[PULL 0/6] tcg patch queue

[PULL 0/6] tcg patch queue

[Richard Henderson]

Mini PR, aimed at fixing the mips and ovmf regressions.


r~

The following changes since commit 36e9aab3c569d4c9ad780473596e18479838d1aa:

  migration: Move return path cleanup to main migration thread (2023-09-27 13:58:02 -0400)

are available in the Git repository at:

  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20230928

for you to fetch changes up to 18a536f1f8d6222e562f59179e837fdfd8b92718:

  accel/tcg: Always require can_do_io (2023-09-28 10:08:13 -0700)

----------------------------------------------------------------
accel/tcg: Always require can_do_io, for #1866

----------------------------------------------------------------
Richard Henderson (6):
      accel/tcg: Avoid load of icount_decr if unused
      accel/tcg: Hoist CF_MEMI_ONLY check outside translation loop
      accel/tcg: Track current value of can_do_io in the TB
      accel/tcg: Improve setting of can_do_io at start of TB
      accel/tcg: Always set CF_LAST_IO with CF_NOIRQ
      accel/tcg: Always require can_do_io

 include/exec/translator.h   |  2 ++
 accel/tcg/cpu-exec.c        |  2 +-
 accel/tcg/tb-maint.c        |  6 ++--
 accel/tcg/translator.c      | 72 +++++++++++++++++++++------------------------
 target/mips/tcg/translate.c |  1 -
 5 files changed, 41 insertions(+), 42 deletions(-)

Re: [PULL 0/6] tcg patch queue

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 115 bytes --]

Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/8.2 for any user-visible changes.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [PULL 0/6] tcg patch queue

[Michael Tokarev]

28.09.2023 22:41, Richard Henderson wrote
> Mini PR, aimed at fixing the mips and ovmf regressions.
> r~
> ----------------------------------------------------------------
> accel/tcg: Always require can_do_io, for #1866
> 
> ----------------------------------------------------------------
> Richard Henderson (6):
>        accel/tcg: Avoid load of icount_decr if unused
>        accel/tcg: Hoist CF_MEMI_ONLY check outside translation loop
>        accel/tcg: Track current value of can_do_io in the TB
>        accel/tcg: Improve setting of can_do_io at start of TB
>        accel/tcg: Always set CF_LAST_IO with CF_NOIRQ
>        accel/tcg: Always require can_do_io

What's the set required for the regression fix for -stable ?
Is it the whole thing?
(yes, I tested the complete set in debian).

Thank you!

/mjt

Re: [PULL 0/6] tcg patch queue

[Richard Henderson]

On 10/2/23 15:46, Michael Tokarev wrote:
> 28.09.2023 22:41, Richard Henderson wrote
>> Mini PR, aimed at fixing the mips and ovmf regressions.
>> r~
>> ----------------------------------------------------------------
>> accel/tcg: Always require can_do_io, for #1866
>>
>> ----------------------------------------------------------------
>> Richard Henderson (6):
>>        accel/tcg: Avoid load of icount_decr if unused
>>        accel/tcg: Hoist CF_MEMI_ONLY check outside translation loop
>>        accel/tcg: Track current value of can_do_io in the TB
>>        accel/tcg: Improve setting of can_do_io at start of TB
>>        accel/tcg: Always set CF_LAST_IO with CF_NOIRQ
>>        accel/tcg: Always require can_do_io
> 
> What's the set required for the regression fix for -stable ?
> Is it the whole thing?
> (yes, I tested the complete set in debian).

