>>      'cpu-system.c',
>>>>> -  'cpu_models_system.c',
>>>>
>>>> This file is compiled anymore and the CPU features and facilities are
>>>> not propagated to the guest anymore.
>>>>
>>>> Without this patch, cpuinfo reports :
>>>>
>>>>     features    : esan3 zarch stfle msa ldisp eimm dfp edat etf3eh
>>>> highgprs te vx vxd vxe gs vxe2 vxp sort dflt vxp2 nnpa
>>>>     facilities      : 0 1 2 3 4 6 7 8 9 10 11 12 13 14 15 16 17 18
>>>> 19 20 21 22 23 24 25 26 27 28 30 31 32 33 34 35 36 37 38 40 41 42 43
>>>> 44 45 47 48 49 50 51 52 53 54 57 58 59 60 61 64 65 69 71 72 73 74 75
>>>> 76 77 78 80 81 82 129 130 131 133 134 135 138 139 140 146 147 148
>>>> 150 151 152 155 156 165 192 193 194 196 197
>>>>
>>>> with :
>>>>
>>>>     features    : esan3 zarch stfle msa ldisp eimm dfp edat etf3eh
>>>> highgprs te vx vxd vxe gs vxe2 vxp sort dflt vxp2
>>>>     acilities      : 0 1 2 3 4 6 7 8 9 10 11 13 14 16 17 18 19 20 21
>>>> 22 23 24 25 26 27 28 30 31 32 33 34 35 36 37 38 40 41 42 43 44 45 46
>>>> 47 48 49 50 51 52 53 54 55 57 58 59 60 61 64 72 73 74 75 76 77 78 80
>>>> 81 82 129 130 131 133 134 135 138 139 146 147 148 150 151 152 155 192
>>>>
>>>
>>> Thanks, Cedric... I wonder if the above is addressed by this patch?
>>> (I haven't checked yet, but will
>>> do that now.)
>>>
>>> https://lore.kernel.org/qemu-devel/20260510204640.2178926-1-
>>> marcandre.lureau@redhat.com/
>>
>> Something like below seems to work.
>>
>> C.
>>
>>
>> @@ -22,7 +22,6 @@ gen_features_h = custom_target('gen-feat
>>
>>   s390x_common_ss.add(gen_features_h)
>>   s390x_common_ss.add(files(
>> -  'cpu_models_user.c',
>>     'gdbstub.c',
>>   ))
>>
>> @@ -38,8 +37,11 @@ s390x_common_system_ss.add(files(
>>     'mmu_helper.c',
>>     'sigp.c',
>>     'cpu-system.c',
>> +  'cpu_models_system.c',
>>   ))
>>
>> +s390x_user_ss.add(files('cpu_models_user.c'))
>> +
>>   subdir('tcg')
>>   subdir('kvm')
> 
> Right. I wonder how I could screw that change...
> 
> 

The only possible thing is that code becoming common skipped some ifdef
that were here before per target.
So, something that should have been poisoned has not been, and we
definitely need to identify what it is to prevent other regressions like
this.

Regards,
Pierrick

Re: [PULL 089/110] target/s390x: Introduce common system/user meson source set

[Pierrick Bouvier]

[-- Attachment #1: Type: text/plain, Size: 5162 bytes --]

On 5/11/2026 11:01 AM, Pierrick Bouvier wrote:
> On 5/11/2026 10:47 AM, Philippe Mathieu-Daudé wrote:
>> On 11/5/26 18:36, Cédric Le Goater wrote:
>>> On 5/11/26 17:58, Eric Farman wrote:
>>>> On Mon, 2026-05-11 at 17:48 +0200, Cédric Le Goater wrote:
>>>>> Hello,
>>>>>
>>>>> On 5/6/26 15:55, Philippe Mathieu-Daudé wrote:
>>>>>> Introduce a source set common to system / user. Start it
>>>>>> with the files built in both sets: 'cpu_models_user.c'
>>>>>> and 'gdbstub.c' No logical change intended.
>>>>>>
>>>>>> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
>>>>>> Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
>>>>>> Message-Id: <20260423135035.50126-4-philmd@linaro.org>
>>>>>
>>>>> This change introduced a regression with PCI passthrough which
>>>>> stopped working. Guest kernel reports :
>>>>>
>>>>>     [    0.156501] zpci: PCI is not supported because CPU facilities
>>>>> 69 or 71 are not available
>>>>>
>>>>> and other devices (ap, ccw) are impacted too I think.
>>>>>
>>>>>> ---
>>>>>>    target/s390x/meson.build | 25 +++++++++++++------------
>>>>>>    1 file changed, 13 insertions(+), 12 deletions(-)
>>>>>>
>>>>>> diff --git a/target/s390x/meson.build b/target/s390x/meson.build
>>>>>> index 6f98ce34d73..44f58ac2919 100644
>>>>>> --- a/target/s390x/meson.build
>>>>>> +++ b/target/s390x/meson.build
>>>>>> @@ -1,4 +1,9 @@
>>>>>>    s390x_ss = ss.source_set()
>>>>>> +s390x_common_ss = ss.source_set()
>>>>>> +s390x_common_system_ss = ss.source_set()
>>>>>> +s390x_system_ss = ss.source_set()
>>>>>> +s390x_user_ss = ss.source_set()
>>>>>> +
>>>>>>    s390x_ss.add(files(
>>>>>>      'cpu.c',
>>>>>>      'cpu_features.c',
>>>>>> @@ -15,15 +20,16 @@ gen_features_h = custom_target('gen-features.h',
>>>>>>                                   capture: true,
>>>>>>                                   command: gen_features)
>>>>>> -s390x_ss.add(gen_features_h)
>>>>>> +s390x_common_ss.add(gen_features_h)
>>>>>> +s390x_common_ss.add(files(
>>>>>> +  'cpu_models_user.c',
>>>>>> +  'gdbstub.c',
>>>>>> +))
>>>>>> -s390x_system_ss = ss.source_set()
>>>>>>    s390x_system_ss.add(files(
>>>>>>      'ioinst.c',
>>>>>>    ))
>>>>>> -s390x_common_system_ss = ss.source_set()
>>>>>> -s390x_common_system_ss.add(gen_features_h)
>>>>>>    s390x_common_system_ss.add(files(
>>>>>>      'helper.c',
>>>>>>      'arch_dump.c',
>>>>>> @@ -32,19 +38,14 @@ s390x_common_system_ss.add(files(
>>>>>>      'mmu_helper.c',
>>>>>>      'sigp.c',
>>>>>>      'cpu-system.c',
>>>>>> -  'cpu_models_system.c',
>>>>>
>>>>> This file is compiled anymore and the CPU features and facilities are
>>>>> not propagated to the guest anymore.
>>>>>
>>>>> Without this patch, cpuinfo reports :
>>>>>
>>>>>     features    : esan3 zarch stfle msa ldisp eimm dfp edat etf3eh
>>>>> highgprs te vx vxd vxe gs vxe2 vxp sort dflt vxp2 nnpa
>>>>>     facilities      : 0 1 2 3 4 6 7 8 9 10 11 12 13 14 15 16 17 18
>>>>> 19 20 21 22 23 24 25 26 27 28 30 31 32 33 34 35 36 37 38 40 41 42 43
>>>>> 44 45 47 48 49 50 51 52 53 54 57 58 59 60 61 64 65 69 71 72 73 74 75
>>>>> 76 77 78 80 81 82 129 130 131 133 134 135 138 139 140 146 147 148
>>>>> 150 151 152 155 156 165 192 193 194 196 197
>>>>>
>>>>> with :
>>>>>
>>>>>     features    : esan3 zarch stfle msa ldisp eimm dfp edat etf3eh
>>>>> highgprs te vx vxd vxe gs vxe2 vxp sort dflt vxp2
>>>>>     acilities      : 0 1 2 3 4 6 7 8 9 10 11 13 14 16 17 18 19 20 21
>>>>> 22 23 24 25 26 27 28 30 31 32 33 34 35 36 37 38 40 41 42 43 44 45 46
>>>>> 47 48 49 50 51 52 53 54 55 57 58 59 60 61 64 72 73 74 75 76 77 78 80
>>>>> 81 82 129 130 131 133 134 135 138 139 146 147 148 150 151 152 155 192
>>>>>
>>>>
>>>> Thanks, Cedric... I wonder if the above is addressed by this patch?
>>>> (I haven't checked yet, but will
>>>> do that now.)
>>>>
>>>> https://lore.kernel.org/qemu-devel/20260510204640.2178926-1-
>>>> marcandre.lureau@redhat.com/
>>>
>>> Something like below seems to work.
>>>
>>> C.
>>>
>>>
>>> @@ -22,7 +22,6 @@ gen_features_h = custom_target('gen-feat
>>>
>>>   s390x_common_ss.add(gen_features_h)
>>>   s390x_common_ss.add(files(
>>> -  'cpu_models_user.c',
>>>     'gdbstub.c',
>>>   ))
>>>
>>> @@ -38,8 +37,11 @@ s390x_common_system_ss.add(files(
>>>     'mmu_helper.c',
>>>     'sigp.c',
>>>     'cpu-system.c',
>>> +  'cpu_models_system.c',
>>>   ))
>>>
>>> +s390x_user_ss.add(files('cpu_models_user.c'))
>>> +
>>>   subdir('tcg')
>>>   subdir('kvm')
>>
>> Right. I wonder how I could screw that change...
>>
>>
> 
> The only possible thing is that code becoming common skipped some ifdef
> that were here before per target.
> So, something that should have been poisoned has not been, and we
> definitely need to identify what it is to prevent other regressions like
> this.
> 
> Regards,
> Pierrick

Fortunately, it was a much simpler bug, where we incorrectly removed
cpu_models_system.c completely, and used user stubs for all versions.

Attached patch should fix it. Can you please test and confirm?

Regards,
Pierrick

[-- Attachment #2: 0001-target-s390x-fix-cpu_models-build-between-user-syste.patch --]
[-- Type: text/plain, Size: 1389 bytes --]

From 7921b534de0d10634e3dff15f9f5f2163d82c729 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Date: Mon, 11 May 2026 11:08:38 -0700
Subject: [PATCH] target/s390x: fix cpu_models build between user/system

A recent commit incorrectly replaced cpu_models_system by stubs
cpu_models_user, thus breaking PCI passthrough on s390.
Fix it by correctly using system/user version as it was done before.

Fixes: 0b83acf2f056cc7f5a9b05b1af9c97c91e2a7b1e ("target/s390x: Introduce common system/user meson source set")
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
---
 target/s390x/meson.build | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/s390x/meson.build b/target/s390x/meson.build
index 44f58ac2919..316cdb954f8 100644
--- a/target/s390x/meson.build
+++ b/target/s390x/meson.build
@@ -22,7 +22,6 @@ gen_features_h = custom_target('gen-features.h',
 
 s390x_common_ss.add(gen_features_h)
 s390x_common_ss.add(files(
-  'cpu_models_user.c',
   'gdbstub.c',
 ))
 
@@ -30,6 +29,8 @@ s390x_system_ss.add(files(
   'ioinst.c',
 ))
 
+s390x_user_ss.add(files('cpu_models_user.c'))
+
 s390x_common_system_ss.add(files(
   'helper.c',
   'arch_dump.c',
@@ -38,6 +39,7 @@ s390x_common_system_ss.add(files(
   'mmu_helper.c',
   'sigp.c',
   'cpu-system.c',
+  'cpu_models_system.c',
 ))
 
 subdir('tcg')
-- 
2.43.0

Re: [PULL 089/110] target/s390x: Introduce common system/user meson source set

[Matthew Rosato]

On 5/11/26 2:16 PM, Pierrick Bouvier wrote:
> On 5/11/2026 11:01 AM, Pierrick Bouvier wrote:

[...]

>>
>> The only possible thing is that code becoming common skipped some ifdef
>> that were here before per target.
>> So, something that should have been poisoned has not been, and we
>> definitely need to identify what it is to prevent other regressions like
>> this.
>>
>> Regards,
>> Pierrick
> 
> Fortunately, it was a much simpler bug, where we incorrectly removed
> cpu_models_system.c completely, and used user stubs for all versions.
> 
> Attached patch should fix it. Can you please test and confirm?
> 
> Regards,
> Pierrick

FYI Eric already posted a very similar patch:

https://lore.kernel.org/qemu-devel/20260511163541.192533-1-farman@linux.ibm.com/

Re: [PULL 089/110] target/s390x: Introduce common system/user meson source set

[Pierrick Bouvier]

On 5/11/2026 11:29 AM, Matthew Rosato wrote:
> On 5/11/26 2:16 PM, Pierrick Bouvier wrote:
>> On 5/11/2026 11:01 AM, Pierrick Bouvier wrote:
> 
> [...]
> 
>>>
>>> The only possible thing is that code becoming common skipped some ifdef
>>> that were here before per target.
>>> So, something that should have been poisoned has not been, and we
>>> definitely need to identify what it is to prevent other regressions like
>>> this.
>>>
>>> Regards,
>>> Pierrick
>>
>> Fortunately, it was a much simpler bug, where we incorrectly removed
>> cpu_models_system.c completely, and used user stubs for all versions.
>>
>> Attached patch should fix it. Can you please test and confirm?
>>
>> Regards,
>> Pierrick
> 
> FYI Eric already posted a very similar patch:
>

Thanks, I didn't see it, as I was not in copy.