While it would be possible to take fewer to just fix the regression, it's probably best to 
take the whole set.


r~

[PULL 0/6] tcg patch queue

[Richard Henderson]

The following changes since commit baa79455fa92984ff0f4b9ae94bed66823177a27:

  Merge tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu into staging (2025-09-03 11:39:16 +0200)

are available in the Git repository at:

  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20250905

for you to fetch changes up to cb2540979264c8d3984e26c5dd90a840e47ec5dd:

  tcg/i386: Use vgf2p8affineqb for MO_8 vector shifts (2025-09-04 09:49:30 +0200)

----------------------------------------------------------------
tcg/arm: Fix tgen_deposit
tcg/i386: Use vgf2p8affineqb for MO_8 vector shifts

----------------------------------------------------------------
Richard Henderson (6):
      tcg/arm: Fix tgen_deposit
      cpuinfo/i386: Detect GFNI as an AVX extension
      tcg/i386: Expand sari of bits-1 as pcmpgt
      tcg/i386: Use canonical operand ordering in expand_vec_sari
      tcg/i386: Add INDEX_op_x86_vgf2p8affineqb_vec
      tcg/i386: Use vgf2p8affineqb for MO_8 vector shifts

 host/include/i386/host/cpuinfo.h |  1 +
 include/qemu/cpuid.h             |  3 ++
 util/cpuinfo-i386.c              |  1 +
 tcg/arm/tcg-target.c.inc         |  3 +-
 tcg/i386/tcg-target-opc.h.inc    |  1 +
 tcg/i386/tcg-target.c.inc        | 91 +++++++++++++++++++++++++++++++++++++---
 6 files changed, 93 insertions(+), 7 deletions(-)

Re: [PULL 0/6] tcg patch queue

[Richard Henderson]

On 9/5/25 09:50, Richard Henderson wrote:
> The following changes since commit baa79455fa92984ff0f4b9ae94bed66823177a27:
> 
>    Merge tag 'pull-trivial-patches' ofhttps://gitlab.com/mjt0k/qemu into staging (2025-09-03 11:39:16 +0200)
> 
> are available in the Git repository at:
> 
>    https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20250905
> 
> for you to fetch changes up to cb2540979264c8d3984e26c5dd90a840e47ec5dd:
> 
>    tcg/i386: Use vgf2p8affineqb for MO_8 vector shifts (2025-09-04 09:49:30 +0200)
> 
> ----------------------------------------------------------------
> tcg/arm: Fix tgen_deposit
> tcg/i386: Use vgf2p8affineqb for MO_8 vector shifts


Applied, thanks.  Please update https://wiki.qemu.org/ChangeLog/10.2 as appropriate.

r~

[PULL 0/6] tcg patch queue

[Richard Henderson]

The following changes since commit 864814f71b4cbb2e65bc83a502e63b3cbdd43b0f:

  Merge tag 'for-upstream' of https://repo.or.cz/qemu/kevin into staging (2025-12-04 13:37:46 -0600)

are available in the Git repository at:

  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20251205

for you to fetch changes up to ff633bc5d55a309122d306a83d09a4362de28b65:

  include/aarch64/host: Fix atomic16_fetch_{and,or} (2025-12-05 07:50:15 -0600)

----------------------------------------------------------------
tcg: fixes for tci
host: fixes for 128-bit atomics

----------------------------------------------------------------
Richard Henderson (6):
      tcg: Zero extend 32-bit addresses for TCI
      tcg/tci: Introduce INDEX_op_tci_qemu_{ld,st}_rrr
      tcg: Remove duplicate test from plugin_gen_mem_callbacks
      tcg/tci: Disable -Wundef FFI_GO_CLOSURES warning
      include/generic/host: Fix atomic128-cas.h.inc for Int128 structure
      include/aarch64/host: Fix atomic16_fetch_{and,or}

 include/tcg/helper-info.h                     | 12 ++++
 tcg/tcg-op-ldst.c                             | 96 ++++++++++++++++++++-------
 tcg/tci.c                                     | 19 ++++++
 host/include/aarch64/host/atomic128-cas.h.inc | 12 ++--
 host/include/generic/host/atomic128-cas.h.inc | 24 ++++---
 tcg/tci/tcg-target-opc.h.inc                  |  2 +
 tcg/tci/tcg-target.c.inc                      | 14 +++-
 7 files changed, 138 insertions(+), 41 deletions(-)

Re: [PULL 0/6] tcg patch queue

[Richard Henderson]

On 12/5/25 10:20, Richard Henderson wrote:
> The following changes since commit 864814f71b4cbb2e65bc83a502e63b3cbdd43b0f:
> 
>    Merge tag 'for-upstream' ofhttps://repo.or.cz/qemu/kevin into staging (2025-12-04 13:37:46 -0600)
> 
> are available in the Git repository at:
> 
>    https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20251205
> 
> for you to fetch changes up to ff633bc5d55a309122d306a83d09a4362de28b65:
> 
>    include/aarch64/host: Fix atomic16_fetch_{and,or} (2025-12-05 07:50:15 -0600)
> 
> ----------------------------------------------------------------
> tcg: fixes for tci
> host: fixes for 128-bit atomics


Applied, thanks.  Please update https://wiki.qemu.org/ChangeLog/10.2 as appropriate.

r~

[PULL 0/6] tcg patch queue

[Richard Henderson]

The following changes since commit 94826ec1370328375c3b6d1e80fdc94c8f46c348:

  Merge tag 'accel-20260706' of https://github.com/philmd/qemu into staging (2026-07-06 18:38:14 +0200)

are available in the Git repository at:

  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20260707

for you to fetch changes up to c56ebd64b82aa4d4a4e2144abbf9568ef593b836:

  tcg/loongarch64: Fix cmp_vec with TCG_COND_NE (2026-07-07 11:16:05 -0700)

----------------------------------------------------------------
tcg/loongarch64: Fix cmp_vec with TCG_COND_NE
tcg/x86_64: declare MO_ATOM_WITHIN16 host atomicity support
accel/tcg: Make PageFlagsNodes' start and last immutable
accel/tcg: Use TLB_FORCE_SLOW not TLB_MMIO for user-only plugins

----------------------------------------------------------------
Andrew Jones (1):
      tcg/x86_64: declare MO_ATOM_WITHIN16 host atomicity support

Ilya Leoshkevich (3):
      accel/tcg: Make PageFlagsNodes' start and last immutable
      tests/tcg/multiarch: Improve mutator randomness
      Revert "tests/tcg: skip the vma-pthread test on CI"

Richard Henderson (2):
      accel/tcg: Use TLB_FORCE_SLOW not TLB_MMIO for user-only plugins
      tcg/loongarch64: Fix cmp_vec with TCG_COND_NE

 include/exec/tlb-flags.h            |  7 ++++---
 accel/tcg/user-exec.c               | 41 +++++++++++++++++++++----------------
 tests/tcg/multiarch/vma-pthread.c   |  3 ++-
 tcg/loongarch64/tcg-target.c.inc    | 39 +++++++++++++++++++++++++----------
 tcg/x86_64/tcg-target.c.inc         |  4 ++--
 tests/tcg/multiarch/Makefile.target |  9 --------
 6 files changed, 59 insertions(+), 44 deletions(-)

[PULL 1/6] accel/tcg: Use TLB_FORCE_SLOW not TLB_MMIO for user-only plugins

[Richard Henderson]

In 6d03226b422 we set TLB_MMIO to a non-zero value for user-only
so that we could return a non-zero value from probe_* functions
so that we could force callers like Arm SVE vector moves to use
the slow path rather than direct access.  All for the sake of
exposing these accesses to plugins.

Back then, TLB_FORCE_SLOW did not exist, so TLB_MMIO seemed like
a reasonable solution.  However, user-only doesn't really have
MMIO and this has knock-on effects, like forcing Arm SVE first-fault
vector loads to stop.  Better to use TLB_FORCE_SLOW as a more exact
trigger for plugins.