> https://lore.kernel.org/qemu-devel/20260511163541.192533-1-farman@linux.ibm.com/
> 
> 

Regards,
Pierrick

Re: [PULL 089/110] target/s390x: Introduce common system/user meson source set

[Eric Farman]

On Mon, 2026-05-11 at 11:58 -0400, Eric Farman wrote:
> On Mon, 2026-05-11 at 17:48 +0200, Cédric Le Goater wrote:
> > Hello,
> > 
> > On 5/6/26 15:55, Philippe Mathieu-Daudé wrote:
> > > Introduce a source set common to system / user. Start it
> > > with the files built in both sets: 'cpu_models_user.c'
> > > and 'gdbstub.c' No logical change intended.
> > > 
> > > Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
> > > Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
> > > Message-Id: <20260423135035.50126-4-philmd@linaro.org>
> > 
> > This change introduced a regression with PCI passthrough which
> > stopped working. Guest kernel reports :
> > 
> >    [    0.156501] zpci: PCI is not supported because CPU facilities 69 or 71 are not available
> > 
> > and other devices (ap, ccw) are impacted too I think.
> > 
> > > ---
> > >   target/s390x/meson.build | 25 +++++++++++++------------
> > >   1 file changed, 13 insertions(+), 12 deletions(-)
> > > 
> > > diff --git a/target/s390x/meson.build b/target/s390x/meson.build
> > > index 6f98ce34d73..44f58ac2919 100644
> > > --- a/target/s390x/meson.build
> > > +++ b/target/s390x/meson.build
> > > @@ -1,4 +1,9 @@
> > >   s390x_ss = ss.source_set()
> > > +s390x_common_ss = ss.source_set()
> > > +s390x_common_system_ss = ss.source_set()
> > > +s390x_system_ss = ss.source_set()
> > > +s390x_user_ss = ss.source_set()
> > > +
> > >   s390x_ss.add(files(
> > >     'cpu.c',
> > >     'cpu_features.c',
> > > @@ -15,15 +20,16 @@ gen_features_h = custom_target('gen-features.h',
> > >                                  capture: true,
> > >                                  command: gen_features)
> > >   
> > > -s390x_ss.add(gen_features_h)
> > > +s390x_common_ss.add(gen_features_h)
> > > +s390x_common_ss.add(files(
> > > +  'cpu_models_user.c',
> > > +  'gdbstub.c',
> > > +))
> > >   
> > > -s390x_system_ss = ss.source_set()
> > >   s390x_system_ss.add(files(
> > >     'ioinst.c',
> > >   ))
> > >   
> > > -s390x_common_system_ss = ss.source_set()
> > > -s390x_common_system_ss.add(gen_features_h)
> > >   s390x_common_system_ss.add(files(
> > >     'helper.c',
> > >     'arch_dump.c',
> > > @@ -32,19 +38,14 @@ s390x_common_system_ss.add(files(
> > >     'mmu_helper.c',
> > >     'sigp.c',
> > >     'cpu-system.c',
> > > -  'cpu_models_system.c',
> > 
> > This file is compiled anymore and the CPU features and facilities are
> > not propagated to the guest anymore.
> > 
> > Without this patch, cpuinfo reports :
> > 
> >    features	: esan3 zarch stfle msa ldisp eimm dfp edat etf3eh highgprs te vx vxd vxe gs vxe2 vxp sort dflt vxp2 nnpa
> >    facilities      : 0 1 2 3 4 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 30 31 32 33 34 35 36 37 38 40 41 42 43 44 45 47 48 49 50 51 52 53 54 57 58 59 60 61 64 65 69 71 72 73 74 75 76 77 78 80 81 82 129 130 131 133 134 135 138 139 140 146 147 148 150 151 152 155 156 165 192 193 194 196 197
> > 
> > with :
> > 
> >    features	: esan3 zarch stfle msa ldisp eimm dfp edat etf3eh highgprs te vx vxd vxe gs vxe2 vxp sort dflt vxp2
> >    acilities      : 0 1 2 3 4 6 7 8 9 10 11 13 14 16 17 18 19 20 21 22 23 24 25 26 27 28 30 31 32 33 34 35 36 37 38 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 57 58 59 60 61 64 72 73 74 75 76 77 78 80 81 82 129 130 131 133 134 135 138 139 146 147 148 150 151 152 155 192
> > 
> 
> Thanks, Cedric... I wonder if the above is addressed by this patch? (I haven't checked yet, but will
> do that now.)
> 
> https://lore.kernel.org/qemu-devel/20260510204640.2178926-1-marcandre.lureau@redhat.com/

Nope, didn't help this particular problem. But patch sent for it.

> 
> Thanks,
> Eric
> 
> > 
> > Thanks,
> > 
> > C.
> > 
> > 
> > > -  'gdbstub.c',
> > > -))
> > > -
> > > -s390x_user_ss = ss.source_set()
> > > -s390x_user_ss.add(files(
> > > -  'cpu_models_user.c',
> > > -  'gdbstub.c',
> > >   ))
> > >   
> > >   subdir('tcg')
> > >   subdir('kvm')
> > >   
> > > +s390x_common_system_ss.add_all(s390x_common_ss)
> > > +s390x_user_ss.add_all(s390x_common_ss)
> > > +
> > >   target_arch += {'s390x': s390x_ss}
> > >   target_system_arch += {'s390x': s390x_system_ss}
> > >   target_common_system_arch += {'s390x': s390x_common_system_ss}

Re: [PULL 089/110] target/s390x: Introduce common system/user meson source set

[Philippe Mathieu-Daudé]

On 11/5/26 17:48, Cédric Le Goater wrote:
> Hello,
> 
> On 5/6/26 15:55, Philippe Mathieu-Daudé wrote:
>> Introduce a source set common to system / user. Start it
>> with the files built in both sets: 'cpu_models_user.c'
>> and 'gdbstub.c' No logical change intended.
>>
>> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
>> Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
>> Message-Id: <20260423135035.50126-4-philmd@linaro.org>
> 
> This change introduced a regression with PCI passthrough which
> stopped working. Guest kernel reports :
> 
>    [    0.156501] zpci: PCI is not supported because CPU facilities 69 
> or 71 are not available
> 
> and other devices (ap, ccw) are impacted too I think.

Is it something we could test with the mainstream CI, or does this
requires specific hardware?

> 
>> ---
>>   target/s390x/meson.build | 25 +++++++++++++------------
>>   1 file changed, 13 insertions(+), 12 deletions(-)

Re: [PULL 089/110] target/s390x: Introduce common system/user meson source set

[Pierrick Bouvier]

On 5/11/2026 10:48 AM, Philippe Mathieu-Daudé wrote:
> On 11/5/26 17:48, Cédric Le Goater wrote:
>> Hello,
>>
>> On 5/6/26 15:55, Philippe Mathieu-Daudé wrote:
>>> Introduce a source set common to system / user. Start it
>>> with the files built in both sets: 'cpu_models_user.c'
>>> and 'gdbstub.c' No logical change intended.
>>>
>>> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
>>> Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
>>> Message-Id: <20260423135035.50126-4-philmd@linaro.org>
>>
>> This change introduced a regression with PCI passthrough which
>> stopped working. Guest kernel reports :
>>
>>    [    0.156501] zpci: PCI is not supported because CPU facilities 69
>> or 71 are not available
>>
>> and other devices (ap, ccw) are impacted too I think.
> 
> Is it something we could test with the mainstream CI, or does this
> requires specific hardware?
>

It could be tested with a tcg arm vm + nested VM with PCI passthrough.
However, the problem is that you need to cross-compile QEMU in CI to
test current version to launch the nested VM.
This would imply to have a "standard" target environment (like debian
with X,Y,Z deps preinstalled) which CI does not have at the moment.

So in practice, it's hard to test it.

>>
>>> ---
>>>   target/s390x/meson.build | 25 +++++++++++++------------
>>>   1 file changed, 13 insertions(+), 12 deletions(-)
> 
> 

Re: [PULL 089/110] target/s390x: Introduce common system/user meson source set

[Cédric Le Goater]

On 5/11/26 19:59, Pierrick Bouvier wrote:
> On 5/11/2026 10:48 AM, Philippe Mathieu-Daudé wrote:
>> On 11/5/26 17:48, Cédric Le Goater wrote:
>>> Hello,
>>>
>>> On 5/6/26 15:55, Philippe Mathieu-Daudé wrote:
>>>> Introduce a source set common to system / user. Start it
>>>> with the files built in both sets: 'cpu_models_user.c'
>>>> and 'gdbstub.c' No logical change intended.
>>>>
>>>> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
>>>> Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
>>>> Message-Id: <20260423135035.50126-4-philmd@linaro.org>
>>>
>>> This change introduced a regression with PCI passthrough which
>>> stopped working. Guest kernel reports :
>>>
>>>     [    0.156501] zpci: PCI is not supported because CPU facilities 69
>>> or 71 are not available
>>>
>>> and other devices (ap, ccw) are impacted too I think.
>>
>> Is it something we could test with the mainstream CI, or does this
>> requires specific hardware?
>>
> 
> It could be tested with a tcg arm vm + nested VM with PCI passthrough.

Yes, adding VFIO tests to the QEMU upstream CI would be great.

> However, the problem is that you need to cross-compile QEMU in CI to
> test current version to launch the nested VM.

Intel comes to mind first :)

Couldn't we install the QEMU CI build artifacts into a VM matching
the configuration in which they were built ? I assume the artifacts
remain available for some time.

We could then install them in an L1 VM with a predefined emulated
igb device and assigned that device to an L2 VM.

I think this would also benefit the QEMU CI in other ways, as
nested setups allow tests to run with higher privileges.

> This would imply to have a "standard" target environment (like debian
> with X,Y,Z deps preinstalled) which CI does not have at the moment.

Why one "standard" target ? All arch are impacted, as well as various
distro flavors.

> So in practice, it's hard to test it.

It is.

Thanks,

C.

Re: [PULL 089/110] target/s390x: Introduce common system/user meson source set

[Pierrick Bouvier]

On 5/11/2026 1:46 PM, Cédric Le Goater wrote:
> On 5/11/26 19:59, Pierrick Bouvier wrote:
>> On 5/11/2026 10:48 AM, Philippe Mathieu-Daudé wrote:
>>> On 11/5/26 17:48, Cédric Le Goater wrote:
>>>> Hello,
>>>>
>>>> On 5/6/26 15:55, Philippe Mathieu-Daudé wrote:
>>>>> Introduce a source set common to system / user. Start it
>>>>> with the files built in both sets: 'cpu_models_user.c'
>>>>> and 'gdbstub.c' No logical change intended.
>>>>>
>>>>> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
>>>>> Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
>>>>> Message-Id: <20260423135035.50126-4-philmd@linaro.org>
>>>>
>>>> This change introduced a regression with PCI passthrough which
>>>> stopped working. Guest kernel reports :
>>>>
>>>>     [    0.156501] zpci: PCI is not supported because CPU facilities 69
>>>> or 71 are not available
>>>>
>>>> and other devices (ap, ccw) are impacted too I think.
>>>
>>> Is it something we could test with the mainstream CI, or does this
>>> requires specific hardware?
>>>
>>
>> It could be tested with a tcg arm vm + nested VM with PCI passthrough.
> 
> Yes, adding VFIO tests to the QEMU upstream CI would be great.
> 
>> However, the problem is that you need to cross-compile QEMU in CI to
>> test current version to launch the nested VM.
> 
> Intel comes to mind first :)
>

I just mentioned Arm because I'm more familiar with what is implemented
for emulating nested virtualization, but any other arch would be welcome
of course!

> Couldn't we install the QEMU CI build artifacts into a VM matching
> the configuration in which they were built ? I assume the artifacts
> remain available for some time.
>

We could totally do that. We just need to agree on one environment, with
a list of dependencies preinstalled.
Ideally, it should be what we have in our cross containers, which are
based on debian. It would mean there is zero additional maintenance
burden. Only question is where to get the kernel, and if we should take
the one from distro, or compile our own.

I don't have the bandwith to implement this at the moment, but if anyone
has time and want more details, I would be happy to talk about it.

> We could then install them in an L1 VM with a predefined emulated
> igb device and assigned that device to an L2 VM.
> 
> I think this would also benefit the QEMU CI in other ways, as
> nested setups allow tests to run with higher privileges.
> 
>> This would imply to have a "standard" target environment (like debian
>> with X,Y,Z deps preinstalled) which CI does not have at the moment.
> 
> Why one "standard" target ? All arch are impacted, as well as various
> distro flavors.
>

I was using the word "target" for the environment it will target (i.e.
which distro), and not referring to arch. Probably a poor choice of
words, given that target already has too many meanings in QEMU :).

>> So in practice, it's hard to test it.
> 
> It is.
> 
> Thanks,
> 
> C.
> 

Re: [PULL 089/110] target/s390x: Introduce common system/user meson source set

[Philippe Mathieu-Daudé]

On 11/5/26 23:07, Pierrick Bouvier wrote:
> On 5/11/2026 1:46 PM, Cédric Le Goater wrote:
>> On 5/11/26 19:59, Pierrick Bouvier wrote:
>>> On 5/11/2026 10:48 AM, Philippe Mathieu-Daudé wrote:
>>>> On 11/5/26 17:48, Cédric Le Goater wrote:
>>>>> Hello,
>>>>>
>>>>> On 5/6/26 15:55, Philippe Mathieu-Daudé wrote:
>>>>>> Introduce a source set common to system / user. Start it
>>>>>> with the files built in both sets: 'cpu_models_user.c'
>>>>>> and 'gdbstub.c' No logical change intended.
>>>>>>
>>>>>> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
>>>>>> Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
>>>>>> Message-Id: <20260423135035.50126-4-philmd@linaro.org>
>>>>>
>>>>> This change introduced a regression with PCI passthrough which
>>>>> stopped working. Guest kernel reports :
>>>>>
>>>>>      [    0.156501] zpci: PCI is not supported because CPU facilities 69
>>>>> or 71 are not available
>>>>>
>>>>> and other devices (ap, ccw) are impacted too I think.
>>>>
>>>> Is it something we could test with the mainstream CI, or does this
>>>> requires specific hardware?
>>>>
>>>
>>> It could be tested with a tcg arm vm + nested VM with PCI passthrough.
>>
>> Yes, adding VFIO tests to the QEMU upstream CI would be great.
>>
>>> However, the problem is that you need to cross-compile QEMU in CI to
>>> test current version to launch the nested VM.

I guess remember one of your scripts close to that setup, mounting
the same directory in nested guest with:

   -virtfs \
    local,path=$(pwd),mount_tag=host,security_model=mapped,readonly=off

Same could be used with s390x / x86 I suppose.

Re: [PULL 089/110] target/s390x: Introduce common system/user meson source set

[Pierrick Bouvier]

On 5/11/2026 8:36 PM, Philippe Mathieu-Daudé wrote:
> On 11/5/26 23:07, Pierrick Bouvier wrote:
>> On 5/11/2026 1:46 PM, Cédric Le Goater wrote:
>>> On 5/11/26 19:59, Pierrick Bouvier wrote:
>>>> On 5/11/2026 10:48 AM, Philippe Mathieu-Daudé wrote:
>>>>> On 11/5/26 17:48, Cédric Le Goater wrote:
>>>>>> Hello,
>>>>>>
>>>>>> On 5/6/26 15:55, Philippe Mathieu-Daudé wrote:
>>>>>>> Introduce a source set common to system / user. Start it
>>>>>>> with the files built in both sets: 'cpu_models_user.c'
>>>>>>> and 'gdbstub.c' No logical change intended.
>>>>>>>
>>>>>>> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
>>>>>>> Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
>>>>>>> Message-Id: <20260423135035.50126-4-philmd@linaro.org>
>>>>>>
>>>>>> This change introduced a regression with PCI passthrough which
>>>>>> stopped working. Guest kernel reports :
>>>>>>
>>>>>>      [    0.156501] zpci: PCI is not supported because CPU
>>>>>> facilities 69
>>>>>> or 71 are not available
>>>>>>
>>>>>> and other devices (ap, ccw) are impacted too I think.
>>>>>
>>>>> Is it something we could test with the mainstream CI, or does this
>>>>> requires specific hardware?
>>>>>
>>>>
>>>> It could be tested with a tcg arm vm + nested VM with PCI passthrough.
>>>
>>> Yes, adding VFIO tests to the QEMU upstream CI would be great.
>>>
>>>> However, the problem is that you need to cross-compile QEMU in CI to
>>>> test current version to launch the nested VM.
> 
> I guess remember one of your scripts close to that setup, mounting
> the same directory in nested guest with:
> 
>   -virtfs \
>    local,path=$(pwd),mount_tag=host,security_model=mapped,readonly=off
> 
> Same could be used with s390x / x86 I suppose.