Cc: qemu-stable@nongnu.org
Fixes: 6d03226b422 ("plugins: force slow path when plugins instrument memory ops")
Acked-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260702171057.47998-1-richard.henderson@linaro.org>
---
 include/exec/tlb-flags.h | 7 ++++---
 accel/tcg/user-exec.c    | 4 ++--
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/include/exec/tlb-flags.h b/include/exec/tlb-flags.h
index 357e79095c..e12cddf234 100644
--- a/include/exec/tlb-flags.h
+++ b/include/exec/tlb-flags.h
@@ -27,12 +27,13 @@
 
 /*
  * Allow some level of source compatibility with softmmu.
- * Invalid is set when the page does not have requested permissions.
- * MMIO is set when we want the target helper to use the functional
+ * INVALID is set when the page does not have requested permissions.
+ * FORCE_SLOW is set when we want the target helper to use the functional
  * interface for load/store so that plugins see the access.
  */
 #define TLB_INVALID_MASK     (1 << 0)
-#define TLB_MMIO             (1 << 1)
+#define TLB_FORCE_SLOW       (1 << 1)
+#define TLB_MMIO             0
 #define TLB_WATCHPOINT       0
 
 #else
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 7704e4017d..e4629b837d 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -769,7 +769,7 @@ static int probe_access_internal(CPUArchState *env, vaddr addr,
         if (page_flags & acc_flag) {
             if (access_type != MMU_INST_FETCH
                 && cpu_plugin_mem_cbs_enabled(env_cpu(env))) {
-                return TLB_MMIO;
+                return TLB_FORCE_SLOW;
             }
             return 0; /* success */
         }
@@ -804,7 +804,7 @@ void *probe_access(CPUArchState *env, vaddr addr, int size,
 
     g_assert(-(addr | TARGET_PAGE_MASK) >= size);
     flags = probe_access_internal(env, addr, size, access_type, false, ra);
-    g_assert((flags & ~TLB_MMIO) == 0);
+    g_assert((flags & ~TLB_FORCE_SLOW) == 0);
 
     return size ? g2h_vaddr(env_cpu(env), addr) : NULL;
 }
-- 
2.43.0

[PULL 2/6] accel/tcg: Make PageFlagsNodes' start and last immutable

[Richard Henderson]

From: Ilya Leoshkevich <iii@linux.ibm.com>

page_check_range() may race with pageflags_set_clear() as follows:

    T1                                     T2
    -------------------------------------  --------------------------------
                                           p = pageflags_find(start, last);
    interval_tree_remove(&p->itree, ...);
    p->itree.start = last + 1;
                                           if (start < p->itree.start) {
                                               ret = false;
    interval_tree_insert(&p->itree, ...);

leading to errors like

    fail indirect write 0x72f0a659aff0 (Bad address)

in vma-pthread test. I am able to reliably reproduce this on a machine
with 32 SMT threads as follows in about 25 seconds:

    jobs=32; \
    seq "$jobs" | \
        time -p parallel \
            --jobs="$jobs" \
            --halt=now,done=1 \
            --ungroup \
            '
                _={};
                while ./qemu-s390x tests/tcg/s390x-linux-user/vma-pthread; do
                    printf .;
                done
            '

Also wasmtime project reported a similar failure pattern in their CI [1]
with a similar reproducer [2].

There are other races like this. In general, region bounds mutating
underneath the reader are very hard to reason about. So fix this by
preventing mutations and creating copies instead. Use RCU guards in
readers to avoid uses-after-frees.

Now, when the reader finds a node, it may fearlessly access its fields
and be certain that at some point in time the respective region had the
respective bounds and permissions. The downside is slightly more
expensive mprotect(), but complexity reduction is worth it.

Lockless field accesses should probably be wrapped in qatomic_read(),
but this is a pre-existing issue, so do not change it here.

[1] https://github.com/bytecodealliance/wasmtime/issues/10000
[2] https://gist.github.com/alexcrichton/f14f23a892ffb9df2522754572d51b1c

Cc: qemu-stable@nongnu.org
Reported-by: Alex Crichton <alex@alexcrichton.com>
Reported-by: Ulrich Weigand <ulrich.weigand@de.ibm.com>
Fixes: 67ff2186b0a4 ("accel/tcg: Use interval tree for user-only page tracking")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260706165445.57418-2-iii@linux.ibm.com>
---
 accel/tcg/user-exec.c | 37 +++++++++++++++++++++----------------
 1 file changed, 21 insertions(+), 16 deletions(-)

diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index e4629b837d..a35aca7889 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -239,13 +239,16 @@ void page_dump(FILE *f)
 
 int page_get_flags(vaddr address)
 {
-    PageFlagsNode *p = pageflags_find(address, address);
+    PageFlagsNode *p;
+
+    RCU_READ_LOCK_GUARD();
 
     /*
      * See util/interval-tree.c re lockless lookups: no false positives but
      * there are false negatives.  If we find nothing, retry with the mmap
      * lock acquired.
      */
+    p = pageflags_find(address, address);
     if (p) {
         return p->flags;
     }
@@ -301,15 +304,15 @@ static void pageflags_create_merge(vaddr start, vaddr last, int flags)
 
     if (prev) {
         if (next) {
-            prev->itree.last = next->itree.last;
+            pageflags_create(prev->itree.start, next->itree.last, flags);
             g_free_rcu(next, rcu);
         } else {
-            prev->itree.last = last;
+            pageflags_create(prev->itree.start, last, flags);
         }
-        interval_tree_insert(&prev->itree, &pageflags_root);
+        g_free_rcu(prev, rcu);
     } else if (next) {
-        next->itree.start = start;
-        interval_tree_insert(&next->itree, &pageflags_root);
+        pageflags_create(start, next->itree.last, flags);
+        g_free_rcu(next, rcu);
     } else {
         pageflags_create(start, last, flags);
     }
@@ -371,8 +374,8 @@ static bool pageflags_set_clear(vaddr start, vaddr last,
     if (set_flags != merge_flags) {
         if (p_start < start) {
             interval_tree_remove(&p->itree, &pageflags_root);
-            p->itree.last = start - 1;
-            interval_tree_insert(&p->itree, &pageflags_root);
+            pageflags_create(p_start, start - 1, p_flags);
+            g_free_rcu(p, rcu);
 
             if (last < p_last) {
                 if (merge_flags & PAGE_VALID) {
@@ -394,11 +397,11 @@ static bool pageflags_set_clear(vaddr start, vaddr last,
             }
             if (last < p_last) {
                 interval_tree_remove(&p->itree, &pageflags_root);
-                p->itree.start = last + 1;
-                interval_tree_insert(&p->itree, &pageflags_root);
+                pageflags_create(last + 1, p_last, p_flags);
                 if (merge_flags & PAGE_VALID) {
                     pageflags_create(start, last, merge_flags);
                 }
+                g_free_rcu(p, rcu);
             } else {
                 if (merge_flags & PAGE_VALID) {
                     p->flags = merge_flags;
@@ -419,8 +422,8 @@ static bool pageflags_set_clear(vaddr start, vaddr last,
     if (set_flags == p_flags) {
         if (start < p_start) {
             interval_tree_remove(&p->itree, &pageflags_root);
-            p->itree.start = start;
-            interval_tree_insert(&p->itree, &pageflags_root);
+            pageflags_create(start, p_last, p_flags);
+            g_free_rcu(p, rcu);
         }
         if (p_last < last) {
             start = p_last + 1;
@@ -432,8 +435,8 @@ static bool pageflags_set_clear(vaddr start, vaddr last,
     /* Maybe split out head and/or tail ranges with the original flags. */
     interval_tree_remove(&p->itree, &pageflags_root);
     if (p_start < start) {
-        p->itree.last = start - 1;
-        interval_tree_insert(&p->itree, &pageflags_root);
+        pageflags_create(p_start, start - 1, p_flags);
+        g_free_rcu(p, rcu);
 
         if (p_last < last) {
             goto restart;
@@ -442,8 +445,8 @@ static bool pageflags_set_clear(vaddr start, vaddr last,
             pageflags_create(last + 1, p_last, p_flags);
         }
     } else if (last < p_last) {
-        p->itree.start = last + 1;
-        interval_tree_insert(&p->itree, &pageflags_root);
+        pageflags_create(last + 1, p_last, p_flags);
+        g_free_rcu(p, rcu);
     } else {
         g_free_rcu(p, rcu);
         goto restart;
@@ -505,6 +508,8 @@ bool page_check_range(vaddr start, vaddr len, int flags)
         return false; /* wrap around */
     }
 