Yes, it's another possibility.
I just like the idea of generating the image on the fly, and not have to
host it/update it anywhere. Considering this, it's "free" to include a
binary at creation vs a mount network.

For reference, this is the script to create an ext4 image from container
[1], and the custom init booting [2] and running a custom command.

[1] https://github.com/p-b-o/qemu-linux-stack/blob/master/build_rootfs.sh
[2] https://github.com/p-b-o/qemu-linux-stack/blob/master/rootfs/common/init

The scripts in themselves are not important, but it shows how small they
are, and thus, easy to develop and maintain.

Re: [PULL 089/110] target/s390x: Introduce common system/user meson source set

[Cédric Le Goater]

On 5/11/26 19:48, Philippe Mathieu-Daudé wrote:
> On 11/5/26 17:48, Cédric Le Goater wrote:
>> Hello,
>>
>> On 5/6/26 15:55, Philippe Mathieu-Daudé wrote:
>>> Introduce a source set common to system / user. Start it
>>> with the files built in both sets: 'cpu_models_user.c'
>>> and 'gdbstub.c' No logical change intended.
>>>
>>> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
>>> Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
>>> Message-Id: <20260423135035.50126-4-philmd@linaro.org>
>>
>> This change introduced a regression with PCI passthrough which
>> stopped working. Guest kernel reports :
>>
>>    [    0.156501] zpci: PCI is not supported because CPU facilities 69 or 71 are not available
>>
>> and other devices (ap, ccw) are impacted too I think.
> 
> Is it something we could test with the mainstream CI, or does this
> requires specific hardware?

I think you need a s390x LPAR with PCI adapters. TCG won't work.
Not a very common system.

C.

[PULL 090/110] target/s390x: Compile few files as common unit

[Philippe Mathieu-Daudé]

Nothing in these files prevents it to be built as common unit:

 - cc_helper.c
 - excp_helper.c
 - fpu_helper.c
 - vec_fpu_helper.c
 - vec_int_helper.c
 - vec_string_helper.c

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20260423135035.50126-5-philmd@linaro.org>
---
 target/s390x/tcg/meson.build | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/target/s390x/tcg/meson.build b/target/s390x/tcg/meson.build
index 17c9374d09e..67f31bfddd4 100644
--- a/target/s390x/tcg/meson.build
+++ b/target/s390x/tcg/meson.build
@@ -1,14 +1,16 @@
 s390x_ss.add(when: 'CONFIG_TCG', if_true: files(
-  'cc_helper.c',
   'crypto_helper.c',
-  'excp_helper.c',
-  'fpu_helper.c',
   'int_helper.c',
   'mem_helper.c',
   'misc_helper.c',
   'translate.c',
-  'vec_fpu_helper.c',
   'vec_helper.c',
+))
+s390x_common_ss.add(when: 'CONFIG_TCG', if_true: files(
+  'cc_helper.c',
+  'excp_helper.c',
+  'fpu_helper.c',
+  'vec_fpu_helper.c',
   'vec_int_helper.c',
   'vec_string_helper.c',
 ))
-- 
2.53.0

[PULL 091/110] target/s390x: Compile translate.c as common unit

[Philippe Mathieu-Daudé]

In order do build translate.c as a common unit we need to
replace:

  #include "tcg/tcg-op.h" -> #include "tcg/tcg-op-common.h"
                          -> #include "tcg/tcg-op-mem.h"

and:

  "accel/tcg/tcg-op-gvec.h" -> "accel/tcg/tcg-op-gvec-common.h"

taking care to define TCG_ADDRESS_BITS, which is fixed
for this 64-bit target.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20260423135035.50126-6-philmd@linaro.org>
---
 target/s390x/tcg/translate.c | 6 ++++--
 target/s390x/tcg/meson.build | 2 +-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index 0f274621e5a..82165ac1ec0 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -31,8 +31,10 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "s390x-internal.h"
-#include "tcg/tcg-op.h"
-#include "tcg/tcg-op-gvec.h"
+#define TCG_ADDRESS_BITS 64
+#include "tcg/tcg-op-common.h"
+#include "tcg/tcg-op-mem.h"
+#include "tcg/tcg-op-gvec-common.h"
 #include "qemu/log.h"
 #include "qemu/host-utils.h"
 #include "exec/helper-proto.h"
diff --git a/target/s390x/tcg/meson.build b/target/s390x/tcg/meson.build
index 67f31bfddd4..d1c60135411 100644
--- a/target/s390x/tcg/meson.build
+++ b/target/s390x/tcg/meson.build
@@ -3,13 +3,13 @@ s390x_ss.add(when: 'CONFIG_TCG', if_true: files(
   'int_helper.c',
   'mem_helper.c',
   'misc_helper.c',
-  'translate.c',
   'vec_helper.c',
 ))
 s390x_common_ss.add(when: 'CONFIG_TCG', if_true: files(
   'cc_helper.c',
   'excp_helper.c',
   'fpu_helper.c',
+  'translate.c',
   'vec_fpu_helper.c',
   'vec_int_helper.c',
   'vec_string_helper.c',
-- 
2.53.0

[PULL 092/110] target/s390x: Compile vec_helper.c as common unit

[Philippe Mathieu-Daudé]

In order do build vec_helper.c as a common unit we need to
replace:

  "accel/tcg/cpu-ldst.h" -> "accel/tcg/cpu-ldst-common.h"

and update the cpu_ld/st_be_data_ra() API by cpu_ld/st_mmu() one.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20260423135035.50126-7-philmd@linaro.org>
---
 target/s390x/tcg/vec_helper.c | 34 +++++++++++++++++++++++-----------
 target/s390x/tcg/meson.build  |  2 +-
 2 files changed, 24 insertions(+), 12 deletions(-)

diff --git a/target/s390x/tcg/vec_helper.c b/target/s390x/tcg/vec_helper.c
index 304745c971b..98eecd9fde6 100644
--- a/target/s390x/tcg/vec_helper.c
+++ b/target/s390x/tcg/vec_helper.c
@@ -16,7 +16,8 @@
 #include "tcg/tcg.h"
 #include "tcg/tcg-gvec-desc.h"
 #include "exec/helper-proto.h"
-#include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/cpu-ldst-common.h"
+#include "accel/tcg/cpu-mmu-index.h"
 
 void HELPER(gvec_vbperm)(void *v1, const void *v2, const void *v3,
                          uint32_t desc)
@@ -42,20 +43,26 @@ void HELPER(gvec_vbperm)(void *v1, const void *v2, const void *v3,
 
 void HELPER(vll)(CPUS390XState *env, void *v1, uint64_t addr, uint64_t bytes)
 {
+    const int mmu_idx = cpu_mmu_index(env_cpu(env), false);
+    const uintptr_t ra = GETPC();
+    MemOpIdx oi;
+
     if (likely(bytes >= 16)) {
         uint64_t t0, t1;
 
-        t0 = cpu_ldq_be_data_ra(env, addr, GETPC());
+        oi = make_memop_idx(MO_BE | MO_64 | MO_UNALN, mmu_idx);
+        t0 = cpu_ldq_mmu(env, addr, oi, ra);
         addr = wrap_address(env, addr + 8);
-        t1 = cpu_ldq_be_data_ra(env, addr, GETPC());
+        t1 = cpu_ldq_mmu(env, addr, oi, ra);
         s390_vec_write_element64(v1, 0, t0);
         s390_vec_write_element64(v1, 1, t1);
     } else {
         S390Vector tmp = {};
-        int i;
 
-        for (i = 0; i < bytes; i++) {
-            uint8_t byte = cpu_ldub_data_ra(env, addr, GETPC());
+        oi = make_memop_idx(MO_8, mmu_idx);
+        for (int i = 0; i < bytes; i++) {
+            uint8_t byte = cpu_ldb_mmu(env, addr, oi, ra);
+
 
             s390_vec_write_element8(&tmp, i, byte);
             addr = wrap_address(env, addr + 1);
@@ -191,20 +198,25 @@ void HELPER(gvec_vperm)(void *v1, const void *v2, const void *v3,
 void HELPER(vstl)(CPUS390XState *env, const void *v1, uint64_t addr,
                   uint64_t bytes)
 {
+    const int mmu_idx = cpu_mmu_index(env_cpu(env), false);
+    const uintptr_t ra = GETPC();
+    MemOpIdx oi;
+
     /* Probe write access before actually modifying memory */
     probe_write_access(env, addr, MIN(bytes, 16), GETPC());
 
     if (likely(bytes >= 16)) {
-        cpu_stq_be_data_ra(env, addr, s390_vec_read_element64(v1, 0), GETPC());
+        oi = make_memop_idx(MO_BE | MO_64 | MO_UNALN, mmu_idx);
+        cpu_stq_mmu(env, addr, s390_vec_read_element64(v1, 0), oi, ra);
         addr = wrap_address(env, addr + 8);
-        cpu_stq_be_data_ra(env, addr, s390_vec_read_element64(v1, 1), GETPC());
+        cpu_stq_mmu(env, addr, s390_vec_read_element64(v1, 1), oi, ra);
     } else {
-        int i;
+        oi = make_memop_idx(MO_8, mmu_idx);
 
-        for (i = 0; i < bytes; i++) {
+        for (int i = 0; i < bytes; i++) {
             uint8_t byte = s390_vec_read_element8(v1, i);
 
-            cpu_stb_data_ra(env, addr, byte, GETPC());
+            cpu_stb_mmu(env, addr, byte, oi, ra);
             addr = wrap_address(env, addr + 1);
         }
     }
diff --git a/target/s390x/tcg/meson.build b/target/s390x/tcg/meson.build
index d1c60135411..ed6441f6f44 100644
--- a/target/s390x/tcg/meson.build
+++ b/target/s390x/tcg/meson.build
@@ -3,7 +3,6 @@ s390x_ss.add(when: 'CONFIG_TCG', if_true: files(
   'int_helper.c',
   'mem_helper.c',
   'misc_helper.c',
-  'vec_helper.c',
 ))
 s390x_common_ss.add(when: 'CONFIG_TCG', if_true: files(
   'cc_helper.c',
@@ -11,6 +10,7 @@ s390x_common_ss.add(when: 'CONFIG_TCG', if_true: files(
   'fpu_helper.c',
   'translate.c',
   'vec_fpu_helper.c',
+  'vec_helper.c',
   'vec_int_helper.c',
   'vec_string_helper.c',
 ))
-- 
2.53.0

[PULL 093/110] target/s390x: Have MSA helper pass a mmu_idx argument

[Philippe Mathieu-Daudé]

Next commit will use the cpu_ld/st_mmu() API and thus
will also use a @mmu_idx. In order to keep it simple to
review, propate @mmu_idx in a preliminary step.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20260423135035.50126-8-philmd@linaro.org>
---
 target/s390x/tcg/crypto_helper.c | 41 +++++++++++++++++---------------
 1 file changed, 22 insertions(+), 19 deletions(-)

diff --git a/target/s390x/tcg/crypto_helper.c b/target/s390x/tcg/crypto_helper.c
index 4447bb66eee..074d745eb3f 100644
--- a/target/s390x/tcg/crypto_helper.c
+++ b/target/s390x/tcg/crypto_helper.c
@@ -18,6 +18,7 @@
 #include "tcg_s390x.h"
 #include "exec/helper-proto.h"
 #include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/cpu-mmu-index.h"
 
 static uint64_t R(uint64_t x, int c)
 {
@@ -119,8 +120,8 @@ static void sha512_bda_be64(uint64_t a[8], uint64_t w[16])
     sha512_bda(a, t);
 }
 
-static void sha512_read_icv(CPUS390XState *env, uint64_t addr,
-                            uint64_t a[8], uintptr_t ra)
+static void sha512_read_icv(CPUS390XState *env, const int mmu_idx,
+                            uint64_t addr, uint64_t a[8], uintptr_t ra)
 {
     int i;
 
@@ -130,8 +131,8 @@ static void sha512_read_icv(CPUS390XState *env, uint64_t addr,
     }
 }
 
-static void sha512_write_ocv(CPUS390XState *env, uint64_t addr,
-                             uint64_t a[8], uintptr_t ra)
+static void sha512_write_ocv(CPUS390XState *env, const int mmu_idx,
+                             uint64_t addr, uint64_t a[8], uintptr_t ra)
 {
     int i;
 
@@ -141,8 +142,8 @@ static void sha512_write_ocv(CPUS390XState *env, uint64_t addr,
     }
 }
 
-static void sha512_read_block(CPUS390XState *env, uint64_t addr,
-                              uint64_t a[16], uintptr_t ra)
+static void sha512_read_block(CPUS390XState *env, const int mmu_idx,
+                              uint64_t addr, uint64_t a[16], uintptr_t ra)
 {
     int i;
 
@@ -152,8 +153,8 @@ static void sha512_read_block(CPUS390XState *env, uint64_t addr,
     }
 }
 
-static void sha512_read_mbl_be64(CPUS390XState *env, uint64_t addr,
-                                 uint8_t a[16], uintptr_t ra)
+static void sha512_read_mbl_be64(CPUS390XState *env, const int mmu_idx,
+                                 uint64_t addr, uint8_t a[16], uintptr_t ra)
 {
     int i;
 
@@ -163,8 +164,9 @@ static void sha512_read_mbl_be64(CPUS390XState *env, uint64_t addr,
     }
 }
 
-static int cpacf_sha512(CPUS390XState *env, uintptr_t ra, uint64_t param_addr,
-                      uint64_t *message_reg, uint64_t *len_reg, uint32_t type)
+static int cpacf_sha512(CPUS390XState *env, const int mmu_idx, uintptr_t ra,
+                        uint64_t param_addr, uint64_t *message_reg,
+                        uint64_t *len_reg, uint32_t type)
 {
     enum { MAX_BLOCKS_PER_RUN = 64 }; /* Arbitrary: keep interactivity. */
     uint64_t len = *len_reg, a[8], processed = 0;
@@ -182,7 +184,7 @@ static int cpacf_sha512(CPUS390XState *env, uintptr_t ra, uint64_t param_addr,
         tcg_s390_program_interrupt(env, PGM_SPECIFICATION, ra);
     }
 
-    sha512_read_icv(env, param_addr, a, ra);
+    sha512_read_icv(env, mmu_idx, param_addr, a, ra);
 
     /* Process full blocks first. */
     for (; len >= 128; len -= 128, processed += 128) {
@@ -192,7 +194,7 @@ static int cpacf_sha512(CPUS390XState *env, uintptr_t ra, uint64_t param_addr,
             break;
         }
 
-        sha512_read_block(env, *message_reg + processed, w, ra);
+        sha512_read_block(env, mmu_idx, *message_reg + processed, w, ra);
         sha512_bda(a, w);
     }
 
@@ -215,13 +217,13 @@ static int cpacf_sha512(CPUS390XState *env, uintptr_t ra, uint64_t param_addr,
          * or use an additional one.
          */
         if (len < 112) {
-            sha512_read_mbl_be64(env, param_addr + 64, x + 112, ra);
+            sha512_read_mbl_be64(env, mmu_idx, param_addr + 64, x + 112, ra);
         }
         sha512_bda_be64(a, (uint64_t *)x);
 
         if (len >= 112) {
             memset(x, 0, 112);
-            sha512_read_mbl_be64(env, param_addr + 64, x + 112, ra);
+            sha512_read_mbl_be64(env, mmu_idx, param_addr + 64, x + 112, ra);
             sha512_bda_be64(a, (uint64_t *)x);
         }
 
@@ -236,14 +238,14 @@ static int cpacf_sha512(CPUS390XState *env, uintptr_t ra, uint64_t param_addr,
      * TODO: if writing fails halfway through (e.g., when crossing page
      * boundaries), we're in trouble. We'd need something like access_prepare().
      */
-    sha512_write_ocv(env, param_addr, a, ra);
+    sha512_write_ocv(env, mmu_idx, param_addr, a, ra);
     *message_reg = deposit64(*message_reg, 0, message_reg_len,
                              *message_reg + processed);
     *len_reg -= processed;
     return !len ? 0 : 3;
 }
 
-static void fill_buf_random(CPUS390XState *env, uintptr_t ra,
+static void fill_buf_random(CPUS390XState *env, const int mmu_idx, uintptr_t ra,
                             uint64_t *buf_reg, uint64_t *len_reg)
 {
     uint8_t tmp[256];
@@ -271,6 +273,7 @@ static void fill_buf_random(CPUS390XState *env, uintptr_t ra,
 uint32_t HELPER(msa)(CPUS390XState *env, uint32_t r1, uint32_t r2, uint32_t r3,
                      uint32_t type)
 {
+    const int mmu_idx = cpu_mmu_index(env_cpu(env), false);
     const uintptr_t ra = GETPC();
     const uint8_t mod = env->regs[0] & 0x80ULL;
     const uint8_t fc = env->regs[0] & 0x7fULL;
@@ -303,11 +306,11 @@ uint32_t HELPER(msa)(CPUS390XState *env, uint32_t r1, uint32_t r2, uint32_t r3,
         }
         break;
     case 3: /* CPACF_*_SHA_512 */
-        return cpacf_sha512(env, ra, env->regs[1], &env->regs[r2],
+        return cpacf_sha512(env, mmu_idx, ra, env->regs[1], &env->regs[r2],
                             &env->regs[r2 + 1], type);
     case 114: /* CPACF_PRNO_TRNG */
-        fill_buf_random(env, ra, &env->regs[r1], &env->regs[r1 + 1]);
-        fill_buf_random(env, ra, &env->regs[r2], &env->regs[r2 + 1]);
+        fill_buf_random(env, mmu_idx, ra, &env->regs[r1], &env->regs[r1 + 1]);
+        fill_buf_random(env, mmu_idx, ra, &env->regs[r2], &env->regs[r2 + 1]);
         break;
     default:
         /* we don't implement any other subfunction yet */
-- 
2.53.0

[PULL 094/110] target/s390x: Compile crypto_helper.c as common unit

[Philippe Mathieu-Daudé]

In order do build crypto_helper.c as a common unit we need to
replace:

  "accel/tcg/cpu-ldst.h" -> "accel/tcg/cpu-ldst-common.h"

and update the cpu_ld/st_be_data_ra() API by cpu_ld/st_mmu() one.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20260423135035.50126-9-philmd@linaro.org>
---
 target/s390x/tcg/crypto_helper.c | 39 +++++++++++++++++---------------
 target/s390x/tcg/meson.build     |  2 +-
 2 files changed, 22 insertions(+), 19 deletions(-)

diff --git a/target/s390x/tcg/crypto_helper.c b/target/s390x/tcg/crypto_helper.c
index 074d745eb3f..ae392bce0e7 100644
--- a/target/s390x/tcg/crypto_helper.c
+++ b/target/s390x/tcg/crypto_helper.c
@@ -17,7 +17,7 @@
 #include "s390x-internal.h"
 #include "tcg_s390x.h"
 #include "exec/helper-proto.h"
-#include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/cpu-ldst-common.h"
 #include "accel/tcg/cpu-mmu-index.h"
 
 static uint64_t R(uint64_t x, int c)
@@ -123,44 +123,44 @@ static void sha512_bda_be64(uint64_t a[8], uint64_t w[16])
 static void sha512_read_icv(CPUS390XState *env, const int mmu_idx,
                             uint64_t addr, uint64_t a[8], uintptr_t ra)
 {
-    int i;
+    const MemOpIdx oi = make_memop_idx(MO_BE | MO_64 | MO_UNALN, mmu_idx);
 
-    for (i = 0; i < 8; i++, addr += 8) {
+    for (int i = 0; i < 8; i++, addr += 8) {
         addr = wrap_address(env, addr);
-        a[i] = cpu_ldq_be_data_ra(env, addr, ra);
+        a[i] = cpu_ldq_mmu(env, addr, oi, ra);
     }
 }
 
 static void sha512_write_ocv(CPUS390XState *env, const int mmu_idx,
                              uint64_t addr, uint64_t a[8], uintptr_t ra)
 {
-    int i;
+    const MemOpIdx oi = make_memop_idx(MO_BE | MO_64 | MO_UNALN, mmu_idx);
 
-    for (i = 0; i < 8; i++, addr += 8) {
+    for (int i = 0; i < 8; i++, addr += 8) {
         addr = wrap_address(env, addr);
-        cpu_stq_be_data_ra(env, addr, a[i], ra);
+        cpu_stq_mmu(env, addr, a[i], oi, ra);
     }
 }
 
 static void sha512_read_block(CPUS390XState *env, const int mmu_idx,
                               uint64_t addr, uint64_t a[16], uintptr_t ra)
 {
-    int i;
+    const MemOpIdx oi = make_memop_idx(MO_BE | MO_64 | MO_UNALN, mmu_idx);
 
-    for (i = 0; i < 16; i++, addr += 8) {
+    for (int i = 0; i < 16; i++, addr += 8) {
         addr = wrap_address(env, addr);
-        a[i] = cpu_ldq_be_data_ra(env, addr, ra);
+        a[i] = cpu_ldq_mmu(env, addr, oi, ra);
     }
 }
 
 static void sha512_read_mbl_be64(CPUS390XState *env, const int mmu_idx,
                                  uint64_t addr, uint8_t a[16], uintptr_t ra)
 {
-    int i;
+    const MemOpIdx oi = make_memop_idx(MO_8, mmu_idx);
 
-    for (i = 0; i < 16; i++, addr += 1) {
+    for (int i = 0; i < 16; i++, addr += 1) {
         addr = wrap_address(env, addr);
-        a[i] = cpu_ldub_data_ra(env, addr, ra);
+        a[i] = cpu_ldb_mmu(env, addr, oi, ra);
     }
 }
 
@@ -200,13 +200,14 @@ static int cpacf_sha512(CPUS390XState *env, const int mmu_idx, uintptr_t ra,
 
     /* KLMD: Process partial/empty block last. */
     if (type == S390_FEAT_TYPE_KLMD && len < 128) {
+        const MemOpIdx oi = make_memop_idx(MO_8, mmu_idx);
         uint8_t x[128];
 
         /* Read the remainder of the message byte-per-byte. */
         for (i = 0; i < len; i++) {
             uint64_t addr = wrap_address(env, *message_reg + processed + i);
 
-            x[i] = cpu_ldub_data_ra(env, addr, ra);
+            x[i] = cpu_ldb_mmu(env, addr, oi, ra);
         }
         /* Pad the remainder with zero and set the top bit. */
         memset(x + len, 0, 128 - len);
@@ -248,6 +249,7 @@ static int cpacf_sha512(CPUS390XState *env, const int mmu_idx, uintptr_t ra,
 static void fill_buf_random(CPUS390XState *env, const int mmu_idx, uintptr_t ra,
                             uint64_t *buf_reg, uint64_t *len_reg)
 {
+    const MemOpIdx oi = make_memop_idx(MO_8, mmu_idx);
     uint8_t tmp[256];
     uint64_t len = *len_reg;
     int buf_reg_len = 64;
@@ -262,7 +264,7 @@ static void fill_buf_random(CPUS390XState *env, const int mmu_idx, uintptr_t ra,
 
         qemu_guest_getrandom_nofail(tmp, block);
         for (size_t i = 0; i < block; ++i) {
-            cpu_stb_data_ra(env, wrap_address(env, *buf_reg), tmp[i], ra);
+            cpu_stb_mmu(env, wrap_address(env, *buf_reg), tmp[i], oi, ra);
             *buf_reg = deposit64(*buf_reg, 0, buf_reg_len, *buf_reg + 1);
             --*len_reg;
         }
@@ -279,7 +281,7 @@ uint32_t HELPER(msa)(CPUS390XState *env, uint32_t r1, uint32_t r2, uint32_t r3,
     const uint8_t fc = env->regs[0] & 0x7fULL;
     uint8_t subfunc[16] = { 0 };
     uint64_t param_addr;
-    int i;
+    MemOpIdx oi;
 
     switch (type) {
     case S390_FEAT_TYPE_KMAC:
@@ -300,9 +302,10 @@ uint32_t HELPER(msa)(CPUS390XState *env, uint32_t r1, uint32_t r2, uint32_t r3,
 
     switch (fc) {
     case 0: /* query subfunction */
-        for (i = 0; i < 16; i++) {
+        oi = make_memop_idx(MO_8, mmu_idx);
+        for (int i = 0; i < 16; i++) {
             param_addr = wrap_address(env, env->regs[1] + i);
-            cpu_stb_data_ra(env, param_addr, subfunc[i], ra);
+            cpu_stb_mmu(env, param_addr, subfunc[i], oi, ra);
         }
         break;
     case 3: /* CPACF_*_SHA_512 */
diff --git a/target/s390x/tcg/meson.build b/target/s390x/tcg/meson.build
index ed6441f6f44..36cb0e079ed 100644
--- a/target/s390x/tcg/meson.build
+++ b/target/s390x/tcg/meson.build
@@ -1,11 +1,11 @@
 s390x_ss.add(when: 'CONFIG_TCG', if_true: files(
-  'crypto_helper.c',
   'int_helper.c',
   'mem_helper.c',
   'misc_helper.c',
 ))
 s390x_common_ss.add(when: 'CONFIG_TCG', if_true: files(
   'cc_helper.c',
+  'crypto_helper.c',
   'excp_helper.c',
   'fpu_helper.c',
   'translate.c',
-- 
2.53.0

[PULL 095/110] target/s390x: Replace cpu_stb_data_ra -> cpu_stb_mmu in STFLE opcode

[Philippe Mathieu-Daudé]

In preparation of building misc_helper.c as a common unit, update
the cpu_ld/st_be_data_ra() API by cpu_ld/st_mmu() one and replace
"accel/tcg/cpu-ldst.h" by "accel/tcg/cpu-ldst-common.h".

For now we are blocked by the CONFIG_DEVICES use so keep the file
in s390x_ss[].

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20260423135035.50126-10-philmd@linaro.org>
---
 target/s390x/tcg/misc_helper.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/target/s390x/tcg/misc_helper.c b/target/s390x/tcg/misc_helper.c
index 1fd900fbbf0..3d13c8bd8ea 100644
--- a/target/s390x/tcg/misc_helper.c
+++ b/target/s390x/tcg/misc_helper.c
@@ -27,7 +27,8 @@
 #include "exec/helper-proto.h"
 #include "qemu/timer.h"
 #include "exec/cputlb.h"
-#include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/cpu-ldst-common.h"
+#include "accel/tcg/cpu-mmu-index.h"
 #include "exec/target_page.h"
 #include "qapi/error.h"
 #include "tcg_s390x.h"
@@ -710,6 +711,8 @@ void HELPER(stfl)(CPUS390XState *env)
 
 uint32_t HELPER(stfle)(CPUS390XState *env, uint64_t addr)
 {
+    const int mmu_idx = cpu_mmu_index(env_cpu(env), false);
+    const MemOpIdx oi = make_memop_idx(MO_8, mmu_idx);
     const uintptr_t ra = GETPC();
     const int count_bytes = ((env->regs[0] & 0xff) + 1) * 8;
     int max_bytes;
@@ -728,7 +731,7 @@ uint32_t HELPER(stfle)(CPUS390XState *env, uint64_t addr)
      * not store the words, and existing software depend on that.
      */
     for (i = 0; i < MIN(count_bytes, max_bytes); ++i) {
-        cpu_stb_data_ra(env, addr + i, stfl_bytes[i], ra);
+        cpu_stb_mmu(env, addr + i, stfl_bytes[i], oi, ra);
     }
 
     env->regs[0] = deposit64(env->regs[0], 0, 8, (max_bytes / 8) - 1);
-- 
2.53.0

[PULL 096/110] target/riscv: Iterate vCPUs using CPU_FOREACH() macro

[Philippe Mathieu-Daudé]

Most code iterates over vCPUs using the CPU_FOREACH()
macro. Prefer cpu_env(cpu) over &cpu->env.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Message-Id: <20260415215539.92629-9-philmd@linaro.org>
---
 hw/riscv/boot.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
index 9086793b7a7..ae2f86c7ceb 100644
--- a/hw/riscv/boot.c
+++ b/hw/riscv/boot.c
@@ -505,10 +505,11 @@ void riscv_setup_direct_kernel(hwaddr kernel_addr, hwaddr fdt_addr)
 {
     CPUState *cs;
 
-    for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {
-        RISCVCPU *riscv_cpu = RISCV_CPU(cs);
-        riscv_cpu->env.kernel_addr = kernel_addr;
-        riscv_cpu->env.fdt_addr = fdt_addr;
+    CPU_FOREACH(cs) {
+        CPURISCVState *env = cpu_env(cs);
+
+        env->kernel_addr = kernel_addr;
+        env->fdt_addr = fdt_addr;
     }
 }
 
-- 
2.53.0

[PULL 097/110] target/mips: Reduce CPUState scope when used with CPU_FOREACH()

[Philippe Mathieu-Daudé]