+    RCU_READ_LOCK_GUARD();
+
     locked = have_mmap_lock();
     while (true) {
         PageFlagsNode *p = pageflags_find(start, last);
-- 
2.43.0

[PULL 3/6] tests/tcg/multiarch: Improve mutator randomness

[Richard Henderson]

From: Ilya Leoshkevich <iii@linux.ibm.com>

Currently mutators perform the same actions, because the RNG seed is
derived from the current time in seconds. Mix in thread ID.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260706165445.57418-3-iii@linux.ibm.com>
---
 tests/tcg/multiarch/vma-pthread.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tests/tcg/multiarch/vma-pthread.c b/tests/tcg/multiarch/vma-pthread.c
index 7045da08fc..0b8ce9751b 100644
--- a/tests/tcg/multiarch/vma-pthread.c
+++ b/tests/tcg/multiarch/vma-pthread.c
@@ -11,6 +11,7 @@
  * pages, which are guaranteed to have the respective protection bit set.
  * Two mutator threads change the non-fixed protection bits randomly.
  */
+#define _GNU_SOURCE
 #include <assert.h>
 #include <fcntl.h>
 #include <pthread.h>
@@ -121,7 +122,7 @@ static void *thread_mutate(void *arg)
     unsigned int seed;
     int prot, ret;
 
-    seed = (unsigned int)time(NULL);
+    seed = (unsigned int)time(NULL) + (unsigned int)gettid();
     for (i = 0; i < 10000; i++) {
         start_idx = rand_r(&seed) & PAGE_IDX_MASK;
         end_idx = rand_r(&seed) & PAGE_IDX_MASK;
-- 
2.43.0

[PULL 4/6] Revert "tests/tcg: skip the vma-pthread test on CI"

[Richard Henderson]

From: Ilya Leoshkevich <iii@linux.ibm.com>

Now that the page_check_range() race condition is fixed, let
vma-pthread run on CI again.

This reverts commit 5842de51573fdbd7299ab4b33d64b7446cc07649.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260706165445.57418-4-iii@linux.ibm.com>
---
 tests/tcg/multiarch/Makefile.target | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/tests/tcg/multiarch/Makefile.target b/tests/tcg/multiarch/Makefile.target
index 508149d57b..ab4bf9c5d5 100644
--- a/tests/tcg/multiarch/Makefile.target
+++ b/tests/tcg/multiarch/Makefile.target
@@ -60,15 +60,6 @@ tb-link: LDFLAGS+=-lpthread
 # code to work around the compiler.
 sha1: CFLAGS+=-Wno-stringop-overread -Wno-unknown-warning-option
 
-# The vma-pthread seems very sensitive on gitlab and we currently
-# don't know if its exposing a real bug or the test is flaky.
-ifneq ($(GITLAB_CI),)
-run-vma-pthread: vma-pthread
-	$(call skip-test, $<, "flaky on CI?")
-run-plugin-vma-pthread-with-%: vma-pthread
-	$(call skip-test, $<, "flaky on CI?")
-endif
-
 run-test-mmap: test-mmap
 	$(call run-test, test-mmap, $(QEMU) $<, $< (default))
 
-- 
2.43.0

[PULL 5/6] tcg/x86_64: declare MO_ATOM_WITHIN16 host atomicity support

[Richard Henderson]

From: Andrew Jones <andrew.jones@oss.qualcomm.com>

Just like aarch64's prepare_host_addr(), x86_64 should use
MO_ATOM_WITHIN16 for the memop when it's capable. Unlike aarch64,
which needs to check a CPU feature, x86 has been capable since P6
family processors and newer (see Intel SDM Vol. 3 §11.1.1).

Since a 16-byte aligned region always fits within a 16-byte multiple
sized cache line (x86_64 implementations always have cache lines of
at least 64 bytes), then this enables riscv cpu models with Zama16b
to use the fast path, just as cpu models without Zama16b do.