When possible, reduce CPUState variable scope.
Prefer cpu_env(cpu) over &cpu->env.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Message-Id: <20260415215539.92629-8-philmd@linaro.org>
---
 target/mips/internal.h              | 11 ++++++-----
 target/mips/tcg/system/cp0_helper.c | 28 ++++++++++++++++------------
 target/mips/tcg/system/tlb_helper.c |  7 +++----
 3 files changed, 25 insertions(+), 21 deletions(-)

diff --git a/target/mips/internal.h b/target/mips/internal.h
index 95b8b7bb9c9..2fd5ffa304a 100644
--- a/target/mips/internal.h
+++ b/target/mips/internal.h
@@ -280,7 +280,7 @@ static inline int mips_vpe_active(CPUMIPSState *env)
 
 static inline int mips_vp_active(CPUMIPSState *env)
 {
-    CPUState *other_cs = first_cpu;
+    CPUState *cs = first_cpu;
 
     /* Check if the VP disabled other VPs (which means the VP is enabled) */
     if ((env->CP0_VPControl >> CP0VPCtl_DIS) & 1) {
@@ -288,10 +288,11 @@ static inline int mips_vp_active(CPUMIPSState *env)
     }
 
     /* Check if the virtual processor is disabled due to a DVP */
-    CPU_FOREACH(other_cs) {
-        MIPSCPU *other_cpu = MIPS_CPU(other_cs);
-        if ((&other_cpu->env != env) &&
-            ((other_cpu->env.CP0_VPControl >> CP0VPCtl_DIS) & 1)) {
+    CPU_FOREACH(cs) {
+        CPUMIPSState *other_env = cpu_env(cs);
+
+        if ((other_env != env) &&
+            ((other_env->CP0_VPControl >> CP0VPCtl_DIS) & 1)) {
             return 0;
         }
     }
diff --git a/target/mips/tcg/system/cp0_helper.c b/target/mips/tcg/system/cp0_helper.c
index 123d5c217c1..8b83ba16399 100644
--- a/target/mips/tcg/system/cp0_helper.c
+++ b/target/mips/tcg/system/cp0_helper.c
@@ -1566,13 +1566,14 @@ target_ulong helper_emt(void)
 
 target_ulong helper_dvpe(CPUMIPSState *env)
 {
-    CPUState *other_cs = first_cpu;
     MIPSCPU *cpu = env_archcpu(env);
     target_ulong prev = cpu->mvp->CP0_MVPControl;
 
     if (env->CP0_VPEConf0 & (1 << CP0VPEC0_MVP)) {
-        CPU_FOREACH(other_cs) {
-            MIPSCPU *other_cpu = MIPS_CPU(other_cs);
+        CPUState *cs = first_cpu;
+
+        CPU_FOREACH(cs) {
+            MIPSCPU *other_cpu = MIPS_CPU(cs);
             /* Turn off all VPEs except the one executing the dvpe.  */
             if (&other_cpu->env != env) {
                 other_cpu->mvp->CP0_MVPControl &= ~(1 << CP0MVPCo_EVP);
@@ -1585,13 +1586,14 @@ target_ulong helper_dvpe(CPUMIPSState *env)
 
 target_ulong helper_evpe(CPUMIPSState *env)
 {
-    CPUState *other_cs = first_cpu;
     MIPSCPU *cpu = env_archcpu(env);
     target_ulong prev = cpu->mvp->CP0_MVPControl;
 
     if (env->CP0_VPEConf0 & (1 << CP0VPEC0_MVP)) {
-        CPU_FOREACH(other_cs) {
-            MIPSCPU *other_cpu = MIPS_CPU(other_cs);
+        CPUState *cs = first_cpu;
+
+        CPU_FOREACH(cs) {
+            MIPSCPU *other_cpu = MIPS_CPU(cs);
 
             if (&other_cpu->env != env
                 /* If the VPE is WFI, don't disturb its sleep.  */
@@ -1608,12 +1610,13 @@ target_ulong helper_evpe(CPUMIPSState *env)
 /* R6 Multi-threading */
 target_ulong helper_dvp(CPUMIPSState *env)
 {
-    CPUState *other_cs = first_cpu;
     target_ulong prev = env->CP0_VPControl;
 
     if (!((env->CP0_VPControl >> CP0VPCtl_DIS) & 1)) {
-        CPU_FOREACH(other_cs) {
-            MIPSCPU *other_cpu = MIPS_CPU(other_cs);
+        CPUState *cpu = first_cpu;
+
+        CPU_FOREACH(cpu) {
+            MIPSCPU *other_cpu = MIPS_CPU(cpu);
             /* Turn off all VPs except the one executing the dvp. */
             if (&other_cpu->env != env) {
                 mips_vpe_sleep(other_cpu);
@@ -1626,12 +1629,13 @@ target_ulong helper_dvp(CPUMIPSState *env)
 
 target_ulong helper_evp(CPUMIPSState *env)
 {
-    CPUState *other_cs = first_cpu;
     target_ulong prev = env->CP0_VPControl;
 
     if ((env->CP0_VPControl >> CP0VPCtl_DIS) & 1) {
-        CPU_FOREACH(other_cs) {
-            MIPSCPU *other_cpu = MIPS_CPU(other_cs);
+        CPUState *cpu = first_cpu;
+
+        CPU_FOREACH(cpu) {
+            MIPSCPU *other_cpu = MIPS_CPU(cpu);
             if ((&other_cpu->env != env) && !mips_vp_is_wfi(other_cpu)) {
                 /*
                  * If the VP is WFI, don't disturb its sleep.
diff --git a/target/mips/tcg/system/tlb_helper.c b/target/mips/tcg/system/tlb_helper.c
index b989c7e5bd5..45cbeb40a2d 100644
--- a/target/mips/tcg/system/tlb_helper.c
+++ b/target/mips/tcg/system/tlb_helper.c
@@ -346,15 +346,14 @@ void helper_ginvt(CPUMIPSState *env, target_ulong arg, uint32_t type)
     uint32_t invMsgVPN2 = arg & (TARGET_PAGE_MASK << 1);
     uint8_t invMsgR = 0;
     uint32_t invMsgMMid = env->CP0_MemoryMapID;
-    CPUState *other_cs = first_cpu;
+    CPUState *cpu = first_cpu;
 
 #ifdef TARGET_MIPS64
     invMsgR = extract64(arg, 62, 2);
 #endif
 
-    CPU_FOREACH(other_cs) {
-        MIPSCPU *other_cpu = MIPS_CPU(other_cs);
-        global_invalidate_tlb(&other_cpu->env, invMsgVPN2, invMsgR, invMsgMMid,
+    CPU_FOREACH(cpu) {
+        global_invalidate_tlb(cpu_env(cpu), invMsgVPN2, invMsgR, invMsgMMid,
                               invAll, invVAMMid, invMMid, invVA);
     }
 }
-- 
2.53.0

[PULL 098/110] target/mips: Do not initialize variable used by CPU_FOREACH macro

[Philippe Mathieu-Daudé]

The CPU_FOREACH() macro, defined in "hw/core/cpu.h",
ends up calling QTAILQ_FOREACH_RCU() which always
assigns its iterator variable when entering the loop.
Remove the pointless and possibly misleading assignment.

Mechanical patch using the following coccinelle spatch:

  @@
  type T;
  identifier e;
  iterator FOREACH_MACRO =~ ".*_FOREACH.*";
  statement S;
  @@
  -    T *e = ...;
  +    T *e;
       ... when != e
       FOREACH_MACRO(e, ...) S

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Message-Id: <20260415215539.92629-7-philmd@linaro.org>
---
 target/mips/internal.h              | 2 +-
 hw/misc/mips_cpc.c                  | 4 ++--
 target/mips/tcg/system/cp0_helper.c | 8 ++++----
 target/mips/tcg/system/tlb_helper.c | 2 +-
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/target/mips/internal.h b/target/mips/internal.h
index 2fd5ffa304a..23e1ada1852 100644
--- a/target/mips/internal.h
+++ b/target/mips/internal.h
@@ -280,7 +280,7 @@ static inline int mips_vpe_active(CPUMIPSState *env)
 
 static inline int mips_vp_active(CPUMIPSState *env)
 {
-    CPUState *cs = first_cpu;
+    CPUState *cs;
 
     /* Check if the VP disabled other VPs (which means the VP is enabled) */
     if ((env->CP0_VPControl >> CP0VPCtl_DIS) & 1) {
diff --git a/hw/misc/mips_cpc.c b/hw/misc/mips_cpc.c
index 9d9c8bf6ec8..9ce37514d5b 100644
--- a/hw/misc/mips_cpc.c
+++ b/hw/misc/mips_cpc.c
@@ -45,7 +45,7 @@ static void mips_cpu_reset_async_work(CPUState *cs, run_on_cpu_data data)
 
 static void cpc_run_vp(MIPSCPCState *cpc, uint64_t vp_run)
 {
-    CPUState *cs = first_cpu;
+    CPUState *cs;
 
     CPU_FOREACH(cs) {
         uint64_t i = 1ULL << cs->cpu_index;
@@ -63,7 +63,7 @@ static void cpc_run_vp(MIPSCPCState *cpc, uint64_t vp_run)
 
 static void cpc_stop_vp(MIPSCPCState *cpc, uint64_t vp_stop)
 {
-    CPUState *cs = first_cpu;
+    CPUState *cs;
 
     CPU_FOREACH(cs) {
         uint64_t i = 1ULL << cs->cpu_index;
diff --git a/target/mips/tcg/system/cp0_helper.c b/target/mips/tcg/system/cp0_helper.c
index 8b83ba16399..ba6b487b751 100644
--- a/target/mips/tcg/system/cp0_helper.c
+++ b/target/mips/tcg/system/cp0_helper.c
@@ -1570,7 +1570,7 @@ target_ulong helper_dvpe(CPUMIPSState *env)
     target_ulong prev = cpu->mvp->CP0_MVPControl;
 
     if (env->CP0_VPEConf0 & (1 << CP0VPEC0_MVP)) {
-        CPUState *cs = first_cpu;
+        CPUState *cs;
 
         CPU_FOREACH(cs) {
             MIPSCPU *other_cpu = MIPS_CPU(cs);
@@ -1590,7 +1590,7 @@ target_ulong helper_evpe(CPUMIPSState *env)
     target_ulong prev = cpu->mvp->CP0_MVPControl;
 
     if (env->CP0_VPEConf0 & (1 << CP0VPEC0_MVP)) {
-        CPUState *cs = first_cpu;
+        CPUState *cs;
 
         CPU_FOREACH(cs) {
             MIPSCPU *other_cpu = MIPS_CPU(cs);
@@ -1613,7 +1613,7 @@ target_ulong helper_dvp(CPUMIPSState *env)
     target_ulong prev = env->CP0_VPControl;
 
     if (!((env->CP0_VPControl >> CP0VPCtl_DIS) & 1)) {
-        CPUState *cpu = first_cpu;
+        CPUState *cpu;
 
         CPU_FOREACH(cpu) {
             MIPSCPU *other_cpu = MIPS_CPU(cpu);
@@ -1632,7 +1632,7 @@ target_ulong helper_evp(CPUMIPSState *env)
     target_ulong prev = env->CP0_VPControl;
 
     if ((env->CP0_VPControl >> CP0VPCtl_DIS) & 1) {
-        CPUState *cpu = first_cpu;
+        CPUState *cpu;
 
         CPU_FOREACH(cpu) {
             MIPSCPU *other_cpu = MIPS_CPU(cpu);
diff --git a/target/mips/tcg/system/tlb_helper.c b/target/mips/tcg/system/tlb_helper.c
index 45cbeb40a2d..c850ddd9650 100644
--- a/target/mips/tcg/system/tlb_helper.c
+++ b/target/mips/tcg/system/tlb_helper.c
@@ -346,7 +346,7 @@ void helper_ginvt(CPUMIPSState *env, target_ulong arg, uint32_t type)
     uint32_t invMsgVPN2 = arg & (TARGET_PAGE_MASK << 1);
     uint8_t invMsgR = 0;
     uint32_t invMsgMMid = env->CP0_MemoryMapID;
-    CPUState *cpu = first_cpu;
+    CPUState *cpu;
 
 #ifdef TARGET_MIPS64
     invMsgR = extract64(arg, 62, 2);
-- 
2.53.0

[PULL 099/110] target/s390x: Do not compile KVM stubs for linux-user binary

[Philippe Mathieu-Daudé]

None of these KVM symbols should be used in the qemu-s390x
linux-user binary. Do not build the stub there, prefer a
real linker failure.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20260423135035.50126-3-philmd@linaro.org>
---
 target/s390x/kvm/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/s390x/kvm/meson.build b/target/s390x/kvm/meson.build
index 588a9aa737e..437e12f221f 100644
--- a/target/s390x/kvm/meson.build
+++ b/target/s390x/kvm/meson.build
@@ -1,5 +1,5 @@
 
-s390x_ss.add(when: 'CONFIG_KVM', if_true: files(
+s390x_system_ss.add(when: 'CONFIG_KVM', if_true: files(
   'pv.c',
   'kvm.c',
   'stsi-topology.c'
-- 
2.53.0

[PULL 100/110] target/xtensa/core: register types using type_init

[Philippe Mathieu-Daudé]

From: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

Instead of using a static constructor, delay registering those types
until we call module_init(MODULE_INIT_QOM).

This is not yet a problem, but since we will start initializing
target-info types before any other, without this patch
qemu-system-xtensa* fails with:
Type 'dsp3400-xtensa-cpu' is missing its parent 'xtensa-cpu'

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Message-ID: <20260430203842.29156-4-pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/xtensa/overlay_tool.h | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/xtensa/overlay_tool.h b/target/xtensa/overlay_tool.h
index 701c00eed20..b9eaffa4871 100644
--- a/target/xtensa/overlay_tool.h
+++ b/target/xtensa/overlay_tool.h
@@ -451,13 +451,14 @@
 
 #if TARGET_BIG_ENDIAN == (XCHAL_HAVE_BE != 0)
 #define REGISTER_CORE(core) \
-    static void __attribute__((constructor)) register_core(void) \
+    static void register_core(void) \
     { \
         static XtensaConfigList node = { \
             .config = &core, \
         }; \
         xtensa_register_core(&node); \
-    }
+    } \
+    type_init(register_core)
 #else
 #define REGISTER_CORE(core)
 #endif
-- 
2.53.0

[PULL 101/110] io: Clear dangling GLib event source tag

[Philippe Mathieu-Daudé]

Following commit 34aad589019 ("hw/char/virtio-console: clear
dangling GLib event source tag"), prevent stale tags from
being reused by clearing dangling GLib event source tag during
the cleanup phase (finalize, unrealize).

Inspired-by: Matthew Penney <matt@matthewpenney.net>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Matthew Penney <matt@matthewpenney.net>
Message-Id: <20260408100605.66795-2-philmd@linaro.org>
---
 hw/usb/redirect.c                     | 4 +---
 io/channel-websock.c                  | 8 ++------
 target/i386/kvm/tdx-quote-generator.c | 5 +----
 3 files changed, 4 insertions(+), 13 deletions(-)

diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
index fda5bbca676..100afbdb06a 100644
--- a/hw/usb/redirect.c
+++ b/hw/usb/redirect.c
@@ -1494,9 +1494,7 @@ static void usbredir_unrealize(USBDevice *udev)
     if (dev->parser) {
         usbredirparser_destroy(dev->parser);
     }
-    if (dev->watch) {
-        g_source_remove(dev->watch);
-    }
+    g_clear_handle_id(&dev->watch, g_source_remove);
 
     free(dev->filter_rules);
     qemu_del_vm_change_state_handler(dev->vmstate);
diff --git a/io/channel-websock.c b/io/channel-websock.c
index 85b22a8822a..617d79c351a 100644
--- a/io/channel-websock.c
+++ b/io/channel-websock.c
@@ -950,12 +950,8 @@ static void qio_channel_websock_finalize(Object *obj)
     buffer_free(&ioc->encinput);
     buffer_free(&ioc->encoutput);
     buffer_free(&ioc->rawinput);
-    if (ioc->hs_io_tag) {
-        g_source_remove(ioc->hs_io_tag);
-    }
-    if (ioc->io_tag) {
-        g_source_remove(ioc->io_tag);
-    }
+    g_clear_handle_id(&ioc->hs_io_tag, g_source_remove);
+    g_clear_handle_id(&ioc->io_tag, g_source_remove);
     error_free(ioc->io_err);
     object_unref(OBJECT(ioc->master));
 }
diff --git a/target/i386/kvm/tdx-quote-generator.c b/target/i386/kvm/tdx-quote-generator.c
index dee8334b27a..002bc40c8a8 100644
--- a/target/i386/kvm/tdx-quote-generator.c
+++ b/target/i386/kvm/tdx-quote-generator.c
@@ -74,10 +74,7 @@ static void encode_header(char *buf, size_t len, uint32_t size) {
 static void tdx_generate_quote_cleanup(TdxGenerateQuoteTask *task)
 {
     timer_del(&task->timer);
-
-    if (task->watch) {
-        g_source_remove(task->watch);
-    }
+    g_clear_handle_id(&task->watch, g_source_remove);
     qio_channel_close(QIO_CHANNEL(task->sioc), NULL);
     object_unref(OBJECT(task->sioc));
 
-- 
2.53.0

[PULL 102/110] io: use g_clear_handle_id() for GSource cleanup

[Philippe Mathieu-Daudé]

Use g_clear_handle_id() instead of g_source_remove() with
manual ID checking and zeroing.

This simplifies the code and ensures consistent handling of
GSource IDs, since g_clear_handle_id() checks for a non-zero
ID before calling the cleanup function and zeros it afterwards.

No functional change intended.

Mechanical change using the following Coccinelle spatch script:

  @@
  expression TAG;
  @@
  -    if (TAG > 0) {
  +    if (TAG) {
           g_source_remove(TAG);
           <... when != TAG
           TAG = 0;
           ...>
       }

  @@
  expression TAG;
  @@
  -    g_source_remove(TAG);
  -    TAG = 0;
  +    g_clear_handle_id(&TAG, g_source_remove);

  @@
  expression TAG;
  @@
  -    if (TAG) {
           g_clear_handle_id(&TAG, g_source_remove);
  -    }

Inspired-by: Matthew Penney <matt@matthewpenney.net>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Matthew Penney <matt@matthewpenney.net>
Message-Id: <20260408100605.66795-3-philmd@linaro.org>
---
 hw/char/cmsdk-apb-uart.c  |  5 +----
 hw/char/nrf51_uart.c      |  5 +----
 hw/char/serial.c          |  6 +-----
 hw/char/stm32l4x5_usart.c |  5 +----
 hw/char/terminal3270.c    |  5 +----
 hw/char/virtio-console.c  | 10 ++--------
 hw/usb/redirect.c         |  5 +----
 io/channel-websock.c      | 13 +++----------
 net/passt.c               |  8 ++------
 net/stream.c              | 15 +++------------
 net/stream_data.c         |  5 +----
 net/vhost-user.c          |  8 ++------
 ui/dbus-clipboard.c       |  6 ++----
 ui/input-barrier.c        |  6 +-----
 ui/vnc-auth-vencrypt.c    |  6 +-----
 ui/vnc-ws.c               | 12 ++----------
 16 files changed, 25 insertions(+), 95 deletions(-)

diff --git a/hw/char/cmsdk-apb-uart.c b/hw/char/cmsdk-apb-uart.c
index edb80f61819..0631821a571 100644
--- a/hw/char/cmsdk-apb-uart.c
+++ b/hw/char/cmsdk-apb-uart.c
@@ -236,10 +236,7 @@ buffer_drained:
 
 static void uart_cancel_transmit(CMSDKAPBUART *s)
 {
-    if (s->watch_tag) {
-        g_source_remove(s->watch_tag);
-        s->watch_tag = 0;
-    }
+    g_clear_handle_id(&s->watch_tag, g_source_remove);
 }
 
 static void uart_write(void *opaque, hwaddr offset, uint64_t value,
diff --git a/hw/char/nrf51_uart.c b/hw/char/nrf51_uart.c
index 73069232441..96f0d085fdd 100644
--- a/hw/char/nrf51_uart.c
+++ b/hw/char/nrf51_uart.c
@@ -104,10 +104,7 @@ buffer_drained:
 
 static void uart_cancel_transmit(NRF51UARTState *s)
 {
-    if (s->watch_tag) {
-        g_source_remove(s->watch_tag);
-        s->watch_tag = 0;
-    }
+    g_clear_handle_id(&s->watch_tag, g_source_remove);
 }
 
 static void uart_write(void *opaque, hwaddr addr,
diff --git a/hw/char/serial.c b/hw/char/serial.c
index 0f3469a1e8f..0729cd2ce9d 100644
--- a/hw/char/serial.c
+++ b/hw/char/serial.c
@@ -856,11 +856,7 @@ const VMStateDescription vmstate_serial = {
 static void serial_reset(void *opaque)
 {
     SerialState *s = opaque;
-
-    if (s->watch_tag > 0) {
-        g_source_remove(s->watch_tag);
-        s->watch_tag = 0;
-    }
+    g_clear_handle_id(&s->watch_tag, g_source_remove);
 
     s->rbr = 0;
     s->ier = 0;
diff --git a/hw/char/stm32l4x5_usart.c b/hw/char/stm32l4x5_usart.c
index 736f1e764e6..dd1b0991956 100644
--- a/hw/char/stm32l4x5_usart.c
+++ b/hw/char/stm32l4x5_usart.c
@@ -280,10 +280,7 @@ buffer_drained:
 
 static void usart_cancel_transmit(Stm32l4x5UsartBaseState *s)
 {
-    if (s->watch_tag) {
-        g_source_remove(s->watch_tag);
-        s->watch_tag = 0;
-    }
+    g_clear_handle_id(&s->watch_tag, g_source_remove);
 }
 
 static void stm32l4x5_update_params(Stm32l4x5UsartBaseState *s)
diff --git a/hw/char/terminal3270.c b/hw/char/terminal3270.c
index 1d857bad9bc..989b6f6ee1e 100644
--- a/hw/char/terminal3270.c
+++ b/hw/char/terminal3270.c
@@ -52,10 +52,7 @@ static int terminal_can_read(void *opaque)
 
 static void terminal_timer_cancel(Terminal3270 *t)
 {
-    if (t->timer_tag) {
-        g_source_remove(t->timer_tag);
-        t->timer_tag = 0;
-    }
+    g_clear_handle_id(&t->timer_tag, g_source_remove);
 }
 
 /*
diff --git a/hw/char/virtio-console.c b/hw/char/virtio-console.c
index efe7cd6772e..4737b9a56eb 100644
--- a/hw/char/virtio-console.c
+++ b/hw/char/virtio-console.c
@@ -159,10 +159,7 @@ static void chr_event(void *opaque, QEMUChrEvent event)
         virtio_serial_open(port);
         break;
     case CHR_EVENT_CLOSED:
-        if (vcon->watch) {
-            g_source_remove(vcon->watch);
-            vcon->watch = 0;
-        }
+        g_clear_handle_id(&vcon->watch, g_source_remove);
         virtio_serial_close(port);
         break;
     case CHR_EVENT_BREAK:
@@ -255,10 +252,7 @@ static void virtconsole_realize(DeviceState *dev, Error **errp)
 static void virtconsole_unrealize(DeviceState *dev)
 {
     VirtConsole *vcon = VIRTIO_CONSOLE(dev);
-
-    if (vcon->watch) {
-        g_clear_handle_id(&vcon->watch, g_source_remove);
-    }
+    g_clear_handle_id(&vcon->watch, g_source_remove);
 }
 
 static void virtconsole_class_init(ObjectClass *klass, const void *data)
diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
index 100afbdb06a..bde821e214b 100644
--- a/hw/usb/redirect.c
+++ b/hw/usb/redirect.c
@@ -1226,10 +1226,7 @@ static void usbredir_chardev_close_bh(void *opaque)
         usbredirparser_destroy(dev->parser);
         dev->parser = NULL;
     }
-    if (dev->watch) {
-        g_source_remove(dev->watch);
-        dev->watch = 0;
-    }
+    g_clear_handle_id(&dev->watch, g_source_remove);
 }
 
 static void usbredir_create_parser(USBRedirDevice *dev)
diff --git a/io/channel-websock.c b/io/channel-websock.c
index 617d79c351a..1929abf56ac 100644
--- a/io/channel-websock.c
+++ b/io/channel-websock.c
@@ -1066,10 +1066,7 @@ static gboolean qio_channel_websock_flush(QIOChannel *ioc,
 
 static void qio_channel_websock_unset_watch(QIOChannelWebsock *ioc)
 {
-    if (ioc->io_tag) {
-        g_source_remove(ioc->io_tag);
-        ioc->io_tag = 0;
-    }
+    g_clear_handle_id(&ioc->io_tag, g_source_remove);
 }
 
 static void qio_channel_websock_set_watch(QIOChannelWebsock *ioc)
@@ -1246,12 +1243,8 @@ static int qio_channel_websock_close(QIOChannel *ioc,
     buffer_free(&wioc->encinput);
     buffer_free(&wioc->encoutput);
     buffer_free(&wioc->rawinput);
-    if (wioc->hs_io_tag) {
-        g_clear_handle_id(&wioc->hs_io_tag, g_source_remove);
-    }
-    if (wioc->io_tag) {
-        g_clear_handle_id(&wioc->io_tag, g_source_remove);
-    }
+    g_clear_handle_id(&wioc->hs_io_tag, g_source_remove);
+    g_clear_handle_id(&wioc->io_tag, g_source_remove);
     if (wioc->io_err) {
         g_clear_pointer(&wioc->io_err, error_free);
     }
diff --git a/net/passt.c b/net/passt.c
index 4ff94ee509d..d3b5ab426c9 100644
--- a/net/passt.c
+++ b/net/passt.c
@@ -90,10 +90,7 @@ static void net_passt_cleanup(NetClientState *nc)
         g_free(s->vhost_net);
         s->vhost_net = NULL;
     }
-    if (s->vhost_watch) {
-        g_source_remove(s->vhost_watch);
-        s->vhost_watch = 0;
-    }
+    g_clear_handle_id(&s->vhost_watch, g_source_remove);
     qemu_chr_fe_deinit(&s->vhost_chr, true);
     if (s->vhost_user) {
         vhost_user_cleanup(s->vhost_user);
@@ -421,8 +418,7 @@ static void passt_vhost_user_event(void *opaque, QEMUChrEvent event)
         if (s->vhost_watch) {
             AioContext *ctx = qemu_get_current_aio_context();
 
-            g_source_remove(s->vhost_watch);
-            s->vhost_watch = 0;
+            g_clear_handle_id(&s->vhost_watch, g_source_remove);
             qemu_chr_fe_set_handlers(&s->vhost_chr, NULL, NULL,  NULL, NULL,
                                      NULL, NULL, false);
 
diff --git a/net/stream.c b/net/stream.c
index ea83f4a763a..6df4e251feb 100644
--- a/net/stream.c
+++ b/net/stream.c
@@ -71,24 +71,15 @@ static gboolean net_stream_send(QIOChannel *ioc,
 static void net_stream_cleanup(NetClientState *nc)
 {
     NetStreamState *s = DO_UPCAST(NetStreamState, data.nc, nc);
-    if (s->timer_tag) {
-        g_source_remove(s->timer_tag);
-        s->timer_tag = 0;
-    }
+    g_clear_handle_id(&s->timer_tag, g_source_remove);
     if (s->addr) {
         qapi_free_SocketAddress(s->addr);
         s->addr = NULL;
     }
     if (s->data.ioc) {
         if (QIO_CHANNEL_SOCKET(s->data.ioc)->fd != -1) {
-            if (s->data.ioc_read_tag) {
-                g_source_remove(s->data.ioc_read_tag);
-                s->data.ioc_read_tag = 0;
-            }
-            if (s->data.ioc_write_tag) {
-                g_source_remove(s->data.ioc_write_tag);
-                s->data.ioc_write_tag = 0;
-            }
+            g_clear_handle_id(&s->data.ioc_read_tag, g_source_remove);
+            g_clear_handle_id(&s->data.ioc_write_tag, g_source_remove);
         }
         object_unref(OBJECT(s->data.ioc));
         s->data.ioc = NULL;
diff --git a/net/stream_data.c b/net/stream_data.c
index 03740e9f73e..73b45da9fe3 100644
--- a/net/stream_data.c
+++ b/net/stream_data.c
@@ -84,10 +84,7 @@ void net_stream_data_rs_finalize(SocketReadState *rs)
     if (qemu_send_packet_async(&d->nc, rs->buf,
                                rs->packet_len,
                                net_stream_data_send_completed) == 0) {
-        if (d->ioc_read_tag) {
-            g_source_remove(d->ioc_read_tag);
-            d->ioc_read_tag = 0;
-        }
+        g_clear_handle_id(&d->ioc_read_tag, g_source_remove);
     }
 }
 
diff --git a/net/vhost-user.c b/net/vhost-user.c
index a4bb49bbcff..2d0fc49b4d8 100644
--- a/net/vhost-user.c
+++ b/net/vhost-user.c
@@ -215,10 +215,7 @@ static void net_vhost_user_cleanup(NetClientState *nc)
         s->vhost_net = NULL;
     }
     if (nc->queue_index == 0) {
-        if (s->watch) {
-            g_source_remove(s->watch);
-            s->watch = 0;
-        }
+        g_clear_handle_id(&s->watch, g_source_remove);
         qemu_chr_fe_deinit(&s->chr, true);
         if (s->vhost_user) {
             vhost_user_cleanup(s->vhost_user);
@@ -356,8 +353,7 @@ static void net_vhost_user_event(void *opaque, QEMUChrEvent event)
         if (s->watch) {
             AioContext *ctx = qemu_get_current_aio_context();
 