Cc: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Signed-off-by: Andrew Jones <andrew.jones@oss.qualcomm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
[rth: Update both atom_and_align_for_opc calls]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260707122819.114105-1-andrew.jones@oss.qualcomm.com>
---
 tcg/x86_64/tcg-target.c.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tcg/x86_64/tcg-target.c.inc b/tcg/x86_64/tcg-target.c.inc
index 92251f8327..1fc45e4ec6 100644
--- a/tcg/x86_64/tcg-target.c.inc
+++ b/tcg/x86_64/tcg-target.c.inc
@@ -1783,7 +1783,7 @@ bool tcg_target_has_memory_bswap(MemOp memop)
      * Reject 16-byte memop with 16-byte atomicity, i.e. VMOVDQA,
      * but do allow a pair of 64-bit operations, i.e. MOVBEQ.
      */
-    aa = atom_and_align_for_opc(tcg_ctx, memop, MO_ATOM_IFALIGN, true);
+    aa = atom_and_align_for_opc(tcg_ctx, memop, MO_ATOM_WITHIN16, true);
     return aa.atom < MO_128;
 }
 
@@ -1934,7 +1934,7 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
         *h = x86_guest_base;
     }
     h->base = addr;
-    h->aa = atom_and_align_for_opc(s, opc, MO_ATOM_IFALIGN, s_bits == MO_128);
+    h->aa = atom_and_align_for_opc(s, opc, MO_ATOM_WITHIN16, s_bits == MO_128);
     a_mask = (1 << h->aa.align) - 1;
 
     if (tcg_use_softmmu) {
-- 
2.43.0

[PULL 6/6] tcg/loongarch64: Fix cmp_vec with TCG_COND_NE

[Richard Henderson]

For NE we need to invert EQ, not swap operands.

Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3589
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260623140609.645445-1-richard.henderson@linaro.org>
---
 tcg/loongarch64/tcg-target.c.inc | 39 +++++++++++++++++++++++---------
 1 file changed, 28 insertions(+), 11 deletions(-)

diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index c3350c90fc..182dcfd5eb 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -2371,19 +2371,36 @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
                 default:
                     g_assert_not_reached();
                 }
-                break;
-            }
-
-            insn = cmp_vec_insn[cond][lasx][vece];
-            if (insn == 0) {
-                TCGArg t;
-                t = a1, a1 = a2, a2 = t;
-                cond = tcg_swap_cond(cond);
-                insn = cmp_vec_insn[cond][lasx][vece];
-                tcg_debug_assert(insn != 0);
+            } else {
+                switch (cond) {
+                case TCG_COND_EQ:
+                case TCG_COND_LE:
+                case TCG_COND_LEU:
+                case TCG_COND_LT:
+                case TCG_COND_LTU:
+                    insn = cmp_vec_insn[cond][lasx][vece];
+                    tcg_out32(s, encode_vdvjvk_insn(insn, a0, a1, a2));
+                    break;
+                case TCG_COND_GE:
+                case TCG_COND_GEU:
+                case TCG_COND_GT:
+                case TCG_COND_GTU:
+                    insn = cmp_vec_insn[tcg_swap_cond(cond)][lasx][vece];
+                    tcg_out32(s, encode_vdvjvk_insn(insn, a0, a2, a1));
+                    break;
+                case TCG_COND_NE:
+                    /* ne -> not(eq) */
+                    insn = cmp_vec_insn[TCG_COND_EQ][lasx][vece];
+                    tcg_out32(s, encode_vdvjvk_insn(insn, a0, a1, a2));
+                    insn = lasx ? OPC_XVNOR_V : OPC_VNOR_V;
+                    tcg_out32(s, encode_vdvjvk_insn(insn, a0, a0, a0));
+                    break;
+                default:
+                    g_assert_not_reached();
+                }
             }
         }
-        goto vdvjvk;
+        break;
     case INDEX_op_add_vec:
         tcg_out_addsub_vec(s, lasx, vece, a0, a1, a2, const_args[2], true);
         break;
-- 
2.43.0

Re: [PULL 0/6] tcg patch queue

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 116 bytes --]

Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/11.1 for any user-visible changes.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]