-            g_source_remove(s->watch);
-            s->watch = 0;
+            g_clear_handle_id(&s->watch, g_source_remove);
             qemu_chr_fe_set_handlers(&s->chr, NULL, NULL, NULL, NULL,
                                      NULL, NULL, false);
 
diff --git a/ui/dbus-clipboard.c b/ui/dbus-clipboard.c
index 935b6b1a2ac..90318384ee4 100644
--- a/ui/dbus-clipboard.c
+++ b/ui/dbus-clipboard.c
@@ -80,8 +80,7 @@ dbus_clipboard_update_info(DBusDisplay *dpy, QemuClipboardInfo *info)
     if (req->invocation && info->types[req->type].data) {
         dbus_clipboard_complete_request(dpy, req->invocation, info, req->type);
         g_clear_object(&req->invocation);
-        g_source_remove(req->timeout_id);
-        req->timeout_id = 0;
+        g_clear_handle_id(&req->timeout_id, g_source_remove);
         return;
     }
 
@@ -183,8 +182,7 @@ dbus_clipboard_request_cancelled(DBusClipboardRequest *req)
         "Cancelled clipboard request");
 
     g_clear_object(&req->invocation);
-    g_source_remove(req->timeout_id);
-    req->timeout_id = 0;
+    g_clear_handle_id(&req->timeout_id, g_source_remove);
 }
 
 static void
diff --git a/ui/input-barrier.c b/ui/input-barrier.c
index 74724be8f45..042f63cc5a1 100644
--- a/ui/input-barrier.c
+++ b/ui/input-barrier.c
@@ -518,11 +518,7 @@ static void input_barrier_complete(UserCreatable *uc, Error **errp)
 static void input_barrier_instance_finalize(Object *obj)
 {
     InputBarrier *ib = INPUT_BARRIER(obj);
-
-    if (ib->ioc_tag) {
-        g_source_remove(ib->ioc_tag);
-        ib->ioc_tag = 0;
-    }
+    g_clear_handle_id(&ib->ioc_tag, g_source_remove);
 
     if (ib->sioc) {
         qio_channel_close(QIO_CHANNEL(ib->sioc), NULL);
diff --git a/ui/vnc-auth-vencrypt.c b/ui/vnc-auth-vencrypt.c
index d9c212ff328..a1b8cde2292 100644
--- a/ui/vnc-auth-vencrypt.c
+++ b/ui/vnc-auth-vencrypt.c
@@ -101,11 +101,7 @@ static int protocol_client_vencrypt_auth(VncState *vs, uint8_t *data, size_t len
         QIOChannelTLS *tls;
         vnc_write_u8(vs, 1); /* Accept auth */
         vnc_flush(vs);
-
-        if (vs->ioc_tag) {
-            g_source_remove(vs->ioc_tag);
-            vs->ioc_tag = 0;
-        }
+        g_clear_handle_id(&vs->ioc_tag, g_source_remove);
 
         tls = qio_channel_tls_new_server(
             vs->ioc,
diff --git a/ui/vnc-ws.c b/ui/vnc-ws.c
index 9e3503d93d8..65e8b344b65 100644
--- a/ui/vnc-ws.c
+++ b/ui/vnc-ws.c
@@ -54,11 +54,7 @@ gboolean vncws_tls_handshake_io(QIOChannel *ioc G_GNUC_UNUSED,
     VncState *vs = opaque;
     QIOChannelTLS *tls;
     Error *err = NULL;
-
-    if (vs->ioc_tag) {
-        g_source_remove(vs->ioc_tag);
-        vs->ioc_tag = 0;
-    }
+    g_clear_handle_id(&vs->ioc_tag, g_source_remove);
 
     if (condition & (G_IO_HUP | G_IO_ERR)) {
         vnc_client_error(vs);
@@ -123,11 +119,7 @@ gboolean vncws_handshake_io(QIOChannel *ioc G_GNUC_UNUSED,
 {
     VncState *vs = opaque;
     QIOChannelWebsock *wioc;
-
-    if (vs->ioc_tag) {
-        g_source_remove(vs->ioc_tag);
-        vs->ioc_tag = 0;
-    }
+    g_clear_handle_id(&vs->ioc_tag, g_source_remove);
 
     if (condition & (G_IO_HUP | G_IO_ERR)) {
         vnc_client_error(vs);
-- 
2.53.0

[PULL 103/110] scripts/checkpatch: Reject another license boilerplate pattern

[Philippe Mathieu-Daudé]

From: Bernhard Beschow <shentey@gmail.com>

The pattern us used 56 times in QEMU.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Tested-by: Matyas Bobek <matyas.bobek@gmail.com>
Message-ID: <20260414135018.13585-1-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 scripts/checkpatch.pl | 1 +
 1 file changed, 1 insertion(+)

diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index e1cf2ff23b9..d440553a7ed 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -368,6 +368,7 @@ our @typeList = (
 # Match text found in common license boilerplate comments:
 # for new files the SPDX-License-Identifier line is sufficient.
 our @LICENSE_BOILERPLATE = (
+	"licensed under the GPL version 2",
 	"licensed under the terms of the GNU GPL",
 	"under the terms of the GNU General Public License",
 	"under the terms of the GNU Lesser General Public",
-- 
2.53.0

[PULL 104/110] cocci: Do not initialize variable used by QLIST_FOREACH macro

[Philippe Mathieu-Daudé]

The QLIST_FOREACH() macro, defined in "qemu/queue.h",
always assigns its iterator variable when entering the
loop. Remove the pointless and possibly misleading
assignment.

Mechanical patch using the following coccinelle spatch:

  @@
  type T;
  identifier e;
  iterator FOREACH_MACRO =~ ".*_FOREACH.*";
  statement S;
  @@
  -    T *e = ...;
  +    T *e;
       ... when != e
       FOREACH_MACRO(e, ...) S

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Message-Id: <20260415215539.92629-2-philmd@linaro.org>
---
 block/blkio.c               | 2 +-
 block/gluster.c             | 4 ++--
 hw/arm/virt-acpi-build.c    | 2 +-
 hw/i386/xen/xen-hvm.c       | 4 ++--
 hw/riscv/riscv-iommu.c      | 2 +-
 hw/vfio/cpr-legacy.c        | 2 +-
 hw/vfio/listener.c          | 4 ++--
 hw/xen/xen_pt_config_init.c | 4 ++--
 8 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/block/blkio.c b/block/blkio.c
index 20f138a38c5..fb8bec27d71 100644
--- a/block/blkio.c
+++ b/block/blkio.c
@@ -124,7 +124,7 @@ blkio_do_alloc_bounce_buffer(BDRVBlkioState *s, BlkioBounceBuf *bounce,
                              int64_t bytes)
 {
     void *addr = s->bounce_pool.addr;
-    BlkioBounceBuf *cur = NULL;
+    BlkioBounceBuf *cur;
     BlkioBounceBuf *prev = NULL;
     ptrdiff_t space;
 
diff --git a/block/gluster.c b/block/gluster.c
index 4fb25b2c6d8..279f650241c 100644
--- a/block/gluster.c
+++ b/block/gluster.c
@@ -251,7 +251,7 @@ static void glfs_set_preopened(const char *volume, glfs_t *fs)
 
 static glfs_t *glfs_find_preopened(const char *volume)
 {
-    ListElement *entry = NULL;
+    ListElement *entry;
 
      QLIST_FOREACH(entry, &glfs_list, list) {
         if (strcmp(entry->saved.volume, volume) == 0) {
@@ -265,7 +265,7 @@ static glfs_t *glfs_find_preopened(const char *volume)
 
 static void glfs_clear_preopened(glfs_t *fs)
 {
-    ListElement *entry = NULL;
+    ListElement *entry;
     ListElement *next;
 
     if (fs == NULL) {
diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index 6817a72e2eb..3f285ff6c78 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -146,7 +146,7 @@ static void acpi_dsdt_add_pci(Aml *scope, const MemMapEntry *memmap,
 {
     int ecam_id = VIRT_ECAM_ID(vms->highmem_ecam);
     bool cxl_present = false;
-    PCIBus *bus = vms->bus;
+    PCIBus *bus;
     bool acpi_pcihp = false;
 
     if (vms->acpi_dev) {
diff --git a/hw/i386/xen/xen-hvm.c b/hw/i386/xen/xen-hvm.c
index 67d3e836eb1..d3ce082e07a 100644
--- a/hw/i386/xen/xen-hvm.c
+++ b/hw/i386/xen/xen-hvm.c
@@ -184,7 +184,7 @@ static void xen_ram_init(PCMachineState *pcms,
 static XenPhysmap *get_physmapping(hwaddr start_addr, ram_addr_t size,
                                    int page_mask)
 {
-    XenPhysmap *physmap = NULL;
+    XenPhysmap *physmap;
 
     start_addr &= page_mask;
 
@@ -200,7 +200,7 @@ static hwaddr xen_phys_offset_to_gaddr(hwaddr phys_offset, ram_addr_t size,
                                        int page_mask)
 {
     hwaddr addr = phys_offset & page_mask;
-    XenPhysmap *physmap = NULL;
+    XenPhysmap *physmap;
 
     QLIST_FOREACH(physmap, &xen_physmap, list) {
         if (range_covers_byte(physmap->phys_offset, physmap->size, addr)) {
diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index 7ba32405522..5fac1ec3449 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -1678,7 +1678,7 @@ static void riscv_iommu_ats(RISCVIOMMUState *s,
     IOMMUAccessFlags perm,
     void (*trace_fn)(const char *id))
 {
-    RISCVIOMMUSpace *as = NULL;
+    RISCVIOMMUSpace *as;
     IOMMUNotifier *n;
     IOMMUTLBEvent event;
     uint32_t pid;
diff --git a/hw/vfio/cpr-legacy.c b/hw/vfio/cpr-legacy.c
index 033a546c301..c431d899731 100644
--- a/hw/vfio/cpr-legacy.c
+++ b/hw/vfio/cpr-legacy.c
@@ -212,7 +212,7 @@ void vfio_legacy_cpr_unregister_container(VFIOLegacyContainer *container)
 void vfio_cpr_giommu_remap(VFIOContainer *bcontainer,
                            MemoryRegionSection *section)
 {
-    VFIOGuestIOMMU *giommu = NULL;
+    VFIOGuestIOMMU *giommu;
     hwaddr as_offset = section->offset_within_address_space;
     hwaddr iommu_offset = as_offset - section->offset_within_region;
 
diff --git a/hw/vfio/listener.c b/hw/vfio/listener.c
index 31c3113f8fb..0b72a2cf5e5 100644
--- a/hw/vfio/listener.c
+++ b/hw/vfio/listener.c
@@ -333,7 +333,7 @@ static void vfio_ram_discard_unregister_listener(VFIOContainer *bcontainer,
                                                  MemoryRegionSection *section)
 {
     RamDiscardManager *rdm = memory_region_get_ram_discard_manager(section->mr);
-    VFIORamDiscardListener *vrdl = NULL;
+    VFIORamDiscardListener *vrdl;
 
     QLIST_FOREACH(vrdl, &bcontainer->vrdl_list, next) {
         if (vrdl->mr == section->mr &&
@@ -463,7 +463,7 @@ static void vfio_device_error_append(VFIODevice *vbasedev, Error **errp)
 VFIORamDiscardListener *vfio_find_ram_discard_listener(
     VFIOContainer *bcontainer, MemoryRegionSection *section)
 {
-    VFIORamDiscardListener *vrdl = NULL;
+    VFIORamDiscardListener *vrdl;
 
     QLIST_FOREACH(vrdl, &bcontainer->vrdl_list, next) {
         if (vrdl->mr == section->mr &&
diff --git a/hw/xen/xen_pt_config_init.c b/hw/xen/xen_pt_config_init.c
index 3edaeab1e34..bbc82a2bcfa 100644
--- a/hw/xen/xen_pt_config_init.c
+++ b/hw/xen/xen_pt_config_init.c
@@ -62,7 +62,7 @@ static int xen_pt_hide_dev_cap(const XenHostPCIDevice *d, uint8_t grp_id)
 /*   find emulate register group entry */
 XenPTRegGroup *xen_pt_find_reg_grp(XenPCIPassthroughState *s, uint32_t address)
 {
-    XenPTRegGroup *entry = NULL;
+    XenPTRegGroup *entry;
 
     /* find register group entry */
     QLIST_FOREACH(entry, &s->reg_grps, entries) {
@@ -80,7 +80,7 @@ XenPTRegGroup *xen_pt_find_reg_grp(XenPCIPassthroughState *s, uint32_t address)
 /* find emulate register entry */
 XenPTReg *xen_pt_find_reg(XenPTRegGroup *reg_grp, uint32_t address)
 {
-    XenPTReg *reg_entry = NULL;
+    XenPTReg *reg_entry;
     XenPTRegInfo *reg = NULL;
     uint32_t real_offset = 0;
 
-- 
2.53.0

[PULL 105/110] cocci: Do not initialize variable used by QSLIST_FOREACH macro

[Philippe Mathieu-Daudé]

The QSLIST_FOREACH() macro, defined in "qemu/queue.h",
always assigns its iterator variable when entering the
loop. Remove the pointless and possibly misleading
assignment.

Mechanical patch using the following coccinelle spatch:

  @@
  type T;
  identifier e;
  iterator FOREACH_MACRO =~ ".*_FOREACH.*";
  statement S;
  @@
  -    T *e = ...;
  +    T *e;
       ... when != e
       FOREACH_MACRO(e, ...) S

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Message-Id: <20260415215539.92629-3-philmd@linaro.org>
---
 ebpf/ebpf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ebpf/ebpf.c b/ebpf/ebpf.c
index 2d73beb4796..a8d441b02c1 100644
--- a/ebpf/ebpf.c
+++ b/ebpf/ebpf.c
@@ -40,7 +40,7 @@ void ebpf_register_binary_data(int id, const void *data, size_t datalen)
 
 const void *ebpf_find_binary_by_id(int id, size_t *sz, Error **errp)
 {
-    struct ElfBinaryDataEntry *it = NULL;
+    struct ElfBinaryDataEntry *it;
     QSLIST_FOREACH(it, &ebpf_elf_obj_list, node) {
         if (id == it->id) {
             *sz = it->datalen;
-- 
2.53.0

[PULL 106/110] cocci: Do not initialize variable used by QSIMPLEQ_FOREACH macro

[Philippe Mathieu-Daudé]

The QSIMPLEQ_FOREACH() macro, defined in "qemu/queue.h",
always assigns its iterator variable when entering the
loop. Remove the pointless and possibly misleading
assignment.

Mechanical patch using the following coccinelle spatch:

  @@
  type T;
  identifier e;
  iterator FOREACH_MACRO =~ ".*_FOREACH.*";
  statement S;
  @@
  -    T *e = ...;
  +    T *e;
       ... when != e
       FOREACH_MACRO(e, ...) S

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Message-Id: <20260415215539.92629-4-philmd@linaro.org>
---
 block/blkdebug.c               | 2 +-
 migration/block-dirty-bitmap.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/block/blkdebug.c b/block/blkdebug.c
index 8a4a8cb85ea..fdc96d1f45d 100644
--- a/block/blkdebug.c
+++ b/block/blkdebug.c
@@ -591,7 +591,7 @@ static int coroutine_fn rule_check(BlockDriverState *bs, uint64_t offset,
                                    uint64_t bytes, BlkdebugIOType iotype)
 {
     BDRVBlkdebugState *s = bs->opaque;
-    BlkdebugRule *rule = NULL;
+    BlkdebugRule *rule;
     int error;
     bool immediately;
 
diff --git a/migration/block-dirty-bitmap.c b/migration/block-dirty-bitmap.c
index a061aad8177..87009c45182 100644
--- a/migration/block-dirty-bitmap.c
+++ b/migration/block-dirty-bitmap.c
@@ -1216,7 +1216,7 @@ fail:
 static int dirty_bitmap_save_setup(QEMUFile *f, void *opaque, Error **errp)
 {
     DBMSaveState *s = &((DBMState *)opaque)->save;
-    SaveBitmapState *dbms = NULL;
+    SaveBitmapState *dbms;
 
     if (init_dirty_bitmap_migration(s, errp) < 0) {
         return -1;
-- 
2.53.0

[PULL 107/110] cocci: Do not initialize variable used by QTAILQ_FOREACH macro

[Philippe Mathieu-Daudé]

The QTAILQ_FOREACH() macro, defined in "qemu/queue.h",
always assigns its iterator variable when entering the
loop. Remove the pointless and possibly misleading
assignment.

Mechanical patch using the following coccinelle spatch:

  @@
  type T;
  identifier e;
  iterator FOREACH_MACRO =~ ".*_FOREACH.*";
  statement S;
  @@
  -    T *e = ...;
  +    T *e;
       ... when != e
       FOREACH_MACRO(e, ...) S

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Message-Id: <20260415215539.92629-5-philmd@linaro.org>
---
 hw/ppc/spapr.c                   | 2 +-
 hw/ppc/spapr_events.c            | 4 ++--
 net/colo-compare.c               | 4 ++--
 net/net.c                        | 2 +-
 target/s390x/kvm/stsi-topology.c | 2 +-
 5 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 428b491a7df..d40af312fae 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -3685,7 +3685,7 @@ struct SpaprDimmState {
 static SpaprDimmState *spapr_pending_dimm_unplugs_find(SpaprMachineState *s,
                                                        PCDIMMDevice *dimm)
 {
-    SpaprDimmState *dimm_state = NULL;
+    SpaprDimmState *dimm_state;
 
     QTAILQ_FOREACH(dimm_state, &s->pending_dimm_unplugs, next) {
         if (dimm_state->dimm == dimm) {
diff --git a/hw/ppc/spapr_events.c b/hw/ppc/spapr_events.c
index 1a21ac7bbf8..ab23e3f477b 100644
--- a/hw/ppc/spapr_events.c
+++ b/hw/ppc/spapr_events.c
@@ -460,7 +460,7 @@ static void rtas_event_log_queue(SpaprMachineState *spapr,
 static SpaprEventLogEntry *rtas_event_log_dequeue(SpaprMachineState *spapr,
                                                   uint32_t event_mask)
 {
-    SpaprEventLogEntry *entry = NULL;
+    SpaprEventLogEntry *entry;
 
     QTAILQ_FOREACH(entry, &spapr->pending_events, next) {
         const SpaprEventSource *source =
@@ -482,7 +482,7 @@ static SpaprEventLogEntry *rtas_event_log_dequeue(SpaprMachineState *spapr,
 
 static bool rtas_event_log_contains(SpaprMachineState *spapr, uint32_t event_mask)
 {
-    SpaprEventLogEntry *entry = NULL;
+    SpaprEventLogEntry *entry;
 
     QTAILQ_FOREACH(entry, &spapr->pending_events, next) {
         const SpaprEventSource *source =
diff --git a/net/colo-compare.c b/net/colo-compare.c
index c356419d6a8..abc1326b704 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -1396,7 +1396,7 @@ static void colo_compare_init(Object *obj)
 
 void colo_compare_cleanup(void)
 {
-    CompareState *tmp = NULL;
+    CompareState *tmp;
     CompareState *n = NULL;
 
     QTAILQ_FOREACH_SAFE(tmp, &net_compares, next, n) {
@@ -1407,7 +1407,7 @@ void colo_compare_cleanup(void)
 static void colo_compare_finalize(Object *obj)
 {
     CompareState *s = COLO_COMPARE(obj);
-    CompareState *tmp = NULL;
+    CompareState *tmp;
 
     qemu_mutex_lock(&colo_compare_mutex);
     QTAILQ_FOREACH(tmp, &net_compares, next) {
diff --git a/net/net.c b/net/net.c
index a176936f9bc..2892f1730d1 100644
--- a/net/net.c
+++ b/net/net.c
@@ -653,7 +653,7 @@ static ssize_t filter_receive_iov(NetClientState *nc,
                                   NetPacketSent *sent_cb)
 {
     ssize_t ret = 0;
-    NetFilterState *nf = NULL;
+    NetFilterState *nf;
 
     if (direction == NET_FILTER_DIRECTION_TX) {
         QTAILQ_FOREACH(nf, &nc->filters, next) {
diff --git a/target/s390x/kvm/stsi-topology.c b/target/s390x/kvm/stsi-topology.c
index c8d6389cd87..301d41b68d2 100644
--- a/target/s390x/kvm/stsi-topology.c
+++ b/target/s390x/kvm/stsi-topology.c
@@ -285,7 +285,7 @@ static void s390_topology_fill_list_sorted(S390TopologyList *topology_list)
  */
 static void s390_topology_empty_list(S390TopologyList *topology_list)
 {
-    S390TopologyEntry *entry = NULL;
+    S390TopologyEntry *entry;
     S390TopologyEntry *tmp = NULL;
 
     QTAILQ_FOREACH_SAFE(entry, topology_list, next, tmp) {
-- 
2.53.0

[PULL 108/110] cocci: Do not initialize variable used by RAMBLOCK_FOREACH* macro

[Philippe Mathieu-Daudé]

The RAMBLOCK_FOREACH_MIGRATABLE() macro, defined in
migration/ram.h, ends up calling QLIST_FOREACH_RCU()
which always assigns its iterator variable when entering
the loop. Remove the pointless and possibly misleading
assignment.

Mechanical patch using the following coccinelle spatch:

  @@
  type T;
  identifier e;
  iterator FOREACH_MACRO =~ ".*_FOREACH.*";
  statement S;
  @@
  -    T *e = ...;
  +    T *e;
       ... when != e
       FOREACH_MACRO(e, ...) S

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Message-Id: <20260415215539.92629-6-philmd@linaro.org>
---
 migration/dirtyrate.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/migration/dirtyrate.c b/migration/dirtyrate.c
index 58f04670629..b360f49efea 100644
--- a/migration/dirtyrate.c
+++ b/migration/dirtyrate.c
@@ -485,7 +485,7 @@ static bool record_ramblock_hash_info(struct RamblockDirtyInfo **block_dinfo,
 {
     struct RamblockDirtyInfo *info = NULL;
     struct RamblockDirtyInfo *dinfo = NULL;
-    RAMBlock *block = NULL;
+    RAMBlock *block;
     int total_count = 0;
     int index = 0;
     bool ret = false;
@@ -568,7 +568,7 @@ static bool compare_page_hash_info(struct RamblockDirtyInfo *info,
                                   int block_count)
 {
     struct RamblockDirtyInfo *block_dinfo = NULL;
-    RAMBlock *block = NULL;
+    RAMBlock *block;
 
     RAMBLOCK_FOREACH_MIGRATABLE(block) {
         if (skip_sample_ramblock(block)) {
-- 
2.53.0

[PULL 109/110] scripts/checkpatch: Avoid false positive on empty blocks

[Philippe Mathieu-Daudé]

From: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>

SUSPECT_CODE_INDENT checks the first line after a conditional statement.
When the block is empty, the first line after the conditional is the
closing brace at the same indentation level, so checkpatch reports a
bogus indentation error.

Ignore same-indented braces and else statements, matching with:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f6950a735f29e782bc219ece22bb91d6e1ab7bbc

Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Message-ID: <20260424-force_rcu-v4-6-feccfaca0568@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 scripts/checkpatch.pl | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index d440553a7ed..2189db19f54 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -2283,7 +2283,8 @@ sub process {
 			#print "line<$line> prevline<$prevline> indent<$indent> sindent<$sindent> check<$check> continuation<$continuation> s<$s> cond_lines<$cond_lines> stat_real<$stat_real> stat<$stat>\n";
 
 			if ($check && (($sindent % 4) != 0 ||
-			    ($sindent <= $indent && $s ne ''))) {
+			    ($sindent <= $indent &&
+			     $s !~ /^\s*(?:\}|\{|else\b)/))) {
 				ERROR("suspect code indent for conditional statements ($indent, $sindent)\n" . $herecurr . "$stat_real\n");
 			}
 		}
-- 
2.53.0

[PULL 110/110] system/vl: inline qemu_opts_parse_noisily() result checks

[Philippe Mathieu-Daudé]

From: Bin Guo <guobin@linux.alibaba.com>

In qemu_init()'s option parsing switch, several cases assigned the
return value of qemu_opts_parse_noisily() to the shared 'opts'
variable solely to check for NULL, without using the pointer
afterwards.  Inline the call directly into the if-condition, matching
the style already used by QEMU_OPTION_action.

This affects the following options:
  -drive, -numa, -iscsi, -m, -mon, -chardev, -fsdev, -fwcfg

Cases where the returned QemuOpts* is subsequently used (e.g.
-acpitable, -smbios, -virtfs) are left unchanged.

Signed-off-by: Bin Guo <guobin@linux.alibaba.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260429062004.36582-4-guobin@linux.alibaba.com>
[PMD: Reduce @opts declaration to innermost block]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 system/vl.c | 39 ++++++++++++++++-----------------------
 1 file changed, 16 insertions(+), 23 deletions(-)

diff --git a/system/vl.c b/system/vl.c
index 705f0d3a4a9..d2f4044e5d8 100644
--- a/system/vl.c
+++ b/system/vl.c
@@ -2842,7 +2842,6 @@ void qmp_x_exit_preconfig(Error **errp)
 
 void qemu_init(int argc, char **argv)
 {
-    QemuOpts *opts;
     QemuOpts *icount_opts = NULL, *accel_opts = NULL;
     QemuOptsList *olist;
     int optind;
@@ -2928,6 +2927,7 @@ void qemu_init(int argc, char **argv)
             drive_add(IF_DEFAULT, 0, argv[optind++], HD_OPTS);
         } else {
             const QEMUOption *popt;
+            QemuOpts *opts;
 
             popt = lookup_opt(argc, argv, &optarg, &optind);
             if (!qemu_arch_available(popt->arch_mask)) {
@@ -2963,9 +2963,8 @@ void qemu_init(int argc, char **argv)
                     break;
                 }
             case QEMU_OPTION_drive:
-                opts = qemu_opts_parse_noisily(qemu_find_opts("drive"),
-                                               optarg, false);
-                if (opts == NULL) {
+                if (!qemu_opts_parse_noisily(qemu_find_opts("drive"),
+                                             optarg, false)) {
                     exit(1);
                 }
                 break;
@@ -2990,9 +2989,8 @@ void qemu_init(int argc, char **argv)
                 replay_add_blocker("-snapshot");
                 break;
             case QEMU_OPTION_numa:
-                opts = qemu_opts_parse_noisily(qemu_find_opts("numa"),
-                                               optarg, true);
-                if (!opts) {
+                if (!qemu_opts_parse_noisily(qemu_find_opts("numa"),
+                                             optarg, true)) {
                     exit(1);
                 }
                 break;
@@ -3051,9 +3049,8 @@ void qemu_init(int argc, char **argv)
                 break;
 #ifdef CONFIG_LIBISCSI
             case QEMU_OPTION_iscsi:
-                opts = qemu_opts_parse_noisily(qemu_find_opts("iscsi"),
-                                               optarg, false);
-                if (!opts) {
+                if (!qemu_opts_parse_noisily(qemu_find_opts("iscsi"),
+                                             optarg, false)) {
                     exit(1);
                 }
                 break;
@@ -3106,8 +3103,8 @@ void qemu_init(int argc, char **argv)
                 exit(0);
                 break;
             case QEMU_OPTION_m:
-                opts = qemu_opts_parse_noisily(qemu_find_opts("memory"), optarg, true);
-                if (opts == NULL) {
+                if (!qemu_opts_parse_noisily(qemu_find_opts("memory"),
+                                             optarg, true)) {
                     exit(1);
                 }
                 break;
@@ -3228,17 +3225,15 @@ void qemu_init(int argc, char **argv)
                 default_monitor = 0;
                 break;
             case QEMU_OPTION_mon:
-                opts = qemu_opts_parse_noisily(qemu_find_opts("mon"), optarg,
-                                               true);
-                if (!opts) {
+                if (!qemu_opts_parse_noisily(qemu_find_opts("mon"), optarg,
+                                             true)) {
                     exit(1);
                 }
                 default_monitor = 0;
                 break;
             case QEMU_OPTION_chardev:
-                opts = qemu_opts_parse_noisily(qemu_find_opts("chardev"),
-                                               optarg, true);
-                if (!opts) {
+                if (!qemu_opts_parse_noisily(qemu_find_opts("chardev"),
+                                             optarg, true)) {
                     exit(1);
                 }
                 break;
@@ -3248,8 +3243,7 @@ void qemu_init(int argc, char **argv)
                     error_report("fsdev support is disabled");
                     exit(1);
                 }
-                opts = qemu_opts_parse_noisily(olist, optarg, true);
-                if (!opts) {
+                if (!qemu_opts_parse_noisily(olist, optarg, true)) {
                     exit(1);
                 }
                 break;
@@ -3388,9 +3382,8 @@ void qemu_init(int argc, char **argv)
                 smbios_entry_add(opts, &error_fatal);
                 break;
             case QEMU_OPTION_fwcfg:
-                opts = qemu_opts_parse_noisily(qemu_find_opts("fw_cfg"),
-                                               optarg, true);
-                if (opts == NULL) {
+                if (!qemu_opts_parse_noisily(qemu_find_opts("fw_cfg"),
+                                             optarg, true)) {
                     exit(1);
                 }
                 break;
-- 
2.53.0

Re: [PULL 000/110] Single binary patches

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 116 bytes --]

Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/11.1 for any user-visible changes.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]